@h-rig/runtime 0.0.6-alpha.2 → 0.0.6-alpha.21

package/dist/src/control-plane/native/workspace-ops.js

@@ -169,10 +169,6 @@ function runBelongsToProject(projectRoot, run, runsDir) {
   if (recordedProjectRoot) {
     return resolve2(recordedProjectRoot) === normalizedRoot;
   }
-  const projectLocalRunsDir = resolve2(normalizedRoot, ".rig", "runs");
-  if (isPathWithin(projectLocalRunsDir, resolve2(runsDir))) {
-    return true;
-  }
   const pathFields = [
     run.worktreePath,
     run.artifactRoot,
@@ -180,10 +176,20 @@ function runBelongsToProject(projectRoot, run, runsDir) {
     run.sessionPath,
     run.sessionLogPath
   ].filter((value) => typeof value === "string" && value.trim().length > 0);
-  if (pathFields.length === 0) {
+  if (pathFields.length > 0) {
+    if (pathFields.some((value) => isPathWithin(normalizedRoot, resolve2(value)))) {
+      return true;
+    }
+    const pointsAtManagedWorkspace = pathFields.some((value) => /(?:^|[/\\])\.worktrees(?:[/\\]|$)/.test(value));
+    if (pointsAtManagedWorkspace) {
+      return false;
+    }
+  }
+  const projectLocalRunsDir = resolve2(normalizedRoot, ".rig", "runs");
+  if (isPathWithin(projectLocalRunsDir, resolve2(runsDir))) {
     return true;
   }
-  return pathFields.some((value) => isPathWithin(normalizedRoot, resolve2(value)));
+  return pathFields.length === 0;
 }
 function isPathWithin(root, candidate) {
   const relativePath = relative(root, candidate);

package/dist/src/control-plane/runtime/index.js

@@ -3848,8 +3848,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -6154,20 +6154,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync24(explicit)) {
+  if (explicit && existsSync24(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync24(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync24(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync24(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -6268,6 +6271,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -6331,6 +6336,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -6341,6 +6350,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -6436,12 +6452,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve27(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8091,7 +8116,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,

package/dist/src/control-plane/runtime/isolation/home.js

@@ -686,20 +686,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync5(explicit)) {
+  if (explicit && existsSync5(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync5(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync5(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync5(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -800,6 +803,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -863,6 +868,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -873,6 +882,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -968,12 +984,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve7(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",

package/dist/src/control-plane/runtime/isolation/index.js

@@ -3148,8 +3148,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5454,20 +5454,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync23(explicit)) {
+  if (explicit && existsSync23(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync23(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync23(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync23(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -5568,6 +5571,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -5631,6 +5636,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -5641,6 +5650,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -5736,12 +5752,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve25(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8060,7 +8085,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,

package/dist/src/control-plane/runtime/isolation/runner.js

@@ -2091,20 +2091,23 @@ function taskRuntimeId(taskId) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync8(explicit)) {
+  if (explicit && existsSync8(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync8(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync8(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync8(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -2198,6 +2201,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -2261,6 +2266,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -2271,6 +2280,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -2318,12 +2334,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve11(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",

package/dist/src/control-plane/runtime/isolation/shared.js

@@ -417,20 +417,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync3(explicit)) {
+  if (explicit && existsSync3(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync3(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync3(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync3(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {

package/dist/src/control-plane/runtime/isolation.js

@@ -3148,8 +3148,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -5454,20 +5454,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync23(explicit)) {
+  if (explicit && existsSync23(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync23(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync23(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync23(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -5568,6 +5571,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -5631,6 +5636,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -5641,6 +5650,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -5736,12 +5752,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve25(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8060,7 +8085,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,

package/dist/src/control-plane/runtime/queue.js

@@ -4560,8 +4560,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -6178,20 +6178,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync24(explicit)) {
+  if (explicit && existsSync24(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync24(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
     if (existsSync24(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync24(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -6292,6 +6295,8 @@ async function runtimeEnv(projectRoot, runtime) {
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -6355,6 +6360,10 @@ async function runtimeEnv(projectRoot, runtime) {
       env[key] = value;
     }
   }
+  const rigGithubToken = process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (rigGithubToken && !env.GITHUB_TOKEN && !env.GH_TOKEN) {
+    env.GITHUB_TOKEN = rigGithubToken;
+  }
   const fallbackGithubToken = !env.GITHUB_TOKEN && !env.GH_TOKEN ? await resolveGithubCliAuthToken(hostGhBinary) : "";
   if (fallbackGithubToken) {
     env.GITHUB_TOKEN = fallbackGithubToken;
@@ -6365,6 +6374,13 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GH_TOKEN && env.GITHUB_TOKEN) {
     env.GH_TOKEN = env.GITHUB_TOKEN;
   }
+  const gitHubToken = env.GITHUB_TOKEN || env.GH_TOKEN || rigGithubToken;
+  if (gitHubToken) {
+    env.RIG_GITHUB_TOKEN = gitHubToken;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || gitHubToken;
+    env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
+    applyGitHubCredentialHelperEnv(env);
+  }
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
@@ -6460,12 +6476,21 @@ async function materializeRuntimeCertBundle(runtime) {
   }
   return targetPath;
 }
+function applyGitHubCredentialHelperEnv(env) {
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_COUNT = "2";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  env.GIT_CONFIG_KEY_1 = "credential.helper";
+  env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+}
 function persistRuntimeSecrets(runtimeRoot, env) {
   const secretsPath = resolve27(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
     "GH_TOKEN",
+    "RIG_GITHUB_TOKEN",
     "GREPTILE_GITHUB_TOKEN",
     "GREPTILE_API_KEY",
     "AI_REVIEW_MODE",
@@ -8045,7 +8070,11 @@ async function ensureAgentRuntime(options) {
   mkdirSync18(runtime.binDir, { recursive: true });
   mkdirSync18(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,