@h-rig/runtime 0.0.6-alpha.3 → 0.0.6-alpha.31

package/dist/src/control-plane/hooks/submodule-branch.js

@@ -121,13 +121,13 @@ var init_utils = __esm(() => {
 
 // packages/runtime/src/control-plane/hooks/task-runtime-start.ts
 init_layout();
-import { existsSync as existsSync35 } from "fs";
-import { resolve as resolve36 } from "path";
+import { existsSync as existsSync36 } from "fs";
+import { resolve as resolve37 } from "path";
 import { resolveProjectRoot } from "@rig/hook-kit";
 
 // packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync22, lstatSync, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve23 } from "path";
+import { existsSync as existsSync23, lstatSync, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve24 } from "path";
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
 import { existsSync as existsSync2, readFileSync } from "fs";
@@ -432,8 +432,8 @@ function isAgentRuntimeContextPath(path) {
 }
 
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve22 } from "path";
+import { appendFileSync, existsSync as existsSync22, mkdirSync as mkdirSync9, readFileSync as readFileSync11, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve23 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -1268,6 +1268,49 @@ function safeReadJson(path) {
   }
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync4, readdirSync, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve10 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve10(projectRoot, ".pi", "skills");
+  if (existsSync10(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve10(skillsRoot, name);
+      if (existsSync10(resolve10(dir, MARKER_FILENAME))) {
+        rmSync4(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve10(projectRoot, skill.path);
+    if (!existsSync10(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync4(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve10(skillsRoot, skillDirName(skill.id));
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync3(resolve10(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync3(resolve10(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -1304,6 +1347,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -1317,12 +1371,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync5, readdirSync, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename4, join as join2, resolve as resolve11 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename4, join as join2, resolve as resolve12 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync10, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve10 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve11 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -1345,7 +1399,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve11(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -1356,8 +1410,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve10(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync10(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve11(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync11(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -1365,7 +1419,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve10(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync4(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -1449,7 +1503,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve11(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -1532,10 +1586,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve11(projectRoot, "rig.config.json");
-  if (existsSync11(jsonPath)) {
+  const jsonPath = resolve12(projectRoot, "rig.config.json");
+  if (existsSync12(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync5(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -1544,12 +1598,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve11(projectRoot, "rig.config.ts");
-  if (!existsSync11(tsPath)) {
+  const tsPath = resolve12(projectRoot, "rig.config.ts");
+  if (!existsSync12(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync5(tsPath, "utf8");
+    const source = readFileSync6(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -1569,10 +1623,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync11(configPath)) {
+  if (!existsSync12(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -1580,12 +1634,12 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve11(projectRoot, sourcePath);
-  if (!existsSync11(directory)) {
+  const directory = resolve12(projectRoot, sourcePath);
+  if (!existsSync12(directory)) {
     return [];
   }
   const tasks = [];
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
@@ -1596,11 +1650,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve11(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve12(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync5(file, "utf8"));
+  const raw = JSON.parse(readFileSync6(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -1613,17 +1667,17 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync11(directory)) {
+  if (!existsSync12(directory)) {
     return null;
   }
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const file = join2(directory, name);
     try {
       if (!statSync2(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync5(file, "utf8"));
+      const raw = JSON.parse(readFileSync6(file, "utf8"));
       const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -1706,8 +1760,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -1783,8 +1837,8 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename6, resolve as resolve18 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename6, resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -1892,27 +1946,27 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync17, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve18 } from "path";
 
 // packages/runtime/src/control-plane/native/git-native.ts
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname6, isAbsolute, resolve as resolve12 } from "path";
+import { dirname as dirname6, isAbsolute, resolve as resolve13 } from "path";
 import { createHash } from "crypto";
-var sharedGitNativeOutputDir = resolve12(tmpdir3(), "rig-native");
-var sharedGitNativeOutputPath = resolve12(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var sharedGitNativeOutputDir = resolve13(tmpdir3(), "rig-native");
+var sharedGitNativeOutputPath = resolve13(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
 function temporaryGitBinaryOutputPath(outputPath) {
   const suffix = process.platform === "win32" ? ".exe" : "";
-  return resolve12(dirname6(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+  return resolve13(dirname6(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
 }
 function publishGitBinary(tempOutputPath, outputPath) {
   try {
     renameSync(tempOutputPath, outputPath);
   } catch (error) {
-    if (process.platform === "win32" && existsSync12(outputPath)) {
-      rmSync4(outputPath, { force: true });
+    if (process.platform === "win32" && existsSync13(outputPath)) {
+      rmSync5(outputPath, { force: true });
       renameSync(tempOutputPath, outputPath);
       return;
     }
@@ -1927,22 +1981,22 @@ function rigGitSourceCandidates() {
   const cwd = process.cwd()?.trim() || "";
   const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  const moduleRelativeSource = resolve12(import.meta.dir, "../../../native/rig-git.zig");
+  const moduleRelativeSource = resolve13(import.meta.dir, "../../../native/rig-git.zig");
   return [...new Set([
     process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
     moduleRelativeSource,
-    projectRoot ? resolve12(projectRoot, "packages/runtime/native/rig-git.zig") : "",
-    hostProjectRoot ? resolve12(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
-    cwd ? resolve12(cwd, "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve12(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve12(execDir, "..", "native", "rig-git.zig") : ""
+    projectRoot ? resolve13(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve13(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve13(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve13(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve13(execDir, "..", "native", "rig-git.zig") : ""
   ].filter(Boolean))];
 }
 function nativePackageBinaryCandidates3(fromDir, fileName) {
   const candidates = [];
-  let cursor = resolve12(fromDir);
+  let cursor = resolve13(fromDir);
   for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve12(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve12(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve12(cursor, "native", fileName), resolve12(cursor, "native", "bin", fileName));
+    candidates.push(resolve13(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve13(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve13(cursor, "native", fileName), resolve13(cursor, "native", "bin", fileName));
     const parent = dirname6(cursor);
     if (parent === cursor)
       break;
@@ -1957,15 +2011,15 @@ function rigGitBinaryCandidates() {
   return [...new Set([
     explicit,
     ...nativePackageBinaryCandidates3(import.meta.dir, fileName),
-    execDir ? resolve12(execDir, fileName) : "",
-    execDir ? resolve12(execDir, "..", fileName) : "",
-    execDir ? resolve12(execDir, "..", "bin", fileName) : "",
+    execDir ? resolve13(execDir, fileName) : "",
+    execDir ? resolve13(execDir, "..", fileName) : "",
+    execDir ? resolve13(execDir, "..", "bin", fileName) : "",
     sharedGitNativeOutputPath
   ].filter(Boolean))];
 }
 function resolveGitSourcePath() {
   for (const candidate of rigGitSourceCandidates()) {
-    if (candidate && existsSync12(candidate)) {
+    if (candidate && existsSync13(candidate)) {
       return candidate;
     }
   }
@@ -1976,7 +2030,7 @@ function resolveGitBinaryPath() {
     return null;
   }
   for (const candidate of rigGitBinaryCandidates()) {
-    if (candidate && existsSync12(candidate)) {
+    if (candidate && existsSync13(candidate)) {
       return candidate;
     }
   }
@@ -2006,7 +2060,7 @@ function nativeBuildManifestPath3(outputPath) {
   return `${outputPath}.build-manifest.json`;
 }
 async function hasMatchingNativeBuildManifest3(manifestPath, buildKey) {
-  if (!existsSync12(manifestPath)) {
+  if (!existsSync13(manifestPath)) {
     return false;
   }
   try {
@@ -2017,11 +2071,11 @@ async function hasMatchingNativeBuildManifest3(manifestPath, buildKey) {
   }
 }
 function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
-  if (!existsSync12(manifestPath)) {
+  if (!existsSync13(manifestPath)) {
     return false;
   }
   try {
-    const manifest = JSON.parse(readFileSync6(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
     return manifest.version === 1 && manifest.buildKey === buildKey;
   } catch {
     return false;
@@ -2033,7 +2087,7 @@ async function sha256File3(path) {
   return hasher.digest("hex");
 }
 function sha256FileSync(path) {
-  return createHash("sha256").update(readFileSync6(path)).digest("hex");
+  return createHash("sha256").update(readFileSync7(path)).digest("hex");
 }
 async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
@@ -2051,7 +2105,7 @@ async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
   if (!zigBinary) {
     throw new Error("zig is required to build native Rig git tools.");
   }
-  mkdirSync5(dirname6(outputPath), { recursive: true });
+  mkdirSync6(dirname6(outputPath), { recursive: true });
   const sourceDigest = await sha256File3(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
@@ -2062,7 +2116,7 @@ async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
     sourceDigest
   });
   const manifestPath = nativeBuildManifestPath3(outputPath);
-  const needsBuild = !existsSync12(outputPath) || !await hasMatchingNativeBuildManifest3(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  const needsBuild = !existsSync13(outputPath) || !await hasMatchingNativeBuildManifest3(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
   if (!needsBuild) {
     chmodSync3(outputPath, 493);
     return outputPath;
@@ -2085,20 +2139,20 @@ async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  if (exitCode !== 0 || !existsSync12(tempOutputPath)) {
+  if (exitCode !== 0 || !existsSync13(tempOutputPath)) {
     const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
 `);
     throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${exitCode}`}`);
   }
   chmodSync3(tempOutputPath, 493);
-  if (existsSync12(outputPath) && await hasMatchingNativeBuildManifest3(manifestPath, buildKey)) {
-    rmSync4(tempOutputPath, { force: true });
+  if (existsSync13(outputPath) && await hasMatchingNativeBuildManifest3(manifestPath, buildKey)) {
+    rmSync5(tempOutputPath, { force: true });
     chmodSync3(outputPath, 493);
     return outputPath;
   }
   publishGitBinary(tempOutputPath, outputPath);
   if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync4(outputPath, { force: true });
+    rmSync5(outputPath, { force: true });
     throw new Error("Failed to build native Rig git tools: tracker command probe failed");
   }
   await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
@@ -2121,7 +2175,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
   if (!zigBinary) {
     throw new Error("zig is required to build native Rig git tools.");
   }
-  mkdirSync5(dirname6(outputPath), { recursive: true });
+  mkdirSync6(dirname6(outputPath), { recursive: true });
   const sourceDigest = sha256FileSync(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
@@ -2132,7 +2186,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     sourceDigest
   });
   const manifestPath = nativeBuildManifestPath3(outputPath);
-  const needsBuild = !existsSync12(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  const needsBuild = !existsSync13(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
   if (!needsBuild) {
     chmodSync3(outputPath, 493);
     return outputPath;
@@ -2150,7 +2204,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     stdout: "pipe",
     stderr: "pipe"
   });
-  if (build.exitCode !== 0 || !existsSync12(tempOutputPath)) {
+  if (build.exitCode !== 0 || !existsSync13(tempOutputPath)) {
     const stderr = build.stderr.toString().trim();
     const stdout = build.stdout.toString().trim();
     const details = [stderr, stdout].filter(Boolean).join(`
@@ -2158,31 +2212,31 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
   }
   chmodSync3(tempOutputPath, 493);
-  if (existsSync12(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
-    rmSync4(tempOutputPath, { force: true });
+  if (existsSync13(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync5(tempOutputPath, { force: true });
     chmodSync3(outputPath, 493);
     return outputPath;
   }
   publishGitBinary(tempOutputPath, outputPath);
   if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync4(outputPath, { force: true });
+    rmSync5(outputPath, { force: true });
     throw new Error("Failed to build native Rig git tools: tracker command probe failed");
   }
-  writeFileSync4(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+  writeFileSync5(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
 `, "utf8");
   return outputPath;
 }
 async function materializeRigGitBinary(targetDir) {
   const sourcePath = await ensureRigGitBinaryPath();
-  const targetPath = resolve12(targetDir, runtimeRigGitFileName());
-  mkdirSync5(targetDir, { recursive: true });
+  const targetPath = resolve13(targetDir, runtimeRigGitFileName());
+  mkdirSync6(targetDir, { recursive: true });
   const sourceDigest = await sha256File3(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
     sourcePath,
     sourceDigest
   });
-  const needsCopy = !existsSync12(targetPath) || !await hasMatchingNativeBuildManifest3(nativeBuildManifestPath3(targetPath), buildKey);
+  const needsCopy = !existsSync13(targetPath) || !await hasMatchingNativeBuildManifest3(nativeBuildManifestPath3(targetPath), buildKey);
   if (needsCopy) {
     copyFileSync3(sourcePath, targetPath);
     chmodSync3(targetPath, 493);
@@ -2209,7 +2263,7 @@ function runGitNative(command, args) {
     }
   } else {
     const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-    binaryPath = explicitBinaryPath && existsSync12(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    binaryPath = explicitBinaryPath && existsSync13(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
     if (!binaryPath) {
       try {
         binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
@@ -2273,41 +2327,41 @@ function nativeFetchRef(repoPath, remote, branch) {
   return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
 }
 function nativeReadBlobAtRef(repoPath, ref, path) {
-  const requestDir = resolve12(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync5(requestDir, { recursive: true });
-  const outputPath = resolve12(requestDir, "blob.txt");
+  const requestDir = resolve13(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync6(requestDir, { recursive: true });
+  const outputPath = resolve13(requestDir, "blob.txt");
   try {
     requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync6(outputPath, "utf8");
+    return readFileSync7(outputPath, "utf8");
   } finally {
-    rmSync4(requestDir, { recursive: true, force: true });
+    rmSync5(requestDir, { recursive: true, force: true });
   }
 }
 function nativeReadBlobBytesAtRef(repoPath, ref, path) {
-  const requestDir = resolve12(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync5(requestDir, { recursive: true });
-  const outputPath = resolve12(requestDir, "blob.bin");
+  const requestDir = resolve13(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync6(requestDir, { recursive: true });
+  const outputPath = resolve13(requestDir, "blob.bin");
   try {
     requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync6(outputPath);
+    return readFileSync7(outputPath);
   } finally {
-    rmSync4(requestDir, { recursive: true, force: true });
+    rmSync5(requestDir, { recursive: true, force: true });
   }
 }
 
 // packages/runtime/src/control-plane/native/utils.ts
 init_layout();
 import { ptr as ptr2 } from "bun:ffi";
-import { existsSync as existsSync14, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve15 } from "path";
 
 // packages/runtime/src/control-plane/native/runtime-native.ts
 import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
-import { copyFileSync as copyFileSync4, existsSync as existsSync13, mkdirSync as mkdirSync6, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync3 } from "fs";
+import { copyFileSync as copyFileSync4, existsSync as existsSync14, mkdirSync as mkdirSync7, renameSync as renameSync2, rmSync as rmSync6, statSync as statSync3 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname7, resolve as resolve13 } from "path";
-var sharedNativeRuntimeOutputDir = resolve13(tmpdir4(), "rig-native");
-var sharedNativeRuntimeOutputPath = resolve13(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+import { dirname as dirname7, resolve as resolve14 } from "path";
+var sharedNativeRuntimeOutputDir = resolve14(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve14(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
 var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
 var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
 function requireNativeRuntimeLibrary(feature) {
@@ -2338,16 +2392,16 @@ async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOu
   if (await buildNativeRuntimeLibrary(outputPath, options)) {
     return outputPath;
   }
-  return !options.force && existsSync13(outputPath) ? outputPath : null;
+  return !options.force && existsSync14(outputPath) ? outputPath : null;
 }
 async function materializeNativeRuntimeLibrary(targetDir) {
   const sourcePath = await ensureNativeRuntimeLibraryPath();
   if (!sourcePath) {
     return null;
   }
-  const targetPath = resolve13(targetDir, colocatedNativeRuntimeFileName);
-  mkdirSync6(targetDir, { recursive: true });
-  const needsCopy = !existsSync13(targetPath) || statSync3(sourcePath).mtimeMs > statSync3(targetPath).mtimeMs;
+  const targetPath = resolve14(targetDir, colocatedNativeRuntimeFileName);
+  mkdirSync7(targetDir, { recursive: true });
+  const needsCopy = !existsSync14(targetPath) || statSync3(sourcePath).mtimeMs > statSync3(targetPath).mtimeMs;
   if (needsCopy) {
     copyFileSync4(sourcePath, targetPath);
   }
@@ -2358,7 +2412,7 @@ async function loadNativeRuntimeLibrary() {
     return null;
   }
   for (const candidate of nativeRuntimeLibraryCandidates()) {
-    if (!candidate || !existsSync13(candidate)) {
+    if (!candidate || !existsSync14(candidate)) {
       continue;
     }
     const loaded = tryDlopenNativeRuntimeLibrary(candidate);
@@ -2374,10 +2428,10 @@ async function loadNativeRuntimeLibrary() {
 }
 function nativePackageLibraryCandidates(fromDir, names) {
   const candidates = [];
-  let cursor = resolve13(fromDir);
+  let cursor = resolve14(fromDir);
   for (let index = 0;index < 8; index += 1) {
     for (const name of names) {
-      candidates.push(resolve13(cursor, "native", `${process.platform}-${process.arch}`, name), resolve13(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve13(cursor, "native", name), resolve13(cursor, "native", "lib", name));
+      candidates.push(resolve14(cursor, "native", `${process.platform}-${process.arch}`, name), resolve14(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve14(cursor, "native", name), resolve14(cursor, "native", "lib", name));
     }
     const parent = dirname7(cursor);
     if (parent === cursor)
@@ -2393,22 +2447,22 @@ function nativeRuntimeLibraryCandidates() {
   return [...new Set([
     explicit,
     ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
-    execDir ? resolve13(execDir, colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve13(execDir, platformSpecific) : "",
-    execDir ? resolve13(execDir, "..", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve13(execDir, "..", platformSpecific) : "",
-    execDir ? resolve13(execDir, "lib", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve13(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve14(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve14(execDir, platformSpecific) : "",
+    execDir ? resolve14(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve14(execDir, "..", platformSpecific) : "",
+    execDir ? resolve14(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve14(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
     sharedNativeRuntimeOutputPath
   ].filter(Boolean))];
 }
 function resolveNativeRuntimeSourcePath() {
   const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
-  if (explicit && existsSync13(explicit)) {
+  if (explicit && existsSync14(explicit)) {
     return explicit;
   }
-  const bundled = resolve13(import.meta.dir, "../../../native/snapshot.zig");
-  return existsSync13(bundled) ? bundled : null;
+  const bundled = resolve14(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync14(bundled) ? bundled : null;
 }
 function resolveNativeRuntimeSidecarSourcePath() {
   const envRoots = [
@@ -2421,17 +2475,17 @@ function resolveNativeRuntimeSidecarSourcePath() {
       "packages/runtime/src/control-plane/native/runtime-native-sidecar.ts",
       "packages/runtime/dist/src/control-plane/native/runtime-native-sidecar.js"
     ]) {
-      const candidate = resolve13(root, relative);
-      if (existsSync13(candidate)) {
+      const candidate = resolve14(root, relative);
+      if (existsSync14(candidate)) {
         return candidate;
       }
     }
   }
   for (const localCandidate of [
-    resolve13(import.meta.dir, "runtime-native-sidecar.js"),
-    resolve13(import.meta.dir, "runtime-native-sidecar.ts")
+    resolve14(import.meta.dir, "runtime-native-sidecar.js"),
+    resolve14(import.meta.dir, "runtime-native-sidecar.ts")
   ]) {
-    if (existsSync13(localCandidate))
+    if (existsSync14(localCandidate))
       return localCandidate;
   }
   return null;
@@ -2447,8 +2501,8 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   }
   const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    mkdirSync6(dirname7(outputPath), { recursive: true });
-    const needsBuild = options.force === true || !existsSync13(outputPath) || statSync3(sourcePath).mtimeMs > statSync3(outputPath).mtimeMs;
+    mkdirSync7(dirname7(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync14(outputPath) || statSync3(sourcePath).mtimeMs > statSync3(outputPath).mtimeMs;
     if (!needsBuild) {
       return true;
     }
@@ -2466,14 +2520,14 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
       stderr: "pipe"
     });
     const exitCode = await build.exited;
-    if (exitCode !== 0 || !existsSync13(tempOutputPath)) {
-      rmSync5(tempOutputPath, { force: true });
+    if (exitCode !== 0 || !existsSync14(tempOutputPath)) {
+      rmSync6(tempOutputPath, { force: true });
       return false;
     }
     renameSync2(tempOutputPath, outputPath);
     return true;
   } catch {
-    rmSync5(tempOutputPath, { force: true });
+    rmSync6(tempOutputPath, { force: true });
     return false;
   }
 }
@@ -2592,11 +2646,11 @@ function runCapture(command, cwd, env) {
   };
 }
 function readJsonFile(path, fallback) {
-  if (!existsSync14(path)) {
+  if (!existsSync15(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync7(path, "utf-8"));
+    return JSON.parse(readFileSync8(path, "utf-8"));
   } catch {
     return fallback;
   }
@@ -2610,31 +2664,31 @@ function unique(values) {
 function resolveHarnessPaths(projectRoot) {
   const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const harnessRoot = resolve14(projectRoot, "rig");
-  const stateRoot = resolve14(projectRoot, ".rig");
+  const harnessRoot = resolve15(projectRoot, "rig");
+  const stateRoot = resolve15(projectRoot, ".rig");
   const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
-  const stateDir = layout?.stateDir ?? resolve14(stateRoot, "state");
-  const logsDir = layout?.logsDir ?? resolve14(stateRoot, "logs");
-  const artifactsDir = layout?.artifactsRoot ?? resolve14(monorepoRoot, "artifacts");
-  const taskConfigPath = layout?.taskConfigPath ?? resolve14(monorepoRoot, ".rig", "task-config.json");
-  const binDir = layout?.binDir ?? resolve14(stateRoot, "bin");
+  const stateDir = layout?.stateDir ?? resolve15(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve15(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve15(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve15(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve15(stateRoot, "bin");
   return {
     harnessRoot,
     stateDir: process.env.RIG_STATE_DIR || stateDir,
     artifactsDir,
     logsDir: process.env.RIG_LOGS_DIR || logsDir,
     binDir,
-    hooksDir: resolve14(harnessRoot, "hooks"),
-    validationDir: resolve14(harnessRoot, "validation"),
+    hooksDir: resolve15(harnessRoot, "hooks"),
+    validationDir: resolve15(harnessRoot, "validation"),
     taskConfigPath,
-    sessionPath: process.env.RIG_SESSION_FILE || resolve14(stateRoot, "session", "session.json"),
+    sessionPath: process.env.RIG_SESSION_FILE || resolve15(stateRoot, "session", "session.json"),
     monorepoRoot,
-    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve14(monorepoRoot, "TSAPITests"),
-    taskRepoCommitsPath: resolve14(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve14(stateDir, "base-repo-pins.json"),
-    failedApproachesPath: resolve14(stateDir, "failed_approaches.md"),
-    agentProfilePath: resolve14(stateDir, "agent-profile.json"),
-    reviewProfilePath: resolve14(stateDir, "review-profile.json")
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve15(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve15(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve15(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve15(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve15(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve15(stateDir, "review-profile.json")
   };
 }
 function normalizeRelativeScopePath(inputPath) {
@@ -2696,35 +2750,35 @@ function createNativeScopeMatcher() {
 }
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync16 } from "fs";
-import { resolve as resolve16 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
 init_layout();
-import { existsSync as existsSync15 } from "fs";
-import { basename as basename5, dirname as dirname8, join as join3, resolve as resolve15 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { basename as basename5, dirname as dirname8, join as join3, resolve as resolve16 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve15(projectRoot);
+  const normalizedProjectRoot = resolve16(projectRoot);
   const projectParent = dirname8(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
     const ownerRoot = dirname8(projectParent);
-    const ownerHasRepoMarkers = existsSync15(resolve15(ownerRoot, ".git")) || existsSync15(resolve15(ownerRoot, ".rig", "state"));
+    const ownerHasRepoMarkers = existsSync16(resolve16(ownerRoot, ".git")) || existsSync16(resolve16(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve15(ownerRoot, ".rig", "state");
+      return resolve16(ownerRoot, ".rig", "state");
     }
   }
-  return resolve15(projectRoot, ".rig", "state");
+  return resolve16(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve15(projectRoot);
+  const normalizedProjectRoot = resolve16(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join3("repos", entry.id);
-  const metadataRoot = resolve15(stateDir, metadataRelativePath);
+  const metadataRoot = resolve16(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve15(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname8(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve16(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname8(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve15(process.env[entry.checkoutEnvVar].trim()) : resolve15(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve16(process.env[entry.checkoutEnvVar].trim()) : resolve16(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -2732,12 +2786,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve15(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve16(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve15(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve15(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve16(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve16(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join3(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -2759,7 +2813,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync16(resolve16(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync17(resolve17(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -2770,8 +2824,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync17,
-  readFile: (path) => readFileSync8(path, "utf8")
+  exists: existsSync18,
+  readFile: (path) => readFileSync9(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -2852,12 +2906,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync17(resolve17(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync18(resolve18(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve17(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve17(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve18(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve18(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -2919,7 +2973,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve18(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve19(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -2995,15 +3049,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve19(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync18(issuesPath)) {
+  const issuesPath = resolve19(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync19(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync9(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -3044,25 +3098,25 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve18(workspaceDir, "artifacts", id);
-    if (existsSync18(worktreeArtifacts) || existsSync18(resolve18(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve19(workspaceDir, "artifacts", id);
+    if (existsSync19(worktreeArtifacts) || existsSync19(resolve19(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve18(paths.artifactsDir, id);
+    return resolve19(paths.artifactsDir, id);
   } catch {
-    return resolve18(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve19(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync18(paths.taskConfigPath)) {
+  if (existsSync19(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync18(candidate)) {
+    if (existsSync19(candidate)) {
       return candidate;
     }
   }
@@ -3070,7 +3124,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync18(candidate)) {
+    if (existsSync19(candidate)) {
       return candidate;
     }
   }
@@ -3083,7 +3137,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync5(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -3135,12 +3189,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync18(issuesPath)) {
+  const issuesPath = resolve19(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync19(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -3196,19 +3250,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve18(projectRoot, sourcePath);
-  if (!existsSync18(directory)) {
+  const directory = resolve19(projectRoot, sourcePath);
+  if (!existsSync19(directory)) {
     return {};
   }
   const config = {};
-  for (const name of readdirSync2(directory)) {
+  for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve18(directory, name);
+    const file = resolve19(directory, name);
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      const raw = JSON.parse(readFileSync10(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -3250,10 +3304,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve18(projectRoot, "rig.config.json");
-  if (existsSync18(jsonPath)) {
+  const jsonPath = resolve19(projectRoot, "rig.config.json");
+  if (existsSync19(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -3265,12 +3319,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve18(projectRoot, "rig.config.ts");
-  if (!existsSync18(tsPath)) {
+  const tsPath = resolve19(projectRoot, "rig.config.ts");
+  if (!existsSync19(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync9(tsPath, "utf8");
+    const source = readFileSync10(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -3284,9 +3338,9 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve18(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve18(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve18(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve19(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve19(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve19(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
@@ -3295,8 +3349,8 @@ init_layout();
 
 // packages/runtime/src/binary-run.ts
 init_layout();
-import { chmodSync as chmodSync4, cpSync, existsSync as existsSync19, mkdirSync as mkdirSync7, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename7, dirname as dirname9, resolve as resolve19 } from "path";
+import { chmodSync as chmodSync4, cpSync, existsSync as existsSync20, mkdirSync as mkdirSync8, renameSync as renameSync3, rmSync as rmSync7, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename7, dirname as dirname9, resolve as resolve20 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -3322,9 +3376,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve19(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve19(tempBuildDir, basename7(options.outputPath));
-  mkdirSync7(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve20(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve20(tempBuildDir, basename7(options.outputPath));
+  mkdirSync8(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -3349,7 +3403,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync19(tempOutputPath)) {
+    if (!existsSync20(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -3364,7 +3418,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
       });
     }
   })).finally(() => {
-    rmSync6(tempBuildDir, { recursive: true, force: true });
+    rmSync7(tempBuildDir, { recursive: true, force: true });
   });
 }
 function runBestEffortBuildGc() {
@@ -3381,8 +3435,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve19(options.cwd, options.sourcePath),
-    outputPath: resolve19(options.outputPath)
+    entrypoint: resolve20(options.cwd, options.sourcePath),
+    outputPath: resolve20(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -3396,7 +3450,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync19(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync20(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -3427,13 +3481,13 @@ async function buildRuntimeBinaryViaWorker(options) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  rmSync6(payloadPath, { force: true });
+  rmSync7(payloadPath, { force: true });
   if (exitCode !== 0) {
     throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve19(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve20(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -3442,13 +3496,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve19(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync19(candidate)) {
+    const candidate = resolve20(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync20(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve19(import.meta.dir, "binary-build-worker.ts");
-  return existsSync19(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve20(import.meta.dir, "binary-build-worker.ts");
+  return existsSync20(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -3484,7 +3538,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync19(input.outputPath) || !existsSync19(input.manifestPath)) {
+  if (!existsSync20(input.outputPath) || !existsSync20(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -3497,7 +3551,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync19(filePath)) {
+    if (!existsSync20(filePath)) {
       return false;
     }
     if (await sha256File4(filePath) !== expectedDigest) {
@@ -3510,7 +3564,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync19(normalized)) {
+    if (!normalized || !existsSync20(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File4(normalized);
@@ -3533,7 +3587,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve19(cwd, inputPath);
+  return resolve20(cwd, inputPath);
 }
 async function sha256File4(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -3549,8 +3603,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve20) => {
-    release = resolve20;
+  runtimeBinaryBuildQueue = new Promise((resolve21) => {
+    release = resolve21;
   });
   await previous;
   try {
@@ -3595,11 +3649,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve21 } from "path";
+import { delimiter, resolve as resolve22 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync20, readdirSync as readdirSync3, realpathSync } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve21 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox-utils.ts
 init_utils();
@@ -3616,7 +3670,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve20(home, ".bun/bin/bun") : "",
+    home ? resolve21(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -3644,8 +3698,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve20(home, ".local/bin/claude") : "",
-    home ? resolve20(home, ".local/share/claude/local/claude") : "",
+    home ? resolve21(home, ".local/bin/claude") : "",
+    home ? resolve21(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -3659,51 +3713,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve20(bunBinaryPath, "../..");
+  return resolve21(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve20(realPath, "..");
+  return resolve21(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve20(explicitNode) === resolve20(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve20(preferredNode, "../..") : resolve20(preferredNode, "..");
+  if (explicitNode && resolve21(explicitNode) === resolve21(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve21(preferredNode, "../..") : resolve21(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve20(realPath, "../..");
+      return resolve21(realPath, "../..");
     }
-    return resolve20(realPath, "..");
+    return resolve21(realPath, "..");
   } catch {
-    return resolve20(preferredNode, "..");
+    return resolve21(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve20(envNode);
-    if (existsSync20(explicit)) {
+    const explicit = resolve21(envNode);
+    if (existsSync21(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve20(nvmBin, "node"));
+    candidates.push(resolve21(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve20(home, ".nvm/versions/node");
-    if (existsSync20(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve21(home, ".nvm/versions/node");
+    if (existsSync21(nvmVersionsDir)) {
       try {
-        const versionDirs = readdirSync3(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve20(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve21(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -3712,8 +3766,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve20(candidate)));
-  const existing = deduped.filter((candidate) => existsSync20(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve21(candidate)));
+  const existing = deduped.filter((candidate) => existsSync21(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -3727,7 +3781,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve20(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve21(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -3739,8 +3793,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve20(candidate);
-  if (!existsSync20(normalized)) {
+  const normalized = resolve21(candidate);
+  if (!existsSync21(normalized)) {
     return "";
   }
   try {
@@ -3750,7 +3804,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve20(candidate).replace(/\\/g, "/");
+  const normalized = resolve21(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -3771,7 +3825,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve21(claudeBinary, "..");
+      return resolve22(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -3781,8 +3835,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve21(realHome, ".local/bin") : "",
-    realHome ? resolve21(realHome, ".cargo/bin") : "",
+    realHome ? resolve22(realHome, ".local/bin") : "",
+    realHome ? resolve22(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -4091,16 +4145,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync21(artifactDir)) {
+    if (!existsSync22(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve22(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve22(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve22(artifactDir, "changed-files.txt");
-    if (existsSync21(changedFiles)) {
-      const lines = readFileSync10(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve23(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve23(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve23(artifactDir, "changed-files.txt");
+    if (existsSync22(changedFiles)) {
+      const lines = readFileSync11(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -4224,12 +4278,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve22(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync21(issuesPath)) {
+  const issuesPath = resolve23(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync22(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -4342,11 +4396,11 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync21(path)) {
+  if (!existsSync22(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync10(path, "utf-8"));
+  process.stdout.write(readFileSync11(path, "utf-8"));
   console.log("");
 }
 
@@ -4366,8 +4420,8 @@ function isRuntimeGatewayGitPath(candidate) {
 }
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync22(resolve23(runtimeWorkspace, ".git"))) {
-    return resolve23(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync23(resolve24(runtimeWorkspace, ".git"))) {
+    return resolve24(runtimeWorkspace);
   }
   try {
     return resolveMonorepoRoot2(projectRoot);
@@ -4392,7 +4446,7 @@ function resolveGitBinary(projectRoot) {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync22(candidate)) {
+    if (existsSync23(candidate)) {
       return candidate;
     }
   }
@@ -4416,7 +4470,7 @@ function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
   }
   const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
   const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
-  if (!existsSync22(resolve23(repoRoot, ".git"))) {
+  if (!existsSync23(resolve24(repoRoot, ".git"))) {
     throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
   }
   const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
@@ -4458,7 +4512,7 @@ function resolveTaskBranchId(projectRoot, taskId) {
     }
   } catch {}
   const artifactDir = artifactDirForId(projectRoot, taskId);
-  if (existsSync22(artifactDir)) {
+  if (existsSync23(artifactDir)) {
     return taskId;
   }
   throw new Error(`Unknown task id: ${taskId}`);
@@ -4475,11 +4529,11 @@ function runCapture2(command, cwd, projectRoot = cwd) {
 }
 function runtimeGitEnv(projectRoot) {
   const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
-  const runtimeHome = runtimeRoot ? resolve23(runtimeRoot, "home") : "";
-  const runtimeTmp = runtimeRoot ? resolve23(runtimeRoot, "tmp") : "";
-  const runtimeCache = runtimeRoot ? resolve23(runtimeRoot, "cache") : "";
-  const runtimeKnownHosts = runtimeHome ? resolve23(runtimeHome, ".ssh", "known_hosts") : "";
-  const runtimeKey = runtimeHome ? resolve23(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const runtimeHome = runtimeRoot ? resolve24(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve24(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve24(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve24(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve24(runtimeHome, ".ssh", "rig-agent-key") : "";
   const env = {};
   if (ctx?.workspaceDir) {
     env.PROJECT_RIG_ROOT = projectRoot;
@@ -4492,14 +4546,14 @@ function runtimeGitEnv(projectRoot) {
   if (runtimeRoot) {
     env.RIG_RUNTIME_HOME = runtimeRoot;
   }
-  if (runtimeHome && existsSync22(runtimeHome)) {
+  if (runtimeHome && existsSync23(runtimeHome)) {
     env.HOME = runtimeHome;
     env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
   }
-  if (runtimeTmp && existsSync22(runtimeTmp)) {
+  if (runtimeTmp && existsSync23(runtimeTmp)) {
     env.TMPDIR = runtimeTmp;
   }
-  if (runtimeCache && existsSync22(runtimeCache)) {
+  if (runtimeCache && existsSync23(runtimeCache)) {
     env.XDG_CACHE_HOME = runtimeCache;
   }
   const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
@@ -4543,14 +4597,14 @@ function runtimeGitEnv(projectRoot) {
     env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
     applyGitHubCredentialHelperEnv(env);
   }
-  if (runtimeKnownHosts && existsSync22(runtimeKnownHosts)) {
+  if (runtimeKnownHosts && existsSync23(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (runtimeKey && existsSync22(runtimeKey)) {
+    if (runtimeKey && existsSync23(runtimeKey)) {
       sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -4571,12 +4625,12 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};
   }
-  const path = resolve23(runtimeRoot, "runtime-secrets.json");
-  if (!existsSync22(path)) {
+  const path = resolve24(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync23(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
     return Object.fromEntries(entries);
   } catch {
@@ -4584,13 +4638,13 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   }
 }
 function ensureRuntimeOpenSslConfig(runtimeHome) {
-  const sslDir = resolve23(runtimeHome, ".ssl");
-  const sslConfig = resolve23(sslDir, "openssl.cnf");
-  if (!existsSync22(sslDir)) {
-    mkdirSync9(sslDir, { recursive: true });
+  const sslDir = resolve24(runtimeHome, ".ssl");
+  const sslConfig = resolve24(sslDir, "openssl.cnf");
+  if (!existsSync23(sslDir)) {
+    mkdirSync10(sslDir, { recursive: true });
   }
-  if (!existsSync22(sslConfig)) {
-    writeFileSync8(sslConfig, `# Rig runtime OpenSSL config placeholder
+  if (!existsSync23(sslConfig)) {
+    writeFileSync9(sslConfig, `# Rig runtime OpenSSL config placeholder
 `);
   }
   return sslConfig;
@@ -4608,11 +4662,11 @@ function resolveRuntimeMetadata(projectRoot) {
   if (contextFile) {
     return {
       ctx,
-      runtimeRoot: dirname10(resolve23(contextFile))
+      runtimeRoot: dirname10(resolve24(contextFile))
     };
   }
   const inferredContextFile = findRuntimeContextFile2(projectRoot);
-  if (existsSync22(inferredContextFile)) {
+  if (existsSync23(inferredContextFile)) {
     try {
       ctx = loadRuntimeContext(inferredContextFile);
     } catch {}
@@ -4624,10 +4678,10 @@ function resolveRuntimeMetadata(projectRoot) {
   return { ctx, runtimeRoot: "" };
 }
 function findRuntimeContextFile2(startPath) {
-  let current = resolve23(startPath);
+  let current = resolve24(startPath);
   while (true) {
-    const candidate = resolve23(current, "runtime-context.json");
-    if (existsSync22(candidate)) {
+    const candidate = resolve24(current, "runtime-context.json");
+    if (existsSync23(candidate)) {
       return candidate;
     }
     const parent = dirname10(current);
@@ -4639,45 +4693,45 @@ function findRuntimeContextFile2(startPath) {
 }
 
 // packages/runtime/src/control-plane/native/repo-ops.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync13, readFileSync as readFileSync13, readdirSync as readdirSync5, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "fs";
-import { basename as basename8, dirname as dirname12, resolve as resolve27 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync14, readdirSync as readdirSync6, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
+import { basename as basename8, dirname as dirname12, resolve as resolve28 } from "path";
 // packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve25 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve26 } from "path";
 
 // packages/runtime/src/control-plane/authority-files.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9, appendFileSync as appendFileSync2, copyFileSync as copyFileSync5, statSync as statSync5, readdirSync as readdirSync4, chmodSync as chmodSync5 } from "fs";
-import { dirname as dirname11, join as join4, relative, resolve as resolve24 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync10, appendFileSync as appendFileSync2, copyFileSync as copyFileSync5, statSync as statSync5, readdirSync as readdirSync5, chmodSync as chmodSync5 } from "fs";
+import { dirname as dirname11, join as join4, relative, resolve as resolve25 } from "path";
 init_layout();
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 function resolveAuthorityProjectStateDir(projectRoot) {
   const explicit = process.env.RIG_STATE_DIR?.trim();
   if (explicit) {
-    return resolve24(explicit);
+    return resolve25(explicit);
   }
-  return resolve24(resolve24(projectRoot), ".rig", "state");
+  return resolve25(resolve25(projectRoot), ".rig", "state");
 }
 function readJsonAtPath(path, fallback) {
-  if (!existsSync23(path)) {
+  if (!existsSync24(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync12(path, "utf-8"));
+    return JSON.parse(readFileSync13(path, "utf-8"));
   } catch {
     return fallback;
   }
 }
 function writeJsonAtPath(path, value) {
-  mkdirSync10(dirname11(path), { recursive: true });
-  writeFileSync9(path, `${JSON.stringify(value, null, 2)}
+  mkdirSync11(dirname11(path), { recursive: true });
+  writeFileSync10(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
   return path;
 }
 function readAuthorityProjectStateJson(projectRoot, relativePath, fallback) {
-  return readJsonAtPath(resolve24(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
+  return readJsonAtPath(resolve25(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
 }
 function writeAuthorityProjectStateJson(projectRoot, relativePath, value) {
-  return writeJsonAtPath(resolve24(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
+  return writeJsonAtPath(resolve25(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
 }
 
 // packages/runtime/src/control-plane/repos/mirror/state.ts
@@ -4737,7 +4791,7 @@ function sameExistingPath(left, right) {
   try {
     return realpathSync2(left) === realpathSync2(right);
   } catch {
-    return resolve25(left) === resolve25(right);
+    return resolve26(left) === resolve26(right);
   }
 }
 function repoLooksUsable(repoRoot, projectRoot) {
@@ -4773,7 +4827,7 @@ function resolveMirrorRemoteUrl(layout) {
       }
     }
   }
-  if (existsSync24(resolve25(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
+  if (existsSync25(resolve26(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
     const checkoutOrigin = runGit(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
     if (checkoutOrigin.exitCode === 0) {
       const currentOrigin = checkoutOrigin.stdout.trim();
@@ -4786,9 +4840,9 @@ function resolveMirrorRemoteUrl(layout) {
 }
 function ensureManagedRepoMirror(projectRoot, repoId) {
   const layout = resolveManagedRepoLayout(projectRoot, repoId);
-  mkdirSync11(layout.metadataRoot, { recursive: true });
+  mkdirSync12(layout.metadataRoot, { recursive: true });
   const remoteUrl = resolveMirrorRemoteUrl(layout);
-  if (!existsSync24(resolve25(layout.mirrorRoot, "HEAD"))) {
+  if (!existsSync25(resolve26(layout.mirrorRoot, "HEAD"))) {
     ensureGitSuccess(runGit(["git", "init", "--bare", layout.mirrorRoot], layout.projectRoot), ["git", "init", "--bare", layout.mirrorRoot]);
   }
   const getOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -4808,8 +4862,8 @@ function ensureManagedRepoMirror(projectRoot, repoId) {
   return layout;
 }
 // packages/runtime/src/control-plane/repos/mirror/refresh.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync12, realpathSync as realpathSync3, rmSync as rmSync7 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, realpathSync as realpathSync3, rmSync as rmSync8 } from "fs";
+import { resolve as resolve27 } from "path";
 function nowIso3() {
   return new Date().toISOString();
 }
@@ -4836,7 +4890,7 @@ function sameExistingPath2(left, right) {
   try {
     return realpathSync3(left) === realpathSync3(right);
   } catch {
-    return resolve26(left) === resolve26(right);
+    return resolve27(left) === resolve27(right);
   }
 }
 function ensureMirrorHead(layout) {
@@ -4882,12 +4936,12 @@ function checkoutLooksUsable2(layout) {
   return probe.exitCode === 0 && sameExistingPath2(probe.stdout.trim(), layout.checkoutRoot);
 }
 function ensureCheckoutFromMirror(layout) {
-  mkdirSync12(resolve26(layout.checkoutRoot, ".."), { recursive: true });
-  const gitPath = resolve26(layout.checkoutRoot, ".git");
-  if (existsSync25(layout.checkoutRoot) && (!existsSync25(gitPath) || !checkoutLooksUsable2(layout))) {
-    rmSync7(layout.checkoutRoot, { recursive: true, force: true });
+  mkdirSync13(resolve27(layout.checkoutRoot, ".."), { recursive: true });
+  const gitPath = resolve27(layout.checkoutRoot, ".git");
+  if (existsSync26(layout.checkoutRoot) && (!existsSync26(gitPath) || !checkoutLooksUsable2(layout))) {
+    rmSync8(layout.checkoutRoot, { recursive: true, force: true });
   }
-  if (!existsSync25(gitPath)) {
+  if (!existsSync26(gitPath)) {
     ensureGitSuccess2(runGit2(["git", "clone", layout.mirrorRoot, layout.checkoutRoot], layout.projectRoot), ["git", "clone", layout.mirrorRoot, layout.checkoutRoot]);
   }
   const getOrigin = runGit2(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -4961,7 +5015,7 @@ function repoEnsure(projectRoot, taskId) {
 }
 function repoBaseline(projectRoot, refresh = false) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  if (!refresh && existsSync26(paths.baseRepoPinsPath)) {
+  if (!refresh && existsSync27(paths.baseRepoPinsPath)) {
     const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
     return baseline.repos || {};
   }
@@ -4985,8 +5039,8 @@ function ensureMonorepoReady(projectRoot) {
 }
 function persistBaselinePins(projectRoot, repos) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  mkdirSync13(resolve27(paths.baseRepoPinsPath, ".."), { recursive: true });
-  writeFileSync10(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+  mkdirSync14(resolve28(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync11(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
 `, "utf-8");
   return repos;
 }
@@ -5065,28 +5119,28 @@ function readRepoDiscoveryTaskConfig(projectRoot) {
 function resolveRepoDiscoveryPaths(projectRoot) {
   const monorepoRoot = resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
   const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
-  const normalizedProjectRoot = resolve27(projectRoot);
+  const normalizedProjectRoot = resolve28(projectRoot);
   const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
-  const stateDir = resolve27(hostProjectRoot, ".rig", "state");
+  const stateDir = resolve28(hostProjectRoot, ".rig", "state");
   return {
     monorepoRoot,
-    taskRepoCommitsPath: resolve27(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve27(stateDir, "base-repo-pins.json")
+    taskRepoCommitsPath: resolve28(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve28(stateDir, "base-repo-pins.json")
   };
 }
 function shouldUseHostProjectStateRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && resolve27(runtimeWorkspace) === projectRoot) {
+  if (runtimeWorkspace && resolve28(runtimeWorkspace) === projectRoot) {
     return true;
   }
   return basename8(dirname12(projectRoot)) === ".worktrees";
 }
 function readPinFromArtifact(projectRoot, depTask, repoKey) {
-  const snapshot = resolve27(artifactDirForId(projectRoot, depTask), "git-state.txt");
-  if (!existsSync26(snapshot)) {
+  const snapshot = resolve28(artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync27(snapshot)) {
     return "";
   }
-  const content = readFileSync13(snapshot, "utf-8");
+  const content = readFileSync14(snapshot, "utf-8");
   const chunk = content.split(/\r?\n/);
   let inSection = false;
   for (const line of chunk) {
@@ -5108,12 +5162,12 @@ function repoPath(projectRoot, key) {
   if (managed) {
     return managed.checkoutRoot;
   }
-  return key.startsWith("/") ? key : resolve27(projectRoot, key);
+  return key.startsWith("/") ? key : resolve28(projectRoot, key);
 }
 function applyPins(projectRoot, pins) {
   for (const [key, commit] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync26(resolve27(path, ".git"))) {
+    if (!existsSync27(resolve28(path, ".git"))) {
       throw new Error(`Repo for pin not available: ${key} (${path})`);
     }
     let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
@@ -5142,7 +5196,7 @@ function verifyPins(projectRoot, pins) {
   let ok = true;
   for (const [key, expected] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync26(resolve27(path, ".git"))) {
+    if (!existsSync27(resolve28(path, ".git"))) {
       console.error(`ERROR: repo missing during pin verification: ${key}`);
       ok = false;
       continue;
@@ -5167,23 +5221,23 @@ function resolveRuntimeGitEnv() {
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
     };
   }
-  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve27(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
-  const runtimeHome = runtimeRoot ? resolve27(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve28(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve28(runtimeRoot, "home") : process.env.HOME?.trim() || "";
   if (!runtimeHome) {
     return;
   }
-  const knownHostsPath = resolve27(runtimeHome, ".ssh", "known_hosts");
-  if (!existsSync26(knownHostsPath)) {
+  const knownHostsPath = resolve28(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync27(knownHostsPath)) {
     return { HOME: runtimeHome };
   }
-  const agentSshKey = resolve27(runtimeHome, ".ssh", "rig-agent-key");
+  const agentSshKey = resolve28(runtimeHome, ".ssh", "rig-agent-key");
   const sshParts = [
     "ssh",
     `-o UserKnownHostsFile="${knownHostsPath}"`,
     "-o StrictHostKeyChecking=yes",
     "-F /dev/null"
   ];
-  if (existsSync26(agentSshKey)) {
+  if (existsSync27(agentSshKey)) {
     sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
   }
   return {
@@ -5193,24 +5247,24 @@ function resolveRuntimeGitEnv() {
 }
 function inferRuntimeRootFromWorkspace(cwd) {
   const contextPath = findRuntimeContextFile3(cwd);
-  if (!contextPath || !existsSync26(contextPath)) {
+  if (!contextPath || !existsSync27(contextPath)) {
     return "";
   }
   try {
     loadRuntimeContext(contextPath);
-    return resolve27(contextPath, "..");
+    return resolve28(contextPath, "..");
   } catch {
     return "";
   }
 }
 function findRuntimeContextFile3(startPath) {
-  let current = resolve27(startPath);
+  let current = resolve28(startPath);
   while (true) {
-    const candidate = resolve27(current, "runtime-context.json");
-    if (existsSync26(candidate)) {
+    const candidate = resolve28(current, "runtime-context.json");
+    if (existsSync27(candidate)) {
       return candidate;
     }
-    const parent = resolve27(current, "..");
+    const parent = resolve28(current, "..");
     if (parent === current) {
       return "";
     }
@@ -5219,12 +5273,12 @@ function findRuntimeContextFile3(startPath) {
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/index.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync18, rmSync as rmSync13 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync19, rmSync as rmSync14 } from "fs";
 import { copyFile, mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve35 } from "path";
+import { resolve as resolve36 } from "path";
 // packages/runtime/src/control-plane/memory-sync/db.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync14 } from "fs";
+import { mkdirSync as mkdirSync15 } from "fs";
 import { dirname as dirname13 } from "path";
 var SCHEMA_STATEMENTS = [
   `CREATE TABLE IF NOT EXISTS memory_events (
@@ -5438,7 +5492,7 @@ async function ensureSchema(db) {
   await ensureColumns(db.client, "memory_items", MEMORY_ITEM_COLUMNS);
 }
 async function openMemoryDb(dbPath) {
-  mkdirSync14(dirname13(dbPath), { recursive: true });
+  mkdirSync15(dirname13(dbPath), { recursive: true });
   const sqlite = new Database(dbPath, { create: true, strict: true });
   const client = createMemoryDbClient(sqlite);
   const db = {
@@ -5452,7 +5506,7 @@ async function openMemoryDb(dbPath) {
   return db;
 }
 // packages/runtime/src/control-plane/memory-sync/read.ts
-import { mkdtempSync, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
+import { mkdtempSync, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join5 } from "path";
 var CANONICAL_MEMORY_DB_PATH = "rig/memory/project-memory.db";
@@ -5461,7 +5515,7 @@ var DEFAULT_READ_DEPS2 = {
   readBlobBytesAtRef: nativeReadBlobBytesAtRef,
   openMemoryDb,
   makeTempDir: () => mkdtempSync(join5(tmpdir5(), "memory-sync-read-")),
-  removeDir: (path) => rmSync9(path, { recursive: true, force: true })
+  removeDir: (path) => rmSync10(path, { recursive: true, force: true })
 };
 function isMissingCanonicalMemoryBlobError(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -5481,7 +5535,7 @@ async function readCanonicalMemoryDb(projectRoot, deps = {}) {
   try {
     try {
       const bytes = readDeps.readBlobBytesAtRef(repoPath2, baseOid, CANONICAL_MEMORY_DB_PATH);
-      writeFileSync11(dbPath, bytes);
+      writeFileSync12(dbPath, bytes);
     } catch (error) {
       if (!isMissingCanonicalMemoryBlobError(error)) {
         throw error;
@@ -5606,7 +5660,7 @@ init_layout();
 
 // packages/runtime/src/control-plane/runtime/overlay.ts
 init_layout();
-import { mkdirSync as mkdirSync15 } from "fs";
+import { mkdirSync as mkdirSync16 } from "fs";
 function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const layout = resolveRuntimeWorkspaceLayout(workspaceDir ?? projectRoot);
   const rootDir = layout.rigRoot;
@@ -5618,14 +5672,14 @@ function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const sessionDir = layout.sessionDir;
   const runtimeDir = layout.runtimeDir;
   const contextPath = layout.contextPath;
-  mkdirSync15(rootDir, { recursive: true });
-  mkdirSync15(homeDir, { recursive: true });
-  mkdirSync15(tmpDir, { recursive: true });
-  mkdirSync15(cacheDir, { recursive: true });
-  mkdirSync15(logsDir, { recursive: true });
-  mkdirSync15(stateDir, { recursive: true });
-  mkdirSync15(sessionDir, { recursive: true });
-  mkdirSync15(runtimeDir, { recursive: true });
+  mkdirSync16(rootDir, { recursive: true });
+  mkdirSync16(homeDir, { recursive: true });
+  mkdirSync16(tmpDir, { recursive: true });
+  mkdirSync16(cacheDir, { recursive: true });
+  mkdirSync16(logsDir, { recursive: true });
+  mkdirSync16(stateDir, { recursive: true });
+  mkdirSync16(sessionDir, { recursive: true });
+  mkdirSync16(runtimeDir, { recursive: true });
   return {
     rootDir,
     homeDir,
@@ -5643,17 +5697,17 @@ import {
   chmodSync as chmodSync6,
   copyFileSync as copyFileSync6,
   cpSync as cpSync2,
-  existsSync as existsSync28,
-  mkdirSync as mkdirSync16,
+  existsSync as existsSync29,
+  mkdirSync as mkdirSync17,
   statSync as statSync6,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
 import { mkdir } from "fs/promises";
-import { basename as basename9, delimiter as delimiter2, resolve as resolve29 } from "path";
+import { basename as basename9, delimiter as delimiter2, resolve as resolve30 } from "path";
 
 // packages/runtime/src/control-plane/runtime/isolation/shared.ts
-import { existsSync as existsSync27, readFileSync as readFileSync14, rmSync as rmSync10 } from "fs";
-import { resolve as resolve28 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync15, rmSync as rmSync11 } from "fs";
+import { resolve as resolve29 } from "path";
 var generatedCredentialFiles = new Set;
 var credentialCleanupRegistered = false;
 function resolveMonorepoRoot3(projectRoot) {
@@ -5677,7 +5731,7 @@ function resolveHostGitBinary() {
     if (!candidate || isRuntimeGatewayGitPath2(candidate)) {
       continue;
     }
-    if (existsSync27(candidate)) {
+    if (existsSync28(candidate)) {
       return candidate;
     }
   }
@@ -5743,7 +5797,7 @@ async function refreshRemoteBranch(repoRoot, remote, branch) {
   }
 }
 async function tryReadGitHead(repoRoot) {
-  if (!existsSync27(resolve28(repoRoot, ".git"))) {
+  if (!existsSync28(resolve29(repoRoot, ".git"))) {
     return;
   }
   const result = await runGitCommand(repoRoot, ["rev-parse", "HEAD"]);
@@ -5754,7 +5808,7 @@ async function tryReadGitHead(repoRoot) {
   return value || undefined;
 }
 async function captureRepoDirtyFiles(repoRoot) {
-  if (!existsSync27(resolve28(repoRoot, ".git"))) {
+  if (!existsSync28(resolve29(repoRoot, ".git"))) {
     return [];
   }
   const files = new Set;
@@ -5790,7 +5844,7 @@ function registerCredentialCleanup(path) {
   const cleanup = () => {
     for (const filePath of generatedCredentialFiles) {
       try {
-        rmSync10(filePath, { force: true });
+        rmSync11(filePath, { force: true });
       } catch {}
     }
     generatedCredentialFiles.clear();
@@ -5841,10 +5895,10 @@ function hashProjectPath(workspaceDir) {
   return sha256Hex(workspaceDir).slice(0, 16);
 }
 function readKnownHosts(path) {
-  if (!existsSync27(path)) {
+  if (!existsSync28(path)) {
     return new Set;
   }
-  return new Set(readFileSync14(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  return new Set(readFileSync15(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/home.ts
@@ -5861,30 +5915,30 @@ async function provisionRuntimeHome(runtime, options = {}) {
   await mkdir(runtime.cacheDir, { recursive: true });
   await provisionAgentSshKey(runtime.homeDir);
   if (options.provider === "codex") {
-    const hasCodexAuth = await injectCodexAuth(resolve29(runtime.homeDir, ".codex"));
+    const hasCodexAuth = await injectCodexAuth(resolve30(runtime.homeDir, ".codex"));
     if (!hasCodexAuth) {
       console.warn("[rig] No Codex auth.json found for isolated runtime. " + "Run `codex login` in your host shell, then retry the agent run.");
     }
   }
   if (options.provider === "pi") {
-    const hasPiAuth = await injectPiAgentConfig(resolve29(runtime.homeDir, ".pi", "agent"));
+    const hasPiAuth = await injectPiAgentConfig(resolve30(runtime.homeDir, ".pi", "agent"));
     if (!hasPiAuth) {
       console.warn("[rig] No Pi auth.json found for isolated runtime. " + "Run `pi /login` in your host shell, then retry the agent run.");
     }
   }
 }
 async function provisionClaudeHome(config) {
-  mkdirSync16(config.claudeHomeDir, { recursive: true });
-  const workspaceSettings = resolve29(config.workspaceDir, ".claude/settings.json");
-  const hostSettings = resolve29(config.hostProjectRoot, ".claude/settings.json");
-  const projectSettings = existsSync28(workspaceSettings) ? workspaceSettings : hostSettings;
+  mkdirSync17(config.claudeHomeDir, { recursive: true });
+  const workspaceSettings = resolve30(config.workspaceDir, ".claude/settings.json");
+  const hostSettings = resolve30(config.hostProjectRoot, ".claude/settings.json");
+  const projectSettings = existsSync29(workspaceSettings) ? workspaceSettings : hostSettings;
   const runtimeSettings = await loadRuntimeClaudeSettings(projectSettings);
-  if (existsSync28(projectSettings)) {
-    writeFileSync12(resolve29(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  if (existsSync29(projectSettings)) {
+    writeFileSync13(resolve30(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
   }
   writeClaudeProjectSettings(config.claudeHomeDir, config.workspaceDir, runtimeSettings);
-  writeFileSync12(resolve29(config.claudeHomeDir, "settings.json"), JSON.stringify({
+  writeFileSync13(resolve30(config.claudeHomeDir, "settings.json"), JSON.stringify({
     permissions: { defaultMode: "bypassPermissions" },
     autoMemoryEnabled: false
   }, null, 2));
@@ -5892,20 +5946,20 @@ async function provisionClaudeHome(config) {
   if (!hasCredentials) {
     console.warn("[rig] No Claude credentials found for isolated runtime. " + "Run `claude /login` in your host shell, then retry the agent run.");
   }
-  const realClaudeHome = resolve29(process.env.HOME ?? "", ".claude");
-  if (process.env.HOME && existsSync28(resolve29(realClaudeHome, "CLAUDE.md"))) {
-    cpSync2(resolve29(realClaudeHome, "CLAUDE.md"), resolve29(config.claudeHomeDir, "CLAUDE.md"));
+  const realClaudeHome = resolve30(process.env.HOME ?? "", ".claude");
+  if (process.env.HOME && existsSync29(resolve30(realClaudeHome, "CLAUDE.md"))) {
+    cpSync2(resolve30(realClaudeHome, "CLAUDE.md"), resolve30(config.claudeHomeDir, "CLAUDE.md"));
   }
-  if (process.env.HOME && existsSync28(resolve29(realClaudeHome, "agents"))) {
-    cpSync2(resolve29(realClaudeHome, "agents"), resolve29(config.claudeHomeDir, "agents"), { recursive: true });
+  if (process.env.HOME && existsSync29(resolve30(realClaudeHome, "agents"))) {
+    cpSync2(resolve30(realClaudeHome, "agents"), resolve30(config.claudeHomeDir, "agents"), { recursive: true });
   }
   if (process.platform === "darwin" && process.env.HOME) {
     writeClaudeProjectSettings(realClaudeHome, config.workspaceDir, runtimeSettings);
   }
 }
 async function provisionAgentSshKey(homeDir) {
-  const sshDir = resolve29(homeDir, ".ssh");
-  if (!existsSync28(sshDir)) {
+  const sshDir = resolve30(homeDir, ".ssh");
+  if (!existsSync29(sshDir)) {
     await mkdir(sshDir, { recursive: true });
   }
   seedKnownHosts(sshDir);
@@ -5913,27 +5967,27 @@ async function provisionAgentSshKey(homeDir) {
   const privateKey = decodeProvisionedSshKey(secrets.GITHUB_SSH_KEY);
   if (!privateKey) {
     const hostKeyPath = resolveHostSshKeyPath(process.env.HOME ?? "");
-    if (!process.env.HOME || !existsSync28(hostKeyPath)) {
+    if (!process.env.HOME || !existsSync29(hostKeyPath)) {
       return;
     }
-    const agentKeyPath2 = resolve29(sshDir, "rig-agent-key");
-    if (!existsSync28(agentKeyPath2)) {
+    const agentKeyPath2 = resolve30(sshDir, "rig-agent-key");
+    if (!existsSync29(agentKeyPath2)) {
       copyFileSync6(hostKeyPath, agentKeyPath2);
       chmodSync6(agentKeyPath2, 384);
     }
     const hostPubPath = `${hostKeyPath}.pub`;
-    if (existsSync28(hostPubPath)) {
+    if (existsSync29(hostPubPath)) {
       const agentPubPath = `${agentKeyPath2}.pub`;
-      if (!existsSync28(agentPubPath)) {
+      if (!existsSync29(agentPubPath)) {
         copyFileSync6(hostPubPath, agentPubPath);
       }
     }
     writeSshConfig(sshDir, agentKeyPath2);
     return;
   }
-  const agentKeyPath = resolve29(sshDir, "rig-agent-key");
-  if (!existsSync28(agentKeyPath)) {
-    writeFileSync12(agentKeyPath, privateKey, { mode: 384 });
+  const agentKeyPath = resolve30(sshDir, "rig-agent-key");
+  if (!existsSync29(agentKeyPath)) {
+    writeFileSync13(agentKeyPath, privateKey, { mode: 384 });
   }
   writeSshConfig(sshDir, agentKeyPath);
 }
@@ -5950,21 +6004,21 @@ function decodeProvisionedSshKey(encodedKey) {
 `;
 }
 function resolveHostSshKeyPath(homeDir) {
-  const sshDir = resolve29(homeDir, ".ssh");
+  const sshDir = resolve30(homeDir, ".ssh");
   const candidates = [
     "rig-agent-key",
     "id_ed25519",
     "id_ecdsa",
     "id_rsa"
-  ].map((name) => resolve29(sshDir, name));
-  return candidates.find((candidate) => existsSync28(candidate)) ?? resolve29(sshDir, "rig-agent-key");
+  ].map((name) => resolve30(sshDir, name));
+  return candidates.find((candidate) => existsSync29(candidate)) ?? resolve30(sshDir, "rig-agent-key");
 }
 function writeSshConfig(sshDir, keyPath) {
-  const configPath = resolve29(sshDir, "config");
-  if (existsSync28(configPath)) {
+  const configPath = resolve30(sshDir, "config");
+  if (existsSync29(configPath)) {
     return;
   }
-  const knownHostsPath = resolve29(sshDir, "known_hosts");
+  const knownHostsPath = resolve30(sshDir, "known_hosts");
   const config = [
     "Host github.com",
     `  IdentityFile ${keyPath}`,
@@ -5974,10 +6028,10 @@ function writeSshConfig(sshDir, keyPath) {
     ""
   ].join(`
 `);
-  writeFileSync12(configPath, config, { mode: 420 });
+  writeFileSync13(configPath, config, { mode: 420 });
 }
 function seedKnownHosts(sshDir) {
-  const knownHostsPath = resolve29(sshDir, "known_hosts");
+  const knownHostsPath = resolve30(sshDir, "known_hosts");
   const existingLines = readKnownHosts(knownHostsPath);
   const requiredLines = GITHUB_KNOWN_HOSTS.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const missing = requiredLines.filter((line) => !existingLines.has(line));
@@ -5988,23 +6042,23 @@ function seedKnownHosts(sshDir) {
     for (const line of missing) {
       existingLines.add(line);
     }
-    writeFileSync12(knownHostsPath, `${Array.from(existingLines).join(`
+    writeFileSync13(knownHostsPath, `${Array.from(existingLines).join(`
 `)}
 `, { mode: 420 });
   } catch (err) {
-    const hint = existsSync28(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    const hint = existsSync29(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
     console.warn(`[rig] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
   }
 }
 function writeClaudeProjectSettings(claudeHomeDir, workspaceDir, runtimeSettings) {
   const projectHash = hashProjectPath(workspaceDir);
-  const projectDir = resolve29(claudeHomeDir, "projects", projectHash);
-  mkdirSync16(projectDir, { recursive: true });
-  writeFileSync12(resolve29(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  const projectDir = resolve30(claudeHomeDir, "projects", projectHash);
+  mkdirSync17(projectDir, { recursive: true });
+  writeFileSync13(resolve30(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
 }
 async function loadRuntimeClaudeSettings(projectSettingsPath) {
-  if (!existsSync28(projectSettingsPath)) {
+  if (!existsSync29(projectSettingsPath)) {
     return {};
   }
   let parsed;
@@ -6050,7 +6104,7 @@ async function loadRuntimeClaudeSettings(projectSettingsPath) {
   return clone;
 }
 async function injectClaudeCredentials(claudeHomeDir, options = {}) {
-  const credentialsPath = resolve29(claudeHomeDir, ".credentials.json");
+  const credentialsPath = resolve30(claudeHomeDir, ".credentials.json");
   const platform = options.platform ?? process.platform;
   if (platform === "darwin") {
     const raw = options.loadKeychainCredentials ? await options.loadKeychainCredentials() : await (async () => {
@@ -6060,16 +6114,16 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
     if (raw) {
       try {
         JSON.parse(raw);
-        writeFileSync12(credentialsPath, raw, { mode: 384 });
+        writeFileSync13(credentialsPath, raw, { mode: 384 });
         registerCredentialCleanup(credentialsPath);
         return true;
       } catch {}
     }
   }
-  const hostClaudeHome = options.hostClaudeHome ? resolve29(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve29(process.env.CLAUDE_HOME) : process.env.HOME ? resolve29(process.env.HOME, ".claude") : "";
+  const hostClaudeHome = options.hostClaudeHome ? resolve30(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve30(process.env.CLAUDE_HOME) : process.env.HOME ? resolve30(process.env.HOME, ".claude") : "";
   if (hostClaudeHome) {
-    const realCredentials = resolve29(hostClaudeHome, ".credentials.json");
-    if (existsSync28(realCredentials)) {
+    const realCredentials = resolve30(hostClaudeHome, ".credentials.json");
+    if (existsSync29(realCredentials)) {
       cpSync2(realCredentials, credentialsPath);
       return true;
     }
@@ -6077,36 +6131,36 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
   return false;
 }
 async function injectCodexAuth(codexHomeDir) {
-  mkdirSync16(codexHomeDir, { recursive: true });
-  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve29(process.env.CODEX_HOME) : process.env.HOME ? resolve29(process.env.HOME, ".codex") : "";
+  mkdirSync17(codexHomeDir, { recursive: true });
+  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve30(process.env.CODEX_HOME) : process.env.HOME ? resolve30(process.env.HOME, ".codex") : "";
   if (!hostCodexHome) {
     return false;
   }
-  const hostAuthPath = resolve29(hostCodexHome, "auth.json");
-  if (!existsSync28(hostAuthPath)) {
+  const hostAuthPath = resolve30(hostCodexHome, "auth.json");
+  if (!existsSync29(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve29(codexHomeDir, "auth.json");
+  const runtimeAuthPath = resolve30(codexHomeDir, "auth.json");
   copyFileSync6(hostAuthPath, runtimeAuthPath);
   chmodSync6(runtimeAuthPath, 384);
   return true;
 }
 async function injectPiAgentConfig(piAgentDir) {
-  mkdirSync16(piAgentDir, { recursive: true });
-  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve29(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve29(process.env.HOME, ".pi", "agent") : "";
+  mkdirSync17(piAgentDir, { recursive: true });
+  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve30(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve30(process.env.HOME, ".pi", "agent") : "";
   if (!hostPiAgentDir) {
     return false;
   }
-  const hostAuthPath = resolve29(hostPiAgentDir, "auth.json");
-  if (!existsSync28(hostAuthPath)) {
+  const hostAuthPath = resolve30(hostPiAgentDir, "auth.json");
+  if (!existsSync29(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve29(piAgentDir, "auth.json");
+  const runtimeAuthPath = resolve30(piAgentDir, "auth.json");
   copyFileSync6(hostAuthPath, runtimeAuthPath);
   chmodSync6(runtimeAuthPath, 384);
-  const hostSettingsPath = resolve29(hostPiAgentDir, "settings.json");
-  if (existsSync28(hostSettingsPath)) {
-    const runtimeSettingsPath = resolve29(piAgentDir, "settings.json");
+  const hostSettingsPath = resolve30(hostPiAgentDir, "settings.json");
+  if (existsSync29(hostSettingsPath)) {
+    const runtimeSettingsPath = resolve30(piAgentDir, "settings.json");
     copyFileSync6(hostSettingsPath, runtimeSettingsPath);
     chmodSync6(runtimeSettingsPath, 384);
   }
@@ -6114,13 +6168,13 @@ async function injectPiAgentConfig(piAgentDir) {
 }
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync17, statSync as statSync7, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve30 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync18, statSync as statSync7, writeFileSync as writeFileSync14 } from "fs";
+import { resolve as resolve31 } from "path";
 var CLAUDE_ROUTER_SERVER_NAME = "rig_runtime_tools";
 function buildRuntimeToolRouterServerConfig(options) {
   return {
     type: "stdio",
-    command: resolve30(options.binDir, "rig-tool-router"),
+    command: resolve31(options.binDir, "rig-tool-router"),
     args: [],
     env: {
       RIG_RUNTIME_CONTEXT_FILE: options.contextFile,
@@ -6129,14 +6183,14 @@ function buildRuntimeToolRouterServerConfig(options) {
   };
 }
 function writeClaudeRuntimeToolRouterConfig(options) {
-  const configPath = resolve30(options.stateDir, "claude-runtime-tools.mcp.json");
-  mkdirSync17(options.stateDir, { recursive: true });
+  const configPath = resolve31(options.stateDir, "claude-runtime-tools.mcp.json");
+  mkdirSync18(options.stateDir, { recursive: true });
   const payload = {
     mcpServers: {
       [CLAUDE_ROUTER_SERVER_NAME]: buildRuntimeToolRouterServerConfig(options)
     }
   };
-  writeFileSync13(configPath, `${JSON.stringify(payload, null, 2)}
+  writeFileSync14(configPath, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
   return configPath;
 }
@@ -6145,8 +6199,8 @@ if (false) {}
 init_layout();
 
 // packages/runtime/src/control-plane/runtime/isolation/worktree.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync18, rmSync as rmSync11 } from "fs";
-import { dirname as dirname14, resolve as resolve31 } from "path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, rmSync as rmSync12 } from "fs";
+import { dirname as dirname14, resolve as resolve32 } from "path";
 async function resolveMonorepoBaseRef(monorepoRoot) {
   const explicit = process.env.RIG_RUNTIME_BASE_REF?.trim();
   if (explicit) {
@@ -6182,12 +6236,12 @@ function ensureProvisioningHostProjectRootEnv(projectRoot) {
 }
 async function provisionRuntimeWorktree(config) {
   const branch = runtimeBranchName(config.taskId, config.runtimeId);
-  let hasValidWorktree = existsSync30(resolve31(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
-  if (existsSync30(config.workspaceDir) && !hasValidWorktree) {
-    rmSync11(config.workspaceDir, { recursive: true, force: true });
+  let hasValidWorktree = existsSync31(resolve32(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
+  if (existsSync31(config.workspaceDir) && !hasValidWorktree) {
+    rmSync12(config.workspaceDir, { recursive: true, force: true });
   }
   if (!hasValidWorktree) {
-    mkdirSync18(dirname14(config.workspaceDir), { recursive: true });
+    mkdirSync19(dirname14(config.workspaceDir), { recursive: true });
     const branchExists = await runGitCommand(config.monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
     const add = branchExists.exitCode === 0 ? await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", config.workspaceDir, branch]) : await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", "-b", branch, config.workspaceDir, config.baseRef]);
     if (add.exitCode !== 0) {
@@ -6363,31 +6417,31 @@ async function preferredBaseRemotes(repoRoot) {
 
 // packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
 import {
-  existsSync as existsSync32,
+  existsSync as existsSync33,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync20,
-  readdirSync as readdirSync6,
-  readFileSync as readFileSync16,
-  rmSync as rmSync12,
+  mkdirSync as mkdirSync21,
+  readdirSync as readdirSync7,
+  readFileSync as readFileSync17,
+  rmSync as rmSync13,
   statSync as statSync9,
   symlinkSync as symlinkSync4
 } from "fs";
 import { mkdir as mkdir2, writeFile } from "fs/promises";
-import { dirname as dirname16, resolve as resolve33 } from "path";
+import { dirname as dirname16, resolve as resolve34 } from "path";
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router-binary.ts
-import { chmodSync as chmodSync7, copyFileSync as copyFileSync7, existsSync as existsSync31, mkdirSync as mkdirSync19, statSync as statSync8 } from "fs";
+import { chmodSync as chmodSync7, copyFileSync as copyFileSync7, existsSync as existsSync32, mkdirSync as mkdirSync20, statSync as statSync8 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { dirname as dirname15, resolve as resolve32 } from "path";
-var sharedRouterOutputDir = resolve32(tmpdir6(), "rig-native");
-var sharedRouterOutputPath = resolve32(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+import { dirname as dirname15, resolve as resolve33 } from "path";
+var sharedRouterOutputDir = resolve33(tmpdir6(), "rig-native");
+var sharedRouterOutputPath = resolve33(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 function runtimeClaudeToolRouterFileName() {
   return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
 }
 async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
-  const sourcePath = resolve32(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
-  mkdirSync19(dirname15(outputPath), { recursive: true });
-  const needsBuild = !existsSync31(outputPath) || statSync8(sourcePath).mtimeMs > statSync8(outputPath).mtimeMs;
+  const sourcePath = resolve33(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
+  mkdirSync20(dirname15(outputPath), { recursive: true });
+  const needsBuild = !existsSync32(outputPath) || statSync8(sourcePath).mtimeMs > statSync8(outputPath).mtimeMs;
   if (!needsBuild) {
     return outputPath;
   }
@@ -6401,9 +6455,9 @@ async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = shared
 }
 async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
   const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
-  const targetPath = resolve32(targetDir, runtimeClaudeToolRouterFileName());
-  mkdirSync19(targetDir, { recursive: true });
-  const needsCopy = !existsSync31(targetPath) || statSync8(sourcePath).mtimeMs > statSync8(targetPath).mtimeMs;
+  const targetPath = resolve33(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync20(targetDir, { recursive: true });
+  const needsCopy = !existsSync32(targetPath) || statSync8(sourcePath).mtimeMs > statSync8(targetPath).mtimeMs;
   if (needsCopy) {
     copyFileSync7(sourcePath, targetPath);
     chmodSync7(targetPath, 493);
@@ -6416,48 +6470,48 @@ var GIT_INDEX_LOCK_RETRY_DELAY_MS = 250;
 var GIT_INDEX_LOCK_STALE_AFTER_MS = 5000;
 function resolveRigSourceRoot(projectRoot) {
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot && existsSync32(resolve33(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
+  if (hostProjectRoot && existsSync33(resolve34(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
     return hostProjectRoot;
   }
-  const fromModule = resolve33(import.meta.dir, "../../../../../..");
-  if (existsSync32(resolve33(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
+  const fromModule = resolve34(import.meta.dir, "../../../../../..");
+  if (existsSync33(resolve34(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
     return fromModule;
   }
   return projectRoot;
 }
 function prepareTrackedRuntimePaths(logsDir, stateDir, sessionDir) {
-  for (const path of [logsDir, stateDir, sessionDir, resolve33(sessionDir, "session.json")]) {
+  for (const path of [logsDir, stateDir, sessionDir, resolve34(sessionDir, "session.json")]) {
     removeSymbolicLink(path);
   }
   runtimePrepareTrackedPathsNative({
     logsDir,
     stateDir,
     sessionDir,
-    controlledBashLogFile: resolve33(logsDir, "controlled-bash.jsonl"),
-    eventsFile: resolve33(logsDir, "control-plane.events.jsonl")
+    controlledBashLogFile: resolve34(logsDir, "controlled-bash.jsonl"),
+    eventsFile: resolve34(logsDir, "control-plane.events.jsonl")
   });
 }
 async function initializeRuntimeStateFiles(stateDir, sessionDir, taskId) {
   await mkdir2(stateDir, { recursive: true });
   await mkdir2(sessionDir, { recursive: true });
-  const failedApproachesPath = resolve33(stateDir, "failed_approaches.md");
-  if (!existsSync32(failedApproachesPath)) {
+  const failedApproachesPath = resolve34(stateDir, "failed_approaches.md");
+  if (!existsSync33(failedApproachesPath)) {
     await writeFile(failedApproachesPath, `# Failed Approaches
 
 `);
   }
-  const hookTripsPath = resolve33(stateDir, "hook_trips.log");
-  if (!existsSync32(hookTripsPath)) {
+  const hookTripsPath = resolve34(stateDir, "hook_trips.log");
+  if (!existsSync33(hookTripsPath)) {
     await writeFile(hookTripsPath, "");
   }
-  const sessionFile = resolve33(sessionDir, "session.json");
+  const sessionFile = resolve34(sessionDir, "session.json");
   if (taskId) {
     await writeFile(sessionFile, JSON.stringify({ activeTaskIds: [taskId] }));
   }
 }
 async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
-  const artifactDir = resolve33(workspaceDir, "artifacts", taskId);
-  const runtimeSnapshotDir = resolve33(artifactDir, "runtime-snapshots");
+  const artifactDir = resolve34(workspaceDir, "artifacts", taskId);
+  const runtimeSnapshotDir = resolve34(artifactDir, "runtime-snapshots");
   let preservedTrackedFiles = false;
   for (const file of [
     "changed-files.txt",
@@ -6473,13 +6527,13 @@ async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
       preservedTrackedFiles = true;
       continue;
     }
-    rmSync12(resolve33(artifactDir, file), { force: true });
+    rmSync13(resolve34(artifactDir, file), { force: true });
   }
   const runtimeSnapshotRelativePath = `artifacts/${taskId}/runtime-snapshots`;
   if (await resetTrackedArtifactPath(workspaceDir, runtimeSnapshotRelativePath)) {
     preservedTrackedFiles = true;
   } else {
-    rmSync12(runtimeSnapshotDir, { recursive: true, force: true });
+    rmSync13(runtimeSnapshotDir, { recursive: true, force: true });
   }
   if (preservedTrackedFiles) {
     console.log(`[rig-agent] Preserved tracked runtime artifact files in ${taskId}; skipped ephemeral cleanup for committed paths.`);
@@ -6512,28 +6566,28 @@ async function buildRuntimeToolchain(options) {
     throw new Error("Failed to provision the native Zig runtime library.");
   }
   const rigSourceRoot = resolveRigSourceRoot(options.projectRoot);
-  await buildBinary("packages/cli/bin/rig.ts", resolve33(options.binDir, "rig"), rigSourceRoot);
-  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve33(options.binDir, "rig-agent"), rigSourceRoot, {
+  await buildBinary("packages/cli/bin/rig.ts", resolve34(options.binDir, "rig"), rigSourceRoot);
+  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve34(options.binDir, "rig-agent"), rigSourceRoot, {
     ...options.runtimeSecretDefines,
     AGENT_TASK_ID: options.taskId,
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_RUNTIME_ID: options.runtimeId,
     AGENT_SCOPE_HASH: options.bakedScopeHash,
     AGENT_MANIFEST_PATH: options.manifestPath,
-    AGENT_BINARY_PATH: resolve33(options.binDir, "rig-agent"),
+    AGENT_BINARY_PATH: resolve34(options.binDir, "rig-agent"),
     AGENT_INFO_OUTPUT: options.bakedInfoOutput,
     AGENT_DEPS_OUTPUT: options.bakedDepsOutput,
     AGENT_STATUS_OUTPUT: options.bakedStatusOutput
   });
-  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve33(options.binDir, "controlled-bash"), rigSourceRoot, {
+  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve34(options.binDir, "controlled-bash"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_LOGS_DIR: options.logsDir,
     AGENT_MONOREPO_ROOT: resolveMonorepoRoot3(options.projectRoot),
-    AGENT_TS_API_TESTS_DIR: resolve33(options.workspaceDir, "TSAPITests"),
-    AGENT_RIG_AGENT_BIN: resolve33(options.binDir, "rig-agent")
+    AGENT_TS_API_TESTS_DIR: resolve34(options.workspaceDir, "TSAPITests"),
+    AGENT_RIG_AGENT_BIN: resolve34(options.binDir, "rig-agent")
   });
-  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve33(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
-  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve33(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
+  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve34(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
+  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve34(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_BUN_PATH: resolveBunBinaryPath()
   });
@@ -6542,15 +6596,15 @@ async function buildRuntimeToolchain(options) {
     AGENT_BUN_PATH: resolveBunBinaryPath()
   };
   for (const hookName of hookNames) {
-    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve33(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
+    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve34(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
   }
-  const pluginsDir = resolve33(options.projectRoot, "rig/plugins");
-  if (existsSync32(pluginsDir)) {
-    for (const entry of readdirSync6(pluginsDir, { withFileTypes: true })) {
+  const pluginsDir = resolve34(options.projectRoot, "rig/plugins");
+  if (existsSync33(pluginsDir)) {
+    for (const entry of readdirSync7(pluginsDir, { withFileTypes: true })) {
       const match = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
       if (!match)
         continue;
-      await buildBinary(`rig/plugins/${entry.name}`, resolve33(runtimeBins.pluginsDir, match[1]), options.projectRoot);
+      await buildBinary(`rig/plugins/${entry.name}`, resolve34(runtimeBins.pluginsDir, match[1]), options.projectRoot);
     }
   }
   await materializeRigGitBinary(options.binDir);
@@ -6560,8 +6614,8 @@ async function buildRuntimeToolchain(options) {
 }
 async function writeRuntimeManifest(config) {
   const scopeHash = sha256Hex(JSON.stringify(config.scopes));
-  const binarySha256 = sha256Hex(readFileSync16(config.binaryPath));
-  const manifestPath = resolve33(config.runtimeRoot, "manifest.json");
+  const binarySha256 = sha256Hex(readFileSync17(config.binaryPath));
+  const manifestPath = resolve34(config.runtimeRoot, "manifest.json");
   const manifest = {
     runtimeId: config.runtimeId,
     taskId: config.taskId,
@@ -6595,7 +6649,7 @@ function removeSymbolicLink(path) {
   } catch {
     return;
   }
-  rmSync12(path, { force: true, recursive: true });
+  rmSync13(path, { force: true, recursive: true });
 }
 async function resetTrackedArtifactPath(workspaceDir, relativePath) {
   const tracked = await runGitLsFiles(workspaceDir, relativePath);
@@ -6621,7 +6675,7 @@ async function restoreTrackedArtifactPathWithRetry(workspaceDir, relativePath, r
   const retryDelayMs = options.retryDelayMs ?? GIT_INDEX_LOCK_RETRY_DELAY_MS;
   const now = options.now ?? Date.now;
   const statMtimeMs = options.statMtimeMs ?? readFileMtimeMs;
-  const removeFile = options.removeFile ?? ((path) => rmSync12(path, { force: true }));
+  const removeFile = options.removeFile ?? ((path) => rmSync13(path, { force: true }));
   const log = options.log ?? console.warn;
   let lastOutput = "";
   for (let attempt = 0;attempt <= maxRetries; attempt += 1) {
@@ -6681,31 +6735,31 @@ function readFileMtimeMs(path) {
 }
 function linkRuntimeDependencyLayers(monorepoRoot, workspaceDir) {
   linkGenericNodeModulesLayers(monorepoRoot, workspaceDir);
-  const sourceNodeModules = resolve33(monorepoRoot, "humoongate", "node_modules");
-  if (!existsSync32(sourceNodeModules)) {} else {
-    const runtimeHumoongate = resolve33(workspaceDir, "humoongate");
-    if (existsSync32(resolve33(runtimeHumoongate, "package.json"))) {
-      const targetNodeModules = resolve33(runtimeHumoongate, "node_modules");
+  const sourceNodeModules = resolve34(monorepoRoot, "humoongate", "node_modules");
+  if (!existsSync33(sourceNodeModules)) {} else {
+    const runtimeHumoongate = resolve34(workspaceDir, "humoongate");
+    if (existsSync33(resolve34(runtimeHumoongate, "package.json"))) {
+      const targetNodeModules = resolve34(runtimeHumoongate, "node_modules");
       runtimeLinkDependencyLayerNative(sourceNodeModules, targetNodeModules);
     }
   }
-  const runtimeHpNext = resolve33(workspaceDir, "microservices", "hp-next-frontend", "app");
-  if (!existsSync32(resolve33(runtimeHpNext, "package.json"))) {
+  const runtimeHpNext = resolve34(workspaceDir, "microservices", "hp-next-frontend", "app");
+  if (!existsSync33(resolve34(runtimeHpNext, "package.json"))) {
     return;
   }
-  const sourceHpNextNodeModules = resolve33(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
-  const sourceMonorepoNodeModules = resolve33(monorepoRoot, "node_modules");
-  const targetHpNextNodeModules = resolve33(runtimeHpNext, "node_modules");
-  if (existsSync32(sourceHpNextNodeModules)) {
+  const sourceHpNextNodeModules = resolve34(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
+  const sourceMonorepoNodeModules = resolve34(monorepoRoot, "node_modules");
+  const targetHpNextNodeModules = resolve34(runtimeHpNext, "node_modules");
+  if (existsSync33(sourceHpNextNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceHpNextNodeModules, targetHpNextNodeModules);
     return;
   }
-  if (existsSync32(sourceMonorepoNodeModules)) {
+  if (existsSync33(sourceMonorepoNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceMonorepoNodeModules, targetHpNextNodeModules);
   }
 }
 function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
-  linkNodeModulesLayer(resolve33(monorepoRoot, "node_modules"), resolve33(workspaceDir, "node_modules"));
+  linkNodeModulesLayer(resolve34(monorepoRoot, "node_modules"), resolve34(workspaceDir, "node_modules"));
   for (const relativePackageDir of [
     "apps/native-app/apps/marketing",
     "apps/native-app/apps/web",
@@ -6727,15 +6781,15 @@ function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
     "packages/standard-plugin",
     "packages/validator-kit"
   ]) {
-    const workspacePackageDir = resolve33(workspaceDir, relativePackageDir);
-    if (!existsSync32(resolve33(workspacePackageDir, "package.json"))) {
+    const workspacePackageDir = resolve34(workspaceDir, relativePackageDir);
+    if (!existsSync33(resolve34(workspacePackageDir, "package.json"))) {
       continue;
     }
-    linkNodeModulesLayer(resolve33(monorepoRoot, relativePackageDir, "node_modules"), resolve33(workspacePackageDir, "node_modules"));
+    linkNodeModulesLayer(resolve34(monorepoRoot, relativePackageDir, "node_modules"), resolve34(workspacePackageDir, "node_modules"));
   }
 }
 function linkNodeModulesLayer(sourceDir, targetDir) {
-  if (!existsSync32(sourceDir) || existsSync32(targetDir)) {
+  if (!existsSync33(sourceDir) || existsSync33(targetDir)) {
     return;
   }
   try {
@@ -6744,23 +6798,23 @@ function linkNodeModulesLayer(sourceDir, targetDir) {
   } catch (error) {
     console.warn(`[rig-agent] Native dependency-layer linking failed for ${targetDir}; using symlink fallback: ${error instanceof Error ? error.message : String(error)}`);
   }
-  mkdirSync20(dirname16(targetDir), { recursive: true });
+  mkdirSync21(dirname16(targetDir), { recursive: true });
   symlinkSync4(sourceDir, targetDir, "dir");
 }
 function ensureRuntimeBinTrees(runtimeBinDir) {
-  const hooksDir = resolve33(runtimeBinDir, "hooks");
-  const pluginsDir = resolve33(runtimeBinDir, "plugins");
-  const validatorsDir = resolve33(runtimeBinDir, "validators");
-  mkdirSync20(hooksDir, { recursive: true });
-  mkdirSync20(pluginsDir, { recursive: true });
-  mkdirSync20(validatorsDir, { recursive: true });
+  const hooksDir = resolve34(runtimeBinDir, "hooks");
+  const pluginsDir = resolve34(runtimeBinDir, "plugins");
+  const validatorsDir = resolve34(runtimeBinDir, "validators");
+  mkdirSync21(hooksDir, { recursive: true });
+  mkdirSync21(pluginsDir, { recursive: true });
+  mkdirSync21(validatorsDir, { recursive: true });
   return { hooksDir, pluginsDir, validatorsDir };
 }
 
 // packages/runtime/src/control-plane/runtime/guard.ts
 import { optimizeNextInvocation } from "bun:jsc";
-import { existsSync as existsSync33, readFileSync as readFileSync17, statSync as statSync10 } from "fs";
-import { resolve as resolve34 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync18, statSync as statSync10 } from "fs";
+import { resolve as resolve35 } from "path";
 
 // packages/runtime/src/control-plane/runtime/guard-types.ts
 var POLICY_VERSION = 1;
@@ -6823,8 +6877,8 @@ function loadPolicy(projectRoot) {
   if (seededPolicyConfig) {
     return seededPolicyConfig;
   }
-  const configPath = resolve34(projectRoot, "rig/policy/policy.json");
-  if (!existsSync33(configPath)) {
+  const configPath = resolve35(projectRoot, "rig/policy/policy.json");
+  if (!existsSync34(configPath)) {
     return defaultPolicy();
   }
   let mtimeMs;
@@ -6838,7 +6892,7 @@ function loadPolicy(projectRoot) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync17(configPath, "utf-8"));
+    parsed = JSON.parse(readFileSync18(configPath, "utf-8"));
   } catch {
     return defaultPolicy();
   }
@@ -7054,28 +7108,28 @@ function resolveAction(mode, matched) {
 }
 function resolveAbsolutePath(projectRoot, rawPath) {
   if (rawPath.startsWith("/"))
-    return resolve34(rawPath);
-  return resolve34(projectRoot, rawPath);
+    return resolve35(rawPath);
+  return resolve35(projectRoot, rawPath);
 }
 function isHarnessPath(projectRoot, rawPath) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   const managedRoots = [
-    resolve34(projectRoot, "rig"),
-    resolve34(projectRoot, ".rig"),
-    resolve34(projectRoot, "artifacts")
+    resolve35(projectRoot, "rig"),
+    resolve35(projectRoot, ".rig"),
+    resolve35(projectRoot, "artifacts")
   ];
   return managedRoots.some((root) => absPath === root || absPath.startsWith(root + "/"));
 }
 function isRuntimePath(projectRoot, rawPath, taskWorkspace) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   if (taskWorkspace) {
-    const workspaceRigRoot = resolve34(taskWorkspace, ".rig");
-    const workspaceArtifactsRoot = resolve34(taskWorkspace, "artifacts");
+    const workspaceRigRoot = resolve35(taskWorkspace, ".rig");
+    const workspaceArtifactsRoot = resolve35(taskWorkspace, "artifacts");
     if (absPath === workspaceRigRoot || absPath.startsWith(workspaceRigRoot + "/") || absPath === workspaceArtifactsRoot || absPath.startsWith(workspaceArtifactsRoot + "/")) {
       return true;
     }
   }
-  const runtimeRoot = resolve34(projectRoot, ".rig/runtime/agents");
+  const runtimeRoot = resolve35(projectRoot, ".rig/runtime/agents");
   return absPath === runtimeRoot || absPath.startsWith(runtimeRoot + "/");
 }
 function isTestFile(path) {
@@ -7123,7 +7177,7 @@ function evaluateScope(policy, context, filePath, access) {
     return allowed();
   }
   if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith("/")) {
-    const absPath = resolve34(filePath);
+    const absPath = resolve35(filePath);
     if (!absPath.startsWith(context.taskWorkspace + "/") && !isHarnessPath(context.projectRoot, filePath)) {
       const reason2 = `Absolute path '${filePath}' is outside task runtime boundary. Allowed root: ${context.taskWorkspace}`;
       const matched2 = [{ id: "scope:workspace-boundary", category: "command", reason: reason2 }];
@@ -7355,9 +7409,9 @@ var CANONICAL_MEMORY_DB_PATH2 = "rig/memory/project-memory.db";
 async function hydrateRuntimeMemory(options) {
   const snapshot = await readCanonicalMemoryDb(options.projectRoot);
   const workspaceLayout = resolveRuntimeWorkspaceLayout(options.workspaceDir);
-  const hydratedPath = resolve35(workspaceLayout.stateDir, "memory", "project-memory.db");
+  const hydratedPath = resolve36(workspaceLayout.stateDir, "memory", "project-memory.db");
   try {
-    await mkdir3(resolve35(workspaceLayout.stateDir, "memory"), { recursive: true });
+    await mkdir3(resolve36(workspaceLayout.stateDir, "memory"), { recursive: true });
     await copyFile(snapshot.dbPath, hydratedPath);
     return {
       canonicalPath: CANONICAL_MEMORY_DB_PATH2,
@@ -7372,12 +7426,12 @@ async function hydrateRuntimeMemory(options) {
   }
 }
 async function createRuntimeTaskRecordReader(options) {
-  const legacyConfigPath = resolve35(options.projectRoot, ".rig", "task-config.json");
+  const legacyConfigPath = resolve36(options.projectRoot, ".rig", "task-config.json");
   let pluginHostContext = null;
   try {
     pluginHostContext = await buildPluginHostContext(options.projectRoot);
   } catch (error) {
-    if (!existsSync34(legacyConfigPath)) {
+    if (!existsSync35(legacyConfigPath)) {
       throw error;
     }
     const message = `Plugin task source unavailable; using source-aware .rig/task-config.json compatibility path: ${error instanceof Error ? error.message : String(error)}`;
@@ -7397,7 +7451,7 @@ async function createRuntimeTaskRecordReader(options) {
       source: "plugin"
     };
   }
-  if (existsSync34(legacyConfigPath)) {
+  if (existsSync35(legacyConfigPath)) {
     const message = "Using source-aware .rig/task-config.json task source compatibility path";
     options.diagnostics?.(message);
     console.warn(message);
@@ -7414,10 +7468,10 @@ async function createRuntimeTaskRecordReader(options) {
   };
 }
 function readConfiguredTaskSourceKindHint(projectRoot) {
-  const jsonPath = resolve35(projectRoot, "rig.config.json");
-  if (existsSync34(jsonPath)) {
+  const jsonPath = resolve36(projectRoot, "rig.config.json");
+  if (existsSync35(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync18(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync19(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -7429,12 +7483,12 @@ function readConfiguredTaskSourceKindHint(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve35(projectRoot, "rig.config.ts");
-  if (!existsSync34(tsPath)) {
+  const tsPath = resolve36(projectRoot, "rig.config.ts");
+  if (!existsSync35(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync18(tsPath, "utf8");
+    const source = readFileSync19(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     return kind ?? null;
@@ -7504,8 +7558,8 @@ async function writeRuntimeTaskConfigProjection(options) {
     ...options.taskEntry.validation && options.taskEntry.validation.length > 0 ? { validation: options.taskEntry.validation } : {},
     ...options.taskEntry.browser ? { browser: options.taskEntry.browser } : {}
   };
-  const configPath = resolve35(options.workspaceDir, ".rig", "task-config.json");
-  await mkdir3(resolve35(options.workspaceDir, ".rig"), { recursive: true });
+  const configPath = resolve36(options.workspaceDir, ".rig", "task-config.json");
+  await mkdir3(resolve36(options.workspaceDir, ".rig"), { recursive: true });
   await writeFile2(configPath, `${JSON.stringify({ [options.task.id]: entry }, null, 2)}
 `, "utf-8");
 }
@@ -7569,9 +7623,9 @@ async function ensureAgentRuntime(options) {
   }
   ensureProvisioningHostProjectRootEnv(options.projectRoot);
   const monorepoRoot = resolveMonorepoRoot3(options.projectRoot);
-  const workspaceDir = resolve35(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
+  const workspaceDir = resolve36(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
   const createdAt = new Date().toISOString();
-  if (!existsSync34(resolve35(monorepoRoot, ".git"))) {
+  if (!existsSync35(resolve36(monorepoRoot, ".git"))) {
     throw new Error(`Monorepo root is not a git checkout: ${monorepoRoot}`);
   }
   const taskResolution = await resolveRuntimeTaskRecord({
@@ -7606,7 +7660,7 @@ async function ensureAgentRuntime(options) {
     logsDir: overlay.logsDir,
     stateDir: overlay.stateDir,
     sessionDir: overlay.sessionDir,
-    claudeHomeDir: resolve35(workspaceLayout.homeDir, ".claude"),
+    claudeHomeDir: resolve36(workspaceLayout.homeDir, ".claude"),
     contextFile: overlay.contextPath,
     binDir: workspaceLayout.binDir,
     createdAt
@@ -7619,10 +7673,14 @@ async function ensureAgentRuntime(options) {
     projectRoot: options.projectRoot,
     workspaceDir
   });
-  mkdirSync21(runtime.binDir, { recursive: true });
-  mkdirSync21(workspaceLayout.distDir, { recursive: true });
+  mkdirSync22(runtime.binDir, { recursive: true });
+  mkdirSync22(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
-  await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  if (options.preserveTaskArtifacts) {
+    console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
+  } else {
+    await resetEphemeralTaskArtifacts(workspaceDir, options.taskId);
+  }
   const ctx = {
     runtimeId: options.id,
     taskId: options.taskId,
@@ -7635,7 +7693,7 @@ async function ensureAgentRuntime(options) {
       runtimeId: options.id
     }),
     workspaceDir,
-    artifactRoot: resolve35(workspaceDir, "artifacts", options.taskId),
+    artifactRoot: resolve36(workspaceDir, "artifacts", options.taskId),
     hostProjectRoot: options.projectRoot,
     monorepoMainRoot: monorepoRoot,
     monorepoBaseRef: baseRef,
@@ -7651,8 +7709,8 @@ async function ensureAgentRuntime(options) {
     stateDir: overlay.stateDir,
     logsDir: overlay.logsDir,
     sessionDir: overlay.sessionDir,
-    sessionFile: resolve35(overlay.sessionDir, "session.json"),
-    policyFile: resolve35(options.projectRoot, "rig/policy/policy.json"),
+    sessionFile: resolve36(overlay.sessionDir, "session.json"),
+    policyFile: resolve36(options.projectRoot, "rig/policy/policy.json"),
     binDir: runtime.binDir,
     createdAt,
     memory
@@ -7663,9 +7721,9 @@ async function ensureAgentRuntime(options) {
     task: taskResolution.task,
     taskEntry
   });
-  const manifestPath = resolve35(runtimeRoot, "manifest.json");
+  const manifestPath = resolve36(runtimeRoot, "manifest.json");
   const bakedScopeHash = sha256Hex(JSON.stringify(taskEntry.scope || []));
-  const runtimeAgentBinary = resolve35(runtime.binDir, "rig-agent");
+  const runtimeAgentBinary = resolve36(runtime.binDir, "rig-agent");
   await ensureRigGitBinaryPath();
   const bakedInfoOutput = await captureTaskInfoOutput({
     projectRoot: options.projectRoot,
@@ -7680,10 +7738,10 @@ async function ensureAgentRuntime(options) {
   const bakedStatusOutput = await captureStdout(async () => {
     taskStatus(options.projectRoot);
   });
-  rmSync13(runtime.binDir, { recursive: true, force: true });
-  rmSync13(workspaceLayout.distDir, { recursive: true, force: true });
-  mkdirSync21(runtime.binDir, { recursive: true });
-  mkdirSync21(workspaceLayout.distDir, { recursive: true });
+  rmSync14(runtime.binDir, { recursive: true, force: true });
+  rmSync14(workspaceLayout.distDir, { recursive: true, force: true });
+  mkdirSync22(runtime.binDir, { recursive: true });
+  mkdirSync22(workspaceLayout.distDir, { recursive: true });
   await buildRuntimeToolchain({
     projectRoot: options.projectRoot,
     workspaceDir,
@@ -7720,9 +7778,9 @@ async function ensureAgentRuntime(options) {
     workspaceDir,
     taskEntry
   });
-  const sandboxDir = resolve35(runtimeRoot, "sandbox");
+  const sandboxDir = resolve36(runtimeRoot, "sandbox");
   await mkdir3(sandboxDir, { recursive: true });
-  await writeFile2(resolve35(runtimeRoot, "runtime.json"), JSON.stringify({
+  await writeFile2(resolve36(runtimeRoot, "runtime.json"), JSON.stringify({
     id: options.id,
     taskId: options.taskId,
     mode: "worktree",
@@ -7769,7 +7827,7 @@ function isProvisionedRuntimeWorkspace(workspaceDir) {
     return false;
   }
   const layout = resolveRuntimeWorkspaceLayout(workspaceDir);
-  return existsSync35(resolve36(workspaceDir, ".git")) && existsSync35(resolve36(layout.binDir, "rig-agent")) && existsSync35(resolve36(layout.binDir, "hooks", "scope-guard")) && existsSync35(resolve36(layout.sessionDir, "session.json"));
+  return existsSync36(resolve37(workspaceDir, ".git")) && existsSync36(resolve37(layout.binDir, "rig-agent")) && existsSync36(resolve37(layout.binDir, "hooks", "scope-guard")) && existsSync36(resolve37(layout.sessionDir, "session.json"));
 }
 async function main() {
   const projectRoot = resolveProjectRoot();