@h-rig/server 0.0.6-alpha.0

package/dist/src/server-helpers/run-mutations.js

@@ -0,0 +1,1784 @@
+// @bun
+// packages/server/src/server-helpers/run-mutations.ts
+import { spawn } from "child_process";
+import { loadConfig } from "@rig/core/load-config";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, relative as relative2, resolve as resolve9 } from "path";
+import {
+  listAuthorityRuns as listAuthorityRuns7,
+  readAuthorityRun as readAuthorityRun8,
+  resolveAuthorityRunDir as resolveAuthorityRunDir4,
+  writeJsonFile as writeJsonFile4
+} from "@rig/runtime/control-plane/authority-files";
+import { readPublishedRigServerStateSync } from "@rig/runtime/local-server";
+import { resolveMonorepoRoot as resolveMonorepoRoot6 } from "@rig/runtime/control-plane/native/utils";
+import {
+  buildTaskRunLifecycleComment as buildTaskRunLifecycleComment2,
+  updateConfiguredTaskSourceTask as updateConfiguredTaskSourceTask2
+} from "@rig/runtime/control-plane/tasks/source-lifecycle";
+
+// packages/server/src/scheduler.ts
+import { normalizeTaskLifecycleStatus } from "@rig/runtime/control-plane/state-sync/types";
+var TERMINAL_RUN_STATUSES = new Set(["done", "completed", "error", "failed", "stopped", "cancelled"]);
+var RUNNABLE_TASK_STATUSES = new Set(["draft", "open", "ready", "queued"]);
+var REMOTE_READY_STATUSES = new Set(["ready", "idle", "connected"]);
+function resolveLocalSchedulerWorkerCount(env = process.env) {
+  const raw = env.RIG_SCHEDULER_LOCAL_WORKERS?.trim();
+  if (!raw) {
+    return Number.MAX_SAFE_INTEGER;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed)) {
+    return Number.MAX_SAFE_INTEGER;
+  }
+  return Math.max(0, parsed);
+}
+function planSchedulerWork(input) {
+  const taskById = new Map(input.tasks.map((task) => [task.id, task]));
+  const activeTaskIds = new Set(input.runs.filter((run) => isActiveRun(run) && typeof run.taskId === "string" && run.taskId.length > 0).map((run) => run.taskId));
+  const activeLocalRuns = input.runs.filter((run) => isActiveRun(run) && typeof run.taskId === "string" && run.taskId.length > 0 && !isRemoteRun(run));
+  const occupiedRemoteHosts = new Set(input.runs.filter((run) => isActiveRun(run) && isRemoteRun(run) && typeof run.hostId === "string" && run.hostId.length > 0).map((run) => run.hostId));
+  const pruneTaskIds = [];
+  const eligibleQueue = input.queue.filter((entry) => {
+    const task = taskById.get(entry.taskId);
+    const normalizedStatus = task ? normalizeTaskLifecycleStatus(task.status) : null;
+    if (!task || !normalizedStatus || !RUNNABLE_TASK_STATUSES.has(normalizedStatus)) {
+      pruneTaskIds.push(entry.taskId);
+      return false;
+    }
+    if (activeTaskIds.has(entry.taskId)) {
+      pruneTaskIds.push(entry.taskId);
+      return false;
+    }
+    return true;
+  });
+  let freeLocalWorkers = Math.max(0, input.localWorkerCount - activeLocalRuns.length);
+  const dispatches = [];
+  const deferredForRemote = [];
+  for (const entry of eligibleQueue) {
+    if (freeLocalWorkers > 0) {
+      dispatches.push({ taskId: entry.taskId, workerKind: "local" });
+      freeLocalWorkers -= 1;
+      continue;
+    }
+    deferredForRemote.push(entry);
+  }
+  const availableRemoteWorkers = input.remoteWorkers.filter((worker) => REMOTE_READY_STATUSES.has(worker.status)).filter((worker) => !occupiedRemoteHosts.has(worker.hostId)).toSorted((left, right) => {
+    if (left.currentLeaseCount !== right.currentLeaseCount) {
+      return left.currentLeaseCount - right.currentLeaseCount;
+    }
+    return left.registeredAt.localeCompare(right.registeredAt) || left.hostId.localeCompare(right.hostId);
+  });
+  for (let index = 0;index < Math.min(deferredForRemote.length, availableRemoteWorkers.length); index += 1) {
+    const entry = deferredForRemote[index];
+    const worker = availableRemoteWorkers[index];
+    if (!entry || !worker) {
+      continue;
+    }
+    dispatches.push({
+      taskId: entry.taskId,
+      workerKind: "remote",
+      hostId: worker.hostId
+    });
+  }
+  return {
+    pruneTaskIds: Array.from(new Set(pruneTaskIds)),
+    dispatches
+  };
+}
+function isActiveRun(run) {
+  const status = normalizeStatus(run.status);
+  return !TERMINAL_RUN_STATUSES.has(status);
+}
+function isRemoteRun(run) {
+  return normalizeStatus(run.mode) === "remote";
+}
+function normalizeStatus(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
+// packages/server/src/server.ts
+import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve7 } from "path";
+import {
+  listAuthorityArtifactRoots,
+  listAuthorityRuns as listAuthorityRuns6,
+  readJsonFile as readJsonFile3,
+  readJsonlFile as readJsonlFile3
+} from "@rig/runtime/control-plane/authority-files";
+import { normalizeTaskLifecycleStatus as normalizeTaskLifecycleStatus3 } from "@rig/runtime/control-plane/state-sync/types";
+import {
+  readWorkspaceSummary
+} from "@rig/runtime/control-plane/native/workspace-ops";
+import { resolveMonorepoRoot as resolveMonorepoRoot5 } from "@rig/runtime/control-plane/native/utils";
+
+// packages/server/src/bootstrap.ts
+import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { RIG_DEFINITION_DIRNAME, resolveMonorepoRoot } from "@rig/runtime";
+function normalizeOptionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function resolveRigServerPaths(projectRoot) {
+  const taskWorkspace = normalizeOptionalString(process.env.RIG_TASK_WORKSPACE);
+  const explicitStateDir = normalizeOptionalString(process.env.RIG_STATE_DIR);
+  const explicitLogsDir = normalizeOptionalString(process.env.RIG_LOGS_DIR);
+  const explicitSessionFile = normalizeOptionalString(process.env.RIG_SESSION_FILE);
+  const hostStateRoot = resolve(projectRoot, ".rig");
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const monorepoStateRoot = resolve(monorepoRoot, ".rig");
+  const stateRoot = taskWorkspace ? resolve(taskWorkspace, ".rig") : explicitStateDir ? dirname(resolve(explicitStateDir)) : explicitLogsDir ? dirname(resolve(explicitLogsDir)) : explicitSessionFile ? dirname(dirname(resolve(explicitSessionFile))) : existsSync(hostStateRoot) ? hostStateRoot : monorepoStateRoot;
+  const stateDir = explicitStateDir ? resolve(explicitStateDir) : resolve(stateRoot, "state");
+  const logsDir = explicitLogsDir ? resolve(explicitLogsDir) : resolve(stateRoot, "logs");
+  const taskConfigPath = taskWorkspace ? resolve(taskWorkspace, ".rig", "task-config.json") : existsSync(resolve(projectRoot, ".rig", "task-config.json")) ? resolve(projectRoot, ".rig", "task-config.json") : resolve(monorepoStateRoot, "task-config.json");
+  return {
+    stateRoot,
+    stateDir,
+    logsDir,
+    controlPlaneEventsFile: resolve(logsDir, "control-plane.events.jsonl"),
+    taskConfigPath,
+    notificationsFile: resolve(projectRoot, "rig", "notifications", "targets.json"),
+    keybindingsPath: resolve(projectRoot, "rig", "keybindings.json")
+  };
+}
+
+// packages/server/src/websocket.ts
+import {
+  WS_CHANNELS
+} from "@rig/contracts";
+function encodeWebSocketPayload(payload) {
+  return JSON.stringify(payload);
+}
+
+// packages/server/src/server-helpers/normalizers.ts
+function normalizeString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function normalizeStringArray(value) {
+  return Array.isArray(value) ? value.map((entry) => normalizeString(entry)).filter((entry) => entry !== null) : [];
+}
+function normalizeRuntimeAdapter(value) {
+  const normalized = normalizeString(value)?.toLowerCase();
+  if (!normalized) {
+    return "pi";
+  }
+  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
+    return "codex";
+  }
+  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
+    return "pi";
+  }
+  return "claude-code";
+}
+
+// packages/server/src/server-helpers/run-io.ts
+import { dirname as dirname2, resolve as resolve2 } from "path";
+import { closeSync, existsSync as existsSync2, mkdirSync as mkdirSync2, openSync, readSync, statSync, writeFileSync as writeFileSync2 } from "fs";
+import {
+  listAuthorityRuns,
+  readAuthorityRun,
+  readJsonlFile,
+  resolveAuthorityRunDir
+} from "@rig/runtime/control-plane/authority-files";
+function runLogsPath(projectRoot, runId) {
+  return resolve2(resolveAuthorityRunDir(projectRoot, runId), "logs.jsonl");
+}
+function parseJsonlRecords(lines) {
+  return lines.map((line) => line.trim()).filter(Boolean).flatMap((line) => {
+    try {
+      return [JSON.parse(line)];
+    } catch {
+      return [];
+    }
+  });
+}
+function readJsonlFileTail(path, options) {
+  const limit = Math.max(0, Math.trunc(options.limit));
+  if (limit === 0 || !existsSync2(path))
+    return [];
+  const maxBytes = Math.max(1024, Math.trunc(options.maxBytes ?? 256 * 1024));
+  const size = statSync(path).size;
+  if (size === 0)
+    return [];
+  const start = Math.max(0, size - maxBytes);
+  const length = size - start;
+  const buffer = Buffer.alloc(length);
+  const fd = openSync(path, "r");
+  try {
+    readSync(fd, buffer, 0, length, start);
+  } finally {
+    closeSync(fd);
+  }
+  const text = buffer.toString("utf8");
+  const lines = text.split(/\r?\n/);
+  const completeLines = start > 0 ? lines.slice(1) : lines;
+  return parseJsonlRecords(completeLines.filter(Boolean).slice(-limit));
+}
+var INITIAL_RUN_LOG_TAIL_MAX_BYTES = 8 * 1024 * 1024;
+function readLatestRawRunLog(projectRoot, runId) {
+  const logs = readJsonlFileTail(runLogsPath(projectRoot, runId), { limit: 20 });
+  return logs.findLast((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry))) ?? null;
+}
+
+// packages/server/src/server-helpers/server-paths.ts
+import { dirname as dirname3, resolve as resolve3 } from "path";
+import { resolveMonorepoRoot as resolveMonorepoRoot2 } from "@rig/runtime/control-plane/native/utils";
+function resolveServerAuthorityPaths(projectRoot) {
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  const explicitStateDir = process.env.RIG_STATE_DIR?.trim();
+  const explicitLogsDir = process.env.RIG_LOGS_DIR?.trim();
+  const explicitSessionFile = process.env.RIG_SESSION_FILE?.trim();
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const stateRoot = taskWorkspace ? resolve3(taskWorkspace, ".rig") : explicitStateDir ? dirname3(resolve3(explicitStateDir)) : explicitLogsDir ? dirname3(resolve3(explicitLogsDir)) : explicitSessionFile ? dirname3(dirname3(resolve3(explicitSessionFile))) : resolve3(monorepoRoot, ".rig");
+  const stateDir = explicitStateDir ? resolve3(explicitStateDir) : resolve3(stateRoot, "state");
+  const logsDir = explicitLogsDir ? resolve3(explicitLogsDir) : resolve3(stateRoot, "logs");
+  const sessionFile = explicitSessionFile ? resolve3(explicitSessionFile) : resolve3(stateRoot, "session", "session.json");
+  const artifactsDir = taskWorkspace ? resolve3(taskWorkspace, "artifacts") : resolve3(monorepoRoot, "artifacts");
+  return {
+    stateRoot,
+    stateDir,
+    logsDir,
+    controlPlaneEventsFile: resolve3(logsDir, "control-plane.events.jsonl"),
+    sessionFile,
+    artifactsDir
+  };
+}
+
+// packages/server/src/server-helpers/snapshot-service.ts
+import { listAgentRuntimes } from "@rig/runtime/control-plane/runtime/isolation";
+
+// packages/server/src/server-helpers/snapshot-orchestrator.ts
+import {
+  listAuthorityRuns as listAuthorityRuns3,
+  readAuthorityRun as readAuthorityRun2
+} from "@rig/runtime/control-plane/authority-files";
+
+// packages/server/src/server-helpers/queue-state.ts
+import { resolve as resolve4 } from "path";
+import { readJsonFile, writeJsonFile } from "@rig/runtime/control-plane/authority-files";
+function resolveQueueStatePath(projectRoot) {
+  return resolve4(resolveServerAuthorityPaths(projectRoot).stateDir, "task-queue.json");
+}
+function readQueueState(projectRoot) {
+  const queue = readJsonFile(resolveQueueStatePath(projectRoot), null);
+  if (!Array.isArray(queue))
+    return [];
+  return queue.filter((entry) => entry && typeof entry === "object").map((entry, index) => ({
+    taskId: normalizeString(entry.taskId),
+    score: typeof entry.score === "number" ? Math.max(0, Math.trunc(entry.score)) : 0,
+    unblockCount: typeof entry.unblockCount === "number" ? Math.max(0, Math.trunc(entry.unblockCount)) : 0,
+    position: typeof entry.position === "number" ? Math.max(0, Math.trunc(entry.position)) : index
+  })).filter((entry) => Boolean(entry.taskId)).sort((left, right) => right.score - left.score || left.position - right.position).map((entry, index) => ({ ...entry, position: index }));
+}
+function writeQueueState(projectRoot, queue) {
+  writeJsonFile(resolveQueueStatePath(projectRoot), queue);
+}
+
+// packages/server/src/server-helpers/remote-snapshots.ts
+import { listAuthorityRemoteEndpoints } from "@rig/runtime/control-plane/authority-files";
+function normalizeIsoTimestamp(value) {
+  const normalized = normalizeString(value);
+  if (!normalized)
+    return null;
+  const timestamp = Date.parse(normalized);
+  return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+}
+
+// packages/server/src/server-helpers/conversation-snapshot.ts
+import {
+  listAuthorityRuns as listAuthorityRuns2,
+  readJsonlFile as readJsonlFile2
+} from "@rig/runtime/control-plane/authority-files";
+var snapshotCache = new Map;
+
+// packages/server/src/server-helpers/plugin-host-cache.ts
+var contextCache = new Map;
+var taskListCache = new Map;
+
+// packages/server/src/server-helpers/terminal-runtime.ts
+import { WS_CHANNELS as WS_CHANNELS2 } from "@rig/contracts";
+
+// packages/server/src/server-helpers/broadcasters.ts
+import { RIG_WS_CHANNELS } from "@rig/contracts";
+
+// packages/server/src/server-helpers/run-writers.ts
+import { resolve as resolve5 } from "path";
+import {
+  appendJsonlRecord,
+  readAuthorityRun as readAuthorityRun3,
+  resolveAuthorityRunDir as resolveAuthorityRunDir2,
+  writeJsonFile as writeJsonFile2
+} from "@rig/runtime/control-plane/authority-files";
+function appendRunLogEntry(projectRoot, runId, value) {
+  if (!readAuthorityRun3(projectRoot, runId)) {
+    return;
+  }
+  appendJsonlRecord(runLogsPath(projectRoot, runId), value);
+  patchRunRecord(projectRoot, runId, {});
+  return value;
+}
+function patchRunRecord(projectRoot, runId, patch) {
+  const current = readAuthorityRun3(projectRoot, runId);
+  if (!current) {
+    throw new Error(`Run not found: ${runId}`);
+  }
+  const next = {
+    ...current,
+    ...patch,
+    updatedAt: normalizeString(patch.updatedAt) ?? new Date().toISOString()
+  };
+  writeJsonFile2(resolve5(resolveAuthorityRunDir2(projectRoot, runId), "run.json"), next);
+  return next;
+}
+function buildRunStartPatch(startedAt) {
+  return {
+    status: "preparing",
+    startedAt,
+    completedAt: null,
+    errorText: null,
+    serverPid: process.pid
+  };
+}
+
+// packages/server/src/server-helpers/event-emitter.ts
+function nextSequence(carrier) {
+  const current = carrier.sequence ?? 0;
+  const next = current + 1;
+  carrier.sequence = next;
+  return next;
+}
+function buildRigEvent(carrier, input) {
+  const createdAt = normalizeIsoTimestamp(input.createdAt) ?? new Date().toISOString();
+  const sequence = nextSequence(carrier);
+  return {
+    id: `rig-event-${sequence}`,
+    sequence,
+    createdAt,
+    type: input.type,
+    aggregateId: input.aggregateId,
+    payload: input.payload ?? {}
+  };
+}
+
+// packages/server/src/server-helpers/broadcasters.ts
+var SERVER_EVENT_JOURNAL_LIMIT = 5000;
+function broadcastPush(state, payload) {
+  const encoded = encodeWebSocketPayload(payload);
+  for (const socket of state.sockets) {
+    try {
+      socket.send(encoded);
+    } catch {
+      state.sockets.delete(socket);
+    }
+  }
+}
+function buildSnapshotInvalidatedPush(state, reason = "snapshot-mutated") {
+  return {
+    type: "push",
+    channel: RIG_WS_CHANNELS.snapshotInvalidated,
+    data: {
+      sequence: state.sequence,
+      updatedAt: new Date().toISOString(),
+      reason
+    }
+  };
+}
+function broadcastSnapshotInvalidation(state, reason) {
+  broadcastPush(state, buildSnapshotInvalidatedPush(state, reason));
+}
+function buildRunLogAppendedPush(runId, entry) {
+  return {
+    type: "push",
+    channel: RIG_WS_CHANNELS.runLogAppended,
+    data: {
+      runId,
+      entry
+    }
+  };
+}
+function broadcastRunLogAppended(state, runId, entry) {
+  if (!entry) {
+    return;
+  }
+  broadcastPush(state, buildRunLogAppendedPush(runId, entry));
+}
+function appendRunLogEntryAndBroadcast(state, runId, value, reason) {
+  const entry = appendRunLogEntry(state.projectRoot, runId, value);
+  broadcastRunLogAppended(state, runId, entry);
+  broadcastSnapshotInvalidation(state, reason);
+  return entry;
+}
+function emitRigEvent(state, input) {
+  const event = buildRigEvent(state, input);
+  state.eventJournal.push(event);
+  if (state.eventJournal.length > SERVER_EVENT_JOURNAL_LIMIT) {
+    state.eventJournal.splice(0, state.eventJournal.length - SERVER_EVENT_JOURNAL_LIMIT);
+  }
+  broadcastPush(state, {
+    type: "push",
+    channel: RIG_WS_CHANNELS.event,
+    data: event
+  });
+  return event;
+}
+
+// packages/server/src/server-helpers/terminal-runtime.ts
+var DEFAULT_TERMINAL_SHELL = process.env.SHELL || "/bin/zsh";
+
+// packages/server/src/server-helpers/http-router.ts
+import {
+  listAuthorityRuns as listAuthorityRuns4,
+  readAuthorityRun as readAuthorityRun5,
+  resolveAuthorityPaths,
+  writeJsonFile as writeJsonFile3
+} from "@rig/runtime/control-plane/authority-files";
+import {
+  mutateWorkspaceServiceFabric,
+  readTaskArtifactPreview,
+  readWorkspaceRemoteFleet,
+  readWorkspaceTopology
+} from "@rig/runtime/control-plane/native/workspace-ops";
+import {
+  doctorManagedRemoteEndpoints,
+  listManagedRemoteEndpoints,
+  removeManagedRemoteEndpoint,
+  resolveRemoteEndpoint,
+  updateManagedRemoteEndpointInAuthority,
+  upsertManagedRemoteEndpoint,
+  RemoteWsClient
+} from "@rig/runtime/control-plane/remote";
+
+// packages/server/src/server-helpers/run-steering.ts
+import { appendJsonlRecord as appendJsonlRecord2, readAuthorityRun as readAuthorityRun4, resolveAuthorityRunDir as resolveAuthorityRunDir3 } from "@rig/runtime/control-plane/authority-files";
+
+// packages/server/src/server-helpers/http-router.ts
+import { buildRigInitConfigSource } from "@rig/core";
+import {
+  buildTaskRunLifecycleComment,
+  updateConfiguredTaskSourceTask
+} from "@rig/runtime/control-plane/tasks/source-lifecycle";
+
+// packages/server/src/server-helpers/github-auth-store.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve6 } from "path";
+function cleanString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function cleanScopes(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((entry) => {
+    const clean = cleanString(entry);
+    return clean ? [clean] : [];
+  });
+}
+function readStoredAuth(stateFile) {
+  if (!existsSync3(stateFile))
+    return {};
+  try {
+    const parsed = JSON.parse(readFileSync(stateFile, "utf8"));
+    return {
+      ...cleanString(parsed.token) ? { token: cleanString(parsed.token) } : {},
+      login: cleanString(parsed.login),
+      userId: cleanString(parsed.userId),
+      scopes: cleanScopes(parsed.scopes),
+      selectedRepo: cleanString(parsed.selectedRepo),
+      tokenSource: parsed.tokenSource === "oauth-device" || parsed.tokenSource === "manual-token" || parsed.tokenSource === "env" ? parsed.tokenSource : undefined,
+      pendingDevice: parsePendingDevice(parsed.pendingDevice),
+      updatedAt: cleanString(parsed.updatedAt) ?? undefined
+    };
+  } catch {
+    return {};
+  }
+}
+function parsePendingDevice(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const record = value;
+  const pollId = cleanString(record.pollId);
+  const deviceCode = cleanString(record.deviceCode);
+  const expiresAt = cleanString(record.expiresAt);
+  const intervalSeconds = typeof record.intervalSeconds === "number" && Number.isFinite(record.intervalSeconds) ? Math.max(1, Math.floor(record.intervalSeconds)) : null;
+  if (!pollId || !deviceCode || !expiresAt || !intervalSeconds)
+    return null;
+  return { pollId, deviceCode, expiresAt, intervalSeconds };
+}
+function writeStoredAuth(stateFile, payload) {
+  mkdirSync3(resolve6(stateFile, ".."), { recursive: true });
+  writeFileSync3(stateFile, `${JSON.stringify(payload, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(stateFile, 384);
+  } catch {}
+}
+function resolveGitHubAuthStateFile(projectRoot) {
+  return resolve6(resolveServerAuthorityPaths(projectRoot).stateDir, "github-auth.json");
+}
+function createGitHubAuthStore(projectRoot) {
+  const stateFile = resolveGitHubAuthStateFile(projectRoot);
+  return {
+    stateFile,
+    status(options) {
+      const stored = readStoredAuth(stateFile);
+      const token = cleanString(stored.token);
+      return {
+        signedIn: Boolean(token),
+        login: cleanString(stored.login),
+        userId: cleanString(stored.userId),
+        scopes: cleanScopes(stored.scopes),
+        selectedRepo: cleanString(stored.selectedRepo),
+        oauthConfigured: options?.oauthConfigured === true,
+        tokenSource: token ? stored.tokenSource ?? "manual-token" : null
+      };
+    },
+    readToken() {
+      return cleanString(readStoredAuth(stateFile).token);
+    },
+    saveToken(input) {
+      const previous = readStoredAuth(stateFile);
+      writeStoredAuth(stateFile, {
+        ...previous,
+        token: input.token,
+        tokenSource: input.tokenSource,
+        login: input.login ?? null,
+        userId: input.userId ?? null,
+        scopes: input.scopes ?? [],
+        selectedRepo: input.selectedRepo ?? previous.selectedRepo ?? null,
+        pendingDevice: null,
+        updatedAt: new Date().toISOString()
+      });
+    },
+    savePendingDevice(input) {
+      const previous = readStoredAuth(stateFile);
+      writeStoredAuth(stateFile, {
+        ...previous,
+        pendingDevice: input,
+        updatedAt: new Date().toISOString()
+      });
+    },
+    saveSelectedRepo(selectedRepo) {
+      const previous = readStoredAuth(stateFile);
+      writeStoredAuth(stateFile, {
+        ...previous,
+        selectedRepo: selectedRepo ?? null,
+        updatedAt: new Date().toISOString()
+      });
+    },
+    readPendingDevice(pollId) {
+      const pending = readStoredAuth(stateFile).pendingDevice ?? null;
+      if (!pending || pending.pollId !== pollId)
+        return null;
+      if (Date.parse(pending.expiresAt) <= Date.now())
+        return null;
+      return pending;
+    },
+    clearPendingDevice() {
+      const previous = readStoredAuth(stateFile);
+      writeStoredAuth(stateFile, {
+        ...previous,
+        pendingDevice: null,
+        updatedAt: new Date().toISOString()
+      });
+    }
+  };
+}
+
+// packages/server/src/server-helpers/github-projects.ts
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+}
+async function defaultGraphQLFetch(query, variables, token) {
+  const response = await fetch("https://api.github.com/graphql", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+      accept: "application/vnd.github+json"
+    },
+    body: JSON.stringify({ query, variables })
+  });
+  const json = await response.json().catch(() => ({}));
+  if (!response.ok || json.errors) {
+    throw new Error(`GitHub Projects GraphQL request failed: ${JSON.stringify(json.errors ?? { status: response.status })}`);
+  }
+  return json.data;
+}
+async function resolveProjectStatusField(input) {
+  const query = `
+    query RigProjectStatusField($projectId: ID!) {
+      node(id: $projectId) {
+        ... on ProjectV2 {
+          fields(first: 50) {
+            nodes {
+              ... on ProjectV2FieldCommon { id name }
+              ... on ProjectV2SingleSelectField { id name options { id name } }
+            }
+          }
+        }
+      }
+    }
+  `;
+  const fetchGraphQL = input.fetchGraphQL ?? defaultGraphQLFetch;
+  const data = await fetchGraphQL(query, { projectId: input.projectId }, input.token);
+  const fields = asRecord(asRecord(asRecord(data)?.node)?.fields)?.nodes;
+  for (const node of Array.isArray(fields) ? fields : []) {
+    const record = asRecord(node);
+    if (asString(record?.name)?.toLowerCase() !== "status")
+      continue;
+    const id = asString(record?.id);
+    if (!id)
+      continue;
+    const options = Array.isArray(record?.options) ? record.options.flatMap((option) => {
+      const optionRecord = asRecord(option);
+      const optionId = asString(optionRecord?.id);
+      const name = asString(optionRecord?.name);
+      return optionId && name ? [{ id: optionId, name }] : [];
+    }) : [];
+    return { id, name: "Status", options };
+  }
+  throw new Error(`GitHub Project ${input.projectId} does not expose a Status single-select field.`);
+}
+async function ensureIssueProjectItem(input) {
+  const query = `
+    query RigFindProjectIssueItem($projectId: ID!, $issueNodeId: ID!) {
+      node(id: $projectId) {
+        ... on ProjectV2 {
+          items(first: 100) { nodes { id content { ... on Issue { id } } } }
+        }
+      }
+    }
+  `;
+  const fetchGraphQL = input.fetchGraphQL ?? defaultGraphQLFetch;
+  const data = await fetchGraphQL(query, { projectId: input.projectId, issueNodeId: input.issueNodeId }, input.token);
+  const nodes = asRecord(asRecord(asRecord(data)?.node)?.items)?.nodes;
+  for (const node of Array.isArray(nodes) ? nodes : []) {
+    const record = asRecord(node);
+    const content = asRecord(record?.content);
+    if (asString(content?.id) === input.issueNodeId) {
+      const id2 = asString(record?.id);
+      if (id2)
+        return { id: id2, created: false };
+    }
+  }
+  const mutation = `
+    mutation RigAddIssueToProject($projectId: ID!, $contentId: ID!) {
+      addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) { item { id } }
+    }
+  `;
+  const created = await fetchGraphQL(mutation, { projectId: input.projectId, contentId: input.issueNodeId }, input.token);
+  const addResult = asRecord(asRecord(created)?.addProjectV2ItemById);
+  const id = asString(asRecord(addResult?.item)?.id);
+  if (!id)
+    throw new Error("GitHub Project item creation did not return an item id.");
+  return { id, created: true };
+}
+async function updateIssueProjectStatus(input) {
+  const mutation = `
+    mutation RigUpdateProjectStatus($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+      updateProjectV2ItemFieldValue(input: {
+        projectId: $projectId,
+        itemId: $itemId,
+        fieldId: $fieldId,
+        value: { singleSelectOptionId: $optionId }
+      }) { projectV2Item { id } }
+    }
+  `;
+  const fetchGraphQL = input.fetchGraphQL ?? defaultGraphQLFetch;
+  await fetchGraphQL(mutation, {
+    projectId: input.projectId,
+    itemId: input.itemId,
+    fieldId: input.fieldId,
+    optionId: input.optionId
+  }, input.token);
+}
+
+// packages/server/src/server-helpers/github-project-status-sync.ts
+var DEFAULT_PROJECT_STATUSES = {
+  running: "In Progress",
+  prOpen: "In Review",
+  ciFixing: "In Review",
+  done: "Done",
+  needsAttention: "Needs Attention"
+};
+function lifecycleStatusForTaskStatus(status) {
+  const normalized = status?.trim().toLowerCase().replace(/[-\s]+/g, "_");
+  if (!normalized)
+    return null;
+  if (normalized === "closed" || normalized === "done")
+    return "done";
+  if (normalized === "under_review" || normalized === "review" || normalized === "pr_open")
+    return "prOpen";
+  if (normalized === "ci_fixing" || normalized === "fixing")
+    return "ciFixing";
+  if (normalized === "failed" || normalized === "needs_attention" || normalized === "blocked")
+    return "needsAttention";
+  if (normalized === "in_progress" || normalized === "running" || normalized === "ready" || normalized === "open")
+    return "running";
+  return null;
+}
+function cleanString2(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function projectConfigFrom(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config))
+    return null;
+  const root = config;
+  return root.github?.projects ?? null;
+}
+async function syncGitHubProjectStatusForTaskUpdate(input) {
+  const projects = projectConfigFrom(input.config);
+  if (!projects?.enabled)
+    return { synced: false, reason: "project-sync-disabled" };
+  const projectId = cleanString2(projects.projectId);
+  if (!projectId)
+    return { synced: false, reason: "missing-project-id" };
+  const token = cleanString2(input.token);
+  if (!token)
+    return { synced: false, reason: "missing-token" };
+  const lifecycleStatus = lifecycleStatusForTaskStatus(input.status);
+  if (!lifecycleStatus)
+    return { synced: false, reason: "missing-status" };
+  const issueNodeId = cleanString2(input.issueNodeId);
+  if (!issueNodeId)
+    return { synced: false, reason: "missing-issue-node-id" };
+  const projectStatus = cleanString2(projects.statuses?.[lifecycleStatus]) ?? DEFAULT_PROJECT_STATUSES[lifecycleStatus];
+  const field = await resolveProjectStatusField({ projectId, token, fetchGraphQL: input.fetchGraphQL });
+  const option = field.options.find((candidate) => candidate.name.toLowerCase() === projectStatus.toLowerCase() || candidate.id === projectStatus);
+  if (!option)
+    return { synced: false, reason: "missing-project-status-option" };
+  const item = await ensureIssueProjectItem({ projectId, issueNodeId, token, fetchGraphQL: input.fetchGraphQL });
+  await updateIssueProjectStatus({
+    projectId,
+    itemId: item.id,
+    fieldId: cleanString2(projects.statusFieldId) ?? field.id,
+    optionId: option.id,
+    token,
+    fetchGraphQL: input.fetchGraphQL
+  });
+  return { synced: true, lifecycleStatus, projectStatus, itemId: item.id };
+}
+function extractGitHubIssueNodeId(task) {
+  if (!task || typeof task !== "object" || Array.isArray(task))
+    return null;
+  const record = task;
+  const direct = cleanString2(record.issueNodeId) ?? cleanString2(record.nodeId) ?? cleanString2(record.node_id);
+  if (direct)
+    return direct;
+  const raw = record.raw;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return null;
+  const rawRecord = raw;
+  return cleanString2(rawRecord.id) ?? cleanString2(rawRecord.nodeId) ?? cleanString2(rawRecord.node_id);
+}
+
+// packages/server/src/server-helpers/http-router.ts
+var RIG_CONFIG_PACKAGE_VERSION = "0.0.6-alpha.0";
+var RIG_CONFIG_DEV_DEPENDENCIES = {
+  "@rig/core": `npm:@h-rig/core@${RIG_CONFIG_PACKAGE_VERSION}`,
+  "@rig/standard-plugin": `npm:@h-rig/standard-plugin@${RIG_CONFIG_PACKAGE_VERSION}`
+};
+
+// packages/server/src/server-helpers/ws-router.ts
+import {
+  ORCHESTRATION_WS_CHANNELS,
+  ORCHESTRATION_WS_METHODS,
+  RIG_WS_METHODS,
+  WS_METHODS
+} from "@rig/contracts";
+import {
+  listManagedRemoteEndpoints as listManagedRemoteEndpoints2,
+  removeManagedRemoteEndpoint as removeManagedRemoteEndpoint2,
+  resolveRemoteEndpoint as resolveRemoteEndpoint2,
+  upsertManagedRemoteEndpoint as upsertManagedRemoteEndpoint2,
+  RemoteWsClient as RemoteWsClient2
+} from "@rig/runtime/control-plane/remote";
+import { deleteRunState } from "@rig/runtime/control-plane/native/run-ops";
+import { readAuthorityRun as readAuthorityRun6 } from "@rig/runtime/control-plane/authority-files";
+
+// packages/server/src/server-helpers/inspector-jobs.ts
+import { readJsonFile as readJsonFile2 } from "@rig/runtime/control-plane/authority-files";
+import { resolveMonorepoRoot as resolveMonorepoRoot4 } from "@rig/runtime/control-plane/native/utils";
+import { normalizeTaskLifecycleStatus as normalizeTaskLifecycleStatus2 } from "@rig/runtime/control-plane/state-sync/types";
+
+// packages/server/src/inspector/discovery.ts
+import {
+  runStatus
+} from "@rig/runtime/control-plane/native/run-ops";
+import {
+  listAuthorityRuns as listAuthorityRuns5,
+  readAuthorityRun as readAuthorityRun7
+} from "@rig/runtime/control-plane/authority-files";
+
+// packages/server/src/inspector/service.ts
+var ACTIVE_RUN_STATUSES = new Set(["preparing", "running", "validating", "reviewing"]);
+
+// packages/server/src/inspector/upstream-sync.ts
+import { resolveMonorepoRoot as resolveMonorepoRoot3 } from "@rig/runtime/control-plane/native/utils";
+var UPSTREAM_VALIDATION_DESCRIPTIONS = {
+  "integration:hg-auth-backport": "Preserves the upstream auth hardening cluster: nonce-backed node-client login, signature-aware JWT verification, shared-token onboarding semantics, and regression coverage.",
+  "integration:hg-core-security-backport": "Preserves the vendored core-app and backend security fixes for OTP validation, NoSQL/operator hardening, AES/encryption behavior, and rate-limit or redirect-state protections.",
+  "integration:hg-boundary-hardening": "Preserves boundary-safe CORS behavior and credential lookup error hygiene across the vendored backend and the extracted credentials-service analogue.",
+  "integration:hg-uudl-runtime": "Preserves the upstream uudl runtime/package fixes: production dependency placement, path-resolution/runtime bootstrap behavior, AWS/MSK environment detection, KMS coverage, and a compiling UUDL tree.",
+  "boundary:hg-auth-triage": "Requires a durable keep/adapt/reject triage record for the post-import auth policy and mobile-wallet SIWE commits so the watcher does not keep rediscovering the same ambiguity.",
+  "boundary:hg-upstream-triage": "Requires a durable keep/adapt/reject triage record for service-relevant upstream commits that do not match the current portable catalog, including commit hashes, touched paths, and follow-up routing decisions."
+};
+var CLUSTERS = {
+  "auth-hardening": {
+    classification: "portable-now",
+    title: "[HG-001] Preserve upstream auth and shared-token hardening across extracted auth work",
+    description: "Backport clearly portable auth changes introduced upstream after imported revision 58b56e15: 3196d5c (node-client login nonce), bb5b74f (JWT signature validation), and 92011ead (shared token verification for wallet signup onboarding). Apply them where they belong in this repo: hp-auth-service, hp-gateway if verification semantics surface there, and the upstream monorepo auth owner flows for the remaining wallet-login/shared-token work. This task must preserve the security behavior, not just copy code. It should explicitly reconcile with bd-k0y-10, bd-k0y-11, bd-k0y-12, and bd-k0y-13.",
+    acceptanceCriteria: "Map upstream commits 3196d5c, bb5b74f, and 92011ead to exact local targets; preserve nonce-backed node-client login, JWT signature validation, and shared-token verification behavior; add automated tests that fail without the hardening; document any deliberate non-ports.",
+    role: "extractor",
+    scope: [
+      "repos/spliter-monorepo/microservices/hp-auth-service/**",
+      "repos/spliter-monorepo/microservices/hp-gateway/**",
+      "repos/spliter-monorepo/humoongate/moongate/core-app/**"
+    ],
+    validation: ["integration:hg-auth-backport", "boundary:changed-files"],
+    validationDescriptions: {
+      "integration:hg-auth-backport": UPSTREAM_VALIDATION_DESCRIPTIONS["integration:hg-auth-backport"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:auth"]
+  },
+  "core-security": {
+    classification: "portable-now",
+    title: "[HG-002] Backport core-app and backend security fixes from post-import upstream",
+    description: "Backport the clearly portable security fixes from efdae709 (OTP validation bypass), f63830d (NoSQL operator injection hardening), d7f6919 (AES encryption), and af86ac16 (three critical/high vulnerabilities). Preserve the behavior in the vendored auth owner and the touched backend query surfaces instead of treating these as optional cleanups. The high-value touched files from af86ac16 must be reviewed and ported or consciously waived with rationale.",
+    acceptanceCriteria: "Review and port the exact security behaviors from efdae709, f63830d, d7f6919, and af86ac16; cover the listed core-app and backend touched files; add regression tests for OTP bypass, NoSQL operator injection, AES/encryption behavior, and rate-limit or redirect-state hardening; document any consciously waived upstream changes.",
+    role: "mechanic",
+    scope: [
+      "repos/spliter-monorepo/humoongate/moongate/core-app/**",
+      "repos/spliter-monorepo/humoongate/humanity/hp-backend-ts/**"
+    ],
+    validation: ["integration:hg-core-security-backport", "boundary:changed-files"],
+    validationDescriptions: {
+      "integration:hg-core-security-backport": UPSTREAM_VALIDATION_DESCRIPTIONS["integration:hg-core-security-backport"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:security"]
+  },
+  "boundary-hardening": {
+    classification: "portable-now",
+    title: "[HG-003] Backport request-boundary hardening for CORS and credential lookup flows",
+    description: "Backport the clearly portable boundary hardening from 083bbe4 (CORS config) and 36d52fba (credential lookup error hygiene). Preserve request-boundary behavior in the vendored backend and any analogous extracted credential-facing service seams so attackers cannot learn internals from credential lookup failures or exploit inconsistent CORS policy.",
+    acceptanceCriteria: "Port the exact request-boundary behavior from 083bbe4 and 36d52fba; preserve safe CORS policy and credential lookup error hygiene; add tests showing callers do not receive overly detailed credential lookup failures; document any extracted-service analogue that must mirror the behavior.",
+    role: "mechanic",
+    scope: [
+      "repos/spliter-monorepo/humoongate/humanity/hp-backend-ts/**",
+      "repos/spliter-monorepo/microservices/hp-credentials-service/**"
+    ],
+    validation: ["integration:hg-boundary-hardening", "boundary:changed-files"],
+    validationDescriptions: {
+      "integration:hg-boundary-hardening": UPSTREAM_VALIDATION_DESCRIPTIONS["integration:hg-boundary-hardening"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:boundary"]
+  },
+  "uudl-runtime": {
+    classification: "portable-now",
+    title: "[HG-004] Backport uudl runtime and packaging fixes from upstream",
+    description: "Backport the clearly portable uudl runtime fixes from 2141b4c, 1fa56d7, a9a0a99, 9fcfa6e, and ea5cb03. Preserve the runtime behavior rather than cherry-picking filenames: production dependency placement, tsconfig-paths resolution, aggregator cycle removal, AWS/MSK environment detection, and local KMS wiring all need to be reflected in whichever UUDL runtime this repo still owns.",
+    acceptanceCriteria: "Port the runtime behaviors from 2141b4c, 1fa56d7, a9a0a99, 9fcfa6e, and ea5cb03; preserve production dependency placement, tsconfig-paths runtime resolution, aggregator cycle removal, AWS/MSK environment detection, and local KMS configuration; add runtime-focused tests or smoke coverage for each preserved behavior.",
+    role: "extractor",
+    scope: ["repos/spliter-monorepo/humoongate/humanity/hp-uudl/**"],
+    validation: ["integration:hg-uudl-runtime", "boundary:changed-files"],
+    validationDescriptions: {
+      "integration:hg-uudl-runtime": UPSTREAM_VALIDATION_DESCRIPTIONS["integration:hg-uudl-runtime"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:uudl"]
+  },
+  "auth-triage": {
+    classification: "needs-human-triage",
+    title: "[HG-005] Triage post-import auth policy deltas and mobile-wallet SIWE changes",
+    description: "Review the upstream changes that are relevant but not safely auto-portable: 1262b75 (JWT_EXPIRES_IN 1d -> 7d), 15036424 (unlink-wallet endpoint and Wallet.default fix), and d4a47015 (unlink-wallet error handling). Produce an explicit keep/adapt/reject decision for each commit with rationale tied to the extracted auth plan, core-app ownership, and current threat model, and record the result in artifacts/bd-2ztk.5/decision-log.md so future agents do not silently re-litigate these decisions.",
+    acceptanceCriteria: "For 1262b75, 15036424, and d4a47015, produce explicit keep/adapt/reject decisions with rationale tied to auth ownership and threat model; record the decision in artifacts/bd-2ztk.5/decision-log.md; identify any follow-on implementation tasks if the answer is keep or adapt.",
+    role: "architect",
+    scope: ["artifacts/bd-2ztk.5/**", "docs/research/**"],
+    validation: ["boundary:hg-auth-triage"],
+    validationDescriptions: {
+      "boundary:hg-auth-triage": UPSTREAM_VALIDATION_DESCRIPTIONS["boundary:hg-auth-triage"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:triage"]
+  },
+  "generic-triage": {
+    classification: "needs-human-triage",
+    title: "[HG-007] Triage uncatalogued service-relevant upstream commits",
+    description: "Review future upstream commits that touch service-relevant paths but do not match the current portable-now catalog. For each commit or batch, produce keep/adapt/reject decisions with rationale, cite the touched paths and why they matter here, and either route them into an existing backport task or open a new follow-up task when they are worth preserving.",
+    acceptanceCriteria: "For each uncatalogued service-relevant upstream commit or batch, record keep/adapt/reject decisions with rationale in artifacts/bd-2ztk.7/decision-log.md; cite the commit hashes and touched paths; and either attach the work to an existing backport task or open a new follow-up task when preservation is warranted.",
+    role: "architect",
+    scope: ["artifacts/bd-2ztk.7/**", "docs/research/**"],
+    validation: ["boundary:hg-upstream-triage"],
+    validationDescriptions: {
+      "boundary:hg-upstream-triage": UPSTREAM_VALIDATION_DESCRIPTIONS["boundary:hg-upstream-triage"]
+    },
+    labels: ["upstream:monorepo", "kind:backport", "cluster:triage"]
+  }
+};
+
+// packages/server/src/server-helpers/task-config.ts
+import { existsSync as existsSync4 } from "fs";
+async function readTaskConfig(projectRoot) {
+  const taskConfigPath = resolveRigServerPaths(projectRoot).taskConfigPath;
+  if (!existsSync4(taskConfigPath)) {
+    return {};
+  }
+  try {
+    const parsed = await Bun.file(taskConfigPath).json();
+    return parsed ?? {};
+  } catch {
+    return {};
+  }
+}
+
+// packages/server/src/server.ts
+var RIG_WORKSPACE_ID = "rig-local-workspace";
+var serverPathEnvQueue = Promise.resolve();
+async function withServerPathEnv(projectRoot, fn) {
+  const waitForTurn = serverPathEnvQueue;
+  let releaseTurn;
+  serverPathEnvQueue = new Promise((resolve8) => {
+    releaseTurn = resolve8;
+  });
+  await waitForTurn;
+  const paths = resolveServerAuthorityPaths(projectRoot);
+  const overrides = {
+    RIG_STATE_DIR: paths.stateDir,
+    RIG_LOGS_DIR: paths.logsDir,
+    RIG_SESSION_FILE: paths.sessionFile,
+    ARTIFACTS_DIR: paths.artifactsDir
+  };
+  const previous = new Map;
+  for (const [key, value] of Object.entries(overrides)) {
+    previous.set(key, process.env[key]);
+    process.env[key] = value;
+  }
+  try {
+    return await fn();
+  } finally {
+    for (const [key, value] of previous.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+    releaseTurn();
+  }
+}
+async function withServerAuthorityEnvIfNeeded(projectRoot, fn) {
+  const paths = resolveServerAuthorityPaths(projectRoot);
+  if (process.env.RIG_STATE_DIR === paths.stateDir && process.env.RIG_LOGS_DIR === paths.logsDir && process.env.RIG_SESSION_FILE === paths.sessionFile) {
+    return await fn();
+  }
+  return withServerPathEnv(projectRoot, fn);
+}
+async function readWorkspaceTasks(projectRoot) {
+  const issuesPath = resolve7(resolveMonorepoRoot5(projectRoot), ".beads", "issues.jsonl");
+  const taskConfig = await readTaskConfig(projectRoot);
+  if (!existsSync5(issuesPath)) {
+    return [];
+  }
+  const latestById = new Map;
+  for (const entry of readJsonlFile3(issuesPath).filter((candidate) => !!candidate && typeof candidate === "object" && !Array.isArray(candidate)).filter((candidate) => normalizeString(candidate.issue_type) !== "epic")) {
+    const id = normalizeString(entry.id) ?? "";
+    if (id.length === 0) {
+      continue;
+    }
+    const config = taskConfig[id] ?? {};
+    const rawStatus = normalizeString(entry.status) ?? "open";
+    const normalizedStatus = normalizeTaskLifecycleStatus3(rawStatus);
+    const dependencyRecords = Array.isArray(entry.dependencies) ? entry.dependencies.filter((dependency) => !!dependency && typeof dependency === "object" && !Array.isArray(dependency)) : [];
+    latestById.set(id, {
+      id,
+      title: normalizeString(entry.title) ?? id,
+      description: normalizeString(entry.description),
+      acceptanceCriteria: normalizeString(entry.acceptance_criteria),
+      status: normalizedStatus ?? "unknown",
+      sourceStatus: normalizedStatus ? null : rawStatus,
+      priority: typeof entry.priority === "number" ? entry.priority : typeof entry.priority === "string" ? Number(entry.priority) : null,
+      issueType: normalizeString(entry.issue_type),
+      role: normalizeString(config.role) ?? null,
+      externalRef: normalizeString(entry.external_ref) ?? normalizeString(config.wp_id) ?? null,
+      sourceIssueId: normalizeString(entry.source_issue_id) ?? normalizeString(config.source_issue_id) ?? null,
+      dependencies: dependencyRecords.filter((dependency) => normalizeString(dependency.type) === "blocks").map((dependency) => normalizeString(dependency.depends_on_id)).filter((dependency) => dependency !== null),
+      parentChildDeps: dependencyRecords.filter((dependency) => normalizeString(dependency.type) === "parent-child").map((dependency) => normalizeString(dependency.depends_on_id)).filter((dependency) => dependency !== null),
+      scope: normalizeStringArray(config.scope),
+      validation: normalizeStringArray(config.validation),
+      createdAt: normalizeString(entry.created_at),
+      updatedAt: normalizeString(entry.updated_at),
+      labels: normalizeStringArray(entry.labels)
+    });
+  }
+  return Array.from(latestById.values()).sort((left, right) => {
+    const leftPriority = left.priority ?? Number.MAX_SAFE_INTEGER;
+    const rightPriority = right.priority ?? Number.MAX_SAFE_INTEGER;
+    if (leftPriority !== rightPriority) {
+      return leftPriority - rightPriority;
+    }
+    return left.id.localeCompare(right.id);
+  });
+}
+if (false) {}
+
+// packages/server/src/server-helpers/validation-failure.ts
+import { resolve as resolve8 } from "path";
+import {
+  readJsonFile as readJsonFile4,
+  resolveTaskArtifactDirs
+} from "@rig/runtime/control-plane/authority-files";
+function summarizeRunValidationFailure(projectRoot, run) {
+  const artifactRoots = run.taskId ? resolveTaskArtifactDirs(projectRoot, run.taskId) : [];
+  const preferredRoots = run.artifactRoot ? [run.artifactRoot, ...artifactRoots] : artifactRoots;
+  const seen = new Set;
+  for (const artifactRoot of preferredRoots) {
+    if (!artifactRoot || seen.has(artifactRoot)) {
+      continue;
+    }
+    seen.add(artifactRoot);
+    const summary = readJsonFile4(resolve8(artifactRoot, "validation-summary.json"), null);
+    if (!summary || summary.status !== "fail") {
+      continue;
+    }
+    const failedCategories = Array.isArray(summary.categories) ? summary.categories.filter((entry) => String(entry?.status ?? "") !== "pass").map((entry) => String(entry?.category ?? "").trim()).filter(Boolean) : [];
+    if (failedCategories.length > 0) {
+      return `Task validation failed: ${failedCategories.join(", ")}`;
+    }
+    return "Task validation failed.";
+  }
+  return null;
+}
+
+// packages/server/src/server-helpers/run-mutations.ts
+async function enqueueRunLinearEvent(_projectRoot, _event) {}
+function fileExists(path) {
+  try {
+    return statSync3(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function sourceTaskContract(task) {
+  return {
+    id: task.id,
+    title: task.title,
+    description: task.description,
+    acceptanceCriteria: task.acceptanceCriteria,
+    status: task.status,
+    sourceStatus: task.sourceStatus,
+    priority: task.priority,
+    issueType: task.issueType,
+    role: task.role,
+    externalRef: task.externalRef,
+    sourceIssueId: task.sourceIssueId,
+    dependencies: task.dependencies,
+    parentChildDeps: task.parentChildDeps,
+    scope: task.scope,
+    validation: task.validation,
+    labels: task.labels,
+    issueNodeId: task.issueNodeId ?? task.nodeId ?? null,
+    raw: task.raw ?? null
+  };
+}
+function runSourceTaskIdentity(run) {
+  const sourceTask = run.sourceTask;
+  return sourceTask && typeof sourceTask === "object" && !Array.isArray(sourceTask) ? sourceTask : null;
+}
+function lifecycleFailureMessage(taskId, status, error) {
+  const details = error instanceof Error ? error.message : String(error);
+  return `Failed to update task source for ${taskId} to ${status}: ${details}`;
+}
+async function loadRigLifecycleConfig(projectRoot) {
+  try {
+    return await loadConfig(projectRoot);
+  } catch {
+    return null;
+  }
+}
+function issueUpdatesMode(config) {
+  const github = config?.github && typeof config.github === "object" && !Array.isArray(config.github) ? config.github : null;
+  const mode = github?.issueUpdates;
+  return mode === "off" || mode === "minimal" || mode === "lifecycle" ? mode : "lifecycle";
+}
+function shouldWriteIssueUpdate(mode, status) {
+  if (mode === "off")
+    return false;
+  if (mode === "lifecycle")
+    return true;
+  return ["closed", "failed", "cancelled", "needs_attention"].includes(status);
+}
+function parseIssueRef(sourceTask, fallbackTaskId) {
+  const raw = normalizeString(sourceTask?.sourceIssueId) ?? normalizeString(sourceTask?.source_issue_id);
+  const match = raw?.match(/^([^/\s]+)\/([^#\s]+)#(\d+)$/);
+  if (match)
+    return { owner: match[1], repo: match[2], number: match[3] };
+  if (/^\d+$/.test(fallbackTaskId))
+    return null;
+  return null;
+}
+async function syncProjectStatusForRunLifecycle(projectRoot, run, status, config) {
+  if (!run.taskId)
+    return;
+  const issueNodeId = extractGitHubIssueNodeId(runSourceTaskIdentity(run));
+  await syncGitHubProjectStatusForTaskUpdate({
+    taskId: run.taskId,
+    status,
+    issueNodeId,
+    token: createGitHubAuthStore(projectRoot).readToken(),
+    config
+  }).catch(() => {
+    return;
+  });
+}
+async function autoAssignRunIssue(projectRoot, run) {
+  if (!run.taskId)
+    return;
+  const store = createGitHubAuthStore(projectRoot);
+  const token = store.readToken();
+  const login = normalizeString(run.initiatedBy) ?? store.status().login;
+  if (!token || !login)
+    return;
+  const ref = parseIssueRef(runSourceTaskIdentity(run), run.taskId);
+  if (!ref)
+    return;
+  await fetch(`https://api.github.com/repos/${ref.owner}/${ref.repo}/issues/${ref.number}/assignees`, {
+    method: "POST",
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      "user-agent": "rig-server"
+    },
+    body: JSON.stringify({ assignees: [login] })
+  }).catch(() => {
+    return;
+  });
+}
+async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, options = {}) {
+  if (!run.taskId) {
+    return;
+  }
+  const config = await loadRigLifecycleConfig(projectRoot);
+  await syncProjectStatusForRunLifecycle(projectRoot, run, status, config);
+  if (status === "in_progress") {
+    await autoAssignRunIssue(projectRoot, run);
+  }
+  const mode = issueUpdatesMode(config);
+  if (!shouldWriteIssueUpdate(mode, status)) {
+    appendRunLogEntry(projectRoot, run.runId, {
+      id: `log:${run.runId}:task-source-update-skipped:${status}`,
+      title: "Task source lifecycle update skipped",
+      detail: `github.issueUpdates=${mode}; ${status} issue update skipped.`,
+      tone: "info",
+      status: "running",
+      createdAt: new Date().toISOString()
+    });
+    return;
+  }
+  const result = await updateConfiguredTaskSourceTask2(projectRoot, {
+    taskId: run.taskId,
+    sourceTask: runSourceTaskIdentity(run),
+    update: {
+      status,
+      comment: buildTaskRunLifecycleComment2({
+        runId: run.runId,
+        status,
+        summary,
+        runtimeWorkspace: normalizeString(run.worktreePath),
+        logsDir: normalizeString(run.logRoot),
+        sessionDir: normalizeString(run.sessionPath),
+        errorText: options.errorText ?? normalizeString(run.errorText)
+      })
+    }
+  });
+  if (!result.updated) {
+    if (result.source === "plugin" || result.sourceKind) {
+      throw new Error(`Configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} did not accept lifecycle update for ${result.taskId}.`);
+    }
+    appendRunLogEntry(projectRoot, run.runId, {
+      id: `log:${run.runId}:task-source-unconfigured:${status}`,
+      title: "Task source lifecycle update skipped",
+      detail: `No source-aware task source configured for ${result.taskId}; ${status} update skipped.`,
+      tone: "info",
+      status: "running",
+      createdAt: new Date().toISOString()
+    });
+  }
+}
+var TERMINAL_RUN_STATUSES2 = new Set([
+  "completed",
+  "complete",
+  "done",
+  "merged",
+  "closed",
+  "failed",
+  "cancelled",
+  "canceled",
+  "needs_attention",
+  "needs-attention",
+  "stopped"
+]);
+function isActiveRunForTask(run, taskId, newRunId) {
+  if (run.runId === newRunId || run.taskId !== taskId)
+    return false;
+  const normalizedStatus = normalizeString(run.status)?.toLowerCase() ?? "created";
+  return !TERMINAL_RUN_STATUSES2.has(normalizedStatus);
+}
+function assertNoActiveRunForTask(projectRoot, taskId, newRunId) {
+  const existing = listAuthorityRuns7(projectRoot).find((run) => isActiveRunForTask(run, taskId, newRunId));
+  if (!existing)
+    return;
+  throw new Error(`Task ${taskId} already has an active Rig run: ${existing.runId}`);
+}
+async function createRunRecord(projectRoot, input, readTasks = readWorkspaceTasks) {
+  if ("taskId" in input && input.taskId) {
+    assertNoActiveRunForTask(projectRoot, input.taskId, input.runId);
+  }
+  const sourceTask = "taskId" in input && input.taskId ? (await readTasks(projectRoot)).find((task) => task.id === input.taskId) ?? null : null;
+  const taskTitle = sourceTask?.title ?? ("taskId" in input && input.taskId ? input.taskId : null);
+  const runDir = resolveAuthorityRunDir4(projectRoot, input.runId);
+  const runRecord = {
+    runId: input.runId,
+    projectRoot,
+    workspaceId: input.workspaceId,
+    taskId: "taskId" in input ? input.taskId ?? null : null,
+    threadId: null,
+    mode: input.executionTarget === "remote" ? "remote" : "local",
+    runtimeAdapter: normalizeRuntimeAdapter(input.runtimeAdapter),
+    status: "created",
+    createdAt: input.createdAt,
+    startedAt: null,
+    completedAt: null,
+    endpointId: null,
+    hostId: input.remoteHostId ?? null,
+    worktreePath: null,
+    artifactRoot: null,
+    logRoot: null,
+    sessionPath: null,
+    sessionLogPath: null,
+    updatedAt: input.createdAt,
+    title: "title" in input && input.title ? input.title : taskTitle ?? "New run",
+    model: input.model ?? null,
+    runtimeMode: input.runtimeMode ?? "full-access",
+    interactionMode: input.interactionMode ?? "default",
+    runMode: (input.runtimeMode ?? "full-access") === "full-access" ? "autonomous" : "interactive",
+    initialPrompt: "initialPrompt" in input ? input.initialPrompt ?? null : null,
+    baselineMode: input.baselineMode ?? "head",
+    prMode: input.prMode ?? null,
+    initiatedBy: input.initiatedBy ?? null,
+    ...sourceTask ? { sourceTask: sourceTaskContract(sourceTask) } : {}
+  };
+  mkdirSync5(runDir, { recursive: true });
+  writeFileSync5(resolve9(runDir, "run.json"), `${JSON.stringify(runRecord, null, 2)}
+`, "utf8");
+  if ("initialPrompt" in input && input.initialPrompt && input.initialPrompt.trim().length > 0) {
+    writeFileSync5(resolve9(runDir, "timeline.jsonl"), `${JSON.stringify({
+      id: `message-${Date.now()}`,
+      type: "user_message",
+      text: input.initialPrompt,
+      createdAt: input.createdAt
+    })}
+`, "utf8");
+  }
+  if (runRecord.taskId) {
+    const taskId = runRecord.taskId;
+    (async () => {
+      try {
+        await updateRunTaskSourceLifecycle(projectRoot, runRecord, "in_progress", "Rig task run started and claimed this task.");
+      } catch (error) {
+        const failureSummary = lifecycleFailureMessage(taskId, "in_progress", error);
+        appendRunLogEntry(projectRoot, input.runId, {
+          id: `log:${input.runId}:task-source-in-progress-update`,
+          title: "Task source claim update failed",
+          detail: failureSummary,
+          tone: "error",
+          status: "running",
+          createdAt: new Date().toISOString(),
+          payload: { taskId }
+        });
+      }
+    })();
+  }
+}
+async function startLocalRun(state, runId, options) {
+  const run = readAuthorityRun8(state.projectRoot, runId);
+  if (!run) {
+    throw new Error(`Run not found: ${runId}`);
+  }
+  const startedAt = new Date().toISOString();
+  state.runProcesses.set(runId, {
+    runId,
+    child: null,
+    startedAt,
+    stopped: false
+  });
+  patchRunRecord(state.projectRoot, runId, buildRunStartPatch(startedAt));
+  await enqueueRunLinearEvent(state.projectRoot, {
+    type: "run.started",
+    runId,
+    taskId: run.taskId,
+    timestamp: startedAt,
+    agent: run.runtimeAdapter,
+    summary: run.title
+  });
+  appendRunLogEntry(state.projectRoot, runId, {
+    id: `log:${runId}:prepare`,
+    title: "Rig task run starting",
+    detail: run.taskId ?? run.title,
+    tone: "info",
+    status: "preparing",
+    createdAt: startedAt
+  });
+  broadcastRunLogAppended(state, runId, readLatestRawRunLog(state.projectRoot, runId));
+  broadcastSnapshotInvalidation(state);
+  const cliProjectRoot = resolveLocalRunCliProjectRoot(state.projectRoot);
+  const cliEntryPoint = resolve9(cliProjectRoot, "packages/cli/bin/rig.ts");
+  if (!existsSync6(cliEntryPoint)) {
+    const completedAt = new Date().toISOString();
+    const failureSummary = `Rig task-run entrypoint missing at ${relative2(state.projectRoot, cliEntryPoint)}`;
+    patchRunRecord(state.projectRoot, runId, {
+      status: "failed",
+      completedAt,
+      errorText: failureSummary
+    });
+    appendRunLogEntryAndBroadcast(state, runId, {
+      id: `log:${runId}:missing-entrypoint`,
+      title: "Run failed",
+      detail: failureSummary,
+      tone: "error",
+      status: "failed",
+      createdAt: completedAt
+    }, "local-run-missing-entrypoint");
+    await enqueueRunLinearEvent(state.projectRoot, {
+      type: "run.failed",
+      runId,
+      taskId: run.taskId,
+      timestamp: completedAt,
+      agent: run.runtimeAdapter,
+      summary: failureSummary
+    });
+    state.runProcesses.delete(runId);
+    broadcastSnapshotInvalidation(state);
+    await reconcileScheduler(state, "local-run-missing-entrypoint");
+    return;
+  }
+  queueMicrotask(() => {
+    withServerAuthorityEnvIfNeeded(state.projectRoot, async () => {
+      const command = [
+        "bun",
+        "run",
+        cliEntryPoint,
+        "--run-id",
+        runId,
+        "server",
+        "task-run",
+        ...run.taskId ? ["--task", run.taskId] : [],
+        ...normalizeString(run.title) ? ["--title", normalizeString(run.title)] : [],
+        "--runtime-adapter",
+        normalizeRuntimeAdapter(run.runtimeAdapter),
+        ...normalizeString(run.model) ? ["--model", normalizeString(run.model)] : [],
+        "--runtime-mode",
+        normalizeString(run.runtimeMode) ?? "full-access",
+        "--interaction-mode",
+        normalizeString(run.interactionMode) ?? "default",
+        ...normalizeString(options?.promptOverride) ?? normalizeString(run.initialPrompt) ? [
+          "--initial-prompt",
+          normalizeString(options?.promptOverride) ?? normalizeString(run.initialPrompt)
+        ] : [],
+        ...normalizeString(run.baselineMode) ? ["--dirty-baseline", normalizeString(run.baselineMode)] : [],
+        ...normalizeString(run.prMode) ? ["--pr", normalizeString(run.prMode)] : []
+      ];
+      const publishedServer = readPublishedRigServerStateSync(state.projectRoot);
+      const serverUrl = process.env.RIG_SERVER_URL?.trim() || (publishedServer ? `http://${publishedServer.host}:${publishedServer.port}` : "");
+      const bridgeAuthToken = process.env.RIG_AUTH_TOKEN?.trim() || publishedServer?.authToken || "";
+      const bridgeGitHubToken = process.env.RIG_GITHUB_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || createGitHubAuthStore(state.projectRoot).readToken() || "";
+      const child = spawn(command[0], command.slice(1), {
+        cwd: cliProjectRoot,
+        env: {
+          ...process.env,
+          PROJECT_RIG_ROOT: state.projectRoot,
+          RIG_HOST_PROJECT_ROOT: cliProjectRoot,
+          RIG_RUNTIME_BASE_REF: process.env.RIG_RUNTIME_BASE_REF ?? "HEAD",
+          RIG_SERVER_INTERNAL_EXEC: "1",
+          ...serverUrl ? { RIG_SERVER_URL: serverUrl } : {},
+          ...bridgeAuthToken ? { RIG_AUTH_TOKEN: bridgeAuthToken } : {},
+          ...bridgeGitHubToken ? { RIG_GITHUB_TOKEN: bridgeGitHubToken } : {}
+        },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const processState = state.runProcesses.get(runId);
+      if (processState) {
+        processState.child = child;
+      }
+      const handleRunProcessOutput = (detail, tone, title) => {
+        for (const rawLine of detail.split(/\r?\n/)) {
+          const line = rawLine.trim();
+          if (!line)
+            continue;
+          if (line.startsWith("__RIG_RUN_EVENT__")) {
+            try {
+              const serverEvent = JSON.parse(line.slice("__RIG_RUN_EVENT__".length));
+              if (serverEvent.type === "log" && serverEvent.runId) {
+                broadcastRunLogAppended(state, serverEvent.runId, readLatestRawRunLog(state.projectRoot, serverEvent.runId));
+              }
+            } catch {}
+            broadcastSnapshotInvalidation(state);
+            continue;
+          }
+          appendRunLogEntryAndBroadcast(state, runId, {
+            id: `log:${runId}:${Date.now()}`,
+            title,
+            detail: line,
+            tone,
+            status: "running",
+            createdAt: new Date().toISOString()
+          }, "run-log-line");
+        }
+      };
+      child.stdout.on("data", (data) => {
+        handleRunProcessOutput(Buffer.isBuffer(data) ? data.toString("utf8") : String(data), "info", "Rig task run");
+      });
+      child.stderr.on("data", (data) => {
+        handleRunProcessOutput(Buffer.isBuffer(data) ? data.toString("utf8") : String(data), "error", "Rig task run stderr");
+      });
+      try {
+        const exit = await new Promise((resolve10) => {
+          child.once("error", (error) => resolve10({ code: 1, signal: null, error }));
+          child.once("close", (code, signal) => resolve10({ code, signal }));
+        });
+        if (exit.error) {
+          throw new Error(`Failed to start task run: ${exit.error.message}`);
+        }
+        const current = readAuthorityRun8(state.projectRoot, runId);
+        if (!current) {
+          return;
+        }
+        if (exit.code !== 0 && current.status !== "completed" && current.status !== "stopped") {
+          const completedAt = current.completedAt ?? new Date().toISOString();
+          const failureSummary = normalizeString(current.errorText) ?? summarizeRunValidationFailure(state.projectRoot, current) ?? `Rig task-run exited with code ${String(exit.code ?? "unknown")}`;
+          if (current.status !== "failed") {
+            patchRunRecord(state.projectRoot, runId, {
+              status: "failed",
+              completedAt,
+              errorText: failureSummary
+            });
+          }
+          if (current.taskId) {
+            try {
+              await updateRunTaskSourceLifecycle(state.projectRoot, { ...current, status: "failed", completedAt, errorText: failureSummary }, "failed", "Rig task run failed.", { errorText: failureSummary });
+            } catch (error) {
+              const sourceFailure = lifecycleFailureMessage(current.taskId, "failed", error);
+              patchRunRecord(state.projectRoot, runId, { errorText: `${failureSummary}
+${sourceFailure}` });
+              appendRunLogEntry(state.projectRoot, runId, {
+                id: `log:${runId}:task-source-failed-update`,
+                title: "Task source failure update failed",
+                detail: sourceFailure,
+                tone: "error",
+                status: "failed",
+                createdAt: new Date().toISOString()
+              });
+            }
+          }
+          await enqueueRunLinearEvent(state.projectRoot, {
+            type: "run.failed",
+            runId,
+            taskId: current.taskId,
+            timestamp: completedAt,
+            agent: current.runtimeAdapter,
+            summary: failureSummary
+          });
+        }
+        broadcastSnapshotInvalidation(state);
+      } catch (error) {
+        const completedAt = new Date().toISOString();
+        const failureSummary = error instanceof Error ? error.message : String(error);
+        patchRunRecord(state.projectRoot, runId, {
+          status: "failed",
+          completedAt,
+          errorText: failureSummary
+        });
+        if (run.taskId) {
+          try {
+            await updateRunTaskSourceLifecycle(state.projectRoot, { ...run, status: "failed", completedAt, errorText: failureSummary }, "failed", "Rig task run failed.", { errorText: failureSummary });
+          } catch (sourceError) {
+            const sourceFailure = lifecycleFailureMessage(run.taskId, "failed", sourceError);
+            patchRunRecord(state.projectRoot, runId, { errorText: `${failureSummary}
+${sourceFailure}` });
+            appendRunLogEntry(state.projectRoot, runId, {
+              id: `log:${runId}:task-source-failed-update`,
+              title: "Task source failure update failed",
+              detail: sourceFailure,
+              tone: "error",
+              status: "failed",
+              createdAt: new Date().toISOString()
+            });
+          }
+        }
+        await enqueueRunLinearEvent(state.projectRoot, {
+          type: "run.failed",
+          runId,
+          taskId: run.taskId,
+          timestamp: completedAt,
+          agent: run.runtimeAdapter,
+          summary: failureSummary
+        });
+        appendRunLogEntryAndBroadcast(state, runId, {
+          id: `log:${runId}:error`,
+          title: "Run failed",
+          detail: error instanceof Error ? error.message : String(error),
+          tone: "error",
+          status: "failed",
+          createdAt: new Date().toISOString()
+        }, "local-run-failed");
+      } finally {
+        state.runProcesses.delete(runId);
+        await reconcileScheduler(state, "local-run-terminal");
+      }
+    });
+  });
+}
+function resolveLocalRunCliProjectRoot(projectRoot) {
+  const envCandidates = [
+    process.env.RIG_HOST_PROJECT_ROOT?.trim(),
+    process.env.PROJECT_RIG_ROOT?.trim()
+  ].filter((value) => !!value);
+  for (const candidate of envCandidates) {
+    if (existsSync6(resolve9(candidate, "packages/cli/bin/rig.ts"))) {
+      return resolve9(candidate);
+    }
+  }
+  if (existsSync6(resolve9(projectRoot, "packages/cli/bin/rig.ts"))) {
+    return projectRoot;
+  }
+  try {
+    const monorepoRoot = resolveMonorepoRoot6(projectRoot);
+    const outerProjectRoot = dirname5(dirname5(monorepoRoot));
+    if (existsSync6(resolve9(outerProjectRoot, "packages/cli/bin/rig.ts"))) {
+      return outerProjectRoot;
+    }
+  } catch {}
+  return projectRoot;
+}
+async function resumeRunRecord(state, input) {
+  const run = readAuthorityRun8(state.projectRoot, input.runId);
+  if (!run) {
+    throw new Error(`Run not found: ${input.runId}`);
+  }
+  if (run.mode !== "local") {
+    throw new Error("Only local runs can be resumed.");
+  }
+  if (state.runProcesses.has(input.runId)) {
+    throw new Error("Run is already active.");
+  }
+  if (run.status === "completed") {
+    throw new Error("Completed runs cannot be resumed.");
+  }
+  await startLocalRun(state, input.runId, { promptOverride: input.promptOverride ?? null });
+}
+function appendRunMessage(projectRoot, input) {
+  const run = readAuthorityRun8(projectRoot, input.runId);
+  if (!run) {
+    throw new Error(`Run not found: ${input.runId}`);
+  }
+  const timelinePath = resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "timeline.jsonl");
+  const existingLines = fileExists(timelinePath) ? readFileSync3(timelinePath, "utf8").trim() : "";
+  const nextLine = JSON.stringify({
+    id: input.messageId,
+    type: "user_message",
+    text: input.text,
+    attachments: input.attachments ?? [],
+    createdAt: input.createdAt
+  });
+  writeFileSync5(timelinePath, existingLines.length > 0 ? `${existingLines}
+${nextLine}
+` : `${nextLine}
+`, "utf8");
+  writeJsonFile4(resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), {
+    ...run,
+    updatedAt: input.createdAt
+  });
+}
+async function stopRunRecord(stateOrProjectRoot, input) {
+  const projectRoot = typeof stateOrProjectRoot === "string" ? stateOrProjectRoot : stateOrProjectRoot.projectRoot;
+  const run = readAuthorityRun8(projectRoot, input.runId);
+  if (!run) {
+    throw new Error(`Run not found: ${input.runId}`);
+  }
+  if (typeof stateOrProjectRoot !== "string") {
+    const processState = stateOrProjectRoot.runProcesses.get(input.runId);
+    if (processState?.child) {
+      processState.stopped = true;
+      try {
+        processState.child.kill("SIGTERM");
+      } catch {}
+    }
+  }
+  const nextRun = {
+    ...run,
+    status: run.status === "completed" ? run.status : "stopped",
+    completedAt: run.completedAt ?? input.createdAt,
+    updatedAt: input.createdAt
+  };
+  writeJsonFile4(resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), nextRun);
+  if (run.status !== "completed" && run.taskId) {
+    const taskId = run.taskId;
+    (async () => {
+      try {
+        await updateRunTaskSourceLifecycle(projectRoot, nextRun, "cancelled", "Rig task run was stopped before completion.");
+      } catch (error) {
+        const sourceFailure = lifecycleFailureMessage(taskId, "cancelled", error);
+        patchRunRecord(projectRoot, input.runId, { errorText: sourceFailure });
+        appendRunLogEntry(projectRoot, input.runId, {
+          id: `log:${input.runId}:task-source-cancelled-update`,
+          title: "Task source cancellation update failed",
+          detail: sourceFailure,
+          tone: "error",
+          status: "failed",
+          createdAt: new Date().toISOString()
+        });
+      }
+    })();
+  }
+  enqueueRunLinearEvent(projectRoot, {
+    type: "run.interrupted",
+    runId: input.runId,
+    taskId: run.taskId,
+    timestamp: input.createdAt,
+    agent: run.runtimeAdapter,
+    summary: "Run stopped before completion"
+  });
+}
+function removeTaskIdsFromQueueState2(projectRoot, taskIds) {
+  const removedTaskIds = new Set(Array.from(taskIds).filter(Boolean));
+  if (removedTaskIds.size === 0) {
+    return readQueueState(projectRoot);
+  }
+  const next = readQueueState(projectRoot).filter((entry) => !removedTaskIds.has(entry.taskId)).map((entry, index) => ({ ...entry, position: index }));
+  writeQueueState(projectRoot, next);
+  return next;
+}
+var ORPHANABLE_LOCAL_RUN_STATUSES = new Set(["preparing", "running"]);
+function reconcileOrphanedLocalRuns(state, runs, nowIso) {
+  let changed = false;
+  for (const run of runs) {
+    const status = normalizeString(run.status)?.toLowerCase() ?? "";
+    const serverPid = run.serverPid;
+    const wasStartedByRigServer = typeof serverPid === "number" || typeof serverPid === "string";
+    if (run.mode !== "local" || !wasStartedByRigServer || !ORPHANABLE_LOCAL_RUN_STATUSES.has(status) || state.runProcesses.has(run.runId)) {
+      continue;
+    }
+    const detail = "Recovered stale local run after Rig server restart; no live child process was attached to this server instance.";
+    patchRunRecord(state.projectRoot, run.runId, {
+      status: "failed",
+      completedAt: run.completedAt ?? nowIso,
+      updatedAt: nowIso,
+      errorText: detail
+    });
+    appendRunLogEntry(state.projectRoot, run.runId, {
+      id: `log:${run.runId}:stale-local-run`,
+      title: "Run marked stale after server restart",
+      detail,
+      tone: "error",
+      status: "failed",
+      createdAt: nowIso
+    });
+    changed = true;
+  }
+  return changed;
+}
+async function reconcileScheduler(state, reason) {
+  if (state.scheduler.reconciling) {
+    state.scheduler.pending = true;
+    return;
+  }
+  state.scheduler.reconciling = true;
+  try {
+    await withServerAuthorityEnvIfNeeded(state.projectRoot, async () => {
+      do {
+        state.scheduler.pending = false;
+        const queue = readQueueState(state.projectRoot);
+        const tasks = await state.snapshotService.getWorkspaceTasks();
+        let runs = listAuthorityRuns7(state.projectRoot);
+        let changed = reconcileOrphanedLocalRuns(state, runs, new Date().toISOString());
+        if (changed) {
+          runs = listAuthorityRuns7(state.projectRoot);
+        }
+        const plan = planSchedulerWork({
+          queue,
+          tasks: tasks.map((task) => ({
+            id: task.id,
+            status: task.status,
+            priority: task.priority
+          })),
+          runs,
+          localWorkerCount: resolveLocalSchedulerWorkerCount(),
+          remoteWorkers: Array.from(state.remoteHosts.values()).map((host) => ({
+            hostId: host.hostId,
+            status: host.status,
+            currentLeaseCount: host.currentLeaseCount,
+            registeredAt: host.registeredAt,
+            runtimeAdapters: host.runtimeAdapters
+          }))
+        });
+        const claimedTaskIds = [
+          ...plan.pruneTaskIds,
+          ...plan.dispatches.map((dispatch) => dispatch.taskId)
+        ];
+        if (claimedTaskIds.length > 0) {
+          removeTaskIdsFromQueueState2(state.projectRoot, claimedTaskIds);
+        }
+        changed = changed || plan.pruneTaskIds.length > 0;
+        for (const dispatch of plan.dispatches) {
+          const task = tasks.find((entry) => entry.id === dispatch.taskId);
+          if (!task) {
+            continue;
+          }
+          const createdAt = new Date().toISOString();
+          const runId = crypto.randomUUID();
+          const remoteHost = dispatch.workerKind === "remote" ? state.remoteHosts.get(dispatch.hostId) : null;
+          const runtimeAdapter = dispatch.workerKind === "remote" ? normalizeRuntimeAdapter(remoteHost?.runtimeAdapters[0]) : normalizeRuntimeAdapter(process.env.RIG_RUNTIME_ADAPTER);
+          await createRunRecord(state.projectRoot, {
+            runId,
+            workspaceId: RIG_WORKSPACE_ID,
+            taskId: task.id,
+            title: task.title,
+            runtimeAdapter,
+            executionTarget: dispatch.workerKind === "remote" ? "remote" : "local",
+            remoteHostId: dispatch.workerKind === "remote" ? dispatch.hostId : undefined,
+            createdAt
+          }, () => state.snapshotService.getWorkspaceTasks());
+          emitRigEvent(state, {
+            type: "rig.task.run-created",
+            aggregateId: task.id,
+            payload: {
+              runId,
+              workspaceId: RIG_WORKSPACE_ID,
+              taskId: task.id
+            },
+            createdAt
+          });
+          changed = true;
+          if (dispatch.workerKind === "local") {
+            await startLocalRun(state, runId);
+          }
+        }
+        if (changed) {
+          broadcastSnapshotInvalidation(state, `scheduler:${reason}`);
+        }
+      } while (state.scheduler.pending);
+    });
+  } finally {
+    state.scheduler.reconciling = false;
+  }
+}
+export {
+  stopRunRecord,
+  startLocalRun,
+  resumeRunRecord,
+  resolveLocalRunCliProjectRoot,
+  removeTaskIdsFromQueueState2 as removeTaskIdsFromQueueState,
+  reconcileScheduler,
+  createRunRecord,
+  appendRunMessage
+};