@h-rig/runtime 0.0.6-alpha.2 → 0.0.6-alpha.20

package/dist/bin/rig-agent.js

@@ -4421,8 +4421,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -6914,12 +6914,12 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "task-result.json",
   "validation-summary.json"
 ]);
-function resolveHostRigBinDir(root) {
-  return resolve26(root, ".rig", "bin");
-}
 function isRuntimeGatewayGitPath(candidate) {
   return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
   if (runtimeWorkspace && existsSync22(resolve26(runtimeWorkspace, ".git"))) {
@@ -6954,6 +6954,9 @@ function resolveGitBinary(projectRoot) {
   }
   return "git";
 }
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function safeCurrentTaskId(projectRoot) {
   try {
     const taskId = currentTaskId(projectRoot);
@@ -7112,17 +7115,15 @@ function gitOpenPr(options) {
   const target = options.target || (taskId ? "monorepo" : "project");
   let repoRoot = options.projectRoot;
   let repoLabel = "project-rig";
-  let defaultBase = process.env.RIG_PR_BASE_PROJECT || "main";
+  const envBase = target === "monorepo" ? process.env.RIG_PR_BASE_MONOREPO?.trim() || "" : process.env.RIG_PR_BASE_PROJECT?.trim() || "";
   if (target === "monorepo") {
     repoRoot = resolveOptionalMonorepoRoot(options.projectRoot) || resolveMonorepoRoot2(options.projectRoot);
     repoLabel = "monorepo";
-    defaultBase = process.env.RIG_PR_BASE_MONOREPO || "main";
     if (taskId) {
       gitSyncBranch(options.projectRoot, taskId, "monorepo");
     }
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
-    defaultBase = inferProjectBase(options.projectRoot, defaultBase);
   }
   if (!existsSync22(resolve26(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
@@ -7131,9 +7132,9 @@ function gitOpenPr(options) {
   if (!branch || branch === "HEAD") {
     throw new Error(`Cannot open PR from detached HEAD in ${repoLabel}. Checkout a branch first.`);
   }
-  const base = options.base || defaultBase;
   const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
   const networkRemote = resolveNetworkRemoteName(options.projectRoot, repoRoot, repoNameWithOwner);
+  const base = options.base || envBase || inferRepositoryDefaultBase(options.projectRoot, repoRoot, repoNameWithOwner, networkRemote, target === "project" ? inferProjectBase(options.projectRoot, "main") : "main");
   refreshRemoteBaseRef(options.projectRoot, repoRoot, base);
   let reviewer = (options.reviewer || "").trim();
   let reviewerSource = reviewer ? "flag" : undefined;
@@ -7169,10 +7170,11 @@ function gitOpenPr(options) {
     "",
     "## Task",
     `- beads: ${taskId || "n/a"}`,
+    ...defaultPrRunLines(taskId, repoNameWithOwner),
     "",
     "## Review",
     "- Completion verification will run validation, verifier review, and PR policy checks.",
-    "- When repository policy allows it, Rig enables GitHub auto-merge after approval."
+    "- When repository policy allows it, Rig attempts an immediate strict-gated, head-locked merge after approval."
   ].join(`
 `);
   const preCheck = runCapture2(withGhRepo([gh, "pr", "list", "--state", "merged", "--head", branch, "--json", "url,mergedAt", "--jq", ".[0]"], repoNameWithOwner), repoRoot);
@@ -7260,6 +7262,30 @@ function gitOpenPr(options) {
   }
   return result;
 }
+function defaultPrRunLines(taskId, repoNameWithOwner) {
+  const lines = [];
+  const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+  if (runId) {
+    lines.push(`- Run: ${runId}`);
+  }
+  const closeout = defaultPrCloseoutLine(taskId, repoNameWithOwner);
+  if (closeout) {
+    lines.push(`- ${closeout}`);
+  }
+  return lines;
+}
+function defaultPrCloseoutLine(taskId, repoNameWithOwner) {
+  const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (sourceIssueId) {
+    const match = sourceIssueId.match(/^([^#]+)#(\d+)$/);
+    if (match?.[1] && match[2]) {
+      const sourceRepo = match[1];
+      const issueNumber = match[2];
+      return sourceRepo.toLowerCase() === repoNameWithOwner.toLowerCase() ? `Closes #${issueNumber}` : `Closes ${sourceRepo}#${issueNumber}`;
+    }
+  }
+  return /^\d+$/.test(taskId) ? `Closes #${taskId}` : "";
+}
 function readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl) {
   const view = runCapture2(withGhRepo([
     gh,
@@ -7385,32 +7411,19 @@ function resolveGithubCliBinary(projectRoot) {
   if (explicit) {
     candidates.add(explicit);
   }
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    candidates.add(candidate);
+  }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
     candidates.add(resolve26(entry, "gh"));
   }
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot) {
-    candidates.add(resolve26(resolveHostRigBinDir(hostProjectRoot), "gh"));
-  }
-  candidates.add(resolve26(resolveHostRigBinDir(projectRoot), "gh"));
-  const runtimeContext = loadRuntimeContextFromEnv();
-  if (runtimeContext?.binDir) {
-    candidates.add(resolve26(runtimeContext.binDir, "gh"));
-  }
-  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
-  if (runtimeHome) {
-    candidates.add(resolve26(runtimeHome, "bin", "gh"));
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    candidates.add(candidate);
-  }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync22(candidate)) {
+    if (candidate && existsSync22(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -7559,6 +7572,32 @@ function withGhRepo(command, repoNameWithOwner) {
   }
   return [command[0], command[1], command[2], ...ghRepoArgs(repoNameWithOwner), ...command.slice(3)];
 }
+function inferRepositoryDefaultBase(projectRoot, repoRoot, repoNameWithOwner, remoteName, fallback) {
+  const remote = remoteName || "origin";
+  const symbolic = runCapture2(gitCmd(projectRoot, repoRoot, "symbolic-ref", "--short", `refs/remotes/${remote}/HEAD`), projectRoot);
+  if (symbolic.exitCode === 0) {
+    const ref = symbolic.stdout.trim().replace(new RegExp(`^${escapeRegExp2(remote)}/`), "");
+    if (ref && ref !== "HEAD") {
+      return ref;
+    }
+  }
+  const lsRemote = runCapture2(gitCmd(projectRoot, repoRoot, "ls-remote", "--symref", remote, "HEAD"), projectRoot);
+  if (lsRemote.exitCode === 0) {
+    const match = lsRemote.stdout.match(/^ref:\s+refs\/heads\/([^\t\r\n]+)\s+HEAD/m);
+    if (match?.[1]) {
+      return match[1];
+    }
+  }
+  const gh = resolveGithubCliBinary(projectRoot);
+  if (gh && repoNameWithOwner) {
+    const api = runCapture2(withGhRepo([gh, "repo", "view", "--json", "defaultBranchRef", "--jq", ".defaultBranchRef.name"], repoNameWithOwner), repoRoot);
+    const branch = api.exitCode === 0 ? api.stdout.trim() : "";
+    if (branch) {
+      return branch;
+    }
+  }
+  return fallback;
+}
 function inferProjectBase(projectRoot, fallback) {
   const containing = runCapture2(gitCmd(projectRoot, projectRoot, "branch", "-r", "--contains", "HEAD"), projectRoot);
   if (containing.exitCode !== 0) {
@@ -7940,6 +7979,10 @@ function runtimeGitEnv(projectRoot) {
     }
     env[key] = value;
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   if (!env.GITHUB_TOKEN && env.GH_TOKEN) {
     env.GITHUB_TOKEN = env.GH_TOKEN;
   }
@@ -7963,6 +8006,13 @@ function runtimeGitEnv(projectRoot) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || env.RIG_GITHUB_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (runtimeKnownHosts && existsSync22(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
@@ -7979,6 +8029,14 @@ function runtimeGitEnv(projectRoot) {
   }
   return Object.keys(env).length > 0 ? env : undefined;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};

package/dist/src/control-plane/agent-wrapper.js

@@ -2951,6 +2951,17 @@ async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
     return null;
   }
 }
+function updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, update, options = {}) {
+  const parsed = sourceIssueId?.trim().match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (!parsed || parsed[3] !== taskId) {
+    return false;
+  }
+  applyGithubIssueUpdate(options.ghBinary ?? "gh", options.spawn ?? spawnSync, parsed[3], {
+    sourceIssueId: sourceIssueId.trim(),
+    taskSource: { kind: "github-issues", owner: parsed[1], repo: parsed[2] }
+  }, update);
+  return true;
+}
 function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
   const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
   const rawEntry = readRawTaskEntry(configPath, taskId);
@@ -3306,8 +3317,8 @@ function ensureStatusLabel(bin, repo, spawnFn, label) {
   }
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5710,20 +5721,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync23(explicit)) {
+  if (explicit && existsSync23(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync23(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync23(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync23(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -5824,6 +5838,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -5887,6 +5903,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -5897,6 +5917,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -5977,12 +6004,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve25(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8461,7 +8497,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,
@@ -9173,7 +9213,8 @@ async function runAgentWrapper(options = {}) {
       taskId,
       mode: "worktree",
       provider,
-      taskRecordReader: taskRecordReaderFromEnv(taskId)
+      taskRecordReader: taskRecordReaderFromEnv(taskId),
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
     });
     emitWrapperEvent("runtime.provision.completed", {
       runtimeId: runtime.id,
@@ -9278,15 +9319,13 @@ async function runAgentWrapper(options = {}) {
     throw error;
   }
   const serverManagedRun = Boolean(process.env.RIG_SERVER_RUN_ID?.trim());
-  if (exitCode === 0 && serverManagedRun) {
-    await updateTaskSourceAfterRun(monorepoRoot, taskId, runtime);
-  }
   const taskClosed = await isTaskClosed(monorepoRoot, taskId);
   const finalExitCode = resolveFinalProviderExitCode({
     providerExitCode: exitCode,
     taskClosed,
     serverManagedRun
   });
+  const handoffRequired = exitCode !== 0 || !taskClosed && !serverManagedRun;
   emitWrapperEvent("provider.completed", {
     provider,
     runtimeId: runtime.id,
@@ -9295,24 +9334,21 @@ async function runAgentWrapper(options = {}) {
     providerExitCode: exitCode,
     taskClosed,
     serverManagedRun,
-    handoffRequired: exitCode !== 0 || !taskClosed
+    handoffRequired
   });
-  if (exitCode !== 0 || !taskClosed) {
+  if (handoffRequired) {
     recordRuntimeHandoff(projectRoot, runtime, taskId, exitCode);
   }
-  if (exitCode === 0 && !taskClosed && serverManagedRun) {
-    console.error(`[rig-agent] Server-managed task run cannot finish successfully while ${taskId} is still open.`);
-  }
   return finalExitCode;
 }
 function resolveFinalProviderExitCode(input) {
   if (input.providerExitCode !== 0) {
     return input.providerExitCode;
   }
-  if (input.taskClosed) {
+  if (input.taskClosed || input.serverManagedRun) {
     return 0;
   }
-  return input.serverManagedRun ? 2 : 0;
+  return 0;
 }
 function shouldBypassProviderSandboxOnPlatform(provider, platform) {
   if (platform !== "darwin") {
@@ -9336,12 +9372,16 @@ function buildProviderArgs(provider, runtime, argv) {
   }
   if (provider === "pi") {
     const piArgs = [...argv];
+    const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
     if (!hasCliOption(piArgs, "--provider")) {
-      piArgs.unshift(process.env.RIG_PI_PROVIDER?.trim() || "openai-codex");
+      piArgs.unshift(piProvider);
       piArgs.unshift("--provider");
     }
-    if (!hasCliOption(piArgs, "--model")) {
-      piArgs.unshift(process.env.RIG_PI_MODEL?.trim() || "gpt-5.5");
+    const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+    if (hasCliOption(piArgs, "--model")) {
+      rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+    } else {
+      piArgs.unshift(normalizePiModelForProvider(model, piProvider));
       piArgs.unshift("--model");
     }
     return piArgs;
@@ -9409,6 +9449,38 @@ function resolveProvider() {
 function hasCliOption(argv, option) {
   return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
 }
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
 function providerBinary(provider) {
   if (provider === "codex") {
     return Bun.which("codex") || "codex";
@@ -9510,8 +9582,8 @@ async function readPluginTaskStatus(projectRoot, taskId) {
 async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
   const comment = buildTaskRunLifecycleComment({
     runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
-    status: "closed",
-    summary: "Rig task run completed and closed this task.",
+    status: "completed",
+    summary: "Rig task run completed; source closeout waits for approved PR merge.",
     runtimeWorkspace: runtime.workspaceDir,
     logsDir: runtime.logsDir,
     sessionDir: runtime.sessionDir
@@ -9519,7 +9591,7 @@ async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
   try {
     const result = await updateConfiguredTaskSourceTask(projectRoot, {
       taskId,
-      update: { status: "closed", comment }
+      update: { status: "completed", comment }
     });
     if (result.updated) {
       return;
@@ -9528,7 +9600,9 @@ async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
   } catch (error) {
     let fallbackUpdated = false;
     try {
-      fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "closed", comment });
+      const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+      fallbackUpdated = updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, { status: "completed", comment });
+      fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "completed", comment }) || fallbackUpdated;
     } catch (fallbackError) {
       console.error(`[rig-agent] Source-aware compatibility update also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
     }

package/dist/src/control-plane/authority-files.js

@@ -464,10 +464,6 @@ function runBelongsToProject(projectRoot, run, runsDir) {
   if (recordedProjectRoot) {
     return resolve2(recordedProjectRoot) === normalizedRoot;
   }
-  const projectLocalRunsDir = resolve2(normalizedRoot, ".rig", "runs");
-  if (isPathWithin(projectLocalRunsDir, resolve2(runsDir))) {
-    return true;
-  }
   const pathFields = [
     run.worktreePath,
     run.artifactRoot,
@@ -475,10 +471,20 @@ function runBelongsToProject(projectRoot, run, runsDir) {
     run.sessionPath,
     run.sessionLogPath
   ].filter((value) => typeof value === "string" && value.trim().length > 0);
-  if (pathFields.length === 0) {
+  if (pathFields.length > 0) {
+    if (pathFields.some((value) => isPathWithin(normalizedRoot, resolve2(value)))) {
+      return true;
+    }
+    const pointsAtManagedWorkspace = pathFields.some((value) => /(?:^|[/\\])\.worktrees(?:[/\\]|$)/.test(value));
+    if (pointsAtManagedWorkspace) {
+      return false;
+    }
+  }
+  const projectLocalRunsDir = resolve2(normalizedRoot, ".rig", "runs");
+  if (isPathWithin(projectLocalRunsDir, resolve2(runsDir))) {
     return true;
   }
-  return pathFields.some((value) => isPathWithin(normalizedRoot, resolve2(value)));
+  return pathFields.length === 0;
 }
 function isPathWithin(root, candidate) {
   const relativePath = relative(root, candidate);