@h-rig/transport-plugin 0.0.6-alpha.158

package/dist/src/plugin.js

@@ -0,0 +1,923 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// packages/transport-plugin/relay-registry/src/client.ts
+import { Effect, Queue, Stream } from "effect";
+function registryUrl(baseUrl, pathname) {
+  const base = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  return new URL(pathname.replace(/^\/+/, ""), base);
+}
+function registryWsUrl(baseUrl, pathname) {
+  const url = registryUrl(baseUrl, pathname);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url;
+}
+async function parseResponseJson(response) {
+  const text = await response.text();
+  const data = text ? JSON.parse(text) : null;
+  if (!response.ok) {
+    const message = data && typeof data === "object" && "error" in data ? String(data.error) : response.statusText;
+    throw new Error(`registry request failed (${response.status}): ${message}`);
+  }
+  return data;
+}
+function workerProjectionFrame(frame) {
+  return typeof frame === "object" && frame !== null && "type" in frame && frame.type === "projection" ? frame : { type: "projection", projection: frame };
+}
+function connectWorkerProjection(first, runId, options) {
+  const cfg = typeof first === "string" ? { baseUrl: options?.baseUrl ?? "", namespaceKey: first, runId: runId ?? "", ...options?.WebSocket ? { WebSocket: options.WebSocket } : {} } : first;
+  if (!cfg.baseUrl)
+    throw new Error("baseUrl is required for worker projection websocket");
+  if (!cfg.runId)
+    throw new Error("runId is required for worker projection websocket");
+  const WebSocketCtor = cfg.WebSocket ?? WebSocket;
+  const url = registryWsUrl(cfg.baseUrl, "worker");
+  url.searchParams.set("namespaceKey", cfg.namespaceKey);
+  url.searchParams.set("runId", cfg.runId);
+  const ws = new WebSocketCtor(url);
+  const pending = [];
+  let closed = false;
+  const ready = new Promise((resolve, reject) => {
+    ws.addEventListener("open", () => {
+      resolve();
+      while (pending.length && ws.readyState === WebSocketCtor.OPEN)
+        ws.send(JSON.stringify(pending.shift()));
+    }, { once: true });
+    ws.addEventListener("error", () => {
+      closed = true;
+      pending.length = 0;
+      reject(new Error("worker projection websocket error"));
+    }, { once: true });
+  });
+  ready.catch(() => {
+    return;
+  });
+  return {
+    ready,
+    push(frame) {
+      if (closed)
+        return;
+      const encoded = workerProjectionFrame(frame);
+      if (ws.readyState === WebSocketCtor.OPEN) {
+        ws.send(JSON.stringify(encoded));
+        return;
+      }
+      pending.push(encoded);
+    },
+    close() {
+      closed = true;
+      pending.length = 0;
+      try {
+        ws.close();
+      } catch {}
+    }
+  };
+}
+function subscribeDiscovery(namespaceKey, repo, options) {
+  return Stream.callback((queue) => Effect.sync(() => {
+    const WebSocketCtor = options.WebSocket ?? WebSocket;
+    const url = registryWsUrl(options.baseUrl, "ws");
+    url.searchParams.set("namespaceKey", namespaceKey);
+    if (repo)
+      url.searchParams.set("repo", repo);
+    const ws = new WebSocketCtor(url);
+    const entries = new Map;
+    const snapshot = (sentAt) => ({
+      type: "registry.snapshot",
+      namespaceKey,
+      sentAt,
+      entries: Array.from(entries.values())
+    });
+    ws.addEventListener("message", (event) => {
+      try {
+        const text = typeof event.data === "string" ? event.data : String(event.data);
+        const frame = JSON.parse(text);
+        if (frame?.type === "registry.snapshot") {
+          entries.clear();
+          for (const entry of frame.entries)
+            entries.set(entry.roomId, entry);
+          Queue.offerUnsafe(queue, frame);
+          return;
+        }
+        if (frame?.type !== "registry.delta")
+          return;
+        if (frame.action === "remove") {
+          entries.delete(frame.roomId);
+        } else if (frame.entry) {
+          entries.set(frame.entry.roomId, frame.entry);
+        }
+        Queue.offerUnsafe(queue, snapshot(frame.sentAt));
+      } catch {}
+    });
+    ws.addEventListener("error", () => {});
+    return ws;
+  }).pipe(Effect.flatMap((ws) => Effect.addFinalizer(() => Effect.sync(() => ws.close())))), { bufferSize: 1, strategy: "sliding" });
+}
+function createRegistryClient(options) {
+  const requestFetch = options.fetch ?? fetch;
+  const headers = { "content-type": "application/json" };
+  async function post(pathname, body) {
+    const response = await requestFetch(registryUrl(options.baseUrl, pathname), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    return parseResponseJson(response);
+  }
+  return {
+    async registerRoom(room) {
+      const response = await post("register", room);
+      return response.entry;
+    },
+    async heartbeatRoom(roomId, status, projection) {
+      const body = projection === undefined ? { roomId, namespaceKey: options.namespaceKey, status } : { roomId, namespaceKey: options.namespaceKey, status, projection };
+      const response = await post("heartbeat", body);
+      return response.entry;
+    },
+    async ingestProjection(input) {
+      const response = await post("projection", {
+        ...input,
+        namespaceKey: input.namespaceKey ?? options.namespaceKey
+      });
+      return response.entry;
+    },
+    async listRoomsByOwner(filter) {
+      const namespaceKey = filter.namespaceKey ?? options.namespaceKey;
+      const url = registryUrl(options.baseUrl, "list");
+      url.searchParams.set("namespaceKey", namespaceKey);
+      if (filter.selectedRepo)
+        url.searchParams.set("repo", filter.selectedRepo);
+      const response = await requestFetch(url);
+      return (await parseResponseJson(response)).entries;
+    },
+    async removeRoom(roomId) {
+      const response = await post("remove", { roomId, namespaceKey: options.namespaceKey });
+      return response.removed;
+    }
+  };
+}
+var init_client = () => {};
+
+// packages/transport-plugin/relay-registry/src/schema.ts
+import { RunStatus as ContractRunStatus, Schema } from "@rig/contracts";
+function isRegistryStatus(value) {
+  return typeof value === "string" && REGISTRY_STATUS_SET.has(value);
+}
+function coerceRegistryStatus(value, fallback) {
+  if (value === "starting")
+    return "preparing";
+  if (value === "waiting-input")
+    return "waiting-user-input";
+  return isRegistryStatus(value) ? value : fallback;
+}
+var RegistryOwner, REGISTRY_STATUS_ALIASES, REGISTRY_STATUS_VALUES, RegistryStatus, REGISTRY_STATUS_SET, RegistryEntry, RegisterRequest, HeartbeatRequest, ProjectionIngestRequest, RemoveRequest, ListedRegistryEntry, ListResponse, RegisterResponse, HeartbeatResponse, ProjectionIngestResponse, RemoveResponse, RegistrySnapshotFrame, RegistryDeltaFrame, WorkerProjectionFrame;
+var init_schema = __esm(() => {
+  RegistryOwner = Schema.Struct({
+    githubUserId: Schema.String,
+    login: Schema.String,
+    namespaceKey: Schema.String
+  });
+  REGISTRY_STATUS_ALIASES = ["starting", "waiting-input"];
+  REGISTRY_STATUS_VALUES = [
+    ...ContractRunStatus.members.map((member) => member.literal),
+    ...REGISTRY_STATUS_ALIASES
+  ];
+  RegistryStatus = Schema.Literals(REGISTRY_STATUS_VALUES);
+  REGISTRY_STATUS_SET = new Set(REGISTRY_STATUS_VALUES);
+  RegistryEntry = Schema.Struct({
+    roomId: Schema.String,
+    owner: RegistryOwner,
+    repo: Schema.String,
+    title: Schema.String,
+    status: RegistryStatus,
+    joinLink: Schema.String,
+    webLink: Schema.String,
+    relayUrl: Schema.String,
+    startedAt: Schema.String,
+    cwd: Schema.optional(Schema.String),
+    sessionPath: Schema.optional(Schema.String),
+    heartbeatAt: Schema.String,
+    pid: Schema.optional(Schema.Number),
+    projection: Schema.optional(Schema.Unknown)
+  });
+  RegisterRequest = Schema.Struct({
+    roomId: Schema.String,
+    owner: RegistryOwner,
+    repo: Schema.String,
+    title: Schema.String,
+    status: RegistryStatus,
+    joinLink: Schema.String,
+    webLink: Schema.String,
+    relayUrl: Schema.String,
+    startedAt: Schema.String,
+    cwd: Schema.optional(Schema.String),
+    sessionPath: Schema.optional(Schema.String),
+    pid: Schema.optional(Schema.Number),
+    projection: Schema.optional(Schema.Unknown)
+  });
+  HeartbeatRequest = Schema.Struct({
+    roomId: Schema.String,
+    namespaceKey: Schema.String,
+    status: RegistryStatus,
+    projection: Schema.optional(Schema.Unknown)
+  });
+  ProjectionIngestRequest = Schema.Struct({
+    namespaceKey: Schema.String,
+    roomId: Schema.optional(Schema.String),
+    owner: Schema.optional(RegistryOwner),
+    repo: Schema.optional(Schema.String),
+    projection: Schema.Unknown
+  });
+  RemoveRequest = Schema.Struct({
+    namespaceKey: Schema.String,
+    roomId: Schema.String
+  });
+  ListedRegistryEntry = Schema.Struct({
+    roomId: Schema.String,
+    owner: RegistryOwner,
+    repo: Schema.String,
+    title: Schema.String,
+    status: RegistryStatus,
+    joinLink: Schema.String,
+    webLink: Schema.String,
+    relayUrl: Schema.String,
+    startedAt: Schema.String,
+    heartbeatAt: Schema.String,
+    cwd: Schema.optional(Schema.String),
+    sessionPath: Schema.optional(Schema.String),
+    pid: Schema.optional(Schema.Number),
+    projection: Schema.optional(Schema.Unknown),
+    stale: Schema.Boolean
+  });
+  ListResponse = Schema.Struct({
+    entries: Schema.Array(ListedRegistryEntry)
+  });
+  RegisterResponse = Schema.Struct({
+    entry: RegistryEntry
+  });
+  HeartbeatResponse = Schema.Struct({
+    entry: RegistryEntry
+  });
+  ProjectionIngestResponse = Schema.Struct({
+    entry: RegistryEntry
+  });
+  RemoveResponse = Schema.Struct({
+    removed: Schema.Boolean
+  });
+  RegistrySnapshotFrame = Schema.Struct({
+    type: Schema.Literal("registry.snapshot"),
+    namespaceKey: Schema.String,
+    sentAt: Schema.String,
+    entries: Schema.Array(ListedRegistryEntry)
+  });
+  RegistryDeltaFrame = Schema.Struct({
+    type: Schema.Literal("registry.delta"),
+    namespaceKey: Schema.String,
+    sentAt: Schema.String,
+    action: Schema.Literals(["upsert", "remove"]),
+    roomId: Schema.String,
+    entry: Schema.optional(ListedRegistryEntry)
+  });
+  WorkerProjectionFrame = Schema.Struct({
+    type: Schema.Literal("projection"),
+    projection: Schema.Unknown
+  });
+});
+
+// packages/transport-plugin/src/relay-registry.ts
+var exports_relay_registry = {};
+__export(exports_relay_registry, {
+  subscribeDiscovery: () => subscribeDiscovery,
+  createRegistryClient: () => createRegistryClient,
+  connectWorkerProjection: () => connectWorkerProjection,
+  coerceRegistryStatus: () => coerceRegistryStatus
+});
+var init_relay_registry = __esm(() => {
+  init_client();
+  init_schema();
+});
+
+// packages/transport-plugin/src/discovery.ts
+var exports_discovery = {};
+__export(exports_discovery, {
+  runDiscoveryStream: () => runDiscoveryStream,
+  registrySnapshotStream: () => registrySnapshotStream,
+  registryBaseUrl: () => registryBaseUrl,
+  matchesRun: () => matchesRun,
+  listActiveRunCollab: () => listActiveRunCollab,
+  defaultListActiveCollabSessions: () => defaultListActiveCollabSessions,
+  collabFromRegistryEntry: () => collabFromRegistryEntry,
+  attachViaRelay: () => attachViaRelay
+});
+import { Effect as Effect2, Option, Stream as Stream2, Duration } from "effect";
+import { resolveOwnerNamespaceKey, resolveRegistryBaseUrl } from "@rig/core/remote-config";
+function registryBaseUrl(projectRoot = process.cwd(), env = process.env) {
+  return resolveRegistryBaseUrl(projectRoot, env);
+}
+function collabFromRegistryEntry(entry) {
+  return {
+    sessionId: entry.roomId,
+    title: entry.title,
+    sessionPath: entry.sessionPath ?? (entry.projection && typeof entry.projection === "object" && "sessionPath" in entry.projection && typeof entry.projection.sessionPath === "string" ? entry.projection.sessionPath : ""),
+    cwd: entry.cwd ?? (entry.projection && typeof entry.projection === "object" && "worktreePath" in entry.projection && typeof entry.projection.worktreePath === "string" ? entry.projection.worktreePath : ""),
+    joinLink: entry.joinLink ?? "",
+    webLink: entry.webLink ?? "",
+    relayUrl: entry.relayUrl ?? "",
+    owner: entry.owner,
+    selectedRepo: entry.repo,
+    startedAt: entry.startedAt,
+    updatedAt: entry.heartbeatAt,
+    ...entry.pid === undefined ? {} : { pid: entry.pid },
+    stale: entry.stale,
+    registryStatus: entry.status,
+    registryProjection: entry.projection
+  };
+}
+function namespaceKeyFor(projectRoot, filter = {}) {
+  return filter.namespaceKey ?? resolveOwnerNamespaceKey(projectRoot) ?? "anonymous";
+}
+async function listActiveRunCollab(projectRoot, filter) {
+  return defaultListActiveCollabSessions(projectRoot, filter);
+}
+async function defaultListActiveCollabSessions(projectRoot, filter) {
+  const namespaceKey = namespaceKeyFor(projectRoot, filter);
+  if (!namespaceKey)
+    return [];
+  try {
+    const client = createRegistryClient({ baseUrl: registryBaseUrl(projectRoot), namespaceKey });
+    return (await client.listRoomsByOwner({ ...filter, namespaceKey })).map(collabFromRegistryEntry);
+  } catch {
+    return [];
+  }
+}
+function matchesRun(collab, runId, taskId) {
+  if (collab.sessionId === runId)
+    return true;
+  return Boolean(taskId && collab.title?.includes(taskId));
+}
+function runDiscoveryStream(projectRoot) {
+  const namespaceKey = namespaceKeyFor(projectRoot);
+  if (!namespaceKey)
+    return Stream2.never;
+  return subscribeDiscovery(namespaceKey, null, { baseUrl: registryBaseUrl(projectRoot) }).pipe(Stream2.map(() => {
+    return;
+  }));
+}
+function registrySnapshotStream(projectRoot, filter = {}) {
+  const namespaceKey = namespaceKeyFor(projectRoot, filter);
+  if (!namespaceKey)
+    return Stream2.never;
+  return subscribeDiscovery(namespaceKey, filter.selectedRepo ?? null, { baseUrl: registryBaseUrl(projectRoot) });
+}
+async function attachViaRelay(input, deps = {}) {
+  const timeoutMs = input.timeoutMs ?? DEFAULT_ATTACH_TIMEOUT_MS;
+  const root = input.projectRoot ?? process.cwd();
+  const listActive = deps.listActiveCollabSessions ?? ((filter) => defaultListActiveCollabSessions(root, filter));
+  const checkOnce = async () => {
+    const live = await listActive(input.identityFilter);
+    const exact = live.find((collab) => collab.sessionId === input.runId && !collab.stale);
+    const match = exact ?? live.find((collab) => matchesRun(collab, input.runId, input.taskId) && !collab.stale);
+    if (!match)
+      return null;
+    return { sessionPath: match.sessionPath ?? null, joinLink: match.joinLink ?? null, collabSessionId: match.sessionId ?? null };
+  };
+  const immediate = await checkOnce();
+  if (immediate)
+    return immediate;
+  const events = deps.discoveryStream ? deps.discoveryStream(root) : runDiscoveryStream(root);
+  return await Effect2.runPromise(events.pipe(Stream2.mapEffect(() => Effect2.promise(checkOnce)), Stream2.filter((m) => m !== null), Stream2.runHead, Effect2.timeout(Duration.millis(timeoutMs)), Effect2.map(Option.getOrNull), Effect2.catch(() => Effect2.succeed(null))));
+}
+var DEFAULT_ATTACH_TIMEOUT_MS = 15000;
+var init_discovery = __esm(() => {
+  init_relay_registry();
+});
+
+// packages/transport-plugin/src/identity-env.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+function stringField(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function githubUserId(value) {
+  if (typeof value === "number" && Number.isInteger(value))
+    return String(value);
+  return stringField(value);
+}
+function readJsonRecord(path) {
+  if (!existsSync(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function resolveTransportIdentityEnv(workspaceRoot) {
+  const stateDir = resolve(workspaceRoot, ".rig", "state");
+  const auth = readJsonRecord(resolve(stateDir, "github-auth.json"));
+  const connection = readJsonRecord(resolve(stateDir, "connection.json"));
+  const projectLink = readJsonRecord(resolve(stateDir, "project-link.json"));
+  const values = {};
+  const selectedRepo = stringField(auth?.selectedRepo) ?? stringField(connection?.project) ?? stringField(projectLink?.repoSlug);
+  const userId = githubUserId(auth?.userId);
+  const login = stringField(auth?.login);
+  const namespaceKey = stringField(auth?.userNamespaceKey);
+  if (selectedRepo)
+    values.RIG_SELECTED_REPO = selectedRepo;
+  if (userId)
+    values.RIG_GITHUB_USER_ID = userId;
+  if (login)
+    values.RIG_GITHUB_LOGIN = login;
+  if (namespaceKey)
+    values.RIG_GITHUB_NAMESPACE_KEY = namespaceKey;
+  return values;
+}
+var init_identity_env = () => {};
+
+// packages/transport-plugin/src/dispatch.ts
+var exports_dispatch = {};
+__export(exports_dispatch, {
+  spawnRunProcess: () => spawnRunProcess,
+  sessionIdFromDispatchSnapshot: () => sessionIdFromDispatchSnapshot,
+  resolveRigRunBin: () => resolveRigRunBin,
+  resolveDispatchTransportPlacement: () => resolveDispatchTransportPlacement2,
+  dispatchRun: () => dispatchRun,
+  createPlacementRunTransport: () => createPlacementRunTransport
+});
+import { randomUUID } from "crypto";
+import { spawn as nodeSpawn } from "child_process";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { resolveOwnerNamespaceKey as resolveOwnerNamespaceKey2, resolveRegistryBaseUrl as resolveRegistryBaseUrl2, resolveDispatchTransportPlacement } from "@rig/core/remote-config";
+import {
+  REMOTE_RIG_RUN_COMMAND,
+  REMOTE_RESOLVED_RIG_RUN_COMMAND,
+  buildRemoteRigRunResolutionShell,
+  buildRigRunLaunchArgs,
+  readGithubAuthStateBase64,
+  resolveLocalDispatchRigRunBin,
+  resolveRemoteCheckoutPlan,
+  resolveRunGithubAuthMaterialization
+} from "@rig/core/run-provisioning";
+import { Duration as Duration2, Effect as Effect3, Option as Option2, Stream as Stream3 } from "effect";
+import { resolveDispatchTransportPlacement as resolveDispatchTransportPlacement2 } from "@rig/core/remote-config";
+function sessionIdFromSessionFile(sessionPath) {
+  if (!sessionPath)
+    return null;
+  const file = sessionPath.split(/[\\/]/).pop() ?? "";
+  const match = file.match(/_([0-9a-fA-F][0-9a-fA-F-]{7,})\.jsonl$/);
+  return match?.[1] ?? null;
+}
+function dispatchLogPath(projectRoot, source, runId) {
+  return resolve2(projectRoot, ".rig", "logs", `${source}-dispatch-${runId}.log`);
+}
+function resolveRigRunBin() {
+  return resolveLocalDispatchRigRunBin({
+    importMetaUrl: import.meta.url,
+    sourceRigRunPath: resolve2(dirname(fileURLToPath(import.meta.url)), "../../../rig-host/bin/rig-run.ts")
+  });
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function remoteRuntimeEnvPayload(env) {
+  const lines = REMOTE_RUNTIME_ENV_KEYS.flatMap((key) => {
+    const value = env[key]?.trim();
+    return value ? [`export ${key}=${shellQuote(value)}`] : [];
+  });
+  return lines.length > 0 ? Buffer.from(`${lines.join(`
+`)}
+`, "utf8").toString("base64") : "";
+}
+function dispatchChildEnv(env, identityEnv, authMaterialization) {
+  const childEnv = { ...env };
+  for (const key of DISPATCH_TOKEN_ENV_KEYS)
+    delete childEnv[key];
+  for (const [key, value] of Object.entries(identityEnv)) {
+    if (value !== undefined)
+      childEnv[key] = value;
+  }
+  childEnv.RIG_GITHUB_AUTH_STATE_FILE ??= authMaterialization.operatorAuthPath;
+  childEnv.RIG_STATE_DIR ??= authMaterialization.operatorStateDir;
+  return childEnv;
+}
+function rigRunShellInvocation(input, runId, command = REMOTE_RIG_RUN_COMMAND) {
+  return [
+    command,
+    ...buildRigRunLaunchArgs(input, runId, "$CHECKOUT").map((arg) => arg === "$CHECKOUT" ? '"$CHECKOUT"' : shellQuote(arg))
+  ].join(" ");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+function isDispatchTransportPlacement(value) {
+  if (!isRecord(value))
+    return false;
+  if (value.kind === "local")
+    return value.sshTarget === null;
+  return value.kind === "remote" && typeof value.sshTarget === "string" && value.sshTarget.trim().length > 0;
+}
+function placementResolverFromOptions(options) {
+  if (!isRecord(options))
+    return;
+  const placement = options.placement;
+  if (typeof placement === "function")
+    return placement;
+  if (isDispatchTransportPlacement(placement))
+    return () => placement;
+  return;
+}
+function stringField2(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function readJsonRecord2(path) {
+  if (!existsSync2(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function readProjectSlug(projectRoot) {
+  const connection = readJsonRecord2(resolve2(projectRoot, ".rig", "state", "connection.json"));
+  return stringField2(connection?.project) ?? null;
+}
+function resolveGitDir(projectRoot) {
+  const dotGit = resolve2(projectRoot, ".git");
+  if (existsSync2(resolve2(dotGit, "HEAD")))
+    return dotGit;
+  try {
+    const match = /^gitdir:\s*(.+)$/m.exec(readFileSync2(dotGit, "utf8"));
+    return match ? resolve2(projectRoot, match[1].trim()) : null;
+  } catch {
+    return null;
+  }
+}
+function readGitDirFile(gitDir, relativePath) {
+  try {
+    return readFileSync2(resolve2(gitDir, relativePath), "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function resolveCommonGitDir(gitDir) {
+  const commonDir = readGitDirFile(gitDir, "commondir");
+  return commonDir ? resolve2(gitDir, commonDir) : null;
+}
+function resolveProjectHeadCommit(projectRoot) {
+  const gitDir = resolveGitDir(projectRoot);
+  if (!gitDir)
+    return null;
+  const head = readGitDirFile(gitDir, "HEAD");
+  if (!head)
+    return null;
+  if (/^[0-9a-f]{40}$/i.test(head))
+    return head;
+  const ref = head.startsWith("ref:") ? head.slice(4).trim() : "";
+  if (!ref)
+    return null;
+  const lookupDirs = [gitDir, resolveCommonGitDir(gitDir)].filter((dir) => Boolean(dir));
+  for (const dir of lookupDirs) {
+    const looseRef = readGitDirFile(dir, ref);
+    if (looseRef && /^[0-9a-f]{40}$/i.test(looseRef))
+      return looseRef;
+  }
+  for (const dir of lookupDirs) {
+    const packedRefs = readGitDirFile(dir, "packed-refs");
+    const packed = packedRefs?.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#") && !line.startsWith("^")).map((line) => line.split(/\s+/)).find(([sha, name]) => name === ref && /^[0-9a-f]{40}$/i.test(sha ?? ""))?.[0];
+    if (packed)
+      return packed;
+  }
+  return null;
+}
+async function spawnRunProcess(input, deps = {}) {
+  const runId = (deps.uuid ?? randomUUID)();
+  const env = deps.env ?? process.env;
+  const identityEnv = resolveTransportIdentityEnv(input.projectRoot);
+  const authMaterialization = resolveRunGithubAuthMaterialization(input.projectRoot);
+  const placement = (deps.resolvePlacement ?? resolveDispatchTransportPlacement)(input.projectRoot, env);
+  if (placement.kind === "remote") {
+    const selected = placement.selected;
+    const sshTarget = placement.sshTarget;
+    const namespaceKey = identityEnv.RIG_GITHUB_NAMESPACE_KEY ?? resolveOwnerNamespaceKey2(input.projectRoot, env) ?? "";
+    const sh = shellQuote;
+    const projectSlug = readProjectSlug(input.projectRoot);
+    const checkoutPlan = resolveRemoteCheckoutPlan({ selectedCheckout: selected?.checkout ?? null, projectSlug });
+    const checkoutExpr = checkoutPlan.checkoutPathKind === "literal" ? sh(checkoutPlan.checkoutPath) : `"$HOME/${checkoutPlan.checkoutPath}"`;
+    const identityAssignments = Object.entries(identityEnv).flatMap(([k, v]) => v ? [`${k}=${sh(v)}`] : []);
+    if (namespaceKey && !identityEnv.RIG_GITHUB_NAMESPACE_KEY)
+      identityAssignments.push(`RIG_GITHUB_NAMESPACE_KEY=${sh(namespaceKey)}`);
+    const registryBaseUrl2 = resolveRegistryBaseUrl2(input.projectRoot, env);
+    const runtimeEnvB64 = remoteRuntimeEnvPayload(env);
+    const remoteAuthState = `"${authMaterialization.remoteAuthPath}"`;
+    const remoteStateDir = `"${authMaterialization.remoteStateDir}"`;
+    const runInvocation = [
+      ...identityAssignments,
+      `RIG_REGISTRY_URL=${sh(registryBaseUrl2)}`,
+      `RIG_GITHUB_AUTH_STATE_FILE=${remoteAuthState}`,
+      `RIG_STATE_DIR=${remoteStateDir}`,
+      rigRunShellInvocation(input, runId, REMOTE_RESOLVED_RIG_RUN_COMMAND)
+    ].filter(Boolean).join(" ");
+    const authStateB64 = readGithubAuthStateBase64(authMaterialization.operatorAuthPath);
+    const operatorHead = resolveProjectHeadCommit(input.projectRoot);
+    if (!operatorHead)
+      throw new Error(`remote dispatch cannot resolve operator git HEAD for ${input.projectRoot}`);
+    const gitCredentialHelper = `#!/usr/bin/env bun
+import { readFileSync } from "node:fs";
+try {
+  const path = process.env.RIG_GITHUB_AUTH_STATE_FILE;
+  if (!path) process.exit(0);
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  const token = typeof parsed.token === "string" ? parsed.token.trim() : "";
+  if (token) process.stdout.write(\`username=x-access-token\\npassword=${"${token}"}\\n\`);
+} catch {
+  process.exit(0);
+}
+`;
+    const provisionAndRun = [
+      "set -e",
+      "IFS= read -r __RIG_GH_AUTH_B64 || true",
+      "IFS= read -r __RIG_RUNTIME_ENV_B64 || true",
+      "__RIG_AUTH_FILE=$(mktemp)",
+      "__RIG_RUNTIME_ENV_FILE=$(mktemp)",
+      "__RIG_GIT_HELPER=$(mktemp)",
+      `trap 'rm -f "$__RIG_AUTH_FILE" "$__RIG_RUNTIME_ENV_FILE" "$__RIG_GIT_HELPER"' EXIT`,
+      `if [ -n "$__RIG_GH_AUTH_B64" ]; then printf %s "$__RIG_GH_AUTH_B64" | base64 -d > "$__RIG_AUTH_FILE" && chmod 600 "$__RIG_AUTH_FILE"; fi`,
+      `if [ -n "$__RIG_RUNTIME_ENV_B64" ]; then printf %s "$__RIG_RUNTIME_ENV_B64" | base64 -d > "$__RIG_RUNTIME_ENV_FILE" && chmod 600 "$__RIG_RUNTIME_ENV_FILE" && . "$__RIG_RUNTIME_ENV_FILE"; fi`,
+      `printf %s ${sh(gitCredentialHelper)} > "$__RIG_GIT_HELPER"`,
+      'chmod 700 "$__RIG_GIT_HELPER"',
+      'git_with_auth() { RIG_GITHUB_AUTH_STATE_FILE="$__RIG_AUTH_FILE" git -c credential.helper="!$__RIG_GIT_HELPER" "$@"; }',
+      `CHECKOUT=${checkoutExpr}`,
+      checkoutPlan.originUrl ? `[ -d "$CHECKOUT/.git" ] || git_with_auth clone ${sh(checkoutPlan.originUrl)} "$CHECKOUT"` : `[ -d "$CHECKOUT/.git" ] || { echo "rig: remote checkout $CHECKOUT missing and no origin to clone" >&2; exit 1; }`,
+      `cd "$CHECKOUT"`,
+      `git_with_auth fetch origin ${sh(operatorHead)} --quiet || git_with_auth fetch origin --prune --quiet`,
+      `git cat-file -e ${sh(`${operatorHead}^{commit}`)} || { echo "rig: operator commit ${operatorHead} is unavailable on remote checkout" >&2; exit 1; }`,
+      `git checkout --detach ${sh(operatorHead)} --quiet`,
+      `git reset --hard ${sh(operatorHead)} --quiet`,
+      "bun install --silent || bun install",
+      `mkdir -p "$CHECKOUT/.rig/state"`,
+      `if [ -s "$__RIG_AUTH_FILE" ]; then cp "$__RIG_AUTH_FILE" "$CHECKOUT/.rig/state/github-auth.json" && chmod 600 "$CHECKOUT/.rig/state/github-auth.json"; fi`,
+      ...buildRemoteRigRunResolutionShell(`https://${DEFAULT_RIG_BACKBONE_HOST}/install`),
+      runInvocation
+    ].join("; ");
+    const dispatchLogDir2 = resolve2(input.projectRoot, ".rig", "logs");
+    mkdirSync(dispatchLogDir2, { recursive: true });
+    const remoteDispatchLogPath = dispatchLogPath(input.projectRoot, placement.kind, runId);
+    await new Promise((resolveDone, rejectDone) => {
+      const sshArgs = ["-o", "ConnectTimeout=20", ...selected && selected.port !== 22 ? ["-p", String(selected.port)] : [], sshTarget, `bash -lc ${sh(provisionAndRun)}`];
+      const child = (deps.spawn ?? nodeSpawn)("ssh", sshArgs, {
+        cwd: input.projectRoot,
+        env: dispatchChildEnv(env, identityEnv, authMaterialization),
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      try {
+        child.stdin?.write(`${authStateB64}
+${runtimeEnvB64}
+`);
+        child.stdin?.end();
+      } catch {}
+      let out = "";
+      child.stdout?.on("data", (chunk) => {
+        out += String(chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        out += String(chunk);
+      });
+      const timer = setTimeout(() => {
+        try {
+          child.kill();
+        } catch {}
+        try {
+          writeFileSync(remoteDispatchLogPath, out);
+        } catch {}
+        rejectDone(new Error(`remote dispatch for task ${input.taskId} did not confirm within 180s (see ${remoteDispatchLogPath})`));
+      }, DEFAULT_REMOTE_DISPATCH_TIMEOUT_MS);
+      child.on("error", (error) => {
+        clearTimeout(timer);
+        rejectDone(error);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        try {
+          writeFileSync(remoteDispatchLogPath, out);
+        } catch {}
+        if (code === 0) {
+          resolveDone();
+          return;
+        }
+        const detail = out.trim().split(`
+`).slice(-8).join(`
+`);
+        rejectDone(new Error(`remote dispatch for task ${input.taskId} exited ${code ?? "null"} (see ${remoteDispatchLogPath})${detail ? `:
+${detail}` : ""}`));
+      });
+    });
+    return { runId };
+  }
+  const dispatchLogDir = resolve2(input.projectRoot, ".rig", "logs");
+  mkdirSync(dispatchLogDir, { recursive: true });
+  const localDispatchLogPath = dispatchLogPath(input.projectRoot, "local", runId);
+  const command = (deps.resolveRigRunBin ?? resolveRigRunBin)();
+  const args = buildRigRunLaunchArgs(input, runId, input.projectRoot);
+  await new Promise((resolveDone, rejectDone) => {
+    const child = (deps.spawn ?? nodeSpawn)(command, args, {
+      cwd: input.projectRoot,
+      env: dispatchChildEnv(env, identityEnv, authMaterialization),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let out = "";
+    child.stdout?.on("data", (chunk) => {
+      out += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      out += String(chunk);
+    });
+    child.on("error", (error) => {
+      try {
+        writeFileSync(localDispatchLogPath, out);
+      } catch {}
+      rejectDone(error);
+    });
+    child.on("close", (code) => {
+      try {
+        writeFileSync(localDispatchLogPath, out);
+      } catch {}
+      if (code === 0) {
+        resolveDone();
+        return;
+      }
+      const detail = out.trim().split(`
+`).slice(-8).join(`
+`);
+      rejectDone(new Error(`local dispatch for task ${input.taskId} exited ${code ?? "null"} (see ${localDispatchLogPath})${detail ? `:
+${detail}` : ""}`));
+    });
+  });
+  return { runId };
+}
+function entryProjection(entry) {
+  return entry.projection && typeof entry.projection === "object" ? entry.projection : {};
+}
+function textContainsHandle(value, handle) {
+  return Boolean(value && value.includes(handle));
+}
+function sessionIdFromDispatchSnapshot(snapshot, dispatchHandle) {
+  for (const entry of snapshot.entries) {
+    const projection = entryProjection(entry);
+    const sessionPath = stringField2(projection.sessionPath) ?? entry.sessionPath ?? null;
+    const cwd = stringField2(projection.cwd) ?? stringField2(projection.collabCwd) ?? entry.cwd ?? stringField2(projection.worktreePath) ?? null;
+    const handleField = stringField2(projection.dispatchHandle);
+    if (handleField !== dispatchHandle && !textContainsHandle(sessionPath, dispatchHandle) && !textContainsHandle(cwd, dispatchHandle))
+      continue;
+    return stringField2(projection.runId) ?? sessionIdFromSessionFile(sessionPath) ?? entry.roomId;
+  }
+  return null;
+}
+async function waitForSessionId(projectRoot, handle, logPath, source, deps) {
+  const timeoutMs = source === "remote" ? deps.remoteSessionTimeoutMs ?? DEFAULT_REMOTE_DISPATCH_TIMEOUT_MS : deps.localSessionTimeoutMs ?? DEFAULT_LOCAL_SESSION_TIMEOUT_MS;
+  const found = await Effect3.runPromise((deps.discoverySnapshots ?? registrySnapshotStream)(projectRoot).pipe(Stream3.map((snapshot) => sessionIdFromDispatchSnapshot(snapshot, handle)), Stream3.filter((sessionId) => sessionId !== null), Stream3.runHead, Effect3.timeout(Duration2.millis(timeoutMs)), Effect3.map(Option2.getOrNull), Effect3.catch(() => Effect3.succeed(null))));
+  if (found)
+    return found;
+  throw new Error(`dispatch for handle ${handle} timed out before an OMP session id appeared (see ${logPath})`);
+}
+async function dispatchRun(input, deps = {}) {
+  const env = deps.env ?? process.env;
+  const placement = (deps.resolvePlacement ?? resolveDispatchTransportPlacement)(input.projectRoot, env);
+  const handle = (deps.uuid ?? randomUUID)();
+  const inner = await (deps.spawnRunProcess ?? spawnRunProcess)(input, { ...deps, uuid: () => handle, resolvePlacement: () => placement });
+  const dispatchHandle = inner.runId;
+  const logPath = dispatchLogPath(input.projectRoot, placement.kind, dispatchHandle);
+  return { runId: await waitForSessionId(input.projectRoot, dispatchHandle, logPath, placement.kind, deps) };
+}
+function createPlacementRunTransport(deps = {}) {
+  return {
+    async dispatch(task, options) {
+      const resolvePlacement = placementResolverFromOptions(options);
+      const { runId } = await dispatchRun(task, resolvePlacement ? { ...deps, resolvePlacement } : deps);
+      return runId;
+    }
+  };
+}
+var DEFAULT_REMOTE_DISPATCH_TIMEOUT_MS = 180000, DEFAULT_LOCAL_SESSION_TIMEOUT_MS = 120000, DISPATCH_TOKEN_ENV_KEYS, REMOTE_RUNTIME_ENV_KEYS;
+var init_dispatch = __esm(() => {
+  init_identity_env();
+  init_discovery();
+  init_plugin();
+  DISPATCH_TOKEN_ENV_KEYS = [
+    "RIG_GITHUB_TOKEN",
+    "RIG_GITHUB_SELECTED_TOKEN",
+    "GH_TOKEN",
+    "GITHUB_TOKEN"
+  ];
+  REMOTE_RUNTIME_ENV_KEYS = [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "OPENROUTER_API_KEY"
+  ];
+});
+
+// packages/transport-plugin/src/plugin.ts
+import { definePlugin } from "@rig/core/config";
+import { defineCapability } from "@rig/core/capability";
+import {
+  RUN_DISPATCH,
+  RUN_DISCOVERY,
+  PLACEMENT_RUN_TRANSPORT,
+  RUN_REGISTRY_BACKBONE
+} from "@rig/contracts";
+import { registerBackboneDefaults } from "@rig/core/remote-config";
+function createTransportPlugin() {
+  return transportPlugin;
+}
+var TRANSPORT_PLUGIN_NAME = "@rig/transport-plugin", DEFAULT_RIG_BACKBONE_HOST = "where.rig-does.work", DEFAULT_RIG_RELAY_URL, DEFAULT_RIG_REGISTRY_URL, DEFAULT_RIG_SSH_TARGET = "ubuntu@100.125.210.33", RUN_DISCOVERY_CAPABILITY_ID = "rig.runs.discovery", RunDiscoveryCap, RunDispatchCap, PlacementRunTransportCap, RunRegistryBackboneCap, transportPlugin, plugin_default;
+var init_plugin = __esm(() => {
+  DEFAULT_RIG_RELAY_URL = `wss://${DEFAULT_RIG_BACKBONE_HOST}`;
+  DEFAULT_RIG_REGISTRY_URL = `https://${DEFAULT_RIG_BACKBONE_HOST}/registry`;
+  registerBackboneDefaults({
+    relayUrl: DEFAULT_RIG_RELAY_URL,
+    registryBaseUrl: DEFAULT_RIG_REGISTRY_URL,
+    sshTarget: DEFAULT_RIG_SSH_TARGET
+  });
+  RunDiscoveryCap = defineCapability(RUN_DISCOVERY);
+  RunDispatchCap = defineCapability(RUN_DISPATCH);
+  PlacementRunTransportCap = defineCapability(PLACEMENT_RUN_TRANSPORT);
+  RunRegistryBackboneCap = defineCapability(RUN_REGISTRY_BACKBONE);
+  transportPlugin = definePlugin({
+    name: TRANSPORT_PLUGIN_NAME,
+    version: "0.0.0-alpha.1",
+    contributes: {
+      capabilities: [
+        RunDiscoveryCap.provide(async () => {
+          const discovery = await Promise.resolve().then(() => (init_discovery(), exports_discovery));
+          return {
+            listActiveRunCollab: discovery.listActiveRunCollab,
+            runDiscoveryStream: discovery.runDiscoveryStream,
+            attachViaRelay: discovery.attachViaRelay
+          };
+        }, {
+          title: "Run discovery (relay-registry merge)",
+          description: "The unified active-run list: local FS-watch + remote registry SSE, plus relay attach."
+        }),
+        RunDispatchCap.provide(async () => {
+          const dispatch = await Promise.resolve().then(() => (init_dispatch(), exports_dispatch));
+          return { dispatchRun: (input) => dispatch.dispatchRun(input) };
+        }, {
+          title: "Run dispatch (placement-aware)",
+          description: "Dispatch a run resolving local vs remote/fleet placement at dispatch time."
+        }),
+        PlacementRunTransportCap.provide(async () => {
+          const { createPlacementRunTransport: createPlacementRunTransport2 } = await Promise.resolve().then(() => (init_dispatch(), exports_dispatch));
+          return createPlacementRunTransport2();
+        }, {
+          title: "Placement run transport",
+          description: "The placement-aware TransportCapability instance passed to adopt() in run-worker sessions."
+        }),
+        RunRegistryBackboneCap.provide(async () => {
+          const registry = await Promise.resolve().then(() => (init_relay_registry(), exports_relay_registry));
+          return {
+            createRegistryClient: registry.createRegistryClient,
+            connectWorkerProjection: registry.connectWorkerProjection,
+            coerceRegistryStatus: registry.coerceRegistryStatus
+          };
+        }, {
+          title: "Run registry backbone",
+          description: "Transport-owned relay-registry client for run-worker room registration, heartbeat, and live projection."
+        })
+      ],
+      config: { defaults: () => ({ runtime: { server: { host: DEFAULT_RIG_BACKBONE_HOST, sshTarget: DEFAULT_RIG_SSH_TARGET } } }) }
+    }
+  });
+  plugin_default = transportPlugin;
+});
+init_plugin();
+
+export {
+  transportPlugin,
+  plugin_default as default,
+  createTransportPlugin,
+  TRANSPORT_PLUGIN_NAME,
+  RUN_DISCOVERY_CAPABILITY_ID,
+  RUN_DISCOVERY,
+  DEFAULT_RIG_SSH_TARGET,
+  DEFAULT_RIG_RELAY_URL,
+  DEFAULT_RIG_REGISTRY_URL,
+  DEFAULT_RIG_BACKBONE_HOST
+};