@h-rig/runtime 0.0.6-alpha.33 → 0.0.6-alpha.35

package/dist/src/control-plane/native/validator.js

@@ -1,7 +1,7 @@
 // @bun
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/layout.ts
 import { existsSync } from "fs";
@@ -678,6 +678,8 @@ function sourceTaskConfigCandidates(projectRoot) {
 }
 
 // packages/runtime/src/control-plane/plugin-host-context.ts
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolvePath } from "path";
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
 
@@ -959,6 +961,55 @@ async function materializeSkills(projectRoot, entries) {
   return written;
 }
 
+// packages/runtime/src/control-plane/pi-settings-materializer.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, resolve as resolve9 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync9(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync6(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve9(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve9(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync9(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync5(dirname6(settingsPath), { recursive: true });
+    writeFileSync5(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync5(dirname6(managedRecordPath), { recursive: true });
+  writeFileSync5(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -1006,6 +1057,14 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const piPackages = config.runtime?.pi?.packages ?? [];
+    if (piPackages.length > 0 || existsSync10(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+      materializePiPackages(projectRoot, piPackages);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -1019,12 +1078,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename3, join as join2, resolve as resolve10 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve11 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve9 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve10 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -1047,7 +1106,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -1058,8 +1117,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve9(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync9(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve10(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync11(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -1067,7 +1126,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve9(projectRoot, "
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -1151,7 +1210,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve11(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -1234,10 +1293,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve10(projectRoot, "rig.config.json");
-  if (existsSync10(jsonPath)) {
+  const jsonPath = resolve11(projectRoot, "rig.config.json");
+  if (existsSync12(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync8(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -1246,12 +1305,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve10(projectRoot, "rig.config.ts");
-  if (!existsSync10(tsPath)) {
+  const tsPath = resolve11(projectRoot, "rig.config.ts");
+  if (!existsSync12(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync7(tsPath, "utf8");
+    const source = readFileSync8(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -1271,10 +1330,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync10(configPath)) {
+  if (!existsSync12(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync8(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -1282,8 +1341,8 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve10(projectRoot, sourcePath);
-  if (!existsSync10(directory)) {
+  const directory = resolve11(projectRoot, sourcePath);
+  if (!existsSync12(directory)) {
     return [];
   }
   const tasks = [];
@@ -1298,11 +1357,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve10(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve11(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  const raw = JSON.parse(readFileSync8(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -1315,7 +1374,7 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync10(directory)) {
+  if (!existsSync12(directory)) {
     return null;
   }
   for (const name of readdirSync3(directory)) {
@@ -1325,7 +1384,7 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync7(file, "utf8"));
+      const raw = JSON.parse(readFileSync8(file, "utf8"));
       const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -1485,12 +1544,12 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, rmSync as rmSync4, statSync as statSync4 } from "fs";
-import { dirname as dirname7, resolve as resolve14 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, rmSync as rmSync4, statSync as statSync4 } from "fs";
+import { dirname as dirname8, resolve as resolve15 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync, cpSync, existsSync as existsSync11, mkdirSync as mkdirSync5, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, dirname as dirname6, resolve as resolve11 } from "path";
+import { chmodSync, cpSync, existsSync as existsSync13, mkdirSync as mkdirSync6, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename4, dirname as dirname7, resolve as resolve12 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -1516,9 +1575,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve11(dirname6(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve11(tempBuildDir, basename4(options.outputPath));
-  mkdirSync5(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve12(dirname7(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve12(tempBuildDir, basename4(options.outputPath));
+  mkdirSync6(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -1543,7 +1602,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync11(tempOutputPath)) {
+    if (!existsSync13(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -1575,8 +1634,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve11(options.cwd, options.sourcePath),
-    outputPath: resolve11(options.outputPath)
+    entrypoint: resolve12(options.cwd, options.sourcePath),
+    outputPath: resolve12(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -1590,7 +1649,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync11(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync13(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -1627,7 +1686,7 @@ async function buildRuntimeBinaryViaWorker(options) {
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve11(dirname6(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve12(dirname7(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -1636,13 +1695,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve11(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync11(candidate)) {
+    const candidate = resolve12(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync13(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve11(import.meta.dir, "binary-build-worker.ts");
-  return existsSync11(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve12(import.meta.dir, "binary-build-worker.ts");
+  return existsSync13(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -1678,7 +1737,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync11(input.outputPath) || !existsSync11(input.manifestPath)) {
+  if (!existsSync13(input.outputPath) || !existsSync13(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -1691,7 +1750,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync11(filePath)) {
+    if (!existsSync13(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -1704,7 +1763,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync11(normalized)) {
+    if (!normalized || !existsSync13(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -1727,7 +1786,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve11(cwd, inputPath);
+  return resolve12(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -1743,8 +1802,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve12) => {
-    release = resolve12;
+  runtimeBinaryBuildQueue = new Promise((resolve13) => {
+    release = resolve13;
   });
   await previous;
   try {
@@ -1789,11 +1848,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve13 } from "path";
+import { delimiter, resolve as resolve14 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync12, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve13 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -1811,7 +1870,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve12(home, ".bun/bin/bun") : "",
+    home ? resolve13(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -1839,8 +1898,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve12(home, ".local/bin/claude") : "",
-    home ? resolve12(home, ".local/share/claude/local/claude") : "",
+    home ? resolve13(home, ".local/bin/claude") : "",
+    home ? resolve13(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -1854,51 +1913,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve12(bunBinaryPath, "../..");
+  return resolve13(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve12(realPath, "..");
+  return resolve13(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve12(explicitNode) === resolve12(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve12(preferredNode, "../..") : resolve12(preferredNode, "..");
+  if (explicitNode && resolve13(explicitNode) === resolve13(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve13(preferredNode, "../..") : resolve13(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve12(realPath, "../..");
+      return resolve13(realPath, "../..");
     }
-    return resolve12(realPath, "..");
+    return resolve13(realPath, "..");
   } catch {
-    return resolve12(preferredNode, "..");
+    return resolve13(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve12(envNode);
-    if (existsSync12(explicit)) {
+    const explicit = resolve13(envNode);
+    if (existsSync14(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve12(nvmBin, "node"));
+    candidates.push(resolve13(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve12(home, ".nvm/versions/node");
-    if (existsSync12(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve13(home, ".nvm/versions/node");
+    if (existsSync14(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve12(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve13(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -1907,8 +1966,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve12(candidate)));
-  const existing = deduped.filter((candidate) => existsSync12(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve13(candidate)));
+  const existing = deduped.filter((candidate) => existsSync14(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -1922,7 +1981,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve12(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve13(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -1934,8 +1993,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve12(candidate);
-  if (!existsSync12(normalized)) {
+  const normalized = resolve13(candidate);
+  if (!existsSync14(normalized)) {
     return "";
   }
   try {
@@ -1945,7 +2004,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve12(candidate).replace(/\\/g, "/");
+  const normalized = resolve13(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -1966,7 +2025,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve13(claudeBinary, "..");
+      return resolve14(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -1976,8 +2035,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve13(realHome, ".local/bin") : "",
-    realHome ? resolve13(realHome, ".cargo/bin") : "",
+    realHome ? resolve14(realHome, ".local/bin") : "",
+    realHome ? resolve14(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -2008,9 +2067,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve14(runtimeContext.binDir, "validators", binaryName);
+    return resolve15(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve14(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve15(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -2025,19 +2084,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve14(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync13(sourcePath)) {
+  const sourcePath = resolve15(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync15(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync4(sourcePath).mtimeMs;
-  const binaryExists = existsSync13(binaryPath);
+  const binaryExists = existsSync15(binaryPath);
   const binaryMtime = binaryExists ? statSync4(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
       rmSync4(binaryPath, { force: true });
       rmSync4(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync6(dirname7(binaryPath), { recursive: true });
+    mkdirSync7(dirname8(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -2046,7 +2105,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync13(binaryPath) ? binaryPath : null;
+  return existsSync15(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -2083,20 +2142,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve15(runtimeContext.logsDir, taskId),
-      artifactDir: resolve15(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve16(runtimeContext.logsDir, taskId),
+      artifactDir: resolve16(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve15(paths.logsDir, taskId),
-    artifactDir: resolve15(paths.artifactsDir, taskId)
+    taskLogDir: resolve16(paths.logsDir, taskId),
+    artifactDir: resolve16(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync14(binaryPath)) {
+  if (!existsSync16(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -2107,7 +2166,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve15(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve16(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -2122,7 +2181,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync14(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync16(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -2162,8 +2221,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync7(taskLogDir, { recursive: true });
-  mkdirSync7(artifactDir, { recursive: true });
+  mkdirSync8(taskLogDir, { recursive: true });
+  mkdirSync8(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -2172,7 +2231,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync7(resolve15(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync8(resolve16(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -2207,18 +2266,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve15(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync7(taskLogDir, { recursive: true });
-      writeFileSync7(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve16(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync8(taskLogDir, { recursive: true });
+      writeFileSync8(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve15(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync7(taskLogDir, { recursive: true });
-    writeFileSync7(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve16(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync8(taskLogDir, { recursive: true });
+    writeFileSync8(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -2240,8 +2299,8 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync7(artifactDir, { recursive: true });
-  writeFileSync7(resolve15(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync8(artifactDir, { recursive: true });
+  writeFileSync8(resolve16(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }