@oisincoveney/pipeline 1.16.0 → 1.16.2

package/dist/config.d.ts

@@ -223,8 +223,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -240,6 +240,7 @@ declare const configSchema: z.ZodObject<{
     }>;
     provider: z.ZodLiteral<"toolhive">;
     token_env: z.ZodDefault<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
     url_env: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>>;
   mcp_servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -278,10 +279,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -325,10 +326,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/config.js

@@ -132,7 +132,8 @@ const mcpGatewaySchema = z.object({
 	default_profile: z.string().min(1).optional(),
 	mode: z.enum(["hosted", "local"]),
 	provider: z.literal("toolhive"),
-	token_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_TOKEN"),
+	token_env: z.string().min(1).default("MEMORY_MCP_BASIC_AUTH"),
+	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP gateway url must use http or https" }).optional(),
 	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
 }).strict();
 const instructionsSchema = z.object({

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { PipelineConfigError, loadPipelineConfig, tryLoadPipelineConfig } from "./config.js";
-import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
 import { runKubernetesRunnerJob } from "./kubernetes-runner.js";

package/dist/install-commands.js

@@ -1,6 +1,5 @@
 import { resolveFileReference } from "./path-refs.js";
 import { loadPipelineConfig } from "./config.js";
-import { codexNativeMcpConfig } from "./mcp/native-config.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
@@ -407,7 +406,6 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 	};
 	const skillConfig = codexSkillConfig(config, cwd, profile);
 	const agentConfig = {
-		name: id,
 		description: profile.description ?? id,
 		...profileWithResolvedModel.model ? { model: profileWithResolvedModel.model } : {},
 		...profile.filesystem?.mode ? { sandbox_mode: profile.filesystem.mode } : {},
@@ -424,7 +422,6 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 			"",
 			codexAgentInstructions(cwd, profile)
 		].join("\n"),
-		...codexNativeMcpConfig(config, profile),
 		skills: { config: skillConfig }
 	};
 	const mcpConfig = "mcp_servers" in agentConfig ? agentConfig : {

package/dist/mcp/gateway.js

@@ -5,7 +5,8 @@ import { execa } from "execa";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";
-const LEGACY_CODEX_MCP_RE = /\[mcp_servers\.(?!pipeline-gateway\])/;
+const AUTHORIZATION_ENV_RE = /\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
+const LEGACY_CODEX_MCP_RE = /\[mcp_servers\./;
 const LEGACY_OPENCODE_MCP_RE = /"mcp"\s*:\s*{(?!\s*"pipeline-gateway")/s;
 const LEGACY_PIPELINE_MCP_RE = /path:\s*\.mcp\.json|uvx\s+mcpm|mcpm\s+run/;
 var PipelineMcpGatewayError = class extends Error {
@@ -25,7 +26,7 @@ function gatewayServer(config, env = process.env) {
 	const gateway = configuredGateway(config);
 	const url = gatewayUrl(gateway, env);
 	return {
-		bearer_token_env_var: gateway.token_env,
+		headers: { Authorization: gatewayAuthorizationHeader(gateway) },
 		url
 	};
 }
@@ -36,6 +37,7 @@ function configuredGateway(config) {
 function gatewayUrl(gateway, env = process.env) {
 	const url = env[gateway.url_env];
 	if (url) return url;
+	if (gateway.url) return gateway.url;
 	if (gateway.mode === "local") return DEFAULT_LOCAL_GATEWAY_URL;
 	throw new PipelineMcpGatewayError(`MCP gateway URL is required. Set ${gateway.url_env}.`);
 }
@@ -44,6 +46,7 @@ function renderGatewayConfig(config) {
 	return [
 		`provider: ${gateway.provider}`,
 		`mode: ${gateway.mode}`,
+		gateway.url ? `url: ${gateway.url}` : "",
 		`url_env: ${gateway.url_env}`,
 		`token_env: ${gateway.token_env}`,
 		gateway.default_profile ? `default_profile: ${gateway.default_profile}` : "",
@@ -53,9 +56,11 @@ function renderGatewayConfig(config) {
 function renderCodexGatewayConfig(config) {
 	const gateway = configuredGateway(config);
 	return [
-		"[mcp_servers.pipeline-gateway]",
-		`url = ${JSON.stringify(gatewayUrl(gateway))}`,
-		`bearer_token_env_var = ${JSON.stringify(gateway.token_env)}`,
+		"# Generated by @oisincoveney/pipeline.",
+		"# Codex pipeline runs receive MCP gateway config through runtime launch args.",
+		"# Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.",
+		`# gateway_url = ${JSON.stringify(gatewayUrl(gateway))}`,
+		`# token_env = ${JSON.stringify(gateway.token_env)}`,
 		""
 	].join("\n");
 }
@@ -65,7 +70,7 @@ function renderOpenCodeGatewayConfig(config) {
 		$schema: "https://opencode.ai/config.json",
 		mcp: { [PIPELINE_GATEWAY_SERVER_ID]: {
 			enabled: true,
-			headers: { Authorization: `Bearer {env:${gateway.token_env}}` },
+			headers: gatewayOpenCodeHeaders(gateway),
 			type: "remote",
 			url: gatewayUrl(gateway)
 		} }
@@ -169,6 +174,17 @@ function checkGatewayToken(gateway) {
 		passed: false
 	};
 }
+function gatewayAuthorizationHeader(gateway) {
+	return `Basic {env:${gateway.token_env}}`;
+}
+function resolveHeaderEnvPlaceholders(value, env = process.env) {
+	return value.replace(AUTHORIZATION_ENV_RE, (_match, envVar) => {
+		return env[envVar] || `{env:${envVar}}`;
+	});
+}
+function gatewayOpenCodeHeaders(gateway) {
+	return { Authorization: gatewayAuthorizationHeader(gateway) };
+}
 async function checkThv(cwd) {
 	try {
 		await execa("thv", ["version"], {
@@ -238,11 +254,12 @@ async function checkGatewayHealth(gateway) {
 	}
 }
 async function firstHealthyGatewayResponse(url, gateway) {
+	const authorization = process.env[gateway.token_env] ? `Basic ${process.env[gateway.token_env]}` : void 0;
 	for (const healthUrl of gatewayHealthUrls(url)) {
 		const response = await fetch(healthUrl, {
 			headers: {
 				Accept: "application/json, text/event-stream",
-				...process.env[gateway.token_env] ? { Authorization: `Bearer ${process.env[gateway.token_env]}` } : {}
+				...authorization ? { Authorization: authorization } : {}
 			},
 			method: "GET"
 		});
@@ -285,4 +302,4 @@ function legacyContentHit(cwd, path, pattern) {
 	return pattern.test(readFileSync(fullPath, "utf8")) ? path : void 0;
 }
 //#endregion
-export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway };
+export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderGatewayConfig, resolveHeaderEnvPlaceholders, runGatewayDoctor, startLocalGateway };

package/dist/mcp/launch-plan.js

@@ -1,4 +1,4 @@
-import { gatewayServerForProfile } from "./gateway.js";
+import { gatewayServerForProfile, resolveHeaderEnvPlaceholders } from "./gateway.js";
 import { mkdtempSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -74,7 +74,7 @@ function codexMcpArgs(servers) {
 		if (isRemoteMcpServer(server)) return [
 			"--config",
 			`mcp_servers.${id}.url=${tomlValue(server.url)}`,
-			...server.headers ? ["--config", `mcp_servers.${id}.http_headers=${tomlValue(server.headers)}`] : [],
+			...server.headers ? ["--config", `mcp_servers.${id}.http_headers=${tomlValue(codexHttpHeaders(server.headers))}`] : [],
 			...server.bearer_token_env_var ? ["--config", `mcp_servers.${id}.bearer_token_env_var=${tomlValue(server.bearer_token_env_var)}`] : []
 		];
 		return [
@@ -85,6 +85,9 @@ function codexMcpArgs(servers) {
 		];
 	});
 }
+function codexHttpHeaders(headers) {
+	return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, resolveHeaderEnvPlaceholders(value)]));
+}
 function tomlValue(value) {
 	if (Array.isArray(value)) return `[${value.map(tomlValue).join(", ")}]`;
 	if (value && typeof value === "object") return `{ ${Object.entries(value).map(([key, item]) => `${tomlKey(key)} = ${tomlValue(item)}`).join(", ")} }`;
@@ -94,4 +97,4 @@ function tomlKey(key) {
 	return TOML_BARE_KEY_PATTERN.test(key) ? key : JSON.stringify(key);
 }
 //#endregion
-export { buildMcpLaunchPlan, isRemoteMcpServer, tomlValue };
+export { buildMcpLaunchPlan, tomlValue };

package/dist/pipeline-init.js

@@ -353,7 +353,7 @@ mcp_gateway:
   provider: toolhive
   mode: local
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:

package/docs/config-architecture.md

@@ -150,8 +150,9 @@ MCP-enabled profiles use one gateway grant:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:

package/docs/mcp-gateway.md

@@ -52,8 +52,9 @@ Example profile config:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:
@@ -86,4 +87,6 @@ Use an off-the-shelf aggregator when possible:
 Use `pipe mcp gateway doctor` to check required environment variables, gateway
 health, local ToolHive availability for local mode, and legacy direct MCP
 entries. Use `pipe mcp gateway configure-host` to rewrite project or global
-Codex/OpenCode host config to gateway-only with a backup.
+host config with a backup. For Codex, this removes persistent MCP entries and
+leaves gateway metadata as comments because the runtime injects the gateway
+with `--config` only for pipeline-launched agents.

package/docs/operator-guide.md

@@ -378,8 +378,9 @@ Use the same client config shape for hosted and local gateways:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 ```
 
@@ -412,12 +413,17 @@ pipe mcp gateway local-status
 pipe mcp gateway local-start
 ```
 
-`configure-host` rewrites Codex/OpenCode config to the gateway-only shape:
+`configure-host` removes persistent Codex MCP config and records the gateway
+metadata as comments. Codex pipeline runs receive the gateway through runtime
+launch arguments so ordinary Codex sessions do not start pipeline MCP clients at
+startup:
 
 ```toml
-[mcp_servers.pipeline-gateway]
-url = "https://gateway.example/mcp"
-bearer_token_env_var = "PIPELINE_MCP_GATEWAY_TOKEN"
+# Generated by @oisincoveney/pipeline.
+# Codex pipeline runs receive MCP gateway config through runtime launch args.
+# Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.
+# gateway_url = "https://gateway.example/mcp"
+# token_env = "MEMORY_MCP_BASIC_AUTH"
 ```
 
 OpenCode receives:
@@ -521,8 +527,9 @@ singleton gateway server to profiles that need MCP.
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
 
 profiles:
   pipeline-router:

package/package.json

@@ -99,7 +99,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.16.0",
+  "version": "1.16.2",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/mcp/native-config.js

@@ -1,21 +0,0 @@
-import { gatewayServerForProfile } from "./gateway.js";
-import { isRemoteMcpServer } from "./launch-plan.js";
-//#region src/mcp/native-config.ts
-function codexNativeMcpConfig(config, profile) {
-	const mcpServers = Object.fromEntries(Object.entries(gatewayServerForProfile(config, profile)).map(([id, server]) => [id, codexNativeMcpServerConfig(server)]));
-	return Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {};
-}
-function codexNativeMcpServerConfig(server) {
-	if (isRemoteMcpServer(server)) return {
-		...server.bearer_token_env_var ? { bearer_token_env_var: server.bearer_token_env_var } : {},
-		...server.headers ? { http_headers: server.headers } : {},
-		url: server.url
-	};
-	return {
-		...server.args ? { args: server.args } : {},
-		command: server.command,
-		...server.env ? { env: server.env } : {}
-	};
-}
-//#endregion
-export { codexNativeMcpConfig };