@h-rig/runtime 0.0.6-alpha.3 → 0.0.6-alpha.30

package/dist/src/control-plane/materialize-task-config.js

@@ -300,6 +300,50 @@ function safeReadJson(path) {
 var MARKER_PLUGIN = "_rigPlugin", MARKER_HOOK_ID = "_rigHookId";
 var init_hook_materializer = () => {};
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve2(projectRoot, ".pi", "skills");
+  if (existsSync3(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve2(skillsRoot, name);
+      if (existsSync3(resolve2(dir, MARKER_FILENAME))) {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve2(projectRoot, skill.path);
+    if (!existsSync3(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync2(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve2(skillsRoot, skillDirName(skill.id));
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync2(resolve2(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync2(resolve2(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+var MARKER_FILENAME = ".rig-plugin";
+var init_skill_materializer = () => {};
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 var exports_plugin_host_context = {};
 __export(exports_plugin_host_context, {
@@ -342,6 +386,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -357,13 +412,14 @@ var init_plugin_host_context = __esm(() => {
   init_registry();
   init_runtime_registration();
   init_hook_materializer();
+  init_skill_materializer();
 });
 
 // packages/runtime/src/control-plane/materialize-task-config.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, resolve as resolve3 } from "path";
 async function materializePluginHostTaskConfig(projectRoot) {
-  const hasConfig = existsSync3(resolve2(projectRoot, "rig.config.ts")) || existsSync3(resolve2(projectRoot, "rig.config.json"));
+  const hasConfig = existsSync4(resolve3(projectRoot, "rig.config.ts")) || existsSync4(resolve3(projectRoot, "rig.config.json"));
   if (!hasConfig)
     return null;
   const { buildPluginHostContext: buildPluginHostContext2 } = await Promise.resolve().then(() => (init_plugin_host_context(), exports_plugin_host_context));
@@ -383,8 +439,8 @@ async function materializePluginHostTaskConfig(projectRoot) {
   const tasks = await source.list();
   if (tasks.length === 0)
     return null;
-  const configPath = resolve2(projectRoot, ".rig", "task-config.json");
-  const existing = existsSync3(configPath) ? safeJsonRead(configPath) : {};
+  const configPath = resolve3(projectRoot, ".rig", "task-config.json");
+  const existing = existsSync4(configPath) ? safeJsonRead(configPath) : {};
   const merged = { ...existing };
   let syncedCount = 0;
   for (const task of tasks) {
@@ -400,8 +456,8 @@ async function materializePluginHostTaskConfig(projectRoot) {
     merged[id] = synthesizeEntry(t, ctx.config.taskSource);
     syncedCount += 1;
   }
-  mkdirSync2(dirname2(configPath), { recursive: true });
-  writeFileSync2(configPath, `${JSON.stringify(merged, null, 2)}
+  mkdirSync3(dirname2(configPath), { recursive: true });
+  writeFileSync3(configPath, `${JSON.stringify(merged, null, 2)}
 `, "utf-8");
   return { configPath, syncedCount };
 }
@@ -442,7 +498,7 @@ function materializedTaskSource(taskSource) {
 }
 function safeJsonRead(path) {
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};

package/dist/src/control-plane/native/git-ops.js

@@ -311,6 +311,9 @@ function getScopeRules() {
   return activeRules;
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { loadSkill } from "@rig/skill-loader";
+
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 
@@ -1365,6 +1368,30 @@ function sourceTaskConfigCandidates(projectRoot) {
 
 // packages/runtime/src/binary-run.ts
 var runtimeBinaryBuildQueue = Promise.resolve();
+// packages/runtime/src/control-plane/native/pr-review-gate.ts
+function strictMergeHeadShaFromGate(result, prUrl) {
+  if (!result.approved) {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate is not approved.`);
+  }
+  if (result.evidence.prUrl !== prUrl) {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate evidence belongs to ${result.evidence.prUrl}.`);
+  }
+  const headSha = result.evidence.headSha?.trim();
+  if (!headSha) {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate did not provide a current head SHA.`);
+  }
+  if (!/^[0-9a-f]{40}$/i.test(headSha)) {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate head is not a raw 40-character commit SHA.`);
+  }
+  if (!result.evidence.greptile.fresh || result.evidence.greptile.currentHeadSha !== headSha) {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate approval is not tied to head ${headSha}.`);
+  }
+  if (result.evidence.greptile.mapping !== "score-5-of-5" && result.evidence.greptile.mapping !== "explicit-approved") {
+    throw new Error(`Refusing to merge ${prUrl}: strict merge gate mapping is ${result.evidence.greptile.mapping}.`);
+  }
+  return headSha;
+}
+
 // packages/runtime/src/control-plane/provider/runtime-instructions.ts
 var CLAUDE_ROUTER_TOOL_NAMES = [
   "`mcp__rig_runtime_tools__read`",
@@ -1575,12 +1602,12 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "task-result.json",
   "validation-summary.json"
 ]);
-function resolveHostRigBinDir(root) {
-  return resolve11(root, ".rig", "bin");
-}
 function isRuntimeGatewayGitPath(candidate) {
   return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
   if (runtimeWorkspace && existsSync9(resolve11(runtimeWorkspace, ".git"))) {
@@ -1615,6 +1642,9 @@ function resolveGitBinary(projectRoot) {
   }
   return "git";
 }
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function safeCurrentTaskId(projectRoot) {
   try {
     const taskId = currentTaskId(projectRoot);
@@ -1828,10 +1858,11 @@ function gitOpenPr(options) {
     "",
     "## Task",
     `- beads: ${taskId || "n/a"}`,
+    ...defaultPrRunLines(taskId, repoNameWithOwner),
     "",
     "## Review",
     "- Completion verification will run validation, verifier review, and PR policy checks.",
-    "- When repository policy allows it, Rig enables GitHub auto-merge after approval."
+    "- When repository policy allows it, Rig attempts an immediate strict-gated, head-locked merge after approval."
   ].join(`
 `);
   const preCheck = runCapture2(withGhRepo([gh, "pr", "list", "--state", "merged", "--head", branch, "--json", "url,mergedAt", "--jq", ".[0]"], repoNameWithOwner), repoRoot);
@@ -1919,6 +1950,30 @@ function gitOpenPr(options) {
   }
   return result;
 }
+function defaultPrRunLines(taskId, repoNameWithOwner) {
+  const lines = [];
+  const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+  if (runId) {
+    lines.push(`- Run: ${runId}`);
+  }
+  const closeout = defaultPrCloseoutLine(taskId, repoNameWithOwner);
+  if (closeout) {
+    lines.push(`- ${closeout}`);
+  }
+  return lines;
+}
+function defaultPrCloseoutLine(taskId, repoNameWithOwner) {
+  const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (sourceIssueId) {
+    const match = sourceIssueId.match(/^([^#]+)#(\d+)$/);
+    if (match?.[1] && match[2]) {
+      const sourceRepo = match[1];
+      const issueNumber = match[2];
+      return sourceRepo.toLowerCase() === repoNameWithOwner.toLowerCase() ? `Closes #${issueNumber}` : `Closes ${sourceRepo}#${issueNumber}`;
+    }
+  }
+  return /^\d+$/.test(taskId) ? `Closes #${taskId}` : "";
+}
 function resolveTaskBranchRef(projectRoot, taskId) {
   return `rig/${resolveTaskBranchId(projectRoot, taskId)}`;
 }
@@ -2003,61 +2058,45 @@ function gitMergePr(options) {
     return { status: "already-merged", url: options.pr.url };
   }
   if (state !== "OPEN") {
-    throw new Error(`Cannot auto-merge PR ${options.pr.url}: state is ${state}.`);
+    throw new Error(`Cannot merge PR ${options.pr.url}: state is ${state}.`);
   }
   if (isDraft) {
-    throw new Error(`Cannot auto-merge draft PR ${options.pr.url}.`);
+    throw new Error(`Cannot merge draft PR ${options.pr.url}.`);
   }
+  const strictGateHeadSha = strictMergeHeadShaFromGate(options.strictGate, options.pr.url);
   const mergeArgs = withGhRepo([gh, "pr", "merge", options.pr.url], repoNameWithOwner);
   const method = options.method || "squash";
   mergeArgs.push(method === "merge" ? "--merge" : method === "rebase" ? "--rebase" : "--squash");
+  mergeArgs.push("--match-head-commit", strictGateHeadSha);
   if (options.deleteBranch !== false) {
     mergeArgs.push("--delete-branch");
   }
-  const autoMergeArgs = [...mergeArgs, "--auto"];
-  const autoMerge = runCapture2(autoMergeArgs, repoRoot);
-  if (autoMerge.exitCode === 0) {
-    const postAutoMergeState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
-    if (postAutoMergeState.state === "MERGED" || postAutoMergeState.mergedAt) {
-      console.log(`Merged PR (${options.pr.repoLabel}): ${options.pr.url}`);
-      return { status: "merged", url: options.pr.url };
-    }
-    if (postAutoMergeState.state === "OPEN" && postAutoMergeState.autoMergeRequest) {
-      if (canAdminMergeApprovedPr(postAutoMergeState)) {
-        const adminMergeArgs = [...mergeArgs];
-        if (postAutoMergeState.headRefOid) {
-          adminMergeArgs.push("--match-head-commit", postAutoMergeState.headRefOid);
-        }
-        adminMergeArgs.push("--admin");
-        const adminMerge = runCapture2(adminMergeArgs, repoRoot);
-        if (adminMerge.exitCode === 0) {
-          const postAdminMergeState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
-          if (postAdminMergeState.state === "MERGED" || postAdminMergeState.mergedAt) {
-            console.log(`Merged PR (${options.pr.repoLabel}) with admin fallback: ${options.pr.url}`);
-            return { status: "merged", url: options.pr.url };
-          }
-          throw new Error(`Admin merge command succeeded for PR ${options.pr.url} in ${options.pr.repoLabel}, but GitHub still reports it open.`);
-        }
-        const adminMergeMessage = `${adminMerge.stderr}
-${adminMerge.stdout}`.trim();
-        if (!/admin|administrator|permission|not permitted|not allowed/i.test(adminMergeMessage)) {
-          throw new Error(`Failed to admin-merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${adminMergeMessage}`);
-        }
+  const directMerge = runCapture2(mergeArgs, repoRoot);
+  if (directMerge.exitCode === 0) {
+    console.log(`Merged PR (${options.pr.repoLabel}): ${options.pr.url}`);
+    return { status: "merged", url: options.pr.url };
+  }
+  const postDirectState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
+  if (canAdminMergeApprovedPr(postDirectState)) {
+    const adminMergeArgs = [...mergeArgs, "--admin"];
+    const adminMerge = runCapture2(adminMergeArgs, repoRoot);
+    if (adminMerge.exitCode === 0) {
+      const postAdminMergeState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
+      if (postAdminMergeState.state === "MERGED" || postAdminMergeState.mergedAt) {
+        console.log(`Merged PR (${options.pr.repoLabel}) with admin fallback: ${options.pr.url}`);
+        return { status: "merged", url: options.pr.url };
       }
-      console.log(`Auto-merge enabled (${options.pr.repoLabel}): ${options.pr.url}`);
-      return { status: "auto-merge-enabled", url: options.pr.url };
+      throw new Error(`Admin merge command succeeded for PR ${options.pr.url} in ${options.pr.repoLabel}, but GitHub still reports it open.`);
+    }
+    const adminMergeMessage = `${adminMerge.stderr}
+${adminMerge.stdout}`.trim();
+    if (!/admin|administrator|permission|not permitted|not allowed/i.test(adminMergeMessage)) {
+      throw new Error(`Failed to admin-merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${adminMergeMessage}`);
     }
-    throw new Error(`Auto-merge command succeeded for PR ${options.pr.url} in ${options.pr.repoLabel}, but GitHub did not report a merged or auto-merge-enabled state.`);
-  }
-  const autoMergeMessage = `${autoMerge.stderr}
-${autoMerge.stdout}`.trim();
-  const autoMergeUnsupported = /auto.?merge.*(not enabled|not allowed|disabled|unsupported)|enablePullRequestAutoMerge|Auto merge is not allowed/i.test(autoMergeMessage);
-  if (!autoMergeUnsupported) {
-    throw new Error(`Failed to auto-merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${autoMergeMessage}`);
   }
-  runOrThrow(options.projectRoot, mergeArgs, `Failed to merge PR ${options.pr.url} in ${options.pr.repoLabel}`);
-  console.log(`Merged PR (${options.pr.repoLabel}): ${options.pr.url}`);
-  return { status: "merged", url: options.pr.url };
+  const directMergeMessage = `${directMerge.stderr}
+${directMerge.stdout}`.trim();
+  throw new Error(`Failed to merge PR ${options.pr.url} in ${options.pr.repoLabel}: ${directMergeMessage}`);
 }
 function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
   const mergeable = prState.mergeable.toUpperCase();
@@ -2169,32 +2208,19 @@ function resolveGithubCliBinary(projectRoot) {
   if (explicit) {
     candidates.add(explicit);
   }
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    candidates.add(candidate);
+  }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
     candidates.add(resolve11(entry, "gh"));
   }
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot) {
-    candidates.add(resolve11(resolveHostRigBinDir(hostProjectRoot), "gh"));
-  }
-  candidates.add(resolve11(resolveHostRigBinDir(projectRoot), "gh"));
-  const runtimeContext = loadRuntimeContextFromEnv();
-  if (runtimeContext?.binDir) {
-    candidates.add(resolve11(runtimeContext.binDir, "gh"));
-  }
-  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
-  if (runtimeHome) {
-    candidates.add(resolve11(runtimeHome, "bin", "gh"));
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    candidates.add(candidate);
-  }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync9(candidate)) {
+    if (candidate && existsSync9(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }