@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/native/validator-binaries.js

@@ -0,0 +1,889 @@
+// @bun
+// packages/runtime/src/control-plane/native/validator-binaries.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve7 } from "path";
+
+// packages/runtime/src/binary-run.ts
+import { chmodSync, cpSync, existsSync as existsSync2, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { drainMicrotasks, gcAndSweep } from "bun:jsc";
+
+// packages/runtime/src/layout.ts
+import { existsSync } from "fs";
+import { basename, dirname, resolve } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve(explicit);
+    const explicitParent = dirname(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname(explicitParent);
+      const ownerHasGit = existsSync(resolve(owner, ".git"));
+      const ownerHasTaskConfig = existsSync(resolve(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync(resolve(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync(resolve(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync(resolve(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync(resolve(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname(projectParent);
+    const ownerHasGit = existsSync(resolve(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync(resolve(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync(resolve(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve(workspaceDir);
+  const rigRoot = resolve(root, ".rig");
+  const logsDir = resolve(rigRoot, "logs");
+  const stateDir = resolve(rigRoot, "state");
+  const runtimeDir = resolve(rigRoot, "runtime");
+  const binDir = resolve(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve(rigRoot, "home"),
+    tmpDir: resolve(rigRoot, "tmp"),
+    cacheDir: resolve(rigRoot, "cache"),
+    sessionDir: resolve(rigRoot, "session"),
+    binDir,
+    distDir: resolve(rigRoot, "dist"),
+    pluginBinDir: resolve(binDir, "plugins"),
+    contextPath: resolve(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve(definitionRoot, "config.sh"),
+    taskConfigPath: resolve(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve(policyDir, "policy.json"),
+    pluginsDir: resolve(definitionRoot, "plugins"),
+    hooksDir: resolve(definitionRoot, "hooks"),
+    toolsDir: resolve(definitionRoot, "tools"),
+    templatesDir: resolve(definitionRoot, "templates"),
+    validationDir: resolve(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+async function buildRuntimeBinary(options) {
+  return runSerializedRuntimeBinaryBuild(async () => {
+    const resolved = resolveRuntimeBinaryBuildOptions(options);
+    runBestEffortBuildGc();
+    const manifestPath = runtimeBinaryCacheManifestPath(resolved.outputPath);
+    const buildKey = createRuntimeBinaryBuildKey({
+      entrypoint: resolved.entrypoint,
+      define: resolved.define,
+      env: resolved.env
+    });
+    if (await isRuntimeBinaryBuildFresh({ outputPath: resolved.outputPath, manifestPath, buildKey })) {
+      return;
+    }
+    if (shouldUseRuntimeBinaryBuildWorker()) {
+      await buildRuntimeBinaryViaWorker(resolved);
+    } else {
+      await buildRuntimeBinaryInProcess(resolved, { manifestPath, buildKey });
+    }
+    runBestEffortBuildGc();
+  });
+}
+async function buildRuntimeBinaryInProcess(options, manifest) {
+  const tempBuildDir = resolve2(dirname2(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve2(tempBuildDir, basename2(options.outputPath));
+  mkdirSync(tempBuildDir, { recursive: true });
+  await withTemporaryEnv({
+    ...options.env,
+    ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+  }, async () => withTemporaryCwd(tempBuildDir, async () => {
+    const buildResult = await Bun.build({
+      entrypoints: [options.entrypoint],
+      compile: {
+        target: currentCompileTarget(),
+        outfile: tempOutputPath
+      },
+      target: "bun",
+      format: "esm",
+      minify: true,
+      bytecode: true,
+      metafile: true,
+      define: options.define ? {
+        __RIG_BUILD_CONFIG__: JSON.stringify(options.define)
+      } : undefined
+    });
+    if (!buildResult.success) {
+      const details = buildResult.logs.map((log) => [log.message, log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+      throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
+    }
+    if (!existsSync2(tempOutputPath)) {
+      const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+      throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+    }
+    renameSync(tempOutputPath, options.outputPath);
+    chmodSync(options.outputPath, 493);
+    if (manifest) {
+      await writeRuntimeBinaryCacheManifest({
+        manifestPath: manifest.manifestPath,
+        buildKey: manifest.buildKey,
+        cwd: tempBuildDir,
+        metafile: buildResult.metafile
+      });
+    }
+  })).finally(() => {
+    rmSync(tempBuildDir, { recursive: true, force: true });
+  });
+}
+function runBestEffortBuildGc() {
+  try {
+    drainMicrotasks();
+  } catch {}
+  try {
+    gcAndSweep();
+  } catch {}
+}
+function runtimeBinaryCacheManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function resolveRuntimeBinaryBuildOptions(options) {
+  return {
+    ...options,
+    entrypoint: resolve2(options.cwd, options.sourcePath),
+    outputPath: resolve2(options.outputPath)
+  };
+}
+function shouldUseRuntimeBinaryBuildWorker() {
+  if (process.env.RIG_RUNTIME_BUILD_WORKER === "1") {
+    return false;
+  }
+  if (process.env.RIG_RUNTIME_BUILD_IN_PROCESS === "1") {
+    return false;
+  }
+  return true;
+}
+async function buildRuntimeBinaryViaWorker(options) {
+  const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
+  if (!workerSourcePath || !existsSync2(workerSourcePath)) {
+    await buildRuntimeBinaryInProcess(options, {
+      manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
+      buildKey: createRuntimeBinaryBuildKey({
+        entrypoint: options.entrypoint,
+        define: options.define,
+        env: options.env
+      })
+    });
+    return;
+  }
+  const payloadPath = createRuntimeBinaryBuildWorkerPayloadPath(options.outputPath);
+  const bunCli = resolveRuntimeBinaryBuildWorkerInvocation();
+  await Bun.write(payloadPath, `${JSON.stringify(options)}
+`);
+  const build = Bun.spawn([bunCli.command, workerSourcePath, payloadPath], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...options.env,
+      ...bunCli.env,
+      RIG_RUNTIME_BUILD_WORKER: "1"
+    }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  rmSync(payloadPath, { force: true });
+  if (exitCode !== 0) {
+    throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
+  }
+}
+function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
+  return resolve2(dirname2(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+}
+function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
+  const envRoots = [
+    options.cwd?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    const candidate = resolve2(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  const localCandidate = resolve2(import.meta.dir, "binary-build-worker.ts");
+  return existsSync2(localCandidate) ? localCandidate : null;
+}
+function resolveRuntimeBinaryBuildWorkerInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime binary build worker.");
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+function createRuntimeBinaryBuildKey(input) {
+  return JSON.stringify({
+    version: 1,
+    bunVersion: Bun.version,
+    platform: process.platform,
+    arch: process.arch,
+    entrypoint: input.entrypoint,
+    define: sortRecord(input.define),
+    env: sortRecord(input.env)
+  });
+}
+async function isRuntimeBinaryBuildFresh(input) {
+  if (!existsSync2(input.outputPath) || !existsSync2(input.manifestPath)) {
+    return false;
+  }
+  let manifest = null;
+  try {
+    manifest = await Bun.file(input.manifestPath).json();
+  } catch {
+    return false;
+  }
+  if (!manifest || manifest.version !== 1 || manifest.buildKey !== input.buildKey) {
+    return false;
+  }
+  for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
+    if (!existsSync2(filePath)) {
+      return false;
+    }
+    if (await sha256File(filePath) !== expectedDigest) {
+      return false;
+    }
+  }
+  return true;
+}
+async function writeRuntimeBinaryCacheManifest(input) {
+  const inputs = {};
+  for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
+    const normalized = normalizeBuildInputPath(input.cwd, inputPath);
+    if (!normalized || !existsSync2(normalized)) {
+      continue;
+    }
+    inputs[normalized] = await sha256File(normalized);
+  }
+  const manifest = {
+    version: 1,
+    buildKey: input.buildKey,
+    inputs
+  };
+  await Bun.write(input.manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function normalizeBuildInputPath(cwd, inputPath) {
+  if (!inputPath) {
+    return null;
+  }
+  if (inputPath.startsWith("file://")) {
+    return fileURLToPath(inputPath);
+  }
+  if (inputPath.startsWith("<")) {
+    return null;
+  }
+  return resolve2(cwd, inputPath);
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+function sortRecord(value) {
+  if (!value) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/provisioning-env.ts
+import { delimiter, resolve as resolve4 } from "path";
+
+// packages/runtime/src/control-plane/runtime/runtime-paths.ts
+import { existsSync as existsSync3, readdirSync, realpathSync } from "fs";
+import { resolve as resolve3 } from "path";
+
+// packages/runtime/src/control-plane/runtime/sandbox/utils.ts
+function uniq(values) {
+  return [...new Set(values)];
+}
+// packages/runtime/src/control-plane/runtime/runtime-paths.ts
+function resolveBunBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_BUN_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathBun = normalizeExecutablePath(Bun.which("bun")?.trim());
+  if (pathBun && !looksLikeRuntimeGateway(pathBun)) {
+    return pathBun;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve3(home, ".bun/bin/bun") : "",
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun",
+    "/usr/bin/bun"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  const execPath = normalizeExecutablePath(process.execPath?.trim());
+  if (execPath && !looksLikeRuntimeGateway(execPath)) {
+    return execPath;
+  }
+  throw new Error("bun not found in PATH");
+}
+function resolveClaudeBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_CLAUDE_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathClaude = normalizeExecutablePath(Bun.which("claude")?.trim());
+  if (pathClaude && !looksLikeRuntimeGateway(pathClaude)) {
+    return pathClaude;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve3(home, ".local/bin/claude") : "",
+    home ? resolve3(home, ".local/share/claude/local/claude") : "",
+    "/opt/homebrew/bin/claude",
+    "/usr/local/bin/claude",
+    "/usr/bin/claude"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  throw new Error("claude not found in PATH");
+}
+function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
+  return resolve3(bunBinaryPath, "../..");
+}
+function resolveClaudeInstallDir() {
+  const realPath = resolveClaudeBinaryPath();
+  return resolve3(realPath, "..");
+}
+function resolveNodeInstallDir() {
+  const preferredNode = resolvePreferredNodeBinary();
+  if (!preferredNode)
+    return null;
+  const explicitNode = process.env.RIG_NODE_BIN?.trim();
+  if (explicitNode && resolve3(explicitNode) === resolve3(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve3(preferredNode, "../..") : resolve3(preferredNode, "..");
+  }
+  try {
+    const realPath = realpathSync(preferredNode);
+    if (realPath.endsWith("/bin/node")) {
+      return resolve3(realPath, "../..");
+    }
+    return resolve3(realPath, "..");
+  } catch {
+    return resolve3(preferredNode, "..");
+  }
+}
+function resolvePreferredNodeBinary() {
+  const candidates = [];
+  const envNode = process.env.RIG_NODE_BIN?.trim();
+  if (envNode) {
+    const explicit = resolve3(envNode);
+    if (existsSync3(explicit)) {
+      return explicit;
+    }
+  }
+  const nvmBin = process.env.NVM_BIN?.trim();
+  if (nvmBin) {
+    candidates.push(resolve3(nvmBin, "node"));
+  }
+  const home = process.env.HOME?.trim();
+  if (home) {
+    const nvmVersionsDir = resolve3(home, ".nvm/versions/node");
+    if (existsSync3(nvmVersionsDir)) {
+      try {
+        const versionDirs = readdirSync(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        for (const versionDir of versionDirs) {
+          candidates.push(resolve3(nvmVersionsDir, versionDir, "bin/node"));
+        }
+      } catch {}
+    }
+  }
+  const whichNode = Bun.which("node");
+  if (whichNode) {
+    candidates.push(whichNode);
+  }
+  const deduped = uniq(candidates.map((candidate) => resolve3(candidate)));
+  const existing = deduped.filter((candidate) => existsSync3(candidate));
+  if (existing.length === 0) {
+    return null;
+  }
+  const stable = existing.find((candidate) => {
+    const major = inferNodeMajor(candidate);
+    return typeof major === "number" && major >= 18 && major <= 24;
+  });
+  if (stable) {
+    return stable;
+  }
+  return existing[0] ?? null;
+}
+function inferNodeMajor(nodeBinaryPath) {
+  const normalized = resolve3(nodeBinaryPath).replace(/\\/g, "/");
+  const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
+  if (!match) {
+    return null;
+  }
+  const major = Number.parseInt(match[1], 10);
+  return Number.isFinite(major) ? major : null;
+}
+function normalizeExecutablePath(candidate) {
+  if (!candidate) {
+    return "";
+  }
+  const normalized = resolve3(candidate);
+  if (!existsSync3(normalized)) {
+    return "";
+  }
+  try {
+    return realpathSync(normalized);
+  } catch {
+    return normalized;
+  }
+}
+function looksLikeRuntimeGateway(candidate) {
+  const normalized = resolve3(candidate).replace(/\\/g, "/");
+  return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
+}
+
+// packages/runtime/src/control-plane/runtime/provisioning-env.ts
+function runtimeProvisioningEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  const realBash = baseEnv.RIG_REAL_BASH?.trim() || "/bin/bash";
+  const bunBinary = baseEnv.RIG_BUN_PATH?.trim() || resolveBunBinaryPath();
+  const bunDir = resolveBunInstallDir(bunBinary);
+  const claudeBinary = baseEnv.RIG_CLAUDE_PATH?.trim() || (() => {
+    try {
+      return resolveClaudeBinaryPath();
+    } catch {
+      return "";
+    }
+  })();
+  const claudeDir = claudeBinary ? (() => {
+    try {
+      return resolveClaudeInstallDir();
+    } catch {
+      return resolve4(claudeBinary, "..");
+    }
+  })() : "";
+  const nodeDir = resolveNodeInstallDir();
+  const realHome = baseEnv.HOME?.trim();
+  const inheritedPath = (baseEnv.PATH ?? "").split(delimiter).map((entry) => entry.trim()).filter(Boolean).filter((entry) => !entry.endsWith("/.rig/bin") && !entry.endsWith("/rig/tools"));
+  const pathEntries = [
+    `${bunDir}/bin`,
+    claudeDir,
+    nodeDir ? `${nodeDir}/bin` : "",
+    realHome ? resolve4(realHome, ".local/bin") : "",
+    realHome ? resolve4(realHome, ".cargo/bin") : "",
+    ...inheritedPath,
+    "/usr/local/bin",
+    "/usr/local/sbin",
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ].filter(Boolean);
+  env.BASH = realBash;
+  env.SHELL = baseEnv.SHELL?.trim() || realBash;
+  env.PATH = [...new Set(pathEntries)].join(delimiter);
+  env.RIG_BUN_PATH = bunBinary;
+  if (claudeBinary) {
+    env.RIG_CLAUDE_PATH = claudeBinary;
+  }
+  env.PYTHON = env.PYTHON?.trim() || "python3";
+  const nodeGypPath = Bun.which("node-gyp");
+  if (nodeGypPath) {
+    env.npm_config_node_gyp = nodeGypPath;
+  }
+  delete env.RIG_BASH_ACTIVE;
+  delete env.RIG_BASH_MODE;
+  return env;
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { resolve as resolve6 } from "path";
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname3, resolve as resolve5 } from "path";
+var sharedNativeRuntimeOutputDir = resolve5(tmpdir(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve5(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync4(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync4(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve5(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve5(cursor, "native", `${process.platform}-${process.arch}`, name), resolve5(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve5(cursor, "native", name), resolve5(cursor, "native", "lib", name));
+    }
+    const parent = dirname3(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve5(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve5(execDir, platformSpecific) : "",
+    execDir ? resolve5(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve5(execDir, "..", platformSpecific) : "",
+    execDir ? resolve5(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve5(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync4(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve5(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync4(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync2(dirname3(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync4(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync4(tempOutputPath)) {
+      rmSync2(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync2(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync2(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var scopeRegexCache = new Map;
+function resolveHarnessPaths(projectRoot) {
+  const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const harnessRoot = resolve6(projectRoot, "rig");
+  const stateRoot = resolve6(projectRoot, ".rig");
+  const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
+  const stateDir = layout?.stateDir ?? resolve6(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve6(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve6(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve6(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve6(stateRoot, "bin");
+  return {
+    harnessRoot,
+    stateDir: process.env.RIG_STATE_DIR || stateDir,
+    artifactsDir,
+    logsDir: process.env.RIG_LOGS_DIR || logsDir,
+    binDir,
+    hooksDir: resolve6(harnessRoot, "hooks"),
+    validationDir: resolve6(harnessRoot, "validation"),
+    taskConfigPath,
+    sessionPath: process.env.RIG_SESSION_FILE || resolve6(stateRoot, "session", "session.json"),
+    monorepoRoot,
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve6(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve6(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve6(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve6(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve6(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve6(stateDir, "review-profile.json")
+  };
+}
+
+// packages/runtime/src/control-plane/native/validator-binaries.ts
+function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
+  if (runtimeContext) {
+    return resolve7(runtimeContext.binDir, "validators", binaryName);
+  }
+  return resolve7(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+}
+async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
+  const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
+  if (!match) {
+    return null;
+  }
+  const category = match[1];
+  const check = match[2];
+  if (!category || !check) {
+    return null;
+  }
+  const binaryName = `${category}-${check}`;
+  const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
+  const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
+  const sourcePath = resolve7(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync5(sourcePath)) {
+    return null;
+  }
+  const sourceMtime = statSync2(sourcePath).mtimeMs;
+  const binaryExists = existsSync5(binaryPath);
+  const binaryMtime = binaryExists ? statSync2(binaryPath).mtimeMs : 0;
+  if (!binaryExists || sourceMtime > binaryMtime) {
+    if (binaryExists) {
+      rmSync3(binaryPath, { force: true });
+      rmSync3(`${binaryPath}.build-manifest.json`, { force: true });
+    }
+    mkdirSync3(dirname4(binaryPath), { recursive: true });
+    await buildRuntimeBinary({
+      sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
+      outputPath: binaryPath,
+      cwd: hostProjectRoot,
+      define: { AGENT_BUN_PATH: resolveBunBinaryPath() },
+      env: runtimeProvisioningEnv()
+    });
+  }
+  return existsSync5(binaryPath) ? binaryPath : null;
+}
+export {
+  resolveValidatorBinaryPath,
+  ensureValidatorBinary
+};