@h-rig/task-sources-plugin 0.0.6-alpha.156 → 0.0.6-alpha.158

package/dist/src/control-plane/native/validator.js

@@ -0,0 +1,979 @@
+// @bun
+// packages/task-sources-plugin/src/control-plane/native/validator.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve7 } from "path";
+import { assertPathInsideRoot as assertPathInsideRoot2, safePathSegment as safePathSegment2 } from "@rig/core/safe-identifiers";
+import { resolveMonorepoRoot } from "@rig/core/layout";
+
+// packages/task-sources-plugin/src/control-plane/native/task-state.ts
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
+import { basename, resolve as resolve2 } from "path";
+import { assertPathInsideRoot, safePathSegment } from "@rig/core/safe-identifiers";
+import { loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+
+// packages/task-sources-plugin/src/control-plane/state-sync/types.ts
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+// packages/task-sources-plugin/src/control-plane/native/native-git.ts
+import { tmpdir } from "os";
+import { dirname, isAbsolute, resolve } from "path";
+var taskSourcesGitNativeOutputDir = resolve(tmpdir(), "rig-task-sources-native");
+var taskSourcesGitNativeOutputPath = resolve(taskSourcesGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/task-sources-plugin/src/control-plane/native/utils.ts
+import { getScopeRules } from "@rig/core/scope-rules";
+import { unique } from "@rig/core/exec";
+import {
+  runCapture,
+  runCaptureAsync,
+  runInherit,
+  getValidationTimeoutMs,
+  readJsonFile,
+  nowIso,
+  unique as unique2,
+  fileLines
+} from "@rig/core/exec";
+import { resolveCheckoutRoot } from "@rig/core/checkout-root";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+var scopeRegexCache = new Map;
+
+// packages/task-sources-plugin/src/control-plane/state-sync/read.ts
+import { RUNTIME_CONTEXT_ENV } from "@rig/core/runtime-context";
+
+// packages/task-sources-plugin/src/control-plane/state-sync/repo.ts
+import { MANAGED_REPO_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { getInstalledCapability } from "@rig/core/capability-loaders";
+// packages/task-sources-plugin/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/task-sources-plugin/src/control-plane/native/task-state.ts
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readValidationDescriptions(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return readValidationDescriptionMap(raw);
+}
+function readValidationDescriptionMap(raw) {
+  return {
+    ...coerceValidationDescriptions(raw.validation_descriptions),
+    ...coerceValidationDescriptions(readValidationDescriptionsFromMeta(raw._meta))
+  };
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve2(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve2(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve2(resolveCheckoutRoot(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-lifecycle.ts
+import { resolvePluginHost } from "@rig/core/project-plugins";
+import { setScopeRules } from "@rig/core/scope-rules";
+
+// packages/task-sources-plugin/src/control-plane/task-source-bootstrap.ts
+import { buildTaskSourceRegistry } from "@rig/core/plugin-host-registries";
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename2, join, resolve as resolve4 } from "path";
+
+// packages/task-sources-plugin/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve3 } from "path";
+import { findTaskById } from "@rig/core/task-record-reader";
+
+class LegacyTaskConfigReadError extends Error {
+  code = "LEGACY_TASK_CONFIG_READ_FAILED";
+  projectRoot;
+  configPath;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "LegacyTaskConfigReadError";
+    this.projectRoot = input.projectRoot;
+    this.configPath = input.configPath;
+    this.cause = input.cause;
+  }
+}
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve3(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
+  };
+  return reader;
+}
+function readLegacyTaskRecords(projectRoot, configPath = resolve3(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync2(configPath)) {
+    return [];
+  }
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+}
+function readLegacyTaskConfigJson(projectRoot, configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync2(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
+    }
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
+  }
+}
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
+  }
+  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  return {
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
+  };
+}
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
+    }
+  }
+  return preserved;
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
+  }
+  return candidate.filter((value) => typeof value === "string");
+}
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/task-sources-plugin/src/control-plane/native/github-token-env.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function authStateToken(env = process.env) {
+  const file = env.RIG_GITHUB_AUTH_STATE_FILE?.trim();
+  if (!file || !existsSync3(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync3(file, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve4(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
+    }
+  };
+}
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
+  }
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
+    }
+  }
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve4(projectRoot, "rig.config.json");
+  if (existsSync4(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync4(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve4(projectRoot, "rig.config.ts");
+  if (!existsSync4(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync4(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
+  }
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync4(configPath)) {
+    return null;
+  }
+  const parsed = JSON.parse(readFileSync4(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve4(projectRoot, sourcePath);
+  if (!existsSync4(directory)) {
+    return [];
+  }
+  const tasks = [];
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const inferredId = basename2(name).replace(FILE_TASK_PATTERN, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
+  }
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve4(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
+  }
+  const raw = JSON.parse(readFileSync4(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
+  }
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
+}
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync4(directory)) {
+    return null;
+  }
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = join(directory, name);
+    try {
+      if (!statSync2(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync4(file, "utf8"));
+      const inferredId = basename2(file).replace(FILE_TASK_PATTERN, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
+      }
+    } catch {}
+  }
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
+  }
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
+  }
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+}
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || authStateToken(process.env) || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+}
+function ghSpawnOptions() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function tokenDiagnostic(value) {
+  const clean = value?.trim() ?? "";
+  return clean ? `present(len=${clean.length})` : "missing";
+}
+function runGh(bin, args, spawnFn) {
+  const options = ghSpawnOptions();
+  const res = spawnFn(bin, [...args], options);
+  assertGhSuccess(args, res, options.env);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
+  }
+  return JSON.parse(res.stdout);
+}
+function assertGhSuccess(args, res, env) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+  }
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}
+[rig gh env:source-aware] GH_TOKEN=${tokenDiagnostic(env.GH_TOKEN)} GITHUB_TOKEN=${tokenDiagnostic(env.GITHUB_TOKEN)} RIG_GITHUB_TOKEN=${tokenDiagnostic(env.RIG_GITHUB_TOKEN)}`);
+  }
+}
+function parseDeps(body) {
+  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
+}
+function parseParents(body) {
+  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
+}
+function parseIssueRefs(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
+}
+function issueTypeFor(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
+}
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-lifecycle.ts
+async function resolveTaskSourceContext(projectRoot) {
+  let resolved;
+  try {
+    resolved = await resolvePluginHost(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config"))
+      return null;
+    throw err;
+  }
+  const { config, host } = resolved;
+  setScopeRules(config.workspace.scopeNormalization);
+  return {
+    taskSourceRegistry: buildTaskSourceRegistry(config, host, { projectRoot })
+  };
+}
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+}
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await resolveTaskSourceContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+  }
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
+}
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+
+// packages/task-sources-plugin/src/control-plane/native/validator-binaries.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, rmSync as rmSync2, statSync as statSync3 } from "fs";
+import { dirname as dirname3, resolve as resolve6 } from "path";
+import { runtimeProvisioningEnv } from "@rig/core/runtime-provisioning-env";
+import { resolveBunBinaryPath } from "@rig/core/runtime-paths";
+
+// packages/task-sources-plugin/src/control-plane/native/runtime-binary-build.ts
+import { chmodSync, existsSync as existsSync5, mkdirSync, renameSync, rmSync } from "fs";
+import { basename as basename3, dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve5 } from "path";
+var runtimeBinaryBuildQueue = Promise.resolve();
+async function buildRuntimeBinary(options) {
+  await runSerializedRuntimeBinaryBuild(async () => {
+    const entrypoint = isAbsolute2(options.sourcePath) ? options.sourcePath : resolve5(options.cwd, options.sourcePath);
+    const outputPath = resolve5(options.outputPath);
+    const tempBuildDir = resolve5(dirname2(outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    const tempOutputPath = resolve5(tempBuildDir, basename3(outputPath));
+    mkdirSync(tempBuildDir, { recursive: true });
+    await withTemporaryEnv({
+      ...options.env,
+      ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+    }, async () => withTemporaryCwd(tempBuildDir, async () => {
+      const buildResult = await Bun.build({
+        entrypoints: [entrypoint],
+        compile: {
+          target: currentCompileTarget(),
+          outfile: tempOutputPath
+        },
+        target: "bun",
+        format: "esm",
+        minify: true,
+        bytecode: true,
+        ...options.external ? { external: options.external } : {},
+        ...options.define ? { define: { __RIG_BUILD_CONFIG__: JSON.stringify(options.define) } } : {}
+      });
+      if (!buildResult.success) {
+        const details = buildResult.logs.map((log) => [
+          log.message,
+          log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""
+        ].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+        throw new Error(`Failed to build ${entrypoint}: ${details || "Bun.build() returned errors"}`);
+      }
+      if (!existsSync5(tempOutputPath)) {
+        const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+        throw new Error(`Failed to build ${entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+      }
+      renameSync(tempOutputPath, outputPath);
+      chmodSync(outputPath, 493);
+    })).finally(() => {
+      rmSync(tempBuildDir, { recursive: true, force: true });
+    });
+  });
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolveRelease) => {
+    release = resolveRelease;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+
+// packages/task-sources-plugin/src/control-plane/native/validator-binaries.ts
+function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
+  if (runtimeContext) {
+    return resolve6(runtimeContext.binDir, "validators", binaryName);
+  }
+  return resolve6(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+}
+async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
+  const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
+  if (!match) {
+    return null;
+  }
+  const category = match[1];
+  const check = match[2];
+  if (!category || !check) {
+    return null;
+  }
+  const binaryName = `${category}-${check}`;
+  const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
+  const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
+  const sourcePath = resolve6(hostProjectRoot, "packages/validator-kit/src/validators", category, `${check}.ts`);
+  if (!existsSync6(sourcePath)) {
+    return null;
+  }
+  const sourceMtime = statSync3(sourcePath).mtimeMs;
+  const binaryExists = existsSync6(binaryPath);
+  const binaryMtime = binaryExists ? statSync3(binaryPath).mtimeMs : 0;
+  if (!binaryExists || sourceMtime > binaryMtime) {
+    if (binaryExists) {
+      rmSync2(binaryPath, { force: true });
+      rmSync2(`${binaryPath}.build-manifest.json`, { force: true });
+    }
+    mkdirSync2(dirname3(binaryPath), { recursive: true });
+    await buildRuntimeBinary({
+      sourcePath: `packages/validator-kit/src/validators/${category}/${check}.ts`,
+      outputPath: binaryPath,
+      cwd: hostProjectRoot,
+      define: { AGENT_BUN_PATH: resolveBunBinaryPath() },
+      env: runtimeProvisioningEnv()
+    });
+  }
+  return existsSync6(binaryPath) ? binaryPath : null;
+}
+
+// packages/task-sources-plugin/src/control-plane/native/validator.ts
+import { createValidatorRegistry } from "@rig/validator-kit";
+function isCheckId(entry) {
+  return /^[a-z][\w-]*:[a-z][\w-]*$/.test(entry);
+}
+function stringArray(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((entry) => typeof entry === "string") : [];
+}
+function safeReadTaskConfig(projectRoot) {
+  try {
+    return readTaskConfig(projectRoot);
+  } catch {
+    return {};
+  }
+}
+async function readTaskSourceValidation(projectRoot, taskId) {
+  const sourceTask = await readConfiguredTaskSourceTask(projectRoot, taskId).then((result) => result.task).catch(() => null);
+  if (!sourceTask) {
+    return { validation: [], scope: [], taskConfig: undefined };
+  }
+  const record = sourceTask;
+  const validation = stringArray(record.validation).length > 0 ? stringArray(record.validation) : stringArray(record.validators);
+  return {
+    validation,
+    scope: stringArray(record.scope),
+    taskConfig: {
+      ...typeof record.role === "string" ? { role: record.role } : {},
+      ...stringArray(record.scope).length > 0 ? { scope: stringArray(record.scope) } : {},
+      ...validation.length > 0 ? { validation } : {}
+    }
+  };
+}
+function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
+  const taskSegment = safePathSegment2(taskId, { fallback: "task", maxLength: 96 });
+  if (runtimeContext) {
+    const runtimeArtifactsRoot = resolve7(runtimeContext.workspaceDir, "artifacts");
+    return {
+      taskLogDir: assertPathInsideRoot2(runtimeContext.logsDir, resolve7(runtimeContext.logsDir, taskSegment), "validation log directory"),
+      artifactDir: assertPathInsideRoot2(runtimeArtifactsRoot, resolve7(runtimeArtifactsRoot, taskSegment), "validation artifact directory")
+    };
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  return {
+    taskLogDir: assertPathInsideRoot2(paths.logsDir, resolve7(paths.logsDir, taskSegment), "validation log directory"),
+    artifactDir: assertPathInsideRoot2(paths.artifactsDir, resolve7(paths.artifactsDir, taskSegment), "validation artifact directory")
+  };
+}
+async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
+  const binaryName = checkId.replace(":", "-");
+  const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
+  if (!existsSync7(binaryPath)) {
+    return {
+      result: {
+        id: checkId,
+        passed: false,
+        summary: `Validator binary not found: ${binaryPath}`
+      },
+      exitCode: 2
+    };
+  }
+  const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
+  const runtimeShellPath = runtimeContext ? resolve7(runtimeContext.binDir, "rig-shell") : "";
+  const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
+  const validatorEnv = {
+    PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
+    RIG_HOST_PROJECT_ROOT: projectRoot,
+    RIG_TASK_WORKSPACE: validatorCwd,
+    MONOREPO_ROOT: validatorCwd,
+    MONOREPO_MAIN_ROOT: monorepoMainRoot,
+    RIG_TASK_ID: taskId
+  };
+  if (runtimeContext) {
+    validatorEnv.RIG_TASK_RUNTIME_ID = runtimeContext.runtimeId;
+    validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
+    validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
+  }
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync7(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  try {
+    const result = JSON.parse(stdout.trim());
+    return { result, exitCode };
+  } catch {
+    return {
+      result: {
+        id: checkId,
+        passed: false,
+        summary: `Failed to parse validator output: ${stderr || stdout}`.slice(0, 200)
+      },
+      exitCode: exitCode || 2
+    };
+  }
+}
+async function dispatchValidator(checkId, registry, ctx, subprocessFallback) {
+  let registered;
+  try {
+    registered = registry.resolve(checkId);
+  } catch {
+    return subprocessFallback(checkId);
+  }
+  const validatorResult = await registered.run(ctx);
+  return {
+    result: {
+      id: validatorResult.id,
+      passed: validatorResult.passed,
+      summary: validatorResult.summary,
+      ...validatorResult.details !== undefined ? { details: validatorResult.details } : {}
+    },
+    exitCode: validatorResult.passed ? 0 : 1
+  };
+}
+async function validateTask(projectRoot, taskId, runtimeContext, registry, options = {}) {
+  const resolvedContext = runtimeContext ?? null;
+  const taskConfig = resolvedContext ? {} : options.taskConfig ?? safeReadTaskConfig(projectRoot);
+  const sourceValidation = !resolvedContext ? await readTaskSourceValidation(projectRoot, taskId) : { validation: [], scope: [], taskConfig: undefined };
+  const configuredValidation = stringArray(taskConfig[taskId]?.validation);
+  const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
+  const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
+  mkdirSync3(taskLogDir, { recursive: true });
+  mkdirSync3(artifactDir, { recursive: true });
+  if (commands.length === 0) {
+    const skipped = {
+      status: "skipped",
+      total: 0,
+      passed: 0,
+      failed: 0,
+      categories: []
+    };
+    writeFileSync3(assertPathInsideRoot2(artifactDir, resolve7(artifactDir, "validation-summary.json"), "validation summary file"), `${JSON.stringify(skipped, null, 2)}
+`, "utf-8");
+    return skipped;
+  }
+  const effectiveRegistry = registry ?? createValidatorRegistry();
+  const workspaceRoot = resolvedContext?.workspaceDir ?? resolveMonorepoRoot(projectRoot);
+  const monorepoRoot = resolvedContext?.monorepoMainRoot ?? process.env.MONOREPO_MAIN_ROOT?.trim() ?? resolveMonorepoRoot(projectRoot);
+  const validatorCtx = {
+    taskId,
+    workspaceRoot,
+    scope: resolvedContext?.scopes ?? (stringArray(taskConfig[taskId]?.scope).length > 0 ? stringArray(taskConfig[taskId]?.scope) : sourceValidation.scope),
+    monorepoRoot,
+    artifactsDir: artifactDir,
+    taskConfig: sourceValidation.taskConfig ?? taskConfig[taskId] ?? undefined
+  };
+  const valDescriptions = resolvedContext ? {} : options.validationDescriptions ?? (() => {
+    try {
+      return readValidationDescriptions(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  const categories = [];
+  let passed = 0;
+  let failed = 0;
+  for (const cmd of commands) {
+    const startedAt = Date.now();
+    if (!isCheckId(cmd)) {
+      failed += 1;
+      categories.push({
+        category: cmd,
+        status: "fail",
+        exit_code: 2,
+        duration_seconds: 0
+      });
+      const logFile2 = assertPathInsideRoot2(taskLogDir, resolve7(taskLogDir, `invalid-entry-validation.log`), "validation log file");
+      mkdirSync3(taskLogDir, { recursive: true });
+      writeFileSync3(logFile2, `=== ${nowIso()} :: ${cmd} ===
+Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
+`, "utf-8");
+      continue;
+    }
+    const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
+    const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
+    const logFile = assertPathInsideRoot2(taskLogDir, resolve7(taskLogDir, `${cmd.replace(":", "-")}-validation.log`), "validation log file");
+    mkdirSync3(taskLogDir, { recursive: true });
+    writeFileSync3(logFile, `=== ${nowIso()} :: ${cmd} ===
+${JSON.stringify(result, null, 2)}
+`, "utf-8");
+    if (result.passed) {
+      passed += 1;
+      categories.push({ category: cmd, status: "pass", duration_seconds: durationSeconds });
+    } else {
+      failed += 1;
+      categories.push({ category: cmd, status: "fail", exit_code: exitCode, duration_seconds: durationSeconds });
+      const desc = valDescriptions[cmd];
+      if (desc) {
+        console.log(`  What this checks (${cmd}): ${desc}`);
+      }
+    }
+  }
+  const summary = {
+    status: failed === 0 ? "pass" : "fail",
+    total: commands.length,
+    passed,
+    failed,
+    categories
+  };
+  mkdirSync3(artifactDir, { recursive: true });
+  writeFileSync3(assertPathInsideRoot2(artifactDir, resolve7(artifactDir, "validation-summary.json"), "validation summary file"), `${JSON.stringify(summary, null, 2)}
+`, "utf-8");
+  return summary;
+}
+export {
+  validateTask,
+  dispatchValidator
+};