@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/runtime/isolation/toolchain.js

@@ -0,0 +1,1892 @@
+// @bun
+// packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
+import {
+  existsSync as existsSync11,
+  lstatSync,
+  mkdirSync as mkdirSync7,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync2,
+  rmSync as rmSync7,
+  statSync as statSync4,
+  symlinkSync as symlinkSync4
+} from "fs";
+import { mkdir, writeFile } from "fs/promises";
+import { dirname as dirname8, resolve as resolve12 } from "path";
+
+// packages/runtime/src/binary-run.ts
+import { chmodSync, cpSync, existsSync as existsSync2, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
+import { basename as basename2, dirname as dirname2, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { drainMicrotasks, gcAndSweep } from "bun:jsc";
+
+// packages/runtime/src/layout.ts
+import { existsSync } from "fs";
+import { basename, dirname, resolve } from "path";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve(explicit);
+    const explicitParent = dirname(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname(explicitParent);
+      const ownerHasGit = existsSync(resolve(owner, ".git"));
+      const ownerHasTaskConfig = existsSync(resolve(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync(resolve(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync(resolve(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync(resolve(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync(resolve(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname(projectParent);
+    const ownerHasGit = existsSync(resolve(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync(resolve(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync(resolve(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+async function buildRuntimeBinary(options) {
+  return runSerializedRuntimeBinaryBuild(async () => {
+    const resolved = resolveRuntimeBinaryBuildOptions(options);
+    runBestEffortBuildGc();
+    const manifestPath = runtimeBinaryCacheManifestPath(resolved.outputPath);
+    const buildKey = createRuntimeBinaryBuildKey({
+      entrypoint: resolved.entrypoint,
+      define: resolved.define,
+      env: resolved.env
+    });
+    if (await isRuntimeBinaryBuildFresh({ outputPath: resolved.outputPath, manifestPath, buildKey })) {
+      return;
+    }
+    if (shouldUseRuntimeBinaryBuildWorker()) {
+      await buildRuntimeBinaryViaWorker(resolved);
+    } else {
+      await buildRuntimeBinaryInProcess(resolved, { manifestPath, buildKey });
+    }
+    runBestEffortBuildGc();
+  });
+}
+async function buildRuntimeBinaryInProcess(options, manifest) {
+  const tempBuildDir = resolve2(dirname2(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve2(tempBuildDir, basename2(options.outputPath));
+  mkdirSync(tempBuildDir, { recursive: true });
+  await withTemporaryEnv({
+    ...options.env,
+    ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+  }, async () => withTemporaryCwd(tempBuildDir, async () => {
+    const buildResult = await Bun.build({
+      entrypoints: [options.entrypoint],
+      compile: {
+        target: currentCompileTarget(),
+        outfile: tempOutputPath
+      },
+      target: "bun",
+      format: "esm",
+      minify: true,
+      bytecode: true,
+      metafile: true,
+      define: options.define ? {
+        __RIG_BUILD_CONFIG__: JSON.stringify(options.define)
+      } : undefined
+    });
+    if (!buildResult.success) {
+      const details = buildResult.logs.map((log) => [log.message, log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+      throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
+    }
+    if (!existsSync2(tempOutputPath)) {
+      const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+      throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+    }
+    renameSync(tempOutputPath, options.outputPath);
+    chmodSync(options.outputPath, 493);
+    if (manifest) {
+      await writeRuntimeBinaryCacheManifest({
+        manifestPath: manifest.manifestPath,
+        buildKey: manifest.buildKey,
+        cwd: tempBuildDir,
+        metafile: buildResult.metafile
+      });
+    }
+  })).finally(() => {
+    rmSync(tempBuildDir, { recursive: true, force: true });
+  });
+}
+function runBestEffortBuildGc() {
+  try {
+    drainMicrotasks();
+  } catch {}
+  try {
+    gcAndSweep();
+  } catch {}
+}
+function runtimeBinaryCacheManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function resolveRuntimeBinaryBuildOptions(options) {
+  return {
+    ...options,
+    entrypoint: resolve2(options.cwd, options.sourcePath),
+    outputPath: resolve2(options.outputPath)
+  };
+}
+function shouldUseRuntimeBinaryBuildWorker() {
+  if (process.env.RIG_RUNTIME_BUILD_WORKER === "1") {
+    return false;
+  }
+  if (process.env.RIG_RUNTIME_BUILD_IN_PROCESS === "1") {
+    return false;
+  }
+  return true;
+}
+async function buildRuntimeBinaryViaWorker(options) {
+  const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
+  if (!workerSourcePath || !existsSync2(workerSourcePath)) {
+    await buildRuntimeBinaryInProcess(options, {
+      manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
+      buildKey: createRuntimeBinaryBuildKey({
+        entrypoint: options.entrypoint,
+        define: options.define,
+        env: options.env
+      })
+    });
+    return;
+  }
+  const payloadPath = createRuntimeBinaryBuildWorkerPayloadPath(options.outputPath);
+  const bunCli = resolveRuntimeBinaryBuildWorkerInvocation();
+  await Bun.write(payloadPath, `${JSON.stringify(options)}
+`);
+  const build = Bun.spawn([bunCli.command, workerSourcePath, payloadPath], {
+    cwd: options.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...options.env,
+      ...bunCli.env,
+      RIG_RUNTIME_BUILD_WORKER: "1"
+    }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  rmSync(payloadPath, { force: true });
+  if (exitCode !== 0) {
+    throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
+  }
+}
+function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
+  return resolve2(dirname2(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+}
+function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
+  const envRoots = [
+    options.cwd?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    const candidate = resolve2(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  const localCandidate = resolve2(import.meta.dir, "binary-build-worker.ts");
+  return existsSync2(localCandidate) ? localCandidate : null;
+}
+function resolveRuntimeBinaryBuildWorkerInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime binary build worker.");
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+function createRuntimeBinaryBuildKey(input) {
+  return JSON.stringify({
+    version: 1,
+    bunVersion: Bun.version,
+    platform: process.platform,
+    arch: process.arch,
+    entrypoint: input.entrypoint,
+    define: sortRecord(input.define),
+    env: sortRecord(input.env)
+  });
+}
+async function isRuntimeBinaryBuildFresh(input) {
+  if (!existsSync2(input.outputPath) || !existsSync2(input.manifestPath)) {
+    return false;
+  }
+  let manifest = null;
+  try {
+    manifest = await Bun.file(input.manifestPath).json();
+  } catch {
+    return false;
+  }
+  if (!manifest || manifest.version !== 1 || manifest.buildKey !== input.buildKey) {
+    return false;
+  }
+  for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
+    if (!existsSync2(filePath)) {
+      return false;
+    }
+    if (await sha256File(filePath) !== expectedDigest) {
+      return false;
+    }
+  }
+  return true;
+}
+async function writeRuntimeBinaryCacheManifest(input) {
+  const inputs = {};
+  for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
+    const normalized = normalizeBuildInputPath(input.cwd, inputPath);
+    if (!normalized || !existsSync2(normalized)) {
+      continue;
+    }
+    inputs[normalized] = await sha256File(normalized);
+  }
+  const manifest = {
+    version: 1,
+    buildKey: input.buildKey,
+    inputs
+  };
+  await Bun.write(input.manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function normalizeBuildInputPath(cwd, inputPath) {
+  if (!inputPath) {
+    return null;
+  }
+  if (inputPath.startsWith("file://")) {
+    return fileURLToPath(inputPath);
+  }
+  if (inputPath.startsWith("<")) {
+    return null;
+  }
+  return resolve2(cwd, inputPath);
+}
+async function sha256File(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+function sortRecord(value) {
+  if (!value) {
+    return;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync as chmodSync2, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname3, isAbsolute, resolve as resolve3 } from "path";
+var sharedGitNativeOutputDir = resolve3(tmpdir(), "rig-native");
+var sharedGitNativeOutputPath = resolve3(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  return resolve3(dirname3(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+}
+function publishGitBinary(tempOutputPath, outputPath) {
+  try {
+    renameSync2(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync3(outputPath)) {
+      rmSync2(outputPath, { force: true });
+      renameSync2(tempOutputPath, outputPath);
+      return;
+    }
+    throw error;
+  }
+}
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
+}
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve3(import.meta.dir, "../../../native/rig-git.zig");
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve3(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve3(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve3(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve3(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve3(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve3(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve3(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve3(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve3(cursor, "native", fileName), resolve3(cursor, "native", "bin", fileName));
+    const parent = dirname3(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return [...new Set([
+    explicit,
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve3(execDir, fileName) : "",
+    execDir ? resolve3(execDir, "..", fileName) : "",
+    execDir ? resolve3(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest(manifestPath, buildKey) {
+  if (!existsSync3(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File2(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync2(dirname3(outputPath), { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync3(outputPath) || !await hasMatchingNativeBuildManifest(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname3(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync3(tempOutputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  chmodSync2(tempOutputPath, 493);
+  if (existsSync3(outputPath) && await hasMatchingNativeBuildManifest(manifestPath, buildKey)) {
+    rmSync2(tempOutputPath, { force: true });
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync2(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRigGitBinary(targetDir) {
+  const sourcePath = await ensureRigGitBinaryPath();
+  const targetPath = resolve3(targetDir, runtimeRigGitFileName());
+  mkdirSync2(targetDir, { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync3(targetPath) || !await hasMatchingNativeBuildManifest(nativeBuildManifestPath(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync(sourcePath, targetPath);
+    chmodSync2(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  return targetPath;
+}
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync as copyFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync as renameSync3, rmSync as rmSync3, statSync } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname as dirname4, resolve as resolve4 } from "path";
+var sharedNativeRuntimeOutputDir = resolve4(tmpdir2(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve4(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+function runtimePrepareTrackedPathsNative(input) {
+  const response = runNativeRuntimeSidecar({
+    op: "prepare-paths",
+    input
+  });
+  if (!response.ok) {
+    throw new Error(response.error);
+  }
+}
+function runtimeLinkDependencyLayerNative(sourceDir, targetDir) {
+  const response = runNativeRuntimeSidecar({
+    op: "link-dependency-layer",
+    input: { sourceDir, targetDir }
+  });
+  if (!response.ok) {
+    throw new Error(response.error);
+  }
+}
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync4(outputPath) ? outputPath : null;
+}
+async function materializeNativeRuntimeLibrary(targetDir) {
+  const sourcePath = await ensureNativeRuntimeLibraryPath();
+  if (!sourcePath) {
+    return null;
+  }
+  const targetPath = resolve4(targetDir, colocatedNativeRuntimeFileName);
+  mkdirSync3(targetDir, { recursive: true });
+  const needsCopy = !existsSync4(targetPath) || statSync(sourcePath).mtimeMs > statSync(targetPath).mtimeMs;
+  if (needsCopy) {
+    copyFileSync2(sourcePath, targetPath);
+  }
+  return targetPath;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync4(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve4(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve4(cursor, "native", `${process.platform}-${process.arch}`, name), resolve4(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve4(cursor, "native", name), resolve4(cursor, "native", "lib", name));
+    }
+    const parent = dirname4(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve4(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve4(execDir, platformSpecific) : "",
+    execDir ? resolve4(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve4(execDir, "..", platformSpecific) : "",
+    execDir ? resolve4(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve4(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync4(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve4(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync4(bundled) ? bundled : null;
+}
+function resolveNativeRuntimeSidecarSourcePath() {
+  const envRoots = [
+    process.cwd()?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter(Boolean);
+  for (const root of envRoots) {
+    for (const relative of [
+      "packages/runtime/src/control-plane/native/runtime-native-sidecar.ts",
+      "packages/runtime/dist/src/control-plane/native/runtime-native-sidecar.js"
+    ]) {
+      const candidate = resolve4(root, relative);
+      if (existsSync4(candidate)) {
+        return candidate;
+      }
+    }
+  }
+  for (const localCandidate of [
+    resolve4(import.meta.dir, "runtime-native-sidecar.js"),
+    resolve4(import.meta.dir, "runtime-native-sidecar.ts")
+  ]) {
+    if (existsSync4(localCandidate))
+      return localCandidate;
+  }
+  return null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync3(dirname4(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync4(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync4(tempOutputPath)) {
+      rmSync3(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync3(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync3(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+function runNativeRuntimeSidecar(request) {
+  const sidecarSourcePath = resolveNativeRuntimeSidecarSourcePath();
+  if (!sidecarSourcePath) {
+    throw new Error("runtime-native-sidecar.ts source file not found.");
+  }
+  const bunCli = resolveNativeRuntimeSidecarInvocation();
+  const proc = Bun.spawnSync([bunCli.command, sidecarSourcePath, JSON.stringify(request)], {
+    cwd: process.env.RIG_HOST_PROJECT_ROOT?.trim() || process.cwd(),
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      ...bunCli.env,
+      RIG_NATIVE_RUNTIME_SIDECAR: "1"
+    }
+  });
+  if (proc.exitCode !== 0) {
+    throw new Error(proc.stderr.toString() || proc.stdout.toString() || `runtime native sidecar exited ${proc.exitCode}`);
+  }
+  const stdout = proc.stdout.toString().trim();
+  if (!stdout) {
+    throw new Error("runtime native sidecar returned empty output.");
+  }
+  return JSON.parse(stdout);
+}
+function resolveNativeRuntimeSidecarInvocation() {
+  const bunPath = Bun.which("bun");
+  if (bunPath) {
+    return { command: bunPath, env: {} };
+  }
+  if (process.execPath?.trim()) {
+    return {
+      command: process.execPath,
+      env: { BUN_BE_BUN: "1" }
+    };
+  }
+  throw new Error("bun is required to run the runtime native sidecar.");
+}
+
+// packages/runtime/src/control-plane/runtime/provisioning-env.ts
+import { delimiter, resolve as resolve6 } from "path";
+
+// packages/runtime/src/control-plane/runtime/runtime-paths.ts
+import { existsSync as existsSync5, readdirSync, realpathSync } from "fs";
+import { resolve as resolve5 } from "path";
+
+// packages/runtime/src/control-plane/runtime/sandbox/utils.ts
+function uniq(values) {
+  return [...new Set(values)];
+}
+// packages/runtime/src/control-plane/runtime/runtime-paths.ts
+function resolveBunBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_BUN_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathBun = normalizeExecutablePath(Bun.which("bun")?.trim());
+  if (pathBun && !looksLikeRuntimeGateway(pathBun)) {
+    return pathBun;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve5(home, ".bun/bin/bun") : "",
+    "/opt/homebrew/bin/bun",
+    "/usr/local/bin/bun",
+    "/usr/bin/bun"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  const execPath = normalizeExecutablePath(process.execPath?.trim());
+  if (execPath && !looksLikeRuntimeGateway(execPath)) {
+    return execPath;
+  }
+  throw new Error("bun not found in PATH");
+}
+function resolveClaudeBinaryPath() {
+  const explicit = normalizeExecutablePath(process.env.RIG_CLAUDE_PATH?.trim());
+  if (explicit) {
+    return explicit;
+  }
+  const pathClaude = normalizeExecutablePath(Bun.which("claude")?.trim());
+  if (pathClaude && !looksLikeRuntimeGateway(pathClaude)) {
+    return pathClaude;
+  }
+  const home = process.env.HOME?.trim();
+  const fallbackCandidates = [
+    home ? resolve5(home, ".local/bin/claude") : "",
+    home ? resolve5(home, ".local/share/claude/local/claude") : "",
+    "/opt/homebrew/bin/claude",
+    "/usr/local/bin/claude",
+    "/usr/bin/claude"
+  ];
+  for (const candidate of fallbackCandidates) {
+    const normalized = normalizeExecutablePath(candidate);
+    if (normalized) {
+      return normalized;
+    }
+  }
+  throw new Error("claude not found in PATH");
+}
+function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
+  return resolve5(bunBinaryPath, "../..");
+}
+function resolveClaudeInstallDir() {
+  const realPath = resolveClaudeBinaryPath();
+  return resolve5(realPath, "..");
+}
+function resolveNodeInstallDir() {
+  const preferredNode = resolvePreferredNodeBinary();
+  if (!preferredNode)
+    return null;
+  const explicitNode = process.env.RIG_NODE_BIN?.trim();
+  if (explicitNode && resolve5(explicitNode) === resolve5(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve5(preferredNode, "../..") : resolve5(preferredNode, "..");
+  }
+  try {
+    const realPath = realpathSync(preferredNode);
+    if (realPath.endsWith("/bin/node")) {
+      return resolve5(realPath, "../..");
+    }
+    return resolve5(realPath, "..");
+  } catch {
+    return resolve5(preferredNode, "..");
+  }
+}
+function resolvePreferredNodeBinary() {
+  const candidates = [];
+  const envNode = process.env.RIG_NODE_BIN?.trim();
+  if (envNode) {
+    const explicit = resolve5(envNode);
+    if (existsSync5(explicit)) {
+      return explicit;
+    }
+  }
+  const nvmBin = process.env.NVM_BIN?.trim();
+  if (nvmBin) {
+    candidates.push(resolve5(nvmBin, "node"));
+  }
+  const home = process.env.HOME?.trim();
+  if (home) {
+    const nvmVersionsDir = resolve5(home, ".nvm/versions/node");
+    if (existsSync5(nvmVersionsDir)) {
+      try {
+        const versionDirs = readdirSync(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        for (const versionDir of versionDirs) {
+          candidates.push(resolve5(nvmVersionsDir, versionDir, "bin/node"));
+        }
+      } catch {}
+    }
+  }
+  const whichNode = Bun.which("node");
+  if (whichNode) {
+    candidates.push(whichNode);
+  }
+  const deduped = uniq(candidates.map((candidate) => resolve5(candidate)));
+  const existing = deduped.filter((candidate) => existsSync5(candidate));
+  if (existing.length === 0) {
+    return null;
+  }
+  const stable = existing.find((candidate) => {
+    const major = inferNodeMajor(candidate);
+    return typeof major === "number" && major >= 18 && major <= 24;
+  });
+  if (stable) {
+    return stable;
+  }
+  return existing[0] ?? null;
+}
+function inferNodeMajor(nodeBinaryPath) {
+  const normalized = resolve5(nodeBinaryPath).replace(/\\/g, "/");
+  const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
+  if (!match) {
+    return null;
+  }
+  const major = Number.parseInt(match[1], 10);
+  return Number.isFinite(major) ? major : null;
+}
+function normalizeExecutablePath(candidate) {
+  if (!candidate) {
+    return "";
+  }
+  const normalized = resolve5(candidate);
+  if (!existsSync5(normalized)) {
+    return "";
+  }
+  try {
+    return realpathSync(normalized);
+  } catch {
+    return normalized;
+  }
+}
+function looksLikeRuntimeGateway(candidate) {
+  const normalized = resolve5(candidate).replace(/\\/g, "/");
+  return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
+}
+
+// packages/runtime/src/control-plane/runtime/provisioning-env.ts
+function runtimeProvisioningEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  const realBash = baseEnv.RIG_REAL_BASH?.trim() || "/bin/bash";
+  const bunBinary = baseEnv.RIG_BUN_PATH?.trim() || resolveBunBinaryPath();
+  const bunDir = resolveBunInstallDir(bunBinary);
+  const claudeBinary = baseEnv.RIG_CLAUDE_PATH?.trim() || (() => {
+    try {
+      return resolveClaudeBinaryPath();
+    } catch {
+      return "";
+    }
+  })();
+  const claudeDir = claudeBinary ? (() => {
+    try {
+      return resolveClaudeInstallDir();
+    } catch {
+      return resolve6(claudeBinary, "..");
+    }
+  })() : "";
+  const nodeDir = resolveNodeInstallDir();
+  const realHome = baseEnv.HOME?.trim();
+  const inheritedPath = (baseEnv.PATH ?? "").split(delimiter).map((entry) => entry.trim()).filter(Boolean).filter((entry) => !entry.endsWith("/.rig/bin") && !entry.endsWith("/rig/tools"));
+  const pathEntries = [
+    `${bunDir}/bin`,
+    claudeDir,
+    nodeDir ? `${nodeDir}/bin` : "",
+    realHome ? resolve6(realHome, ".local/bin") : "",
+    realHome ? resolve6(realHome, ".cargo/bin") : "",
+    ...inheritedPath,
+    "/usr/local/bin",
+    "/usr/local/sbin",
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ].filter(Boolean);
+  env.BASH = realBash;
+  env.SHELL = baseEnv.SHELL?.trim() || realBash;
+  env.PATH = [...new Set(pathEntries)].join(delimiter);
+  env.RIG_BUN_PATH = bunBinary;
+  if (claudeBinary) {
+    env.RIG_CLAUDE_PATH = claudeBinary;
+  }
+  env.PYTHON = env.PYTHON?.trim() || "python3";
+  const nodeGypPath = Bun.which("node-gyp");
+  if (nodeGypPath) {
+    env.npm_config_node_gyp = nodeGypPath;
+  }
+  delete env.RIG_BASH_ACTIVE;
+  delete env.RIG_BASH_MODE;
+  return env;
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
+import { existsSync as existsSync9, rmSync as rmSync6, symlinkSync as symlinkSync3 } from "fs";
+import { resolve as resolve10 } from "path";
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename3, dirname as dirname5, resolve as resolve7 } from "path";
+var sharedNativeShellOutputDir = resolve7(tmpdir3(), "rig-native");
+var sharedNativeShellOutputPath = resolve7(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeRigShellFileName() {
+  return `rig-shell${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function ensureRigShellBinaryPath(outputPath = sharedNativeShellOutputPath) {
+  const sourcePath = resolveRigShellSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigShellBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-shell.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build the native Rig shell.");
+  }
+  mkdirSync4(dirname5(outputPath), { recursive: true });
+  const sourceDigest = await sha256File3(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath2(outputPath);
+  const needsBuild = !existsSync6(outputPath) || !await hasMatchingNativeBuildManifest2(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname5(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync6(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig shell: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRigShellBinary(targetDir) {
+  const sourcePath = await ensureRigShellBinaryPath();
+  const targetPath = resolve7(targetDir, runtimeRigShellFileName());
+  mkdirSync4(targetDir, { recursive: true });
+  const sourceDigest = await sha256File3(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync6(targetPath) || !await hasMatchingNativeBuildManifest2(nativeBuildManifestPath2(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync3(sourcePath, targetPath);
+    chmodSync3(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath2(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  return targetPath;
+}
+function resolveRigShellSourcePath() {
+  for (const candidate of rigShellSourceCandidates()) {
+    if (candidate && existsSync6(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigShellBinaryPath() {
+  for (const candidate of rigShellBinaryCandidates()) {
+    if (candidate && existsSync6(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigShellSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_SOURCE?.trim() || "",
+    cwd ? resolve7(cwd, "packages/runtime/native/rig-shell.zig") : "",
+    projectRoot ? resolve7(projectRoot, "packages/runtime/native/rig-shell.zig") : "",
+    hostProjectRoot ? resolve7(hostProjectRoot, "packages/runtime/native/rig-shell.zig") : "",
+    execDir ? resolve7(execDir, "..", "..", "packages/runtime/native/rig-shell.zig") : "",
+    execDir ? resolve7(execDir, "..", "native", "rig-shell.zig") : "",
+    resolve7(import.meta.dir, "../../../../native/rig-shell.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates2(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve7(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve7(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve7(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve7(cursor, "native", fileName), resolve7(cursor, "native", "bin", fileName));
+    const parent = dirname5(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigShellBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const fileName = runtimeRigShellFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates2(import.meta.dir, fileName),
+    execDir ? resolve7(execDir, fileName) : "",
+    execDir ? resolve7(execDir, "..", fileName) : "",
+    execDir ? resolve7(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function runtimeToolGatewayNames() {
+  return [
+    "bash",
+    "sh",
+    "zsh",
+    "git",
+    "bun",
+    "node",
+    "python3",
+    "rg",
+    "grep",
+    "sed",
+    "cat",
+    "ls",
+    "find",
+    "tsc",
+    "gh",
+    "mkdir",
+    "rm",
+    "mv",
+    "cp",
+    "touch",
+    "pwd",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "awk",
+    "xargs",
+    "dirname",
+    "basename",
+    "realpath",
+    "env",
+    "jq",
+    "tee",
+    "which"
+  ];
+}
+function nativeBuildManifestPath2(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest2(manifestPath, buildKey) {
+  if (!existsSync6(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File3(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/browser-tools.ts
+import { existsSync as existsSync7, rmSync as rmSync4, symlinkSync } from "fs";
+import { resolve as resolve8 } from "path";
+function runtimeBrowserToolBinaryName() {
+  return `rig-browser-tool${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeBrowserToolNames() {
+  return [
+    "rig-browser-launch",
+    "rig-browser-check",
+    "rig-browser-attach-info",
+    "rig-browser-e2e",
+    "rig-browser-reset-profile"
+  ];
+}
+async function materializeRuntimeBrowserTools(targetDir) {
+  const binaryPath = resolve8(targetDir, runtimeBrowserToolBinaryName());
+  for (const tool of runtimeBrowserToolNames()) {
+    const toolPath = resolve8(targetDir, tool);
+    if (existsSync7(toolPath)) {
+      rmSync4(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync(binaryPath, toolPath);
+  }
+  return binaryPath;
+}
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { chmodSync as chmodSync4, copyFileSync as copyFileSync4, existsSync as existsSync8, mkdirSync as mkdirSync5, rmSync as rmSync5, symlinkSync as symlinkSync2 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { basename as basename4, dirname as dirname6, resolve as resolve9 } from "path";
+var sharedNativeToolsOutputDir = resolve9(tmpdir4(), "rig-native");
+var sharedNativeToolsOutputPath = resolve9(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeRigToolsFileName() {
+  return `rig-tools${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeFileToolNames() {
+  return [
+    "rig-read",
+    "rig-write",
+    "rig-edit",
+    "rig-glob",
+    "rig-grep"
+  ];
+}
+async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath) {
+  const sourcePath = resolveRigToolsSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigToolsBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
+    }
+    throw new Error("rig-tools.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig file tools.");
+  }
+  mkdirSync5(dirname6(outputPath), { recursive: true });
+  const sourceDigest = await sha256File4(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath3(outputPath);
+  const needsBuild = !existsSync8(outputPath) || !await hasMatchingNativeBuildManifest3(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
+  }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname6(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync8(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig file tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
+}
+async function materializeRuntimeFileTools(targetDir) {
+  const sourcePath = await ensureRigToolsBinaryPath();
+  const targetPath = resolve9(targetDir, runtimeRigToolsFileName());
+  mkdirSync5(targetDir, { recursive: true });
+  const sourceDigest = await sha256File4(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync8(targetPath) || !await hasMatchingNativeBuildManifest3(nativeBuildManifestPath3(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync4(sourcePath, targetPath);
+    chmodSync4(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath3(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  }
+  for (const tool of runtimeFileToolNames()) {
+    const toolPath = resolve9(targetDir, tool);
+    if (existsSync8(toolPath)) {
+      rmSync5(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync2(targetPath, toolPath);
+  }
+  return targetPath;
+}
+function resolveRigToolsSourcePath() {
+  for (const candidate of rigToolsSourceCandidates()) {
+    if (candidate && existsSync8(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveBundledRigToolsBinaryPath() {
+  for (const candidate of rigToolsBinaryCandidates()) {
+    if (candidate && existsSync8(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigToolsSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_SOURCE?.trim() || "",
+    cwd ? resolve9(cwd, "packages/runtime/native/rig-tools.zig") : "",
+    projectRoot ? resolve9(projectRoot, "packages/runtime/native/rig-tools.zig") : "",
+    hostProjectRoot ? resolve9(hostProjectRoot, "packages/runtime/native/rig-tools.zig") : "",
+    execDir ? resolve9(execDir, "..", "..", "packages/runtime/native/rig-tools.zig") : "",
+    execDir ? resolve9(execDir, "..", "native", "rig-tools.zig") : "",
+    resolve9(import.meta.dir, "../../../../native/rig-tools.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates3(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve9(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve9(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve9(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve9(cursor, "native", fileName), resolve9(cursor, "native", "bin", fileName));
+    const parent = dirname6(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigToolsBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
+  const fileName = runtimeRigToolsFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates3(import.meta.dir, fileName),
+    execDir ? resolve9(execDir, fileName) : "",
+    execDir ? resolve9(execDir, "..", fileName) : "",
+    execDir ? resolve9(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function nativeBuildManifestPath3(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest3(manifestPath, buildKey) {
+  if (!existsSync8(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+async function sha256File4(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
+function runtimeGatewayToolNames() {
+  return runtimeToolGatewayNames();
+}
+async function materializeRuntimeToolGateway(binDir) {
+  const shellPath = await materializeRigShellBinary(binDir);
+  for (const tool of runtimeGatewayToolNames()) {
+    const toolPath = resolve10(binDir, tool);
+    if (existsSync9(toolPath)) {
+      rmSync6(toolPath, { force: true, recursive: true });
+    }
+    symlinkSync3(shellPath, toolPath);
+  }
+  await materializeRuntimeBrowserTools(binDir);
+  return resolve10(binDir, runtimeRigShellFileName());
+}
+// packages/runtime/src/control-plane/runtime/tooling/claude-router-binary.ts
+import { chmodSync as chmodSync5, copyFileSync as copyFileSync5, existsSync as existsSync10, mkdirSync as mkdirSync6, statSync as statSync3 } from "fs";
+import { tmpdir as tmpdir5 } from "os";
+import { dirname as dirname7, resolve as resolve11 } from "path";
+var sharedRouterOutputDir = resolve11(tmpdir5(), "rig-native");
+var sharedRouterOutputPath = resolve11(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeClaudeToolRouterFileName() {
+  return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
+}
+async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
+  const sourcePath = resolve11(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
+  mkdirSync6(dirname7(outputPath), { recursive: true });
+  const needsBuild = !existsSync10(outputPath) || statSync3(sourcePath).mtimeMs > statSync3(outputPath).mtimeMs;
+  if (!needsBuild) {
+    return outputPath;
+  }
+  await buildRuntimeBinary({
+    sourcePath: "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts",
+    outputPath,
+    cwd: projectRoot
+  });
+  chmodSync5(outputPath, 493);
+  return outputPath;
+}
+async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
+  const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
+  const targetPath = resolve11(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync6(targetDir, { recursive: true });
+  const needsCopy = !existsSync10(targetPath) || statSync3(sourcePath).mtimeMs > statSync3(targetPath).mtimeMs;
+  if (needsCopy) {
+    copyFileSync5(sourcePath, targetPath);
+    chmodSync5(targetPath, 493);
+  }
+  return targetPath;
+}
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var scopeRegexCache = new Map;
+
+// packages/runtime/src/control-plane/runtime/isolation/shared.ts
+var generatedCredentialFiles = new Set;
+function resolveMonorepoRoot3(projectRoot) {
+  return resolveMonorepoRoot2(projectRoot);
+}
+function sha256Hex(input) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(input);
+  return hasher.digest("hex");
+}
+function taskRuntimeId(taskId) {
+  return `task-${taskId}`;
+}
+
+// packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
+var GIT_INDEX_LOCK_MAX_RETRIES = 20;
+var GIT_INDEX_LOCK_RETRY_DELAY_MS = 250;
+var GIT_INDEX_LOCK_STALE_AFTER_MS = 5000;
+function resolveRigSourceRoot(projectRoot) {
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
+  if (hostProjectRoot && existsSync11(resolve12(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
+    return hostProjectRoot;
+  }
+  const fromModule = resolve12(import.meta.dir, "../../../../../..");
+  if (existsSync11(resolve12(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
+    return fromModule;
+  }
+  return projectRoot;
+}
+function prepareTrackedRuntimePaths(logsDir, stateDir, sessionDir) {
+  for (const path of [logsDir, stateDir, sessionDir, resolve12(sessionDir, "session.json")]) {
+    removeSymbolicLink(path);
+  }
+  runtimePrepareTrackedPathsNative({
+    logsDir,
+    stateDir,
+    sessionDir,
+    controlledBashLogFile: resolve12(logsDir, "controlled-bash.jsonl"),
+    eventsFile: resolve12(logsDir, "control-plane.events.jsonl")
+  });
+}
+async function initializeRuntimeStateFiles(stateDir, sessionDir, taskId) {
+  await mkdir(stateDir, { recursive: true });
+  await mkdir(sessionDir, { recursive: true });
+  const failedApproachesPath = resolve12(stateDir, "failed_approaches.md");
+  if (!existsSync11(failedApproachesPath)) {
+    await writeFile(failedApproachesPath, `# Failed Approaches
+
+`);
+  }
+  const hookTripsPath = resolve12(stateDir, "hook_trips.log");
+  if (!existsSync11(hookTripsPath)) {
+    await writeFile(hookTripsPath, "");
+  }
+  const sessionFile = resolve12(sessionDir, "session.json");
+  if (taskId) {
+    await writeFile(sessionFile, JSON.stringify({ activeTaskIds: [taskId] }));
+  }
+}
+async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
+  const artifactDir = resolve12(workspaceDir, "artifacts", taskId);
+  const runtimeSnapshotDir = resolve12(artifactDir, "runtime-snapshots");
+  let preservedTrackedFiles = false;
+  for (const file of [
+    "changed-files.txt",
+    "pr-state.json",
+    "review-state.json",
+    "review-feedback.md",
+    "review-greptile-raw.json",
+    "review-status.txt",
+    "validation-summary.json"
+  ]) {
+    const relativePath = `artifacts/${taskId}/${file}`;
+    if (await resetTrackedArtifactPath(workspaceDir, relativePath)) {
+      preservedTrackedFiles = true;
+      continue;
+    }
+    rmSync7(resolve12(artifactDir, file), { force: true });
+  }
+  const runtimeSnapshotRelativePath = `artifacts/${taskId}/runtime-snapshots`;
+  if (await resetTrackedArtifactPath(workspaceDir, runtimeSnapshotRelativePath)) {
+    preservedTrackedFiles = true;
+  } else {
+    rmSync7(runtimeSnapshotDir, { recursive: true, force: true });
+  }
+  if (preservedTrackedFiles) {
+    console.log(`[rig-agent] Preserved tracked runtime artifact files in ${taskId}; skipped ephemeral cleanup for committed paths.`);
+  }
+}
+function prepareRuntimeWorkspace(projectRoot, workspaceDir) {
+  const monorepoRoot = resolveMonorepoRoot3(projectRoot);
+  linkRuntimeDependencyLayers(monorepoRoot, workspaceDir);
+  syncRuntimeWorkspaceSources(projectRoot, workspaceDir);
+}
+async function materializeRuntimeHostToolWrappers(binDir) {
+  await materializeRuntimeToolGateway(binDir);
+  await materializeRuntimeFileTools(binDir);
+}
+async function buildRuntimeToolchain(options) {
+  const hookNames = [
+    "scope-guard",
+    "import-guard",
+    "safety-guard",
+    "test-integrity-guard",
+    "audit-trail",
+    "post-edit-lint",
+    "completion-verification",
+    "inject-context",
+    "task-runtime-start"
+  ];
+  const runtimeBins = ensureRuntimeBinTrees(options.binDir);
+  const nativeRuntimeLibraryPath = await materializeNativeRuntimeLibrary(options.binDir);
+  if (!nativeRuntimeLibraryPath) {
+    throw new Error("Failed to provision the native Zig runtime library.");
+  }
+  const rigSourceRoot = resolveRigSourceRoot(options.projectRoot);
+  await buildBinary("packages/cli/bin/rig.ts", resolve12(options.binDir, "rig"), rigSourceRoot);
+  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve12(options.binDir, "rig-agent"), rigSourceRoot, {
+    ...options.runtimeSecretDefines,
+    AGENT_TASK_ID: options.taskId,
+    AGENT_PROJECT_ROOT: options.projectRoot,
+    AGENT_RUNTIME_ID: options.runtimeId,
+    AGENT_SCOPE_HASH: options.bakedScopeHash,
+    AGENT_MANIFEST_PATH: options.manifestPath,
+    AGENT_BINARY_PATH: resolve12(options.binDir, "rig-agent"),
+    AGENT_INFO_OUTPUT: options.bakedInfoOutput,
+    AGENT_DEPS_OUTPUT: options.bakedDepsOutput,
+    AGENT_STATUS_OUTPUT: options.bakedStatusOutput
+  });
+  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve12(options.binDir, "controlled-bash"), rigSourceRoot, {
+    AGENT_PROJECT_ROOT: options.projectRoot,
+    AGENT_LOGS_DIR: options.logsDir,
+    AGENT_MONOREPO_ROOT: resolveMonorepoRoot3(options.projectRoot),
+    AGENT_TS_API_TESTS_DIR: resolve12(options.workspaceDir, "TSAPITests"),
+    AGENT_RIG_AGENT_BIN: resolve12(options.binDir, "rig-agent")
+  });
+  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve12(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
+  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve12(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
+    AGENT_PROJECT_ROOT: options.projectRoot,
+    AGENT_BUN_PATH: resolveBunBinaryPath()
+  });
+  const hookDefines = {
+    AGENT_PROJECT_ROOT: options.projectRoot,
+    AGENT_BUN_PATH: resolveBunBinaryPath()
+  };
+  for (const hookName of hookNames) {
+    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve12(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
+  }
+  const pluginsDir = resolve12(options.projectRoot, "rig/plugins");
+  if (existsSync11(pluginsDir)) {
+    for (const entry of readdirSync2(pluginsDir, { withFileTypes: true })) {
+      const match = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
+      if (!match)
+        continue;
+      await buildBinary(`rig/plugins/${entry.name}`, resolve12(runtimeBins.pluginsDir, match[1]), options.projectRoot);
+    }
+  }
+  await materializeRigGitBinary(options.binDir);
+  await materializeClaudeToolRouterBinary(rigSourceRoot, options.binDir);
+  await materializeRuntimeHostToolWrappers(options.binDir);
+  await materializeRuntimeBrowserTools(options.binDir);
+}
+async function writeRuntimeManifest(config) {
+  const scopeHash = sha256Hex(JSON.stringify(config.scopes));
+  const binarySha256 = sha256Hex(readFileSync2(config.binaryPath));
+  const manifestPath = resolve12(config.runtimeRoot, "manifest.json");
+  const manifest = {
+    runtimeId: config.runtimeId,
+    taskId: config.taskId,
+    scopeHash,
+    builtAt: new Date().toISOString(),
+    workspaceDir: config.workspaceDir,
+    binDir: config.binDir,
+    binary: {
+      path: config.binaryPath,
+      sha256: binarySha256
+    }
+  };
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf-8");
+}
+async function buildBinary(entrypoint, outputPath, cwd, defines) {
+  await buildRuntimeBinary({
+    sourcePath: entrypoint,
+    outputPath,
+    cwd,
+    define: defines,
+    env: runtimeProvisioningEnv()
+  });
+}
+function syncRuntimeWorkspaceSources(projectRoot, workspaceDir) {}
+function removeSymbolicLink(path) {
+  try {
+    if (!lstatSync(path).isSymbolicLink()) {
+      return;
+    }
+  } catch {
+    return;
+  }
+  rmSync7(path, { force: true, recursive: true });
+}
+async function resetTrackedArtifactPath(workspaceDir, relativePath) {
+  const tracked = await runGitLsFiles(workspaceDir, relativePath);
+  if (!tracked) {
+    return false;
+  }
+  await restoreTrackedArtifactPathWithRetry(workspaceDir, relativePath, async () => {
+    const restore = await Bun.$`git -C ${workspaceDir} checkout -- ${relativePath}`.quiet().nothrow();
+    return {
+      exitCode: restore.exitCode,
+      output: restore.stderr.toString() || restore.stdout.toString()
+    };
+  }, { sleep: Bun.sleep });
+  return true;
+}
+async function runGitLsFiles(workspaceDir, relativePath) {
+  const tracked = await Bun.$`git -C ${workspaceDir} ls-files --error-unmatch -- ${relativePath}`.quiet().nothrow();
+  return tracked.exitCode === 0;
+}
+async function restoreTrackedArtifactPathWithRetry(workspaceDir, relativePath, restorePath, options = {}) {
+  const sleep = options.sleep ?? Bun.sleep;
+  const maxRetries = options.maxRetries ?? GIT_INDEX_LOCK_MAX_RETRIES;
+  const retryDelayMs = options.retryDelayMs ?? GIT_INDEX_LOCK_RETRY_DELAY_MS;
+  const now = options.now ?? Date.now;
+  const statMtimeMs = options.statMtimeMs ?? readFileMtimeMs;
+  const removeFile = options.removeFile ?? ((path) => rmSync7(path, { force: true }));
+  const log = options.log ?? console.warn;
+  let lastOutput = "";
+  for (let attempt = 0;attempt <= maxRetries; attempt += 1) {
+    const restore = await restorePath();
+    if (restore.exitCode === 0) {
+      return;
+    }
+    lastOutput = restore.output;
+    if (!isGitIndexLockError(lastOutput)) {
+      break;
+    }
+    const lockPath = parseGitIndexLockPath(lastOutput);
+    if (attempt === maxRetries) {
+      if (lockPath && tryClearStaleGitIndexLock(lockPath, {
+        now,
+        statMtimeMs,
+        removeFile,
+        log
+      })) {
+        const recovered = await restorePath();
+        if (recovered.exitCode === 0) {
+          return;
+        }
+        lastOutput = recovered.output;
+      }
+      break;
+    }
+    await sleep(retryDelayMs);
+  }
+  throw new Error(`Failed to restore tracked runtime artifact path ${relativePath} in ${workspaceDir}: ${lastOutput}`);
+}
+function isGitIndexLockError(output) {
+  return /index\.lock|Unable to create '.+index\.lock'.*File exists/i.test(output);
+}
+function parseGitIndexLockPath(output) {
+  const match = output.match(/Unable to create '([^']+index\.lock)'/i);
+  return match?.[1] ?? null;
+}
+function tryClearStaleGitIndexLock(lockPath, options) {
+  const mtimeMs = options.statMtimeMs(lockPath);
+  if (mtimeMs === null) {
+    return false;
+  }
+  if (options.now() - mtimeMs < GIT_INDEX_LOCK_STALE_AFTER_MS) {
+    return false;
+  }
+  options.removeFile(lockPath);
+  options.log(`[rig-agent] Cleared stale git index lock during run recovery: ${lockPath}`);
+  return true;
+}
+function readFileMtimeMs(path) {
+  try {
+    return statSync4(path).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function linkRuntimeDependencyLayers(monorepoRoot, workspaceDir) {
+  linkGenericNodeModulesLayers(monorepoRoot, workspaceDir);
+  const sourceNodeModules = resolve12(monorepoRoot, "humoongate", "node_modules");
+  if (!existsSync11(sourceNodeModules)) {} else {
+    const runtimeHumoongate = resolve12(workspaceDir, "humoongate");
+    if (existsSync11(resolve12(runtimeHumoongate, "package.json"))) {
+      const targetNodeModules = resolve12(runtimeHumoongate, "node_modules");
+      runtimeLinkDependencyLayerNative(sourceNodeModules, targetNodeModules);
+    }
+  }
+  const runtimeHpNext = resolve12(workspaceDir, "microservices", "hp-next-frontend", "app");
+  if (!existsSync11(resolve12(runtimeHpNext, "package.json"))) {
+    return;
+  }
+  const sourceHpNextNodeModules = resolve12(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
+  const sourceMonorepoNodeModules = resolve12(monorepoRoot, "node_modules");
+  const targetHpNextNodeModules = resolve12(runtimeHpNext, "node_modules");
+  if (existsSync11(sourceHpNextNodeModules)) {
+    runtimeLinkDependencyLayerNative(sourceHpNextNodeModules, targetHpNextNodeModules);
+    return;
+  }
+  if (existsSync11(sourceMonorepoNodeModules)) {
+    runtimeLinkDependencyLayerNative(sourceMonorepoNodeModules, targetHpNextNodeModules);
+  }
+}
+function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
+  linkNodeModulesLayer(resolve12(monorepoRoot, "node_modules"), resolve12(workspaceDir, "node_modules"));
+  for (const relativePackageDir of [
+    "apps/native-app/apps/marketing",
+    "apps/native-app/apps/web",
+    "apps/native-app/apps/browser",
+    "apps/native-app/apps/desktop",
+    "apps/native-app/scripts",
+    "apps/tui",
+    "packages/cli",
+    "packages/client",
+    "packages/contracts",
+    "packages/core",
+    "packages/hook-kit",
+    "packages/plugin-testkit",
+    "packages/runtime",
+    "packages/scripts",
+    "packages/server",
+    "packages/shared",
+    "packages/skill-loader",
+    "packages/standard-plugin",
+    "packages/validator-kit"
+  ]) {
+    const workspacePackageDir = resolve12(workspaceDir, relativePackageDir);
+    if (!existsSync11(resolve12(workspacePackageDir, "package.json"))) {
+      continue;
+    }
+    linkNodeModulesLayer(resolve12(monorepoRoot, relativePackageDir, "node_modules"), resolve12(workspacePackageDir, "node_modules"));
+  }
+}
+function linkNodeModulesLayer(sourceDir, targetDir) {
+  if (!existsSync11(sourceDir) || existsSync11(targetDir)) {
+    return;
+  }
+  try {
+    runtimeLinkDependencyLayerNative(sourceDir, targetDir);
+    return;
+  } catch (error) {
+    console.warn(`[rig-agent] Native dependency-layer linking failed for ${targetDir}; using symlink fallback: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  mkdirSync7(dirname8(targetDir), { recursive: true });
+  symlinkSync4(sourceDir, targetDir, "dir");
+}
+function ensureRuntimeBinTrees(runtimeBinDir) {
+  const hooksDir = resolve12(runtimeBinDir, "hooks");
+  const pluginsDir = resolve12(runtimeBinDir, "plugins");
+  const validatorsDir = resolve12(runtimeBinDir, "validators");
+  mkdirSync7(hooksDir, { recursive: true });
+  mkdirSync7(pluginsDir, { recursive: true });
+  mkdirSync7(validatorsDir, { recursive: true });
+  return { hooksDir, pluginsDir, validatorsDir };
+}
+function runtimeWorktreeId(workspaceDir) {
+  return workspaceDir.split("/").at(-1) || "runtime";
+}
+function isCanonicalTaskRuntime(taskId, runtimeId) {
+  return runtimeId === taskRuntimeId(taskId);
+}
+var __testOnly = {
+  isGitIndexLockError,
+  parseGitIndexLockPath,
+  restoreTrackedArtifactPathWithRetry,
+  tryClearStaleGitIndexLock
+};
+export {
+  writeRuntimeManifest,
+  syncRuntimeWorkspaceSources,
+  runtimeWorktreeId,
+  resetEphemeralTaskArtifacts,
+  prepareTrackedRuntimePaths,
+  prepareRuntimeWorkspace,
+  materializeRuntimeHostToolWrappers,
+  isCanonicalTaskRuntime,
+  initializeRuntimeStateFiles,
+  buildRuntimeToolchain,
+  buildBinary,
+  __testOnly
+};