@oisincoveney/pipeline 1.16.1 → 1.16.2

package/dist/config.d.ts

@@ -223,8 +223,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -240,6 +240,7 @@ declare const configSchema: z.ZodObject<{
     }>;
     provider: z.ZodLiteral<"toolhive">;
     token_env: z.ZodDefault<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
     url_env: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>>;
   mcp_servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -278,10 +279,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -325,10 +326,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/config.js

@@ -132,7 +132,8 @@ const mcpGatewaySchema = z.object({
 	default_profile: z.string().min(1).optional(),
 	mode: z.enum(["hosted", "local"]),
 	provider: z.literal("toolhive"),
-	token_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_TOKEN"),
+	token_env: z.string().min(1).default("MEMORY_MCP_BASIC_AUTH"),
+	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP gateway url must use http or https" }).optional(),
 	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
 }).strict();
 const instructionsSchema = z.object({

package/dist/mcp/gateway.js

@@ -5,6 +5,7 @@ import { execa } from "execa";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";
+const AUTHORIZATION_ENV_RE = /\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
 const LEGACY_CODEX_MCP_RE = /\[mcp_servers\./;
 const LEGACY_OPENCODE_MCP_RE = /"mcp"\s*:\s*{(?!\s*"pipeline-gateway")/s;
 const LEGACY_PIPELINE_MCP_RE = /path:\s*\.mcp\.json|uvx\s+mcpm|mcpm\s+run/;
@@ -25,7 +26,7 @@ function gatewayServer(config, env = process.env) {
 	const gateway = configuredGateway(config);
 	const url = gatewayUrl(gateway, env);
 	return {
-		bearer_token_env_var: gateway.token_env,
+		headers: { Authorization: gatewayAuthorizationHeader(gateway) },
 		url
 	};
 }
@@ -36,6 +37,7 @@ function configuredGateway(config) {
 function gatewayUrl(gateway, env = process.env) {
 	const url = env[gateway.url_env];
 	if (url) return url;
+	if (gateway.url) return gateway.url;
 	if (gateway.mode === "local") return DEFAULT_LOCAL_GATEWAY_URL;
 	throw new PipelineMcpGatewayError(`MCP gateway URL is required. Set ${gateway.url_env}.`);
 }
@@ -44,6 +46,7 @@ function renderGatewayConfig(config) {
 	return [
 		`provider: ${gateway.provider}`,
 		`mode: ${gateway.mode}`,
+		gateway.url ? `url: ${gateway.url}` : "",
 		`url_env: ${gateway.url_env}`,
 		`token_env: ${gateway.token_env}`,
 		gateway.default_profile ? `default_profile: ${gateway.default_profile}` : "",
@@ -67,7 +70,7 @@ function renderOpenCodeGatewayConfig(config) {
 		$schema: "https://opencode.ai/config.json",
 		mcp: { [PIPELINE_GATEWAY_SERVER_ID]: {
 			enabled: true,
-			headers: { Authorization: `Bearer {env:${gateway.token_env}}` },
+			headers: gatewayOpenCodeHeaders(gateway),
 			type: "remote",
 			url: gatewayUrl(gateway)
 		} }
@@ -171,6 +174,17 @@ function checkGatewayToken(gateway) {
 		passed: false
 	};
 }
+function gatewayAuthorizationHeader(gateway) {
+	return `Basic {env:${gateway.token_env}}`;
+}
+function resolveHeaderEnvPlaceholders(value, env = process.env) {
+	return value.replace(AUTHORIZATION_ENV_RE, (_match, envVar) => {
+		return env[envVar] || `{env:${envVar}}`;
+	});
+}
+function gatewayOpenCodeHeaders(gateway) {
+	return { Authorization: gatewayAuthorizationHeader(gateway) };
+}
 async function checkThv(cwd) {
 	try {
 		await execa("thv", ["version"], {
@@ -240,11 +254,12 @@ async function checkGatewayHealth(gateway) {
 	}
 }
 async function firstHealthyGatewayResponse(url, gateway) {
+	const authorization = process.env[gateway.token_env] ? `Basic ${process.env[gateway.token_env]}` : void 0;
 	for (const healthUrl of gatewayHealthUrls(url)) {
 		const response = await fetch(healthUrl, {
 			headers: {
 				Accept: "application/json, text/event-stream",
-				...process.env[gateway.token_env] ? { Authorization: `Bearer ${process.env[gateway.token_env]}` } : {}
+				...authorization ? { Authorization: authorization } : {}
 			},
 			method: "GET"
 		});
@@ -287,4 +302,4 @@ function legacyContentHit(cwd, path, pattern) {
 	return pattern.test(readFileSync(fullPath, "utf8")) ? path : void 0;
 }
 //#endregion
-export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway };
+export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderGatewayConfig, resolveHeaderEnvPlaceholders, runGatewayDoctor, startLocalGateway };

package/dist/mcp/launch-plan.js

@@ -1,4 +1,4 @@
-import { gatewayServerForProfile } from "./gateway.js";
+import { gatewayServerForProfile, resolveHeaderEnvPlaceholders } from "./gateway.js";
 import { mkdtempSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -74,7 +74,7 @@ function codexMcpArgs(servers) {
 		if (isRemoteMcpServer(server)) return [
 			"--config",
 			`mcp_servers.${id}.url=${tomlValue(server.url)}`,
-			...server.headers ? ["--config", `mcp_servers.${id}.http_headers=${tomlValue(server.headers)}`] : [],
+			...server.headers ? ["--config", `mcp_servers.${id}.http_headers=${tomlValue(codexHttpHeaders(server.headers))}`] : [],
 			...server.bearer_token_env_var ? ["--config", `mcp_servers.${id}.bearer_token_env_var=${tomlValue(server.bearer_token_env_var)}`] : []
 		];
 		return [
@@ -85,6 +85,9 @@ function codexMcpArgs(servers) {
 		];
 	});
 }
+function codexHttpHeaders(headers) {
+	return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key, resolveHeaderEnvPlaceholders(value)]));
+}
 function tomlValue(value) {
 	if (Array.isArray(value)) return `[${value.map(tomlValue).join(", ")}]`;
 	if (value && typeof value === "object") return `{ ${Object.entries(value).map(([key, item]) => `${tomlKey(key)} = ${tomlValue(item)}`).join(", ")} }`;

package/dist/pipeline-init.js

@@ -353,7 +353,7 @@ mcp_gateway:
   provider: toolhive
   mode: local
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:

package/docs/config-architecture.md

@@ -150,8 +150,9 @@ MCP-enabled profiles use one gateway grant:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:

package/docs/mcp-gateway.md

@@ -52,8 +52,9 @@ Example profile config:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 
 profiles:

package/docs/operator-guide.md

@@ -378,8 +378,9 @@ Use the same client config shape for hosted and local gateways:
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
   default_profile: default
 ```
 
@@ -422,7 +423,7 @@ startup:
 # Codex pipeline runs receive MCP gateway config through runtime launch args.
 # Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.
 # gateway_url = "https://gateway.example/mcp"
-# token_env = "PIPELINE_MCP_GATEWAY_TOKEN"
+# token_env = "MEMORY_MCP_BASIC_AUTH"
 ```
 
 OpenCode receives:
@@ -526,8 +527,9 @@ singleton gateway server to profiles that need MCP.
 mcp_gateway:
   provider: toolhive
   mode: hosted
+  url: https://pipeline-mcp.momokaya.ee/mcp/
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: PIPELINE_MCP_GATEWAY_TOKEN
+  token_env: MEMORY_MCP_BASIC_AUTH
 
 profiles:
   pipeline-router:

package/package.json

@@ -99,7 +99,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.16.1",
+  "version": "1.16.2",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",