@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/native/run-ops.js

@@ -0,0 +1,3281 @@
+// @bun
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// packages/runtime/src/layout.ts
+import { existsSync } from "fs";
+import { basename, dirname, resolve } from "path";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve(explicit);
+    const explicitParent = dirname(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname(explicitParent);
+      const ownerHasGit = existsSync(resolve(owner, ".git"));
+      const ownerHasTaskConfig = existsSync(resolve(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync(resolve(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync(resolve(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync(resolve(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync(resolve(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname(projectParent);
+    const ownerHasGit = existsSync(resolve(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync(resolve(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync(resolve(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve(workspaceDir);
+  const rigRoot = resolve(root, ".rig");
+  const logsDir = resolve(rigRoot, "logs");
+  const stateDir = resolve(rigRoot, "state");
+  const runtimeDir = resolve(rigRoot, "runtime");
+  const binDir = resolve(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve(rigRoot, "home"),
+    tmpDir: resolve(rigRoot, "tmp"),
+    cacheDir: resolve(rigRoot, "cache"),
+    sessionDir: resolve(rigRoot, "session"),
+    binDir,
+    distDir: resolve(rigRoot, "dist"),
+    pluginBinDir: resolve(binDir, "plugins"),
+    contextPath: resolve(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve(logsDir, "control-plane.events.jsonl")
+  };
+}
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+var init_layout = () => {};
+
+// packages/runtime/src/control-plane/runtime/sandbox/utils.ts
+var init_utils = __esm(() => {
+  init_layout();
+});
+
+// packages/runtime/src/control-plane/native/run-ops.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync2, rmSync as rmSync5, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { randomUUID } from "crypto";
+import { basename as basename6, dirname as dirname11, resolve as resolve14 } from "path";
+
+// packages/runtime/src/binary-run.ts
+init_layout();
+import { chmodSync, cpSync, existsSync as existsSync2, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { drainMicrotasks, gcAndSweep } from "bun:jsc";
+var runtimeBinaryBuildQueue = Promise.resolve();
+async function buildRuntimeBinary(options) {
+  return runSerializedRuntimeBinaryBuild(async () => {
+    const resolved = resolveRuntimeBinaryBuildOptions(options);
+    runBestEffortBuildGc();
+    const manifestPath = runtimeBinaryCacheManifestPath(resolved.outputPath);
+    const buildKey = createRuntimeBinaryBuildKey({
+      entrypoint: resolved.entrypoint,
+      define: resolved.define,
+      env: resolved.env
+    });
+    if (await isRuntimeBinaryBuildFresh({ outputPath: resolved.outputPath, manifestPath, buildKey })) {
+      return;
+    }
+    if (shouldUseRuntimeBinaryBuildWorker()) {
+      await buildRuntimeBinaryViaWorker(resolved);
+    } else {
+      await buildRuntimeBinaryInProcess(resolved, { manifestPath, buildKey });
+    }
+    runBestEffortBuildGc();
+  });
+}
+async function buildRuntimeBinaryInProcess(options, manifest) {
+  const tempBuildDir = resolve2(dirname2(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve2(tempBuildDir, basename2(options.outputPath));
+  mkdirSync(tempBuildDir, { recursive: true });
+  await withTemporaryEnv({
+    ...options.env,
+    ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+  }, async () => withTemporaryCwd(tempBuildDir, async () => {
+    const buildResult = await Bun.build({
+      entrypoints: [options.entrypoint],
+      compile: {
+        target: currentCompileTarget(),
+        outfile: tempOutputPath
+      },
+      target: "bun",
+      format: "esm",
+      minify: true,
+      bytecode: true,
+      metafile: true,
+      define: options.define ? {
+        __RIG_BUILD_CONFIG__: JSON.stringify(options.define)
+      } : undefined
+    });
+    if (!buildResult.success) {
+      const details = buildResult.logs.map((log) => [log.message, log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+      throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
+    }
+    if (!existsSync2(tempOutputPath)) {
+      const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+      throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+    }
+    renameSync(tempOutputPath, options.outputPath);
+    chmodSync(options.outputPath, 493);
+    if (manifest) {
+      await writeRuntimeBinaryCacheManifest({
+        manifestPath: manifest.manifestPath,
+        buildKey: manifest.buildKey,
+        cwd: tempBuildDir,
+        metafile: buildResult.metafile
+      });
+    }
+  })).finally(() => {
+    rmSync(tempBuildDir, { recursive: true, force: true });
+  });
+}
+function runBestEffortBuildGc() {
+  try {
+    drainMicrotasks();
+  } catch {}
+  try {
+    gcAndSweep();
+  } catch {}
+}
+function runtimeBinaryCacheManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function resolveRuntimeBinaryBuildOptions(options) {
+  return {
+    ...options,
+    entrypoint: resolve2(options.cwd, options.sourcePath),
+    outputPath: resolve2(options.outputPath)
+  };
+}
+function shouldUseRuntimeBinaryBuildWorker() {
+  if (process.env.RIG_RUNTIME_BUILD_WORKER === "1") {
+    return false;
+  }
+  if (process.env.RIG_RUNTIME_BUILD_IN_PROCESS === "1") {
+    return false;
+  }
+  return true;
+}
+async function buildRuntimeBinaryViaWorker(options) {
+  const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
+  if (!workerSourcePath || !existsSync2(workerSourcePath)) {
+    await buildRuntimeBinaryInProcess(options, {
+      manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
+      buildKey: createRuntimeBinaryBuildKey({
+        entrypoint: options.entrypoint,
+        define: options.define,
+        env: options.env
+      })
+    });
+    return;
+  }
+  const payloadPath = createRuntimeBinaryBuildWorkerPayloadPath(options.outputPath);
+  const bunCli = resolveRuntimeBinaryBuildWorkerInvocation();
+  await Bun.write(payloadPath, `${JSON.stringify(options)}
+`);
+  const build = Bun.spawn([bunCli.command, workerSourcePath, payloadPath], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...options.env,
+      ...bunCli.env,
+      RIG_RUNTIME_BUILD_WORKER: "1"
+    }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  rmSync(payloadPath, { force: true });
+  if (exitCode !== 0) {
+    throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
+  }
+}
+function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
+  return resolve2(dirname2(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+}
+function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
+  const envRoots = [
+    options.cwd?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    const candidate = resolve2(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  const localCandidate = resolve2(import.meta.dir, "binary-build-worker.ts");
+  return existsSync2(localCandidate) ? localCandidate : null;
+}
+function resolveRuntimeBinaryBuildWorkerInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime binary build worker.");
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+function createRuntimeBinaryBuildKey(input) {
+  return JSON.stringify({
+    version: 1,
+    bunVersion: Bun.version,
+    platform: process.platform,
+    arch: process.arch,
+    entrypoint: input.entrypoint,
+    define: sortRecord(input.define),
+    env: sortRecord(input.env)
+  });
+}
+async function isRuntimeBinaryBuildFresh(input) {
+  if (!existsSync2(input.outputPath) || !existsSync2(input.manifestPath)) {
+    return false;
+  }
+  let manifest = null;
+  try {
+    manifest = await Bun.file(input.manifestPath).json();
+  } catch {
+    return false;
+  }
+  if (!manifest || manifest.version !== 1 || manifest.buildKey !== input.buildKey) {
+    return false;
+  }
+  for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
+    if (!existsSync2(filePath)) {
+      return false;
+    }
+    if (await sha256File(filePath) !== expectedDigest) {
+      return false;
+    }
+  }
+  return true;
+}
+async function writeRuntimeBinaryCacheManifest(input) {
+  const inputs = {};
+  for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
+    const normalized = normalizeBuildInputPath(input.cwd, inputPath);
+    if (!normalized || !existsSync2(normalized)) {
+      continue;
+    }
+    inputs[normalized] = await sha256File(normalized);
+  }
+  const manifest = {
+    version: 1,
+    buildKey: input.buildKey,
+    inputs
+  };
+  await Bun.write(input.manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function normalizeBuildInputPath(cwd, inputPath) {
+  if (!inputPath) {
+    return null;
+  }
+  if (inputPath.startsWith("file://")) {
+    return fileURLToPath(inputPath);
+  }
+  if (inputPath.startsWith("<")) {
+    return null;
+  }
+  return resolve2(cwd, inputPath);
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+function sortRecord(value) {
+  if (!value) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+
+// packages/runtime/src/control-plane/remote.ts
+import { homedir } from "os";
+import { dirname as dirname4, join as join2 } from "path";
+import { parse as parseToml2, stringify as stringifyToml2 } from "smol-toml";
+
+// packages/runtime/src/control-plane/authority-files.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2, appendFileSync, copyFileSync, statSync, readdirSync, chmodSync as chmodSync2 } from "fs";
+import { dirname as dirname3, join, relative, resolve as resolve3 } from "path";
+init_layout();
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+function readTomlFile(path, fallback) {
+  if (!existsSync3(path))
+    return fallback;
+  const raw = readFileSync(path, "utf8");
+  if (!raw.trim())
+    return fallback;
+  return parseToml(raw);
+}
+function writeTomlFile(path, value) {
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, `${stringifyToml(value).trimEnd()}
+`, "utf8");
+}
+function normalizeString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function normalizeStringArray(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.map((entry) => normalizeString(entry)).filter((entry) => entry !== null);
+}
+function normalizePort(value) {
+  const port = typeof value === "number" ? value : Number(value);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : 7890;
+}
+function loadRemoteEndpointsToml(projectRoot) {
+  const paths = resolveAuthorityPaths(projectRoot);
+  const parsed = readTomlFile(paths.remoteEndpointsPath, { version: 1, endpoints: {} });
+  return {
+    version: parsed.version ?? 1,
+    endpoints: parsed.endpoints ?? {}
+  };
+}
+function loadRemoteSecretsToml(projectRoot) {
+  const paths = resolveAuthorityPaths(projectRoot);
+  const parsed = readTomlFile(paths.remoteSecretsPath, { version: 1, secrets: {} });
+  return {
+    version: parsed.version ?? 1,
+    secrets: parsed.secrets ?? {}
+  };
+}
+function saveRemoteEndpointsToml(projectRoot, payload) {
+  const paths = resolveAuthorityPaths(projectRoot);
+  writeTomlFile(paths.remoteEndpointsPath, payload);
+}
+function resolveAuthorityPaths(projectRoot) {
+  const normalizedRoot = resolve3(projectRoot);
+  const stateRoot = resolveAuthorityStateRoot(normalizedRoot);
+  const stateDir = resolveAuthorityStateDir(normalizedRoot);
+  return {
+    projectRoot: normalizedRoot,
+    harnessRoot: resolve3(normalizedRoot, "rig"),
+    runsDir: resolve3(stateRoot, "runs"),
+    remoteDir: resolve3(stateRoot, "remote"),
+    stateDir,
+    remoteEndpointsPath: resolve3(stateRoot, "remote", "endpoints.toml"),
+    remoteSecretsPath: resolve3(stateDir, "remote-secrets.toml")
+  };
+}
+function resolveAuthorityStateRoot(projectRoot) {
+  const normalizedRoot = resolve3(projectRoot);
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (taskWorkspace) {
+    return resolve3(taskWorkspace, ".rig");
+  }
+  const stateDir = process.env.RIG_STATE_DIR?.trim();
+  if (stateDir) {
+    return dirname3(resolve3(stateDir));
+  }
+  const logsDir = process.env.RIG_LOGS_DIR?.trim();
+  if (logsDir) {
+    return dirname3(resolve3(logsDir));
+  }
+  const sessionFile = process.env.RIG_SESSION_FILE?.trim();
+  if (sessionFile) {
+    return dirname3(dirname3(resolve3(sessionFile)));
+  }
+  const projectStateRoot = resolve3(normalizedRoot, ".rig");
+  if (existsSync3(projectStateRoot)) {
+    return projectStateRoot;
+  }
+  return resolve3(normalizedRoot, ".rig");
+}
+function resolveAuthorityStateDir(projectRoot) {
+  const explicit = process.env.RIG_STATE_DIR?.trim();
+  if (explicit) {
+    return resolve3(explicit);
+  }
+  return resolve3(resolveAuthorityStateRoot(projectRoot), "state");
+}
+function resolveAuthorityArtifactsRoot(projectRoot) {
+  const explicit = process.env.ARTIFACTS_DIR?.trim();
+  if (explicit) {
+    return resolve3(explicit);
+  }
+  const projectArtifactsRoot = resolve3(projectRoot, "artifacts");
+  if (existsSync3(projectArtifactsRoot)) {
+    return projectArtifactsRoot;
+  }
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (taskWorkspace) {
+    return resolve3(taskWorkspace, "artifacts");
+  }
+  if (process.env.MONOREPO_ROOT?.trim()) {
+    return resolve3(resolveMonorepoRoot(projectRoot), "artifacts");
+  }
+  const normalizedRoot = resolve3(projectRoot);
+  const projectLooksLikeMonorepo = existsSync3(resolve3(normalizedRoot, ".git")) && existsSync3(resolve3(normalizedRoot, ".rig", "task-config.json"));
+  if (!projectLooksLikeMonorepo) {
+    return projectArtifactsRoot;
+  }
+  return resolve3(resolveMonorepoRoot(projectRoot), "artifacts");
+}
+function resolveAuthorityRuntimeDir(projectRoot) {
+  return resolve3(resolveAuthorityStateRoot(projectRoot), "runtime");
+}
+function uniquePaths(paths) {
+  const seen = new Set;
+  const result = [];
+  for (const value of paths) {
+    const normalized = normalizeString(value);
+    if (!normalized || seen.has(normalized))
+      continue;
+    seen.add(normalized);
+    result.push(normalized);
+  }
+  return result;
+}
+function listAuthorityRunRoots(projectRoot) {
+  const normalizedRoot = resolve3(projectRoot);
+  const monorepoRoot = resolveMonorepoRoot(normalizedRoot);
+  return uniquePaths([
+    resolve3(resolveAuthorityStateRoot(normalizedRoot), "runs"),
+    resolve3(monorepoRoot, ".rig", "runs")
+  ]);
+}
+function listAuthorityArtifactRoots(projectRoot) {
+  return uniquePaths([
+    resolveAuthorityArtifactsRoot(projectRoot)
+  ]);
+}
+function listAuthorityRuntimeAgentsRoots(projectRoot) {
+  return uniquePaths([
+    resolve3(resolveAuthorityRuntimeDir(projectRoot), "agents")
+  ]);
+}
+function listAuthorityRemoteEndpoints(projectRoot) {
+  const endpoints = loadRemoteEndpointsToml(projectRoot).endpoints ?? {};
+  const secrets = loadRemoteSecretsToml(projectRoot).secrets ?? {};
+  return Object.values(endpoints).map((entry) => {
+    const token = secrets[entry.secret_ref] ?? "";
+    return {
+      id: entry.id,
+      alias: entry.alias,
+      host: entry.host,
+      port: normalizePort(entry.port),
+      token,
+      autoConnect: Boolean(entry.auto_connect),
+      addedAt: entry.created_at,
+      updatedAt: entry.updated_at,
+      lastConnectedAt: normalizeString(entry.last_connected_at) ?? null,
+      labels: normalizeStringArray(entry.labels),
+      capabilities: normalizeStringArray(entry.capabilities),
+      transport: normalizeString(entry.transport) ?? "websocket",
+      secretRef: entry.secret_ref
+    };
+  }).sort((left, right) => left.alias.localeCompare(right.alias));
+}
+function markAuthorityRemoteEndpointConnected(projectRoot, endpointId, connectedAt = new Date().toISOString()) {
+  const endpointsToml = loadRemoteEndpointsToml(projectRoot);
+  const entry = endpointsToml.endpoints?.[endpointId];
+  if (!entry)
+    return;
+  endpointsToml.endpoints = {
+    ...endpointsToml.endpoints ?? {},
+    [endpointId]: {
+      ...entry,
+      last_connected_at: connectedAt,
+      updated_at: connectedAt
+    }
+  };
+  saveRemoteEndpointsToml(projectRoot, endpointsToml);
+}
+function resolveAuthorityRunDir(projectRoot, runId) {
+  const roots = listAuthorityRunRoots(projectRoot);
+  for (const runsDir of roots) {
+    const candidate = resolve3(runsDir, runId);
+    if (existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return resolve3(roots[0] ?? resolveAuthorityPaths(projectRoot).runsDir, runId);
+}
+function writeJsonFile(path, value) {
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync3(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+function listAuthorityRuns(projectRoot) {
+  const runs = new Map;
+  for (const runsDir of listAuthorityRunRoots(projectRoot)) {
+    if (!existsSync3(runsDir))
+      continue;
+    for (const runId of readDirRuns(runsDir)) {
+      if (runs.has(runId))
+        continue;
+      const entry = readJsonFile(resolve3(runsDir, runId, "run.json"), null);
+      if (entry && runBelongsToProject(projectRoot, entry, runsDir)) {
+        runs.set(runId, entry);
+      }
+    }
+  }
+  return [...runs.values()].sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+}
+function runBelongsToProject(projectRoot, run, runsDir) {
+  const normalizedRoot = resolve3(projectRoot);
+  const record = run;
+  const recordedProjectRoot = normalizeString(record.projectRoot);
+  if (recordedProjectRoot) {
+    return resolve3(recordedProjectRoot) === normalizedRoot;
+  }
+  const projectLocalRunsDir = resolve3(normalizedRoot, ".rig", "runs");
+  if (isPathWithin(projectLocalRunsDir, resolve3(runsDir))) {
+    return true;
+  }
+  const pathFields = [
+    run.worktreePath,
+    run.artifactRoot,
+    run.logRoot,
+    run.sessionPath,
+    run.sessionLogPath
+  ].filter((value) => typeof value === "string" && value.trim().length > 0);
+  if (pathFields.length === 0) {
+    return true;
+  }
+  return pathFields.some((value) => isPathWithin(normalizedRoot, resolve3(value)));
+}
+function isPathWithin(root, candidate) {
+  const relativePath = relative(root, candidate);
+  return relativePath === "" || !relativePath.startsWith("..") && !relativePath.startsWith(`/`) && !relativePath.startsWith(`\\`);
+}
+function readDirRuns(runsDir) {
+  try {
+    return readdirSync(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+function readAuthorityRun(projectRoot, runId) {
+  for (const runsDir of listAuthorityRunRoots(projectRoot)) {
+    const entry = readJsonFile(resolve3(runsDir, runId, "run.json"), null);
+    if (entry) {
+      return entry;
+    }
+  }
+  return null;
+}
+function resolveTaskArtifactDirs(projectRoot, taskId) {
+  const candidates = [];
+  const seen = new Set;
+  const add = (value) => {
+    const normalized = normalizeString(value);
+    if (!normalized || seen.has(normalized))
+      return;
+    seen.add(normalized);
+    candidates.push(normalized);
+  };
+  for (const run of listAuthorityRuns(projectRoot)) {
+    if (run.taskId !== taskId)
+      continue;
+    add(run.artifactRoot);
+    if (run.worktreePath) {
+      add(resolve3(run.worktreePath, "artifacts", taskId));
+    }
+  }
+  for (const artifactsRoot of listAuthorityArtifactRoots(projectRoot)) {
+    add(resolve3(artifactsRoot, taskId));
+  }
+  return candidates;
+}
+
+// packages/runtime/src/control-plane/remote.ts
+var DEFAULT_TIMEOUTS = {
+  connectMs: 5000,
+  authMs: 5000,
+  requestMs: 30000,
+  subscriptionMs: 1e4
+};
+var REMOTES_CONFIG_PATH = join2(homedir(), ".config", "rig", "remotes.toml");
+
+class RemoteCliError extends Error {
+  code;
+  exitCode;
+  details;
+  constructor(code, message, exitCode = 1, details) {
+    super(message);
+    this.name = "RemoteCliError";
+    this.code = code;
+    this.exitCode = exitCode;
+    this.details = details;
+  }
+}
+class RemoteWsClient {
+  endpoint;
+  ws = null;
+  connected = false;
+  pending = new Map;
+  onEvent;
+  requestTimeoutMs;
+  connectTimeoutMs;
+  authTimeoutMs;
+  subscriptionTimeoutMs;
+  connectionToken = null;
+  connectionTokenExpiresAt = null;
+  tokenRefreshTimer = null;
+  constructor(endpoint, options = {}) {
+    this.endpoint = endpoint;
+    this.onEvent = options.onEvent;
+    this.connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_TIMEOUTS.connectMs;
+    this.authTimeoutMs = options.authTimeoutMs ?? DEFAULT_TIMEOUTS.authMs;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_TIMEOUTS.requestMs;
+    this.subscriptionTimeoutMs = options.subscriptionTimeoutMs ?? DEFAULT_TIMEOUTS.subscriptionMs;
+  }
+  setEventHandler(handler) {
+    this.onEvent = handler;
+  }
+  async connect() {
+    if (this.connected) {
+      return;
+    }
+    const url = `ws://${this.endpoint.host}:${this.endpoint.port}`;
+    await new Promise((resolve4, reject) => {
+      let authResolved = false;
+      let connectTimer = setTimeout(() => {
+        connectTimer = null;
+        reject(new RemoteCliError("RIG_REMOTE_CONNECT_TIMEOUT", `Timed out connecting to ${url} after ${this.connectTimeoutMs}ms.`, 3, { host: this.endpoint.host, port: this.endpoint.port, timeoutMs: this.connectTimeoutMs }));
+      }, this.connectTimeoutMs);
+      const ws = new WebSocket(url);
+      this.ws = ws;
+      ws.onopen = () => {
+        const authMessage = {
+          type: "auth",
+          id: crypto.randomUUID(),
+          timestamp: new Date().toISOString(),
+          token: this.connectionToken || this.endpoint.token,
+          tokenType: this.connectionToken ? "connection" : "server"
+        };
+        let authTimer = setTimeout(() => {
+          authTimer = null;
+          reject(new RemoteCliError("RIG_REMOTE_AUTH_TIMEOUT", `Timed out waiting for auth response from ${url} after ${this.authTimeoutMs}ms.`, 3, { host: this.endpoint.host, port: this.endpoint.port, timeoutMs: this.authTimeoutMs }));
+        }, this.authTimeoutMs);
+        ws.send(JSON.stringify(authMessage));
+        const originalOnMessage = ws.onmessage;
+        ws.onmessage = (event) => {
+          const message = parseIncomingMessage(event.data);
+          if (!message) {
+            return;
+          }
+          if (message.type === "auth_response" && !authResolved) {
+            authResolved = true;
+            if (connectTimer) {
+              clearTimeout(connectTimer);
+              connectTimer = null;
+            }
+            if (authTimer) {
+              clearTimeout(authTimer);
+              authTimer = null;
+            }
+            const auth = message;
+            if (!auth.success) {
+              reject(new RemoteCliError("RIG_REMOTE_AUTH_FAILED", auth.error || "Remote authentication failed.", 3, { host: this.endpoint.host, port: this.endpoint.port }));
+              return;
+            }
+            if (auth.connectionToken && auth.connectionTokenExpiresAt) {
+              this.connectionToken = auth.connectionToken;
+              this.connectionTokenExpiresAt = auth.connectionTokenExpiresAt;
+              this.scheduleTokenRefresh();
+            }
+            if (this.endpoint.configPath.endsWith("endpoints.toml")) {
+              const projectRoot = dirname4(dirname4(dirname4(this.endpoint.configPath)));
+              try {
+                markAuthorityRemoteEndpointConnected(projectRoot, this.endpoint.alias ? listAuthorityRemoteEndpoints(projectRoot).find((entry) => entry.alias === this.endpoint.alias)?.id ?? "" : "");
+              } catch {}
+            }
+            this.connected = true;
+            ws.onmessage = (event2) => {
+              const next = parseIncomingMessage(event2.data);
+              if (!next) {
+                return;
+              }
+              this.routeMessage(next);
+            };
+            resolve4();
+            return;
+          }
+          if (typeof originalOnMessage === "function") {
+            originalOnMessage.call(ws, event);
+          }
+        };
+      };
+      ws.onerror = () => {
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
+        if (!authResolved) {
+          reject(new RemoteCliError("RIG_REMOTE_CONNECT_FAILED", `Failed to connect to ${url}.`, 3, { host: this.endpoint.host, port: this.endpoint.port }));
+        }
+      };
+      ws.onclose = () => {
+        this.connected = false;
+        this.clearPending("Connection closed");
+      };
+    });
+  }
+  disconnect() {
+    this.connected = false;
+    this.clearTokenRefreshTimer();
+    this.clearPending("Connection closed");
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {}
+      this.ws = null;
+    }
+  }
+  async subscribe(eventTypes = []) {
+    const message = { type: "subscribe" };
+    if (eventTypes.length > 0) {
+      message.eventTypes = eventTypes;
+    }
+    const response = await this.request(message, this.subscriptionTimeoutMs);
+    return expectType(response, "operation_result");
+  }
+  async unsubscribe() {
+    return expectType(await this.request({ type: "unsubscribe" }), "operation_result");
+  }
+  async getState() {
+    return expectType(await this.request({ type: "get_state" }), "state_response");
+  }
+  async getTasks() {
+    return expectType(await this.request({ type: "get_tasks" }), "tasks_response");
+  }
+  async pause() {
+    return expectType(await this.request({ type: "pause" }), "operation_result");
+  }
+  async resume() {
+    return expectType(await this.request({ type: "resume" }), "operation_result");
+  }
+  async interrupt() {
+    return expectType(await this.request({ type: "interrupt" }), "operation_result");
+  }
+  async continueExecution() {
+    return expectType(await this.request({ type: "continue" }), "operation_result");
+  }
+  async refreshTasks() {
+    return expectType(await this.request({ type: "refresh_tasks" }), "operation_result");
+  }
+  async addIterations(count) {
+    return expectType(await this.request({ type: "add_iterations", count }), "operation_result");
+  }
+  async removeIterations(count) {
+    return expectType(await this.request({ type: "remove_iterations", count }), "operation_result");
+  }
+  async getPromptPreview(taskId) {
+    return expectType(await this.request({ type: "get_prompt_preview", taskId }), "prompt_preview_response");
+  }
+  async getIterationOutput(taskId) {
+    return expectType(await this.request({ type: "get_iteration_output", taskId }), "iteration_output_response");
+  }
+  async startOrchestration(options) {
+    return expectType(await this.request({
+      type: "orchestrate:start",
+      maxWorkers: options.maxWorkers,
+      maxIterations: options.maxIterations,
+      directMerge: options.directMerge
+    }), "orchestrate:start_response");
+  }
+  async pauseOrchestration(orchestrationId) {
+    return expectType(await this.request({ type: "orchestrate:pause", orchestrationId }), "operation_result");
+  }
+  async resumeOrchestration(orchestrationId) {
+    return expectType(await this.request({ type: "orchestrate:resume", orchestrationId }), "operation_result");
+  }
+  async stopOrchestration(orchestrationId) {
+    return expectType(await this.request({ type: "orchestrate:stop", orchestrationId }), "operation_result");
+  }
+  async getOrchestrationState(orchestrationId) {
+    return expectType(await this.request({ type: "orchestrate:get_state", orchestrationId }), "orchestrate:state_response");
+  }
+  async ping() {
+    return this.request({ type: "ping" });
+  }
+  async request(payload, timeoutMs = this.requestTimeoutMs) {
+    if (!this.connected || !this.ws) {
+      throw new RemoteCliError("RIG_REMOTE_NOT_CONNECTED", "Remote client is not connected.", 3);
+    }
+    const id = crypto.randomUUID();
+    const message = {
+      ...payload,
+      id,
+      timestamp: new Date().toISOString()
+    };
+    return await new Promise((resolve4, reject) => {
+      const timeout = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new RemoteCliError("RIG_REMOTE_REQUEST_TIMEOUT", `Timed out waiting for response to '${String(payload.type)}' after ${timeoutMs}ms.`, 3, { requestType: payload.type, requestId: id, timeoutMs }));
+      }, timeoutMs);
+      this.pending.set(id, { resolve: resolve4, reject, timeout });
+      this.ws?.send(JSON.stringify(message));
+    });
+  }
+  routeMessage(message) {
+    if (message.id && this.pending.has(message.id)) {
+      const pending = this.pending.get(message.id);
+      if (pending) {
+        clearTimeout(pending.timeout);
+        this.pending.delete(message.id);
+        pending.resolve(message);
+      }
+      return;
+    }
+    if (message.type === "token_refresh_response") {
+      const token = normalizeString2(message.connectionToken);
+      const expiresAt = normalizeString2(message.connectionTokenExpiresAt);
+      if (token && expiresAt) {
+        this.connectionToken = token;
+        this.connectionTokenExpiresAt = expiresAt;
+        this.scheduleTokenRefresh();
+      }
+    }
+    this.onEvent?.({ receivedAt: new Date().toISOString(), message });
+  }
+  scheduleTokenRefresh() {
+    this.clearTokenRefreshTimer();
+    if (!this.connectionToken || !this.connectionTokenExpiresAt || !this.ws || !this.connected) {
+      return;
+    }
+    const expiresAt = new Date(this.connectionTokenExpiresAt).getTime();
+    if (!Number.isFinite(expiresAt)) {
+      return;
+    }
+    const refreshAt = expiresAt - 60 * 60 * 1000;
+    const delay = Math.max(0, refreshAt - Date.now());
+    this.tokenRefreshTimer = setTimeout(() => {
+      if (!this.connected || !this.ws || !this.connectionToken) {
+        return;
+      }
+      const refreshMessage = {
+        type: "token_refresh",
+        id: crypto.randomUUID(),
+        timestamp: new Date().toISOString(),
+        connectionToken: this.connectionToken
+      };
+      this.ws.send(JSON.stringify(refreshMessage));
+    }, delay);
+  }
+  clearTokenRefreshTimer() {
+    if (this.tokenRefreshTimer) {
+      clearTimeout(this.tokenRefreshTimer);
+      this.tokenRefreshTimer = null;
+    }
+  }
+  clearPending(reason) {
+    for (const [requestId, pending] of this.pending.entries()) {
+      clearTimeout(pending.timeout);
+      pending.reject(new RemoteCliError("RIG_REMOTE_REQUEST_CANCELLED", `${reason} (request ${requestId}).`, 3, { requestId }));
+      this.pending.delete(requestId);
+    }
+  }
+}
+function normalizeString2(value) {
+  if (!value) {
+    return "";
+  }
+  return value.trim();
+}
+function parseIncomingMessage(raw) {
+  if (typeof raw !== "string") {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function expectType(message, expectedType) {
+  if (message.type !== expectedType) {
+    throw new RemoteCliError("RIG_REMOTE_UNEXPECTED_RESPONSE", `Unexpected response type: ${message.type}. Expected ${expectedType}.`, 3, { expectedType, actualType: message.type, message });
+  }
+  return message;
+}
+
+// packages/runtime/src/control-plane/runtime/baked-secrets.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
+    }
+  }
+  return resolved;
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  const dotenvPath = resolve4(projectRoot, ".env");
+  if (!existsSync4(dotenvPath)) {
+    return {};
+  }
+  const parsed = {};
+  const lines = readFileSync2(dotenvPath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+    if (!exportMatch) {
+      continue;
+    }
+    const key = exportMatch[1];
+    if (!(key in BAKED_RUNTIME_SECRETS)) {
+      continue;
+    }
+    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
+    if (value) {
+      parsed[key] = value;
+    }
+  }
+  return parsed;
+}
+function secretDefinesFromEnv(env = process.env, projectRoot) {
+  const dotenvSecrets = projectRoot ? loadDotEnvSecrets(projectRoot, env) : {};
+  const resolved = resolveRuntimeSecrets(env, {
+    ...BAKED_RUNTIME_SECRETS,
+    ...dotenvSecrets
+  });
+  return {
+    RIG_BAKED_ANTHROPIC_API_KEY: resolved.ANTHROPIC_API_KEY || "",
+    RIG_BAKED_OPENAI_API_KEY: resolved.OPENAI_API_KEY || "",
+    RIG_BAKED_OPENROUTER_API_KEY: resolved.OPENROUTER_API_KEY || "",
+    RIG_BAKED_AI_REVIEW_MODE: resolved.AI_REVIEW_MODE || "",
+    RIG_BAKED_AI_REVIEW_PROVIDER: resolved.AI_REVIEW_PROVIDER || "",
+    RIG_BAKED_GREPTILE_API_BASE: resolved.GREPTILE_API_BASE || "",
+    RIG_BAKED_GREPTILE_REMOTE: resolved.GREPTILE_REMOTE || "",
+    RIG_BAKED_GREPTILE_REPOSITORY: resolved.GREPTILE_REPOSITORY || "",
+    RIG_BAKED_GREPTILE_CONTEXT_BRANCH: resolved.GREPTILE_CONTEXT_BRANCH || "",
+    RIG_BAKED_GREPTILE_API_KEY: resolved.GREPTILE_API_KEY || "",
+    RIG_BAKED_GREPTILE_GITHUB_TOKEN: resolved.GREPTILE_GITHUB_TOKEN || "",
+    RIG_BAKED_GREPTILE_POLL_ATTEMPTS: resolved.GREPTILE_POLL_ATTEMPTS || "",
+    RIG_BAKED_GREPTILE_POLL_INTERVAL_MS: resolved.GREPTILE_POLL_INTERVAL_MS || "",
+    RIG_BAKED_GITHUB_TOKEN: resolved.GITHUB_TOKEN || resolved.GH_TOKEN || "",
+    RIG_BAKED_GITHUB_SSH_KEY: resolved.GITHUB_SSH_KEY || "",
+    RIG_BAKED_AWS_ACCESS_KEY_ID: resolved.AWS_ACCESS_KEY_ID || "",
+    RIG_BAKED_AWS_SECRET_ACCESS_KEY: resolved.AWS_SECRET_ACCESS_KEY || "",
+    RIG_BAKED_AWS_REGION: resolved.AWS_REGION || "",
+    RIG_BAKED_LINEAR_API_KEY: resolved.LINEAR_API_KEY || "",
+    RIG_BAKED_LINEAR_WEBHOOK_SECRET: resolved.LINEAR_WEBHOOK_SECRET || ""
+  };
+}
+function expandShellValue(rawValue, env) {
+  let value = rawValue.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
+    const envValue = env[name]?.trim();
+    if (envValue) {
+      return envValue;
+    }
+    return fallback ?? "";
+  });
+}
+
+// packages/runtime/src/control-plane/native/git-native.ts
+import { tmpdir } from "os";
+import { dirname as dirname5, isAbsolute, resolve as resolve5 } from "path";
+var sharedGitNativeOutputDir = resolve5(tmpdir(), "rig-native");
+var sharedGitNativeOutputPath = resolve5(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/native/utils.ts
+import { ptr as ptr2 } from "bun:ffi";
+init_layout();
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname6, resolve as resolve6 } from "path";
+var sharedNativeRuntimeOutputDir = resolve6(tmpdir2(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve6(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+function requireNativeRuntimeLibrary(feature) {
+  if (!nativeRuntimeLibrary) {
+    throw new Error(`Native Zig runtime is required for ${feature}`);
+  }
+  return nativeRuntimeLibrary;
+}
+function runtimeScanWorktreesNative(worktreesRoot) {
+  const response = runNativeRuntimeSidecar({
+    op: "scan-worktrees",
+    input: { worktreesRoot }
+  });
+  if (!response.ok) {
+    throw new Error(response.error);
+  }
+  return response.entries ?? [];
+}
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync5(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync5(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve6(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve6(cursor, "native", `${process.platform}-${process.arch}`, name), resolve6(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve6(cursor, "native", name), resolve6(cursor, "native", "lib", name));
+    }
+    const parent = dirname6(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve6(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve6(execDir, platformSpecific) : "",
+    execDir ? resolve6(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve6(execDir, "..", platformSpecific) : "",
+    execDir ? resolve6(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve6(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync5(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve6(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync5(bundled) ? bundled : null;
+}
+function resolveNativeRuntimeSidecarSourcePath() {
+  const envRoots = [
+    process.cwd()?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    for (const relative2 of [
+      "packages/runtime/src/control-plane/native/runtime-native-sidecar.ts",
+      "packages/runtime/dist/src/control-plane/native/runtime-native-sidecar.js"
+    ]) {
+      const candidate = resolve6(root, relative2);
+      if (existsSync5(candidate)) {
+        return candidate;
+      }
+    }
+  }
+  for (const localCandidate of [
+    resolve6(import.meta.dir, "runtime-native-sidecar.js"),
+    resolve6(import.meta.dir, "runtime-native-sidecar.ts")
+  ]) {
+    if (existsSync5(localCandidate))
+      return localCandidate;
+  }
+  return null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync3(dirname6(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync5(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync5(tempOutputPath)) {
+      rmSync2(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync2(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync2(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+function runNativeRuntimeSidecar(request) {
+  const sidecarSourcePath = resolveNativeRuntimeSidecarSourcePath();
+  if (!sidecarSourcePath) {
+    throw new Error("runtime-native-sidecar.ts source file not found.");
+  }
+  const bunCli = resolveNativeRuntimeSidecarInvocation();
+  const proc = Bun.spawnSync([bunCli.command, sidecarSourcePath, JSON.stringify(request)], {
+    cwd: process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.cwd(),
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...bunCli.env,
+      RIG_NATIVE_RUNTIME_SIDECAR: "1"
+    }
+  });
+  if (proc.exitCode !== 0) {
+    throw new Error(proc.stderr.toString() || proc.stdout.toString() || `runtime native sidecar exited ${proc.exitCode}`);
+  }
+  const stdout = proc.stdout.toString().trim();
+  if (!stdout) {
+    throw new Error("runtime native sidecar returned empty output.");
+  }
+  return JSON.parse(stdout);
+}
+function resolveNativeRuntimeSidecarInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime native sidecar.");
+}
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function getScopeRules() {
+  return activeRules;
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var nativeScopeMatcher = null;
+var scopeRegexCache = new Map;
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function normalizeRelativeScopePath(inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        normalized = normalized.slice(prefix.length);
+      }
+    }
+  }
+  return normalized;
+}
+function normalizePathToScope(projectRoot, monorepoRoot, inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  if (normalized.startsWith(projectRoot + "/")) {
+    normalized = normalized.slice(projectRoot.length + 1);
+  }
+  if (normalized.startsWith(monorepoRoot + "/")) {
+    normalized = normalized.slice(monorepoRoot.length + 1);
+  }
+  return normalizeRelativeScopePath(normalized);
+}
+function scopeMatches(path, scopes) {
+  const matcher = getNativeScopeMatcher();
+  const pathVariants = unique([path, normalizeRelativeScopePath(path)]);
+  for (const scope of scopes) {
+    const scopeVariants = unique([scope, normalizeRelativeScopePath(scope)]);
+    for (const candidatePath of pathVariants) {
+      for (const candidateScope of scopeVariants) {
+        if (candidatePath === candidateScope) {
+          return true;
+        }
+        if (matcher.match(candidateScope, candidatePath)) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+function getNativeScopeMatcher() {
+  if (nativeScopeMatcher) {
+    return nativeScopeMatcher;
+  }
+  nativeScopeMatcher = createNativeScopeMatcher();
+  return nativeScopeMatcher;
+}
+function createNativeScopeMatcher() {
+  const library = requireNativeRuntimeLibrary("scope matching");
+  return {
+    match: (pattern, path) => {
+      const patternBuffer = Buffer.from(`${pattern}\x00`);
+      const pathBuffer = Buffer.from(`${path}\x00`);
+      return library.symbols.rig_scope_match(Number(ptr2(patternBuffer)), Number(ptr2(pathBuffer))) !== 0;
+    }
+  };
+}
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname7, resolve as resolve7 } from "path";
+var DEFAULT_RUNTIME_MEMORY_RETRIEVAL = {
+  topK: 5,
+  lexicalWeight: 0.35,
+  vectorWeight: 0.45,
+  recencyWeight: 0.1,
+  confidenceWeight: 0.1
+};
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function loadRuntimeContext(path) {
+  const absPath = resolve7(path);
+  if (!existsSync6(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+
+// packages/runtime/src/control-plane/memory-sync/query.ts
+var DEFAULT_RESULT_LIMIT = DEFAULT_RUNTIME_MEMORY_RETRIEVAL.topK;
+var DAY_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename3, dirname as dirname8, resolve as resolve8 } from "path";
+var sharedNativeShellOutputDir = resolve8(tmpdir3(), "rig-native");
+var sharedNativeShellOutputPath = resolve8(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir4 } from "os";
+import { basename as basename4, dirname as dirname9, resolve as resolve9 } from "path";
+var sharedNativeToolsOutputDir = resolve9(tmpdir4(), "rig-native");
+var sharedNativeToolsOutputPath = resolve9(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/repos/registry.ts
+var MANAGED_REPOS = new Map;
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+// packages/runtime/src/control-plane/repos/layout.ts
+init_layout();
+// packages/runtime/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/control-plane/native/validator.ts
+init_layout();
+
+// packages/runtime/src/control-plane/runtime/sandbox-utils.ts
+init_utils();
+
+// packages/runtime/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+
+// packages/runtime/src/control-plane/provider/runtime-instructions.ts
+var CLAUDE_ROUTER_TOOL_NAMES = [
+  "`mcp__rig_runtime_tools__read`",
+  "`mcp__rig_runtime_tools__write`",
+  "`mcp__rig_runtime_tools__edit`",
+  "`mcp__rig_runtime_tools__glob`",
+  "`mcp__rig_runtime_tools__grep`"
+].join(", ");
+var CODEX_DYNAMIC_TOOL_NAMES = [
+  "`shell`",
+  "`read`",
+  "`write`",
+  "`edit`",
+  "`glob`",
+  "`grep`"
+].join(", ");
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+var GENERATED_TASK_ARTIFACT_FILES = new Set([
+  "changed-files.txt",
+  "decision-log.md",
+  "next-actions.md",
+  "task-result.json",
+  "validation-summary.json",
+  "review-feedback.md",
+  "review-state.json",
+  "review-status.txt",
+  "review-greptile-raw.json",
+  "pr-state.json",
+  "git-state.txt"
+]);
+
+// packages/runtime/src/control-plane/runtime/isolation/index.ts
+init_layout();
+
+// packages/runtime/src/control-plane/runtime/overlay.ts
+init_layout();
+
+// packages/runtime/src/control-plane/runtime/isolation/shared.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4, rmSync as rmSync3 } from "fs";
+var generatedCredentialFiles = new Set;
+function resolveMonorepoRoot3(projectRoot) {
+  return resolveMonorepoRoot2(projectRoot);
+}
+function isRuntimeGatewayGitPath(candidate) {
+  return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
+}
+function resolveHostGitBinary() {
+  const candidates = [
+    process.env.RIG_GIT_BIN?.trim() || "",
+    "/usr/bin/git",
+    "/opt/homebrew/bin/git",
+    "/usr/local/bin/git"
+  ];
+  const bunResolved = Bun.which("git");
+  if (bunResolved && !isRuntimeGatewayGitPath(bunResolved)) {
+    candidates.push(bunResolved);
+  }
+  for (const candidate of candidates) {
+    if (!candidate || isRuntimeGatewayGitPath(candidate)) {
+      continue;
+    }
+    if (existsSync7(candidate)) {
+      return candidate;
+    }
+  }
+  return "git";
+}
+async function runGitCommand(repoRoot, args) {
+  const gitBinary = resolveHostGitBinary();
+  return Bun.$`${gitBinary} -C ${repoRoot} ${args}`.quiet().nothrow();
+}
+function sanitizeRuntimeRefSegment(value) {
+  const sanitized = value.trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return (sanitized || "runtime").slice(0, 64);
+}
+function taskRuntimeId(taskId) {
+  return `task-${taskId}`;
+}
+
+// packages/runtime/src/control-plane/runtime/isolation/home.ts
+var GITHUB_KNOWN_HOSTS = [
+  "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl",
+  "github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=",
+  "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
+].join(`
+`);
+
+// packages/runtime/src/control-plane/runtime/tooling/claude-router.ts
+if (false) {}
+// packages/runtime/src/control-plane/runtime/isolation/discovery.ts
+init_layout();
+import { existsSync as existsSync8 } from "fs";
+import { resolve as resolve11 } from "path";
+
+// packages/runtime/src/control-plane/runtime/isolation/worktree.ts
+async function cleanupRuntimeWorktree(monorepoRoot, workspaceDir) {
+  await runGitCommand(monorepoRoot, ["worktree", "remove", "--force", workspaceDir]);
+}
+function runtimeWorktreeNameFromRuntimeId(runtimeId) {
+  return sanitizeRuntimeRefSegment(runtimeId.replace(/^task-/, ""));
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/claude-router-binary.ts
+import { tmpdir as tmpdir5 } from "os";
+import { dirname as dirname10, resolve as resolve10 } from "path";
+var sharedRouterOutputDir = resolve10(tmpdir5(), "rig-native");
+var sharedRouterOutputPath = resolve10(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
+function runtimeWorktreeId(workspaceDir) {
+  return workspaceDir.split("/").at(-1) || "runtime";
+}
+
+// packages/runtime/src/control-plane/runtime/isolation/discovery.ts
+async function readRuntimeMetadata(metadataPath) {
+  if (!existsSync8(metadataPath)) {
+    return null;
+  }
+  try {
+    return await Bun.file(metadataPath).json();
+  } catch {
+    return null;
+  }
+}
+async function listAgentRuntimes(projectRoot) {
+  const runtimes = [];
+  const monorepoRoot = resolveMonorepoRoot3(projectRoot);
+  const worktreesRoot = resolve11(monorepoRoot, ".worktrees");
+  if (!existsSync8(worktreesRoot)) {
+    return [];
+  }
+  const workspaces = runtimeScanWorktreesNative(worktreesRoot);
+  for (let scan of workspaces) {
+    let workspacePath = scan.workspaceDir;
+    const workspaceLayout = resolveRuntimeWorkspaceLayout(workspacePath);
+    const rootDir = scan.runtimeDir || workspaceLayout.runtimeDir;
+    const metadataPath = scan.metadataPath || resolve11(rootDir, "runtime.json");
+    const contextFile = scan.contextPath || workspaceLayout.contextPath;
+    let mode = "worktree";
+    let createdAt = new Date().toISOString();
+    let taskId = "";
+    let runtimeId = "";
+    let binDir = workspaceLayout.binDir;
+    let logsDir = workspaceLayout.logsDir;
+    let stateDir = workspaceLayout.stateDir;
+    let sessionDir = workspaceLayout.sessionDir;
+    const metadata = await readRuntimeMetadata(metadataPath);
+    if (metadata) {
+      runtimeId = metadata.id;
+      mode = metadata.mode;
+      createdAt = metadata.createdAt;
+    }
+    if (existsSync8(contextFile)) {
+      try {
+        const ctx = loadRuntimeContext(contextFile);
+        taskId = ctx.taskId;
+        workspacePath = ctx.workspaceDir;
+        binDir = ctx.binDir;
+        logsDir = ctx.logsDir;
+        stateDir = ctx.stateDir;
+        sessionDir = ctx.sessionDir;
+      } catch {}
+    }
+    if (!runtimeId) {
+      runtimeId = taskRuntimeId(taskId || runtimeWorktreeId(workspacePath));
+    }
+    runtimes.push({
+      id: runtimeId,
+      taskId,
+      mode,
+      rootDir,
+      workspaceDir: workspacePath,
+      homeDir: resolve11(rootDir, "home"),
+      tmpDir: resolve11(rootDir, "tmp"),
+      cacheDir: resolve11(rootDir, "cache"),
+      logsDir,
+      stateDir,
+      sessionDir,
+      claudeHomeDir: resolve11(rootDir, "home", ".claude"),
+      contextFile,
+      binDir,
+      createdAt
+    });
+  }
+  return runtimes;
+}
+function runtimeRootForCleanup(projectRoot, runtimeId) {
+  let monorepoRoot = null;
+  try {
+    monorepoRoot = resolveMonorepoRoot3(projectRoot);
+  } catch {}
+  const workspaceRootCandidate = monorepoRoot ?? projectRoot;
+  const initialWorkspaceDir = resolve11(workspaceRootCandidate, ".worktrees", runtimeWorktreeNameFromRuntimeId(runtimeId));
+  const runtimeRoot = resolveRuntimeWorkspaceLayout(initialWorkspaceDir).runtimeDir;
+  return { monorepoRoot, initialWorkspaceDir, runtimeRoot };
+}
+
+// packages/runtime/src/control-plane/runtime/isolation/runner.ts
+import { existsSync as existsSync10, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename5, resolve as resolve13 } from "path";
+
+// packages/runtime/src/control-plane/runtime/guard.ts
+import { optimizeNextInvocation } from "bun:jsc";
+import { existsSync as existsSync9, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import { resolve as resolve12 } from "path";
+
+// packages/runtime/src/control-plane/runtime/guard-types.ts
+var POLICY_VERSION = 1;
+
+// packages/runtime/src/control-plane/runtime/guard.ts
+var DEFAULT_SCOPE = {
+  fail_closed: true,
+  harness_paths_exempt: true,
+  runtime_paths_exempt: true
+};
+var DEFAULT_SANDBOX = {
+  mode: "enforce",
+  network: true,
+  read_deny: [],
+  write_allow_from_runtime: true
+};
+var DEFAULT_ISOLATION = {
+  default_mode: "worktree",
+  repo_symlink_fallback: false,
+  strict_provisioning: true,
+  fail_closed_on_provision_error: true
+};
+var DEFAULT_COMPLETION = {
+  derive_checks_from_scope: true,
+  checks: [],
+  typescript_config_probe: ["tsconfig.json"],
+  eslint_config_probe: [".eslintrc.js", ".eslintrc.json", "eslint.config.js"]
+};
+var DEFAULT_RUNTIME_IMAGE = {
+  deps: {
+    monorepo_install: false,
+    hp_next_install: false
+  },
+  plugins_require_binaries: true
+};
+var DEFAULT_RUNTIME_SNAPSHOT = {
+  enabled: true
+};
+function defaultPolicy() {
+  return {
+    version: POLICY_VERSION,
+    mode: "enforce",
+    scope: { ...DEFAULT_SCOPE },
+    rules: [],
+    sandbox: { ...DEFAULT_SANDBOX },
+    isolation: { ...DEFAULT_ISOLATION },
+    completion: { ...DEFAULT_COMPLETION },
+    runtime_image: {
+      deps: { ...DEFAULT_RUNTIME_IMAGE.deps },
+      plugins_require_binaries: DEFAULT_RUNTIME_IMAGE.plugins_require_binaries
+    },
+    runtime_snapshot: { ...DEFAULT_RUNTIME_SNAPSHOT }
+  };
+}
+var policyCache = null;
+var policyCachePath = null;
+var seededPolicyConfig = null;
+var compiledRegexCache = new Map;
+function loadPolicy(projectRoot) {
+  if (seededPolicyConfig) {
+    return seededPolicyConfig;
+  }
+  const configPath = resolve12(projectRoot, "rig/policy/policy.json");
+  if (!existsSync9(configPath)) {
+    return defaultPolicy();
+  }
+  let mtimeMs;
+  try {
+    mtimeMs = statSync3(configPath).mtimeMs;
+  } catch {
+    return defaultPolicy();
+  }
+  if (policyCache && policyCachePath === configPath && policyCache.mtimeMs === mtimeMs) {
+    return policyCache.config;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync5(configPath, "utf-8"));
+  } catch {
+    return defaultPolicy();
+  }
+  const config = mergeWithDefaults(parsed);
+  policyCache = { mtimeMs, config };
+  policyCachePath = configPath;
+  return config;
+}
+function mergeWithDefaults(parsed) {
+  const base = defaultPolicy();
+  if (typeof parsed.mode === "string" && isValidMode(parsed.mode)) {
+    base.mode = parsed.mode;
+  }
+  if (parsed.scope && typeof parsed.scope === "object" && !Array.isArray(parsed.scope)) {
+    const s = parsed.scope;
+    if (typeof s.fail_closed === "boolean")
+      base.scope.fail_closed = s.fail_closed;
+    if (typeof s.harness_paths_exempt === "boolean")
+      base.scope.harness_paths_exempt = s.harness_paths_exempt;
+    if (typeof s.runtime_paths_exempt === "boolean")
+      base.scope.runtime_paths_exempt = s.runtime_paths_exempt;
+  }
+  if (Array.isArray(parsed.rules)) {
+    base.rules = precompilePolicyRuleRegexes(parsed.rules.filter(isValidRule));
+  }
+  if (Array.isArray(parsed.deny) && base.rules.length === 0) {
+    base.rules = precompilePolicyRuleRegexes(migrateLegacyDeny(parsed.deny));
+  }
+  if (parsed.sandbox && typeof parsed.sandbox === "object" && !Array.isArray(parsed.sandbox)) {
+    const sb = parsed.sandbox;
+    if (typeof sb.mode === "string" && isValidMode(sb.mode))
+      base.sandbox.mode = sb.mode;
+    if (typeof sb.network === "boolean")
+      base.sandbox.network = sb.network;
+    if (Array.isArray(sb.read_deny))
+      base.sandbox.read_deny = sb.read_deny.filter((v) => typeof v === "string");
+    if (typeof sb.write_allow_from_runtime === "boolean")
+      base.sandbox.write_allow_from_runtime = sb.write_allow_from_runtime;
+  }
+  if (parsed.isolation && typeof parsed.isolation === "object" && !Array.isArray(parsed.isolation)) {
+    const iso = parsed.isolation;
+    if (iso.default_mode === "worktree")
+      base.isolation.default_mode = iso.default_mode;
+    if (typeof iso.repo_symlink_fallback === "boolean")
+      base.isolation.repo_symlink_fallback = iso.repo_symlink_fallback;
+    if (typeof iso.strict_provisioning === "boolean")
+      base.isolation.strict_provisioning = iso.strict_provisioning;
+    if (typeof iso.fail_closed_on_provision_error === "boolean")
+      base.isolation.fail_closed_on_provision_error = iso.fail_closed_on_provision_error;
+  }
+  if (parsed.completion && typeof parsed.completion === "object" && !Array.isArray(parsed.completion)) {
+    const comp = parsed.completion;
+    if (typeof comp.derive_checks_from_scope === "boolean")
+      base.completion.derive_checks_from_scope = comp.derive_checks_from_scope;
+    if (Array.isArray(comp.checks))
+      base.completion.checks = comp.checks.filter((v) => typeof v === "string");
+    if (Array.isArray(comp.typescript_config_probe))
+      base.completion.typescript_config_probe = comp.typescript_config_probe.filter((v) => typeof v === "string");
+    if (Array.isArray(comp.eslint_config_probe))
+      base.completion.eslint_config_probe = comp.eslint_config_probe.filter((v) => typeof v === "string");
+  }
+  if (parsed.runtime_image && typeof parsed.runtime_image === "object" && !Array.isArray(parsed.runtime_image)) {
+    const runtimeImage = parsed.runtime_image;
+    if (runtimeImage.deps && typeof runtimeImage.deps === "object" && !Array.isArray(runtimeImage.deps)) {
+      const deps = runtimeImage.deps;
+      if (typeof deps.monorepo_install === "boolean") {
+        base.runtime_image.deps.monorepo_install = deps.monorepo_install;
+      }
+      if (typeof deps.hp_next_install === "boolean") {
+        base.runtime_image.deps.hp_next_install = deps.hp_next_install;
+      }
+    }
+    if (typeof runtimeImage.plugins_require_binaries === "boolean") {
+      base.runtime_image.plugins_require_binaries = runtimeImage.plugins_require_binaries;
+    }
+  }
+  if (parsed.runtime_snapshot && typeof parsed.runtime_snapshot === "object" && !Array.isArray(parsed.runtime_snapshot)) {
+    const runtimeSnapshot = parsed.runtime_snapshot;
+    if (typeof runtimeSnapshot.enabled === "boolean") {
+      base.runtime_snapshot.enabled = runtimeSnapshot.enabled;
+    }
+  }
+  return base;
+}
+function isValidMode(value) {
+  return value === "off" || value === "observe" || value === "enforce";
+}
+function isValidRule(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const r = value;
+  return typeof r.id === "string" && typeof r.category === "string" && r.match != null && typeof r.match === "object";
+}
+function migrateLegacyDeny(deny) {
+  const rules = [];
+  for (const entry of deny) {
+    if (typeof entry.id !== "string")
+      continue;
+    const match = {};
+    if (typeof entry.pattern === "string")
+      match.pattern = entry.pattern;
+    if (typeof entry.regex === "string")
+      match.regex = entry.regex;
+    if (!match.pattern && !match.regex)
+      continue;
+    rules.push({
+      id: entry.id,
+      category: "command",
+      match,
+      action: "block",
+      ...typeof entry.description === "string" ? { description: entry.description } : {}
+    });
+  }
+  return rules;
+}
+function precompilePolicyRuleRegexes(rules) {
+  return rules.map((rule) => {
+    const compiledRegex = rule.match.regex ? compileSafeRegex(rule.match.regex, `rules.${rule.id}.match.regex`, true) : undefined;
+    const compiledUnlessRegex = rule.unless?.regex ? compileSafeRegex(rule.unless.regex, `rules.${rule.id}.unless.regex`, true) : undefined;
+    return {
+      ...rule,
+      ...compiledRegex ? { compiledRegex } : {},
+      ...compiledUnlessRegex ? { compiledUnlessRegex } : {}
+    };
+  });
+}
+function getRegexUnsafeReason(pattern) {
+  if (pattern.length > 512) {
+    return "pattern exceeds max safe length (512 chars)";
+  }
+  if (/\\[1-9]/.test(pattern)) {
+    return "pattern uses backreferences";
+  }
+  if (/\((?:[^()\\]|\\.)*[+*](?:[^()\\]|\\.)*\)\s*[*+{]/.test(pattern)) {
+    return "pattern contains nested quantifiers";
+  }
+  if (/\((?:[^()\\]|\\.)*\.\\?[+*](?:[^()\\]|\\.)*\)\s*[*+{]/.test(pattern)) {
+    return "pattern contains nested broad quantifiers";
+  }
+  return null;
+}
+function compileSafeRegex(pattern, sourceLabel, logOnFailure) {
+  const cached = compiledRegexCache.get(pattern);
+  if (cached !== undefined) {
+    return cached ?? undefined;
+  }
+  const unsafeReason = getRegexUnsafeReason(pattern);
+  if (unsafeReason) {
+    if (logOnFailure) {
+      console.warn(`[policy] Skipping unsafe regex in ${sourceLabel}: ${unsafeReason}`);
+    }
+    compiledRegexCache.set(pattern, null);
+    return;
+  }
+  try {
+    const compiled = new RegExp(pattern);
+    compiledRegexCache.set(pattern, compiled);
+    return compiled;
+  } catch (error) {
+    if (logOnFailure) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[policy] Skipping invalid regex in ${sourceLabel}: ${message}`);
+    }
+    compiledRegexCache.set(pattern, null);
+    return;
+  }
+}
+function matchRule(rule, input) {
+  const { match } = rule;
+  if (match.pattern && input.includes(match.pattern)) {
+    return true;
+  }
+  if (match.regex) {
+    const compiled = rule.compiledRegex || compileSafeRegex(match.regex, `rules.${rule.id}.match.regex`, false);
+    if (!compiled) {
+      return false;
+    }
+    try {
+      return compiled.test(input);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function matchRuleUnless(rule, command, taskId) {
+  if (!rule.unless)
+    return false;
+  if (rule.unless.regex) {
+    const compiled = rule.compiledUnlessRegex || compileSafeRegex(rule.unless.regex, `rules.${rule.id}.unless.regex`, false);
+    if (!compiled) {
+      return false;
+    }
+    try {
+      if (compiled.test(command))
+        return true;
+    } catch {}
+  }
+  if (rule.unless.task_in && taskId) {
+    if (rule.unless.task_in.includes(taskId))
+      return true;
+  }
+  return false;
+}
+function resolveAction(mode, matched) {
+  if (matched.length === 0)
+    return "allow";
+  if (mode === "off")
+    return "allow";
+  if (mode === "observe")
+    return "warn";
+  return "block";
+}
+function resolveAbsolutePath(projectRoot, rawPath) {
+  if (rawPath.startsWith("/"))
+    return resolve12(rawPath);
+  return resolve12(projectRoot, rawPath);
+}
+function isHarnessPath(projectRoot, rawPath) {
+  const absPath = resolveAbsolutePath(projectRoot, rawPath);
+  const managedRoots = [
+    resolve12(projectRoot, "rig"),
+    resolve12(projectRoot, ".rig"),
+    resolve12(projectRoot, "artifacts")
+  ];
+  return managedRoots.some((root) => absPath === root || absPath.startsWith(root + "/"));
+}
+function isRuntimePath(projectRoot, rawPath, taskWorkspace) {
+  const absPath = resolveAbsolutePath(projectRoot, rawPath);
+  if (taskWorkspace) {
+    const workspaceRigRoot = resolve12(taskWorkspace, ".rig");
+    const workspaceArtifactsRoot = resolve12(taskWorkspace, "artifacts");
+    if (absPath === workspaceRigRoot || absPath.startsWith(workspaceRigRoot + "/") || absPath === workspaceArtifactsRoot || absPath.startsWith(workspaceArtifactsRoot + "/")) {
+      return true;
+    }
+  }
+  const runtimeRoot = resolve12(projectRoot, ".rig/runtime/agents");
+  return absPath === runtimeRoot || absPath.startsWith(runtimeRoot + "/");
+}
+function isTestFile(path) {
+  return /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(path) || /\/(__tests__|tests|test)\//.test(path);
+}
+function evaluate(context) {
+  const policy = loadPolicy(context.projectRoot);
+  switch (context.evaluation.type) {
+    case "tool-call":
+      return evaluateToolCall(policy, context);
+    case "command":
+      return evaluateCommand(policy, context);
+    case "content-write":
+      return evaluateContent(policy, context);
+    case "file-access":
+      return evaluateScope(policy, context, context.evaluation.file_path, context.evaluation.access);
+  }
+}
+function evaluateScope(policy, context, filePath, access) {
+  const allowed = () => ({
+    allowed: true,
+    matchedRules: [],
+    action: "allow",
+    failClosed: false
+  });
+  if (policy.scope.harness_paths_exempt && isHarnessPath(context.projectRoot, filePath)) {
+    return allowed();
+  }
+  if (policy.scope.runtime_paths_exempt && isRuntimePath(context.projectRoot, filePath, context.taskWorkspace)) {
+    return allowed();
+  }
+  if (!context.taskId) {
+    if (access === "write" && policy.scope.fail_closed) {
+      return {
+        allowed: false,
+        matchedRules: [],
+        action: resolveAction(policy.mode, [{ id: "scope:no-task", category: "command", reason: "No active task; fail-closed for write operations" }]),
+        failClosed: true
+      };
+    }
+    return allowed();
+  }
+  const scopes = context.taskScopes || [];
+  if (scopes.length === 0) {
+    return allowed();
+  }
+  if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith("/")) {
+    const absPath = resolve12(filePath);
+    if (!absPath.startsWith(context.taskWorkspace + "/") && !isHarnessPath(context.projectRoot, filePath)) {
+      const reason2 = `Absolute path '${filePath}' is outside task runtime boundary. Allowed root: ${context.taskWorkspace}`;
+      const matched2 = [{ id: "scope:workspace-boundary", category: "command", reason: reason2 }];
+      return {
+        allowed: policy.mode !== "enforce",
+        matchedRules: matched2,
+        action: resolveAction(policy.mode, matched2),
+        failClosed: false
+      };
+    }
+  }
+  const monorepoRoot = context.monorepoRoot || process.env.MONOREPO_ROOT?.trim() || context.taskWorkspace || context.projectRoot;
+  let normalizedPath = filePath;
+  if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith(context.taskWorkspace + "/")) {
+    normalizedPath = filePath.slice(context.taskWorkspace.length + 1);
+  }
+  normalizedPath = normalizePathToScope(context.projectRoot, monorepoRoot, normalizedPath);
+  if (scopeMatches(filePath, scopes) || scopeMatches(normalizedPath, scopes)) {
+    return allowed();
+  }
+  const reason = `File '${filePath}' (normalized: '${normalizedPath}') is outside scope of task ${context.taskId}`;
+  const matched = [{ id: "scope:out-of-scope", category: "command", reason }];
+  return {
+    allowed: policy.mode !== "enforce",
+    matchedRules: matched,
+    action: resolveAction(policy.mode, matched),
+    failClosed: false
+  };
+}
+function evaluateCommand(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "command") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const command = evaluation.command;
+  const matchedRules = [];
+  for (const rule of policy.rules) {
+    if (rule.category !== "command")
+      continue;
+    if (!matchRule(rule, command))
+      continue;
+    if (matchRuleUnless(rule, command, context.taskId))
+      continue;
+    matchedRules.push({
+      id: rule.id,
+      category: rule.category,
+      description: rule.description,
+      reason: rule.description || `Matched rule ${rule.id}`
+    });
+  }
+  const writeTarget = extractWriteTarget(command);
+  if (writeTarget && !/^\/dev\//.test(writeTarget) && !/^\/proc\//.test(writeTarget)) {
+    const scopeResult = evaluateScope(policy, context, writeTarget, "write");
+    if (!scopeResult.allowed || scopeResult.matchedRules.length > 0) {
+      matchedRules.push(...scopeResult.matchedRules);
+    }
+  }
+  const action = resolveAction(policy.mode, matchedRules);
+  return {
+    allowed: action !== "block",
+    matchedRules,
+    action,
+    failClosed: false
+  };
+}
+function extractWriteTarget(command) {
+  const redirect = command.match(/>>?\s+([^\s;|&]+)/);
+  if (redirect?.[1])
+    return redirect[1];
+  const tee = command.match(/tee\s+(-a\s+)?([^\s;|&]+)/);
+  if (tee?.[2])
+    return tee[2];
+  return "";
+}
+function evaluateContent(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "content-write") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const { content, file_path } = evaluation;
+  const matchedRules = [];
+  const scopeResult = evaluateScope(policy, context, file_path, "write");
+  if (scopeResult.matchedRules.length > 0) {
+    matchedRules.push(...scopeResult.matchedRules);
+  }
+  for (const rule of policy.rules) {
+    if (rule.category !== "content" && rule.category !== "import" && rule.category !== "test-integrity")
+      continue;
+    if (rule.applies_to === "test-files" && !isTestFile(file_path))
+      continue;
+    if (!matchRule(rule, content))
+      continue;
+    if (matchRuleUnless(rule, content, context.taskId))
+      continue;
+    matchedRules.push({
+      id: rule.id,
+      category: rule.category,
+      description: rule.description,
+      reason: rule.description || `Matched rule ${rule.id}`
+    });
+  }
+  const action = resolveAction(policy.mode, matchedRules);
+  return {
+    allowed: action !== "block",
+    matchedRules,
+    action,
+    failClosed: false
+  };
+}
+function evaluateToolCall(policy, context) {
+  const evaluation = context.evaluation;
+  if (evaluation.type !== "tool-call") {
+    return { allowed: true, matchedRules: [], action: "allow", failClosed: false };
+  }
+  const { tool_name, tool_input } = evaluation;
+  const allMatched = [];
+  const filePaths = extractFilePathsFromToolInput(tool_name, tool_input);
+  for (const fp of filePaths) {
+    const access = isWriteTool(tool_name) ? "write" : "read";
+    const scopeResult = evaluateScope(policy, context, fp, access);
+    if (scopeResult.matchedRules.length > 0) {
+      allMatched.push(...scopeResult.matchedRules);
+    }
+  }
+  const content = extractContentFromToolInput(tool_input);
+  if (content) {
+    const filePath = filePaths[0] || "";
+    const contentContext = {
+      ...context,
+      evaluation: { type: "content-write", file_path: filePath, content }
+    };
+    const contentPolicy = loadPolicy(context.projectRoot);
+    for (const rule of contentPolicy.rules) {
+      if (rule.category !== "content" && rule.category !== "import" && rule.category !== "test-integrity")
+        continue;
+      if (rule.applies_to === "test-files" && !isTestFile(filePath))
+        continue;
+      if (!matchRule(rule, content))
+        continue;
+      if (matchRuleUnless(rule, content, context.taskId))
+        continue;
+      allMatched.push({
+        id: rule.id,
+        category: rule.category,
+        description: rule.description,
+        reason: rule.description || `Matched rule ${rule.id}`
+      });
+    }
+  }
+  if (tool_name === "Bash") {
+    const command = String(tool_input.command || tool_input.cmd || "");
+    if (command) {
+      const cmdContext = {
+        ...context,
+        evaluation: { type: "command", command }
+      };
+      const cmdResult = evaluateCommand(policy, cmdContext);
+      if (cmdResult.matchedRules.length > 0) {
+        allMatched.push(...cmdResult.matchedRules);
+      }
+    }
+  }
+  const seen = new Set;
+  const deduplicated = [];
+  for (const rule of allMatched) {
+    if (!seen.has(rule.id)) {
+      seen.add(rule.id);
+      deduplicated.push(rule);
+    }
+  }
+  const action = resolveAction(policy.mode, deduplicated);
+  return {
+    allowed: action !== "block",
+    matchedRules: deduplicated,
+    action,
+    failClosed: false
+  };
+}
+function isWriteTool(toolName) {
+  return toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit";
+}
+function extractFilePathsFromToolInput(toolName, input) {
+  const paths = [];
+  const add = (value) => {
+    if (typeof value === "string" && value.trim()) {
+      paths.push(value.trim());
+    }
+  };
+  if (toolName === "Read" || toolName === "Write" || toolName === "Edit" || toolName === "MultiEdit") {
+    add(input.file_path);
+    add(input.path);
+  } else if (toolName === "Glob") {
+    add(input.path);
+  } else if (toolName === "Grep") {
+    add(input.path);
+  } else {
+    add(input.file_path);
+    add(input.path);
+  }
+  return paths;
+}
+function extractContentFromToolInput(input) {
+  if (typeof input.content === "string")
+    return input.content;
+  if (typeof input.new_string === "string")
+    return input.new_string;
+  return "";
+}
+var guardHotPathPrimed = false;
+function primeGuardHotPaths() {
+  if (guardHotPathPrimed) {
+    return;
+  }
+  guardHotPathPrimed = true;
+  try {
+    optimizeNextInvocation(matchRule);
+    optimizeNextInvocation(evaluate);
+  } catch {}
+}
+primeGuardHotPaths();
+
+// packages/runtime/src/control-plane/runtime/sandbox/backend.ts
+init_utils();
+// packages/runtime/src/control-plane/runtime/isolation/runner.ts
+init_layout();
+async function cleanupAgentRuntime(options) {
+  const { monorepoRoot, initialWorkspaceDir, runtimeRoot } = runtimeRootForCleanup(options.projectRoot, options.id);
+  const metadataPath = resolve13(runtimeRoot, "runtime.json");
+  if (!existsSync10(runtimeRoot)) {
+    return;
+  }
+  let mode = "worktree";
+  let workspaceDir = "";
+  const metadata = await readRuntimeMetadata2(metadataPath);
+  const metadataMatchesRequestedRuntime = metadata !== null && metadata.id === options.id && resolve13(metadata.workspaceDir) === resolve13(initialWorkspaceDir);
+  if (metadata && metadataMatchesRequestedRuntime) {
+    mode = metadata.mode;
+    workspaceDir = metadata.workspaceDir;
+  } else if (existsSync10(initialWorkspaceDir)) {
+    workspaceDir = initialWorkspaceDir;
+  }
+  const preservesTaskWorktree = metadataMatchesRequestedRuntime && metadata ? options.id === taskRuntimeId(metadata.taskId) : false;
+  if (mode === "worktree" && workspaceDir && monorepoRoot && !preservesTaskWorktree) {
+    await cleanupRuntimeWorktree(monorepoRoot, workspaceDir);
+  } else if (mode === "worktree" && workspaceDir && preservesTaskWorktree) {
+    cleanupTaskRuntimeOverlay(workspaceDir);
+  }
+  rmSync4(runtimeRoot, { recursive: true, force: true });
+}
+function cleanupTaskRuntimeOverlay(workspaceDir) {
+  const layout = resolveRuntimeWorkspaceLayout(workspaceDir);
+  for (const path of [
+    layout.homeDir,
+    layout.tmpDir,
+    layout.cacheDir,
+    layout.logsDir,
+    layout.stateDir,
+    layout.sessionDir,
+    layout.binDir,
+    layout.distDir,
+    layout.runtimeDir,
+    layout.contextPath
+  ]) {
+    rmSync4(path, { recursive: true, force: true });
+  }
+}
+async function readRuntimeMetadata2(metadataPath) {
+  if (!existsSync10(metadataPath)) {
+    return null;
+  }
+  try {
+    return await Bun.file(metadataPath).json();
+  } catch {
+    return null;
+  }
+}
+// packages/runtime/src/control-plane/native/run-ops.ts
+var ACTIVE_RUN_STATUSES = new Set(["preparing", "running", "validating", "reviewing"]);
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readProcessParents(projectRoot) {
+  const captured = runCapture(["ps", "-axo", "pid=,ppid="], projectRoot);
+  if (captured.exitCode !== 0) {
+    return new Map;
+  }
+  const parents = new Map;
+  for (const rawLine of captured.stdout.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    const match = line.match(/^(\d+)\s+(\d+)$/);
+    if (!match)
+      continue;
+    const pid = Number.parseInt(match[1], 10);
+    const ppid = Number.parseInt(match[2], 10);
+    if (Number.isInteger(pid) && pid > 0 && Number.isInteger(ppid) && ppid >= 0) {
+      parents.set(pid, ppid);
+    }
+  }
+  return parents;
+}
+function collectProcessTreePids(rootPid, parents) {
+  if (!Number.isInteger(rootPid) || rootPid <= 0) {
+    return [];
+  }
+  const childrenByParent = new Map;
+  for (const [pid, ppid] of parents.entries()) {
+    const existing = childrenByParent.get(ppid);
+    if (existing) {
+      existing.push(pid);
+    } else {
+      childrenByParent.set(ppid, [pid]);
+    }
+  }
+  const ordered = [];
+  const visit = (pid) => {
+    for (const childPid of childrenByParent.get(pid) ?? []) {
+      visit(childPid);
+    }
+    ordered.push(pid);
+  };
+  visit(rootPid);
+  return [...new Set(ordered)];
+}
+function signalProcessSet(pids, signal) {
+  for (const pid of pids) {
+    if (!isPidAlive(pid))
+      continue;
+    try {
+      process.kill(pid, signal);
+    } catch {}
+  }
+}
+async function stopAuthorityRunLocally(projectRoot, run) {
+  const pid = typeof run.pid === "number" ? run.pid : null;
+  if (!pid || pid === process.pid) {
+    return false;
+  }
+  const markStopped = () => {
+    writeJsonFile(resolve14(resolveAuthorityRunDir(projectRoot, run.runId), "run.json"), {
+      ...run,
+      status: "stopped",
+      completedAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString()
+    });
+  };
+  if (!isPidAlive(pid)) {
+    markStopped();
+    return true;
+  }
+  const processTree = collectProcessTreePids(pid, readProcessParents(projectRoot));
+  const pidsToStop = processTree.length > 0 ? processTree : [pid];
+  signalProcessSet(pidsToStop, "SIGTERM");
+  const deadline = Date.now() + 2000;
+  while (Date.now() < deadline) {
+    if (pidsToStop.every((candidatePid) => !isPidAlive(candidatePid))) {
+      markStopped();
+      return true;
+    }
+    await Bun.sleep(100);
+  }
+  signalProcessSet(pidsToStop, "SIGKILL");
+  if (pidsToStop.every((candidatePid) => !isPidAlive(candidatePid))) {
+    markStopped();
+    return true;
+  }
+  return false;
+}
+function defaultStartRunOptions(mode) {
+  return {
+    mode,
+    workers: parsePositiveInt(process.env.RIG_PARALLEL_WORKERS, 3),
+    wsPort: parsePositiveInt(process.env.RIG_WS_PORT, 7890),
+    startEventServer: process.env.RIG_START_EVENT_SERVER !== "0",
+    serverHost: process.env.RIG_SERVER_HOST || "0.0.0.0",
+    serverPort: parsePositiveInt(process.env.RIG_SERVER_PORT, 8787),
+    serverPollMs: parsePositiveInt(process.env.RIG_SERVER_POLL_MS, 1000),
+    dryRun: false
+  };
+}
+async function startRun(projectRoot, options) {
+  if (!options.runtimeContext) {
+    await ensureLocalControlBinaries(projectRoot);
+  }
+  requireBinary("br", "beads-rust (br) is required for epic auto-pick.");
+  const epicId = options.epicId || await resolveDefaultEpic(projectRoot);
+  if (!epicId) {
+    throw new RemoteCliError("RIG_RUN_EPIC_NOT_FOUND", "Could not resolve an epic automatically. Pass --epic <id>.", 2);
+  }
+  const readyTasks = listReadyTasksForEpic(projectRoot, epicId);
+  const selectedTasks = readyTasks.slice(0, options.mode === "parallel" ? Math.max(1, options.workers) : 1);
+  if (selectedTasks.length === 0) {
+    throw new RemoteCliError("RIG_RUN_NO_READY_TASKS", `No ready tasks found for epic ${epicId}.`, 2, { epicId });
+  }
+  const server = await ensureServerForRuns(projectRoot);
+  const runIds = selectedTasks.map(() => randomUUID());
+  const eventServerUrl = `${server.baseUrl}/events/stream`;
+  if (options.dryRun) {
+    for (let index = 0;index < selectedTasks.length; index += 1) {
+      const task = selectedTasks[index];
+      console.log(`[dry-run] POST ${server.baseUrl}/api/runs/task runId=${runIds[index]} taskId=${task.id} title=${JSON.stringify(task.title)}`);
+    }
+    return { epicId, runIds, baseUrl: server.baseUrl, eventServerUrl, exitCode: 0 };
+  }
+  for (let index = 0;index < selectedTasks.length; index += 1) {
+    const task = selectedTasks[index];
+    const response = await fetch(`${server.baseUrl}/api/runs/task`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...server.authToken ? { authorization: `Bearer ${server.authToken}` } : {}
+      },
+      body: JSON.stringify({
+        runId: runIds[index],
+        taskId: task.id,
+        title: task.title,
+        runtimeAdapter: process.env.RIG_RUNTIME_ADAPTER || "claude-code",
+        executionTarget: "local"
+      })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new RemoteCliError("RIG_RUN_START_FAILED", `Failed to submit run for ${task.id}: ${text || response.statusText}`, 1, { epicId, taskId: task.id });
+    }
+  }
+  return { epicId, runIds, baseUrl: server.baseUrl, eventServerUrl, exitCode: 0 };
+}
+function runStatus(projectRoot, runtimeContext) {
+  const runs = listAuthorityRuns(projectRoot).map((entry) => {
+    const record = readAuthorityRun(projectRoot, entry.runId);
+    if (!record) {
+      return null;
+    }
+    return {
+      runId: entry.runId,
+      taskId: record.taskId ?? null,
+      title: String(record.title ?? record.taskId ?? entry.runId),
+      status: String(record.status ?? "unknown")
+    };
+  }).filter((entry) => entry !== null).sort((left, right) => right.runId.localeCompare(left.runId));
+  const activeRuns = runs.filter((entry) => ACTIVE_RUN_STATUSES.has(entry.status));
+  return {
+    activeRuns,
+    recentRuns: runs.slice(0, 10)
+  };
+}
+async function runResume(projectRoot, runtimeContext) {
+  const resumable = listAuthorityRuns(projectRoot).map((entry) => readAuthorityRun(projectRoot, entry.runId)).filter((run2) => Boolean(run2)).filter((run2) => run2.mode === "local" && (run2.status === "stopped" || run2.status === "failed" || run2.status === "created")).sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")));
+  const run = resumable[0];
+  if (!run) {
+    throw new RemoteCliError("RIG_RUN_NOTHING_TO_RESUME", "No stopped local run is available to resume.", 2);
+  }
+  const server = await ensureServerForRuns(projectRoot);
+  const response = await fetch(`${server.baseUrl}/api/runs/resume`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...server.authToken ? { authorization: `Bearer ${server.authToken}` } : {}
+    },
+    body: JSON.stringify({ runId: run.runId, createdAt: new Date().toISOString() })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new RemoteCliError("RIG_RUN_RESUME_FAILED", text || response.statusText, 1, { runId: run.runId });
+  }
+  return { runId: run.runId };
+}
+async function runStop(projectRoot) {
+  const activeRuns = listAuthorityRuns(projectRoot).map((entry) => readAuthorityRun(projectRoot, entry.runId)).filter((run) => Boolean(run)).filter((run) => run.mode === "local" && ACTIVE_RUN_STATUSES.has(String(run.status ?? "")));
+  if (activeRuns.length === 0) {
+    return { stopped: 0, remaining: [] };
+  }
+  let stopped = 0;
+  const remainingRunIds = [];
+  for (const run of activeRuns) {
+    if (await stopAuthorityRunLocally(projectRoot, run)) {
+      stopped += 1;
+      continue;
+    }
+    remainingRunIds.push(run.runId);
+  }
+  if (remainingRunIds.length === 0) {
+    return { stopped, remaining: [] };
+  }
+  const server = await ensureServerForRuns(projectRoot);
+  const unresolved = [];
+  for (const runId of remainingRunIds) {
+    const response = await fetch(`${server.baseUrl}/api/runs/stop`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...server.authToken ? { authorization: `Bearer ${server.authToken}` } : {}
+      },
+      body: JSON.stringify({ runId, createdAt: new Date().toISOString() })
+    });
+    if (response.ok) {
+      stopped += 1;
+    } else {
+      unresolved.push(runId);
+    }
+  }
+  return { stopped, remaining: unresolved };
+}
+function buildRuntimePath(projectRoot) {
+  const entries = [
+    resolve14(projectRoot, ".rig/bin"),
+    resolve14(projectRoot, "rig/tools"),
+    process.env.PATH || ""
+  ];
+  return entries.filter(Boolean).join(":");
+}
+async function deleteRunState(projectRoot, options) {
+  const run = readAuthorityRun(projectRoot, options.runId);
+  if (!run) {
+    throw new RemoteCliError("RIG_RUN_NOT_FOUND", `Run not found: ${options.runId}`, 2, {
+      runId: options.runId
+    });
+  }
+  const runDir = resolveAuthorityRunDir(projectRoot, options.runId);
+  const runtimeIds = new Set;
+  const runtimeRoots = new Set;
+  if (options.purgeRuntime !== false && run.worktreePath) {
+    const derivedRuntimeRoot = dirname11(run.worktreePath);
+    runtimeRoots.add(derivedRuntimeRoot);
+    const derivedRuntimeId = basename6(derivedRuntimeRoot);
+    if (derivedRuntimeId) {
+      runtimeIds.add(derivedRuntimeId);
+    }
+    for (const runtime of await listAgentRuntimes(projectRoot)) {
+      if (runtime.workspaceDir === run.worktreePath || runtime.rootDir === derivedRuntimeRoot) {
+        runtimeIds.add(runtime.id);
+        runtimeRoots.add(runtime.rootDir);
+      }
+    }
+  }
+  for (const runtimeId of runtimeIds) {
+    await cleanupAgentRuntime({ projectRoot, id: runtimeId });
+  }
+  for (const runtimeRoot of runtimeRoots) {
+    rmSync5(runtimeRoot, { recursive: true, force: true });
+  }
+  rmSync5(runDir, { recursive: true, force: true });
+  let taskArtifactsDeleted = false;
+  if (options.purgeTaskArtifacts && run.taskId) {
+    for (const taskArtifactsDir of resolveTaskArtifactDirs(projectRoot, run.taskId)) {
+      if (!existsSync11(taskArtifactsDir))
+        continue;
+      rmSync5(taskArtifactsDir, { recursive: true, force: true });
+      taskArtifactsDeleted = true;
+    }
+  }
+  return {
+    runId: options.runId,
+    taskId: run.taskId ?? null,
+    runDeleted: true,
+    runtimeIds: Array.from(runtimeIds),
+    runtimeRoots: Array.from(runtimeRoots),
+    taskArtifactsDeleted
+  };
+}
+async function cleanupRunState(projectRoot, options = {}) {
+  const runs = listAuthorityRuns(projectRoot);
+  const runIds = runs.map((run) => run.runId);
+  const runtimeIds = new Set;
+  for (const runId of runIds) {
+    const result = await deleteRunState(projectRoot, {
+      runId,
+      purgeRuntime: options.includeRuntimes !== false,
+      purgeTaskArtifacts: false
+    });
+    for (const runtimeId of result.runtimeIds) {
+      runtimeIds.add(runtimeId);
+    }
+  }
+  if (options.includeRuntimes !== false) {
+    for (const agentsRoot of listAuthorityRuntimeAgentsRoots(projectRoot)) {
+      if (!existsSync11(agentsRoot))
+        continue;
+      for (const entry of readdirSync2(agentsRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+          continue;
+        rmSync5(resolve14(agentsRoot, entry.name), { recursive: true, force: true });
+      }
+    }
+  }
+  let artifactsCleared = false;
+  if (options.includeArtifacts !== false) {
+    const seen = new Set;
+    for (const run of runs) {
+      if (!run.taskId)
+        continue;
+      for (const artifactsRoot of resolveTaskArtifactDirs(projectRoot, run.taskId)) {
+        if (seen.has(artifactsRoot) || !existsSync11(artifactsRoot))
+          continue;
+        seen.add(artifactsRoot);
+        rmSync5(artifactsRoot, { recursive: true, force: true });
+        artifactsCleared = true;
+      }
+    }
+    for (const artifactsRoot of listAuthorityArtifactRoots(projectRoot)) {
+      if (seen.has(artifactsRoot) || !existsSync11(artifactsRoot))
+        continue;
+      rmSync5(artifactsRoot, { recursive: true, force: true });
+      artifactsCleared = true;
+    }
+  }
+  let queueCleared = false;
+  if (options.includeQueue !== false) {
+    const queuePath = resolve14(resolveAuthorityPaths(projectRoot).stateDir, "task-queue.json");
+    if (existsSync11(queuePath)) {
+      rmSync5(queuePath, { force: true });
+      queueCleared = true;
+    }
+  }
+  return {
+    runIds,
+    runtimeIds: Array.from(runtimeIds),
+    artifactsCleared,
+    queueCleared
+  };
+}
+async function resolveDefaultEpic(projectRoot) {
+  const fromSession = await readSessionEpic(projectRoot);
+  if (fromSession) {
+    return fromSession;
+  }
+  const fromReady = epicFromReadyTasks(projectRoot);
+  if (fromReady) {
+    return fromReady;
+  }
+  const epics = listOpenEpics(projectRoot);
+  return epics[0]?.id || "";
+}
+function listOpenEpics(projectRoot) {
+  const list = runCapture(["br", "--no-db", "list", "--json"], projectRoot);
+  if (list.exitCode !== 0 || !list.stdout.trim()) {
+    return [];
+  }
+  const issues = parseJson(list.stdout, []);
+  const epics = issues.filter((issue) => issue.issue_type === "epic" && issue.status === "open");
+  sortByPriorityAndCreatedAt(epics);
+  return epics.map((issue) => {
+    if (typeof issue.id !== "string" || !issue.id) {
+      return null;
+    }
+    return {
+      id: issue.id,
+      priority: Number.isFinite(issue.priority) ? Number(issue.priority) : undefined,
+      createdAt: typeof issue.created_at === "string" ? issue.created_at : undefined
+    };
+  }).filter((issue) => issue !== null);
+}
+function listReadyTasksForEpic(projectRoot, epicId) {
+  const ready = runCapture(["br", "--no-db", "ready", "--json"], projectRoot);
+  if (ready.exitCode !== 0 || !ready.stdout.trim()) {
+    return [];
+  }
+  const issues = parseJson(ready.stdout, []);
+  const tasks = issues.filter((issue) => issue.issue_type === "task" && issue.status === "open");
+  sortByPriorityAndCreatedAt(tasks);
+  return tasks.filter((issue) => typeof issue.id === "string" && issue.id).filter((issue) => resolveParentEpic(projectRoot, issue.id) === epicId).map((issue) => ({
+    id: issue.id,
+    title: typeof issue.title === "string" && issue.title.trim().length > 0 ? issue.title : issue.id
+  }));
+}
+var LOCAL_CONTROL_BINARY_SPECS = [
+  { entrypoint: "packages/cli/bin/rig.ts", output: ".rig/bin/rig" },
+  { entrypoint: "packages/runtime/bin/rig-agent-dispatch.ts", output: ".rig/bin/rig-agent" }
+];
+function hasLocalControlDispatchSource(root) {
+  return existsSync11(resolve14(root, "packages/runtime/bin/rig-agent-dispatch.ts"));
+}
+function resolveLocalControlBinarySourceRoot(projectRoot, options = {}) {
+  const env = options.env ?? process.env;
+  const candidates = [
+    env.RIG_HOST_PROJECT_ROOT?.trim(),
+    env.PROJECT_RIG_ROOT?.trim(),
+    options.cwd ?? process.cwd(),
+    resolve14(options.moduleDir ?? import.meta.dir, "../../../../.."),
+    projectRoot
+  ].filter((value) => Boolean(value));
+  for (const candidate of candidates) {
+    const root = resolve14(candidate);
+    if (hasLocalControlDispatchSource(root)) {
+      return root;
+    }
+  }
+  return resolve14(projectRoot);
+}
+function collectLocalControlBinaryBuildTargets(projectRoot, sourceRoot) {
+  return LOCAL_CONTROL_BINARY_SPECS.flatMap((spec) => {
+    const sourcePath = resolve14(sourceRoot, spec.entrypoint);
+    if (!existsSync11(sourcePath))
+      return [];
+    return [{
+      entrypoint: spec.entrypoint,
+      sourcePath,
+      outputPath: resolve14(projectRoot, spec.output)
+    }];
+  });
+}
+async function resolvePreferredShellBinary(projectRoot, runtimeContext) {
+  if (runtimeContext) {
+    const runtimeAgent = resolve14(runtimeContext.binDir, "rig-agent");
+    if (existsSync11(runtimeAgent)) {
+      return runtimeAgent;
+    }
+  }
+  const agent = resolve14(projectRoot, ".rig/bin/rig-agent");
+  const sourceRoot = resolveLocalControlBinarySourceRoot(projectRoot);
+  if (!existsSync11(agent) || localControlBinaryNeedsRebuild(sourceRoot, agent, "packages/runtime/bin/rig-agent-dispatch.ts")) {
+    await ensureLocalControlBinaries(projectRoot, sourceRoot);
+  }
+  if (existsSync11(agent)) {
+    return agent;
+  }
+  throw new RemoteCliError("RIG_RUN_MISSING_AGENT_BINARY", `Missing compiled agent dispatch binary at ${agent}. Run the local control binary build first.`, 2);
+}
+function localControlBinaryNeedsRebuild(projectRoot, outputPath, entrypoint) {
+  if (!existsSync11(outputPath)) {
+    return true;
+  }
+  let outputMtime = 0;
+  try {
+    outputMtime = statSync4(outputPath).mtimeMs;
+  } catch {
+    return true;
+  }
+  const sourceRoots = entrypoint === "packages/runtime/bin/rig-agent-dispatch.ts" ? [
+    "packages/contracts/src",
+    "packages/core/src",
+    "packages/runtime/bin",
+    "packages/runtime/src",
+    "packages/runtime/native",
+    "packages/standard-plugin/src"
+  ] : [
+    "packages/cli/bin",
+    "packages/cli/src",
+    "packages/runtime/src",
+    "packages/server/src"
+  ];
+  for (const relativePath of sourceRoots) {
+    if (sourceTreeHasNewerFiles(projectRoot, relativePath, outputMtime)) {
+      return true;
+    }
+  }
+  return false;
+}
+function sourceTreeHasNewerFiles(projectRoot, relativePath, outputMtime) {
+  const rootPath = resolve14(projectRoot, relativePath);
+  if (!existsSync11(rootPath)) {
+    return false;
+  }
+  const pending = [rootPath];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) {
+      continue;
+    }
+    let currentStat;
+    try {
+      currentStat = statSync4(current);
+    } catch {
+      return true;
+    }
+    if (currentStat.isDirectory()) {
+      let entries;
+      try {
+        entries = readdirSync2(current, { withFileTypes: true, encoding: "utf8" });
+      } catch {
+        return true;
+      }
+      for (const entry of entries) {
+        if (entry.name === "node_modules" || entry.name === ".git" || entry.name === ".worktrees" || entry.name === ".rig") {
+          continue;
+        }
+        pending.push(resolve14(current, entry.name));
+      }
+      continue;
+    }
+    if (currentStat.mtimeMs > outputMtime) {
+      return true;
+    }
+  }
+  return false;
+}
+function requireBinary(name, message) {
+  if (!Bun.which(name)) {
+    throw new RemoteCliError("RIG_RUN_MISSING_BINARY", message, 2, { name });
+  }
+}
+async function ensureLocalControlBinaries(projectRoot, sourceRoot = resolveLocalControlBinarySourceRoot(projectRoot)) {
+  const targets = collectLocalControlBinaryBuildTargets(projectRoot, sourceRoot);
+  const secretDefines = secretDefinesFromEnv(process.env, projectRoot);
+  for (const target of targets) {
+    mkdirSync5(dirname11(target.outputPath), { recursive: true });
+    try {
+      await buildRuntimeBinary({
+        sourcePath: target.sourcePath,
+        outputPath: target.outputPath,
+        cwd: sourceRoot,
+        define: target.entrypoint === "packages/runtime/bin/rig-agent-dispatch.ts" ? secretDefines : undefined
+      });
+    } catch (error) {
+      throw new RemoteCliError("RIG_RUN_BINARY_BUILD_FAILED", `Failed to compile ${target.entrypoint}: ${error instanceof Error ? error.message : "unknown error"}`, 2);
+    }
+  }
+}
+async function readSessionEpic(projectRoot) {
+  const file = resolve14(resolveAuthorityPaths(projectRoot).stateDir, "session-meta.json");
+  if (!existsSync11(file)) {
+    return "";
+  }
+  try {
+    const parsed = await Bun.file(file).json();
+    if (typeof parsed.epicId !== "string" || !parsed.epicId) {
+      return "";
+    }
+    if (await sessionTasksExhausted(projectRoot)) {
+      clearExhaustedSession(projectRoot);
+      return "";
+    }
+    return parsed.epicId;
+  } catch {
+    return "";
+  }
+}
+async function sessionTasksExhausted(projectRoot) {
+  const sessionFile = resolve14(resolveAuthorityPaths(projectRoot).stateDir, "session.json");
+  if (!existsSync11(sessionFile)) {
+    return false;
+  }
+  try {
+    const session = await Bun.file(sessionFile).json();
+    const tasks = session?.trackerState?.tasks;
+    if (!Array.isArray(tasks) || tasks.length === 0) {
+      return true;
+    }
+    return tasks.every((t) => t.status === "completed");
+  } catch {
+    return false;
+  }
+}
+function clearExhaustedSession(projectRoot) {
+  for (const name of ["session-meta.json", "session.json"]) {
+    try {
+      rmSync5(resolve14(resolveAuthorityPaths(projectRoot).stateDir, name), { force: true });
+    } catch {}
+  }
+}
+function epicFromReadyTasks(projectRoot) {
+  const ready = runCapture(["br", "--no-db", "ready", "--json"], projectRoot);
+  if (ready.exitCode !== 0 || !ready.stdout.trim()) {
+    return "";
+  }
+  const issues = parseJson(ready.stdout, []);
+  const tasks = issues.filter((issue) => issue.issue_type === "task" && issue.status === "open");
+  sortByPriorityAndCreatedAt(tasks);
+  const firstTaskId = tasks[0]?.id;
+  if (!firstTaskId) {
+    return "";
+  }
+  return resolveParentEpic(projectRoot, firstTaskId);
+}
+function resolveParentEpic(projectRoot, taskId) {
+  const deps = runCapture(["br", "--no-db", "dep", "list", taskId, "--json"], projectRoot);
+  if (deps.exitCode !== 0 || !deps.stdout.trim()) {
+    return "";
+  }
+  const parsed = parseJson(deps.stdout, []);
+  for (const item of parsed) {
+    const type = typeof item.type === "string" ? item.type : "";
+    const dependsOn = typeof item.depends_on_id === "string" ? item.depends_on_id : "";
+    if (type === "parent-child" && dependsOn) {
+      return dependsOn;
+    }
+  }
+  return "";
+}
+function sortByPriorityAndCreatedAt(issues) {
+  issues.sort((a, b) => {
+    const pa = Number.isFinite(a.priority) ? Number(a.priority) : Number.MAX_SAFE_INTEGER;
+    const pb = Number.isFinite(b.priority) ? Number(b.priority) : Number.MAX_SAFE_INTEGER;
+    if (pa !== pb) {
+      return pa - pb;
+    }
+    const ca = typeof a.created_at === "string" ? Date.parse(a.created_at) : Number.MAX_SAFE_INTEGER;
+    const cb = typeof b.created_at === "string" ? Date.parse(b.created_at) : Number.MAX_SAFE_INTEGER;
+    return ca - cb;
+  });
+}
+function resolvePublishedServerStatePath(projectRoot) {
+  return resolve14(resolveAuthorityPaths(projectRoot).stateDir, "rig-server.json");
+}
+async function readPublishedServerState(projectRoot) {
+  const filePath = resolvePublishedServerStatePath(projectRoot);
+  if (!existsSync11(filePath)) {
+    return null;
+  }
+  try {
+    return await Bun.file(filePath).json();
+  } catch {
+    return null;
+  }
+}
+async function waitForServerHealthy(baseUrl, timeoutMs = 15000, authToken = null) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(`${baseUrl}/health`, {
+        headers: authToken ? { authorization: `Bearer ${authToken}` } : undefined
+      });
+      if (response.ok) {
+        return true;
+      }
+    } catch {}
+    await Bun.sleep(250);
+  }
+  return false;
+}
+async function waitForPublishedServer(projectRoot, authToken, timeoutMs = 15000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const published = await readPublishedServerState(projectRoot);
+    if (published && published.authToken === authToken) {
+      const baseUrl = `http://${published.host}:${published.port}`;
+      if (await waitForServerHealthy(baseUrl, 500, published.authToken)) {
+        return published;
+      }
+    }
+    await Bun.sleep(250);
+  }
+  return null;
+}
+async function ensureServerForRuns(projectRoot) {
+  const published = await readPublishedServerState(projectRoot);
+  if (published) {
+    const baseUrl = `http://${published.host}:${published.port}`;
+    if (await waitForServerHealthy(baseUrl, 1500, published.authToken)) {
+      return { baseUrl, authToken: published.authToken };
+    }
+  }
+  const authToken = randomUUID().replace(/-/g, "");
+  const child = Bun.spawn([
+    "bun",
+    "run",
+    "packages/server/src/server.ts",
+    "start",
+    "--host",
+    "127.0.0.1",
+    "--port",
+    "0",
+    "--auth-token",
+    authToken
+  ], {
+    cwd: projectRoot,
+    env: {
+      ...process.env,
+      PROJECT_RIG_ROOT: projectRoot
+    },
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: "ignore",
+    detached: true
+  });
+  writeFileSync5(resolve14(resolveAuthorityPaths(projectRoot).stateDir, "event-server.pid"), String(child.pid));
+  const ready = await waitForPublishedServer(projectRoot, authToken);
+  if (!ready) {
+    throw new RemoteCliError("RIG_RUN_SERVER_TIMEOUT", "Timed out waiting for Rig server to start.", 1);
+  }
+  return {
+    baseUrl: `http://${ready.host}:${ready.port}`,
+    authToken: ready.authToken
+  };
+}
+var __testOnly = {
+  waitForServerHealthy
+};
+function parseJson(raw, fallback) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+function parsePositiveInt(raw, fallback) {
+  if (!raw) {
+    return fallback;
+  }
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value <= 0) {
+    return fallback;
+  }
+  return value;
+}
+export {
+  startRun,
+  runStop,
+  runStatus,
+  runResume,
+  resolvePreferredShellBinary,
+  resolveLocalControlBinarySourceRoot,
+  resolveDefaultEpic,
+  listReadyTasksForEpic,
+  listOpenEpics,
+  deleteRunState,
+  defaultStartRunOptions,
+  collectLocalControlBinaryBuildTargets,
+  cleanupRunState,
+  buildRuntimePath,
+  __testOnly
+};