@h-rig/runtime 0.0.6-alpha.34 → 0.0.6-alpha.35

package/dist/src/control-plane/runtime/index.js

@@ -149,32 +149,32 @@ var RIG_DEFINITION_DIRNAME = "rig", RIG_ARTIFACTS_DIRNAME = "artifacts";
 var init_layout = () => {};
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
-import { existsSync as existsSync21, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve23 } from "path";
 function toRealPath(path) {
-  if (!existsSync21(path)) {
-    return resolve22(path);
+  if (!existsSync23(path)) {
+    return resolve23(path);
   }
   try {
     return realpathSync.native(path);
   } catch {
-    return resolve22(path);
+    return resolve23(path);
   }
 }
 function resolveHostGitMetadataPaths(projectRoot, workspaceDir) {
   const candidates = new Set;
   const addPath = (candidate) => {
-    if (existsSync21(candidate)) {
+    if (existsSync23(candidate)) {
       candidates.add(toRealPath(candidate));
     }
   };
-  addPath(resolve22(projectRoot, ".git"));
-  addPath(resolve22(workspaceDir, "..", "..", ".git"));
+  addPath(resolve23(projectRoot, ".git"));
+  addPath(resolve23(workspaceDir, "..", "..", ".git"));
   for (const repoRoot of resolveHostRepoRootPaths(projectRoot)) {
-    addPath(resolve22(repoRoot, ".git"));
+    addPath(resolve23(repoRoot, ".git"));
   }
-  const workspaceGit = resolve22(workspaceDir, ".git");
-  if (existsSync21(workspaceGit)) {
+  const workspaceGit = resolve23(workspaceDir, ".git");
+  if (existsSync23(workspaceGit)) {
     addPath(workspaceGit);
   }
   return [...candidates];
@@ -182,7 +182,7 @@ function resolveHostGitMetadataPaths(projectRoot, workspaceDir) {
 function resolveHostRepoRootPaths(projectRoot) {
   const candidates = new Set;
   const addPath = (candidate) => {
-    if (existsSync21(candidate)) {
+    if (existsSync23(candidate)) {
       candidates.add(toRealPath(candidate));
     }
   };
@@ -192,11 +192,11 @@ function resolveHostRepoRootPaths(projectRoot) {
       addPath(monorepoRoot);
     }
   } catch {}
-  const reposDir = resolve22(projectRoot, "repos");
-  if (existsSync21(reposDir)) {
+  const reposDir = resolve23(projectRoot, "repos");
+  if (existsSync23(reposDir)) {
     for (const entry of readdirSync4(reposDir, { withFileTypes: true })) {
       if (entry.isDirectory() || entry.isSymbolicLink()) {
-        addPath(resolve22(reposDir, entry.name));
+        addPath(resolve23(reposDir, entry.name));
       }
     }
   }
@@ -240,8 +240,8 @@ var exports_backend_seatbelt = {};
 __export(exports_backend_seatbelt, {
   SeatbeltBackend: () => SeatbeltBackend
 });
-import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync12 } from "fs";
-import { resolve as resolve34 } from "path";
+import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync13 } from "fs";
+import { resolve as resolve35 } from "path";
 
 class SeatbeltBackend {
   kind = "macos-seatbelt";
@@ -265,11 +265,11 @@ class SeatbeltBackend {
     };
   }
   writeSeatbeltProfile(options) {
-    const sandboxDir = resolve34(options.runtime.rootDir, "sandbox");
-    mkdirSync17(sandboxDir, { recursive: true });
-    const profilePath = resolve34(sandboxDir, "seatbelt.sb");
+    const sandboxDir = resolve35(options.runtime.rootDir, "sandbox");
+    mkdirSync18(sandboxDir, { recursive: true });
+    const profilePath = resolve35(sandboxDir, "seatbelt.sb");
     const profile = this.renderProfile(options);
-    writeFileSync12(profilePath, `${profile}
+    writeFileSync13(profilePath, `${profile}
 `, "utf-8");
     return profilePath;
   }
@@ -354,7 +354,7 @@ class SeatbeltBackend {
     const realHome = process.env.HOME?.trim();
     if (realHome) {
       for (const binSubdir of [".local/bin", ".cargo/bin"]) {
-        const binPath = resolve34(realHome, binSubdir);
+        const binPath = resolve35(realHome, binSubdir);
         if (ctx.pathExists(binPath)) {
           lines.push(`(allow file-read* (subpath ${seatbeltString(ctx.realPath(binPath))}))`);
         }
@@ -383,8 +383,8 @@ var exports_backend_bwrap = {};
 __export(exports_backend_bwrap, {
   BwrapBackend: () => BwrapBackend
 });
-import { mkdirSync as mkdirSync18 } from "fs";
-import { resolve as resolve35 } from "path";
+import { mkdirSync as mkdirSync19 } from "fs";
+import { resolve as resolve36 } from "path";
 
 class BwrapBackend {
   kind = "linux-bwrap";
@@ -513,18 +513,18 @@ class BwrapBackend {
     const realHome = process.env.HOME?.trim();
     if (realHome) {
       for (const binSubdir of [".local/bin", ".local/lib", ".cargo/bin"]) {
-        const binPath = ctx.realPath(resolve35(realHome, binSubdir));
+        const binPath = ctx.realPath(resolve36(realHome, binSubdir));
         if (ctx.pathExists(binPath)) {
           args.push("--ro-bind", binPath, binPath);
         }
       }
-      const agentSshDir = resolve35(homeReal, ".ssh");
+      const agentSshDir = resolve36(homeReal, ".ssh");
       if (ctx.pathExists(agentSshDir)) {
         args.push("--ro-bind", agentSshDir, agentSshDir);
       } else {
-        const hostSshDir = resolve35(realHome, ".ssh");
+        const hostSshDir = resolve36(realHome, ".ssh");
         if (ctx.pathExists(hostSshDir)) {
-          mkdirSync18(agentSshDir, { recursive: true });
+          mkdirSync19(agentSshDir, { recursive: true });
           args.push("--ro-bind", hostSshDir, agentSshDir);
           args.push("--ro-bind", hostSshDir, hostSshDir);
         }
@@ -1671,9 +1671,9 @@ function primeGuardHotPaths() {
 }
 primeGuardHotPaths();
 // packages/runtime/src/control-plane/runtime/isolation/index.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync19, readFileSync as readFileSync16, rmSync as rmSync13 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync20, readFileSync as readFileSync17, rmSync as rmSync13 } from "fs";
 import { copyFile, mkdir as mkdir4, writeFile as writeFile2 } from "fs/promises";
-import { resolve as resolve37 } from "path";
+import { resolve as resolve38 } from "path";
 
 // packages/runtime/src/control-plane/native/git-native.ts
 import { chmodSync, copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync } from "fs";
@@ -2558,8 +2558,8 @@ function isAgentRuntimeContextPath(path) {
 var DEFAULT_RESULT_LIMIT = DEFAULT_RUNTIME_MEMORY_RETRIEVAL.topK;
 var DAY_MS = 24 * 60 * 60 * 1000;
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
-import { resolve as resolve26 } from "path";
+import { appendFileSync, existsSync as existsSync26, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve27 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -3123,6 +3123,8 @@ function buildBrowserGuidanceLines(browser) {
 }
 
 // packages/runtime/src/control-plane/plugin-host-context.ts
+import { existsSync as existsSync15 } from "fs";
+import { resolve as resolvePath } from "path";
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
 
@@ -3453,6 +3455,55 @@ async function materializeSkills(projectRoot, entries) {
   return written;
 }
 
+// packages/runtime/src/control-plane/pi-settings-materializer.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname10, resolve as resolve15 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync14(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync7(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve15(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve15(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync14(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync9(dirname10(settingsPath), { recursive: true });
+    writeFileSync6(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync9(dirname10(managedRecordPath), { recursive: true });
+  writeFileSync6(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -3500,6 +3551,14 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const piPackages = config.runtime?.pi?.packages ?? [];
+    if (piPackages.length > 0 || existsSync15(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+      materializePiPackages(projectRoot, piPackages);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -3513,12 +3572,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, join as join3, resolve as resolve16 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename4, join as join3, resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync14, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -3541,7 +3600,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve15(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve16(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -3552,8 +3611,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve15(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync14(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve16(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync16(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -3561,7 +3620,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve15(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -3645,7 +3704,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve16(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve17(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -3728,10 +3787,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve16(projectRoot, "rig.config.json");
-  if (existsSync15(jsonPath)) {
+  const jsonPath = resolve17(projectRoot, "rig.config.json");
+  if (existsSync17(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync8(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -3740,12 +3799,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve16(projectRoot, "rig.config.ts");
-  if (!existsSync15(tsPath)) {
+  const tsPath = resolve17(projectRoot, "rig.config.ts");
+  if (!existsSync17(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync8(tsPath, "utf8");
+    const source = readFileSync9(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -3765,10 +3824,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync15(configPath)) {
+  if (!existsSync17(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync8(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync9(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -3776,8 +3835,8 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve16(projectRoot, sourcePath);
-  if (!existsSync15(directory)) {
+  const directory = resolve17(projectRoot, sourcePath);
+  if (!existsSync17(directory)) {
     return [];
   }
   const tasks = [];
@@ -3792,11 +3851,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve16(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve17(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync8(file, "utf8"));
+  const raw = JSON.parse(readFileSync9(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -3809,7 +3868,7 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync15(directory)) {
+  if (!existsSync17(directory)) {
     return null;
   }
   for (const name of readdirSync2(directory)) {
@@ -3819,7 +3878,7 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync8(file, "utf8"));
+      const raw = JSON.parse(readFileSync9(file, "utf8"));
       const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -3979,8 +4038,8 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync19, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename6, resolve as resolve20 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync11, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename6, resolve as resolve21 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -4088,39 +4147,39 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve20 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync17 } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync19 } from "fs";
+import { resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
 init_layout();
-import { existsSync as existsSync16 } from "fs";
-import { basename as basename5, dirname as dirname10, join as join4, resolve as resolve17 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { basename as basename5, dirname as dirname11, join as join4, resolve as resolve18 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve17(projectRoot);
-  const projectParent = dirname10(normalizedProjectRoot);
+  const normalizedProjectRoot = resolve18(projectRoot);
+  const projectParent = dirname11(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
-    const ownerRoot = dirname10(projectParent);
-    const ownerHasRepoMarkers = existsSync16(resolve17(ownerRoot, ".git")) || existsSync16(resolve17(ownerRoot, ".rig", "state"));
+    const ownerRoot = dirname11(projectParent);
+    const ownerHasRepoMarkers = existsSync18(resolve18(ownerRoot, ".git")) || existsSync18(resolve18(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve17(ownerRoot, ".rig", "state");
+      return resolve18(ownerRoot, ".rig", "state");
     }
   }
-  return resolve17(projectRoot, ".rig", "state");
+  return resolve18(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve17(projectRoot);
+  const normalizedProjectRoot = resolve18(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join4("repos", entry.id);
-  const metadataRoot = resolve17(stateDir, metadataRelativePath);
+  const metadataRoot = resolve18(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve17(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname10(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve18(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname11(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve17(process.env[entry.checkoutEnvVar].trim()) : resolve17(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve18(process.env[entry.checkoutEnvVar].trim()) : resolve18(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -4128,12 +4187,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve17(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve18(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve17(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve17(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve18(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve18(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join4(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -4151,7 +4210,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync17(resolve18(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync19(resolve19(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -4162,8 +4221,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS2 = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync18,
-  readFile: (path) => readFileSync9(path, "utf8")
+  exists: existsSync20,
+  readFile: (path) => readFileSync10(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -4244,12 +4303,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync18(resolve19(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync20(resolve20(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve19(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve19(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve20(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve20(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -4311,7 +4370,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve20(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve21(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -4387,15 +4446,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync19(issuesPath)) {
+  const issuesPath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync21(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync10(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -4420,25 +4479,25 @@ function inferTaskIdFromRuntimePath(path) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve20(workspaceDir, "artifacts", id);
-    if (existsSync19(worktreeArtifacts) || existsSync19(resolve20(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve21(workspaceDir, "artifacts", id);
+    if (existsSync21(worktreeArtifacts) || existsSync21(resolve21(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve20(paths.artifactsDir, id);
+    return resolve21(paths.artifactsDir, id);
   } catch {
-    return resolve20(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve21(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync19(paths.taskConfigPath)) {
+  if (existsSync21(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync19(candidate)) {
+    if (existsSync21(candidate)) {
       return candidate;
     }
   }
@@ -4446,7 +4505,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync19(candidate)) {
+    if (existsSync21(candidate)) {
       return candidate;
     }
   }
@@ -4459,7 +4518,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync8(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -4511,12 +4570,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve20(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync19(issuesPath)) {
+  const issuesPath = resolve21(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync21(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -4572,19 +4631,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve20(projectRoot, sourcePath);
-  if (!existsSync19(directory)) {
+  const directory = resolve21(projectRoot, sourcePath);
+  if (!existsSync21(directory)) {
     return {};
   }
   const config = {};
   for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve20(directory, name);
+    const file = resolve21(directory, name);
     try {
       if (!statSync5(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync10(file, "utf8"));
+      const raw = JSON.parse(readFileSync11(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -4626,10 +4685,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve20(projectRoot, "rig.config.json");
-  if (existsSync19(jsonPath)) {
+  const jsonPath = resolve21(projectRoot, "rig.config.json");
+  if (existsSync21(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync11(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -4641,12 +4700,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve20(projectRoot, "rig.config.ts");
-  if (!existsSync19(tsPath)) {
+  const tsPath = resolve21(projectRoot, "rig.config.ts");
+  if (!existsSync21(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync10(tsPath, "utf8");
+    const source = readFileSync11(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -4660,9 +4719,9 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve20(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve20(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve20(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve21(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve21(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve21(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
@@ -4671,8 +4730,8 @@ init_layout();
 
 // packages/runtime/src/binary-run.ts
 init_layout();
-import { chmodSync as chmodSync4, cpSync, existsSync as existsSync20, mkdirSync as mkdirSync9, renameSync as renameSync3, rmSync as rmSync8, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename7, dirname as dirname11, resolve as resolve21 } from "path";
+import { chmodSync as chmodSync4, cpSync, existsSync as existsSync22, mkdirSync as mkdirSync10, renameSync as renameSync3, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename7, dirname as dirname12, resolve as resolve22 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -4698,9 +4757,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve21(dirname11(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve21(tempBuildDir, basename7(options.outputPath));
-  mkdirSync9(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve22(dirname12(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve22(tempBuildDir, basename7(options.outputPath));
+  mkdirSync10(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -4725,7 +4784,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync20(tempOutputPath)) {
+    if (!existsSync22(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -4757,8 +4816,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve21(options.cwd, options.sourcePath),
-    outputPath: resolve21(options.outputPath)
+    entrypoint: resolve22(options.cwd, options.sourcePath),
+    outputPath: resolve22(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -4772,7 +4831,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync20(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync22(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -4809,7 +4868,7 @@ async function buildRuntimeBinaryViaWorker(options) {
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve21(dirname11(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve22(dirname12(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -4818,13 +4877,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve21(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync20(candidate)) {
+    const candidate = resolve22(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync22(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve21(import.meta.dir, "binary-build-worker.ts");
-  return existsSync20(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve22(import.meta.dir, "binary-build-worker.ts");
+  return existsSync22(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -4860,7 +4919,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync20(input.outputPath) || !existsSync20(input.manifestPath)) {
+  if (!existsSync22(input.outputPath) || !existsSync22(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -4873,7 +4932,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync20(filePath)) {
+    if (!existsSync22(filePath)) {
       return false;
     }
     if (await sha256File4(filePath) !== expectedDigest) {
@@ -4886,7 +4945,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync20(normalized)) {
+    if (!normalized || !existsSync22(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File4(normalized);
@@ -4909,7 +4968,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve21(cwd, inputPath);
+  return resolve22(cwd, inputPath);
 }
 async function sha256File4(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -4925,8 +4984,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve22) => {
-    release = resolve22;
+  runtimeBinaryBuildQueue = new Promise((resolve23) => {
+    release = resolve23;
   });
   await previous;
   try {
@@ -4971,11 +5030,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve24 } from "path";
+import { delimiter, resolve as resolve25 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync22, readdirSync as readdirSync5, realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync5, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve24 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox-utils.ts
 init_utils();
@@ -4992,7 +5051,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve23(home, ".bun/bin/bun") : "",
+    home ? resolve24(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -5020,8 +5079,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve23(home, ".local/bin/claude") : "",
-    home ? resolve23(home, ".local/share/claude/local/claude") : "",
+    home ? resolve24(home, ".local/bin/claude") : "",
+    home ? resolve24(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -5035,35 +5094,35 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve23(bunBinaryPath, "../..");
+  return resolve24(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve23(realPath, "..");
+  return resolve24(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve23(explicitNode) === resolve23(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve23(preferredNode, "../..") : resolve23(preferredNode, "..");
+  if (explicitNode && resolve24(explicitNode) === resolve24(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve24(preferredNode, "../..") : resolve24(preferredNode, "..");
   }
   try {
     const realPath = realpathSync2(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve23(realPath, "../..");
+      return resolve24(realPath, "../..");
     }
-    return resolve23(realPath, "..");
+    return resolve24(realPath, "..");
   } catch {
-    return resolve23(preferredNode, "..");
+    return resolve24(preferredNode, "..");
   }
 }
 function resolveRuntimeDependencyRoots(runtimeDirs) {
   const roots = [];
   if (process.platform === "darwin") {
     for (const macPath of ["/opt/homebrew", "/opt/homebrew/opt"]) {
-      if (existsSync22(macPath)) {
+      if (existsSync24(macPath)) {
         roots.push(macPath);
       }
     }
@@ -5081,23 +5140,23 @@ function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve23(envNode);
-    if (existsSync22(explicit)) {
+    const explicit = resolve24(envNode);
+    if (existsSync24(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve23(nvmBin, "node"));
+    candidates.push(resolve24(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve23(home, ".nvm/versions/node");
-    if (existsSync22(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve24(home, ".nvm/versions/node");
+    if (existsSync24(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync5(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve23(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve24(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -5106,8 +5165,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve23(candidate)));
-  const existing = deduped.filter((candidate) => existsSync22(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve24(candidate)));
+  const existing = deduped.filter((candidate) => existsSync24(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -5121,7 +5180,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve23(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve24(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -5133,8 +5192,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve23(candidate);
-  if (!existsSync22(normalized)) {
+  const normalized = resolve24(candidate);
+  if (!existsSync24(normalized)) {
     return "";
   }
   try {
@@ -5144,7 +5203,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve23(candidate).replace(/\\/g, "/");
+  const normalized = resolve24(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -5165,7 +5224,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve24(claudeBinary, "..");
+      return resolve25(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -5175,8 +5234,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve24(realHome, ".local/bin") : "",
-    realHome ? resolve24(realHome, ".cargo/bin") : "",
+    realHome ? resolve25(realHome, ".local/bin") : "",
+    realHome ? resolve25(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -5205,8 +5264,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 }
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
-import { existsSync as existsSync23, readFileSync as readFileSync11 } from "fs";
-import { resolve as resolve25 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve26 } from "path";
 var BAKED_RUNTIME_SECRETS = {
   ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
   OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
@@ -5249,12 +5308,12 @@ function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
   return resolved;
 }
 function loadDotEnvSecrets(projectRoot, env = process.env) {
-  const dotenvPath = resolve25(projectRoot, ".env");
-  if (!existsSync23(dotenvPath)) {
+  const dotenvPath = resolve26(projectRoot, ".env");
+  if (!existsSync25(dotenvPath)) {
     return {};
   }
   const parsed = {};
-  const lines = readFileSync11(dotenvPath, "utf-8").split(/\r?\n/);
+  const lines = readFileSync12(dotenvPath, "utf-8").split(/\r?\n/);
   for (const rawLine of lines) {
     const line = rawLine.trim();
     if (!line || line.startsWith("#")) {
@@ -5611,16 +5670,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync24(artifactDir)) {
+    if (!existsSync26(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve26(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve26(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve26(artifactDir, "changed-files.txt");
-    if (existsSync24(changedFiles)) {
-      const lines = readFileSync12(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve27(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve27(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve27(artifactDir, "changed-files.txt");
+    if (existsSync26(changedFiles)) {
+      const lines = readFileSync13(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -5744,12 +5803,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve26(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync24(issuesPath)) {
+  const issuesPath = resolve27(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync26(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync12(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync13(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -5862,11 +5921,11 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync24(path)) {
+  if (!existsSync26(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync12(path, "utf-8"));
+  process.stdout.write(readFileSync13(path, "utf-8"));
   console.log("");
 }
 
@@ -5968,7 +6027,7 @@ init_layout();
 
 // packages/runtime/src/control-plane/runtime/overlay.ts
 init_layout();
-import { mkdirSync as mkdirSync11 } from "fs";
+import { mkdirSync as mkdirSync12 } from "fs";
 function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const layout = resolveRuntimeWorkspaceLayout(workspaceDir ?? projectRoot);
   const rootDir = layout.rigRoot;
@@ -5980,14 +6039,14 @@ function ensureRuntimeOverlay(projectRoot, runtimeId, workspaceDir) {
   const sessionDir = layout.sessionDir;
   const runtimeDir = layout.runtimeDir;
   const contextPath = layout.contextPath;
-  mkdirSync11(rootDir, { recursive: true });
-  mkdirSync11(homeDir, { recursive: true });
-  mkdirSync11(tmpDir, { recursive: true });
-  mkdirSync11(cacheDir, { recursive: true });
-  mkdirSync11(logsDir, { recursive: true });
-  mkdirSync11(stateDir, { recursive: true });
-  mkdirSync11(sessionDir, { recursive: true });
-  mkdirSync11(runtimeDir, { recursive: true });
+  mkdirSync12(rootDir, { recursive: true });
+  mkdirSync12(homeDir, { recursive: true });
+  mkdirSync12(tmpDir, { recursive: true });
+  mkdirSync12(cacheDir, { recursive: true });
+  mkdirSync12(logsDir, { recursive: true });
+  mkdirSync12(stateDir, { recursive: true });
+  mkdirSync12(sessionDir, { recursive: true });
+  mkdirSync12(runtimeDir, { recursive: true });
   return {
     rootDir,
     homeDir,
@@ -6005,17 +6064,17 @@ import {
   chmodSync as chmodSync5,
   copyFileSync as copyFileSync5,
   cpSync as cpSync2,
-  existsSync as existsSync26,
-  mkdirSync as mkdirSync12,
+  existsSync as existsSync28,
+  mkdirSync as mkdirSync13,
   statSync as statSync6,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "fs";
 import { mkdir as mkdir2 } from "fs/promises";
-import { basename as basename8, delimiter as delimiter2, resolve as resolve28 } from "path";
+import { basename as basename8, delimiter as delimiter2, resolve as resolve29 } from "path";
 
 // packages/runtime/src/control-plane/runtime/isolation/shared.ts
-import { existsSync as existsSync25, readFileSync as readFileSync13, rmSync as rmSync9 } from "fs";
-import { resolve as resolve27 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync14, rmSync as rmSync9 } from "fs";
+import { resolve as resolve28 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 var generatedCredentialFiles = new Set;
 var credentialCleanupRegistered = false;
@@ -6040,7 +6099,7 @@ function resolveHostGitBinary() {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync25(candidate)) {
+    if (existsSync27(candidate)) {
       return candidate;
     }
   }
@@ -6106,7 +6165,7 @@ async function refreshRemoteBranch(repoRoot, remote, branch) {
   }
 }
 async function tryReadGitHead(repoRoot) {
-  if (!existsSync25(resolve27(repoRoot, ".git"))) {
+  if (!existsSync27(resolve28(repoRoot, ".git"))) {
     return;
   }
   const result = await runGitCommand(repoRoot, ["rev-parse", "HEAD"]);
@@ -6117,7 +6176,7 @@ async function tryReadGitHead(repoRoot) {
   return value || undefined;
 }
 async function captureRepoDirtyFiles(repoRoot) {
-  if (!existsSync25(resolve27(repoRoot, ".git"))) {
+  if (!existsSync27(resolve28(repoRoot, ".git"))) {
     return [];
   }
   const files = new Set;
@@ -6208,16 +6267,16 @@ function hashProjectPath(workspaceDir) {
 }
 function resolveGithubCliBinaryPath() {
   const explicit = process.env.RIG_GH_BIN?.trim();
-  if (explicit && existsSync25(explicit) && !isRuntimeGatewayGhPath(explicit)) {
+  if (explicit && existsSync27(explicit) && !isRuntimeGatewayGhPath(explicit)) {
     return explicit;
   }
   for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
-    if (existsSync25(candidate)) {
+    if (existsSync27(candidate)) {
       return candidate;
     }
   }
   const bunResolved = Bun.which("gh");
-  if (bunResolved && existsSync25(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
+  if (bunResolved && existsSync27(bunResolved) && !isRuntimeGatewayGhPath(bunResolved)) {
     return bunResolved;
   }
   return "";
@@ -6251,17 +6310,17 @@ function resolveSystemCertBundlePath() {
     "/opt/homebrew/etc/openssl@3/cert.pem"
   ];
   for (const candidate of candidates) {
-    if (candidate && existsSync25(candidate)) {
-      return resolve27(candidate);
+    if (candidate && existsSync27(candidate)) {
+      return resolve28(candidate);
     }
   }
   return "";
 }
 function readKnownHosts(path) {
-  if (!existsSync25(path)) {
+  if (!existsSync27(path)) {
     return new Set;
   }
-  return new Set(readFileSync13(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
+  return new Set(readFileSync14(path, "utf-8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/home.ts
@@ -6276,12 +6335,12 @@ function resolveControlPlaneSourceRoot(projectRoot) {
   const candidates = [
     process.env.RIG_CONTROL_PLANE_SOURCE_ROOT?.trim(),
     process.env.RIG_HOST_PROJECT_ROOT?.trim(),
-    resolve28(import.meta.dir, "../../../../.."),
+    resolve29(import.meta.dir, "../../../../.."),
     projectRoot
   ].filter((value) => Boolean(value));
   for (const candidate of candidates) {
-    const root = resolve28(candidate);
-    if (existsSync26(resolve28(root, "packages/runtime/src/control-plane/pi-sessiond/bin.ts"))) {
+    const root = resolve29(candidate);
+    if (existsSync28(resolve29(root, "packages/runtime/src/control-plane/pi-sessiond/bin.ts"))) {
       return root;
     }
   }
@@ -6301,7 +6360,7 @@ async function runtimeEnv(projectRoot, runtime) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve28(claudeBinaryPath, "..");
+      return resolve29(claudeBinaryPath, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -6316,8 +6375,8 @@ async function runtimeEnv(projectRoot, runtime) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve28(realHome, ".local/bin") : "",
-    realHome ? resolve28(realHome, ".cargo/bin") : "",
+    realHome ? resolve29(realHome, ".local/bin") : "",
+    realHome ? resolve29(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -6328,9 +6387,9 @@ async function runtimeEnv(projectRoot, runtime) {
     "/usr/sbin",
     "/sbin"
   ].filter(Boolean);
-  const runtimeBash = resolve28(runtime.binDir, "bash");
-  const runtimeRigGit = resolve28(runtime.binDir, runtimeRigGitFileName());
-  const preferredShell = existsSync26(runtimeBash) ? runtimeBash : "/bin/bash";
+  const runtimeBash = resolve29(runtime.binDir, "bash");
+  const runtimeRigGit = resolve29(runtime.binDir, runtimeRigGitFileName());
+  const preferredShell = existsSync28(runtimeBash) ? runtimeBash : "/bin/bash";
   const nativeRuntimeLibraryPath = await materializeNativeRuntimeLibrary(runtime.binDir);
   const controlPlaneSourceRoot = resolveControlPlaneSourceRoot(projectRoot);
   const env = {
@@ -6351,30 +6410,30 @@ async function runtimeEnv(projectRoot, runtime) {
     RIG_RUNTIME_MODE: runtime.mode,
     RIG_RUNTIME_HOME: runtime.rootDir,
     RIG_RUNTIME_BIN_DIR: runtime.binDir,
-    ...existsSync26(runtimeRigGit) ? { RIG_NATIVE_GIT_BIN: runtimeRigGit } : {},
+    ...existsSync28(runtimeRigGit) ? { RIG_NATIVE_GIT_BIN: runtimeRigGit } : {},
     RIG_BUN_PATH: bunBinaryPath,
     ...claudeBinaryPath ? { RIG_CLAUDE_PATH: claudeBinaryPath } : {},
-    RIG_AGENT_BIN: resolve28(runtime.binDir, "rig-agent"),
+    RIG_AGENT_BIN: resolve29(runtime.binDir, "rig-agent"),
     RIG_HOOKS_ACTIVE: "1",
     RIG_AUTO_PR_ON_COMPLETE: "1",
-    RIG_POLICY_FILE: resolve28(projectRoot, "rig/policy/policy.json"),
+    RIG_POLICY_FILE: resolve29(projectRoot, "rig/policy/policy.json"),
     RIG_STATE_DIR: runtime.stateDir,
     RIG_LOGS_DIR: runtime.logsDir,
-    RIG_SESSION_FILE: resolve28(runtime.sessionDir, "session.json"),
+    RIG_SESSION_FILE: resolve29(runtime.sessionDir, "session.json"),
     MONOREPO_ROOT: runtime.workspaceDir,
     MONOREPO_MAIN_ROOT: monorepoMainRoot,
-    TS_API_TESTS_DIR: resolve28(runtime.workspaceDir, "TSAPITests"),
+    TS_API_TESTS_DIR: resolve29(runtime.workspaceDir, "TSAPITests"),
     BASH: preferredShell,
     SHELL: preferredShell,
     PATH: [...new Set(pathEntries)].join(delimiter2),
     LANG: process.env.LANG ?? "en_US.UTF-8",
     TERM: process.env.TERM ?? "xterm-256color",
     PYTHONDONTWRITEBYTECODE: "1",
-    PYTHONPYCACHEPREFIX: resolve28(runtime.cacheDir, "python"),
+    PYTHONPYCACHEPREFIX: resolve29(runtime.cacheDir, "python"),
     ...process.env.RIG_PR_BASE_PROJECT && { RIG_PR_BASE_PROJECT: process.env.RIG_PR_BASE_PROJECT },
     ...process.env.RIG_PR_BASE_MONOREPO && { RIG_PR_BASE_MONOREPO: process.env.RIG_PR_BASE_MONOREPO },
     CLAUDE_HOME: runtime.claudeHomeDir,
-    PI_CODING_AGENT_DIR: resolve28(runtime.homeDir, ".pi", "agent"),
+    PI_CODING_AGENT_DIR: resolve29(runtime.homeDir, ".pi", "agent"),
     [RUNTIME_CONTEXT_ENV]: runtime.contextFile,
     ...nativeRuntimeLibraryPath ? { RIG_NATIVE_RUNTIME_LIB: nativeRuntimeLibraryPath } : {},
     ...hostGhBinary ? { RIG_GH_BIN: hostGhBinary } : {},
@@ -6385,16 +6444,16 @@ async function runtimeEnv(projectRoot, runtime) {
       NODE_EXTRA_CA_CERTS: runtimeCertBundlePath
     } : {}
   };
-  const knownHostsPath = resolve28(runtime.homeDir, ".ssh", "known_hosts");
-  if (existsSync26(knownHostsPath)) {
-    const agentSshKey = resolve28(runtime.homeDir, ".ssh", "rig-agent-key");
+  const knownHostsPath = resolve29(runtime.homeDir, ".ssh", "known_hosts");
+  if (existsSync28(knownHostsPath)) {
+    const agentSshKey = resolve29(runtime.homeDir, ".ssh", "rig-agent-key");
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${knownHostsPath}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (existsSync26(agentSshKey)) {
+    if (existsSync28(agentSshKey)) {
       sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -6431,7 +6490,7 @@ async function runtimeEnv(projectRoot, runtime) {
   if (!env.GREPTILE_GITHUB_TOKEN && env.GITHUB_TOKEN) {
     env.GREPTILE_GITHUB_TOKEN = env.GITHUB_TOKEN;
   }
-  if (existsSync26(runtime.contextFile)) {
+  if (existsSync28(runtime.contextFile)) {
     const runtimeContext = loadRuntimeContext(runtime.contextFile);
     Object.assign(env, runtimeMemoryEnvFromContext(runtimeContext));
     Object.assign(env, browserEnvFromContext(runtimeContext.browser));
@@ -6460,30 +6519,30 @@ async function provisionRuntimeHome(runtime, options = {}) {
   await mkdir2(runtime.cacheDir, { recursive: true });
   await provisionAgentSshKey(runtime.homeDir);
   if (options.provider === "codex") {
-    const hasCodexAuth = await injectCodexAuth(resolve28(runtime.homeDir, ".codex"));
+    const hasCodexAuth = await injectCodexAuth(resolve29(runtime.homeDir, ".codex"));
     if (!hasCodexAuth) {
       console.warn("[rig] No Codex auth.json found for isolated runtime. " + "Run `codex login` in your host shell, then retry the agent run.");
     }
   }
   if (options.provider === "pi") {
-    const hasPiAuth = await injectPiAgentConfig(resolve28(runtime.homeDir, ".pi", "agent"));
+    const hasPiAuth = await injectPiAgentConfig(resolve29(runtime.homeDir, ".pi", "agent"));
     if (!hasPiAuth) {
       console.warn("[rig] No Pi auth.json found for isolated runtime. " + "Run `pi /login` in your host shell, then retry the agent run.");
     }
   }
 }
 async function provisionClaudeHome(config) {
-  mkdirSync12(config.claudeHomeDir, { recursive: true });
-  const workspaceSettings = resolve28(config.workspaceDir, ".claude/settings.json");
-  const hostSettings = resolve28(config.hostProjectRoot, ".claude/settings.json");
-  const projectSettings = existsSync26(workspaceSettings) ? workspaceSettings : hostSettings;
+  mkdirSync13(config.claudeHomeDir, { recursive: true });
+  const workspaceSettings = resolve29(config.workspaceDir, ".claude/settings.json");
+  const hostSettings = resolve29(config.hostProjectRoot, ".claude/settings.json");
+  const projectSettings = existsSync28(workspaceSettings) ? workspaceSettings : hostSettings;
   const runtimeSettings = await loadRuntimeClaudeSettings(projectSettings);
-  if (existsSync26(projectSettings)) {
-    writeFileSync10(resolve28(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  if (existsSync28(projectSettings)) {
+    writeFileSync11(resolve29(config.claudeHomeDir, "settings.local.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
   }
   writeClaudeProjectSettings(config.claudeHomeDir, config.workspaceDir, runtimeSettings);
-  writeFileSync10(resolve28(config.claudeHomeDir, "settings.json"), JSON.stringify({
+  writeFileSync11(resolve29(config.claudeHomeDir, "settings.json"), JSON.stringify({
     permissions: { defaultMode: "bypassPermissions" },
     autoMemoryEnabled: false
   }, null, 2));
@@ -6491,12 +6550,12 @@ async function provisionClaudeHome(config) {
   if (!hasCredentials) {
     console.warn("[rig] No Claude credentials found for isolated runtime. " + "Run `claude /login` in your host shell, then retry the agent run.");
   }
-  const realClaudeHome = resolve28(process.env.HOME ?? "", ".claude");
-  if (process.env.HOME && existsSync26(resolve28(realClaudeHome, "CLAUDE.md"))) {
-    cpSync2(resolve28(realClaudeHome, "CLAUDE.md"), resolve28(config.claudeHomeDir, "CLAUDE.md"));
+  const realClaudeHome = resolve29(process.env.HOME ?? "", ".claude");
+  if (process.env.HOME && existsSync28(resolve29(realClaudeHome, "CLAUDE.md"))) {
+    cpSync2(resolve29(realClaudeHome, "CLAUDE.md"), resolve29(config.claudeHomeDir, "CLAUDE.md"));
   }
-  if (process.env.HOME && existsSync26(resolve28(realClaudeHome, "agents"))) {
-    cpSync2(resolve28(realClaudeHome, "agents"), resolve28(config.claudeHomeDir, "agents"), { recursive: true });
+  if (process.env.HOME && existsSync28(resolve29(realClaudeHome, "agents"))) {
+    cpSync2(resolve29(realClaudeHome, "agents"), resolve29(config.claudeHomeDir, "agents"), { recursive: true });
   }
   if (process.platform === "darwin" && process.env.HOME) {
     writeClaudeProjectSettings(realClaudeHome, config.workspaceDir, runtimeSettings);
@@ -6507,10 +6566,10 @@ async function materializeRuntimeCertBundle(runtime) {
   if (!sourcePath) {
     return "";
   }
-  const certsDir = resolve28(runtime.rootDir, "certs");
-  const targetPath = resolve28(certsDir, "ca-certificates.pem");
+  const certsDir = resolve29(runtime.rootDir, "certs");
+  const targetPath = resolve29(certsDir, "ca-certificates.pem");
   await mkdir2(certsDir, { recursive: true });
-  let shouldCopy = !existsSync26(targetPath);
+  let shouldCopy = !existsSync28(targetPath);
   if (!shouldCopy) {
     try {
       shouldCopy = statSync6(sourcePath).mtimeMs > statSync6(targetPath).mtimeMs;
@@ -6532,7 +6591,7 @@ function applyGitHubCredentialHelperEnv(env) {
   env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
 }
 function persistRuntimeSecrets(runtimeRoot, env) {
-  const secretsPath = resolve28(runtimeRoot, "runtime-secrets.json");
+  const secretsPath = resolve29(runtimeRoot, "runtime-secrets.json");
   const persisted = {};
   for (const key of [
     "GITHUB_TOKEN",
@@ -6551,12 +6610,12 @@ function persistRuntimeSecrets(runtimeRoot, env) {
   if (Object.keys(persisted).length === 0) {
     return;
   }
-  writeFileSync10(secretsPath, `${JSON.stringify(persisted, null, 2)}
+  writeFileSync11(secretsPath, `${JSON.stringify(persisted, null, 2)}
 `, "utf-8");
 }
 async function provisionAgentSshKey(homeDir) {
-  const sshDir = resolve28(homeDir, ".ssh");
-  if (!existsSync26(sshDir)) {
+  const sshDir = resolve29(homeDir, ".ssh");
+  if (!existsSync28(sshDir)) {
     await mkdir2(sshDir, { recursive: true });
   }
   seedKnownHosts(sshDir);
@@ -6564,27 +6623,27 @@ async function provisionAgentSshKey(homeDir) {
   const privateKey = decodeProvisionedSshKey(secrets.GITHUB_SSH_KEY);
   if (!privateKey) {
     const hostKeyPath = resolveHostSshKeyPath(process.env.HOME ?? "");
-    if (!process.env.HOME || !existsSync26(hostKeyPath)) {
+    if (!process.env.HOME || !existsSync28(hostKeyPath)) {
       return;
     }
-    const agentKeyPath2 = resolve28(sshDir, "rig-agent-key");
-    if (!existsSync26(agentKeyPath2)) {
+    const agentKeyPath2 = resolve29(sshDir, "rig-agent-key");
+    if (!existsSync28(agentKeyPath2)) {
       copyFileSync5(hostKeyPath, agentKeyPath2);
       chmodSync5(agentKeyPath2, 384);
     }
     const hostPubPath = `${hostKeyPath}.pub`;
-    if (existsSync26(hostPubPath)) {
+    if (existsSync28(hostPubPath)) {
       const agentPubPath = `${agentKeyPath2}.pub`;
-      if (!existsSync26(agentPubPath)) {
+      if (!existsSync28(agentPubPath)) {
         copyFileSync5(hostPubPath, agentPubPath);
       }
     }
     writeSshConfig(sshDir, agentKeyPath2);
     return;
   }
-  const agentKeyPath = resolve28(sshDir, "rig-agent-key");
-  if (!existsSync26(agentKeyPath)) {
-    writeFileSync10(agentKeyPath, privateKey, { mode: 384 });
+  const agentKeyPath = resolve29(sshDir, "rig-agent-key");
+  if (!existsSync28(agentKeyPath)) {
+    writeFileSync11(agentKeyPath, privateKey, { mode: 384 });
   }
   writeSshConfig(sshDir, agentKeyPath);
 }
@@ -6601,21 +6660,21 @@ function decodeProvisionedSshKey(encodedKey) {
 `;
 }
 function resolveHostSshKeyPath(homeDir) {
-  const sshDir = resolve28(homeDir, ".ssh");
+  const sshDir = resolve29(homeDir, ".ssh");
   const candidates = [
     "rig-agent-key",
     "id_ed25519",
     "id_ecdsa",
     "id_rsa"
-  ].map((name) => resolve28(sshDir, name));
-  return candidates.find((candidate) => existsSync26(candidate)) ?? resolve28(sshDir, "rig-agent-key");
+  ].map((name) => resolve29(sshDir, name));
+  return candidates.find((candidate) => existsSync28(candidate)) ?? resolve29(sshDir, "rig-agent-key");
 }
 function writeSshConfig(sshDir, keyPath) {
-  const configPath = resolve28(sshDir, "config");
-  if (existsSync26(configPath)) {
+  const configPath = resolve29(sshDir, "config");
+  if (existsSync28(configPath)) {
     return;
   }
-  const knownHostsPath = resolve28(sshDir, "known_hosts");
+  const knownHostsPath = resolve29(sshDir, "known_hosts");
   const config = [
     "Host github.com",
     `  IdentityFile ${keyPath}`,
@@ -6625,10 +6684,10 @@ function writeSshConfig(sshDir, keyPath) {
     ""
   ].join(`
 `);
-  writeFileSync10(configPath, config, { mode: 420 });
+  writeFileSync11(configPath, config, { mode: 420 });
 }
 function seedKnownHosts(sshDir) {
-  const knownHostsPath = resolve28(sshDir, "known_hosts");
+  const knownHostsPath = resolve29(sshDir, "known_hosts");
   const existingLines = readKnownHosts(knownHostsPath);
   const requiredLines = GITHUB_KNOWN_HOSTS.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const missing = requiredLines.filter((line) => !existingLines.has(line));
@@ -6639,23 +6698,23 @@ function seedKnownHosts(sshDir) {
     for (const line of missing) {
       existingLines.add(line);
     }
-    writeFileSync10(knownHostsPath, `${Array.from(existingLines).join(`
+    writeFileSync11(knownHostsPath, `${Array.from(existingLines).join(`
 `)}
 `, { mode: 420 });
   } catch (err) {
-    const hint = existsSync26(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
+    const hint = existsSync28(knownHostsPath) ? "" : " \u2014 known_hosts is missing; git SSH operations may fail";
     console.warn(`[rig] Could not update ${knownHostsPath}: ${err instanceof Error ? err.message : String(err)}${hint}`);
   }
 }
 function writeClaudeProjectSettings(claudeHomeDir, workspaceDir, runtimeSettings) {
   const projectHash = hashProjectPath(workspaceDir);
-  const projectDir = resolve28(claudeHomeDir, "projects", projectHash);
-  mkdirSync12(projectDir, { recursive: true });
-  writeFileSync10(resolve28(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
+  const projectDir = resolve29(claudeHomeDir, "projects", projectHash);
+  mkdirSync13(projectDir, { recursive: true });
+  writeFileSync11(resolve29(projectDir, "settings.json"), `${JSON.stringify(runtimeSettings, null, 2)}
 `, "utf-8");
 }
 async function loadRuntimeClaudeSettings(projectSettingsPath) {
-  if (!existsSync26(projectSettingsPath)) {
+  if (!existsSync28(projectSettingsPath)) {
     return {};
   }
   let parsed;
@@ -6701,7 +6760,7 @@ async function loadRuntimeClaudeSettings(projectSettingsPath) {
   return clone;
 }
 async function injectClaudeCredentials(claudeHomeDir, options = {}) {
-  const credentialsPath = resolve28(claudeHomeDir, ".credentials.json");
+  const credentialsPath = resolve29(claudeHomeDir, ".credentials.json");
   const platform = options.platform ?? process.platform;
   if (platform === "darwin") {
     const raw = options.loadKeychainCredentials ? await options.loadKeychainCredentials() : await (async () => {
@@ -6711,16 +6770,16 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
     if (raw) {
       try {
         JSON.parse(raw);
-        writeFileSync10(credentialsPath, raw, { mode: 384 });
+        writeFileSync11(credentialsPath, raw, { mode: 384 });
         registerCredentialCleanup(credentialsPath);
         return true;
       } catch {}
     }
   }
-  const hostClaudeHome = options.hostClaudeHome ? resolve28(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve28(process.env.CLAUDE_HOME) : process.env.HOME ? resolve28(process.env.HOME, ".claude") : "";
+  const hostClaudeHome = options.hostClaudeHome ? resolve29(options.hostClaudeHome) : process.env.CLAUDE_HOME?.trim() ? resolve29(process.env.CLAUDE_HOME) : process.env.HOME ? resolve29(process.env.HOME, ".claude") : "";
   if (hostClaudeHome) {
-    const realCredentials = resolve28(hostClaudeHome, ".credentials.json");
-    if (existsSync26(realCredentials)) {
+    const realCredentials = resolve29(hostClaudeHome, ".credentials.json");
+    if (existsSync28(realCredentials)) {
       cpSync2(realCredentials, credentialsPath);
       return true;
     }
@@ -6728,36 +6787,36 @@ async function injectClaudeCredentials(claudeHomeDir, options = {}) {
   return false;
 }
 async function injectCodexAuth(codexHomeDir) {
-  mkdirSync12(codexHomeDir, { recursive: true });
-  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve28(process.env.CODEX_HOME) : process.env.HOME ? resolve28(process.env.HOME, ".codex") : "";
+  mkdirSync13(codexHomeDir, { recursive: true });
+  const hostCodexHome = process.env.CODEX_HOME?.trim() ? resolve29(process.env.CODEX_HOME) : process.env.HOME ? resolve29(process.env.HOME, ".codex") : "";
   if (!hostCodexHome) {
     return false;
   }
-  const hostAuthPath = resolve28(hostCodexHome, "auth.json");
-  if (!existsSync26(hostAuthPath)) {
+  const hostAuthPath = resolve29(hostCodexHome, "auth.json");
+  if (!existsSync28(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve28(codexHomeDir, "auth.json");
+  const runtimeAuthPath = resolve29(codexHomeDir, "auth.json");
   copyFileSync5(hostAuthPath, runtimeAuthPath);
   chmodSync5(runtimeAuthPath, 384);
   return true;
 }
 async function injectPiAgentConfig(piAgentDir) {
-  mkdirSync12(piAgentDir, { recursive: true });
-  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve28(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve28(process.env.HOME, ".pi", "agent") : "";
+  mkdirSync13(piAgentDir, { recursive: true });
+  const hostPiAgentDir = process.env.PI_CODING_AGENT_DIR?.trim() ? resolve29(process.env.PI_CODING_AGENT_DIR) : process.env.HOME ? resolve29(process.env.HOME, ".pi", "agent") : "";
   if (!hostPiAgentDir) {
     return false;
   }
-  const hostAuthPath = resolve28(hostPiAgentDir, "auth.json");
-  if (!existsSync26(hostAuthPath)) {
+  const hostAuthPath = resolve29(hostPiAgentDir, "auth.json");
+  if (!existsSync28(hostAuthPath)) {
     return false;
   }
-  const runtimeAuthPath = resolve28(piAgentDir, "auth.json");
+  const runtimeAuthPath = resolve29(piAgentDir, "auth.json");
   copyFileSync5(hostAuthPath, runtimeAuthPath);
   chmodSync5(runtimeAuthPath, 384);
-  const hostSettingsPath = resolve28(hostPiAgentDir, "settings.json");
-  if (existsSync26(hostSettingsPath)) {
-    const runtimeSettingsPath = resolve28(piAgentDir, "settings.json");
+  const hostSettingsPath = resolve29(hostPiAgentDir, "settings.json");
+  if (existsSync28(hostSettingsPath)) {
+    const runtimeSettingsPath = resolve29(piAgentDir, "settings.json");
     copyFileSync5(hostSettingsPath, runtimeSettingsPath);
     chmodSync5(runtimeSettingsPath, 384);
   }
@@ -6765,13 +6824,13 @@ async function injectPiAgentConfig(piAgentDir) {
 }
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync13, statSync as statSync7, writeFileSync as writeFileSync11 } from "fs";
-import { resolve as resolve29 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync14, statSync as statSync7, writeFileSync as writeFileSync12 } from "fs";
+import { resolve as resolve30 } from "path";
 var CLAUDE_ROUTER_SERVER_NAME = "rig_runtime_tools";
 function buildRuntimeToolRouterServerConfig(options) {
   return {
     type: "stdio",
-    command: resolve29(options.binDir, "rig-tool-router"),
+    command: resolve30(options.binDir, "rig-tool-router"),
     args: [],
     env: {
       RIG_RUNTIME_CONTEXT_FILE: options.contextFile,
@@ -6780,25 +6839,25 @@ function buildRuntimeToolRouterServerConfig(options) {
   };
 }
 function writeClaudeRuntimeToolRouterConfig(options) {
-  const configPath = resolve29(options.stateDir, "claude-runtime-tools.mcp.json");
-  mkdirSync13(options.stateDir, { recursive: true });
+  const configPath = resolve30(options.stateDir, "claude-runtime-tools.mcp.json");
+  mkdirSync14(options.stateDir, { recursive: true });
   const payload = {
     mcpServers: {
       [CLAUDE_ROUTER_SERVER_NAME]: buildRuntimeToolRouterServerConfig(options)
     }
   };
-  writeFileSync11(configPath, `${JSON.stringify(payload, null, 2)}
+  writeFileSync12(configPath, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
   return configPath;
 }
 if (false) {}
 // packages/runtime/src/control-plane/runtime/isolation/discovery.ts
 init_layout();
-import { resolve as resolve33 } from "path";
+import { resolve as resolve34 } from "path";
 
 // packages/runtime/src/control-plane/runtime/isolation/worktree.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync14, rmSync as rmSync10 } from "fs";
-import { dirname as dirname12, resolve as resolve30 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync15, rmSync as rmSync10 } from "fs";
+import { dirname as dirname13, resolve as resolve31 } from "path";
 async function resolveMonorepoBaseRef(monorepoRoot) {
   const explicit = process.env.RIG_RUNTIME_BASE_REF?.trim();
   if (explicit) {
@@ -6834,12 +6893,12 @@ function ensureProvisioningHostProjectRootEnv(projectRoot) {
 }
 async function provisionRuntimeWorktree(config) {
   const branch = runtimeBranchName(config.taskId, config.runtimeId);
-  let hasValidWorktree = existsSync28(resolve30(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
-  if (existsSync28(config.workspaceDir) && !hasValidWorktree) {
+  let hasValidWorktree = existsSync30(resolve31(config.workspaceDir, ".git")) && (await runGitCommand(config.workspaceDir, ["rev-parse", "--show-toplevel"])).exitCode === 0;
+  if (existsSync30(config.workspaceDir) && !hasValidWorktree) {
     rmSync10(config.workspaceDir, { recursive: true, force: true });
   }
   if (!hasValidWorktree) {
-    mkdirSync14(dirname12(config.workspaceDir), { recursive: true });
+    mkdirSync15(dirname13(config.workspaceDir), { recursive: true });
     const branchExists = await runGitCommand(config.monorepoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
     const add = branchExists.exitCode === 0 ? await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", config.workspaceDir, branch]) : await runGitCommand(config.monorepoRoot, ["worktree", "add", "--force", "-b", branch, config.workspaceDir, config.baseRef]);
     if (add.exitCode !== 0) {
@@ -7021,31 +7080,31 @@ async function preferredBaseRemotes(repoRoot) {
 
 // packages/runtime/src/control-plane/runtime/isolation/toolchain.ts
 import {
-  existsSync as existsSync30,
+  existsSync as existsSync32,
   lstatSync,
-  mkdirSync as mkdirSync16,
+  mkdirSync as mkdirSync17,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   rmSync as rmSync11,
   statSync as statSync9,
   symlinkSync as symlinkSync4
 } from "fs";
 import { mkdir as mkdir3, writeFile } from "fs/promises";
-import { dirname as dirname14, resolve as resolve32 } from "path";
+import { dirname as dirname15, resolve as resolve33 } from "path";
 
 // packages/runtime/src/control-plane/runtime/tooling/claude-router-binary.ts
-import { chmodSync as chmodSync6, copyFileSync as copyFileSync6, existsSync as existsSync29, mkdirSync as mkdirSync15, statSync as statSync8 } from "fs";
+import { chmodSync as chmodSync6, copyFileSync as copyFileSync6, existsSync as existsSync31, mkdirSync as mkdirSync16, statSync as statSync8 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { dirname as dirname13, resolve as resolve31 } from "path";
-var sharedRouterOutputDir = resolve31(tmpdir6(), "rig-native");
-var sharedRouterOutputPath = resolve31(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+import { dirname as dirname14, resolve as resolve32 } from "path";
+var sharedRouterOutputDir = resolve32(tmpdir6(), "rig-native");
+var sharedRouterOutputPath = resolve32(sharedRouterOutputDir, `rig-tool-router-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 function runtimeClaudeToolRouterFileName() {
   return `rig-tool-router${process.platform === "win32" ? ".exe" : ""}`;
 }
 async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = sharedRouterOutputPath) {
-  const sourcePath = resolve31(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
-  mkdirSync15(dirname13(outputPath), { recursive: true });
-  const needsBuild = !existsSync29(outputPath) || statSync8(sourcePath).mtimeMs > statSync8(outputPath).mtimeMs;
+  const sourcePath = resolve32(projectRoot, "packages/runtime/src/control-plane/runtime/tooling/claude-router.ts");
+  mkdirSync16(dirname14(outputPath), { recursive: true });
+  const needsBuild = !existsSync31(outputPath) || statSync8(sourcePath).mtimeMs > statSync8(outputPath).mtimeMs;
   if (!needsBuild) {
     return outputPath;
   }
@@ -7059,9 +7118,9 @@ async function ensureClaudeToolRouterBinaryPath(projectRoot, outputPath = shared
 }
 async function materializeClaudeToolRouterBinary(projectRoot, targetDir) {
   const sourcePath = await ensureClaudeToolRouterBinaryPath(projectRoot);
-  const targetPath = resolve31(targetDir, runtimeClaudeToolRouterFileName());
-  mkdirSync15(targetDir, { recursive: true });
-  const needsCopy = !existsSync29(targetPath) || statSync8(sourcePath).mtimeMs > statSync8(targetPath).mtimeMs;
+  const targetPath = resolve32(targetDir, runtimeClaudeToolRouterFileName());
+  mkdirSync16(targetDir, { recursive: true });
+  const needsCopy = !existsSync31(targetPath) || statSync8(sourcePath).mtimeMs > statSync8(targetPath).mtimeMs;
   if (needsCopy) {
     copyFileSync6(sourcePath, targetPath);
     chmodSync6(targetPath, 493);
@@ -7074,48 +7133,48 @@ var GIT_INDEX_LOCK_RETRY_DELAY_MS = 250;
 var GIT_INDEX_LOCK_STALE_AFTER_MS = 5000;
 function resolveRigSourceRoot(projectRoot) {
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot && existsSync30(resolve32(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
+  if (hostProjectRoot && existsSync32(resolve33(hostProjectRoot, "packages/runtime/bin/rig-agent.ts"))) {
     return hostProjectRoot;
   }
-  const fromModule = resolve32(import.meta.dir, "../../../../../..");
-  if (existsSync30(resolve32(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
+  const fromModule = resolve33(import.meta.dir, "../../../../../..");
+  if (existsSync32(resolve33(fromModule, "packages/runtime/bin/rig-agent.ts"))) {
     return fromModule;
   }
   return projectRoot;
 }
 function prepareTrackedRuntimePaths(logsDir, stateDir, sessionDir) {
-  for (const path of [logsDir, stateDir, sessionDir, resolve32(sessionDir, "session.json")]) {
+  for (const path of [logsDir, stateDir, sessionDir, resolve33(sessionDir, "session.json")]) {
     removeSymbolicLink(path);
   }
   runtimePrepareTrackedPathsNative({
     logsDir,
     stateDir,
     sessionDir,
-    controlledBashLogFile: resolve32(logsDir, "controlled-bash.jsonl"),
-    eventsFile: resolve32(logsDir, "control-plane.events.jsonl")
+    controlledBashLogFile: resolve33(logsDir, "controlled-bash.jsonl"),
+    eventsFile: resolve33(logsDir, "control-plane.events.jsonl")
   });
 }
 async function initializeRuntimeStateFiles(stateDir, sessionDir, taskId) {
   await mkdir3(stateDir, { recursive: true });
   await mkdir3(sessionDir, { recursive: true });
-  const failedApproachesPath = resolve32(stateDir, "failed_approaches.md");
-  if (!existsSync30(failedApproachesPath)) {
+  const failedApproachesPath = resolve33(stateDir, "failed_approaches.md");
+  if (!existsSync32(failedApproachesPath)) {
     await writeFile(failedApproachesPath, `# Failed Approaches
 
 `);
   }
-  const hookTripsPath = resolve32(stateDir, "hook_trips.log");
-  if (!existsSync30(hookTripsPath)) {
+  const hookTripsPath = resolve33(stateDir, "hook_trips.log");
+  if (!existsSync32(hookTripsPath)) {
     await writeFile(hookTripsPath, "");
   }
-  const sessionFile = resolve32(sessionDir, "session.json");
+  const sessionFile = resolve33(sessionDir, "session.json");
   if (taskId) {
     await writeFile(sessionFile, JSON.stringify({ activeTaskIds: [taskId] }));
   }
 }
 async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
-  const artifactDir = resolve32(workspaceDir, "artifacts", taskId);
-  const runtimeSnapshotDir = resolve32(artifactDir, "runtime-snapshots");
+  const artifactDir = resolve33(workspaceDir, "artifacts", taskId);
+  const runtimeSnapshotDir = resolve33(artifactDir, "runtime-snapshots");
   let preservedTrackedFiles = false;
   for (const file of [
     "changed-files.txt",
@@ -7131,7 +7190,7 @@ async function resetEphemeralTaskArtifacts(workspaceDir, taskId) {
       preservedTrackedFiles = true;
       continue;
     }
-    rmSync11(resolve32(artifactDir, file), { force: true });
+    rmSync11(resolve33(artifactDir, file), { force: true });
   }
   const runtimeSnapshotRelativePath = `artifacts/${taskId}/runtime-snapshots`;
   if (await resetTrackedArtifactPath(workspaceDir, runtimeSnapshotRelativePath)) {
@@ -7170,28 +7229,28 @@ async function buildRuntimeToolchain(options) {
     throw new Error("Failed to provision the native Zig runtime library.");
   }
   const rigSourceRoot = resolveRigSourceRoot(options.projectRoot);
-  await buildBinary("packages/cli/bin/rig.ts", resolve32(options.binDir, "rig"), rigSourceRoot);
-  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve32(options.binDir, "rig-agent"), rigSourceRoot, {
+  await buildBinary("packages/cli/bin/rig.ts", resolve33(options.binDir, "rig"), rigSourceRoot);
+  await buildBinary("packages/runtime/bin/rig-agent.ts", resolve33(options.binDir, "rig-agent"), rigSourceRoot, {
     ...options.runtimeSecretDefines,
     AGENT_TASK_ID: options.taskId,
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_RUNTIME_ID: options.runtimeId,
     AGENT_SCOPE_HASH: options.bakedScopeHash,
     AGENT_MANIFEST_PATH: options.manifestPath,
-    AGENT_BINARY_PATH: resolve32(options.binDir, "rig-agent"),
+    AGENT_BINARY_PATH: resolve33(options.binDir, "rig-agent"),
     AGENT_INFO_OUTPUT: options.bakedInfoOutput,
     AGENT_DEPS_OUTPUT: options.bakedDepsOutput,
     AGENT_STATUS_OUTPUT: options.bakedStatusOutput
   });
-  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve32(options.binDir, "controlled-bash"), rigSourceRoot, {
+  await buildBinary("packages/runtime/src/control-plane/controlled-bash.ts", resolve33(options.binDir, "controlled-bash"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_LOGS_DIR: options.logsDir,
     AGENT_MONOREPO_ROOT: resolveMonorepoRoot3(options.projectRoot),
-    AGENT_TS_API_TESTS_DIR: resolve32(options.workspaceDir, "TSAPITests"),
-    AGENT_RIG_AGENT_BIN: resolve32(options.binDir, "rig-agent")
+    AGENT_TS_API_TESTS_DIR: resolve33(options.workspaceDir, "TSAPITests"),
+    AGENT_RIG_AGENT_BIN: resolve33(options.binDir, "rig-agent")
   });
-  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve32(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
-  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve32(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
+  await buildBinary("packages/runtime/bin/rig-browser-tool.ts", resolve33(options.binDir, runtimeBrowserToolBinaryName()), rigSourceRoot);
+  await buildBinary("packages/runtime/src/control-plane/runtime/snapshot/sidecar.ts", resolve33(options.binDir, "snapshot-sidecar"), rigSourceRoot, {
     AGENT_PROJECT_ROOT: options.projectRoot,
     AGENT_BUN_PATH: resolveBunBinaryPath()
   });
@@ -7200,15 +7259,15 @@ async function buildRuntimeToolchain(options) {
     AGENT_BUN_PATH: resolveBunBinaryPath()
   };
   for (const hookName of hookNames) {
-    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve32(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
+    await buildBinary(`packages/runtime/src/control-plane/hooks/${hookName}.ts`, resolve33(runtimeBins.hooksDir, hookName), rigSourceRoot, hookDefines);
   }
-  const pluginsDir = resolve32(options.projectRoot, "rig/plugins");
-  if (existsSync30(pluginsDir)) {
+  const pluginsDir = resolve33(options.projectRoot, "rig/plugins");
+  if (existsSync32(pluginsDir)) {
     for (const entry of readdirSync6(pluginsDir, { withFileTypes: true })) {
       const match = entry.name.match(/^(.+)\.plugin\.(ts|js|mjs|cjs)$/);
       if (!match)
         continue;
-      await buildBinary(`rig/plugins/${entry.name}`, resolve32(runtimeBins.pluginsDir, match[1]), options.projectRoot);
+      await buildBinary(`rig/plugins/${entry.name}`, resolve33(runtimeBins.pluginsDir, match[1]), options.projectRoot);
     }
   }
   await materializeRigGitBinary(options.binDir);
@@ -7218,8 +7277,8 @@ async function buildRuntimeToolchain(options) {
 }
 async function writeRuntimeManifest(config) {
   const scopeHash = sha256Hex(JSON.stringify(config.scopes));
-  const binarySha256 = sha256Hex(readFileSync15(config.binaryPath));
-  const manifestPath = resolve32(config.runtimeRoot, "manifest.json");
+  const binarySha256 = sha256Hex(readFileSync16(config.binaryPath));
+  const manifestPath = resolve33(config.runtimeRoot, "manifest.json");
   const manifest = {
     runtimeId: config.runtimeId,
     taskId: config.taskId,
@@ -7339,31 +7398,31 @@ function readFileMtimeMs(path) {
 }
 function linkRuntimeDependencyLayers(monorepoRoot, workspaceDir) {
   linkGenericNodeModulesLayers(monorepoRoot, workspaceDir);
-  const sourceNodeModules = resolve32(monorepoRoot, "humoongate", "node_modules");
-  if (!existsSync30(sourceNodeModules)) {} else {
-    const runtimeHumoongate = resolve32(workspaceDir, "humoongate");
-    if (existsSync30(resolve32(runtimeHumoongate, "package.json"))) {
-      const targetNodeModules = resolve32(runtimeHumoongate, "node_modules");
+  const sourceNodeModules = resolve33(monorepoRoot, "humoongate", "node_modules");
+  if (!existsSync32(sourceNodeModules)) {} else {
+    const runtimeHumoongate = resolve33(workspaceDir, "humoongate");
+    if (existsSync32(resolve33(runtimeHumoongate, "package.json"))) {
+      const targetNodeModules = resolve33(runtimeHumoongate, "node_modules");
       runtimeLinkDependencyLayerNative(sourceNodeModules, targetNodeModules);
     }
   }
-  const runtimeHpNext = resolve32(workspaceDir, "microservices", "hp-next-frontend", "app");
-  if (!existsSync30(resolve32(runtimeHpNext, "package.json"))) {
+  const runtimeHpNext = resolve33(workspaceDir, "microservices", "hp-next-frontend", "app");
+  if (!existsSync32(resolve33(runtimeHpNext, "package.json"))) {
     return;
   }
-  const sourceHpNextNodeModules = resolve32(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
-  const sourceMonorepoNodeModules = resolve32(monorepoRoot, "node_modules");
-  const targetHpNextNodeModules = resolve32(runtimeHpNext, "node_modules");
-  if (existsSync30(sourceHpNextNodeModules)) {
+  const sourceHpNextNodeModules = resolve33(monorepoRoot, "microservices", "hp-next-frontend", "app", "node_modules");
+  const sourceMonorepoNodeModules = resolve33(monorepoRoot, "node_modules");
+  const targetHpNextNodeModules = resolve33(runtimeHpNext, "node_modules");
+  if (existsSync32(sourceHpNextNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceHpNextNodeModules, targetHpNextNodeModules);
     return;
   }
-  if (existsSync30(sourceMonorepoNodeModules)) {
+  if (existsSync32(sourceMonorepoNodeModules)) {
     runtimeLinkDependencyLayerNative(sourceMonorepoNodeModules, targetHpNextNodeModules);
   }
 }
 function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
-  linkNodeModulesLayer(resolve32(monorepoRoot, "node_modules"), resolve32(workspaceDir, "node_modules"));
+  linkNodeModulesLayer(resolve33(monorepoRoot, "node_modules"), resolve33(workspaceDir, "node_modules"));
   for (const relativePackageDir of [
     "apps/native-app/apps/marketing",
     "apps/native-app/apps/web",
@@ -7385,15 +7444,15 @@ function linkGenericNodeModulesLayers(monorepoRoot, workspaceDir) {
     "packages/standard-plugin",
     "packages/validator-kit"
   ]) {
-    const workspacePackageDir = resolve32(workspaceDir, relativePackageDir);
-    if (!existsSync30(resolve32(workspacePackageDir, "package.json"))) {
+    const workspacePackageDir = resolve33(workspaceDir, relativePackageDir);
+    if (!existsSync32(resolve33(workspacePackageDir, "package.json"))) {
       continue;
     }
-    linkNodeModulesLayer(resolve32(monorepoRoot, relativePackageDir, "node_modules"), resolve32(workspacePackageDir, "node_modules"));
+    linkNodeModulesLayer(resolve33(monorepoRoot, relativePackageDir, "node_modules"), resolve33(workspacePackageDir, "node_modules"));
   }
 }
 function linkNodeModulesLayer(sourceDir, targetDir) {
-  if (!existsSync30(sourceDir) || existsSync30(targetDir)) {
+  if (!existsSync32(sourceDir) || existsSync32(targetDir)) {
     return;
   }
   try {
@@ -7402,16 +7461,16 @@ function linkNodeModulesLayer(sourceDir, targetDir) {
   } catch (error) {
     console.warn(`[rig-agent] Native dependency-layer linking failed for ${targetDir}; using symlink fallback: ${error instanceof Error ? error.message : String(error)}`);
   }
-  mkdirSync16(dirname14(targetDir), { recursive: true });
+  mkdirSync17(dirname15(targetDir), { recursive: true });
   symlinkSync4(sourceDir, targetDir, "dir");
 }
 function ensureRuntimeBinTrees(runtimeBinDir) {
-  const hooksDir = resolve32(runtimeBinDir, "hooks");
-  const pluginsDir = resolve32(runtimeBinDir, "plugins");
-  const validatorsDir = resolve32(runtimeBinDir, "validators");
-  mkdirSync16(hooksDir, { recursive: true });
-  mkdirSync16(pluginsDir, { recursive: true });
-  mkdirSync16(validatorsDir, { recursive: true });
+  const hooksDir = resolve33(runtimeBinDir, "hooks");
+  const pluginsDir = resolve33(runtimeBinDir, "plugins");
+  const validatorsDir = resolve33(runtimeBinDir, "validators");
+  mkdirSync17(hooksDir, { recursive: true });
+  mkdirSync17(pluginsDir, { recursive: true });
+  mkdirSync17(validatorsDir, { recursive: true });
   return { hooksDir, pluginsDir, validatorsDir };
 }
 
@@ -7422,17 +7481,17 @@ function runtimeRootForCleanup(projectRoot, runtimeId) {
     monorepoRoot = resolveMonorepoRoot3(projectRoot);
   } catch {}
   const workspaceRootCandidate = monorepoRoot ?? projectRoot;
-  const initialWorkspaceDir = resolve33(workspaceRootCandidate, ".worktrees", runtimeWorktreeNameFromRuntimeId(runtimeId));
+  const initialWorkspaceDir = resolve34(workspaceRootCandidate, ".worktrees", runtimeWorktreeNameFromRuntimeId(runtimeId));
   const runtimeRoot = resolveRuntimeWorkspaceLayout(initialWorkspaceDir).runtimeDir;
   return { monorepoRoot, initialWorkspaceDir, runtimeRoot };
 }
 
 // packages/runtime/src/control-plane/runtime/isolation/runner.ts
-import { existsSync as existsSync32, rmSync as rmSync12, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename9, resolve as resolve36 } from "path";
+import { existsSync as existsSync34, rmSync as rmSync12, writeFileSync as writeFileSync14 } from "fs";
+import { basename as basename9, resolve as resolve37 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/backend.ts
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync33 } from "fs";
 init_utils();
 
 // packages/runtime/src/control-plane/runtime/sandbox/backend-none.ts
@@ -7532,13 +7591,13 @@ async function resolveBackend(projectRoot, options) {
     depRoots
   };
   const fsContext = {
-    pathExists: (p) => existsSync31(p),
+    pathExists: (p) => existsSync33(p),
     realPath: toRealPath
   };
   if (process.platform === "darwin" && (!requestedBackend || requestedBackend === "macos-seatbelt")) {
     const seatbelt = Bun.which("sandbox-exec");
     probed.push("sandbox-exec");
-    if (seatbelt && existsSync31(seatbelt)) {
+    if (seatbelt && existsSync33(seatbelt)) {
       const SeatbeltBackendClass = loadSeatbeltBackend();
       if (SeatbeltBackendClass) {
         return {
@@ -7659,8 +7718,8 @@ init_layout();
 var SNAPSHOT_SIDECAR_READY_TIMEOUT_MS = 1e4;
 async function startRuntimeSnapshotSidecar(runtime, options = {}) {
   const instanceId = sanitizeRuntimeRefSegment(options.instanceId?.trim() || runtime.id);
-  const readyFile = resolve36(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.ready`);
-  const requestFile = resolve36(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.request.json`);
+  const readyFile = resolve37(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.ready`);
+  const requestFile = resolve37(runtime.stateDir, `runtime-snapshot-sidecar-${instanceId}.request.json`);
   rmSync12(readyFile, { force: true });
   rmSync12(requestFile, { force: true });
   const sidecarBinary = resolveSnapshotSidecarBinaryPath(runtime.binDir);
@@ -7704,7 +7763,7 @@ async function startRuntimeSnapshotSidecar(runtime, options = {}) {
       rmSync12(requestFile, { force: true });
     },
     finalize: async (commandParts, exitCode) => {
-      writeFileSync13(requestFile, `${JSON.stringify({ command: commandParts, exitCode })}
+      writeFileSync14(requestFile, `${JSON.stringify({ command: commandParts, exitCode })}
 `, "utf-8");
       const [sidecarExitCode, stdout, stderr] = await Promise.all([
         proc.exited,
@@ -7768,8 +7827,8 @@ async function runInAgentRuntime(options) {
     const stdout = await new Response(proc.stdout).text();
     const stderr = await new Response(proc.stderr).text();
     try {
-      await Bun.write(resolve36(options.runtime.logsDir, "agent-stdout.log"), stdout);
-      await Bun.write(resolve36(options.runtime.logsDir, "agent-stderr.log"), stderr);
+      await Bun.write(resolve37(options.runtime.logsDir, "agent-stdout.log"), stdout);
+      await Bun.write(resolve37(options.runtime.logsDir, "agent-stderr.log"), stderr);
     } catch {}
     await snapshotSidecar.finalize(runtimeCommand, exitCode);
     return {
@@ -7799,18 +7858,18 @@ function resolveInternalRuntimeCommand(command) {
 }
 async function cleanupAgentRuntime(options) {
   const { monorepoRoot, initialWorkspaceDir, runtimeRoot } = runtimeRootForCleanup(options.projectRoot, options.id);
-  const metadataPath = resolve36(runtimeRoot, "runtime.json");
-  if (!existsSync32(runtimeRoot)) {
+  const metadataPath = resolve37(runtimeRoot, "runtime.json");
+  if (!existsSync34(runtimeRoot)) {
     return;
   }
   let mode = "worktree";
   let workspaceDir = "";
   const metadata = await readRuntimeMetadata(metadataPath);
-  const metadataMatchesRequestedRuntime = metadata !== null && metadata.id === options.id && resolve36(metadata.workspaceDir) === resolve36(initialWorkspaceDir);
+  const metadataMatchesRequestedRuntime = metadata !== null && metadata.id === options.id && resolve37(metadata.workspaceDir) === resolve37(initialWorkspaceDir);
   if (metadata && metadataMatchesRequestedRuntime) {
     mode = metadata.mode;
     workspaceDir = metadata.workspaceDir;
-  } else if (existsSync32(initialWorkspaceDir)) {
+  } else if (existsSync34(initialWorkspaceDir)) {
     workspaceDir = initialWorkspaceDir;
   }
   const preservesTaskWorktree = metadataMatchesRequestedRuntime && metadata ? options.id === taskRuntimeId(metadata.taskId) : false;
@@ -7842,10 +7901,10 @@ function resolveSnapshotSidecarScriptPath() {
   return resolveRuntimeSourceScriptPath("snapshot-sidecar.ts");
 }
 function resolveSnapshotSidecarBinaryPath(binDir) {
-  return resolve36(binDir, "snapshot-sidecar");
+  return resolve37(binDir, "snapshot-sidecar");
 }
 function shouldUseCompiledSnapshotSidecar(binaryPath) {
-  if (!existsSync32(binaryPath)) {
+  if (!existsSync34(binaryPath)) {
     return false;
   }
   const preference = process.env.RIG_USE_COMPILED_SNAPSHOT_SIDECAR?.trim().toLowerCase();
@@ -7860,12 +7919,12 @@ function resolveRuntimeSourceScriptPath(fileName) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter((value) => Boolean(value));
   for (const root of hostRoots) {
-    const candidate = resolve36(root, "packages/runtime/src/control-plane/runtime", fileName);
-    if (existsSync32(candidate)) {
+    const candidate = resolve37(root, "packages/runtime/src/control-plane/runtime", fileName);
+    if (existsSync34(candidate)) {
       return candidate;
     }
   }
-  return resolve36(import.meta.dir, "..", fileName);
+  return resolve37(import.meta.dir, "..", fileName);
 }
 function resolveBunCliInvocation() {
   if (process.env.RIG_BUN_PATH?.trim()) {
@@ -7892,7 +7951,7 @@ function resolveBunCliInvocation() {
 async function waitForSnapshotSidecarReady(readyFile, proc, stdoutTextPromise, stderrTextPromise) {
   const deadline = Date.now() + SNAPSHOT_SIDECAR_READY_TIMEOUT_MS;
   while (Date.now() < deadline) {
-    if (existsSync32(readyFile)) {
+    if (existsSync34(readyFile)) {
       return;
     }
     const exitCode = proc.exitCode;
@@ -7905,7 +7964,7 @@ async function waitForSnapshotSidecarReady(readyFile, proc, stdoutTextPromise, s
   throw new Error(`snapshot sidecar did not become ready within ${SNAPSHOT_SIDECAR_READY_TIMEOUT_MS}ms`);
 }
 async function readRuntimeMetadata(metadataPath) {
-  if (!existsSync32(metadataPath)) {
+  if (!existsSync34(metadataPath)) {
     return null;
   }
   try {
@@ -7920,9 +7979,9 @@ var CANONICAL_MEMORY_DB_PATH2 = "rig/memory/project-memory.db";
 async function hydrateRuntimeMemory(options) {
   const snapshot = await readCanonicalMemoryDb(options.projectRoot);
   const workspaceLayout = resolveRuntimeWorkspaceLayout(options.workspaceDir);
-  const hydratedPath = resolve37(workspaceLayout.stateDir, "memory", "project-memory.db");
+  const hydratedPath = resolve38(workspaceLayout.stateDir, "memory", "project-memory.db");
   try {
-    await mkdir4(resolve37(workspaceLayout.stateDir, "memory"), { recursive: true });
+    await mkdir4(resolve38(workspaceLayout.stateDir, "memory"), { recursive: true });
     await copyFile(snapshot.dbPath, hydratedPath);
     return {
       canonicalPath: CANONICAL_MEMORY_DB_PATH2,
@@ -7937,12 +7996,12 @@ async function hydrateRuntimeMemory(options) {
   }
 }
 async function createRuntimeTaskRecordReader(options) {
-  const legacyConfigPath = resolve37(options.projectRoot, ".rig", "task-config.json");
+  const legacyConfigPath = resolve38(options.projectRoot, ".rig", "task-config.json");
   let pluginHostContext = null;
   try {
     pluginHostContext = await buildPluginHostContext(options.projectRoot);
   } catch (error) {
-    if (!existsSync33(legacyConfigPath)) {
+    if (!existsSync35(legacyConfigPath)) {
       throw error;
     }
     const message = `Plugin task source unavailable; using source-aware .rig/task-config.json compatibility path: ${error instanceof Error ? error.message : String(error)}`;
@@ -7962,7 +8021,7 @@ async function createRuntimeTaskRecordReader(options) {
       source: "plugin"
     };
   }
-  if (existsSync33(legacyConfigPath)) {
+  if (existsSync35(legacyConfigPath)) {
     const message = "Using source-aware .rig/task-config.json task source compatibility path";
     options.diagnostics?.(message);
     console.warn(message);
@@ -7979,10 +8038,10 @@ async function createRuntimeTaskRecordReader(options) {
   };
 }
 function readConfiguredTaskSourceKindHint(projectRoot) {
-  const jsonPath = resolve37(projectRoot, "rig.config.json");
-  if (existsSync33(jsonPath)) {
+  const jsonPath = resolve38(projectRoot, "rig.config.json");
+  if (existsSync35(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync16(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync17(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -7994,12 +8053,12 @@ function readConfiguredTaskSourceKindHint(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve37(projectRoot, "rig.config.ts");
-  if (!existsSync33(tsPath)) {
+  const tsPath = resolve38(projectRoot, "rig.config.ts");
+  if (!existsSync35(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync16(tsPath, "utf8");
+    const source = readFileSync17(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     return kind ?? null;
@@ -8069,8 +8128,8 @@ async function writeRuntimeTaskConfigProjection(options) {
     ...options.taskEntry.validation && options.taskEntry.validation.length > 0 ? { validation: options.taskEntry.validation } : {},
     ...options.taskEntry.browser ? { browser: options.taskEntry.browser } : {}
   };
-  const configPath = resolve37(options.workspaceDir, ".rig", "task-config.json");
-  await mkdir4(resolve37(options.workspaceDir, ".rig"), { recursive: true });
+  const configPath = resolve38(options.workspaceDir, ".rig", "task-config.json");
+  await mkdir4(resolve38(options.workspaceDir, ".rig"), { recursive: true });
   await writeFile2(configPath, `${JSON.stringify({ [options.task.id]: entry }, null, 2)}
 `, "utf-8");
 }
@@ -8134,9 +8193,9 @@ async function ensureAgentRuntime(options) {
   }
   ensureProvisioningHostProjectRootEnv(options.projectRoot);
   const monorepoRoot = resolveMonorepoRoot3(options.projectRoot);
-  const workspaceDir = resolve37(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
+  const workspaceDir = resolve38(monorepoRoot, ".worktrees", runtimeWorktreeName(options.taskId, options.id));
   const createdAt = new Date().toISOString();
-  if (!existsSync33(resolve37(monorepoRoot, ".git"))) {
+  if (!existsSync35(resolve38(monorepoRoot, ".git"))) {
     throw new Error(`Monorepo root is not a git checkout: ${monorepoRoot}`);
   }
   const taskResolution = await resolveRuntimeTaskRecord({
@@ -8171,7 +8230,7 @@ async function ensureAgentRuntime(options) {
     logsDir: overlay.logsDir,
     stateDir: overlay.stateDir,
     sessionDir: overlay.sessionDir,
-    claudeHomeDir: resolve37(workspaceLayout.homeDir, ".claude"),
+    claudeHomeDir: resolve38(workspaceLayout.homeDir, ".claude"),
     contextFile: overlay.contextPath,
     binDir: workspaceLayout.binDir,
     createdAt
@@ -8184,8 +8243,8 @@ async function ensureAgentRuntime(options) {
     projectRoot: options.projectRoot,
     workspaceDir
   });
-  mkdirSync19(runtime.binDir, { recursive: true });
-  mkdirSync19(workspaceLayout.distDir, { recursive: true });
+  mkdirSync20(runtime.binDir, { recursive: true });
+  mkdirSync20(workspaceLayout.distDir, { recursive: true });
   prepareRuntimeWorkspace(options.projectRoot, workspaceDir);
   if (options.preserveTaskArtifacts) {
     console.log(`[rig-agent] Preserving runtime task artifacts for resume of ${options.taskId}.`);
@@ -8204,7 +8263,7 @@ async function ensureAgentRuntime(options) {
       runtimeId: options.id
     }),
     workspaceDir,
-    artifactRoot: resolve37(workspaceDir, "artifacts", options.taskId),
+    artifactRoot: resolve38(workspaceDir, "artifacts", options.taskId),
     hostProjectRoot: options.projectRoot,
     monorepoMainRoot: monorepoRoot,
     monorepoBaseRef: baseRef,
@@ -8220,8 +8279,8 @@ async function ensureAgentRuntime(options) {
     stateDir: overlay.stateDir,
     logsDir: overlay.logsDir,
     sessionDir: overlay.sessionDir,
-    sessionFile: resolve37(overlay.sessionDir, "session.json"),
-    policyFile: resolve37(options.projectRoot, "rig/policy/policy.json"),
+    sessionFile: resolve38(overlay.sessionDir, "session.json"),
+    policyFile: resolve38(options.projectRoot, "rig/policy/policy.json"),
     binDir: runtime.binDir,
     createdAt,
     memory
@@ -8232,9 +8291,9 @@ async function ensureAgentRuntime(options) {
     task: taskResolution.task,
     taskEntry
   });
-  const manifestPath = resolve37(runtimeRoot, "manifest.json");
+  const manifestPath = resolve38(runtimeRoot, "manifest.json");
   const bakedScopeHash = sha256Hex(JSON.stringify(taskEntry.scope || []));
-  const runtimeAgentBinary = resolve37(runtime.binDir, "rig-agent");
+  const runtimeAgentBinary = resolve38(runtime.binDir, "rig-agent");
   await ensureRigGitBinaryPath();
   const bakedInfoOutput = await captureTaskInfoOutput({
     projectRoot: options.projectRoot,
@@ -8251,8 +8310,8 @@ async function ensureAgentRuntime(options) {
   });
   rmSync13(runtime.binDir, { recursive: true, force: true });
   rmSync13(workspaceLayout.distDir, { recursive: true, force: true });
-  mkdirSync19(runtime.binDir, { recursive: true });
-  mkdirSync19(workspaceLayout.distDir, { recursive: true });
+  mkdirSync20(runtime.binDir, { recursive: true });
+  mkdirSync20(workspaceLayout.distDir, { recursive: true });
   await buildRuntimeToolchain({
     projectRoot: options.projectRoot,
     workspaceDir,
@@ -8289,9 +8348,9 @@ async function ensureAgentRuntime(options) {
     workspaceDir,
     taskEntry
   });
-  const sandboxDir = resolve37(runtimeRoot, "sandbox");
+  const sandboxDir = resolve38(runtimeRoot, "sandbox");
   await mkdir4(sandboxDir, { recursive: true });
-  await writeFile2(resolve37(runtimeRoot, "runtime.json"), JSON.stringify({
+  await writeFile2(resolve38(runtimeRoot, "runtime.json"), JSON.stringify({
     id: options.id,
     taskId: options.taskId,
     mode: "worktree",