@h-rig/runtime 0.0.6-alpha.33 → 0.0.6-alpha.35

package/dist/bin/rig-agent.js

@@ -2,8 +2,8 @@
 // @bun
 
 // packages/runtime/bin/rig-agent.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync17, readFileSync as readFileSync17, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname17, resolve as resolve32 } from "path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync18, readFileSync as readFileSync18, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname18, resolve as resolve33 } from "path";
 
 // packages/runtime/src/control-plane/controlled-bash.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -3616,13 +3616,13 @@ class GeneralCliEventBus {
 }
 
 // packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync23, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, resolve as resolve27 } from "path";
+import { existsSync as existsSync25, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname15, isAbsolute as isAbsolute2, resolve as resolve28 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve26 } from "path";
+import { appendFileSync, existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve27 } from "path";
 
 // packages/runtime/src/control-plane/runtime/tooling/shell.ts
 import { tmpdir as tmpdir4 } from "os";
@@ -3688,6 +3688,8 @@ function runtimeGatewayToolNames() {
   return runtimeToolGatewayNames();
 }
 // packages/runtime/src/control-plane/plugin-host-context.ts
+import { existsSync as existsSync13 } from "fs";
+import { resolve as resolvePath } from "path";
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
 
@@ -4026,6 +4028,55 @@ async function materializeSkills(projectRoot, entries) {
   return written;
 }
 
+// packages/runtime/src/control-plane/pi-settings-materializer.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname11, resolve as resolve15 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync12(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync9(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve15(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve15(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync12(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync7(dirname11(settingsPath), { recursive: true });
+    writeFileSync6(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync7(dirname11(managedRecordPath), { recursive: true });
+  writeFileSync6(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -4073,6 +4124,14 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const piPackages = config.runtime?.pi?.packages ?? [];
+    if (piPackages.length > 0 || existsSync13(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+      materializePiPackages(projectRoot, piPackages);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -4086,12 +4145,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, join as join3, resolve as resolve16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename4, join as join3, resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -4114,7 +4173,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve15(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve16(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -4125,8 +4184,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve15(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync12(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve16(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync14(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -4134,7 +4193,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve15(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync9(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -4218,7 +4277,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve16(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve17(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -4301,10 +4360,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve16(projectRoot, "rig.config.json");
-  if (existsSync13(jsonPath)) {
+  const jsonPath = resolve17(projectRoot, "rig.config.json");
+  if (existsSync15(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync11(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -4313,12 +4372,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve16(projectRoot, "rig.config.ts");
-  if (!existsSync13(tsPath)) {
+  const tsPath = resolve17(projectRoot, "rig.config.ts");
+  if (!existsSync15(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync10(tsPath, "utf8");
+    const source = readFileSync11(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -4338,10 +4397,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync13(configPath)) {
+  if (!existsSync15(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync10(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync11(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -4349,8 +4408,8 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve16(projectRoot, sourcePath);
-  if (!existsSync13(directory)) {
+  const directory = resolve17(projectRoot, sourcePath);
+  if (!existsSync15(directory)) {
     return [];
   }
   const tasks = [];
@@ -4365,11 +4424,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve16(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve17(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync10(file, "utf8"));
+  const raw = JSON.parse(readFileSync11(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -4382,7 +4441,7 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync13(directory)) {
+  if (!existsSync15(directory)) {
     return null;
   }
   for (const name of readdirSync2(directory)) {
@@ -4392,7 +4451,7 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync10(file, "utf8"));
+      const raw = JSON.parse(readFileSync11(file, "utf8"));
       const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -4552,8 +4611,8 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync17, readFileSync as readFileSync12, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename6, resolve as resolve20 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync13, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename6, resolve as resolve21 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -4661,38 +4720,38 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve20 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync15 } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
-import { existsSync as existsSync14 } from "fs";
-import { basename as basename5, dirname as dirname11, join as join4, resolve as resolve17 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { basename as basename5, dirname as dirname12, join as join4, resolve as resolve18 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve17(projectRoot);
-  const projectParent = dirname11(normalizedProjectRoot);
+  const normalizedProjectRoot = resolve18(projectRoot);
+  const projectParent = dirname12(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
-    const ownerRoot = dirname11(projectParent);
-    const ownerHasRepoMarkers = existsSync14(resolve17(ownerRoot, ".git")) || existsSync14(resolve17(ownerRoot, ".rig", "state"));
+    const ownerRoot = dirname12(projectParent);
+    const ownerHasRepoMarkers = existsSync16(resolve18(ownerRoot, ".git")) || existsSync16(resolve18(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve17(ownerRoot, ".rig", "state");
+      return resolve18(ownerRoot, ".rig", "state");
     }
   }
-  return resolve17(projectRoot, ".rig", "state");
+  return resolve18(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve17(projectRoot);
+  const normalizedProjectRoot = resolve18(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join4("repos", entry.id);
-  const metadataRoot = resolve17(stateDir, metadataRelativePath);
+  const metadataRoot = resolve18(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve17(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname11(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve18(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname12(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve17(process.env[entry.checkoutEnvVar].trim()) : resolve17(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve18(process.env[entry.checkoutEnvVar].trim()) : resolve18(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -4700,12 +4759,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve17(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve18(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve17(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve17(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve18(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve18(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join4(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -4727,7 +4786,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync15(resolve18(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync17(resolve19(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -4738,8 +4797,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS2 = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync16,
-  readFile: (path) => readFileSync11(path, "utf8")
+  exists: existsSync18,
+  readFile: (path) => readFileSync12(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -4820,12 +4879,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync16(resolve19(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync18(resolve20(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve19(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve19(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve20(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve20(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -4887,7 +4946,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve20(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve21(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -4963,15 +5022,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync17(issuesPath)) {
+  const issuesPath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync19(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync12(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync13(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -5012,25 +5071,25 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve20(workspaceDir, "artifacts", id);
-    if (existsSync17(worktreeArtifacts) || existsSync17(resolve20(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve21(workspaceDir, "artifacts", id);
+    if (existsSync19(worktreeArtifacts) || existsSync19(resolve21(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve20(paths.artifactsDir, id);
+    return resolve21(paths.artifactsDir, id);
   } catch {
-    return resolve20(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve21(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync17(paths.taskConfigPath)) {
+  if (existsSync19(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync17(candidate)) {
+    if (existsSync19(candidate)) {
       return candidate;
     }
   }
@@ -5038,7 +5097,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync17(candidate)) {
+    if (existsSync19(candidate)) {
       return candidate;
     }
   }
@@ -5051,7 +5110,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync8(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -5103,12 +5162,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync17(issuesPath)) {
+  const issuesPath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync19(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync12(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync13(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -5164,19 +5223,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve20(projectRoot, sourcePath);
-  if (!existsSync17(directory)) {
+  const directory = resolve21(projectRoot, sourcePath);
+  if (!existsSync19(directory)) {
     return {};
   }
   const config = {};
   for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve20(directory, name);
+    const file = resolve21(directory, name);
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync12(file, "utf8"));
+      const raw = JSON.parse(readFileSync13(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -5218,10 +5277,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve20(projectRoot, "rig.config.json");
-  if (existsSync17(jsonPath)) {
+  const jsonPath = resolve21(projectRoot, "rig.config.json");
+  if (existsSync19(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync12(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync13(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -5233,12 +5292,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve20(projectRoot, "rig.config.ts");
-  if (!existsSync17(tsPath)) {
+  const tsPath = resolve21(projectRoot, "rig.config.ts");
+  if (!existsSync19(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync12(tsPath, "utf8");
+    const source = readFileSync13(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -5252,23 +5311,23 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve20(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve20(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve20(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve21(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve21(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve21(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { resolve as resolve25 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve26 } from "path";
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync8, rmSync as rmSync6, statSync as statSync5 } from "fs";
-import { dirname as dirname13, resolve as resolve24 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync9, rmSync as rmSync6, statSync as statSync5 } from "fs";
+import { dirname as dirname14, resolve as resolve25 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync as chmodSync2, cpSync, existsSync as existsSync18, mkdirSync as mkdirSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename7, dirname as dirname12, resolve as resolve21 } from "path";
+import { chmodSync as chmodSync2, cpSync, existsSync as existsSync20, mkdirSync as mkdirSync8, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename7, dirname as dirname13, resolve as resolve22 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -5294,9 +5353,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve21(dirname12(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve21(tempBuildDir, basename7(options.outputPath));
-  mkdirSync7(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve22(dirname13(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve22(tempBuildDir, basename7(options.outputPath));
+  mkdirSync8(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -5321,7 +5380,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync18(tempOutputPath)) {
+    if (!existsSync20(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -5353,8 +5412,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve21(options.cwd, options.sourcePath),
-    outputPath: resolve21(options.outputPath)
+    entrypoint: resolve22(options.cwd, options.sourcePath),
+    outputPath: resolve22(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -5368,7 +5427,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync18(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync20(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -5405,7 +5464,7 @@ async function buildRuntimeBinaryViaWorker(options) {
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve21(dirname12(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve22(dirname13(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -5414,13 +5473,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve21(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync18(candidate)) {
+    const candidate = resolve22(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync20(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve21(import.meta.dir, "binary-build-worker.ts");
-  return existsSync18(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve22(import.meta.dir, "binary-build-worker.ts");
+  return existsSync20(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -5456,7 +5515,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync18(input.outputPath) || !existsSync18(input.manifestPath)) {
+  if (!existsSync20(input.outputPath) || !existsSync20(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -5469,7 +5528,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync18(filePath)) {
+    if (!existsSync20(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -5482,7 +5541,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync18(normalized)) {
+    if (!normalized || !existsSync20(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -5505,7 +5564,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve21(cwd, inputPath);
+  return resolve22(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -5521,8 +5580,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve22) => {
-    release = resolve22;
+  runtimeBinaryBuildQueue = new Promise((resolve23) => {
+    release = resolve23;
   });
   await previous;
   try {
@@ -5567,11 +5626,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve23 } from "path";
+import { delimiter, resolve as resolve24 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync19, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve23 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -5589,7 +5648,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve22(home, ".bun/bin/bun") : "",
+    home ? resolve23(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -5617,8 +5676,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve22(home, ".local/bin/claude") : "",
-    home ? resolve22(home, ".local/share/claude/local/claude") : "",
+    home ? resolve23(home, ".local/bin/claude") : "",
+    home ? resolve23(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -5632,51 +5691,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve22(bunBinaryPath, "../..");
+  return resolve23(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve22(realPath, "..");
+  return resolve23(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve22(explicitNode) === resolve22(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve22(preferredNode, "../..") : resolve22(preferredNode, "..");
+  if (explicitNode && resolve23(explicitNode) === resolve23(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve23(preferredNode, "../..") : resolve23(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve22(realPath, "../..");
+      return resolve23(realPath, "../..");
     }
-    return resolve22(realPath, "..");
+    return resolve23(realPath, "..");
   } catch {
-    return resolve22(preferredNode, "..");
+    return resolve23(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve22(envNode);
-    if (existsSync19(explicit)) {
+    const explicit = resolve23(envNode);
+    if (existsSync21(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve22(nvmBin, "node"));
+    candidates.push(resolve23(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve22(home, ".nvm/versions/node");
-    if (existsSync19(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve23(home, ".nvm/versions/node");
+    if (existsSync21(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve22(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve23(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -5685,8 +5744,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve22(candidate)));
-  const existing = deduped.filter((candidate) => existsSync19(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve23(candidate)));
+  const existing = deduped.filter((candidate) => existsSync21(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -5700,7 +5759,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve22(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve23(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -5712,8 +5771,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve22(candidate);
-  if (!existsSync19(normalized)) {
+  const normalized = resolve23(candidate);
+  if (!existsSync21(normalized)) {
     return "";
   }
   try {
@@ -5723,7 +5782,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve22(candidate).replace(/\\/g, "/");
+  const normalized = resolve23(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -5744,7 +5803,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve23(claudeBinary, "..");
+      return resolve24(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -5754,8 +5813,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve23(realHome, ".local/bin") : "",
-    realHome ? resolve23(realHome, ".cargo/bin") : "",
+    realHome ? resolve24(realHome, ".local/bin") : "",
+    realHome ? resolve24(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -5786,9 +5845,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve24(runtimeContext.binDir, "validators", binaryName);
+    return resolve25(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve24(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve25(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -5803,19 +5862,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve24(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync20(sourcePath)) {
+  const sourcePath = resolve25(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync22(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync5(sourcePath).mtimeMs;
-  const binaryExists = existsSync20(binaryPath);
+  const binaryExists = existsSync22(binaryPath);
   const binaryMtime = binaryExists ? statSync5(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
       rmSync6(binaryPath, { force: true });
       rmSync6(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync8(dirname13(binaryPath), { recursive: true });
+    mkdirSync9(dirname14(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -5824,7 +5883,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync20(binaryPath) ? binaryPath : null;
+  return existsSync22(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -5861,20 +5920,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve25(runtimeContext.logsDir, taskId),
-      artifactDir: resolve25(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve26(runtimeContext.logsDir, taskId),
+      artifactDir: resolve26(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve25(paths.logsDir, taskId),
-    artifactDir: resolve25(paths.artifactsDir, taskId)
+    taskLogDir: resolve26(paths.logsDir, taskId),
+    artifactDir: resolve26(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync21(binaryPath)) {
+  if (!existsSync23(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -5885,7 +5944,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve25(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve26(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -5900,7 +5959,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync21(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync23(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -5940,8 +5999,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync9(taskLogDir, { recursive: true });
-  mkdirSync9(artifactDir, { recursive: true });
+  mkdirSync10(taskLogDir, { recursive: true });
+  mkdirSync10(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -5950,7 +6009,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync9(resolve25(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync10(resolve26(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -5985,18 +6044,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve25(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync9(taskLogDir, { recursive: true });
-      writeFileSync9(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve26(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync10(taskLogDir, { recursive: true });
+      writeFileSync10(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve25(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync9(taskLogDir, { recursive: true });
-    writeFileSync9(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve26(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync10(taskLogDir, { recursive: true });
+    writeFileSync10(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -6018,8 +6077,8 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync9(artifactDir, { recursive: true });
-  writeFileSync9(resolve25(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync10(artifactDir, { recursive: true });
+  writeFileSync10(resolve26(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }
@@ -6366,16 +6425,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync22(artifactDir)) {
+    if (!existsSync24(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve26(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve26(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve26(artifactDir, "changed-files.txt");
-    if (existsSync22(changedFiles)) {
-      const lines = readFileSync13(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve27(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve27(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve27(artifactDir, "changed-files.txt");
+    if (existsSync24(changedFiles)) {
+      const lines = readFileSync14(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -6420,12 +6479,12 @@ function taskRecord(projectRoot, type, text, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync10(paths.stateDir, { recursive: true });
+  mkdirSync11(paths.stateDir, { recursive: true });
   if (type === "decision") {
-    const artifactDir = resolve26(paths.artifactsDir, activeTask);
-    mkdirSync10(artifactDir, { recursive: true });
+    const artifactDir = resolve27(paths.artifactsDir, activeTask);
+    mkdirSync11(artifactDir, { recursive: true });
     const timestamp = nowIso();
-    appendFileSync(resolve26(artifactDir, "decision-log.md"), `
+    appendFileSync(resolve27(artifactDir, "decision-log.md"), `
 ### ${timestamp}
 
 ${text}
@@ -6435,14 +6494,14 @@ ${text}
     return;
   }
   const failedPath = paths.failedApproachesPath;
-  if (!existsSync22(failedPath)) {
-    writeFileSync10(failedPath, `# Failed Approaches Log
+  if (!existsSync24(failedPath)) {
+    writeFileSync11(failedPath, `# Failed Approaches Log
 
 This file records approaches that did not work.
 
 `, "utf-8");
   }
-  const content = readFileSync13(failedPath, "utf-8");
+  const content = readFileSync14(failedPath, "utf-8");
   const attempts = (content.match(new RegExp(`^## ${escapeRegExp(activeTask)}\\b`, "gm")) || []).length + 1;
   appendFileSync(failedPath, `
 ## ${activeTask} - Attempt ${attempts} (${nowIso()})
@@ -6459,40 +6518,40 @@ function taskArtifacts(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve26(paths.artifactsDir, activeTask);
-  mkdirSync10(artifactDir, { recursive: true });
+  const artifactDir = resolve27(paths.artifactsDir, activeTask);
+  mkdirSync11(artifactDir, { recursive: true });
   const changed = changedFilesForTask(projectRoot, activeTask, true);
-  writeFileSync10(resolve26(artifactDir, "changed-files.txt"), `${changed.join(`
+  writeFileSync11(resolve27(artifactDir, "changed-files.txt"), `${changed.join(`
 `)}
 `, "utf-8");
   console.log(`changed-files.txt: ${changed.length} files`);
-  const taskResultPath = resolve26(artifactDir, "task-result.json");
-  if (!existsSync22(taskResultPath)) {
+  const taskResultPath = resolve27(artifactDir, "task-result.json");
+  if (!existsSync24(taskResultPath)) {
     const template = {
       task_id: activeTask,
       status: "completed",
       summary: "TODO: Write a one-line summary of what you did",
       completed_at: nowIso()
     };
-    writeFileSync10(taskResultPath, `${JSON.stringify(template, null, 2)}
+    writeFileSync11(taskResultPath, `${JSON.stringify(template, null, 2)}
 `, "utf-8");
     console.log("task-result.json: created (update the summary!)");
   } else {
     console.log("task-result.json: already exists");
   }
-  const decisionLogPath = resolve26(artifactDir, "decision-log.md");
-  if (!existsSync22(decisionLogPath)) {
+  const decisionLogPath = resolve27(artifactDir, "decision-log.md");
+  if (!existsSync24(decisionLogPath)) {
     const content = `# Decision Log: ${activeTask}
 
 Record key decisions here using: rig-agent record decision "..."
 `;
-    writeFileSync10(decisionLogPath, content, "utf-8");
+    writeFileSync11(decisionLogPath, content, "utf-8");
     console.log("decision-log.md: created (record your decisions!)");
   } else {
     console.log("decision-log.md: already exists");
   }
-  const nextActionsPath = resolve26(artifactDir, "next-actions.md");
-  if (!existsSync22(nextActionsPath)) {
+  const nextActionsPath = resolve27(artifactDir, "next-actions.md");
+  if (!existsSync24(nextActionsPath)) {
     const content = [
       `# Next Actions: ${activeTask}`,
       "",
@@ -6509,13 +6568,13 @@ Record key decisions here using: rig-agent record decision "..."
       ""
     ].join(`
 `);
-    writeFileSync10(nextActionsPath, content, "utf-8");
+    writeFileSync11(nextActionsPath, content, "utf-8");
     console.log("next-actions.md: created (add recommendations for downstream tasks!)");
   } else {
     console.log("next-actions.md: already exists");
   }
-  const validationSummaryPath = resolve26(artifactDir, "validation-summary.json");
-  if (existsSync22(validationSummaryPath)) {
+  const validationSummaryPath = resolve27(artifactDir, "validation-summary.json");
+  if (existsSync24(validationSummaryPath)) {
     console.log("validation-summary.json: already exists");
   } else {
     console.log("validation-summary.json: not yet created (run: rig-agent validate)");
@@ -6529,8 +6588,8 @@ function taskArtifactDir(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve26(paths.artifactsDir, activeTask);
-  mkdirSync10(artifactDir, { recursive: true });
+  const artifactDir = resolve27(paths.artifactsDir, activeTask);
+  mkdirSync11(artifactDir, { recursive: true });
   return artifactDir;
 }
 function taskArtifactWrite(projectRoot, filename, content, taskId) {
@@ -6539,10 +6598,10 @@ function taskArtifactWrite(projectRoot, filename, content, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve26(paths.artifactsDir, activeTask);
-  mkdirSync10(artifactDir, { recursive: true });
-  const targetPath = resolve26(artifactDir, filename);
-  writeFileSync10(targetPath, content, "utf-8");
+  const artifactDir = resolve27(paths.artifactsDir, activeTask);
+  mkdirSync11(artifactDir, { recursive: true });
+  const targetPath = resolve27(artifactDir, filename);
+  writeFileSync11(targetPath, content, "utf-8");
   console.log(`Wrote: ${targetPath}`);
 }
 async function taskValidate(projectRoot, taskId, validatorRegistry) {
@@ -6603,7 +6662,7 @@ function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
     [projectRoot, ""],
     [monorepoRepoRoot, ""]
   ]) {
-    if (!existsSync22(resolve26(repo, ".git"))) {
+    if (!existsSync24(resolve27(repo, ".git"))) {
       continue;
     }
     if (includeCommitted && repo === monorepoRepoRoot) {
@@ -6628,12 +6687,22 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync22(resolve26(runtimeWorkspace, ".git"))) {
-    return resolve26(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync24(resolve27(runtimeWorkspace, ".git"))) {
+    return resolve27(runtimeWorkspace);
   }
   return resolveHarnessPaths(projectRoot).monorepoRoot;
 }
 function collectCommittedMonorepoFiles(projectRoot, repo) {
+  const defaultRef = runCapture(["git", "-C", repo, "rev-parse", "--abbrev-ref", "origin/HEAD"], projectRoot);
+  if (defaultRef.exitCode === 0 && defaultRef.stdout.trim()) {
+    const mergeBase = runCapture(["git", "-C", repo, "merge-base", "HEAD", defaultRef.stdout.trim()], projectRoot);
+    if (mergeBase.exitCode === 0 && mergeBase.stdout.trim()) {
+      const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${mergeBase.stdout.trim()}..HEAD`], projectRoot);
+      if (result.exitCode === 0) {
+        return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      }
+    }
+  }
   const initialHeadCommit = resolveRuntimeInitialHeadCommit(projectRoot, repo);
   if (initialHeadCommit) {
     const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${initialHeadCommit}..HEAD`], projectRoot);
@@ -6657,7 +6726,7 @@ function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve26(monorepoRoot) === resolve26(repo)) {
+    if (resolve27(monorepoRoot) === resolve27(repo)) {
       return runtimeContext.initialHeadCommits.monorepo.trim();
     }
   }
@@ -6667,7 +6736,7 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.monorepoBaseCommit?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve26(monorepoRoot) === resolve26(repo)) {
+    if (resolve27(monorepoRoot) === resolve27(repo)) {
       return runtimeContext.monorepoBaseCommit.trim();
     }
   }
@@ -6712,7 +6781,7 @@ function resolveRuntimeDirtyBaseline(projectRoot, repo) {
     return new Set;
   }
   const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const selected = resolve26(repo) === resolve26(monorepoRoot) ? dirtyFiles.monorepo : resolve26(repo) === resolve26(projectRoot) ? dirtyFiles.project : undefined;
+  const selected = resolve27(repo) === resolve27(monorepoRoot) ? dirtyFiles.monorepo : resolve27(repo) === resolve27(projectRoot) ? dirtyFiles.project : undefined;
   return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
 }
 function normalizeChangedFilePath(file) {
@@ -6812,12 +6881,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve26(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync22(issuesPath)) {
+  const issuesPath = resolve27(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync24(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync13(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync14(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -6930,11 +6999,11 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync22(path)) {
+  if (!existsSync24(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync13(path, "utf-8"));
+  process.stdout.write(readFileSync14(path, "utf-8"));
   console.log("");
 }
 function escapeRegExp(value) {
@@ -6974,8 +7043,8 @@ function isRuntimeGatewayGhPath(candidate) {
 }
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync23(resolve27(runtimeWorkspace, ".git"))) {
-    return resolve27(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync25(resolve28(runtimeWorkspace, ".git"))) {
+    return resolve28(runtimeWorkspace);
   }
   try {
     return resolveMonorepoRoot2(projectRoot);
@@ -7000,7 +7069,7 @@ function resolveGitBinary(projectRoot) {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync23(candidate)) {
+    if (existsSync25(candidate)) {
       return candidate;
     }
   }
@@ -7024,7 +7093,7 @@ function shouldScopeGitCommit(args, hasTaskContext) {
   if (!hasTaskContext) {
     return false;
   }
-  return !args.includes("--all") && !args.includes("--unscoped");
+  return args.includes("--scoped");
 }
 function gitStatus(projectRoot, taskId) {
   const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
@@ -7060,11 +7129,11 @@ function gitPreflight(projectRoot, taskId, strict) {
   const expected = resolvedTask ? `rig/${resolveTaskBranchId(projectRoot, resolvedTask)}` : "";
   console.log("=== Git Flow Preflight ===");
   let issues = 0;
-  if (!existsSync23(resolve27(projectRoot, ".git"))) {
+  if (!existsSync25(resolve28(projectRoot, ".git"))) {
     console.log(`ERROR: project root is not a git repo (${projectRoot})`);
     issues += 1;
   }
-  if (monorepoRoot && existsSync23(resolve27(monorepoRoot, ".git"))) {
+  if (monorepoRoot && existsSync25(resolve28(monorepoRoot, ".git"))) {
     const monoBranch = branchName(projectRoot, monorepoRoot);
     if (expected && monoBranch !== expected) {
       console.log(`WARN: monorepo branch is ${monoBranch}, expected ${expected} for task ${resolvedTask}`);
@@ -7098,7 +7167,7 @@ function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
   }
   const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
   const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
-  if (!existsSync23(resolve27(repoRoot, ".git"))) {
+  if (!existsSync25(resolve28(repoRoot, ".git"))) {
     throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
   }
   const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
@@ -7142,8 +7211,8 @@ function gitCommit(options) {
 function gitSnapshot(projectRoot, taskId, outputPath) {
   const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
   const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
-  const output = outputPath || (resolvedTask ? resolveArtifactSnapshot(projectRoot, resolvedTask) : resolve27(resolve27(projectRoot, ".rig", "state"), "git-state.txt"));
-  mkdirSync11(dirname14(output), { recursive: true });
+  const output = outputPath || (resolvedTask ? resolveArtifactSnapshot(projectRoot, resolvedTask) : resolve28(resolve28(projectRoot, ".rig", "state"), "git-state.txt"));
+  mkdirSync12(dirname15(output), { recursive: true });
   const lines = ["# Git Snapshot", `timestamp: ${nowIso()}`];
   if (resolvedTask) {
     lines.push(`task: ${resolvedTask}`);
@@ -7153,7 +7222,7 @@ function gitSnapshot(projectRoot, taskId, outputPath) {
   if (monorepoRoot && monorepoRoot !== projectRoot) {
     lines.push(...snapshotRepo(projectRoot, "monorepo", monorepoRoot));
   }
-  writeFileSync11(output, `${lines.join(`
+  writeFileSync12(output, `${lines.join(`
 `)}
 `, "utf-8");
   return output;
@@ -7177,7 +7246,7 @@ function gitOpenPr(options) {
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
   }
-  if (!existsSync23(resolve27(repoRoot, ".git"))) {
+  if (!existsSync25(resolve28(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
   }
   const branch = branchName(options.projectRoot, repoRoot);
@@ -7390,12 +7459,12 @@ function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
 }
 function writePrMetadata(projectRoot, taskId, result) {
   const dir = artifactDirForId(projectRoot, taskId);
-  mkdirSync11(dir, { recursive: true });
-  const path = resolve27(dir, "pr-state.json");
+  mkdirSync12(dir, { recursive: true });
+  const path = resolve28(dir, "pr-state.json");
   let prs = {};
-  if (existsSync23(path)) {
+  if (existsSync25(path)) {
     try {
-      const parsed = JSON.parse(readFileSync14(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync15(path, "utf-8"));
       if (parsed && typeof parsed === "object" && parsed.prs && typeof parsed.prs === "object") {
         prs = parsed.prs;
       }
@@ -7411,12 +7480,12 @@ function writePrMetadata(projectRoot, taskId, result) {
     ...primary || {},
     updated_at: nowIso()
   };
-  writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync12(path, `${JSON.stringify(artifact, null, 2)}
 `, "utf-8");
 }
 function resolveArtifactSnapshot(projectRoot, taskId) {
-  const artifactDir = resolve27(resolveHarnessPaths(projectRoot).artifactsDir, taskId);
-  return resolve27(artifactDir, "git-state.txt");
+  const artifactDir = resolve28(resolveHarnessPaths(projectRoot).artifactsDir, taskId);
+  return resolve28(artifactDir, "git-state.txt");
 }
 function ensureFullGitHistory(projectRoot, repoRoot, remoteName = "origin") {
   const shallow = runCapture2(gitCmd(projectRoot, repoRoot, "rev-parse", "--is-shallow-repository"), projectRoot);
@@ -7468,14 +7537,14 @@ function resolveGithubCliBinary(projectRoot) {
   }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
-    candidates.add(resolve27(entry, "gh"));
+    candidates.add(resolve28(entry, "gh"));
   }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync23(candidate) && !isRuntimeGatewayGhPath(candidate)) {
+    if (candidate && existsSync25(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -7505,7 +7574,7 @@ function resolveRepoNameWithOwner(projectRoot, repoRoot) {
   return resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, repoRoot, repoRoot, visited);
 }
 function resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, gitRoot, cwd, visited) {
-  const normalizedGitRoot = resolve27(gitRoot);
+  const normalizedGitRoot = resolve28(gitRoot);
   if (visited.has(normalizedGitRoot)) {
     return "";
   }
@@ -7577,7 +7646,7 @@ function resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner) {
   return remotes.includes("origin") ? "origin" : remotes[0];
 }
 function gitQuery(projectRoot, gitRoot, cwd, ...args) {
-  const gitArgs = existsSync23(resolve27(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
+  const gitArgs = existsSync25(resolve28(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
   return runCapture2(gitArgs, cwd, projectRoot);
 }
 function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
@@ -7595,9 +7664,9 @@ function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
   } else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /^[^@]+@[^:]+:.+$/.test(normalized)) {
     return "";
   } else if (!isAbsolute2(normalized)) {
-    candidate = resolve27(gitRoot, normalized);
+    candidate = resolve28(gitRoot, normalized);
   }
-  return existsSync23(candidate) ? candidate : "";
+  return existsSync25(candidate) ? candidate : "";
 }
 function normalizeGithubRepoNameWithOwner(value) {
   const normalized = value.trim();
@@ -7724,7 +7793,7 @@ function inferReviewerFromChangedFiles(projectRoot, repoRoot, baseRef, branchRef
   return best;
 }
 function snapshotRepo(projectRoot, label, repo) {
-  if (!existsSync23(resolve27(repo, ".git"))) {
+  if (!existsSync25(resolve28(repo, ".git"))) {
     return [`## ${label}`, `repo: ${repo}`, "status: unavailable", ""];
   }
   const status = runCapture2(gitCmd(projectRoot, repo, "status", "--short"), projectRoot).stdout.trim();
@@ -7747,7 +7816,7 @@ function snapshotRepo(projectRoot, label, repo) {
   ];
 }
 function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files, changedFilesManifest) {
-  if (!existsSync23(resolve27(repo, ".git"))) {
+  if (!existsSync25(resolve28(repo, ".git"))) {
     console.log(`Skipping ${label}: repo not available (${repo})`);
     return;
   }
@@ -7779,18 +7848,18 @@ function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files
   console.log(`Committed ${label}: ${message}`);
 }
 function readChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve27(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  if (!existsSync23(manifestPath)) {
+  const manifestPath = resolve28(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  if (!existsSync25(manifestPath)) {
     return [];
   }
-  const files = readFileSync14(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
+  const files = readFileSync15(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
   return [...new Set(files)];
 }
 function refreshChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve27(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  mkdirSync11(dirname14(manifestPath), { recursive: true });
+  const manifestPath = resolve28(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  mkdirSync12(dirname15(manifestPath), { recursive: true });
   const changedFiles = changedFilesForTask(projectRoot, taskId, true);
-  writeFileSync11(manifestPath, `${changedFiles.join(`
+  writeFileSync12(manifestPath, `${changedFiles.join(`
 `)}
 `, "utf-8");
   return manifestPath;
@@ -7903,7 +7972,7 @@ function repoHasPathChange(projectRoot, repoRoot, relativePath) {
   return result.exitCode === 0 && result.stdout.trim().length > 0;
 }
 function stageExcludePathspecs(repoRoot) {
-  const patterns = existsSync23(resolve27(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
+  const patterns = existsSync25(resolve28(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
   return patterns.map((pattern) => `:(glob,exclude)${pattern}`);
 }
 function pathResolvesBeyondSymlink(repoRoot, relativePath) {
@@ -7913,7 +7982,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   }
   let current = repoRoot;
   for (let index = 0;index < parts.length - 1; index += 1) {
-    current = resolve27(current, parts[index]);
+    current = resolve28(current, parts[index]);
     try {
       if (lstatSync(current).isSymbolicLink()) {
         return true;
@@ -7925,7 +7994,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   return false;
 }
 function printRepoStatus(projectRoot, label, repo, expectedBranch) {
-  if (!existsSync23(resolve27(repo, ".git"))) {
+  if (!existsSync25(resolve28(repo, ".git"))) {
     console.log(`${label}: unavailable (${repo})`);
     return;
   }
@@ -7961,7 +8030,7 @@ function resolveTaskBranchId(projectRoot, taskId) {
     }
   } catch {}
   const artifactDir = artifactDirForId(projectRoot, taskId);
-  if (existsSync23(artifactDir)) {
+  if (existsSync25(artifactDir)) {
     return taskId;
   }
   throw new Error(`Unknown task id: ${taskId}`);
@@ -7997,11 +8066,11 @@ function runCapture2(command, cwd, projectRoot = cwd) {
 }
 function runtimeGitEnv(projectRoot) {
   const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
-  const runtimeHome = runtimeRoot ? resolve27(runtimeRoot, "home") : "";
-  const runtimeTmp = runtimeRoot ? resolve27(runtimeRoot, "tmp") : "";
-  const runtimeCache = runtimeRoot ? resolve27(runtimeRoot, "cache") : "";
-  const runtimeKnownHosts = runtimeHome ? resolve27(runtimeHome, ".ssh", "known_hosts") : "";
-  const runtimeKey = runtimeHome ? resolve27(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const runtimeHome = runtimeRoot ? resolve28(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve28(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve28(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve28(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve28(runtimeHome, ".ssh", "rig-agent-key") : "";
   const env = {};
   if (ctx?.workspaceDir) {
     env.PROJECT_RIG_ROOT = projectRoot;
@@ -8014,14 +8083,14 @@ function runtimeGitEnv(projectRoot) {
   if (runtimeRoot) {
     env.RIG_RUNTIME_HOME = runtimeRoot;
   }
-  if (runtimeHome && existsSync23(runtimeHome)) {
+  if (runtimeHome && existsSync25(runtimeHome)) {
     env.HOME = runtimeHome;
     env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
   }
-  if (runtimeTmp && existsSync23(runtimeTmp)) {
+  if (runtimeTmp && existsSync25(runtimeTmp)) {
     env.TMPDIR = runtimeTmp;
   }
-  if (runtimeCache && existsSync23(runtimeCache)) {
+  if (runtimeCache && existsSync25(runtimeCache)) {
     env.XDG_CACHE_HOME = runtimeCache;
   }
   const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
@@ -8065,14 +8134,14 @@ function runtimeGitEnv(projectRoot) {
     env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
     applyGitHubCredentialHelperEnv(env);
   }
-  if (runtimeKnownHosts && existsSync23(runtimeKnownHosts)) {
+  if (runtimeKnownHosts && existsSync25(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (runtimeKey && existsSync23(runtimeKey)) {
+    if (runtimeKey && existsSync25(runtimeKey)) {
       sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -8093,12 +8162,12 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};
   }
-  const path = resolve27(runtimeRoot, "runtime-secrets.json");
-  if (!existsSync23(path)) {
+  const path = resolve28(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync25(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync14(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(path, "utf-8"));
     const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
     return Object.fromEntries(entries);
   } catch {
@@ -8106,13 +8175,13 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   }
 }
 function ensureRuntimeOpenSslConfig(runtimeHome) {
-  const sslDir = resolve27(runtimeHome, ".ssl");
-  const sslConfig = resolve27(sslDir, "openssl.cnf");
-  if (!existsSync23(sslDir)) {
-    mkdirSync11(sslDir, { recursive: true });
+  const sslDir = resolve28(runtimeHome, ".ssl");
+  const sslConfig = resolve28(sslDir, "openssl.cnf");
+  if (!existsSync25(sslDir)) {
+    mkdirSync12(sslDir, { recursive: true });
   }
-  if (!existsSync23(sslConfig)) {
-    writeFileSync11(sslConfig, `# Rig runtime OpenSSL config placeholder
+  if (!existsSync25(sslConfig)) {
+    writeFileSync12(sslConfig, `# Rig runtime OpenSSL config placeholder
 `);
   }
   return sslConfig;
@@ -8130,29 +8199,29 @@ function resolveRuntimeMetadata(projectRoot) {
   if (contextFile) {
     return {
       ctx,
-      runtimeRoot: dirname14(resolve27(contextFile))
+      runtimeRoot: dirname15(resolve28(contextFile))
     };
   }
   const inferredContextFile = findRuntimeContextFile2(projectRoot);
-  if (existsSync23(inferredContextFile)) {
+  if (existsSync25(inferredContextFile)) {
     try {
       ctx = loadRuntimeContext(inferredContextFile);
     } catch {}
     return {
       ctx,
-      runtimeRoot: dirname14(inferredContextFile)
+      runtimeRoot: dirname15(inferredContextFile)
     };
   }
   return { ctx, runtimeRoot: "" };
 }
 function findRuntimeContextFile2(startPath) {
-  let current = resolve27(startPath);
+  let current = resolve28(startPath);
   while (true) {
-    const candidate = resolve27(current, "runtime-context.json");
-    if (existsSync23(candidate)) {
+    const candidate = resolve28(current, "runtime-context.json");
+    if (existsSync25(candidate)) {
       return candidate;
     }
-    const parent = dirname14(current);
+    const parent = dirname15(current);
     if (parent === current) {
       return "";
     }
@@ -8161,7 +8230,7 @@ function findRuntimeContextFile2(startPath) {
 }
 
 // packages/runtime/src/control-plane/native/profile-ops.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "fs";
 var DEFAULTS = {
   model: parseEnvOrDefault(process.env.DEFAULT_AGENT_MODEL, ["claude", "gpt-codex", "pi"], "pi"),
   runtime: parseEnvOrDefault(process.env.DEFAULT_AGENT_RUNTIME, ["claude-code", "codex-app-server", "pi"], "pi"),
@@ -8176,7 +8245,7 @@ function parseEnvOrDefault(value, allowed, fallback) {
   return allowed.includes(value) ? value : fallback;
 }
 async function readProfileFile(path) {
-  if (!existsSync24(path)) {
+  if (!existsSync26(path)) {
     return null;
   }
   try {
@@ -8229,14 +8298,14 @@ async function setProfile(projectRoot, options) {
     plugin = model === "gpt-codex" ? "codex" : model === "pi" ? "pi" : "claude";
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync12(paths.stateDir, { recursive: true });
+  mkdirSync13(paths.stateDir, { recursive: true });
   const next = {
     model,
     runtime,
     agent_plugin: plugin,
     updated_at: new Date().toISOString()
   };
-  writeFileSync12(paths.agentProfilePath, `${JSON.stringify(next, null, 2)}
+  writeFileSync13(paths.agentProfilePath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   await showProfile(projectRoot, false);
 }
@@ -8272,13 +8341,13 @@ async function setReviewProfile(projectRoot, mode, provider) {
     throw new Error(`Invalid provider: ${resolvedProvider}. Supported: greptile.`);
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync12(paths.stateDir, { recursive: true });
+  mkdirSync13(paths.stateDir, { recursive: true });
   const next = {
     mode,
     provider: resolvedProvider,
     updated_at: new Date().toISOString()
   };
-  writeFileSync12(paths.reviewProfilePath, `${JSON.stringify(next, null, 2)}
+  writeFileSync13(paths.reviewProfilePath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   await showReviewProfile(projectRoot);
 }
@@ -8316,44 +8385,44 @@ async function loadReviewProfile(path) {
 }
 
 // packages/runtime/src/control-plane/native/repo-ops.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync16, readFileSync as readFileSync16, readdirSync as readdirSync6, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "fs";
-import { basename as basename8, dirname as dirname16, resolve as resolve31 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync17, readFileSync as readFileSync17, readdirSync as readdirSync6, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename8, dirname as dirname17, resolve as resolve32 } from "path";
 // packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync14, realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve29 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync15, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve30 } from "path";
 
 // packages/runtime/src/control-plane/authority-files.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync13, appendFileSync as appendFileSync2, copyFileSync as copyFileSync3, statSync as statSync6, readdirSync as readdirSync5, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname15, join as join5, relative, resolve as resolve28 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync14, appendFileSync as appendFileSync2, copyFileSync as copyFileSync3, statSync as statSync6, readdirSync as readdirSync5, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname16, join as join5, relative, resolve as resolve29 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 function resolveAuthorityProjectStateDir(projectRoot) {
   const explicit = process.env.RIG_STATE_DIR?.trim();
   if (explicit) {
-    return resolve28(explicit);
+    return resolve29(explicit);
   }
-  return resolve28(resolve28(projectRoot), ".rig", "state");
+  return resolve29(resolve29(projectRoot), ".rig", "state");
 }
 function readJsonAtPath(path, fallback) {
-  if (!existsSync25(path)) {
+  if (!existsSync27(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync15(path, "utf-8"));
+    return JSON.parse(readFileSync16(path, "utf-8"));
   } catch {
     return fallback;
   }
 }
 function writeJsonAtPath(path, value) {
-  mkdirSync13(dirname15(path), { recursive: true });
-  writeFileSync13(path, `${JSON.stringify(value, null, 2)}
+  mkdirSync14(dirname16(path), { recursive: true });
+  writeFileSync14(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
   return path;
 }
 function readAuthorityProjectStateJson(projectRoot, relativePath, fallback) {
-  return readJsonAtPath(resolve28(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
+  return readJsonAtPath(resolve29(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
 }
 function writeAuthorityProjectStateJson(projectRoot, relativePath, value) {
-  return writeJsonAtPath(resolve28(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
+  return writeJsonAtPath(resolve29(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
 }
 
 // packages/runtime/src/control-plane/repos/mirror/state.ts
@@ -8413,7 +8482,7 @@ function sameExistingPath(left, right) {
   try {
     return realpathSync2(left) === realpathSync2(right);
   } catch {
-    return resolve29(left) === resolve29(right);
+    return resolve30(left) === resolve30(right);
   }
 }
 function repoLooksUsable(repoRoot, projectRoot) {
@@ -8449,7 +8518,7 @@ function resolveMirrorRemoteUrl(layout) {
       }
     }
   }
-  if (existsSync26(resolve29(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
+  if (existsSync28(resolve30(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
     const checkoutOrigin = runGit(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
     if (checkoutOrigin.exitCode === 0) {
       const currentOrigin = checkoutOrigin.stdout.trim();
@@ -8462,9 +8531,9 @@ function resolveMirrorRemoteUrl(layout) {
 }
 function ensureManagedRepoMirror(projectRoot, repoId) {
   const layout = resolveManagedRepoLayout(projectRoot, repoId);
-  mkdirSync14(layout.metadataRoot, { recursive: true });
+  mkdirSync15(layout.metadataRoot, { recursive: true });
   const remoteUrl = resolveMirrorRemoteUrl(layout);
-  if (!existsSync26(resolve29(layout.mirrorRoot, "HEAD"))) {
+  if (!existsSync28(resolve30(layout.mirrorRoot, "HEAD"))) {
     ensureGitSuccess(runGit(["git", "init", "--bare", layout.mirrorRoot], layout.projectRoot), ["git", "init", "--bare", layout.mirrorRoot]);
   }
   const getOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -8484,8 +8553,8 @@ function ensureManagedRepoMirror(projectRoot, repoId) {
   return layout;
 }
 // packages/runtime/src/control-plane/repos/mirror/refresh.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync15, realpathSync as realpathSync3, rmSync as rmSync7 } from "fs";
-import { resolve as resolve30 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync16, realpathSync as realpathSync3, rmSync as rmSync7 } from "fs";
+import { resolve as resolve31 } from "path";
 function nowIso3() {
   return new Date().toISOString();
 }
@@ -8512,7 +8581,7 @@ function sameExistingPath2(left, right) {
   try {
     return realpathSync3(left) === realpathSync3(right);
   } catch {
-    return resolve30(left) === resolve30(right);
+    return resolve31(left) === resolve31(right);
   }
 }
 function ensureMirrorHead(layout) {
@@ -8558,12 +8627,12 @@ function checkoutLooksUsable2(layout) {
   return probe.exitCode === 0 && sameExistingPath2(probe.stdout.trim(), layout.checkoutRoot);
 }
 function ensureCheckoutFromMirror(layout) {
-  mkdirSync15(resolve30(layout.checkoutRoot, ".."), { recursive: true });
-  const gitPath = resolve30(layout.checkoutRoot, ".git");
-  if (existsSync27(layout.checkoutRoot) && (!existsSync27(gitPath) || !checkoutLooksUsable2(layout))) {
+  mkdirSync16(resolve31(layout.checkoutRoot, ".."), { recursive: true });
+  const gitPath = resolve31(layout.checkoutRoot, ".git");
+  if (existsSync29(layout.checkoutRoot) && (!existsSync29(gitPath) || !checkoutLooksUsable2(layout))) {
     rmSync7(layout.checkoutRoot, { recursive: true, force: true });
   }
-  if (!existsSync27(gitPath)) {
+  if (!existsSync29(gitPath)) {
     ensureGitSuccess2(runGit2(["git", "clone", layout.mirrorRoot, layout.checkoutRoot], layout.projectRoot), ["git", "clone", layout.mirrorRoot, layout.checkoutRoot]);
   }
   const getOrigin = runGit2(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -8664,7 +8733,7 @@ function repoDiscover(projectRoot, taskId) {
 }
 function repoBaseline(projectRoot, refresh = false) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  if (!refresh && existsSync28(paths.baseRepoPinsPath)) {
+  if (!refresh && existsSync30(paths.baseRepoPinsPath)) {
     const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
     return baseline.repos || {};
   }
@@ -8688,8 +8757,8 @@ function ensureMonorepoReady(projectRoot) {
 }
 function persistBaselinePins(projectRoot, repos) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  mkdirSync16(resolve31(paths.baseRepoPinsPath, ".."), { recursive: true });
-  writeFileSync14(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+  mkdirSync17(resolve32(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync15(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
 `, "utf-8");
   return repos;
 }
@@ -8768,28 +8837,28 @@ function readRepoDiscoveryTaskConfig(projectRoot) {
 function resolveRepoDiscoveryPaths(projectRoot) {
   const monorepoRoot = resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
   const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
-  const normalizedProjectRoot = resolve31(projectRoot);
+  const normalizedProjectRoot = resolve32(projectRoot);
   const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
-  const stateDir = resolve31(hostProjectRoot, ".rig", "state");
+  const stateDir = resolve32(hostProjectRoot, ".rig", "state");
   return {
     monorepoRoot,
-    taskRepoCommitsPath: resolve31(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve31(stateDir, "base-repo-pins.json")
+    taskRepoCommitsPath: resolve32(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve32(stateDir, "base-repo-pins.json")
   };
 }
 function shouldUseHostProjectStateRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && resolve31(runtimeWorkspace) === projectRoot) {
+  if (runtimeWorkspace && resolve32(runtimeWorkspace) === projectRoot) {
     return true;
   }
-  return basename8(dirname16(projectRoot)) === ".worktrees";
+  return basename8(dirname17(projectRoot)) === ".worktrees";
 }
 function readPinFromArtifact(projectRoot, depTask, repoKey) {
-  const snapshot = resolve31(artifactDirForId(projectRoot, depTask), "git-state.txt");
-  if (!existsSync28(snapshot)) {
+  const snapshot = resolve32(artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync30(snapshot)) {
     return "";
   }
-  const content = readFileSync16(snapshot, "utf-8");
+  const content = readFileSync17(snapshot, "utf-8");
   const chunk = content.split(/\r?\n/);
   let inSection = false;
   for (const line of chunk) {
@@ -8811,12 +8880,12 @@ function repoPath(projectRoot, key) {
   if (managed) {
     return managed.checkoutRoot;
   }
-  return key.startsWith("/") ? key : resolve31(projectRoot, key);
+  return key.startsWith("/") ? key : resolve32(projectRoot, key);
 }
 function applyPins(projectRoot, pins) {
   for (const [key, commit] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync28(resolve31(path, ".git"))) {
+    if (!existsSync30(resolve32(path, ".git"))) {
       throw new Error(`Repo for pin not available: ${key} (${path})`);
     }
     let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
@@ -8845,7 +8914,7 @@ function verifyPins(projectRoot, pins) {
   let ok = true;
   for (const [key, expected] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync28(resolve31(path, ".git"))) {
+    if (!existsSync30(resolve32(path, ".git"))) {
       console.error(`ERROR: repo missing during pin verification: ${key}`);
       ok = false;
       continue;
@@ -8870,23 +8939,23 @@ function resolveRuntimeGitEnv() {
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
     };
   }
-  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve31(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
-  const runtimeHome = runtimeRoot ? resolve31(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve32(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve32(runtimeRoot, "home") : process.env.HOME?.trim() || "";
   if (!runtimeHome) {
     return;
   }
-  const knownHostsPath = resolve31(runtimeHome, ".ssh", "known_hosts");
-  if (!existsSync28(knownHostsPath)) {
+  const knownHostsPath = resolve32(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync30(knownHostsPath)) {
     return { HOME: runtimeHome };
   }
-  const agentSshKey = resolve31(runtimeHome, ".ssh", "rig-agent-key");
+  const agentSshKey = resolve32(runtimeHome, ".ssh", "rig-agent-key");
   const sshParts = [
     "ssh",
     `-o UserKnownHostsFile="${knownHostsPath}"`,
     "-o StrictHostKeyChecking=yes",
     "-F /dev/null"
   ];
-  if (existsSync28(agentSshKey)) {
+  if (existsSync30(agentSshKey)) {
     sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
   }
   return {
@@ -8896,24 +8965,24 @@ function resolveRuntimeGitEnv() {
 }
 function inferRuntimeRootFromWorkspace(cwd) {
   const contextPath = findRuntimeContextFile3(cwd);
-  if (!contextPath || !existsSync28(contextPath)) {
+  if (!contextPath || !existsSync30(contextPath)) {
     return "";
   }
   try {
     loadRuntimeContext(contextPath);
-    return resolve31(contextPath, "..");
+    return resolve32(contextPath, "..");
   } catch {
     return "";
   }
 }
 function findRuntimeContextFile3(startPath) {
-  let current = resolve31(startPath);
+  let current = resolve32(startPath);
   while (true) {
-    const candidate = resolve31(current, "runtime-context.json");
-    if (existsSync28(candidate)) {
+    const candidate = resolve32(current, "runtime-context.json");
+    if (existsSync30(candidate)) {
       return candidate;
     }
-    const parent = resolve31(current, "..");
+    const parent = resolve32(current, "..");
     if (parent === current) {
       return "";
     }
@@ -8935,7 +9004,7 @@ var BAKED_STATUS_OUTPUT2 = BUILD_CONFIG3.AGENT_STATUS_OUTPUT ?? "";
 var BAKED_GIT_BRANCH = BUILD_CONFIG3.AGENT_GIT_BRANCH ?? "";
 var BAKED_BASE_COMMIT = BUILD_CONFIG3.AGENT_BASE_COMMIT ?? "";
 if (BAKED_BINARY_PATH) {
-  const binaryDir = dirname17(BAKED_BINARY_PATH);
+  const binaryDir = dirname18(BAKED_BINARY_PATH);
   const currentPath = process.env.PATH || "";
   const pathEntries = currentPath.split(":").filter(Boolean);
   if (!pathEntries.includes(binaryDir)) {
@@ -8967,7 +9036,7 @@ function getEventBus() {
 }
 function inferRuntimeContext() {
   for (const candidate of runtimeContextCandidates()) {
-    if (!candidate || !existsSync29(candidate)) {
+    if (!candidate || !existsSync31(candidate)) {
       continue;
     }
     try {
@@ -8980,15 +9049,15 @@ function inferRuntimeContext() {
 function runtimeContextCandidates() {
   const cwd = process.cwd();
   const candidates = [
-    resolve32(cwd, "..", "runtime-context.json"),
-    resolve32(cwd, ".rig", "runtime-context.json")
+    resolve33(cwd, "..", "runtime-context.json"),
+    resolve33(cwd, ".rig", "runtime-context.json")
   ];
   const argv1 = process.argv[1]?.trim();
   if (argv1) {
-    candidates.push(resolve32(argv1, "..", "..", "runtime-context.json"));
+    candidates.push(resolve33(argv1, "..", "..", "runtime-context.json"));
   }
   if (BAKED_BINARY_PATH) {
-    candidates.push(resolve32(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
+    candidates.push(resolve33(BAKED_BINARY_PATH, "..", "..", "runtime-context.json"));
   }
   return Array.from(new Set(candidates));
 }
@@ -9003,12 +9072,12 @@ var GITHUB_KNOWN_HOSTS = [
   "github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk="
 ];
 function ensureRuntimeKnownHosts(runtimeHome) {
-  const sshDir = resolve32(runtimeHome, ".ssh");
-  const knownHostsPath = resolve32(sshDir, "known_hosts");
-  if (!existsSync29(sshDir)) {
-    mkdirSync17(sshDir, { recursive: true });
+  const sshDir = resolve33(runtimeHome, ".ssh");
+  const knownHostsPath = resolve33(sshDir, "known_hosts");
+  if (!existsSync31(sshDir)) {
+    mkdirSync18(sshDir, { recursive: true });
   }
-  const existing = existsSync29(knownHostsPath) ? readFileSync17(knownHostsPath, "utf-8") : "";
+  const existing = existsSync31(knownHostsPath) ? readFileSync18(knownHostsPath, "utf-8") : "";
   const existingLines = new Set(existing.split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
   const missing = GITHUB_KNOWN_HOSTS.filter((line) => !existingLines.has(line));
   if (missing.length === 0) {
@@ -9018,11 +9087,11 @@ function ensureRuntimeKnownHosts(runtimeHome) {
     for (const line of missing) {
       existingLines.add(line);
     }
-    writeFileSync15(knownHostsPath, `${Array.from(existingLines).join(`
+    writeFileSync16(knownHostsPath, `${Array.from(existingLines).join(`
 `)}
 `, { mode: 420 });
   } catch (err) {
-    const hint = existsSync29(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    const hint = existsSync31(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
     console.warn(`[rig-agent] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
   }
   return knownHostsPath;
@@ -9036,13 +9105,13 @@ function hydrateRuntimeProcessEnv(ctx) {
     return;
   }
   process.env.RIG_RUNTIME_CONTEXT_FILE = contextFile;
-  const runtimeRoot = dirname17(resolve32(contextFile));
-  const runtimeHome = resolve32(runtimeRoot, "home");
-  const runtimeTmp = resolve32(runtimeRoot, "tmp");
-  const runtimeCache = resolve32(runtimeRoot, "cache");
-  const runtimeBin = resolve32(runtimeRoot, "bin");
-  const runtimeWorkspaceBin = resolve32(ctx.workspaceDir, ".rig", "bin");
-  const runtimeTools = resolve32(ctx.workspaceDir, "rig", "tools");
+  const runtimeRoot = dirname18(resolve33(contextFile));
+  const runtimeHome = resolve33(runtimeRoot, "home");
+  const runtimeTmp = resolve33(runtimeRoot, "tmp");
+  const runtimeCache = resolve33(runtimeRoot, "cache");
+  const runtimeBin = resolve33(runtimeRoot, "bin");
+  const runtimeWorkspaceBin = resolve33(ctx.workspaceDir, ".rig", "bin");
+  const runtimeTools = resolve33(ctx.workspaceDir, "rig", "tools");
   if (ctx.hostProjectRoot) {
     process.env.PROJECT_RIG_ROOT = ctx.hostProjectRoot;
   }
@@ -9058,13 +9127,13 @@ function hydrateRuntimeProcessEnv(ctx) {
   for (const [key, value] of Object.entries(browserEnvFromContext(ctx.browser))) {
     process.env[key] = value;
   }
-  if (existsSync29(runtimeHome)) {
+  if (existsSync31(runtimeHome)) {
     process.env.HOME = runtimeHome;
   }
-  if (existsSync29(runtimeTmp)) {
+  if (existsSync31(runtimeTmp)) {
     process.env.TMPDIR = runtimeTmp;
   }
-  if (existsSync29(runtimeCache)) {
+  if (existsSync31(runtimeCache)) {
     process.env.XDG_CACHE_HOME = runtimeCache;
   }
   const workspaceSecrets = loadDotEnvSecrets(ctx.workspaceDir, process.env);
@@ -9090,31 +9159,31 @@ function hydrateRuntimeProcessEnv(ctx) {
   const currentPath = process.env.PATH || "";
   const pathEntries = currentPath.split(":").filter(Boolean);
   for (const entry of [runtimeBin, runtimeWorkspaceBin, runtimeTools, "/usr/bin", "/bin", "/usr/sbin", "/sbin"]) {
-    if (existsSync29(entry) && !pathEntries.includes(entry)) {
+    if (existsSync31(entry) && !pathEntries.includes(entry)) {
       pathEntries.unshift(entry);
     }
   }
   process.env.PATH = pathEntries.join(":");
   if (!process.env.RIG_GIT_BIN) {
-    const runtimeGit = resolve32(runtimeBin, "git");
-    process.env.RIG_GIT_BIN = existsSync29(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
+    const runtimeGit = resolve33(runtimeBin, "git");
+    process.env.RIG_GIT_BIN = existsSync31(runtimeGit) ? runtimeGit : Bun.which("git") || "/usr/bin/git";
   }
   const knownHosts = ensureRuntimeKnownHosts(runtimeHome);
-  const agentKey = resolve32(runtimeHome, ".ssh", "rig-agent-key");
+  const agentKey = resolve33(runtimeHome, ".ssh", "rig-agent-key");
   const sshParts = [
     "ssh",
     `-o UserKnownHostsFile="${knownHosts}"`,
     "-o StrictHostKeyChecking=yes",
     "-F /dev/null"
   ];
-  if (existsSync29(agentKey)) {
+  if (existsSync31(agentKey)) {
     sshParts.splice(1, 0, `-i "${agentKey}"`, "-o IdentitiesOnly=yes");
   }
   process.env.GIT_SSH_COMMAND = sshParts.join(" ");
 }
 function inferRuntimeContextFileFromWorkspace(workspaceDir) {
-  const candidate = resolve32(workspaceDir, "..", "runtime-context.json");
-  return existsSync29(candidate) ? candidate : "";
+  const candidate = resolve33(workspaceDir, "..", "runtime-context.json");
+  return existsSync31(candidate) ? candidate : "";
 }
 async function main() {
   const args = process.argv.slice(2);
@@ -9239,7 +9308,7 @@ async function runAgentCommand(args) {
         const fileIdx = rest.indexOf("--file");
         const inputFile = fileIdx !== -1 ? rest[fileIdx + 1] : undefined;
         if (inputFile) {
-          content = readFileSync17(resolve32(projectRoot, inputFile), "utf-8");
+          content = readFileSync18(resolve33(projectRoot, inputFile), "utf-8");
         } else {
           const chunks = [];
           for await (const chunk of process.stdin) {
@@ -9542,8 +9611,8 @@ WORKFLOW:
 `);
 }
 async function runCompletionVerification(projectRoot) {
-  const hookPath = resolve32(projectRoot, ".rig/bin/hooks/completion-verification");
-  if (!existsSync29(hookPath)) {
+  const hookPath = resolve33(projectRoot, ".rig/bin/hooks/completion-verification");
+  if (!existsSync31(hookPath)) {
     console.error(`[rig-agent] completion-verification hook binary not found: ${hookPath}`);
     return 1;
   }
@@ -9577,7 +9646,7 @@ async function verifyRuntimeManifest() {
   if (!manifestPath) {
     return;
   }
-  if (!existsSync29(manifestPath)) {
+  if (!existsSync31(manifestPath)) {
     throw new Error(`[rig-agent] Runtime manifest missing: ${manifestPath}`);
   }
   let manifest;
@@ -9594,10 +9663,10 @@ async function verifyRuntimeManifest() {
   if (!manifestBinaryPath || !expectedHash) {
     throw new Error(`[rig-agent] Runtime manifest is missing binary hash data (${manifestPath}).`);
   }
-  if (!existsSync29(manifestBinaryPath)) {
+  if (!existsSync31(manifestBinaryPath)) {
     throw new Error(`[rig-agent] Runtime binary not found at ${manifestBinaryPath}.`);
   }
-  const actualHash = sha256Hex(readFileSync17(resolve32(manifestBinaryPath)));
+  const actualHash = sha256Hex(readFileSync18(resolve33(manifestBinaryPath)));
   if (actualHash !== expectedHash) {
     throw new Error(`[rig-agent] Runtime manifest mismatch for binary hash.
 ` + `expected=${expectedHash}