@h-rig/runtime 0.0.6-alpha.3 → 0.0.6-alpha.30

package/dist/bin/rig-agent-dispatch.js

@@ -150,32 +150,32 @@ var RIG_DEFINITION_DIRNAME = "rig", RIG_ARTIFACTS_DIRNAME = "artifacts";
 var init_layout = () => {};
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
-import { existsSync as existsSync19, readdirSync as readdirSync3, realpathSync } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve20 } from "path";
 function toRealPath(path) {
-  if (!existsSync19(path)) {
-    return resolve19(path);
+  if (!existsSync20(path)) {
+    return resolve20(path);
   }
   try {
     return realpathSync.native(path);
   } catch {
-    return resolve19(path);
+    return resolve20(path);
   }
 }
 function resolveHostGitMetadataPaths(projectRoot, workspaceDir) {
   const candidates = new Set;
   const addPath = (candidate) => {
-    if (existsSync19(candidate)) {
+    if (existsSync20(candidate)) {
       candidates.add(toRealPath(candidate));
     }
   };
-  addPath(resolve19(projectRoot, ".git"));
-  addPath(resolve19(workspaceDir, "..", "..", ".git"));
+  addPath(resolve20(projectRoot, ".git"));
+  addPath(resolve20(workspaceDir, "..", "..", ".git"));
   for (const repoRoot of resolveHostRepoRootPaths(projectRoot)) {
-    addPath(resolve19(repoRoot, ".git"));
+    addPath(resolve20(repoRoot, ".git"));
   }
-  const workspaceGit = resolve19(workspaceDir, ".git");
-  if (existsSync19(workspaceGit)) {
+  const workspaceGit = resolve20(workspaceDir, ".git");
+  if (existsSync20(workspaceGit)) {
     addPath(workspaceGit);
   }
   return [...candidates];
@@ -183,7 +183,7 @@ function resolveHostGitMetadataPaths(projectRoot, workspaceDir) {
 function resolveHostRepoRootPaths(projectRoot) {
   const candidates = new Set;
   const addPath = (candidate) => {
-    if (existsSync19(candidate)) {
+    if (existsSync20(candidate)) {
       candidates.add(toRealPath(candidate));
     }
   };
@@ -193,11 +193,11 @@ function resolveHostRepoRootPaths(projectRoot) {
       addPath(monorepoRoot);
     }
   } catch {}
-  const reposDir = resolve19(projectRoot, "repos");
-  if (existsSync19(reposDir)) {
-    for (const entry of readdirSync3(reposDir, { withFileTypes: true })) {
+  const reposDir = resolve20(projectRoot, "repos");
+  if (existsSync20(reposDir)) {
+    for (const entry of readdirSync4(reposDir, { withFileTypes: true })) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        addPath(resolve19(reposDir, entry.name));
+        addPath(resolve20(reposDir, entry.name));
       }
     }
   }
@@ -241,8 +241,8 @@ var exports_backend_seatbelt = {};
 __export(exports_backend_seatbelt, {
   SeatbeltBackend: () => SeatbeltBackend
 });
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync11 } from "fs";
-import { resolve as resolve31 } from "path";
+import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "fs";
+import { resolve as resolve32 } from "path";
 
 class SeatbeltBackend {
   kind = "macos-seatbelt";
@@ -266,11 +266,11 @@ class SeatbeltBackend {
     };
   }
   writeSeatbeltProfile(options) {
-    const sandboxDir = resolve31(options.runtime.rootDir, "sandbox");
-    mkdirSync16(sandboxDir, { recursive: true });
-    const profilePath = resolve31(sandboxDir, "seatbelt.sb");
+    const sandboxDir = resolve32(options.runtime.rootDir, "sandbox");
+    mkdirSync17(sandboxDir, { recursive: true });
+    const profilePath = resolve32(sandboxDir, "seatbelt.sb");
     const profile = this.renderProfile(options);
-    writeFileSync11(profilePath, `${profile}
+    writeFileSync12(profilePath, `${profile}
 `, "utf-8");
     return profilePath;
   }
@@ -355,7 +355,7 @@ class SeatbeltBackend {
     const realHome = process.env.HOME?.trim();
     if (realHome) {
       for (const binSubdir of [".local/bin", ".cargo/bin"]) {
-        const binPath = resolve31(realHome, binSubdir);
+        const binPath = resolve32(realHome, binSubdir);
         if (ctx.pathExists(binPath)) {
           lines.push(`(allow file-read* (subpath ${seatbeltString(ctx.realPath(binPath))}))`);
         }
@@ -384,8 +384,8 @@ var exports_backend_bwrap = {};
 __export(exports_backend_bwrap, {
   BwrapBackend: () => BwrapBackend
 });
-import { mkdirSync as mkdirSync17 } from "fs";
-import { resolve as resolve32 } from "path";
+import { mkdirSync as mkdirSync18 } from "fs";
+import { resolve as resolve33 } from "path";
 
 class BwrapBackend {
   kind = "linux-bwrap";
@@ -514,18 +514,18 @@ class BwrapBackend {
     const realHome = process.env.HOME?.trim();
     if (realHome) {
       for (const binSubdir of [".local/bin", ".local/lib", ".cargo/bin"]) {
-        const binPath = ctx.realPath(resolve32(realHome, binSubdir));
+        const binPath = ctx.realPath(resolve33(realHome, binSubdir));
         if (ctx.pathExists(binPath)) {
           args.push("--ro-bind", binPath, binPath);
         }
       }
-      const agentSshDir = resolve32(homeReal, ".ssh");
+      const agentSshDir = resolve33(homeReal, ".ssh");
       if (ctx.pathExists(agentSshDir)) {
         args.push("--ro-bind", agentSshDir, agentSshDir);
       } else {
-        const hostSshDir = resolve32(realHome, ".ssh");
+        const hostSshDir = resolve33(realHome, ".ssh");
         if (ctx.pathExists(hostSshDir)) {
-          mkdirSync17(agentSshDir, { recursive: true });
+          mkdirSync18(agentSshDir, { recursive: true });
           args.push("--ro-bind", hostSshDir, agentSshDir);
           args.push("--ro-bind", hostSshDir, hostSshDir);
         }
@@ -567,8 +567,9 @@ var init_backend_bwrap = __esm(() => {
 });
 
 // packages/runtime/src/control-plane/agent-wrapper.ts
-import { resolve as resolve35 } from "path";
-import { existsSync as existsSync33, mkdirSync as mkdirSync19, writeFileSync as writeFileSync13 } from "fs";
+import { createRequire } from "module";
+import { resolve as resolve37 } from "path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync21, writeFileSync as writeFileSync14 } from "fs";
 
 // packages/runtime/src/control-plane/runtime/context.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -776,9 +777,9 @@ function isAgentRuntimeContextPath(path) {
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/index.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync18, readFileSync as readFileSync15, rmSync as rmSync12 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync19, readFileSync as readFileSync16, rmSync as rmSync13 } from "fs";
 import { copyFile, mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve34 } from "path";
+import { resolve as resolve35 } from "path";
 
 // packages/runtime/src/control-plane/native/git-native.ts
 import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
@@ -1853,8 +1854,8 @@ async function readCanonicalMemoryDb(projectRoot, deps = {}) {
 var DEFAULT_RESULT_LIMIT = DEFAULT_RUNTIME_MEMORY_RETRIEVAL.topK;
 var DAY_MS = 24 * 60 * 60 * 1000;
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync22, mkdirSync as mkdirSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve23 } from "path";
+import { appendFileSync, existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve24 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -2705,6 +2706,49 @@ function safeReadJson(path) {
   }
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync5, readdirSync, rmSync as rmSync7, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve12 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve12(projectRoot, ".pi", "skills");
+  if (existsSync12(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve12(skillsRoot, name);
+      if (existsSync12(resolve12(dir, MARKER_FILENAME))) {
+        rmSync7(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve12(projectRoot, skill.path);
+    if (!existsSync12(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync5(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve12(skillsRoot, skillDirName(skill.id));
+    mkdirSync8(dir, { recursive: true });
+    writeFileSync5(resolve12(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync5(resolve12(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -2741,6 +2785,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -2754,12 +2809,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync6, readdirSync, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename4, join as join3, resolve as resolve13 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, join as join3, resolve as resolve14 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync12, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve13 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -2782,7 +2837,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -2793,8 +2848,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync12(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve13(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync13(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -2802,7 +2857,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -2886,7 +2941,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve14(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -2951,34 +3006,6 @@ async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
     return null;
   }
 }
-function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
-  const rawEntry = readRawTaskEntry(configPath, taskId);
-  if (!rawEntry) {
-    const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
-    return configuredFilesPath ? updateFileBackedTask(projectRoot, configuredFilesPath, taskId, update) : false;
-  }
-  const metadata = readMaterializedTaskMetadata(rawEntry);
-  const source = metadata.taskSource;
-  if (source?.kind === "github-issues") {
-    applyGithubIssueUpdate(options.ghBinary ?? "gh", options.spawn ?? spawnSync, taskId, metadata, update);
-    return true;
-  }
-  if (source?.kind === "files" && source.path) {
-    return updateFileBackedTask(projectRoot, source.path, taskId, update);
-  }
-  if (source?.kind && source.kind !== "files" && source.kind !== "legacy-task-config") {
-    return false;
-  }
-  if (!source && options.allowLocalTaskConfigStatusFallback === false) {
-    return false;
-  }
-  if (typeof update.status !== "string" || update.status.trim().length === 0) {
-    return false;
-  }
-  writeLegacyTaskStatus(configPath, taskId, update.status);
-  return true;
-}
 function readMaterializedTaskMetadata(entry) {
   const rawRig = entry._rig;
   if (!isPlainRecord2(rawRig)) {
@@ -3005,10 +3032,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve13(projectRoot, "rig.config.json");
-  if (existsSync13(jsonPath)) {
+  const jsonPath = resolve14(projectRoot, "rig.config.json");
+  if (existsSync14(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -3017,12 +3044,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve13(projectRoot, "rig.config.ts");
-  if (!existsSync13(tsPath)) {
+  const tsPath = resolve14(projectRoot, "rig.config.ts");
+  if (!existsSync14(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync6(tsPath, "utf8");
+    const source = readFileSync7(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -3042,63 +3069,23 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync13(configPath)) {
+  if (!existsSync14(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
   const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
   return tasks;
 }
-function writeLegacyTaskStatus(configPath, taskId, status) {
-  const rawConfig = readRawTaskConfig(configPath);
-  if (!rawConfig) {
-    return;
-  }
-  const entry = rawConfig[taskId];
-  if (!isPlainRecord2(entry)) {
-    return;
-  }
-  entry.status = status;
-  writeFileSync5(configPath, `${JSON.stringify(rawConfig, null, 2)}
-`, "utf8");
-}
-function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
-  const directory = resolve13(projectRoot, sourcePath);
-  const file = findFileBackedTaskFile(directory, taskId);
-  if (!file) {
-    return false;
-  }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
-  if (!isPlainRecord2(raw)) {
-    return false;
-  }
-  if (update.status)
-    raw.status = update.status;
-  if (update.title !== undefined)
-    raw.title = update.title;
-  if (update.body !== undefined)
-    raw.body = update.body;
-  if (update.comment?.trim()) {
-    const existing = Array.isArray(raw.comments) ? raw.comments : [];
-    raw.comments = [
-      ...existing,
-      { body: update.comment, createdAt: new Date().toISOString(), source: "rig" }
-    ];
-  }
-  writeFileSync5(file, `${JSON.stringify(raw, null, 2)}
-`, "utf8");
-  return true;
-}
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve13(projectRoot, sourcePath);
-  if (!existsSync13(directory)) {
+  const directory = resolve14(projectRoot, sourcePath);
+  if (!existsSync14(directory)) {
     return [];
   }
   const tasks = [];
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
@@ -3109,11 +3096,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve13(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve14(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -3126,17 +3113,17 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync13(directory)) {
+  if (!existsSync14(directory)) {
     return null;
   }
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const file = join3(directory, name);
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
       const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -3159,26 +3146,6 @@ function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
   ], spawnFn);
   return githubIssueToTask(issue, source, rawEntry);
 }
-function applyGithubIssueUpdate(bin, spawnFn, id, metadata, update) {
-  const source = requireGithubIssueSource(metadata, id);
-  const repo = `${source.owner}/${source.repo}`;
-  if (update.status) {
-    applyGithubIssueStatus(bin, repo, spawnFn, id, update.status);
-  }
-  if (typeof update.comment === "string" && update.comment.trim().length > 0) {
-    runGhVoid(bin, ["issue", "comment", String(id), "--repo", repo, "--body", update.comment], spawnFn);
-  }
-  const editArgs = ["issue", "edit", String(id), "--repo", repo];
-  if (typeof update.title === "string" && update.title.trim().length > 0) {
-    editArgs.push("--title", update.title.trim());
-  }
-  if (typeof update.body === "string") {
-    editArgs.push("--body", update.body);
-  }
-  if (editArgs.length > 5) {
-    runGhVoid(bin, editArgs, spawnFn);
-  }
-}
 function requireGithubIssueSource(metadata, id) {
   const source = metadata.taskSource;
   if (source?.kind === "github-issues" && source.owner && source.repo) {
@@ -3238,76 +3205,9 @@ function githubStatusFor(issue) {
     return "cancelled";
   return "open";
 }
-function applyGithubIssueStatus(bin, repo, spawnFn, id, status) {
-  if (status === "closed") {
-    runGhVoid(bin, ["issue", "close", String(id), "--repo", repo], spawnFn);
-    return;
-  }
-  const targetLabel = statusLabelFor(status);
-  for (const label of STATUS_LABELS) {
-    if (targetLabel !== null && label === targetLabel) {
-      continue;
-    }
-    try {
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--remove-label", label], spawnFn);
-    } catch {}
-  }
-  if (targetLabel !== null) {
-    try {
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", targetLabel], spawnFn);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (!/not found/i.test(message)) {
-        throw error;
-      }
-      ensureStatusLabel(bin, repo, spawnFn, targetLabel);
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", targetLabel], spawnFn);
-    }
-  }
-}
-function statusLabelFor(status) {
-  switch (status) {
-    case "in_progress":
-      return "in-progress";
-    case "blocked":
-      return "blocked";
-    case "ready":
-      return "ready";
-    case "under_review":
-      return "under-review";
-    case "failed":
-      return "failed";
-    case "cancelled":
-      return "cancelled";
-    case "open":
-      return null;
-    default:
-      throw new Error(`unsupported status: ${status}`);
-  }
-}
-function ensureStatusLabel(bin, repo, spawnFn, label) {
-  try {
-    runGhVoid(bin, [
-      "label",
-      "create",
-      label,
-      "--repo",
-      repo,
-      "--color",
-      "6f42c1",
-      "--description",
-      "Task status managed by Rig"
-    ], spawnFn);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (!/already exists/i.test(message)) {
-      throw error;
-    }
-  }
-}
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -3320,10 +3220,6 @@ function runGh(bin, args, spawnFn) {
   }
   return JSON.parse(res.stdout);
 }
-function runGhVoid(bin, args, spawnFn) {
-  const res = spawnFn(bin, [...args], ghSpawnOptions());
-  assertGhSuccess(args, res);
-}
 function assertGhSuccess(args, res) {
   if (res.error) {
     const msg = res.error.message ?? String(res.error);
@@ -3361,19 +3257,6 @@ function isPlainRecord2(candidate) {
 function hasRunnableTaskSource(source) {
   return Boolean(source && typeof source === "object" && !Array.isArray(source));
 }
-function cleanString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-function taskIdFromSourceIssueId(value) {
-  const raw = cleanString(value);
-  if (!raw)
-    return null;
-  const issueNumber = raw.match(/#([^#\s]+)$/)?.[1];
-  return issueNumber ?? raw;
-}
-function resolveSourceTaskId(taskId, sourceTask) {
-  return cleanString(sourceTask?.id) ?? taskIdFromSourceIssueId(sourceTask?.sourceIssueId) ?? taskIdFromSourceIssueId(sourceTask?.source_issue_id) ?? taskId;
-}
 async function getPluginTask(projectRoot, taskId) {
   const ctx = await buildPluginHostContext(projectRoot);
   const [source] = ctx?.taskSourceRegistry.list() ?? [];
@@ -3398,95 +3281,10 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
     task
   };
 }
-async function updatePluginTaskSourceTask(projectRoot, taskId, update) {
-  const ctx = await buildPluginHostContext(projectRoot);
-  const [source] = ctx?.taskSourceRegistry.list() ?? [];
-  if (!hasRunnableTaskSource(source)) {
-    return ctx ? { taskId, updated: false, source: "none", sourceKind: null, status: null } : null;
-  }
-  if (source.updateTask) {
-    await source.updateTask(taskId, update);
-  } else if (update.status && source.updateStatus) {
-    await source.updateStatus(taskId, update.status);
-  } else {
-    return {
-      taskId,
-      updated: false,
-      source: "plugin",
-      sourceKind: source.kind,
-      status: null
-    };
-  }
-  const status = source.get ? (await source.get(taskId))?.status ?? update.status ?? null : update.status ?? null;
-  return {
-    taskId,
-    updated: true,
-    source: "plugin",
-    sourceKind: source.kind,
-    status
-  };
-}
-async function updateConfiguredTaskSourceTask(projectRoot, input) {
-  const taskId = resolveSourceTaskId(input.taskId, input.sourceTask);
-  let pluginResult = null;
-  try {
-    pluginResult = await updatePluginTaskSourceTask(projectRoot, taskId, input.update);
-  } catch (error) {
-    const fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, input.update, {
-      allowLocalTaskConfigStatusFallback: false
-    });
-    if (!fallbackUpdated) {
-      throw error;
-    }
-    return {
-      taskId,
-      updated: true,
-      source: "compat",
-      sourceKind: null,
-      status: await readSourceAwareTaskStatus(projectRoot, taskId)
-    };
-  }
-  if (pluginResult) {
-    return pluginResult;
-  }
-  const updated = updateSourceAwareTaskConfigTask(projectRoot, taskId, input.update);
-  return {
-    taskId,
-    updated,
-    source: updated ? "compat" : "none",
-    sourceKind: null,
-    status: await readSourceAwareTaskStatus(projectRoot, taskId)
-  };
-}
-function buildTaskRunLifecycleComment(input) {
-  const lines = [
-    "<!-- rig:status-comment -->",
-    `### Rig status: ${input.status}`,
-    "",
-    input.summary,
-    "",
-    `- Run: ${input.runId}`,
-    `- Status: ${input.status}`
-  ];
-  if (input.errorText?.trim()) {
-    lines.push(`- Error: ${input.errorText.trim()}`);
-  }
-  if (input.runtimeWorkspace?.trim()) {
-    lines.push(`- Runtime workspace: ${input.runtimeWorkspace.trim()}`);
-  }
-  if (input.logsDir?.trim()) {
-    lines.push(`- Logs: ${input.logsDir.trim()}`);
-  }
-  if (input.sessionDir?.trim()) {
-    lines.push(`- Session: ${input.sessionDir.trim()}`);
-  }
-  return lines.join(`
-`);
-}
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync17, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve17 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename6, resolve as resolve18 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -3594,39 +3392,39 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync16, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve16 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync15 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
 init_layout();
-import { existsSync as existsSync14 } from "fs";
-import { basename as basename5, dirname as dirname9, join as join4, resolve as resolve14 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { basename as basename5, dirname as dirname9, join as join4, resolve as resolve15 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve14(projectRoot);
+  const normalizedProjectRoot = resolve15(projectRoot);
   const projectParent = dirname9(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
     const ownerRoot = dirname9(projectParent);
-    const ownerHasRepoMarkers = existsSync14(resolve14(ownerRoot, ".git")) || existsSync14(resolve14(ownerRoot, ".rig", "state"));
+    const ownerHasRepoMarkers = existsSync15(resolve15(ownerRoot, ".git")) || existsSync15(resolve15(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve14(ownerRoot, ".rig", "state");
+      return resolve15(ownerRoot, ".rig", "state");
     }
   }
-  return resolve14(projectRoot, ".rig", "state");
+  return resolve15(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve14(projectRoot);
+  const normalizedProjectRoot = resolve15(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join4("repos", entry.id);
-  const metadataRoot = resolve14(stateDir, metadataRelativePath);
+  const metadataRoot = resolve15(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve14(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname9(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve15(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname9(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve14(process.env[entry.checkoutEnvVar].trim()) : resolve14(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve15(process.env[entry.checkoutEnvVar].trim()) : resolve15(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -3634,12 +3432,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve14(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve15(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve14(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve14(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve15(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve15(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join4(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -3657,7 +3455,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync15(resolve15(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync16(resolve16(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -3668,8 +3466,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS2 = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync16,
-  readFile: (path) => readFileSync7(path, "utf8")
+  exists: existsSync17,
+  readFile: (path) => readFileSync8(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -3750,12 +3548,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync16(resolve16(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync17(resolve17(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve16(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve16(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve17(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve17(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -3817,7 +3615,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve17(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve18(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -3893,15 +3691,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync17(issuesPath)) {
+  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync18(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync8(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync9(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -3926,25 +3724,25 @@ function inferTaskIdFromRuntimePath(path) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve17(workspaceDir, "artifacts", id);
-    if (existsSync17(worktreeArtifacts) || existsSync17(resolve17(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve18(workspaceDir, "artifacts", id);
+    if (existsSync18(worktreeArtifacts) || existsSync18(resolve18(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve17(paths.artifactsDir, id);
+    return resolve18(paths.artifactsDir, id);
   } catch {
-    return resolve17(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve18(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync17(paths.taskConfigPath)) {
+  if (existsSync18(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync17(candidate)) {
+    if (existsSync18(candidate)) {
       return candidate;
     }
   }
@@ -3952,7 +3750,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync17(candidate)) {
+    if (existsSync18(candidate)) {
       return candidate;
     }
   }
@@ -3965,7 +3763,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -4017,12 +3815,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync17(issuesPath)) {
+  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync18(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync8(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -4078,19 +3876,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve17(projectRoot, sourcePath);
-  if (!existsSync17(directory)) {
+  const directory = resolve18(projectRoot, sourcePath);
+  if (!existsSync18(directory)) {
     return {};
   }
   const config = {};
-  for (const name of readdirSync2(directory)) {
+  for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve17(directory, name);
+    const file = resolve18(directory, name);
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync8(file, "utf8"));
+      const raw = JSON.parse(readFileSync9(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -4132,10 +3930,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve17(projectRoot, "rig.config.json");
-  if (existsSync17(jsonPath)) {
+  const jsonPath = resolve18(projectRoot, "rig.config.json");
+  if (existsSync18(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync8(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -4147,12 +3945,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve17(projectRoot, "rig.config.ts");
-  if (!existsSync17(tsPath)) {
+  const tsPath = resolve18(projectRoot, "rig.config.ts");
+  if (!existsSync18(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync8(tsPath, "utf8");
+    const source = readFileSync9(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -4166,9 +3964,9 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve17(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve17(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve17(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve18(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve18(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve18(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
@@ -4177,8 +3975,8 @@ init_layout();
 
 // packages/runtime/src/binary-run.ts
 init_layout();
-import { chmodSync as chmodSync4, cpSync, existsSync as existsSync18, mkdirSync as mkdirSync8, renameSync as renameSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename7, dirname as dirname10, resolve as resolve18 } from "path";
+import { chmodSync as chmodSync4, cpSync, existsSync as existsSync19, mkdirSync as mkdirSync9, renameSync as renameSync3, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename7, dirname as dirname10, resolve as resolve19 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -4204,9 +4002,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve18(dirname10(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve18(tempBuildDir, basename7(options.outputPath));
-  mkdirSync8(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve19(dirname10(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve19(tempBuildDir, basename7(options.outputPath));
+  mkdirSync9(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -4231,7 +4029,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync18(tempOutputPath)) {
+    if (!existsSync19(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -4246,7 +4044,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
       });
     }
   })).finally(() => {
-    rmSync7(tempBuildDir, { recursive: true, force: true });
+    rmSync8(tempBuildDir, { recursive: true, force: true });
   });
 }
 function runBestEffortBuildGc() {
@@ -4263,8 +4061,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve18(options.cwd, options.sourcePath),
-    outputPath: resolve18(options.outputPath)
+    entrypoint: resolve19(options.cwd, options.sourcePath),
+    outputPath: resolve19(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -4278,7 +4076,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync18(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync19(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -4309,13 +4107,13 @@ async function buildRuntimeBinaryViaWorker(options) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  rmSync7(payloadPath, { force: true });
+  rmSync8(payloadPath, { force: true });
   if (exitCode !== 0) {
     throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve18(dirname10(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve19(dirname10(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -4324,13 +4122,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve18(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync18(candidate)) {
+    const candidate = resolve19(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync19(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve18(import.meta.dir, "binary-build-worker.ts");
-  return existsSync18(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve19(import.meta.dir, "binary-build-worker.ts");
+  return existsSync19(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -4366,7 +4164,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync18(input.outputPath) || !existsSync18(input.manifestPath)) {
+  if (!existsSync19(input.outputPath) || !existsSync19(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -4379,7 +4177,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync18(filePath)) {
+    if (!existsSync19(filePath)) {
       return false;
     }
     if (await sha256File4(filePath) !== expectedDigest) {
@@ -4392,7 +4190,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync18(normalized)) {
+    if (!normalized || !existsSync19(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File4(normalized);
@@ -4415,7 +4213,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve18(cwd, inputPath);
+  return resolve19(cwd, inputPath);
 }
 async function sha256File4(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -4431,8 +4229,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve19) => {
-    release = resolve19;
+  runtimeBinaryBuildQueue = new Promise((resolve20) => {
+    release = resolve20;
   });
   await previous;
   try {
@@ -4477,11 +4275,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve21 } from "path";
+import { delimiter, resolve as resolve22 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync20, readdirSync as readdirSync4, realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync5, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve21 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox-utils.ts
 init_utils();
@@ -4498,7 +4296,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve20(home, ".bun/bin/bun") : "",
+    home ? resolve21(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -4526,8 +4324,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve20(home, ".local/bin/claude") : "",
-    home ? resolve20(home, ".local/share/claude/local/claude") : "",
+    home ? resolve21(home, ".local/bin/claude") : "",
+    home ? resolve21(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -4541,35 +4339,35 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve20(bunBinaryPath, "../..");
+  return resolve21(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve20(realPath, "..");
+  return resolve21(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve20(explicitNode) === resolve20(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve20(preferredNode, "../..") : resolve20(preferredNode, "..");
+  if (explicitNode && resolve21(explicitNode) === resolve21(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve21(preferredNode, "../..") : resolve21(preferredNode, "..");
   }
   try {
     const realPath = realpathSync2(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve20(realPath, "../..");
+      return resolve21(realPath, "../..");
     }
-    return resolve20(realPath, "..");
+    return resolve21(realPath, "..");
   } catch {
-    return resolve20(preferredNode, "..");
+    return resolve21(preferredNode, "..");
   }
 }
 function resolveRuntimeDependencyRoots(runtimeDirs) {
   const roots = [];
   if (process.platform === "darwin") {
     for (const macPath of ["/opt/homebrew", "/opt/homebrew/opt"]) {
-      if (existsSync20(macPath)) {
+      if (existsSync21(macPath)) {
         roots.push(macPath);
       }
     }
@@ -4587,23 +4385,23 @@ function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve20(envNode);
-    if (existsSync20(explicit)) {
+    const explicit = resolve21(envNode);
+    if (existsSync21(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve20(nvmBin, "node"));
+    candidates.push(resolve21(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve20(home, ".nvm/versions/node");
-    if (existsSync20(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve21(home, ".nvm/versions/node");
+    if (existsSync21(nvmVersionsDir)) {
       try {
-        const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        const versionDirs = readdirSync5(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve20(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve21(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -4612,8 +4410,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve20(candidate)));
-  const existing = deduped.filter((candidate) => existsSync20(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve21(candidate)));
+  const existing = deduped.filter((candidate) => existsSync21(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -4627,7 +4425,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve20(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve21(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -4639,8 +4437,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve20(candidate);
-  if (!existsSync20(normalized)) {
+  const normalized = resolve21(candidate);
+  if (!existsSync21(normalized)) {
     return "";
   }
   try {
@@ -4650,7 +4448,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve20(candidate).replace(/\\/g, "/");
+  const normalized = resolve21(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -4671,7 +4469,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve21(claudeBinary, "..");
+      return resolve22(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -4681,8 +4479,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve21(realHome, ".local/bin") : "",
-    realHome ? resolve21(realHome, ".cargo/bin") : "",
+    realHome ? resolve22(realHome, ".local/bin") : "",
+    realHome ? resolve22(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -4711,8 +4509,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 }
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
-import { existsSync as existsSync21, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve23 } from "path";
 var BAKED_RUNTIME_SECRETS = {
   ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
   OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
@@ -4755,12 +4553,12 @@ function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
   return resolved;
 }
 function loadDotEnvSecrets(projectRoot, env = process.env) {
-  const dotenvPath = resolve22(projectRoot, ".env");
-  if (!existsSync21(dotenvPath)) {
+  const dotenvPath = resolve23(projectRoot, ".env");
+  if (!existsSync22(dotenvPath)) {
     return {};
   }
   const parsed = {};
-  const lines = readFileSync9(dotenvPath, "utf-8").split(/\r?\n/);
+  const lines = readFileSync10(dotenvPath, "utf-8").split(/\r?\n/);
   for (const rawLine of lines) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) {
@@ -5117,16 +4915,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync22(artifactDir)) {
+    if (!existsSync23(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve23(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve23(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve23(artifactDir, "changed-files.txt");
-    if (existsSync22(changedFiles)) {
-      const lines = readFileSync10(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve24(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve24(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve24(artifactDir, "changed-files.txt");
+    if (existsSync23(changedFiles)) {
+      const lines = readFileSync11(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -5250,12 +5048,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve23(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync22(issuesPath)) {
+  const issuesPath = resolve24(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync23(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -5368,11 +5166,11 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync22(path)) {
+  if (!existsSync23(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync10(path, "utf-8"));
+  process.stdout.write(readFileSync11(path, "utf-8"));
   console.log("");
 }
 
@@ -5474,7 +5272,7 @@ init_layout();
 
 // packages/runtime/src/control-plane/runtime/overlay.ts
 init_layout();
-import { mkdirSync as mkdirSync10 } from "fs";
+import { mkdirSync as mkdirSync11 } from "fs";
 function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const layout = resolveRuntimeWorkspaceLayout(workspaceDir ?? projectRoot);
   const rootDir = layout.rigRoot;
@@ -5486,14 +5284,14 @@ function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const sessionDir = layout.sessionDir;
   const runtimeDir = layout.runtimeDir;
   const contextPath = layout.contextPath;
-  mkdirSync10(rootDir, { recursive: true });
-  mkdirSync10(homeDir, { recursive: true });
-  mkdirSync10(tmpDir, { recursive: true });
-  mkdirSync10(cacheDir, { recursive: true });
-  mkdirSync10(logsDir, { recursive: true });
-  mkdirSync10(stateDir, { recursive: true });
-  mkdirSync10(sessionDir, { recursive: true });
-  mkdirSync10(runtimeDir, { recursive: true });
+  mkdirSync11(rootDir, { recursive: true });
+  mkdirSync11(homeDir, { recursive: true });
+  mkdirSync11(tmpDir, { recursive: true });
+  mkdirSync11(cacheDir, { recursive: true });
+  mkdirSync11(logsDir, { recursive: true });
+  mkdirSync11(stateDir, { recursive: true });
+  mkdirSync11(sessionDir, { recursive: true });
+  mkdirSync11(runtimeDir, { recursive: true });
   return {
     rootDir,
     homeDir,
@@ -5511,17 +5309,17 @@ import {
   chmodSync as chmodSync5,
   copyFileSync as copyFileSync5,
   cpSync as cpSync2,
-  existsSync as existsSync24,
-  mkdirSync as mkdirSync11,
+  existsSync as existsSync25,
+  mkdirSync as mkdirSync12,
   statSync as statSync5,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync10
 } from "fs";
 import { mkdir } from "fs/promises";
-import { basename as basename8, delimiter as delimiter2, resolve as resolve25 } from "path";
+import { basename as basename8, delimiter as delimiter2, resolve as resolve26 } from "path";
 
 // packages/runtime/src/control-plane/runtime/isolation/shared.ts
-import { existsSync as existsSync23, readFileSync as readFileSync11, rmSync as rmSync8 } from "fs";
-import { resolve as resolve24 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync12, rmSync as rmSync9 } from "fs";
+import { resolve as resolve25 } from "path";
 var generatedCredentialFiles = new Set;
 var credentialCleanupRegistered = false;
 function resolveMonorepoRoot3(projectRoot) {
@@ -5545,7 +5343,7 @@ function resolveHostGitBinary() {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync23(candidate)) {
+    if (existsSync24(candidate)) {
       return candidate;
     }
   }
@@ -5611,7 +5409,7 @@ async function refreshRemoteBranch(repoRoot, remote, branch) {
   }
 }
 async function tryReadGitHead(repoRoot) {
-  if (!existsSync23(resolve24(repoRoot, ".git"))) {
+  if (!existsSync24(resolve25(repoRoot, ".git"))) {
     return;
   }
   const result = await runGitCommand(repoRoot, ["rev-parse", "HEAD"]);
@@ -5622,7 +5420,7 @@ async function tryReadGitHead(repoRoot) {
   return value || undefined;
 }
 async function captureRepoDirtyFiles(repoRoot) {
-  if (!existsSync23(resolve24(repoRoot, ".git"))) {
+  if (!existsSync24(resolve25(repoRoot, ".git"))) {
     return [];
   }
   const files = new Set;
@@ -5658,7 +5456,7 @@ function registerCredentialCleanup(path) {
   const cleanup = () => {
     for (const filePath of generatedCredentialFiles) {
       try {
-        rmSync8(filePath, { force: true });
+        rmSync9(filePath, { force: true });
       } catch {}
     }
     generatedCredentialFiles.clear();
@@ -5710,20 +5508,23 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync23(explicit)) {
+  if (explicit && existsSync24(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
-  const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync23(bunResolved)) {
-    return bunResolved;
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    if (existsSync23(candidate)) {
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    if (existsSync24(candidate)) {
       return candidate;
     }
   }
+  const bunResolved = Bun.which("gh");
+  if (bunResolved && existsSync24(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+    return bunResolved;
+  }
   return "";
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 async function resolveGithubCliAuthToken(ghBinary = "") {
   const gh = ghBinary || resolveGithubCliBinaryPath();
   if (!gh) {
@@ -5750,17 +5551,17 @@ function resolveSystemCertBundlePath() {
     "/opt/homebrew/etc/openssl@3/cert.pem"
   ];
   for (const candidate of candidates) {
-    if (candidate && existsSync23(candidate)) {
-      return resolve24(candidate);
+    if (candidate && existsSync24(candidate)) {
+      return resolve25(candidate);
     }
   }
   return "";
 }
 function readKnownHosts(path) {
-  if (!existsSync23(path)) {
+  if (!existsSync24(path)) {
     return new Set;
   }
-  return new Set(readFileSync11(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  return new Set(readFileSync12(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/home.ts
@@ -5771,6 +5572,21 @@ var GITHUB_KNOWN_HOSTS = [
   "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
 ].join(`
 `);
+function resolveControlPlaneSourceRoot(projectRoot) {
+  const candidates = [
+    process.env.RIG_CONTROL_PLANE_SOURCE_ROOT?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    resolve26(import.meta.dir, "../../../../.."),
+    projectRoot
+  ].filter((value) => Boolean(value));
+  for (const candidate of candidates) {
+    const root = resolve26(candidate);
+    if (existsSync25(resolve26(root, "packages/runtime/src/control-plane/pi-sessiond/bin.ts"))) {
+      return root;
+    }
+  }
+  return "";
+}
 async function runtimeEnv(projectRoot, runtime) {
   const bunBinaryPath = resolveBunBinaryPath();
   const bunDir = resolveBunInstallDir(bunBinaryPath);
@@ -5785,7 +5601,7 @@ async function runtimeEnv(projectRoot, runtime) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve25(claudeBinaryPath, "..");
+      return resolve26(claudeBinaryPath, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -5800,8 +5616,8 @@ async function runtimeEnv(projectRoot, runtime) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve25(realHome, ".local/bin") : "",
-    realHome ? resolve25(realHome, ".cargo/bin") : "",
+    realHome ? resolve26(realHome, ".local/bin") : "",
+    realHome ? resolve26(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -5812,18 +5628,22 @@ async function runtimeEnv(projectRoot, runtime) {
     "/usr/sbin",
     "/sbin"
   ].filter(Boolean);
-  const runtimeBash = resolve25(runtime.binDir, "bash");
-  const runtimeRigGit = resolve25(runtime.binDir, runtimeRigGitFileName());
-  const preferredShell = existsSync24(runtimeBash) ? runtimeBash : "/bin/bash";
+  const runtimeBash = resolve26(runtime.binDir, "bash");
+  const runtimeRigGit = resolve26(runtime.binDir, runtimeRigGitFileName());
+  const preferredShell = existsSync25(runtimeBash) ? runtimeBash : "/bin/bash";
   const nativeRuntimeLibraryPath = await materializeNativeRuntimeLibrary(runtime.binDir);
+  const controlPlaneSourceRoot = resolveControlPlaneSourceRoot(projectRoot);
   const env = {
     PROJECT_RIG_ROOT: projectRoot,
     RIG_HOST_PROJECT_ROOT: projectRoot,
+    ...controlPlaneSourceRoot ? { RIG_CONTROL_PLANE_SOURCE_ROOT: controlPlaneSourceRoot } : {},
     HOME: runtime.homeDir,
     TMPDIR: runtime.tmpDir,
     XDG_CACHE_HOME: runtime.cacheDir,
     XDG_STATE_HOME: runtime.stateDir,
     RIG_AGENT_ID: runtime.id,
+    ...process.env.RIG_RUN_ID?.trim() ? { RIG_RUN_ID: process.env.RIG_RUN_ID.trim() } : {},
+    ...process.env.RIG_SERVER_RUN_ID?.trim() ? { RIG_SERVER_RUN_ID: process.env.RIG_SERVER_RUN_ID.trim() } : {},
     RIG_TASK_ID: runtime.taskId,
     RIG_TASK_RUNTIME_ID: runtime.id,
     RIG_TASK_WORKSPACE: runtime.workspaceDir,
@@ -5831,30 +5651,30 @@ async function runtimeEnv(projectRoot, runtime) {
     RIG_RUNTIME_MODE: runtime.mode,
     RIG_RUNTIME_HOME: runtime.rootDir,
     RIG_RUNTIME_BIN_DIR: runtime.binDir,
-    ...existsSync24(runtimeRigGit) ? { RIG_NATIVE_GIT_BIN: runtimeRigGit } : {},
+    ...existsSync25(runtimeRigGit) ? { RIG_NATIVE_GIT_BIN: runtimeRigGit } : {},
     RIG_BUN_PATH: bunBinaryPath,
     ...claudeBinaryPath ? { RIG_CLAUDE_PATH: claudeBinaryPath } : {},
-    RIG_AGENT_BIN: resolve25(runtime.binDir, "rig-agent"),
+    RIG_AGENT_BIN: resolve26(runtime.binDir, "rig-agent"),
     RIG_HOOKS_ACTIVE: "1",
     RIG_AUTO_PR_ON_COMPLETE: "1",
-    RIG_POLICY_FILE: resolve25(projectRoot, "rig/policy/policy.json"),
+    RIG_POLICY_FILE: resolve26(projectRoot, "rig/policy/policy.json"),
     RIG_STATE_DIR: runtime.stateDir,
     RIG_LOGS_DIR: runtime.logsDir,
-    RIG_SESSION_FILE: resolve25(runtime.sessionDir, "session.json"),
+    RIG_SESSION_FILE: resolve26(runtime.sessionDir, "session.json"),
     MONOREPO_ROOT: runtime.workspaceDir,
     MONOREPO_MAIN_ROOT: monorepoMainRoot,
-    TS_API_TESTS_DIR: resolve25(runtime.workspaceDir, "TSAPITests"),
+    TS_API_TESTS_DIR: resolve26(runtime.workspaceDir, "TSAPITests"),
     BASH: preferredShell,
     SHELL: preferredShell,
     PATH: [...new Set(pathEntries)].join(delimiter2),
     LANG: process.env.LANG ?? "en_US.UTF-8",
     TERM: process.env.TERM ?? "xterm-256color",
     PYTHONDONTWRITEBYTECODE: "1",
-    PYTHONPYCACHEPREFIX: resolve25(runtime.cacheDir, "python"),
+    PYTHONPYCACHEPREFIX: resolve26(runtime.cacheDir, "python"),
     ...process.env.RIG_PR_BASE_PROJECT && { RIG_PR_BASE_PROJECT: process.env.RIG_PR_BASE_PROJECT },
     ...process.env.RIG_PR_BASE_MONOREPO && { RIG_PR_BASE_MONOREPO: process.env.RIG_PR_BASE_MONOREPO },
     CLAUDE_HOME: runtime.claudeHomeDir,
-    PI_CODING_AGENT_DIR: resolve25(runtime.homeDir, ".pi", "agent"),
+    PI_CODING_AGENT_DIR: resolve26(runtime.homeDir, ".pi", "agent"),
     [RUNTIME_CONTEXT_ENV]: runtime.contextFile,
     ...nativeRuntimeLibraryPath ? { RIG_NATIVE_RUNTIME_LIB: nativeRuntimeLibraryPath } : {},
     ...hostGhBinary ? { RIG_GH_BIN: hostGhBinary } : {},
@@ -5865,16 +5685,16 @@ async function runtimeEnv(projectRoot, runtime) {
       NODE_EXTRA_CA_CERTS: runtimeCertBundlePath
     } : {}
   };
-  const knownHostsPath = resolve25(runtime.homeDir, ".ssh", "known_hosts");
-  if (existsSync24(knownHostsPath)) {
-    const agentSshKey = resolve25(runtime.homeDir, ".ssh", "rig-agent-key");
+  const knownHostsPath = resolve26(runtime.homeDir, ".ssh", "known_hosts");
+  if (existsSync25(knownHostsPath)) {
+    const agentSshKey = resolve26(runtime.homeDir, ".ssh", "rig-agent-key");
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${knownHostsPath}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (existsSync24(agentSshKey)) {
+    if (existsSync25(agentSshKey)) {
       sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -5911,7 +5731,7 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
-  if (existsSync24(runtime.contextFile)) {
+  if (existsSync25(runtime.contextFile)) {
     const runtimeContext = loadRuntimeContext(runtime.contextFile);
     Object.assign(env, runtimeMemoryEnvFromContext(runtimeContext));
     Object.assign(env, browserEnvFromContext(runtimeContext.browser));
@@ -5925,30 +5745,30 @@ async function provisionRuntimeHome(runtime, options = {}) {
   await mkdir(runtime.cacheDir, { recursive: true });
   await provisionAgentSshKey(runtime.homeDir);
   if (options.provider === "codex") {
-    const hasCodexAuth = await injectCodexAuth(resolve25(runtime.homeDir, ".codex"));
+    const hasCodexAuth = await injectCodexAuth(resolve26(runtime.homeDir, ".codex"));
     if (!hasCodexAuth) {
       console.warn("[rig] No Codex auth.json found for isolated runtime. " + "Run `codex login` in your host shell, then retry the agent run.");
     }
   }
   if (options.provider === "pi") {
-    const hasPiAuth = await injectPiAgentConfig(resolve25(runtime.homeDir, ".pi", "agent"));
+    const hasPiAuth = await injectPiAgentConfig(resolve26(runtime.homeDir, ".pi", "agent"));
     if (!hasPiAuth) {
       console.warn("[rig] No Pi auth.json found for isolated runtime. " + "Run `pi /login` in your host shell, then retry the agent run.");
     }
   }
 }
 async function provisionClaudeHome(config) {
-  mkdirSync11(config.claudeHomeDir, { recursive: true });
-  const workspaceSettings = resolve25(config.workspaceDir, ".claude/settings.json");
-  const hostSettings = resolve25(config.hostProjectRoot, ".claude/settings.json");
-  const projectSettings = existsSync24(workspaceSettings) ? workspaceSettings : hostSettings;
+  mkdirSync12(config.claudeHomeDir, { recursive: true });
+  const workspaceSettings = resolve26(config.workspaceDir, ".claude/settings.json");
+  const hostSettings = resolve26(config.hostProjectRoot, ".claude/settings.json");
+  const projectSettings = existsSync25(workspaceSettings) ? workspaceSettings : hostSettings;
   const runtimeSettings = await loadRuntimeClaudeSettings(projectSettings);
-  if (existsSync24(projectSettings)) {
-    writeFileSync9(resolve25(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  if (existsSync25(projectSettings)) {
+    writeFileSync10(resolve26(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
   }
   writeClaudeProjectSettings(config.claudeHomeDir, config.workspaceDir, runtimeSettings);
-  writeFileSync9(resolve25(config.claudeHomeDir, "settings.json"), JSON.stringify({
+  writeFileSync10(resolve26(config.claudeHomeDir, "settings.json"), JSON.stringify({
     permissions: { defaultMode: "bypassPermissions" },
     autoMemoryEnabled: false
   }, null, 2));
@@ -5956,12 +5776,12 @@ async function provisionClaudeHome(config) {
   if (!hasCredentials) {
     console.warn("[rig] No Claude credentials found for isolated runtime. " + "Run `claude /login` in your host shell, then retry the agent run.");
   }
-  const realClaudeHome = resolve25(process.env.HOME ?? "", ".claude");
-  if (process.env.HOME && existsSync24(resolve25(realClaudeHome, "CLAUDE.md"))) {
-    cpSync2(resolve25(realClaudeHome, "CLAUDE.md"), resolve25(config.claudeHomeDir, "CLAUDE.md"));
+  const realClaudeHome = resolve26(process.env.HOME ?? "", ".claude");
+  if (process.env.HOME && existsSync25(resolve26(realClaudeHome, "CLAUDE.md"))) {
+    cpSync2(resolve26(realClaudeHome, "CLAUDE.md"), resolve26(config.claudeHomeDir, "CLAUDE.md"));
   }
-  if (process.env.HOME && existsSync24(resolve25(realClaudeHome, "agents"))) {
-    cpSync2(resolve25(realClaudeHome, "agents"), resolve25(config.claudeHomeDir, "agents"), { recursive: true });
+  if (process.env.HOME && existsSync25(resolve26(realClaudeHome, "agents"))) {
+    cpSync2(resolve26(realClaudeHome, "agents"), resolve26(config.claudeHomeDir, "agents"), { recursive: true });
   }
   if (process.platform === "darwin" && process.env.HOME) {
     writeClaudeProjectSettings(realClaudeHome, config.workspaceDir, runtimeSettings);
@@ -5972,10 +5792,10 @@ async function materializeRuntimeCertBundle(runtime) {
   if (!sourcePath) {
     return "";
   }
-  const certsDir = resolve25(runtime.rootDir, "certs");
-  const targetPath = resolve25(certsDir, "ca-certificates.pem");
+  const certsDir = resolve26(runtime.rootDir, "certs");
+  const targetPath = resolve26(certsDir, "ca-certificates.pem");
   await mkdir(certsDir, { recursive: true });
-  let shouldCopy = !existsSync24(targetPath);
+  let shouldCopy = !existsSync25(targetPath);
   if (!shouldCopy) {
     try {
       shouldCopy = statSync5(sourcePath).mtimeMs > statSync5(targetPath).mtimeMs;
@@ -5997,7 +5817,7 @@ function applyGitHubCredentialHelperEnv(env) {
   env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
 }
 function persistRuntimeSecrets(runtimeRoot, env) {
-  const secretsPath = resolve25(runtimeRoot, "runtime-secrets.json");
+  const secretsPath = resolve26(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
@@ -6016,12 +5836,12 @@ function persistRuntimeSecrets(runtimeRoot, env) {
   if (Object.keys(persisted).length === 0) {
     return;
   }
-  writeFileSync9(secretsPath, `${JSON.stringify(persisted, null, 2)}
+  writeFileSync10(secretsPath, `${JSON.stringify(persisted, null, 2)}
 `, "utf-8");
 }
 async function provisionAgentSshKey(homeDir) {
-  const sshDir = resolve25(homeDir, ".ssh");
-  if (!existsSync24(sshDir)) {
+  const sshDir = resolve26(homeDir, ".ssh");
+  if (!existsSync25(sshDir)) {
     await mkdir(sshDir, { recursive: true });
   }
   seedKnownHosts(sshDir);
@@ -6029,27 +5849,27 @@ async function provisionAgentSshKey(homeDir) {
   const privateKey = decodeProvisionedSshKey(secrets.GITHUB_SSH_KEY);
   if (!privateKey) {
     const hostKeyPath = resolveHostSshKeyPath(process.env.HOME ?? "");
-    if (!process.env.HOME || !existsSync24(hostKeyPath)) {
+    if (!process.env.HOME || !existsSync25(hostKeyPath)) {
       return;
     }
-    const agentKeyPath2 = resolve25(sshDir, "rig-agent-key");
-    if (!existsSync24(agentKeyPath2)) {
+    const agentKeyPath2 = resolve26(sshDir, "rig-agent-key");
+    if (!existsSync25(agentKeyPath2)) {
       copyFileSync5(hostKeyPath, agentKeyPath2);
       chmodSync5(agentKeyPath2, 384);
     }
     const hostPubPath = `${hostKeyPath}.pub`;
-    if (existsSync24(hostPubPath)) {
+    if (existsSync25(hostPubPath)) {
       const agentPubPath = `${agentKeyPath2}.pub`;
-      if (!existsSync24(agentPubPath)) {
+      if (!existsSync25(agentPubPath)) {
         copyFileSync5(hostPubPath, agentPubPath);
       }
     }
     writeSshConfig(sshDir, agentKeyPath2);
     return;
   }
-  const agentKeyPath = resolve25(sshDir, "rig-agent-key");
-  if (!existsSync24(agentKeyPath)) {
-    writeFileSync9(agentKeyPath, privateKey, { mode: 384 });
+  const agentKeyPath = resolve26(sshDir, "rig-agent-key");
+  if (!existsSync25(agentKeyPath)) {
+    writeFileSync10(agentKeyPath, privateKey, { mode: 384 });
   }
   writeSshConfig(sshDir, agentKeyPath);
 }
@@ -6066,21 +5886,21 @@ function decodeProvisionedSshKey(encodedKey) {
 `;
 }
 function resolveHostSshKeyPath(homeDir) {
-  const sshDir = resolve25(homeDir, ".ssh");
+  const sshDir = resolve26(homeDir, ".ssh");
   const candidates = [
     "rig-agent-key",
     "id_ed25519",
     "id_ecdsa",
     "id_rsa"
-  ].map((name) => resolve25(sshDir, name));
-  return candidates.find((candidate) => existsSync24(candidate)) ?? resolve25(sshDir, "rig-agent-key");
+  ].map((name) => resolve26(sshDir, name));
+  return candidates.find((candidate) => existsSync25(candidate)) ?? resolve26(sshDir, "rig-agent-key");
 }
 function writeSshConfig(sshDir, keyPath) {
-  const configPath = resolve25(sshDir, "config");
-  if (existsSync24(configPath)) {
+  const configPath = resolve26(sshDir, "config");
+  if (existsSync25(configPath)) {
     return;
   }
-  const knownHostsPath = resolve25(sshDir, "known_hosts");
+  const knownHostsPath = resolve26(sshDir, "known_hosts");
   const config = [
     "Host github.com",
     `  IdentityFile ${keyPath}`,
@@ -6090,10 +5910,10 @@ function writeSshConfig(sshDir, keyPath) {
     ""
   ].join(`
 `);
-  writeFileSync9(configPath, config, { mode: 420 });
+  writeFileSync10(configPath, config, { mode: 420 });
 }
 function seedKnownHosts(sshDir) {
-  const knownHostsPath = resolve25(sshDir, "known_hosts");
+  const knownHostsPath = resolve26(sshDir, "known_hosts");
   const existingLines = readKnownHosts(knownHostsPath);
   const requiredLines = GITHUB_KNOWN_HOSTS.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const missing = requiredLines.filter((line) => !existingLines.has(line));
@@ -6104,23 +5924,23 @@ function seedKnownHosts(sshDir) {
     for (const line of missing) {
       existingLines.add(line);
     }
-    writeFileSync9(knownHostsPath, `${Array.from(existingLines).join(`
+    writeFileSync10(knownHostsPath, `${Array.from(existingLines).join(`
 `)}
 `, { mode: 420 });
   } catch (err) {
-    const hint = existsSync24(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    const hint = existsSync25(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
     console.warn(`[rig] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
   }
 }
 function writeClaudeProjectSettings(claudeHomeDir, workspaceDir, runtimeSettings) {
   const projectHash = hashProjectPath(workspaceDir);
-  const projectDir = resolve25(claudeHomeDir, "projects", projectHash);
-  mkdirSync11(projectDir, { recursive: true });
-  writeFileSync9(resolve25(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  const projectDir = resolve26(claudeHomeDir, "projects", projectHash);
+  mkdirSync12(projectDir, { recursive: true });
+  writeFileSync10(resolve26(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
 }
 async function loadRuntimeClaudeSettings(projectSettingsPath) {
-  if (!existsSync24(projectSettingsPath)) {
+  if (!existsSync25(projectSettingsPath)) {
     return {};
   }
   let parsed;
@@ -6166,7 +5986,7 @@ async function loadRuntimeClaudeSettings(projectSettingsPath) {
   return clone;
 }
 async function injectClaudeCredentials(claudeHomeDir, options = {}) {
-  const credentialsPath = resolve25(claudeHomeDir, ".credentials.json");
+  const credentialsPath = resolve26(claudeHomeDir, ".credentials.json");
   const platform = options.platform ?? process.platform;
   if (platform === "darwin") {
     const raw = options.loadKeychainCredentials ? await options.loadKeychainCredentials() : await (async () => {
@@ -6176,16 +5996,16 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
     if (raw) {
       try {
         JSON.parse(raw);
-        writeFileSync9(credentialsPath, raw, { mode: 384 });
+        writeFileSync10(credentialsPath, raw, { mode: 384 });
         registerCredentialCleanup(credentialsPath);
         return true;
       } catch {}
     }
   }
-  const hostClaudeHome = options.hostClaudeHome ? resolve25(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve25(process.env.CLAUDE_HOME) : process.env.HOME ? resolve25(process.env.HOME, ".claude") : "";
+  const hostClaudeHome = options.hostClaudeHome ? resolve26(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve26(process.env.CLAUDE_HOME) : process.env.HOME ? resolve26(process.env.HOME, ".claude") : "";
   if (hostClaudeHome) {
-    const realCredentials = resolve25(hostClaudeHome, ".credentials.json");
-    if (existsSync24(realCredentials)) {
+    const realCredentials = resolve26(hostClaudeHome, ".credentials.json");
+    if (existsSync25(realCredentials)) {
       cpSync2(realCredentials, credentialsPath);
       return true;
     }
@@ -6193,36 +6013,36 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
   return false;
 }
 async function injectCodexAuth(codexHomeDir) {
-  mkdirSync11(codexHomeDir, { recursive: true });
-  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve25(process.env.CODEX_HOME) : process.env.HOME ? resolve25(process.env.HOME, ".codex") : "";
+  mkdirSync12(codexHomeDir, { recursive: true });
+  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve26(process.env.CODEX_HOME) : process.env.HOME ? resolve26(process.env.HOME, ".codex") : "";
   if (!hostCodexHome) {
     return false;
   }
-  const hostAuthPath = resolve25(hostCodexHome, "auth.json");
-  if (!existsSync24(hostAuthPath)) {
+  const hostAuthPath = resolve26(hostCodexHome, "auth.json");
+  if (!existsSync25(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve25(codexHomeDir, "auth.json");
+  const runtimeAuthPath = resolve26(codexHomeDir, "auth.json");
   copyFileSync5(hostAuthPath, runtimeAuthPath);
   chmodSync5(runtimeAuthPath, 384);
   return true;
 }
 async function injectPiAgentConfig(piAgentDir) {
-  mkdirSync11(piAgentDir, { recursive: true });
-  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve25(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve25(process.env.HOME, ".pi", "agent") : "";
+  mkdirSync12(piAgentDir, { recursive: true });
+  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve26(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve26(process.env.HOME, ".pi", "agent") : "";
   if (!hostPiAgentDir) {
     return false;
   }
-  const hostAuthPath = resolve25(hostPiAgentDir, "auth.json");
-  if (!existsSync24(hostAuthPath)) {
+  const hostAuthPath = resolve26(hostPiAgentDir, "auth.json");
+  if (!existsSync25(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve25(piAgentDir, "auth.json");
+  const runtimeAuthPath = resolve26(piAgentDir, "auth.json");
   copyFileSync5(hostAuthPath, runtimeAuthPath);
   chmodSync5(runtimeAuthPath, 384);
-  const hostSettingsPath = resolve25(hostPiAgentDir, "settings.json");
-  if (existsSync24(hostSettingsPath)) {
-    const runtimeSettingsPath = resolve25(piAgentDir, "settings.json");
+  const hostSettingsPath = resolve26(hostPiAgentDir, "settings.json");
+  if (existsSync25(hostSettingsPath)) {
+    const runtimeSettingsPath = resolve26(piAgentDir, "settings.json");
     copyFileSync5(hostSettingsPath, runtimeSettingsPath);
     chmodSync5(runtimeSettingsPath, 384);
   }
@@ -6230,8 +6050,8 @@ async function injectPiAgentConfig(piAgentDir) {
 }
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, statSync as statSync6, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, statSync as statSync6, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve27 } from "path";
 var CLAUDE_ROUTER_SERVER_NAME = "rig_runtime_tools";
 var CLAUDE_DISABLED_FILE_TOOLS = [
   "Read",
@@ -6329,7 +6149,7 @@ function claudeRuntimeToolCliArgs(configPath) {
 function buildRuntimeToolRouterServerConfig(options) {
   return {
     type: "stdio",
-    command: resolve26(options.binDir, "rig-tool-router"),
+    command: resolve27(options.binDir, "rig-tool-router"),
     args: [],
     env: {
       RIG_RUNTIME_CONTEXT_FILE: options.contextFile,
@@ -6363,14 +6183,14 @@ function codexRuntimeToolCliArgs(options) {
   ];
 }
 function writeClaudeRuntimeToolRouterConfig(options) {
-  const configPath = resolve26(options.stateDir, "claude-runtime-tools.mcp.json");
-  mkdirSync12(options.stateDir, { recursive: true });
+  const configPath = resolve27(options.stateDir, "claude-runtime-tools.mcp.json");
+  mkdirSync13(options.stateDir, { recursive: true });
   const payload = {
     mcpServers: {
       [CLAUDE_ROUTER_SERVER_NAME]: buildRuntimeToolRouterServerConfig(options)
     }
   };
-  writeFileSync10(configPath, `${JSON.stringify(payload, null, 2)}
+  writeFileSync11(configPath, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
   return configPath;
 }
@@ -6457,7 +6277,7 @@ function resolveRuntimeToolBinary(toolName, env) {
     grep: "rig-grep"
   };
   const executable = mapping[toolName];
-  return executable ? resolve26(binDir, executable) : "";
+  return executable ? resolve27(binDir, executable) : "";
 }
 function renderToolText(toolName, payload) {
   if (toolName === "shell") {
@@ -6522,10 +6342,10 @@ async function invokeRuntimeShellTool(args, options = {}) {
       isError: true
     };
   }
-  const workspaceRoot = resolve26(invocationEnv.RIG_TASK_WORKSPACE?.trim() || process.cwd());
+  const workspaceRoot = resolve27(invocationEnv.RIG_TASK_WORKSPACE?.trim() || process.cwd());
   const requestedWorkdir = typeof args.workdir === "string" ? args.workdir.trim() : "";
   const workdir = requestedWorkdir ? resolveWithinWorkspace(workspaceRoot, requestedWorkdir) : workspaceRoot;
-  if (!existsSync25(workdir)) {
+  if (!existsSync26(workdir)) {
     return {
       content: [{
         type: "text",
@@ -6592,10 +6412,10 @@ async function invokeRuntimeShellTool(args, options = {}) {
 }
 function resolveRuntimeShellBinary(shellName, env) {
   const binDir = env.RIG_RUNTIME_BIN_DIR?.trim() || "";
-  return binDir ? resolve26(binDir, shellName) : "";
+  return binDir ? resolve27(binDir, shellName) : "";
 }
 function resolveWithinWorkspace(workspaceRoot, target) {
-  const resolvedTarget = resolve26(workspaceRoot, normalizeWorkspaceRelativeTarget(target));
+  const resolvedTarget = resolve27(workspaceRoot, normalizeWorkspaceRelativeTarget(target));
   const normalizedWorkspace = workspaceRoot.endsWith("/") ? workspaceRoot : `${workspaceRoot}/`;
   const normalizedTarget = resolvedTarget.endsWith("/") ? resolvedTarget : `${resolvedTarget}/`;
   if (resolvedTarget === workspaceRoot || normalizedTarget.startsWith(normalizedWorkspace)) {
@@ -6633,8 +6453,8 @@ if (false) {}
 init_layout();
 
 // packages/runtime/src/control-plane/runtime/isolation/worktree.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, rmSync as rmSync9 } from "fs";
-import { dirname as dirname11, resolve as resolve27 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, rmSync as rmSync10 } from "fs";
+import { dirname as dirname11, resolve as resolve28 } from "path";
 async function resolveMonorepoBaseRef(monorepoRoot) {
   const explicit = process.env.RIG_RUNTIME_BASE_REF?.trim();
   if (explicit) {
@@ -6670,12 +6490,12 @@ function ensureProvisioningHostProjectRootEnv(projectRoot) {
 }
 async function provisionRuntimeWorktree(config) {
   const branch = runtimeBranchName(config.taskId, config.runtimeId);
-  let hasValidWorktree = existsSync26(resolve27(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
-  if (existsSync26(config.workspaceDir) && !hasValidWorktree) {
-    rmSync9(config.workspaceDir, { recursive: true, force: true });
+  let hasValidWorktree = existsSync27(resolve28(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
+  if (existsSync27(config.workspaceDir) && !hasValidWorktree) {
+    rmSync10(config.workspaceDir, { recursive: true, force: true });
   }
   if (!hasValidWorktree) {
-    mkdirSync13(dirname11(config.workspaceDir), { recursive: true });
+    mkdirSync14(dirname11(config.workspaceDir), { recursive: true });
     const branchExists = await runGitCommand(config.monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
     const add = branchExists.exitCode === 0 ? await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", config.workspaceDir, branch]) : await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", "-b", branch, config.workspaceDir, config.baseRef]);
     if (add.exitCode !== 0) {
@@ -6851,31 +6671,31 @@ async function preferredBaseRemotes(repoRoot) {
 
 // packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
 import {
-  existsSync as existsSync28,
+  existsSync as existsSync29,
   lstatSync,
-  mkdirSync as mkdirSync15,
-  readdirSync as readdirSync5,
-  readFileSync as readFileSync13,
-  rmSync as rmSync10,
+  mkdirSync as mkdirSync16,
+  readdirSync as readdirSync6,
+  readFileSync as readFileSync14,
+  rmSync as rmSync11,
   statSync as statSync8,
   symlinkSync as symlinkSync4
 } from "fs";
 import { mkdir as mkdir2, writeFile } from "fs/promises";
-import { dirname as dirname13, resolve as resolve29 } from "path";
+import { dirname as dirname13, resolve as resolve30 } from "path";
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router-binary.ts
-import { chmodSync as chmodSync6, copyFileSync as copyFileSync6, existsSync as existsSync27, mkdirSync as mkdirSync14, statSync as statSync7 } from "fs";
+import { chmodSync as chmodSync6, copyFileSync as copyFileSync6, existsSync as existsSync28, mkdirSync as mkdirSync15, statSync as statSync7 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { dirname as dirname12, resolve as resolve28 } from "path";
-var sharedRouterOutputDir = resolve28(tmpdir6(), "rig-native");
-var sharedRouterOutputPath = resolve28(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+import { dirname as dirname12, resolve as resolve29 } from "path";
+var sharedRouterOutputDir = resolve29(tmpdir6(), "rig-native");
+var sharedRouterOutputPath = resolve29(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 function runtimeClaudeToolRouterFileName() {
   return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
 }
 async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
-  const sourcePath = resolve28(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
-  mkdirSync14(dirname12(outputPath), { recursive: true });
-  const needsBuild = !existsSync27(outputPath) || statSync7(sourcePath).mtimeMs > statSync7(outputPath).mtimeMs;
+  const sourcePath = resolve29(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
+  mkdirSync15(dirname12(outputPath), { recursive: true });
+  const needsBuild = !existsSync28(outputPath) || statSync7(sourcePath).mtimeMs > statSync7(outputPath).mtimeMs;
   if (!needsBuild) {
     return outputPath;
   }
@@ -6889,9 +6709,9 @@ async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = shared
 }
 async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
   const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
-  const targetPath = resolve28(targetDir, runtimeClaudeToolRouterFileName());
-  mkdirSync14(targetDir, { recursive: true });
-  const needsCopy = !existsSync27(targetPath) || statSync7(sourcePath).mtimeMs > statSync7(targetPath).mtimeMs;
+  const targetPath = resolve29(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync15(targetDir, { recursive: true });
+  const needsCopy = !existsSync28(targetPath) || statSync7(sourcePath).mtimeMs > statSync7(targetPath).mtimeMs;
   if (needsCopy) {
     copyFileSync6(sourcePath, targetPath);
     chmodSync6(targetPath, 493);
@@ -6904,48 +6724,48 @@ var GIT_INDEX_LOCK_RETRY_DELAY_MS = 250;
 var GIT_INDEX_LOCK_STALE_AFTER_MS = 5000;
 function resolveRigSourceRoot(projectRoot) {
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot && existsSync28(resolve29(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
+  if (hostProjectRoot && existsSync29(resolve30(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
     return hostProjectRoot;
   }
-  const fromModule = resolve29(import.meta.dir, "../../../../../..");
-  if (existsSync28(resolve29(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
+  const fromModule = resolve30(import.meta.dir, "../../../../../..");
+  if (existsSync29(resolve30(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
     return fromModule;
   }
   return projectRoot;
 }
 function prepareTrackedRuntimePaths(logsDir, stateDir, sessionDir) {
-  for (const path of [logsDir, stateDir, sessionDir, resolve29(sessionDir, "session.json")]) {
+  for (const path of [logsDir, stateDir, sessionDir, resolve30(sessionDir, "session.json")]) {
     removeSymbolicLink(path);
   }
   runtimePrepareTrackedPathsNative({
     logsDir,
     stateDir,
     sessionDir,
-    controlledBashLogFile: resolve29(logsDir, "controlled-bash.jsonl"),
-    eventsFile: resolve29(logsDir, "control-plane.events.jsonl")
+    controlledBashLogFile: resolve30(logsDir, "controlled-bash.jsonl"),
+    eventsFile: resolve30(logsDir, "control-plane.events.jsonl")
   });
 }
 async function initializeRuntimeStateFiles(stateDir, sessionDir, taskId) {
   await mkdir2(stateDir, { recursive: true });
   await mkdir2(sessionDir, { recursive: true });
-  const failedApproachesPath = resolve29(stateDir, "failed_approaches.md");
-  if (!existsSync28(failedApproachesPath)) {
+  const failedApproachesPath = resolve30(stateDir, "failed_approaches.md");
+  if (!existsSync29(failedApproachesPath)) {
     await writeFile(failedApproachesPath, `# Failed Approaches
 
 `);
   }
-  const hookTripsPath = resolve29(stateDir, "hook_trips.log");
-  if (!existsSync28(hookTripsPath)) {
+  const hookTripsPath = resolve30(stateDir, "hook_trips.log");
+  if (!existsSync29(hookTripsPath)) {
     await writeFile(hookTripsPath, "");
   }
-  const sessionFile = resolve29(sessionDir, "session.json");
+  const sessionFile = resolve30(sessionDir, "session.json");
   if (taskId) {
     await writeFile(sessionFile, JSON.stringify({ activeTaskIds: [taskId] }));
   }
 }
 async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
-  const artifactDir = resolve29(workspaceDir, "artifacts", taskId);
-  const runtimeSnapshotDir = resolve29(artifactDir, "runtime-snapshots");
+  const artifactDir = resolve30(workspaceDir, "artifacts", taskId);
+  const runtimeSnapshotDir = resolve30(artifactDir, "runtime-snapshots");
   let preservedTrackedFiles = false;
   for (const file of [
     "changed-files.txt",
@@ -6961,13 +6781,13 @@ async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
       preservedTrackedFiles = true;
       continue;
     }
-    rmSync10(resolve29(artifactDir, file), { force: true });
+    rmSync11(resolve30(artifactDir, file), { force: true });
   }
   const runtimeSnapshotRelativePath = `artifacts/${taskId}/runtime-snapshots`;
   if (await resetTrackedArtifactPath(workspaceDir, runtimeSnapshotRelativePath)) {
     preservedTrackedFiles = true;
   } else {
-    rmSync10(runtimeSnapshotDir, { recursive: true, force: true });
+    rmSync11(runtimeSnapshotDir, { recursive: true, force: true });
   }
   if (preservedTrackedFiles) {
     console.log(`[rig-agent] Preserved tracked runtime artifact files in ${taskId}; skipped ephemeral cleanup for committed paths.`);
@@ -7000,28 +6820,28 @@ async function buildRuntimeToolchain(options) {
     throw new Error("Failed to provision the native Zig runtime library.");
   }
   const rigSourceRoot = resolveRigSourceRoot(options.projectRoot);
-  await buildBinary("packages/cli/bin/rig.ts", resolve29(options.binDir, "rig"), rigSourceRoot);
-  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve29(options.binDir, "rig-agent"), rigSourceRoot, {
+  await buildBinary("packages/cli/bin/rig.ts", resolve30(options.binDir, "rig"), rigSourceRoot);
+  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve30(options.binDir, "rig-agent"), rigSourceRoot, {
     ...options.runtimeSecretDefines,
     AGENT_TASK_ID: options.taskId,
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_RUNTIME_ID: options.runtimeId,
     AGENT_SCOPE_HASH: options.bakedScopeHash,
     AGENT_MANIFEST_PATH: options.manifestPath,
-    AGENT_BINARY_PATH: resolve29(options.binDir, "rig-agent"),
+    AGENT_BINARY_PATH: resolve30(options.binDir, "rig-agent"),
     AGENT_INFO_OUTPUT: options.bakedInfoOutput,
     AGENT_DEPS_OUTPUT: options.bakedDepsOutput,
     AGENT_STATUS_OUTPUT: options.bakedStatusOutput
   });
-  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve29(options.binDir, "controlled-bash"), rigSourceRoot, {
+  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve30(options.binDir, "controlled-bash"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_LOGS_DIR: options.logsDir,
     AGENT_MONOREPO_ROOT: resolveMonorepoRoot3(options.projectRoot),
-    AGENT_TS_API_TESTS_DIR: resolve29(options.workspaceDir, "TSAPITests"),
-    AGENT_RIG_AGENT_BIN: resolve29(options.binDir, "rig-agent")
+    AGENT_TS_API_TESTS_DIR: resolve30(options.workspaceDir, "TSAPITests"),
+    AGENT_RIG_AGENT_BIN: resolve30(options.binDir, "rig-agent")
   });
-  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve29(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
-  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve29(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
+  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve30(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
+  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve30(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_BUN_PATH: resolveBunBinaryPath()
   });
@@ -7030,15 +6850,15 @@ async function buildRuntimeToolchain(options) {
     AGENT_BUN_PATH: resolveBunBinaryPath()
   };
   for (const hookName of hookNames) {
-    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve29(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
+    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve30(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
   }
-  const pluginsDir = resolve29(options.projectRoot, "rig/plugins");
-  if (existsSync28(pluginsDir)) {
-    for (const entry of readdirSync5(pluginsDir, { withFileTypes: true })) {
+  const pluginsDir = resolve30(options.projectRoot, "rig/plugins");
+  if (existsSync29(pluginsDir)) {
+    for (const entry of readdirSync6(pluginsDir, { withFileTypes: true })) {
       const match = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
       if (!match)
         continue;
-      await buildBinary(`rig/plugins/${entry.name}`, resolve29(runtimeBins.pluginsDir, match[1]), options.projectRoot);
+      await buildBinary(`rig/plugins/${entry.name}`, resolve30(runtimeBins.pluginsDir, match[1]), options.projectRoot);
     }
   }
   await materializeRigGitBinary(options.binDir);
@@ -7048,8 +6868,8 @@ async function buildRuntimeToolchain(options) {
 }
 async function writeRuntimeManifest(config) {
   const scopeHash = sha256Hex(JSON.stringify(config.scopes));
-  const binarySha256 = sha256Hex(readFileSync13(config.binaryPath));
-  const manifestPath = resolve29(config.runtimeRoot, "manifest.json");
+  const binarySha256 = sha256Hex(readFileSync14(config.binaryPath));
+  const manifestPath = resolve30(config.runtimeRoot, "manifest.json");
   const manifest = {
     runtimeId: config.runtimeId,
     taskId: config.taskId,
@@ -7083,7 +6903,7 @@ function removeSymbolicLink(path) {
   } catch {
     return;
   }
-  rmSync10(path, { force: true, recursive: true });
+  rmSync11(path, { force: true, recursive: true });
 }
 async function resetTrackedArtifactPath(workspaceDir, relativePath) {
   const tracked = await runGitLsFiles(workspaceDir, relativePath);
@@ -7109,7 +6929,7 @@ async function restoreTrackedArtifactPathWithRetry(workspaceDir, relativePath, r
   const retryDelayMs = options.retryDelayMs ?? GIT_INDEX_LOCK_RETRY_DELAY_MS;
   const now = options.now ?? Date.now;
   const statMtimeMs = options.statMtimeMs ?? readFileMtimeMs;
-  const removeFile = options.removeFile ?? ((path) => rmSync10(path, { force: true }));
+  const removeFile = options.removeFile ?? ((path) => rmSync11(path, { force: true }));
   const log = options.log ?? console.warn;
   let lastOutput = "";
   for (let attempt = 0;attempt <= maxRetries; attempt += 1) {
@@ -7169,31 +6989,31 @@ function readFileMtimeMs(path) {
 }
 function linkRuntimeDependencyLayers(monorepoRoot, workspaceDir) {
   linkGenericNodeModulesLayers(monorepoRoot, workspaceDir);
-  const sourceNodeModules = resolve29(monorepoRoot, "humoongate", "node_modules");
-  if (!existsSync28(sourceNodeModules)) {} else {
-    const runtimeHumoongate = resolve29(workspaceDir, "humoongate");
-    if (existsSync28(resolve29(runtimeHumoongate, "package.json"))) {
-      const targetNodeModules = resolve29(runtimeHumoongate, "node_modules");
+  const sourceNodeModules = resolve30(monorepoRoot, "humoongate", "node_modules");
+  if (!existsSync29(sourceNodeModules)) {} else {
+    const runtimeHumoongate = resolve30(workspaceDir, "humoongate");
+    if (existsSync29(resolve30(runtimeHumoongate, "package.json"))) {
+      const targetNodeModules = resolve30(runtimeHumoongate, "node_modules");
       runtimeLinkDependencyLayerNative(sourceNodeModules, targetNodeModules);
     }
   }
-  const runtimeHpNext = resolve29(workspaceDir, "microservices", "hp-next-frontend", "app");
-  if (!existsSync28(resolve29(runtimeHpNext, "package.json"))) {
+  const runtimeHpNext = resolve30(workspaceDir, "microservices", "hp-next-frontend", "app");
+  if (!existsSync29(resolve30(runtimeHpNext, "package.json"))) {
     return;
   }
-  const sourceHpNextNodeModules = resolve29(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
-  const sourceMonorepoNodeModules = resolve29(monorepoRoot, "node_modules");
-  const targetHpNextNodeModules = resolve29(runtimeHpNext, "node_modules");
-  if (existsSync28(sourceHpNextNodeModules)) {
+  const sourceHpNextNodeModules = resolve30(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
+  const sourceMonorepoNodeModules = resolve30(monorepoRoot, "node_modules");
+  const targetHpNextNodeModules = resolve30(runtimeHpNext, "node_modules");
+  if (existsSync29(sourceHpNextNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceHpNextNodeModules, targetHpNextNodeModules);
     return;
   }
-  if (existsSync28(sourceMonorepoNodeModules)) {
+  if (existsSync29(sourceMonorepoNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceMonorepoNodeModules, targetHpNextNodeModules);
   }
 }
 function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
-  linkNodeModulesLayer(resolve29(monorepoRoot, "node_modules"), resolve29(workspaceDir, "node_modules"));
+  linkNodeModulesLayer(resolve30(monorepoRoot, "node_modules"), resolve30(workspaceDir, "node_modules"));
   for (const relativePackageDir of [
     "apps/native-app/apps/marketing",
     "apps/native-app/apps/web",
@@ -7215,15 +7035,15 @@ function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
     "packages/standard-plugin",
     "packages/validator-kit"
   ]) {
-    const workspacePackageDir = resolve29(workspaceDir, relativePackageDir);
-    if (!existsSync28(resolve29(workspacePackageDir, "package.json"))) {
+    const workspacePackageDir = resolve30(workspaceDir, relativePackageDir);
+    if (!existsSync29(resolve30(workspacePackageDir, "package.json"))) {
       continue;
     }
-    linkNodeModulesLayer(resolve29(monorepoRoot, relativePackageDir, "node_modules"), resolve29(workspacePackageDir, "node_modules"));
+    linkNodeModulesLayer(resolve30(monorepoRoot, relativePackageDir, "node_modules"), resolve30(workspacePackageDir, "node_modules"));
   }
 }
 function linkNodeModulesLayer(sourceDir, targetDir) {
-  if (!existsSync28(sourceDir) || existsSync28(targetDir)) {
+  if (!existsSync29(sourceDir) || existsSync29(targetDir)) {
     return;
   }
   try {
@@ -7232,30 +7052,30 @@ function linkNodeModulesLayer(sourceDir, targetDir) {
   } catch (error) {
     console.warn(`[rig-agent] Native dependency-layer linking failed for ${targetDir}; using symlink fallback: ${error instanceof Error ? error.message : String(error)}`);
   }
-  mkdirSync15(dirname13(targetDir), { recursive: true });
+  mkdirSync16(dirname13(targetDir), { recursive: true });
   symlinkSync4(sourceDir, targetDir, "dir");
 }
 function ensureRuntimeBinTrees(runtimeBinDir) {
-  const hooksDir = resolve29(runtimeBinDir, "hooks");
-  const pluginsDir = resolve29(runtimeBinDir, "plugins");
-  const validatorsDir = resolve29(runtimeBinDir, "validators");
-  mkdirSync15(hooksDir, { recursive: true });
-  mkdirSync15(pluginsDir, { recursive: true });
-  mkdirSync15(validatorsDir, { recursive: true });
+  const hooksDir = resolve30(runtimeBinDir, "hooks");
+  const pluginsDir = resolve30(runtimeBinDir, "plugins");
+  const validatorsDir = resolve30(runtimeBinDir, "validators");
+  mkdirSync16(hooksDir, { recursive: true });
+  mkdirSync16(pluginsDir, { recursive: true });
+  mkdirSync16(validatorsDir, { recursive: true });
   return { hooksDir, pluginsDir, validatorsDir };
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/runner.ts
-import { existsSync as existsSync31, rmSync as rmSync11, writeFileSync as writeFileSync12 } from "fs";
-import { basename as basename9, resolve as resolve33 } from "path";
+import { existsSync as existsSync32, rmSync as rmSync12, writeFileSync as writeFileSync13 } from "fs";
+import { basename as basename9, resolve as resolve34 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/backend.ts
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 
 // packages/runtime/src/control-plane/runtime/guard.ts
 import { optimizeNextInvocation } from "bun:jsc";
-import { existsSync as existsSync29, readFileSync as readFileSync14, statSync as statSync9 } from "fs";
-import { resolve as resolve30 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync15, statSync as statSync9 } from "fs";
+import { resolve as resolve31 } from "path";
 
 // packages/runtime/src/control-plane/runtime/guard-types.ts
 var POLICY_VERSION = 1;
@@ -7318,8 +7138,8 @@ function loadPolicy(projectRoot) {
   if (seededPolicyConfig) {
     return seededPolicyConfig;
   }
-  const configPath = resolve30(projectRoot, "rig/policy/policy.json");
-  if (!existsSync29(configPath)) {
+  const configPath = resolve31(projectRoot, "rig/policy/policy.json");
+  if (!existsSync30(configPath)) {
     return defaultPolicy();
   }
   let mtimeMs;
@@ -7333,7 +7153,7 @@ function loadPolicy(projectRoot) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(configPath, "utf-8"));
+    parsed = JSON.parse(readFileSync15(configPath, "utf-8"));
   } catch {
     return defaultPolicy();
   }
@@ -7549,28 +7369,28 @@ function resolveAction(mode, matched) {
 }
 function resolveAbsolutePath(projectRoot, rawPath) {
   if (rawPath.startsWith("/"))
-    return resolve30(rawPath);
-  return resolve30(projectRoot, rawPath);
+    return resolve31(rawPath);
+  return resolve31(projectRoot, rawPath);
 }
 function isHarnessPath(projectRoot, rawPath) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   const managedRoots = [
-    resolve30(projectRoot, "rig"),
-    resolve30(projectRoot, ".rig"),
-    resolve30(projectRoot, "artifacts")
+    resolve31(projectRoot, "rig"),
+    resolve31(projectRoot, ".rig"),
+    resolve31(projectRoot, "artifacts")
   ];
   return managedRoots.some((root) => absPath === root || absPath.startsWith(root + "/"));
 }
 function isRuntimePath(projectRoot, rawPath, taskWorkspace) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   if (taskWorkspace) {
-    const workspaceRigRoot = resolve30(taskWorkspace, ".rig");
-    const workspaceArtifactsRoot = resolve30(taskWorkspace, "artifacts");
+    const workspaceRigRoot = resolve31(taskWorkspace, ".rig");
+    const workspaceArtifactsRoot = resolve31(taskWorkspace, "artifacts");
     if (absPath === workspaceRigRoot || absPath.startsWith(workspaceRigRoot + "/") || absPath === workspaceArtifactsRoot || absPath.startsWith(workspaceArtifactsRoot + "/")) {
       return true;
     }
   }
-  const runtimeRoot = resolve30(projectRoot, ".rig/runtime/agents");
+  const runtimeRoot = resolve31(projectRoot, ".rig/runtime/agents");
   return absPath === runtimeRoot || absPath.startsWith(runtimeRoot + "/");
 }
 function isTestFile(path) {
@@ -7618,7 +7438,7 @@ function evaluateScope(policy, context, filePath, access) {
     return allowed();
   }
   if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith("/")) {
-    const absPath = resolve30(filePath);
+    const absPath = resolve31(filePath);
     if (!absPath.startsWith(context.taskWorkspace + "/") && !isHarnessPath(context.projectRoot, filePath)) {
       const reason2 = `Absolute path '${filePath}' is outside task runtime boundary. Allowed root: ${context.taskWorkspace}`;
       const matched2 = [{ id: "scope:workspace-boundary", category: "command", reason: reason2 }];
@@ -7946,13 +7766,13 @@ async function resolveBackend(projectRoot, options) {
     depRoots
   };
   const fsContext = {
-    pathExists: (p) => existsSync30(p),
+    pathExists: (p) => existsSync31(p),
     realPath: toRealPath
   };
   if (process.platform === "darwin" && (!requestedBackend || requestedBackend === "macos-seatbelt")) {
     const seatbelt = Bun.which("sandbox-exec");
     probed.push("sandbox-exec");
-    if (seatbelt && existsSync30(seatbelt)) {
+    if (seatbelt && existsSync31(seatbelt)) {
       const SeatbeltBackendClass = loadSeatbeltBackend();
       if (SeatbeltBackendClass) {
         return {
@@ -8073,10 +7893,10 @@ init_layout();
 var SNAPSHOT_SIDECAR_READY_TIMEOUT_MS = 1e4;
 async function startRuntimeSnapshotSidecar(runtime, options = {}) {
   const instanceId = sanitizeRuntimeRefSegment(options.instanceId?.trim() || runtime.id);
-  const readyFile = resolve33(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.ready`);
-  const requestFile = resolve33(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.request.json`);
-  rmSync11(readyFile, { force: true });
-  rmSync11(requestFile, { force: true });
+  const readyFile = resolve34(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.ready`);
+  const requestFile = resolve34(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.request.json`);
+  rmSync12(readyFile, { force: true });
+  rmSync12(requestFile, { force: true });
   const sidecarBinary = resolveSnapshotSidecarBinaryPath(runtime.binDir);
   const useCompiledSidecar = shouldUseCompiledSnapshotSidecar(sidecarBinary);
   const bunCli = useCompiledSidecar ? null : resolveBunCliInvocation();
@@ -8114,19 +7934,19 @@ async function startRuntimeSnapshotSidecar(runtime, options = {}) {
         proc.kill("SIGTERM");
       } catch {}
       await proc.exited;
-      rmSync11(readyFile, { force: true });
-      rmSync11(requestFile, { force: true });
+      rmSync12(readyFile, { force: true });
+      rmSync12(requestFile, { force: true });
     },
     finalize: async (commandParts, exitCode) => {
-      writeFileSync12(requestFile, `${JSON.stringify({ command: commandParts, exitCode })}
+      writeFileSync13(requestFile, `${JSON.stringify({ command: commandParts, exitCode })}
 `, "utf-8");
       const [sidecarExitCode, stdout, stderr] = await Promise.all([
         proc.exited,
         stdoutTextPromise,
         stderrTextPromise
       ]);
-      rmSync11(readyFile, { force: true });
-      rmSync11(requestFile, { force: true });
+      rmSync12(readyFile, { force: true });
+      rmSync12(requestFile, { force: true });
       if (sidecarExitCode !== 0) {
         throw new Error(`snapshot sidecar failed (${sidecarExitCode}): ${stderr || stdout}`);
       }
@@ -8146,10 +7966,10 @@ function resolveSnapshotSidecarScriptPath() {
   return resolveRuntimeSourceScriptPath("snapshot-sidecar.ts");
 }
 function resolveSnapshotSidecarBinaryPath(binDir) {
-  return resolve33(binDir, "snapshot-sidecar");
+  return resolve34(binDir, "snapshot-sidecar");
 }
 function shouldUseCompiledSnapshotSidecar(binaryPath) {
-  if (!existsSync31(binaryPath)) {
+  if (!existsSync32(binaryPath)) {
     return false;
   }
   const preference = process.env.RIG_USE_COMPILED_SNAPSHOT_SIDECAR?.trim().toLowerCase();
@@ -8164,12 +7984,12 @@ function resolveRuntimeSourceScriptPath(fileName) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter((value) => Boolean(value));
   for (const root of hostRoots) {
-    const candidate = resolve33(root, "packages/runtime/src/control-plane/runtime", fileName);
-    if (existsSync31(candidate)) {
+    const candidate = resolve34(root, "packages/runtime/src/control-plane/runtime", fileName);
+    if (existsSync32(candidate)) {
       return candidate;
     }
   }
-  return resolve33(import.meta.dir, "..", fileName);
+  return resolve34(import.meta.dir, "..", fileName);
 }
 function resolveBunCliInvocation() {
   if (process.env.RIG_BUN_PATH?.trim()) {
@@ -8196,7 +8016,7 @@ function resolveBunCliInvocation() {
 async function waitForSnapshotSidecarReady(readyFile, proc, stdoutTextPromise, stderrTextPromise) {
   const deadline = Date.now() + SNAPSHOT_SIDECAR_READY_TIMEOUT_MS;
   while (Date.now() < deadline) {
-    if (existsSync31(readyFile)) {
+    if (existsSync32(readyFile)) {
       return;
     }
     const exitCode = proc.exitCode;
@@ -8214,9 +8034,9 @@ var CANONICAL_MEMORY_DB_PATH2 = "rig/memory/project-memory.db";
 async function hydrateRuntimeMemory(options) {
   const snapshot = await readCanonicalMemoryDb(options.projectRoot);
   const workspaceLayout = resolveRuntimeWorkspaceLayout(options.workspaceDir);
-  const hydratedPath = resolve34(workspaceLayout.stateDir, "memory", "project-memory.db");
+  const hydratedPath = resolve35(workspaceLayout.stateDir, "memory", "project-memory.db");
   try {
-    await mkdir3(resolve34(workspaceLayout.stateDir, "memory"), { recursive: true });
+    await mkdir3(resolve35(workspaceLayout.stateDir, "memory"), { recursive: true });
     await copyFile(snapshot.dbPath, hydratedPath);
     return {
       canonicalPath: CANONICAL_MEMORY_DB_PATH2,
@@ -8231,12 +8051,12 @@ async function hydrateRuntimeMemory(options) {
   }
 }
 async function createRuntimeTaskRecordReader(options) {
-  const legacyConfigPath = resolve34(options.projectRoot, ".rig", "task-config.json");
+  const legacyConfigPath = resolve35(options.projectRoot, ".rig", "task-config.json");
   let pluginHostContext = null;
   try {
     pluginHostContext = await buildPluginHostContext(options.projectRoot);
   } catch (error) {
-    if (!existsSync32(legacyConfigPath)) {
+    if (!existsSync33(legacyConfigPath)) {
       throw error;
     }
     const message = `Plugin task source unavailable; using source-aware .rig/task-config.json compatibility path: ${error instanceof Error ? error.message : String(error)}`;
@@ -8256,7 +8076,7 @@ async function createRuntimeTaskRecordReader(options) {
       source: "plugin"
     };
   }
-  if (existsSync32(legacyConfigPath)) {
+  if (existsSync33(legacyConfigPath)) {
     const message = "Using source-aware .rig/task-config.json task source compatibility path";
     options.diagnostics?.(message);
     console.warn(message);
@@ -8273,10 +8093,10 @@ async function createRuntimeTaskRecordReader(options) {
   };
 }
 function readConfiguredTaskSourceKindHint(projectRoot) {
-  const jsonPath = resolve34(projectRoot, "rig.config.json");
-  if (existsSync32(jsonPath)) {
+  const jsonPath = resolve35(projectRoot, "rig.config.json");
+  if (existsSync33(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync15(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync16(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -8288,12 +8108,12 @@ function readConfiguredTaskSourceKindHint(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve34(projectRoot, "rig.config.ts");
-  if (!existsSync32(tsPath)) {
+  const tsPath = resolve35(projectRoot, "rig.config.ts");
+  if (!existsSync33(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync15(tsPath, "utf8");
+    const source = readFileSync16(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     return kind ?? null;
@@ -8363,8 +8183,8 @@ async function writeRuntimeTaskConfigProjection(options) {
     ...options.taskEntry.validation && options.taskEntry.validation.length > 0 ? { validation: options.taskEntry.validation } : {},
     ...options.taskEntry.browser ? { browser: options.taskEntry.browser } : {}
   };
-  const configPath = resolve34(options.workspaceDir, ".rig", "task-config.json");
-  await mkdir3(resolve34(options.workspaceDir, ".rig"), { recursive: true });
+  const configPath = resolve35(options.workspaceDir, ".rig", "task-config.json");
+  await mkdir3(resolve35(options.workspaceDir, ".rig"), { recursive: true });
   await writeFile2(configPath, `${JSON.stringify({ [options.task.id]: entry }, null, 2)}
 `, "utf-8");
 }
@@ -8428,9 +8248,9 @@ async function ensureAgentRuntime(options) {
   }
   ensureProvisioningHostProjectRootEnv(options.projectRoot);
   const monorepoRoot = resolveMonorepoRoot3(options.projectRoot);
-  const workspaceDir = resolve34(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
+  const workspaceDir = resolve35(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
   const createdAt = new Date().toISOString();
-  if (!existsSync32(resolve34(monorepoRoot, ".git"))) {
+  if (!existsSync33(resolve35(monorepoRoot, ".git"))) {
     throw new Error(`Monorepo root is not a git checkout: ${monorepoRoot}`);
   }
   const taskResolution = await resolveRuntimeTaskRecord({
@@ -8465,7 +8285,7 @@ async function ensureAgentRuntime(options) {
     logsDir: overlay.logsDir,
     stateDir: overlay.stateDir,
     sessionDir: overlay.sessionDir,
-    claudeHomeDir: resolve34(workspaceLayout.homeDir, ".claude"),
+    claudeHomeDir: resolve35(workspaceLayout.homeDir, ".claude"),
     contextFile: overlay.contextPath,
     binDir: workspaceLayout.binDir,
     createdAt
@@ -8478,10 +8298,14 @@ async function ensureAgentRuntime(options) {
     projectRoot: options.projectRoot,
     workspaceDir
   });
-  mkdirSync18(runtime.binDir, { recursive: true });
-  mkdirSync18(workspaceLayout.distDir, { recursive: true });
+  mkdirSync19(runtime.binDir, { recursive: true });
+  mkdirSync19(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,
@@ -8494,7 +8318,7 @@ async function ensureAgentRuntime(options) {
       runtimeId: options.id
     }),
     workspaceDir,
-    artifactRoot: resolve34(workspaceDir, "artifacts", options.taskId),
+    artifactRoot: resolve35(workspaceDir, "artifacts", options.taskId),
     hostProjectRoot: options.projectRoot,
     monorepoMainRoot: monorepoRoot,
     monorepoBaseRef: baseRef,
@@ -8510,8 +8334,8 @@ async function ensureAgentRuntime(options) {
     stateDir: overlay.stateDir,
     logsDir: overlay.logsDir,
     sessionDir: overlay.sessionDir,
-    sessionFile: resolve34(overlay.sessionDir, "session.json"),
-    policyFile: resolve34(options.projectRoot, "rig/policy/policy.json"),
+    sessionFile: resolve35(overlay.sessionDir, "session.json"),
+    policyFile: resolve35(options.projectRoot, "rig/policy/policy.json"),
     binDir: runtime.binDir,
     createdAt,
     memory
@@ -8522,9 +8346,9 @@ async function ensureAgentRuntime(options) {
     task: taskResolution.task,
     taskEntry
   });
-  const manifestPath = resolve34(runtimeRoot, "manifest.json");
+  const manifestPath = resolve35(runtimeRoot, "manifest.json");
   const bakedScopeHash = sha256Hex(JSON.stringify(taskEntry.scope || []));
-  const runtimeAgentBinary = resolve34(runtime.binDir, "rig-agent");
+  const runtimeAgentBinary = resolve35(runtime.binDir, "rig-agent");
   await ensureRigGitBinaryPath();
   const bakedInfoOutput = await captureTaskInfoOutput({
     projectRoot: options.projectRoot,
@@ -8539,10 +8363,10 @@ async function ensureAgentRuntime(options) {
   const bakedStatusOutput = await captureStdout(async () => {
     taskStatus(options.projectRoot);
   });
-  rmSync12(runtime.binDir, { recursive: true, force: true });
-  rmSync12(workspaceLayout.distDir, { recursive: true, force: true });
-  mkdirSync18(runtime.binDir, { recursive: true });
-  mkdirSync18(workspaceLayout.distDir, { recursive: true });
+  rmSync13(runtime.binDir, { recursive: true, force: true });
+  rmSync13(workspaceLayout.distDir, { recursive: true, force: true });
+  mkdirSync19(runtime.binDir, { recursive: true });
+  mkdirSync19(workspaceLayout.distDir, { recursive: true });
   await buildRuntimeToolchain({
     projectRoot: options.projectRoot,
     workspaceDir,
@@ -8579,9 +8403,9 @@ async function ensureAgentRuntime(options) {
     workspaceDir,
     taskEntry
   });
-  const sandboxDir = resolve34(runtimeRoot, "sandbox");
+  const sandboxDir = resolve35(runtimeRoot, "sandbox");
   await mkdir3(sandboxDir, { recursive: true });
-  await writeFile2(resolve34(runtimeRoot, "runtime.json"), JSON.stringify({
+  await writeFile2(resolve35(runtimeRoot, "runtime.json"), JSON.stringify({
     id: options.id,
     taskId: options.taskId,
     mode: "worktree",
@@ -8688,8 +8512,8 @@ async function runCodexAppServerTaskRun(options) {
   const sendRequest = async (method, params) => {
     const id = nextRequestId;
     nextRequestId += 1;
-    const resultPromise = new Promise((resolve35, reject) => {
-      pendingResponses.set(id, { resolve: resolve35, reject });
+    const resultPromise = new Promise((resolve36, reject) => {
+      pendingResponses.set(id, { resolve: resolve36, reject });
     });
     await sendMessage({ id, method, params });
     return resultPromise;
@@ -8888,8 +8712,8 @@ async function runCodexAppServerTaskRun(options) {
       console.error(line);
     }
   });
-  const exitPromise = new Promise((resolve35) => {
-    child.once("close", (code, signal) => resolve35({ code, signal }));
+  const exitPromise = new Promise((resolve36) => {
+    child.once("close", (code, signal) => resolve36({ code, signal }));
   });
   await sendRequest("initialize", {
     clientInfo: DEFAULT_CLIENT_INFO,
@@ -8930,7 +8754,7 @@ async function runCodexAppServerTaskRun(options) {
   while (!completionState.current) {
     exitResult = await Promise.race([
       exitPromise,
-      new Promise((resolve35) => setTimeout(() => resolve35(null), 100))
+      new Promise((resolve36) => setTimeout(() => resolve36(null), 100))
     ]);
     if (exitResult) {
       break;
@@ -9079,13 +8903,13 @@ function sanitizeEnv(env) {
   return next;
 }
 function writeChildLine(child, line) {
-  return new Promise((resolve35, reject) => {
+  return new Promise((resolve36, reject) => {
     child.stdin.write(line, (error) => {
       if (error) {
         reject(error);
         return;
       }
-      resolve35();
+      resolve36();
     });
   });
 }
@@ -9131,7 +8955,175 @@ function formatJsonRpcError(error) {
   return parts.join(" ");
 }
 
+// packages/runtime/src/control-plane/pi-sessiond/launcher.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync34, mkdirSync as mkdirSync20, readFileSync as readFileSync17, rmSync as rmSync14 } from "fs";
+import { dirname as dirname14, resolve as resolve36 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// packages/runtime/src/control-plane/pi-sessiond/client.ts
+class RigPiSessionDaemonClient {
+  baseUrl;
+  token;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.token = options.token;
+  }
+  static fromConnection(connection, token) {
+    if (connection.mode === "http")
+      return new RigPiSessionDaemonClient({ baseUrl: connection.baseUrl, token });
+    throw new Error("Unix-socket Rig Pi daemon connections are not implemented in this build; use loopback HTTP.");
+  }
+  async request(method, path, body) {
+    const response = await fetch(`${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${this.token}`,
+        ...body === undefined ? {} : { "content-type": "application/json" }
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    const text = await response.text();
+    const payload = text.trim() ? JSON.parse(text) : undefined;
+    if (!response.ok) {
+      const message = payload && typeof payload === "object" && !Array.isArray(payload) && typeof payload.error === "string" ? payload.error : text || response.statusText;
+      throw new Error(`Rig Pi session daemon request failed (${response.status}): ${message}`);
+    }
+    return payload;
+  }
+  webSocketUrl(path) {
+    const url = new URL(`${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`);
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    url.searchParams.set("token", this.token);
+    return url.toString();
+  }
+}
+
+// packages/runtime/src/control-plane/pi-sessiond/launcher.ts
+var BUILD_CONFIG2 = {};
+var BAKED_RIG_SOURCE_ROOT = BUILD_CONFIG2.RIG_SOURCE_ROOT ?? "";
+async function ensureRigPiSessionDaemon(input) {
+  const rootDir = resolve36(input.rootDir);
+  mkdirSync20(rootDir, { recursive: true });
+  const readyFile = resolve36(rootDir, "ready.json");
+  const existing = readDaemonReadyFile(readyFile);
+  const existingHandle = existing ? await tryReady(existing) : null;
+  if (existingHandle)
+    return existingHandle;
+  try {
+    rmSync14(readyFile, { force: true });
+  } catch {}
+  const token = randomBytes(32).toString("hex");
+  const binPath = resolveRigPiSessionDaemonBinPath(input.env);
+  const bunPath = input.env.RIG_BUN_PATH || process.execPath;
+  const proc = Bun.spawn([bunPath, binPath], {
+    cwd: rootDir,
+    env: {
+      ...input.env,
+      RIG_PI_SESSIOND_ROOT: rootDir,
+      RIG_PI_SESSIOND_TOKEN: token,
+      RIG_PI_SESSIOND_READY_FILE: readyFile,
+      RIG_PI_SESSIOND_HOST: "127.0.0.1",
+      RIG_PI_SESSIOND_PORT: "0",
+      ...input.version ? { RIG_VERSION: input.version } : {},
+      ...input.commit ? { RIG_GIT_COMMIT: input.commit } : {}
+    },
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: "inherit"
+  });
+  proc.unref();
+  const deadline = Date.now() + (input.timeoutMs ?? 15000);
+  while (Date.now() < deadline) {
+    const ready = readDaemonReadyFile(readyFile);
+    const handle = ready ? await tryReady(ready) : null;
+    if (handle)
+      return handle;
+    await sleep(100);
+  }
+  throw new Error([
+    `Rig Pi session daemon did not become ready at ${readyFile}.`,
+    "Usual causes: the bundled Pi runtime is missing or broken. Run `rig doctor` to check Pi wiring,",
+    "set RIG_PI_BINARY to a working Pi build, or run without Pi via RIG_RUNTIME_ADAPTER=claude-code."
+  ].join(`
+`));
+}
+function privateMetadataForDaemon(input) {
+  return { public: input.publicMetadata, daemonConnection: input.connection };
+}
+async function tryReady(ready) {
+  const host = typeof ready.host === "string" ? ready.host : "127.0.0.1";
+  const port = typeof ready.port === "number" ? ready.port : Number(ready.port);
+  const token = typeof ready.token === "string" ? ready.token : "";
+  if (!Number.isFinite(port) || port <= 0 || !token)
+    return null;
+  const baseUrl = `http://${host}:${port}`;
+  const client = new RigPiSessionDaemonClient({ baseUrl, token });
+  try {
+    await client.request("GET", "/health");
+  } catch {
+    return null;
+  }
+  return {
+    client,
+    connection: { mode: "http", baseUrl, tokenRef: tokenRefFromReady(ready) },
+    token,
+    ready
+  };
+}
+function tokenRefFromReady(ready) {
+  const token = typeof ready.token === "string" ? ready.token : "";
+  return token ? `inline:${token}` : "missing";
+}
+function resolveRigPiSessionDaemonBinPath(env) {
+  const explicit = env.RIG_PI_SESSIOND_BIN?.trim();
+  if (explicit)
+    return explicit;
+  const roots = [
+    env.RIG_CONTROL_PLANE_SOURCE_ROOT?.trim(),
+    BAKED_RIG_SOURCE_ROOT.trim(),
+    process.env.RIG_CONTROL_PLANE_SOURCE_ROOT?.trim(),
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter((value) => Boolean(value));
+  for (const root of roots) {
+    const candidate = resolve36(root, "packages/runtime/src/control-plane/pi-sessiond/bin.ts");
+    if (existsSync34(candidate))
+      return candidate;
+  }
+  const moduleCandidate = fileURLToPath2(new URL("./bin.ts", import.meta.url));
+  if (existsSync34(moduleCandidate))
+    return moduleCandidate;
+  throw new Error([
+    "Unable to locate rig-pi-sessiond entrypoint.",
+    "Set RIG_PI_SESSIOND_BIN or RIG_CONTROL_PLANE_SOURCE_ROOT to the Rig source checkout,",
+    "or run without the Pi daemon via RIG_RUNTIME_ADAPTER=claude-code."
+  ].join(`
+`));
+}
+function readDaemonReadyFile(path) {
+  if (!existsSync34(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync17(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
+function resolveRigPiSessionDaemonRoot(stateDir) {
+  const root = resolve36(stateDir, "pi-sessiond");
+  mkdirSync20(dirname14(root), { recursive: true });
+  if (!existsSync34(root))
+    mkdirSync20(root, { recursive: true });
+  return root;
+}
+
 // packages/runtime/src/control-plane/agent-wrapper.ts
+var requireFromRuntime = createRequire(import.meta.url);
 async function finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, context) {
   try {
     await snapshotSidecar.finalize(providerCommand, exitCode);
@@ -9164,7 +9156,7 @@ async function startOptionalRuntimeSnapshotSidecar(runtime, startSidecar = start
   }
 }
 async function runAgentWrapper(options = {}) {
-  const projectRoot = resolve35(options.projectRoot || process.env.PROJECT_RIG_ROOT || process.cwd());
+  const projectRoot = resolve37(options.projectRoot || process.env.PROJECT_RIG_ROOT || process.cwd());
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   const argv = options.argv || process.argv.slice(2);
   if (argv.length === 0 || argv[0] === "--version" || argv[0] === "--help" || argv[0] === "help") {
@@ -9193,7 +9185,8 @@ async function runAgentWrapper(options = {}) {
       taskId,
       mode: "worktree",
       provider,
-      taskRecordReader: taskRecordReaderFromEnv(taskId)
+      taskRecordReader: taskRecordReaderFromEnv(taskId),
+      preserveTaskArtifacts: process.env.RIG_RUN_RESUME === "1" || process.env.RIG_RUNTIME_ARTIFACT_CLEANUP === "preserve"
     });
     emitWrapperEvent("runtime.provision.completed", {
       runtimeId: runtime.id,
@@ -9226,7 +9219,8 @@ async function runAgentWrapper(options = {}) {
     return 1;
   }
   const providerArgs = buildProviderArgs(provider, runtime, argv);
-  const providerCommand = [providerBinary(provider), ...providerArgs];
+  const normalPiDaemonPath = provider === "pi" && process.env.RIG_PI_RPC_FALLBACK !== "1";
+  const providerCommand = normalPiDaemonPath ? ["rig-pi-sessiond", ...providerArgs] : [providerBinary(provider), ...providerArgs];
   emitWrapperEvent("provider.launch", {
     provider,
     runtimeId: runtime.id,
@@ -9238,11 +9232,11 @@ async function runAgentWrapper(options = {}) {
   const bypassOuterRuntimeSandbox = shouldBypassProviderSandboxOnPlatform(provider, process.platform);
   const runClaudeCompatUnsandboxed = provider === "claude-code" && bypassOuterRuntimeSandbox;
   if (runClaudeCompatUnsandboxed && process.env.HOME?.trim()) {
-    env.CLAUDE_HOME = resolve35(process.env.HOME.trim(), ".claude");
+    env.CLAUDE_HOME = resolve37(process.env.HOME.trim(), ".claude");
     env.RIG_CLAUDE_RUNTIME_HOME = runtime.claudeHomeDir;
   }
   if (provider === "pi") {
-    env.PI_CODING_AGENT_DIR = resolve35(runtime.homeDir, ".pi", "agent");
+    env.PI_CODING_AGENT_DIR = resolve37(runtime.homeDir, ".pi", "agent");
     env.PI_CODING_AGENT_SESSION_DIR = runtime.sessionDir;
   }
   env.RIG_RUNTIME_SANDBOX = "enforce";
@@ -9276,14 +9270,36 @@ async function runAgentWrapper(options = {}) {
         },
         command: providerCommand
       })).command;
-      const proc = Bun.spawn(command, {
-        cwd: runtime.workspaceDir,
-        env,
-        stdin: "inherit",
-        stdout: "inherit",
-        stderr: "inherit"
-      });
-      exitCode = await proc.exited;
+      if (provider === "pi" && process.env.RIG_PI_RPC_FALLBACK !== "1") {
+        const prompt = await readProcessStdin();
+        exitCode = await runPiSessionDaemonProvider({
+          projectRoot,
+          runtime,
+          env,
+          prompt,
+          runId: process.env.RIG_SERVER_RUN_ID?.trim() || process.env.RIG_RUN_ID?.trim() || undefined,
+          sessionName: process.env.RIG_SERVER_RUN_ID?.trim() ? `Rig ${process.env.RIG_SERVER_RUN_ID.trim()}` : `Rig ${runtime.taskId}`
+        });
+      } else if (provider === "pi" && isPiRpcArgs(providerArgs)) {
+        const prompt = await readProcessStdin();
+        exitCode = await runPiRpcProviderFallback({
+          command,
+          cwd: runtime.workspaceDir,
+          env,
+          prompt,
+          runId: process.env.RIG_SERVER_RUN_ID?.trim() || undefined,
+          sessionName: process.env.RIG_SERVER_RUN_ID?.trim() ? `Rig ${process.env.RIG_SERVER_RUN_ID.trim()}` : `Rig ${runtime.taskId}`
+        });
+      } else {
+        const proc = Bun.spawn(command, {
+          cwd: runtime.workspaceDir,
+          env,
+          stdin: "inherit",
+          stdout: "inherit",
+          stderr: "inherit"
+        });
+        exitCode = await proc.exited;
+      }
     }
     if (snapshotSidecar) {
       await finalizeRuntimeSnapshot(snapshotSidecar, providerCommand, exitCode, {
@@ -9298,15 +9314,13 @@ async function runAgentWrapper(options = {}) {
     throw error;
   }
   const serverManagedRun = Boolean(process.env.RIG_SERVER_RUN_ID?.trim());
-  if (exitCode === 0 && serverManagedRun) {
-    await updateTaskSourceAfterRun(monorepoRoot, taskId, runtime);
-  }
   const taskClosed = await isTaskClosed(monorepoRoot, taskId);
   const finalExitCode = resolveFinalProviderExitCode({
     providerExitCode: exitCode,
     taskClosed,
     serverManagedRun
   });
+  const handoffRequired = exitCode !== 0 || !taskClosed && !serverManagedRun;
   emitWrapperEvent("provider.completed", {
     provider,
     runtimeId: runtime.id,
@@ -9315,24 +9329,352 @@ async function runAgentWrapper(options = {}) {
     providerExitCode: exitCode,
     taskClosed,
     serverManagedRun,
-    handoffRequired: exitCode !== 0 || !taskClosed
+    handoffRequired
   });
-  if (exitCode !== 0 || !taskClosed) {
+  if (handoffRequired) {
     recordRuntimeHandoff(projectRoot, runtime, taskId, exitCode);
   }
-  if (exitCode === 0 && !taskClosed && serverManagedRun) {
-    console.error(`[rig-agent] Server-managed task run cannot finish successfully while ${taskId} is still open.`);
-  }
   return finalExitCode;
 }
+function parseJsonRecord(line) {
+  try {
+    const parsed = JSON.parse(line);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readProcessStdin() {
+  if (process.stdin.isTTY)
+    return "";
+  return await new Promise((resolveRead) => {
+    let data = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += String(chunk);
+    });
+    process.stdin.on("end", () => resolveRead(data));
+    process.stdin.resume();
+  });
+}
+async function pumpReadableLines(stream, onLine) {
+  if (!stream)
+    return;
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const parts = buffer.split(/\r?\n/);
+      buffer = parts.pop() ?? "";
+      for (const part of parts)
+        onLine(part);
+    }
+    buffer += decoder.decode();
+    if (buffer)
+      onLine(buffer);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function isBlockingPiRpcUiRequest(record) {
+  if (record.type !== "extension_ui_request")
+    return false;
+  return record.method === "select" || record.method === "confirm" || record.method === "input" || record.method === "editor";
+}
+function writeRpcCommand(stdin, command) {
+  stdin.write(`${JSON.stringify(command)}
+`);
+}
+function joinUrl(baseUrl, pathname) {
+  return `${baseUrl.replace(/\/+$/, "")}${pathname.startsWith("/") ? pathname : `/${pathname}`}`;
+}
+async function readQueuedSteeringFromServer(input) {
+  if (!input.serverUrl || !input.runId)
+    return [];
+  const headers = {};
+  if (input.authToken)
+    headers.authorization = `Bearer ${input.authToken}`;
+  const response = await fetch(joinUrl(input.serverUrl, `/api/runs/${encodeURIComponent(input.runId)}/steering?ack=1`), { headers });
+  if (!response.ok)
+    return [];
+  const payload = await response.json().catch(() => null);
+  const messages = payload && typeof payload === "object" && !Array.isArray(payload) ? payload.messages : null;
+  return Array.isArray(messages) ? messages.filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) : [];
+}
+function steeringMessageText(entry) {
+  const message = typeof entry.message === "string" ? entry.message.trim() : "";
+  return message || null;
+}
+function isPiRpcArgs(args) {
+  return cliOptionValue(args, "--mode") === "rpc";
+}
+async function runPiSessionDaemonProvider(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const runId = input.runId ?? input.runtime.taskId;
+  emitWrapperEvent("pi.sessiond.starting", {
+    runId,
+    runtimeId: input.runtime.id,
+    workspaceDir: input.runtime.workspaceDir
+  });
+  const daemon = await ensureRigPiSessionDaemon({
+    rootDir: resolveRigPiSessionDaemonRoot(input.runtime.stateDir),
+    env: input.env,
+    version: process.env.RIG_VERSION?.trim() || "dev",
+    commit: process.env.RIG_GIT_COMMIT?.trim() || undefined
+  });
+  emitWrapperEvent("pi.sessiond.ready", {
+    runId,
+    runtimeId: input.runtime.id,
+    connection: daemon.connection,
+    ready: daemon.ready
+  });
+  const start = await daemon.client.request("POST", "/sessions", {
+    runId,
+    cwd: input.runtime.workspaceDir,
+    agentDir: input.env.PI_CODING_AGENT_DIR || resolve37(input.runtime.homeDir, ".pi", "agent"),
+    sessionDir: input.runtime.sessionDir,
+    sessionName: input.sessionName
+  });
+  const privateMetadata = privateMetadataForDaemon({ publicMetadata: start.metadata, connection: daemon.connection });
+  emitWrapperEvent("pi.session.ready", {
+    runId,
+    runtimeId: input.runtime.id,
+    metadata: start.metadata,
+    privateMetadata
+  });
+  const eventStream = waitForPiSessionEvents({
+    url: daemon.client.webSocketUrl(`/sessions/${encodeURIComponent(start.metadata.sessionId)}/events`),
+    stdout,
+    stderr,
+    runId
+  });
+  emitWrapperEvent("pi.session.event_stream.connected", { runId, sessionId: start.metadata.sessionId });
+  const forwardSigterm = () => {
+    daemon.client.request("POST", `/sessions/${encodeURIComponent(start.metadata.sessionId)}/abort`).catch(() => {
+      return;
+    });
+    eventStream.close();
+  };
+  process.once("SIGTERM", forwardSigterm);
+  try {
+    if (input.prompt.trim()) {
+      await daemon.client.request("POST", `/sessions/${encodeURIComponent(start.metadata.sessionId)}/prompt`, { text: input.prompt });
+      emitWrapperEvent("pi.prompt.sent", { runId, sessionId: start.metadata.sessionId, bytes: Buffer.byteLength(input.prompt) });
+    } else {
+      emitWrapperEvent("pi.prompt.waiting", { runId, sessionId: start.metadata.sessionId, reason: "empty-initial-prompt" });
+    }
+    const result = await eventStream.done;
+    if (result.error) {
+      stderr.write(`[rig-agent] Pi session daemon stream failed: ${result.error}
+`);
+      return 1;
+    }
+    return 0;
+  } finally {
+    process.off("SIGTERM", forwardSigterm);
+    eventStream.close();
+  }
+}
+function waitForPiSessionEvents(input) {
+  let closed = false;
+  let resolved = false;
+  let socket = null;
+  let resolveDone = () => {
+    return;
+  };
+  const done = new Promise((resolveDoneInner) => {
+    resolveDone = resolveDoneInner;
+  });
+  const finish = (value) => {
+    if (resolved)
+      return;
+    resolved = true;
+    resolveDone(value);
+  };
+  socket = new WebSocket(input.url);
+  socket.addEventListener("message", (message) => {
+    const text = typeof message.data === "string" ? message.data : Buffer.from(message.data).toString("utf8");
+    input.stdout.write(`${text}
+`);
+    const envelope = parseJsonRecord(text);
+    if (!envelope)
+      return;
+    if (envelope.type === "pi.event") {
+      const event = envelope.event && typeof envelope.event === "object" && !Array.isArray(envelope.event) ? envelope.event : null;
+      if (event?.type === "agent_end") {
+        emitWrapperEvent("pi.session.agent_end", { runId: input.runId, sessionId: envelope.sessionId });
+        finish({});
+      }
+    }
+    if (envelope.type === "error") {
+      emitWrapperEvent("pi.session.error", { runId: input.runId, message: envelope.message, detail: envelope.detail ?? null });
+      finish({ error: envelope.message });
+    }
+  });
+  socket.addEventListener("error", () => {
+    if (!closed)
+      finish({ error: "WebSocket error" });
+  });
+  socket.addEventListener("close", () => {
+    if (!closed && !resolved)
+      finish({ error: "WebSocket closed before agent_end" });
+  });
+  return {
+    done,
+    close: () => {
+      closed = true;
+      try {
+        socket?.close();
+      } catch {}
+    }
+  };
+}
+async function runPiRpcProviderFallback(input) {
+  const stdout = input.stdout ?? process.stdout;
+  const stderr = input.stderr ?? process.stderr;
+  const proc = Bun.spawn(input.command, {
+    cwd: input.cwd,
+    env: input.env,
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  let sawAgentEnd = false;
+  let promptError = null;
+  let stdinOpen = true;
+  let steeringPollStopped = false;
+  const closeStdin = () => {
+    if (!stdinOpen)
+      return;
+    stdinOpen = false;
+    try {
+      steeringPollStopped = true;
+      proc.stdin.end();
+    } catch {}
+  };
+  const send = (command) => {
+    if (!stdinOpen)
+      return;
+    try {
+      writeRpcCommand(proc.stdin, command);
+    } catch (error) {
+      promptError ??= error instanceof Error ? error.message : String(error);
+    }
+  };
+  const forwardSigterm = () => {
+    try {
+      proc.kill("SIGTERM");
+    } catch {}
+  };
+  process.once("SIGTERM", forwardSigterm);
+  const pollSteering = async () => {
+    const serverUrl = input.env.RIG_SERVER_URL || input.env.RIG_SERVER_BASE_URL;
+    const authToken = input.env.RIG_AUTH_TOKEN || input.env.RIG_SERVER_AUTH_TOKEN;
+    while (!steeringPollStopped && stdinOpen) {
+      try {
+        const messages = await readQueuedSteeringFromServer({ serverUrl, authToken, runId: input.runId });
+        for (const message of messages) {
+          const text = steeringMessageText(message);
+          if (!text || !stdinOpen)
+            continue;
+          send({
+            id: typeof message.id === "string" ? `rig_steer_${message.id}` : `rig_steer_${Date.now()}`,
+            type: "prompt",
+            message: text,
+            streamingBehavior: "steer"
+          });
+          emitWrapperEvent("pi.rpc.steering.delivered", {
+            runId: input.runId ?? null,
+            steeringId: typeof message.id === "string" ? message.id : null,
+            actor: typeof message.actor === "string" ? message.actor : "operator",
+            message: text
+          });
+        }
+      } catch (error) {
+        emitWrapperEvent("pi.rpc.steering.poll.failed", {
+          runId: input.runId ?? null,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      await sleep2(1000);
+    }
+  };
+  const stdoutPump = pumpReadableLines(proc.stdout, (line) => {
+    stdout.write(`${line}
+`);
+    const record = parseJsonRecord(line.trim());
+    if (!record)
+      return;
+    if (record.type === "agent_end") {
+      sawAgentEnd = true;
+      closeStdin();
+      return;
+    }
+    if (record.type === "response" && record.command === "prompt" && record.success === false) {
+      promptError = typeof record.error === "string" ? record.error : "Pi RPC prompt failed.";
+      closeStdin();
+      return;
+    }
+    if (isBlockingPiRpcUiRequest(record)) {
+      const id = typeof record.id === "string" ? record.id : "";
+      if (id) {
+        send({ type: "extension_ui_response", id, cancelled: true });
+        emitWrapperEvent("pi.rpc.extension_ui.cancelled", {
+          id,
+          method: record.method,
+          reason: "noninteractive Rig worker RPC session"
+        });
+      }
+    }
+  });
+  const stderrPump = pumpReadableLines(proc.stderr, (line) => {
+    stderr.write(`${line}
+`);
+  });
+  if (input.sessionName?.trim()) {
+    send({ id: "rig_set_session_name", type: "set_session_name", name: input.sessionName.trim() });
+  }
+  const steeringPollPromise = pollSteering();
+  if (input.prompt.trim()) {
+    send({ id: "rig_initial_prompt", type: "prompt", message: input.prompt });
+    emitWrapperEvent("pi.rpc.prompt.sent", {
+      runId: input.runId ?? null,
+      kind: "initial",
+      bytes: Buffer.byteLength(input.prompt)
+    });
+  } else {
+    closeStdin();
+  }
+  const exitCode = await proc.exited;
+  process.off("SIGTERM", forwardSigterm);
+  steeringPollStopped = true;
+  await Promise.all([stdoutPump, stderrPump, steeringPollPromise]);
+  if (promptError) {
+    stderr.write(`[rig-agent] Pi RPC prompt failed: ${promptError}
+`);
+    return exitCode === 0 ? 1 : exitCode;
+  }
+  if (input.prompt.trim() && !sawAgentEnd && exitCode === 0) {
+    stderr.write(`[rig-agent] Pi RPC exited before emitting agent_end.
+`);
+    return 1;
+  }
+  return exitCode;
+}
 function resolveFinalProviderExitCode(input) {
   if (input.providerExitCode !== 0) {
     return input.providerExitCode;
   }
-  if (input.taskClosed) {
+  if (input.taskClosed || input.serverManagedRun) {
     return 0;
   }
-  return input.serverManagedRun ? 2 : 0;
+  return 0;
 }
 function shouldBypassProviderSandboxOnPlatform(provider, platform) {
   if (platform !== "darwin") {
@@ -9356,14 +9698,27 @@ function buildProviderArgs(provider, runtime, argv) {
   }
   if (provider === "pi") {
     const piArgs = [...argv];
+    if (piArgs.includes("__rig_pi_session_daemon__")) {
+      return piArgs.filter((arg) => arg !== "__rig_pi_session_daemon__");
+    }
+    const piProvider = cliOptionValue(piArgs, "--provider") || process.env.RIG_PI_PROVIDER?.trim() || "openai-codex";
     if (!hasCliOption(piArgs, "--provider")) {
-      piArgs.unshift(process.env.RIG_PI_PROVIDER?.trim() || "openai-codex");
+      piArgs.unshift(piProvider);
       piArgs.unshift("--provider");
     }
-    if (!hasCliOption(piArgs, "--model")) {
-      piArgs.unshift(process.env.RIG_PI_MODEL?.trim() || "gpt-5.5");
+    const model = cliOptionValue(piArgs, "--model") || process.env.RIG_PI_MODEL?.trim() || "gpt-5.5";
+    if (hasCliOption(piArgs, "--model")) {
+      rewriteCliOptionValue(piArgs, "--model", normalizePiModelForProvider(model, piProvider));
+    } else {
+      piArgs.unshift(normalizePiModelForProvider(model, piProvider));
       piArgs.unshift("--model");
     }
+    if (!hasCliOption(piArgs, "--mode")) {
+      piArgs.push("--mode", process.env.RIG_PI_TRANSPORT?.trim() === "print" ? "json" : "rpc");
+      if (process.env.RIG_PI_TRANSPORT?.trim() === "print" && !hasCliOption(piArgs, "--print")) {
+        piArgs.push("--print");
+      }
+    }
     return piArgs;
   }
   return [
@@ -9413,6 +9768,7 @@ async function runBeadsJson(projectRoot, args) {
     return null;
   }
 }
+var warnedUnknownRuntimeAdapter = false;
 function resolveProvider() {
   const value = process.env.RIG_RUNTIME_ADAPTER?.trim().toLowerCase();
   if (!value) {
@@ -9424,28 +9780,85 @@ function resolveProvider() {
   if (value === "pi" || value === "rig-pi" || value === "@rig/pi") {
     return "pi";
   }
+  if (value !== "claude-code" && value !== "claude" && !warnedUnknownRuntimeAdapter) {
+    warnedUnknownRuntimeAdapter = true;
+    console.warn(`[rig-agent] Unknown RIG_RUNTIME_ADAPTER value "${value}"; falling back to claude-code. Use pi|claude-code|codex.`);
+  }
   return "claude-code";
 }
 function hasCliOption(argv, option) {
   return argv.some((arg) => arg === option || arg.startsWith(`${option}=`));
 }
+function cliOptionValue(argv, option) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("--") ? next : undefined;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      return arg.slice(option.length + 1);
+    }
+  }
+  return;
+}
+function rewriteCliOptionValue(argv, option, value) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === option && argv[index + 1] && !argv[index + 1].startsWith("--")) {
+      argv[index + 1] = value;
+      return;
+    }
+    if (arg?.startsWith(`${option}=`)) {
+      argv[index] = `${option}=${value}`;
+      return;
+    }
+  }
+}
+function normalizePiModelForProvider(model, provider) {
+  if (provider === "openrouter" && model === "openai-codex/gpt-5.5") {
+    return "openai/gpt-5.5";
+  }
+  return model;
+}
+function resolveFromShellPath(binary) {
+  const resolved = Bun.spawnSync(["sh", "-lc", `command -v ${binary}`], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    env: process.env
+  });
+  if (resolved.exitCode !== 0)
+    return null;
+  const path = resolved.stdout.toString().trim().split(/\r?\n/)[0]?.trim();
+  return path || null;
+}
+function resolveBundledPiBinary() {
+  try {
+    const packageJson = requireFromRuntime.resolve("@earendil-works/pi-coding-agent/package.json");
+    const binaryPath = resolve37(packageJson, "..", "dist", "cli.js");
+    return existsSync35(binaryPath) ? binaryPath : null;
+  } catch {
+    return null;
+  }
+}
 function providerBinary(provider) {
   if (provider === "codex") {
-    return Bun.which("codex") || "codex";
+    return resolveFromShellPath("codex") || Bun.which("codex") || "codex";
   }
   if (provider === "pi") {
-    return Bun.which("pi") || "pi";
+    return process.env.RIG_PI_BINARY?.trim() || resolveBundledPiBinary() || resolveFromShellPath("pi") || Bun.which("pi") || "pi";
   }
   try {
     return resolveClaudeBinaryPath();
   } catch {
-    return Bun.which("claude") || "claude";
+    return resolveFromShellPath("claude") || Bun.which("claude") || "claude";
   }
 }
 function emitWrapperEvent(type, payload) {
   console.log(`__RIG_WRAPPER_EVENT__${JSON.stringify({ type, payload, at: new Date().toISOString() })}`);
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
 async function waitForDirtyBaselineReady(runtime, taskId) {
@@ -9460,11 +9873,11 @@ async function waitForDirtyBaselineReady(runtime, taskId) {
     workspaceDir: runtime.workspaceDir,
     readyFile
   });
-  while (!existsSync33(readyFile)) {
+  while (!existsSync35(readyFile)) {
     if (Date.now() >= deadline) {
       throw new Error(`Timed out waiting for dirty baseline ready file: ${readyFile}`);
     }
-    await sleep(50);
+    await sleep2(50);
   }
   emitWrapperEvent("runtime.baseline.completed", {
     runtimeId: runtime.id,
@@ -9527,43 +9940,10 @@ async function readPluginTaskStatus(projectRoot, taskId) {
     return readSourceAwareTaskStatus(projectRoot, taskId);
   }
 }
-async function updateTaskSourceAfterRun(projectRoot, taskId, runtime) {
-  const comment = buildTaskRunLifecycleComment({
-    runId: process.env.RIG_SERVER_RUN_ID || "(unknown)",
-    status: "closed",
-    summary: "Rig task run completed and closed this task.",
-    runtimeWorkspace: runtime.workspaceDir,
-    logsDir: runtime.logsDir,
-    sessionDir: runtime.sessionDir
-  });
-  try {
-    const result = await updateConfiguredTaskSourceTask(projectRoot, {
-      taskId,
-      update: { status: "closed", comment }
-    });
-    if (result.updated) {
-      return;
-    }
-    throw new Error(result.source === "plugin" || result.sourceKind ? `configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} does not support lifecycle updates` : "no source-aware task source is configured");
-  } catch (error) {
-    let fallbackUpdated = false;
-    try {
-      fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, { status: "closed", comment });
-    } catch (fallbackError) {
-      console.error(`[rig-agent] Source-aware compatibility update also failed for ${taskId}: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
-    }
-    const message = `[rig-agent] Failed to update task source for ${taskId}${fallbackUpdated ? "; applied source-aware compatibility update" : ""}: ${error instanceof Error ? error.message : String(error)}`;
-    if (fallbackUpdated) {
-      console.log(message);
-    } else {
-      console.error(message);
-    }
-  }
-}
 function recordRuntimeHandoff(hostProjectRoot, runtime, taskId, exitCode) {
-  const handoffDir = resolve35(hostProjectRoot, ".rig/runtime/handoffs");
-  mkdirSync19(handoffDir, { recursive: true });
-  const handoffPath = resolve35(handoffDir, `${taskId}-${Date.now()}.json`);
+  const handoffDir = resolve37(hostProjectRoot, ".rig/runtime/handoffs");
+  mkdirSync21(handoffDir, { recursive: true });
+  const handoffPath = resolve37(handoffDir, `${taskId}-${Date.now()}.json`);
   const handoff = {
     taskId,
     runtimeId: runtime.id,
@@ -9579,7 +9959,7 @@ function recordRuntimeHandoff(hostProjectRoot, runtime, taskId, exitCode) {
       `rig git open-pr --task ${taskId}`
     ]
   };
-  writeFileSync13(handoffPath, `${JSON.stringify(handoff, null, 2)}
+  writeFileSync14(handoffPath, `${JSON.stringify(handoff, null, 2)}
 `, "utf-8");
   console.log(`[rig-agent] Completion verification paused for ${taskId}.`);
   console.log(`[rig-agent] Runtime handoff saved: ${handoffPath}`);
@@ -9629,13 +10009,13 @@ async function readTaskMetadata2(taskRoot, taskId) {
 async function readTaskConfigHints(taskRoot, taskId) {
   const runtimeContext = loadRuntimeContextFromEnv();
   const candidates = [
-    runtimeContext?.monorepoMainRoot ? resolve35(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve35(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve35(taskRoot, ".rig", "task-config.json"),
-    resolve35(taskRoot, "rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve37(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve37(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve37(taskRoot, ".rig", "task-config.json"),
+    resolve37(taskRoot, "rig", "task-config.json")
   ].filter(Boolean);
   for (const configPath of candidates) {
-    if (!existsSync33(configPath)) {
+    if (!existsSync35(configPath)) {
       continue;
     }
     try {