@h-rig/runtime 0.0.6-alpha.3 → 0.0.6-alpha.31

package/dist/src/control-plane/native/validator.js

@@ -1,7 +1,7 @@
 // @bun
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { resolve as resolve15 } from "path";
 
 // packages/runtime/src/layout.ts
 import { existsSync } from "fs";
@@ -916,6 +916,49 @@ function safeReadJson(path) {
   }
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, readdirSync as readdirSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve8 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve8(projectRoot, ".pi", "skills");
+  if (existsSync8(skillsRoot)) {
+    for (const name of readdirSync2(skillsRoot)) {
+      const dir = resolve8(skillsRoot, name);
+      if (existsSync8(resolve8(dir, MARKER_FILENAME))) {
+        rmSync2(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve8(projectRoot, skill.path);
+    if (!existsSync8(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync5(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve8(skillsRoot, skillDirName(skill.id));
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync4(resolve8(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync4(resolve8(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -952,6 +995,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -965,12 +1019,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { basename as basename3, join as join2, resolve as resolve9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve10 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve9 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -993,7 +1047,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve8(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -1004,8 +1058,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync8(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve9(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync9(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -1013,7 +1067,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, "
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -1097,7 +1151,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -1180,10 +1234,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve9(projectRoot, "rig.config.json");
-  if (existsSync9(jsonPath)) {
+  const jsonPath = resolve10(projectRoot, "rig.config.json");
+  if (existsSync10(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -1192,12 +1246,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve9(projectRoot, "rig.config.ts");
-  if (!existsSync9(tsPath)) {
+  const tsPath = resolve10(projectRoot, "rig.config.ts");
+  if (!existsSync10(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync6(tsPath, "utf8");
+    const source = readFileSync7(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -1217,10 +1271,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync9(configPath)) {
+  if (!existsSync10(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -1228,12 +1282,12 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve9(projectRoot, sourcePath);
-  if (!existsSync9(directory)) {
+  const directory = resolve10(projectRoot, sourcePath);
+  if (!existsSync10(directory)) {
     return [];
   }
   const tasks = [];
-  for (const name of readdirSync2(directory)) {
+  for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const inferredId = basename3(name).replace(FILE_TASK_PATTERN, "");
@@ -1244,11 +1298,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve9(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve10(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -1261,17 +1315,17 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync9(directory)) {
+  if (!existsSync10(directory)) {
     return null;
   }
-  for (const name of readdirSync2(directory)) {
+  for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const file = join2(directory, name);
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
       const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -1354,8 +1408,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -1431,12 +1485,12 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, rmSync as rmSync3, statSync as statSync4 } from "fs";
-import { dirname as dirname7, resolve as resolve13 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, rmSync as rmSync4, statSync as statSync4 } from "fs";
+import { dirname as dirname7, resolve as resolve14 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync, cpSync, existsSync as existsSync10, mkdirSync as mkdirSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename4, dirname as dirname6, resolve as resolve10 } from "path";
+import { chmodSync, cpSync, existsSync as existsSync11, mkdirSync as mkdirSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, dirname as dirname6, resolve as resolve11 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -1462,9 +1516,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve10(dirname6(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve10(tempBuildDir, basename4(options.outputPath));
-  mkdirSync4(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve11(dirname6(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve11(tempBuildDir, basename4(options.outputPath));
+  mkdirSync5(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -1489,7 +1543,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync10(tempOutputPath)) {
+    if (!existsSync11(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -1504,7 +1558,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
       });
     }
   })).finally(() => {
-    rmSync2(tempBuildDir, { recursive: true, force: true });
+    rmSync3(tempBuildDir, { recursive: true, force: true });
   });
 }
 function runBestEffortBuildGc() {
@@ -1521,8 +1575,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve10(options.cwd, options.sourcePath),
-    outputPath: resolve10(options.outputPath)
+    entrypoint: resolve11(options.cwd, options.sourcePath),
+    outputPath: resolve11(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -1536,7 +1590,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync10(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync11(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -1567,13 +1621,13 @@ async function buildRuntimeBinaryViaWorker(options) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  rmSync2(payloadPath, { force: true });
+  rmSync3(payloadPath, { force: true });
   if (exitCode !== 0) {
     throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve10(dirname6(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve11(dirname6(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -1582,13 +1636,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve10(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync10(candidate)) {
+    const candidate = resolve11(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync11(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve10(import.meta.dir, "binary-build-worker.ts");
-  return existsSync10(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve11(import.meta.dir, "binary-build-worker.ts");
+  return existsSync11(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -1624,7 +1678,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync10(input.outputPath) || !existsSync10(input.manifestPath)) {
+  if (!existsSync11(input.outputPath) || !existsSync11(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -1637,7 +1691,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync10(filePath)) {
+    if (!existsSync11(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -1650,7 +1704,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync10(normalized)) {
+    if (!normalized || !existsSync11(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -1673,7 +1727,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve10(cwd, inputPath);
+  return resolve11(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -1689,8 +1743,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve11) => {
-    release = resolve11;
+  runtimeBinaryBuildQueue = new Promise((resolve12) => {
+    release = resolve12;
   });
   await previous;
   try {
@@ -1735,11 +1789,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve12 } from "path";
+import { delimiter, resolve as resolve13 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync11, readdirSync as readdirSync3, realpathSync } from "fs";
-import { resolve as resolve11 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve12 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -1757,7 +1811,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve11(home, ".bun/bin/bun") : "",
+    home ? resolve12(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -1785,8 +1839,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve11(home, ".local/bin/claude") : "",
-    home ? resolve11(home, ".local/share/claude/local/claude") : "",
+    home ? resolve12(home, ".local/bin/claude") : "",
+    home ? resolve12(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -1800,51 +1854,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve11(bunBinaryPath, "../..");
+  return resolve12(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve11(realPath, "..");
+  return resolve12(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve11(explicitNode) === resolve11(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve11(preferredNode, "../..") : resolve11(preferredNode, "..");
+  if (explicitNode && resolve12(explicitNode) === resolve12(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve12(preferredNode, "../..") : resolve12(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve11(realPath, "../..");
+      return resolve12(realPath, "../..");
     }
-    return resolve11(realPath, "..");
+    return resolve12(realPath, "..");
   } catch {
-    return resolve11(preferredNode, "..");
+    return resolve12(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve11(envNode);
-    if (existsSync11(explicit)) {
+    const explicit = resolve12(envNode);
+    if (existsSync12(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve11(nvmBin, "node"));
+    candidates.push(resolve12(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve11(home, ".nvm/versions/node");
-    if (existsSync11(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve12(home, ".nvm/versions/node");
+    if (existsSync12(nvmVersionsDir)) {
       try {
-        const versionDirs = readdirSync3(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve11(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve12(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -1853,8 +1907,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve11(candidate)));
-  const existing = deduped.filter((candidate) => existsSync11(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve12(candidate)));
+  const existing = deduped.filter((candidate) => existsSync12(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -1868,7 +1922,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve11(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve12(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -1880,8 +1934,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve11(candidate);
-  if (!existsSync11(normalized)) {
+  const normalized = resolve12(candidate);
+  if (!existsSync12(normalized)) {
     return "";
   }
   try {
@@ -1891,7 +1945,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve11(candidate).replace(/\\/g, "/");
+  const normalized = resolve12(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -1912,7 +1966,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve12(claudeBinary, "..");
+      return resolve13(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -1922,8 +1976,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve12(realHome, ".local/bin") : "",
-    realHome ? resolve12(realHome, ".cargo/bin") : "",
+    realHome ? resolve13(realHome, ".local/bin") : "",
+    realHome ? resolve13(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -1954,9 +2008,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve13(runtimeContext.binDir, "validators", binaryName);
+    return resolve14(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve13(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve14(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -1971,19 +2025,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve13(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync12(sourcePath)) {
+  const sourcePath = resolve14(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync13(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync4(sourcePath).mtimeMs;
-  const binaryExists = existsSync12(binaryPath);
+  const binaryExists = existsSync13(binaryPath);
   const binaryMtime = binaryExists ? statSync4(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
-      rmSync3(binaryPath, { force: true });
-      rmSync3(`${binaryPath}.build-manifest.json`, { force: true });
+      rmSync4(binaryPath, { force: true });
+      rmSync4(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync5(dirname7(binaryPath), { recursive: true });
+    mkdirSync6(dirname7(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -1992,7 +2046,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync12(binaryPath) ? binaryPath : null;
+  return existsSync13(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -2029,20 +2083,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve14(runtimeContext.logsDir, taskId),
-      artifactDir: resolve14(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve15(runtimeContext.logsDir, taskId),
+      artifactDir: resolve15(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve14(paths.logsDir, taskId),
-    artifactDir: resolve14(paths.artifactsDir, taskId)
+    taskLogDir: resolve15(paths.logsDir, taskId),
+    artifactDir: resolve15(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync13(binaryPath)) {
+  if (!existsSync14(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -2053,7 +2107,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve14(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve15(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -2068,7 +2122,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync13(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync14(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -2108,8 +2162,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync6(taskLogDir, { recursive: true });
-  mkdirSync6(artifactDir, { recursive: true });
+  mkdirSync7(taskLogDir, { recursive: true });
+  mkdirSync7(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -2118,7 +2172,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync6(resolve14(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync7(resolve15(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -2153,18 +2207,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve14(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync6(taskLogDir, { recursive: true });
-      writeFileSync6(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve15(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync7(taskLogDir, { recursive: true });
+      writeFileSync7(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve14(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync6(taskLogDir, { recursive: true });
-    writeFileSync6(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve15(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync7(taskLogDir, { recursive: true });
+    writeFileSync7(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -2186,8 +2240,8 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync6(artifactDir, { recursive: true });
-  writeFileSync6(resolve14(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync7(artifactDir, { recursive: true });
+  writeFileSync7(resolve15(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }