@h-rig/server 0.0.6-alpha.13 → 0.0.6-alpha.15

package/dist/src/server.js

@@ -1074,6 +1074,18 @@ function readJsonlFileTail(path, options) {
   const completeLines = start > 0 ? lines.slice(1) : lines;
   return parseJsonlRecords(completeLines.filter(Boolean).slice(-limit));
 }
+async function readRunTimelinePage(projectRoot, runId, options = {}) {
+  const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 200), 500));
+  const cursor = options.cursor == null ? 0 : Number.parseInt(options.cursor, 10);
+  const entries = readJsonlFile(runTimelinePath(projectRoot, runId)).filter((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry)));
+  const startInclusive = Number.isFinite(cursor) ? Math.max(0, Math.min(cursor, entries.length)) : 0;
+  const endExclusive = Math.min(entries.length, startInclusive + limit);
+  return {
+    entries: entries.slice(startInclusive, endExclusive).map((entry, offset) => ({ ...entry, cursor: startInclusive + offset + 1 })),
+    nextCursor: String(endExclusive),
+    hasMore: endExclusive < entries.length
+  };
+}
 var INITIAL_RUN_LOG_TAIL_MAX_BYTES = 8 * 1024 * 1024;
 async function readRunLogsPage(projectRoot, runId, options = {}) {
   const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 200), 500));
@@ -2731,8 +2743,7 @@ function buildRunStartPatch(startedAt) {
     status: "preparing",
     startedAt,
     completedAt: null,
-    errorText: null,
-    serverPid: process.pid
+    errorText: null
   };
 }
 
@@ -3214,6 +3225,11 @@ import {
   buildTaskRunLifecycleComment,
   updateConfiguredTaskSourceTask
 } from "@rig/runtime/control-plane/tasks/source-lifecycle";
+import {
+  closeIssueAfterMergedPr,
+  commitRunChanges,
+  runPrAutomation
+} from "@rig/runtime/control-plane/native/pr-automation";
 
 // packages/server/src/scheduler.ts
 import { normalizeTaskLifecycleStatus } from "@rig/runtime/control-plane/state-sync/types";
@@ -3549,6 +3565,9 @@ function asRecord(value) {
 function asString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value : undefined;
 }
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
 async function defaultGraphQLFetch(query, variables, token) {
   const response = await fetch("https://api.github.com/graphql", {
     method: "POST",
@@ -3565,6 +3584,32 @@ async function defaultGraphQLFetch(query, variables, token) {
   }
   return json.data;
 }
+function projectNodesFrom(data) {
+  const root = asRecord(data);
+  const owner = asRecord(root?.organization) ?? asRecord(root?.user);
+  const projects = asRecord(owner?.projectsV2);
+  const nodes = projects?.nodes;
+  return Array.isArray(nodes) ? nodes : [];
+}
+async function listGitHubProjects(input) {
+  const query = `
+    query RigListProjects($owner: String!, $first: Int!) {
+      organization(login: $owner) { projectsV2(first: $first, orderBy: { field: UPDATED_AT, direction: DESC }) { nodes { id number title url } } }
+      user(login: $owner) { projectsV2(first: $first, orderBy: { field: UPDATED_AT, direction: DESC }) { nodes { id number title url } } }
+    }
+  `;
+  const fetchGraphQL = input.fetchGraphQL ?? defaultGraphQLFetch;
+  const data = await fetchGraphQL(query, { owner: input.owner, first: input.first ?? 20 }, input.token);
+  return projectNodesFrom(data).flatMap((node) => {
+    const record = asRecord(node);
+    const id = asString(record?.id);
+    const number = asNumber(record?.number);
+    const title = asString(record?.title);
+    if (!id || number === undefined || !title)
+      return [];
+    return [{ id, number, title, ...asString(record?.url) ? { url: asString(record?.url) } : {} }];
+  });
+}
 async function resolveProjectStatusField(input) {
   const query = `
     query RigProjectStatusField($projectId: ID!) {
@@ -3659,6 +3704,7 @@ var DEFAULT_PROJECT_STATUSES = {
   running: "In Progress",
   prOpen: "In Review",
   ciFixing: "In Review",
+  merging: "Merging",
   done: "Done",
   needsAttention: "Needs Attention"
 };
@@ -3672,6 +3718,8 @@ function lifecycleStatusForTaskStatus(status) {
     return "prOpen";
   if (normalized === "ci_fixing" || normalized === "fixing")
     return "ciFixing";
+  if (normalized === "merging" || normalized === "merge")
+    return "merging";
   if (normalized === "failed" || normalized === "needs_attention" || normalized === "blocked")
     return "needsAttention";
   if (normalized === "in_progress" || normalized === "running" || normalized === "ready" || normalized === "open")
@@ -3800,9 +3848,14 @@ function parseIssueRef(sourceTask, fallbackTaskId) {
     return null;
   return null;
 }
+function githubProjectsEnabled(config) {
+  const github = config?.github && typeof config.github === "object" && !Array.isArray(config.github) ? config.github : null;
+  const projects = github?.projects && typeof github.projects === "object" && !Array.isArray(github.projects) ? github.projects : null;
+  return projects?.enabled === true;
+}
 async function syncProjectStatusForRunLifecycle(projectRoot, run, status, config) {
   if (!run.taskId)
-    return;
+    return false;
   const issueNodeId = extractGitHubIssueNodeId(runSourceTaskIdentity(run));
   try {
     const result = await syncGitHubProjectStatusForTaskUpdate({
@@ -3813,28 +3866,86 @@ async function syncProjectStatusForRunLifecycle(projectRoot, run, status, config
       config
     });
     if (!result.synced && result.reason !== "project-sync-disabled") {
+      const detail = `Project status sync for ${run.taskId} could not run: ${result.reason}.`;
       appendRunLogEntry(projectRoot, run.runId, {
         id: `log:${run.runId}:github-project-sync:${status}`,
         title: "GitHub Project sync skipped",
-        detail: `Project status sync for ${run.taskId} could not run: ${result.reason}.`,
+        detail,
         tone: "warn",
         status: "running",
         createdAt: new Date().toISOString(),
         payload: { reason: result.reason, issueNodeId }
       });
+      if (githubProjectsEnabled(config)) {
+        throw new Error(detail);
+      }
+      return false;
     }
+    return result.synced === true;
   } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
     appendRunLogEntry(projectRoot, run.runId, {
       id: `log:${run.runId}:github-project-sync-error:${status}`,
       title: "GitHub Project sync failed",
-      detail: error instanceof Error ? error.message : String(error),
+      detail,
       tone: "error",
       status: "running",
       createdAt: new Date().toISOString(),
       payload: { issueNodeId }
     });
+    if (githubProjectsEnabled(config)) {
+      throw new Error(detail);
+    }
+    return false;
   }
 }
+function createCommandRunner(binary, extraEnv = {}) {
+  return async (args, options) => {
+    const child = spawn3(binary, [...args], {
+      cwd: options?.cwd,
+      env: { ...process.env, ...extraEnv },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    child.stdout?.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+    child.stderr?.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+    const exitCode = await new Promise((resolve15) => {
+      child.once("error", () => resolve15(1));
+      child.once("close", (code) => resolve15(code ?? 1));
+    });
+    return {
+      exitCode,
+      stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+      stderr: Buffer.concat(stderrChunks).toString("utf8")
+    };
+  };
+}
+function closeoutRecord(run) {
+  const value = run.serverCloseout;
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function closeoutPhasePatch(phase, status, extra = {}) {
+  const updatedAt = new Date().toISOString();
+  return {
+    serverCloseout: {
+      phase,
+      status,
+      updatedAt,
+      ...extra
+    }
+  };
+}
+function appendCloseoutStage(state, runId, phase, detail, status = "reviewing", tone = "info") {
+  appendRunLogEntryAndBroadcast(state, runId, {
+    id: `log:${runId}:server-closeout:${phase}:${Date.now()}`,
+    title: `Server closeout: ${phase}`,
+    detail,
+    tone,
+    status,
+    createdAt: new Date().toISOString()
+  }, `server-closeout-${phase}`);
+}
 async function autoAssignRunIssue(projectRoot, run) {
   if (!run.taskId)
     return;
@@ -3864,7 +3975,7 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     return;
   }
   const config = await loadRigLifecycleConfig(projectRoot);
-  await syncProjectStatusForRunLifecycle(projectRoot, run, status, config);
+  const projectSynced = await syncProjectStatusForRunLifecycle(projectRoot, run, status, config);
   if (status === "in_progress") {
     await autoAssignRunIssue(projectRoot, run);
   }
@@ -3880,24 +3991,53 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     });
     return;
   }
-  const result = await updateConfiguredTaskSourceTask(projectRoot, {
-    taskId: run.taskId,
-    sourceTask: runSourceTaskIdentity(run),
-    update: {
-      status,
-      comment: buildTaskRunLifecycleComment({
-        runId: run.runId,
+  const sourceTask = runSourceTaskIdentity(run);
+  const previousStatus = normalizeString(sourceTask?.status) ?? normalizeString(sourceTask?.sourceStatus);
+  const rollbackProjectSync = async () => {
+    if (!projectSynced || !previousStatus || !run.taskId || !githubProjectsEnabled(config))
+      return;
+    await syncGitHubProjectStatusForTaskUpdate({
+      taskId: run.taskId,
+      status: previousStatus,
+      issueNodeId: extractGitHubIssueNodeId(sourceTask),
+      token: createGitHubAuthStore(projectRoot).readToken(),
+      config
+    }).catch((rollbackError) => {
+      appendRunLogEntry(projectRoot, run.runId, {
+        id: `log:${run.runId}:github-project-sync-rollback:${status}`,
+        title: "GitHub Project sync rollback failed",
+        detail: rollbackError instanceof Error ? rollbackError.message : String(rollbackError),
+        tone: "error",
+        status: "running",
+        createdAt: new Date().toISOString()
+      });
+    });
+  };
+  let result;
+  try {
+    result = await updateConfiguredTaskSourceTask(projectRoot, {
+      taskId: run.taskId,
+      sourceTask,
+      update: {
         status,
-        summary,
-        runtimeWorkspace: normalizeString(run.worktreePath),
-        logsDir: normalizeString(run.logRoot),
-        sessionDir: normalizeString(run.sessionPath),
-        errorText: options.errorText ?? normalizeString(run.errorText)
-      })
-    }
-  });
+        comment: buildTaskRunLifecycleComment({
+          runId: run.runId,
+          status,
+          summary,
+          runtimeWorkspace: normalizeString(run.worktreePath),
+          logsDir: normalizeString(run.logRoot),
+          sessionDir: normalizeString(run.sessionPath),
+          errorText: options.errorText ?? normalizeString(run.errorText)
+        })
+      }
+    });
+  } catch (error) {
+    await rollbackProjectSync();
+    throw error;
+  }
   if (!result.updated) {
     if (result.source === "plugin" || result.sourceKind) {
+      await rollbackProjectSync();
       throw new Error(`Configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} did not accept lifecycle update for ${result.taskId}.`);
     }
     appendRunLogEntry(projectRoot, run.runId, {
@@ -3910,6 +4050,219 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     });
   }
 }
+async function runServerOwnedPrCloseout(state, runId) {
+  const run = readAuthorityRun4(state.projectRoot, runId);
+  if (!run)
+    throw new Error(`Run not found: ${runId}`);
+  const closeout = closeoutRecord(run);
+  if (!closeout)
+    return;
+  const taskId = normalizeString(closeout.taskId) ?? normalizeString(run.taskId);
+  if (!taskId)
+    throw new Error("Server-owned closeout requires a task id.");
+  const workspace = normalizeString(closeout.runtimeWorkspace) ?? normalizeString(run.worktreePath) ?? state.projectRoot;
+  const branch = normalizeString(closeout.branch) ?? `rig/${taskId}-${runId}`;
+  const config = await loadRigLifecycleConfig(state.projectRoot);
+  const runPrMode = normalizeString(run.prMode);
+  const prMode = runPrMode === "auto" || runPrMode === "ask" || runPrMode === "off" ? runPrMode : config?.pr?.mode ?? "off";
+  const effectiveConfig = {
+    ...config ?? {},
+    pr: {
+      ...config?.pr ?? {},
+      mode: prMode,
+      autoFixChecks: false,
+      autoFixReview: false
+    }
+  };
+  const readCurrentRun = () => readAuthorityRun4(state.projectRoot, runId) ?? run;
+  const sourceTask = runSourceTaskIdentity(run);
+  const closeoutPhase = normalizeString(closeout.phase)?.toLowerCase() ?? "";
+  const closeoutStatus = normalizeString(closeout.status)?.toLowerCase() ?? "";
+  const closeoutPrUrl = normalizeString(closeout.prUrl);
+  if (closeoutPhase === "completed" || closeoutStatus === "completed") {
+    return;
+  }
+  if (closeoutPhase === "close-source" && closeoutPrUrl) {
+    patchRunRecord(state.projectRoot, runId, {
+      status: "reviewing",
+      ...closeoutPhasePatch("close-source", "running", { ...closeout, prUrl: closeoutPrUrl, taskId, runtimeWorkspace: workspace, branch })
+    });
+    await closeIssueAfterMergedPr({
+      projectRoot: state.projectRoot,
+      taskId,
+      runId,
+      prUrl: closeoutPrUrl,
+      sourceTask,
+      updateTaskSource: async (projectRoot, input) => {
+        await updateRunTaskSourceLifecycle(projectRoot, readCurrentRun(), "closed", "Rig merged the pull request and closed this task source.");
+        return { updated: true, taskId: input.taskId, status: input.update.status, source: "server", sourceKind: "server" };
+      }
+    });
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { ...closeout, prUrl: closeoutPrUrl, iterations: closeout.iterations, completedAt })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR merged and issue closed: ${closeoutPrUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: closeoutPrUrl, closeout: "merged" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  if (prMode === "off" || prMode === "ask") {
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { taskId, runtimeWorkspace: workspace, branch, reason: prMode === "ask" ? "pr-mode-ask" : "pr-mode-off" })
+    });
+    appendCloseoutStage(state, runId, "completed", prMode === "ask" ? "Validation completed; PR creation awaits operator approval." : "Validation completed; PR automation disabled.", "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, closeout: "skipped", reason: prMode === "ask" ? "pr-mode-ask" : "pr-mode-off" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  const githubToken = createGitHubAuthStore(state.projectRoot).readToken();
+  const githubEnv = githubToken ? { RIG_GITHUB_TOKEN: githubToken, GITHUB_TOKEN: githubToken, GH_TOKEN: githubToken } : {};
+  const gitCommand = createCommandRunner("git", githubEnv);
+  const ghCommand = createCommandRunner("gh", githubEnv);
+  const setCloseout = (phase, status, extra = {}) => {
+    const previous = closeoutRecord(readCurrentRun()) ?? closeout;
+    patchRunRecord(state.projectRoot, runId, {
+      status: status === "failed" ? "failed" : status === "needs_attention" ? "needs_attention" : "reviewing",
+      ...closeoutPhasePatch(phase, status, { ...previous, ...extra })
+    });
+  };
+  setCloseout("commit", "running", { runtimeWorkspace: workspace, branch, taskId });
+  appendCloseoutStage(state, runId, "commit", `Committing changes in ${workspace}.`, "reviewing", "tool");
+  const commit = await commitRunChanges({ cwd: workspace, message: `rig: complete task ${taskId}`, command: gitCommand });
+  appendCloseoutStage(state, runId, "commit", commit.committed ? "Committed run workspace changes." : "No workspace changes to commit.", "reviewing", "tool");
+  setCloseout("push", "running", { runtimeWorkspace: workspace, branch, taskId });
+  const push = await gitCommand(["push", "--set-upstream", "origin", branch], { cwd: workspace });
+  if (push.exitCode !== 0) {
+    throw new Error(`git push --set-upstream origin ${branch} failed (${push.exitCode}): ${push.stderr ?? push.stdout ?? ""}`.trim());
+  }
+  const sourceTaskForPr = {
+    title: normalizeString(sourceTask?.title) ?? normalizeString(run.title)
+  };
+  const artifactRoot = resolve14(state.projectRoot, "artifacts", taskId);
+  setCloseout("pr-review-merge", "running", { runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+  const pr = await runPrAutomation({
+    projectRoot: workspace,
+    taskId,
+    runId,
+    branch,
+    config: effectiveConfig,
+    sourceTask: sourceTaskForPr,
+    artifactRoot,
+    command: ghCommand,
+    gitCommand,
+    steerPi: async (message) => {
+      appendCloseoutStage(state, runId, "feedback", message, "reviewing", "info");
+      appendRunTimelineEntry(state.projectRoot, runId, {
+        id: `message:${runId}:server-closeout-feedback:${Date.now()}`,
+        type: "user_message",
+        text: message,
+        createdAt: new Date().toISOString(),
+        state: "completed"
+      });
+    },
+    lifecycle: {
+      onPrOpened: async ({ prUrl }) => {
+        setCloseout("pr-opened", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+        appendCloseoutStage(state, runId, "open-pr", prUrl, "reviewing", "tool");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "under_review", "Rig opened a pull request for this task.");
+      },
+      onReviewCiStarted: ({ prUrl, iteration }) => appendCloseoutStage(state, runId, "review-ci", `${prUrl} (iteration ${iteration})`, "reviewing", "info"),
+      onFeedback: async ({ feedback }) => {
+        appendCloseoutStage(state, runId, "feedback", feedback.join(`
+`), "reviewing", "error");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "ci_fixing", "Rig is fixing CI/review feedback for this task.");
+      },
+      onMergeStarted: async ({ prUrl }) => {
+        setCloseout("merge", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+        appendCloseoutStage(state, runId, "merge", prUrl, "reviewing", "tool");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "merging", "Rig is merging the pull request for this task.");
+      },
+      onMerged: ({ prUrl }) => {
+        setCloseout("close-source", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot, merged: true });
+        appendCloseoutStage(state, runId, "merge", prUrl, "reviewing", "tool");
+      }
+    }
+  });
+  if (pr.status === "merged" && pr.prUrl) {
+    setCloseout("close-source", "running", { prUrl: pr.prUrl, iterations: pr.iterations });
+    await closeIssueAfterMergedPr({
+      projectRoot: state.projectRoot,
+      taskId,
+      runId,
+      prUrl: pr.prUrl,
+      sourceTask,
+      updateTaskSource: async (projectRoot, input) => {
+        await updateRunTaskSourceLifecycle(projectRoot, readCurrentRun(), "closed", "Rig merged the pull request and closed this task source.");
+        return { updated: true, taskId: input.taskId, status: input.update.status, source: "server", sourceKind: "server" };
+      }
+    });
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { prUrl: pr.prUrl, iterations: pr.iterations, completedAt })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR merged and issue closed: ${pr.prUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: pr.prUrl, closeout: "merged" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  if (pr.status === "opened" && pr.prUrl) {
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { prUrl: pr.prUrl, iterations: pr.iterations })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR ready without merge: ${pr.prUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: pr.prUrl, closeout: "pr-ready" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  const detail = pr.actionableFeedback.join(`
+`) || "PR automation did not merge the PR.";
+  await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "needs_attention", "Rig needs operator attention before this task can proceed.", { errorText: detail }).catch((error) => {
+    appendCloseoutStage(state, runId, "needs-attention-update", error instanceof Error ? error.message : String(error), "needs_attention", "error");
+  });
+  patchRunRecord(state.projectRoot, runId, {
+    status: "needs_attention",
+    completedAt: new Date().toISOString(),
+    errorText: detail,
+    ...closeoutPhasePatch("needs_attention", "needs_attention", { feedback: pr.actionableFeedback, prUrl: pr.prUrl ?? null, iterations: pr.iterations })
+  });
+  appendCloseoutStage(state, runId, "needs-attention", detail, "needs_attention", "error");
+  emitRigEvent(state, {
+    type: "rig.run.needs-attention",
+    aggregateId: runId,
+    payload: { runId, taskId, error: detail, prUrl: pr.prUrl ?? null }
+  });
+}
 var TERMINAL_RUN_STATUSES2 = new Set([
   "completed",
   "complete",
@@ -4118,6 +4471,7 @@ async function startLocalRun(state, runId, options) {
           RIG_HOST_PROJECT_ROOT: cliProjectRoot,
           RIG_RUNTIME_BASE_REF: process.env.RIG_RUNTIME_BASE_REF ?? "HEAD",
           RIG_SERVER_INTERNAL_EXEC: "1",
+          RIG_SERVER_OWNS_CLOSEOUT: "1",
           ...serverUrl ? { RIG_SERVER_URL: serverUrl } : {},
           ...bridgeAuthToken ? { RIG_AUTH_TOKEN: bridgeAuthToken } : {},
           ...bridgeGitHubToken ? {
@@ -4214,6 +4568,38 @@ ${sourceFailure}` });
             agent: current.runtimeAdapter,
             summary: failureSummary
           });
+        } else if (closeoutRecord(current)?.status === "pending") {
+          try {
+            await runServerOwnedPrCloseout(state, runId);
+          } catch (closeoutError) {
+            const closeoutFailure = closeoutError instanceof Error ? closeoutError.message : String(closeoutError);
+            patchRunRecord(state.projectRoot, runId, {
+              status: "failed",
+              completedAt: new Date().toISOString(),
+              errorText: closeoutFailure,
+              ...closeoutPhasePatch("failed", "failed", { error: closeoutFailure })
+            });
+            appendRunLogEntryAndBroadcast(state, runId, {
+              id: `log:${runId}:server-closeout-failed`,
+              title: "Server-owned closeout failed",
+              detail: closeoutFailure,
+              tone: "error",
+              status: "failed",
+              createdAt: new Date().toISOString()
+            }, "server-closeout-failed");
+            if (current.taskId) {
+              await updateRunTaskSourceLifecycle(state.projectRoot, { ...current, status: "failed", errorText: closeoutFailure }, "failed", "Rig server-owned closeout failed.", { errorText: closeoutFailure }).catch((error) => {
+                appendRunLogEntry(state.projectRoot, runId, {
+                  id: `log:${runId}:task-source-closeout-failed-update`,
+                  title: "Task source closeout failure update failed",
+                  detail: error instanceof Error ? error.message : String(error),
+                  tone: "error",
+                  status: "failed",
+                  createdAt: new Date().toISOString()
+                });
+              });
+            }
+          }
         }
         broadcastSnapshotInvalidation(state);
       } catch (error) {
@@ -4300,6 +4686,12 @@ async function resumeRunRecord(state, input) {
   if (run.status === "completed") {
     throw new Error("Completed runs cannot be resumed.");
   }
+  const closeout = closeoutRecord(run);
+  const closeoutStatus = normalizeString(closeout?.status)?.toLowerCase() ?? "";
+  if (RESUMABLE_SERVER_CLOSEOUT_STATUSES.has(closeoutStatus)) {
+    await runServerOwnedPrCloseout(state, input.runId);
+    return;
+  }
   await startLocalRun(state, input.runId, { promptOverride: input.promptOverride ?? null, resume: input.restart !== true });
 }
 function appendRunMessage(projectRoot, input) {
@@ -4384,11 +4776,45 @@ function removeTaskIdsFromQueueState(projectRoot, taskIds) {
   writeQueueState(projectRoot, next);
   return next;
 }
-var RESUMABLE_LOCAL_RUN_STATUSES = new Set(["created", "preparing", "running", "validating", "reviewing"]);
-function collectResumableLocalRuns(state, runs) {
+var RESUMABLE_SERVER_CLOSEOUT_STATUSES = new Set(["pending", "running"]);
+var ACTIVE_LOCAL_RUN_STATUSES = new Set(["created", "preparing", "running", "validating", "reviewing"]);
+function processExists(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function recoverStaleLocalRun(projectRoot, run) {
+  const record = run;
+  if (run.mode !== "local")
+    return false;
+  const status = normalizeString(record.status)?.toLowerCase() ?? "";
+  if (!ACTIVE_LOCAL_RUN_STATUSES.has(status))
+    return false;
+  const serverPid = typeof record.serverPid === "number" ? record.serverPid : null;
+  const childPid = typeof record.pid === "number" ? record.pid : null;
+  if (serverPid === null && childPid === null)
+    return false;
+  const hasLiveRecordedProcess = [serverPid, childPid].some((pid) => typeof pid === "number" && processExists(pid));
+  if (hasLiveRecordedProcess && serverPid === process.pid)
+    return false;
+  const completedAt = new Date().toISOString();
+  patchRunRecord(projectRoot, run.runId, {
+    status: "failed",
+    completedAt,
+    errorText: `Recovered stale local run ${run.runId} after server startup; no active server-owned process was tracking it.`
+  });
+  return true;
+}
+function collectResumableServerCloseouts(state, runs) {
   return runs.filter((run) => {
-    const status = normalizeString(run.status)?.toLowerCase() ?? "";
-    return run.mode === "local" && RESUMABLE_LOCAL_RUN_STATUSES.has(status) && !state.runProcesses.has(run.runId);
+    const closeout = closeoutRecord(run);
+    const closeoutStatus = normalizeString(closeout?.status)?.toLowerCase() ?? "";
+    return run.mode === "local" && RESUMABLE_SERVER_CLOSEOUT_STATUSES.has(closeoutStatus) && !state.runProcesses.has(run.runId);
   });
 }
 async function reconcileScheduler(state, reason) {
@@ -4405,17 +4831,33 @@ async function reconcileScheduler(state, reason) {
         const tasks = await state.snapshotService.getWorkspaceTasks();
         let runs = listAuthorityRuns4(state.projectRoot);
         let changed = false;
-        const resumableRuns = collectResumableLocalRuns(state, runs);
-        for (const run of resumableRuns) {
+        for (const run of runs) {
+          if (!state.runProcesses.has(run.runId) && recoverStaleLocalRun(state.projectRoot, run)) {
+            changed = true;
+          }
+        }
+        if (changed) {
+          runs = listAuthorityRuns4(state.projectRoot);
+        }
+        const resumableCloseouts = collectResumableServerCloseouts(state, runs);
+        for (const run of resumableCloseouts) {
           appendRunLogEntry(state.projectRoot, run.runId, {
-            id: `log:${run.runId}:auto-resume:${Date.now()}`,
-            title: "Run auto-resume scheduled",
-            detail: `Rig server recovered nonterminal run ${run.runId} after ${reason}; resuming the same lifecycle instead of restarting it.`,
+            id: `log:${run.runId}:server-closeout-auto-resume:${Date.now()}`,
+            title: "Server-owned closeout auto-resume scheduled",
+            detail: `Rig server recovered closeout checkpoint ${run.runId} after ${reason}; resuming the server-owned lifecycle phase.`,
             tone: "info",
-            status: "preparing",
+            status: "reviewing",
             createdAt: new Date().toISOString()
           });
-          await startLocalRun(state, run.runId, { resume: true });
+          await runServerOwnedPrCloseout(state, run.runId).catch((error) => {
+            const detail = error instanceof Error ? error.message : String(error);
+            patchRunRecord(state.projectRoot, run.runId, {
+              status: "failed",
+              completedAt: new Date().toISOString(),
+              errorText: detail,
+              ...closeoutPhasePatch("failed", "failed", { error: detail })
+            });
+          });
           changed = true;
         }
         if (changed) {
@@ -5211,6 +5653,75 @@ function buildProjectConfigStatus(root) {
     suggestion: kind === "missing" ? "Run `rig init` in the project root to scaffold rig.config.ts." : null
   };
 }
+var RIG_GITHUB_LIFECYCLE_LABELS = [
+  "ready",
+  "blocked",
+  "in-progress",
+  "under-review",
+  "failed",
+  "cancelled",
+  "rig:running",
+  "rig:pr-open",
+  "rig:ci-fixing",
+  "rig:merging",
+  "rig:done",
+  "rig:needs-attention"
+];
+function githubProjectsEnabled2(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config))
+    return false;
+  const root = config;
+  const github = root.github && typeof root.github === "object" && !Array.isArray(root.github) ? root.github : null;
+  const projects = github?.projects && typeof github.projects === "object" && !Array.isArray(github.projects) ? github.projects : null;
+  return projects?.enabled === true;
+}
+function githubIssueSourceRepo(config) {
+  if (!config || typeof config !== "object" || Array.isArray(config))
+    return null;
+  const root = config;
+  const taskSource = root.taskSource && typeof root.taskSource === "object" && !Array.isArray(root.taskSource) ? root.taskSource : null;
+  const owner = normalizeString(taskSource?.owner);
+  const repo = normalizeString(taskSource?.repo);
+  if (taskSource?.kind === "github-issues" && owner && repo)
+    return { owner, repo };
+  const project = root.project && typeof root.project === "object" && !Array.isArray(root.project) ? root.project : null;
+  const slug = normalizeString(project?.repo) ?? normalizeString(project?.name);
+  const match = slug?.match(/^([^/]+)\/([^/]+)$/);
+  return match ? { owner: match[1], repo: match[2] } : null;
+}
+async function ensureGitHubLifecycleLabels(projectRoot, config) {
+  const repo = githubIssueSourceRepo(config);
+  if (!repo)
+    return { ok: false, ready: false, labelsReady: false, reason: "not-github-issues-source", labels: RIG_GITHUB_LIFECYCLE_LABELS };
+  const token = createGitHubAuthStore(projectRoot).readToken();
+  if (!token)
+    return { ok: false, ready: false, labelsReady: false, reason: "missing-token", repo, labels: RIG_GITHUB_LIFECYCLE_LABELS };
+  const existingResponse = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/labels?per_page=100`, {
+    headers: { accept: "application/vnd.github+json", authorization: `Bearer ${token}`, "user-agent": "rig-server" }
+  });
+  const existingJson = await existingResponse.json().catch(() => []);
+  const existing = new Set(Array.isArray(existingJson) ? existingJson.flatMap((entry) => entry && typeof entry === "object" && typeof entry.name === "string" ? [entry.name] : []) : []);
+  const created = [];
+  const alreadyPresent = [];
+  const failed = [];
+  for (const label of RIG_GITHUB_LIFECYCLE_LABELS) {
+    if (existing.has(label)) {
+      alreadyPresent.push(label);
+      continue;
+    }
+    const response = await fetch(`https://api.github.com/repos/${repo.owner}/${repo.repo}/labels`, {
+      method: "POST",
+      headers: { accept: "application/vnd.github+json", authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "rig-server" },
+      body: JSON.stringify({ name: label, color: label.startsWith("rig:") ? "6f42c1" : "ededed", description: label.startsWith("rig:") ? "Task status managed by Rig" : "Task lifecycle status managed by Rig" })
+    });
+    if (response.ok || response.status === 422) {
+      (response.status === 422 ? alreadyPresent : created).push(label);
+    } else {
+      failed.push({ label, error: await response.text().catch(() => response.statusText) });
+    }
+  }
+  return { ok: failed.length === 0, ready: failed.length === 0, labelsReady: failed.length === 0, repo, labels: RIG_GITHUB_LIFECYCLE_LABELS, created, existing: alreadyPresent, failed };
+}
 function normalizeCommit(value) {
   const raw = normalizeString(value);
   return raw && /^[0-9a-f]{7,40}$/i.test(raw) ? raw : null;
@@ -5609,15 +6120,33 @@ say "Installing @h-rig/cli@latest"
 bun add -g @h-rig/cli@latest
 
 export BUN_INSTALL="\${BUN_INSTALL:-$HOME/.bun}"
-export PATH="$BUN_INSTALL/bin:$PATH"
+BUN_RIG="$BUN_INSTALL/bin/rig"
+if [ ! -x "$BUN_RIG" ]; then
+  printf 'rig-install: expected Bun global rig at %s but it was not executable.
+' "$BUN_RIG" >&2
+  exit 1
+fi
+
+USER_BIN="$HOME/.local/bin"
+mkdir -p "$USER_BIN"
+cat > "$USER_BIN/rig" <<'RIG_SHIM'
+#!/usr/bin/env bash
+set -euo pipefail
+exec "\${BUN_INSTALL:-$HOME/.bun}/bin/rig" "$@"
+RIG_SHIM
+chmod +x "$USER_BIN/rig"
+
+export PATH="$USER_BIN:$BUN_INSTALL/bin:$PATH"
+if command -v hash >/dev/null 2>&1; then hash -r; fi
 
 if ! command -v rig >/dev/null 2>&1; then
-  printf 'rig-install: rig installed, but rig is not on PATH. Add %s/bin to PATH and retry.
-' "$BUN_INSTALL" >&2
+  printf 'rig-install: rig installed, but rig is not on PATH. Add %s and %s/bin to PATH and retry.
+' "$USER_BIN" "$BUN_INSTALL" >&2
   exit 1
 fi
 
 say "Verifying rig"
+"$BUN_RIG" --help >/dev/null
 rig --help >/dev/null
 say "Done. Run: rig --help"
 `;
@@ -6356,16 +6885,12 @@ data: ${JSON.stringify({ connectedAt: new Date().toISOString() })}
           if (!source) {
             return deps.badRequest("No task source is configured");
           }
+          if (!source.updateTask && !(update.status && source.updateStatus)) {
+            return deps.badRequest("Configured task source does not support updates");
+          }
           const taskBeforeUpdate = source.get ? await source.get(id).catch(() => {
             return;
           }) : (await deps.snapshotService.getWorkspaceTasks().catch(() => [])).find((task) => task.id === id);
-          if (source.updateTask) {
-            await source.updateTask(id, update);
-          } else if (update.status && source.updateStatus) {
-            await source.updateStatus(id, update.status);
-          } else {
-            return deps.badRequest("Configured task source does not support updates");
-          }
           const issueNodeId = normalizeString(body.issueNodeId) ?? extractGitHubIssueNodeId(taskBeforeUpdate);
           const projectSync = update.status ? await syncGitHubProjectStatusForTaskUpdate({
             taskId: id,
@@ -6374,6 +6899,35 @@ data: ${JSON.stringify({ connectedAt: new Date().toISOString() })}
             token: createGitHubAuthStore(state.projectRoot).readToken(),
             config: ctx?.config
           }).catch((error) => ({ synced: false, reason: `error:${error instanceof Error ? error.message : String(error)}` })) : { synced: false, reason: "missing-status" };
+          if (update.status && githubProjectsEnabled2(ctx?.config) && projectSync.synced === false) {
+            return deps.jsonResponse({ ok: false, id, projectSync, error: `GitHub Project status sync failed: ${String(projectSync.reason)}` }, 502);
+          }
+          try {
+            if (source.updateTask) {
+              await source.updateTask(id, update);
+            } else if (update.status && source.updateStatus) {
+              await source.updateStatus(id, update.status);
+            }
+          } catch (error) {
+            let rollback = null;
+            const previousStatus = normalizeString(taskBeforeUpdate?.status) ?? normalizeString(taskBeforeUpdate?.sourceStatus);
+            if (update.status && previousStatus && githubProjectsEnabled2(ctx?.config) && projectSync.synced !== false) {
+              rollback = await syncGitHubProjectStatusForTaskUpdate({
+                taskId: id,
+                status: previousStatus,
+                issueNodeId,
+                token: createGitHubAuthStore(state.projectRoot).readToken(),
+                config: ctx?.config
+              }).catch((rollbackError) => ({ synced: false, reason: `rollback-error:${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}` }));
+            }
+            return deps.jsonResponse({
+              ok: false,
+              id,
+              projectSync,
+              rollback,
+              error: `Task source update failed: ${error instanceof Error ? error.message : String(error)}`
+            }, 502);
+          }
           deps.snapshotService.invalidate("github-issue-updated");
           await state.taskProjectionReconciler?.tick("github-issue-updated").catch(() => {
             return;
@@ -6382,26 +6936,41 @@ data: ${JSON.stringify({ connectedAt: new Date().toISOString() })}
           return deps.jsonResponse({ ok: true, id, projectSync });
         }
         if (url.pathname === "/api/workspace/task-labels") {
+          const ctx = await getCachedPluginHostContext(state.projectRoot).catch(() => null);
+          if (url.searchParams.get("ensure") === "1" || req.method === "POST") {
+            return deps.jsonResponse(await ensureGitHubLifecycleLabels(state.projectRoot, ctx?.config));
+          }
           return deps.jsonResponse({
             ok: true,
             ready: true,
             labelsReady: true,
-            labels: [
-              "ready",
-              "blocked",
-              "in-progress",
-              "under-review",
-              "failed",
-              "cancelled",
-              "rig:running",
-              "rig:pr-open",
-              "rig:ci-fixing",
-              "rig:done",
-              "rig:needs-attention"
-            ],
-            note: "GitHub issue lifecycle labels are created on demand by the configured task source when supported."
+            labels: [...RIG_GITHUB_LIFECYCLE_LABELS],
+            note: "Lifecycle labels are required during init; call POST /api/workspace/task-labels or ?ensure=1 to proactively create them."
           });
         }
+        if (url.pathname === "/api/github/projects" && req.method === "GET") {
+          const owner = normalizeString(url.searchParams.get("owner"));
+          if (!owner)
+            return deps.badRequest("owner is required");
+          const token = createGitHubAuthStore(state.projectRoot).readToken();
+          if (!token)
+            return deps.jsonResponse({ ok: false, error: "missing-token", projects: [] }, 401);
+          const projects = await listGitHubProjects({ owner, token }).catch((error) => {
+            throw new Error(error instanceof Error ? error.message : String(error));
+          });
+          return deps.jsonResponse({ ok: true, projects });
+        }
+        const projectStatusMatch = url.pathname.match(/^\/api\/github\/projects\/([^/]+)\/status-field$/);
+        if (projectStatusMatch && req.method === "GET") {
+          const projectId = decodeURIComponent(projectStatusMatch[1]);
+          const token = createGitHubAuthStore(state.projectRoot).readToken();
+          if (!token)
+            return deps.jsonResponse({ ok: false, error: "missing-token" }, 401);
+          const field = await resolveProjectStatusField({ projectId, token }).catch((error) => {
+            throw new Error(error instanceof Error ? error.message : String(error));
+          });
+          return deps.jsonResponse({ ok: true, field });
+        }
         if (url.pathname === "/api/workspace/issue-analysis/run" && req.method === "POST") {
           const body = await deps.readJsonBody(req);
           const ids = uniqueStringList(body.ids ?? body.id);
@@ -7566,6 +8135,69 @@ data: ${JSON.stringify({ connectedAt: new Date().toISOString() })}
           }
           const run = leaseValidation.run;
           const completedAt = new Date().toISOString();
+          const workspaceDir = normalizeString(body.workspaceDir) ?? normalizeString(body.runtimeWorkspace) ?? normalizeString(run.worktreePath);
+          if (run.taskId && workspaceDir) {
+            patchRunRecord(state.projectRoot, runId, {
+              status: "reviewing",
+              completedAt: null,
+              hostId,
+              endpointId: leaseId,
+              worktreePath: workspaceDir,
+              serverCloseout: {
+                status: "pending",
+                phase: "queued",
+                requestedAt: completedAt,
+                updatedAt: completedAt,
+                runtimeWorkspace: workspaceDir,
+                branch: normalizeString(body.branch) ?? normalizeString(run.branch) ?? `rig/${run.taskId}-${runId}`,
+                taskId: run.taskId,
+                source: "remote-complete"
+              }
+            });
+            deps.appendRunLogEntryAndBroadcast(state, runId, {
+              id: `log:${runId}:remote-server-closeout-requested`,
+              title: "Server-owned closeout requested",
+              detail: "Remote run completed provider work and handed commit/PR/review/merge closeout to the Rig server.",
+              tone: "info",
+              status: "reviewing",
+              createdAt: completedAt,
+              payload: { workspaceDir, hostId, leaseId }
+            }, "remote-server-closeout-requested");
+            deps.runServerOwnedPrCloseout(state, runId).catch((error) => {
+              const detail = error instanceof Error ? error.message : String(error);
+              patchRunRecord(state.projectRoot, runId, {
+                status: "failed",
+                completedAt: new Date().toISOString(),
+                errorText: detail,
+                serverCloseout: {
+                  status: "failed",
+                  phase: "failed",
+                  updatedAt: new Date().toISOString(),
+                  error: detail
+                }
+              });
+              deps.appendRunLogEntryAndBroadcast(state, runId, {
+                id: `log:${runId}:remote-server-closeout-failed`,
+                title: "Server-owned closeout failed",
+                detail,
+                tone: "error",
+                status: "failed",
+                createdAt: new Date().toISOString()
+              }, "remote-server-closeout-failed");
+            }).finally(() => {
+              deps.reconcileScheduler(state, "remote-server-closeout-terminal");
+            });
+            deps.broadcastSnapshotInvalidation(state);
+            return deps.jsonResponse({
+              ok: true,
+              workspaceId: normalizeString(body.workspaceId) ?? RIG_WORKSPACE_ID,
+              hostId,
+              runId,
+              leaseId,
+              closeout: "server-owned",
+              acceptedAt: new Date().toISOString()
+            });
+          }
           patchRunRecord(state.projectRoot, runId, {
             status: "completed",
             completedAt,
@@ -7708,6 +8340,14 @@ data: ${JSON.stringify({ connectedAt: new Date().toISOString() })}
           const page = await readRunLogsPage(state.projectRoot, runId, { limit, cursor });
           return deps.jsonResponse(page);
         }
+        const runTimelineMatch = url.pathname.match(/^\/api\/runs\/([^/]+)\/timeline$/);
+        if (runTimelineMatch) {
+          const runId = decodeURIComponent(runTimelineMatch[1]);
+          const limit = Number.parseInt(url.searchParams.get("limit") || "500", 10);
+          const cursor = normalizeString(url.searchParams.get("cursor"));
+          const page = await readRunTimelinePage(state.projectRoot, runId, { limit, cursor });
+          return deps.jsonResponse(page);
+        }
         const runSteerMatch = url.pathname.match(/^\/api\/runs\/([^/]+)\/steer$/);
         if (runSteerMatch && req.method === "POST") {
           const runId = decodeURIComponent(runSteerMatch[1]);
@@ -12924,6 +13564,7 @@ function buildHttpRouterDeps(state) {
     startLocalRun,
     stopRunRecord,
     resumeRunRecord,
+    runServerOwnedPrCloseout,
     claimRemoteRun,
     listRemoteRunArtifacts,
     broadcastSnapshotInvalidation,