@oisincoveney/pipeline 1.26.1 → 1.27.0

package/.agents/skills/inspect/SKILL.md

@@ -23,7 +23,7 @@ Orchestrate package-owned pipeline config.
 Run workflow `inspect` for the user task.
 These nodes are not Codex native routes.
 CLI routes:
-- inspect: opencode CLI profile=pipeline-inspector command=`opencode run --agent pipeline-inspector --format json --dir <repo-root> <node prompt>` needs=none
+- inspect: opencode CLI profile=moka-inspector command=`opencode run --agent "MoKa Inspector" --format json --dir <repo-root> <node prompt>` needs=none
 
 For each CLI node prompt include:
 - user task

package/README.md

@@ -164,10 +164,17 @@ validation, contract-version checks, and JSON Schema generation.
 
 Pipeline Console submits hosted runs through `@oisincoveney/pipeline/moka-submit`.
 The subpath exports `mokaSubmitOptionsSchema`, `mokaSubmitResultSchema`,
-`MokaSubmitOptionsInput`, `MokaSubmitOptionsOutput`, `MokaSubmitInput`,
+`mokaSubmitDirectHooksSchema`, `mokaSubmitHookPolicySchema`,
+`MokaSubmitOptionsInput`, `MokaSubmitOptionsOutput`,
+`MokaSubmitDirectHooksInput`, `MokaSubmitHookPolicyInput`, `MokaSubmitInput`,
 `MokaSubmitOutput`, and `submitMoka` so callers can validate prompt or ticket
-tasks with explicit repository, run, delivery, event sink, and runner settings
-without importing Argo, Kubernetes, or runner-command internals.
+tasks with explicit repository, run, delivery, event sink, lifecycle hooks, hook
+policy, and runner settings without importing Argo, Kubernetes, or
+runner-command internals. `eventSink` is runner event transport; direct `hooks`
+configure runner-side lifecycle behavior and are normalized into internal
+runtime hook config by the package. Direct hook function ids are generated as
+`moka-submit-<event-name-with-dashes>`; existing package hooks are preserved,
+and a generated id that already exists in the supplied config is rejected.
 
 ## Configuration Model
 

package/defaults/opencode-ecosystem.yaml

@@ -148,50 +148,50 @@ skills:
     used_by: [orchestrator]
   - id: inspect
     path: .agents/skills/inspect/SKILL.md
-    used_by: [pipeline-inspector]
+    used_by: [moka-inspector]
   - id: epic
     path: .agents/skills/epic/SKILL.md
-    used_by: [pipeline-epic-router]
+    used_by: [moka-epic-router]
   - id: execute
     path: .agents/skills/execute/SKILL.md
-    used_by: [pipeline-code-writer]
+    used_by: [moka-code-writer]
   - id: research
     path: .agents/skills/research/SKILL.md
-    used_by: [pipeline-researcher]
+    used_by: [moka-researcher]
   - id: library-first-development
     path: .agents/skills/library-first-development/SKILL.md
-    used_by: [pipeline-researcher, pipeline-code-writer]
+    used_by: [moka-researcher, moka-code-writer]
   - id: critique
     path: .agents/skills/critique/SKILL.md
-    used_by: [pipeline-thermo-nuclear-reviewer]
+    used_by: [moka-thermo-nuclear-reviewer]
   - id: verify
     path: .agents/skills/verify/SKILL.md
-    used_by: [pipeline-verifier]
+    used_by: [moka-verifier]
 prompts:
   - id: orchestrator
     source: package-default-profile
     used_by: [orchestrator]
   - id: researcher
     source: package-default-profile
-    used_by: [pipeline-researcher]
+    used_by: [moka-researcher]
   - id: inspector
     source: package-default-profile
-    used_by: [pipeline-inspector]
+    used_by: [moka-inspector]
   - id: schedule-planner
     source: package-default-profile
-    used_by: [pipeline-schedule-planner]
+    used_by: [moka-schedule-planner]
   - id: test-writer
     source: package-default-profile
-    used_by: [pipeline-test-writer]
+    used_by: [moka-test-writer]
   - id: code-writer
     source: package-default-profile
-    used_by: [pipeline-code-writer]
+    used_by: [moka-code-writer]
   - id: acceptance-reviewer
     source: package-default-profile
-    used_by: [pipeline-acceptance-reviewer]
+    used_by: [moka-acceptance-reviewer]
   - id: verifier
     source: package-default-profile
-    used_by: [pipeline-verifier]
+    used_by: [moka-verifier]
 host_capabilities:
   agents: true
   subagents: true

package/dist/config.d.ts

@@ -452,6 +452,7 @@ declare const configSchema: z.ZodObject<{
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      task: "task";
       read: "read";
       list: "list";
       grep: "grep";
@@ -459,7 +460,6 @@ declare const configSchema: z.ZodObject<{
       bash: "bash";
       edit: "edit";
       write: "write";
-      task: "task";
     }>>>;
   }, z.core.$strict>>>;
   runner_command: z.ZodDefault<z.ZodObject<{
@@ -485,8 +485,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -511,6 +511,7 @@ declare const configSchema: z.ZodObject<{
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        task: "task";
         read: "read";
         list: "list";
         grep: "grep";
@@ -518,15 +519,14 @@ declare const configSchema: z.ZodObject<{
         bash: "bash";
         edit: "edit";
         write: "write";
-        task: "task";
       }>>>;
     }, z.core.$strict>;
     command: z.ZodOptional<z.ZodString>;
     host_models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     model: z.ZodOptional<z.ZodString>;
     type: z.ZodEnum<{
-      opencode: "opencode";
       command: "command";
+      opencode: "opencode";
     }>;
   }, z.core.$strict>>>;
   scheduler: z.ZodDefault<z.ZodObject<{
@@ -613,8 +613,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      execute: "execute";
       quick: "quick";
+      execute: "execute";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;
@@ -626,8 +626,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/config.js

@@ -124,6 +124,15 @@ mcp_gateway:
       workspace_path_source: PIPELINE_TARGET_PATH
       tool_prefixes: [backlog]
 skills:
+  execute:
+    path: .agents/skills/execute/SKILL.md
+    source_root: package
+  inspect:
+    path: .agents/skills/inspect/SKILL.md
+    source_root: package
+  quick:
+    path: .agents/skills/quick/SKILL.md
+    source_root: package
   critique:
     path: .agents/skills/critique/SKILL.md
     source_root: package
@@ -167,7 +176,16 @@ skills:
     path: .agents/skills/verify/SKILL.md
     source_root: package
 profiles:
-  pipeline-researcher:
+  moka-orchestrator:
+    runner: opencode
+    description: Orchestrate the configured pipeline and enforce gates.
+    instructions: { inline: "Orchestrate the configured pipeline through package-defined entrypoints, native agents, and gates. Do not bypass configured runner subprocesses or package-configured gates." }
+    skills: [execute, quick, inspect]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+  moka-researcher:
     runner: opencode
     description: Research the requested task and produce structured findings.
     instructions: { inline: "Inspect first-party source, tests, docs, and task context for the current task only. Produce concise findings with file references and stop; do not perform open-ended repository exploration." }
@@ -181,7 +199,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/research.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-inspector:
+  moka-inspector:
     runner: opencode
     description: Inspect the repository without modifying files.
     instructions: { inline: "Inspect the repository without modifying files." }
@@ -190,7 +208,7 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
-  pipeline-schedule-planner:
+  moka-schedule-planner:
     runner: opencode
     description: Refine a baseline schedule into a specialized approved-plan artifact.
     instructions: { inline: "Generate exactly one workflow named root as an explicit schedule graph. Return YAML only." }
@@ -200,7 +218,7 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
-  pipeline-test-writer:
+  moka-test-writer:
     runner: opencode
     scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
@@ -214,7 +232,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/implementation.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-code-writer:
+  moka-code-writer:
     runner: opencode
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
@@ -228,7 +246,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/implementation.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-acceptance-reviewer:
+  moka-acceptance-reviewer:
     runner: opencode
     scheduling_roles: [coverage]
     description: Audit the finished change against every acceptance criterion.
@@ -242,7 +260,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/acceptance.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-thermo-nuclear-reviewer:
+  moka-thermo-nuclear-reviewer:
     runner: opencode
     scheduling_roles: [coverage]
     description: Perform the final thermo-nuclear code quality review of the integration branch.
@@ -256,7 +274,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/review.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-verifier:
+  moka-verifier:
     runner: opencode
     scheduling_roles: [coverage]
     description: Verify checks, implementation fit, and final evidence.
@@ -270,7 +288,7 @@ profiles:
       format: json_schema
       schema_path: .pipeline/schemas/verify.schema.json
       repair: { enabled: true, max_attempts: 1 }
-  pipeline-learner:
+  moka-learner:
     runner: opencode
     description: Store durable lessons from the completed run.
     instructions: { inline: "Store durable lessons from the completed run when useful." }
@@ -286,6 +304,8 @@ profiles:
 `;
 const PACKAGE_DEFAULT_PIPELINE_YAML = `version: 1
 default_workflow: inspect
+orchestrator:
+  profile: moka-orchestrator
 entrypoints:
   quick:
     schedule: quick-schedule
@@ -323,63 +343,63 @@ scheduler:
       nodes:
         backlog-intake:
           category: intake
-          profile: pipeline-researcher
+          profile: moka-researcher
           models: [zai-coding-plan/glm-5-turbo, openai/gpt-5.5-fast]
         red-tests:
           category: red
-          profile: pipeline-test-writer
+          profile: moka-test-writer
           models: [openai/gpt-5.5, zai-coding-plan/glm-5.1, kimi-for-coding/kimi-k2-thinking]
         green-implementation:
           category: green
-          profile: pipeline-code-writer
+          profile: moka-code-writer
           models: [opencode-go/qwen3.7-max, kimi-for-coding/k2p6, opencode-go/deepseek-v4-pro]
         verification:
           category: verification
-          profile: pipeline-verifier
+          profile: moka-verifier
           models: [openai/gpt-5.5, zai-coding-plan/glm-5.1]
     execute:
       required_categories: [intake, research, red, green, mechanical, acceptance, verification, learn]
       nodes:
         backlog-intake:
           category: intake
-          profile: pipeline-researcher
+          profile: moka-researcher
           models: [zai-coding-plan/glm-5-turbo, openai/gpt-5.5-fast]
         research:
           category: research
-          profile: pipeline-researcher
+          profile: moka-researcher
           models: [openai/gpt-5.5-fast, zai-coding-plan/glm-5.1, kimi-for-coding/k2p6]
         red-tests:
           category: red
-          profile: pipeline-test-writer
+          profile: moka-test-writer
           models: [openai/gpt-5.5, zai-coding-plan/glm-5.1, kimi-for-coding/kimi-k2-thinking]
         green-backend:
           category: green
-          profile: pipeline-code-writer
+          profile: moka-code-writer
           models: [opencode-go/qwen3.7-max, kimi-for-coding/k2p6, opencode-go/deepseek-v4-pro]
         green-frontend:
           category: green
-          profile: pipeline-code-writer
+          profile: moka-code-writer
           models: [opencode-go/qwen3.7-max, kimi-for-coding/k2p6, opencode-go/deepseek-v4-pro]
         acceptance-review:
           category: acceptance
-          profile: pipeline-acceptance-reviewer
+          profile: moka-acceptance-reviewer
           models: [openai/gpt-5.5, zai-coding-plan/glm-5.1]
         verification:
           category: verification
-          profile: pipeline-verifier
+          profile: moka-verifier
           models: [openai/gpt-5.5, zai-coding-plan/glm-5.1]
         learn:
           category: learn
-          profile: pipeline-learner
+          profile: moka-learner
           models: [zai-coding-plan/glm-5-turbo, openai/gpt-5.5-fast]
 schedules:
   quick-schedule:
     baseline: quick
-    planner_profile: pipeline-schedule-planner
+    planner_profile: moka-schedule-planner
     node_catalog: quick
   execute-schedule:
     baseline: execute
-    planner_profile: pipeline-schedule-planner
+    planner_profile: moka-schedule-planner
     node_catalog: execute
 workflows:
   inspect:
@@ -387,7 +407,7 @@ workflows:
     nodes:
       - id: inspect
         kind: agent
-        profile: pipeline-inspector
+        profile: moka-inspector
 `;
 const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST_URL = new URL(`../${OPENCODE_ECOSYSTEM_MANIFEST_PATH}`, import.meta.url);
 const PACKAGE_ASSET_ROOT = new URL("..", import.meta.url);

package/dist/install-commands.js

@@ -21,6 +21,8 @@ const SINGLE_OPENCODE_PLUGIN_ARRAY_RE = /\n {2}"plugin": \[\n {4}("[^"]+")\n {2}
 const OPENCODE_PROJECT_CONFIG_PATH = ".opencode/opencode.json";
 const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/([^/]+)\.md$/] };
 const COMMAND_HOSTS = ["opencode"];
+const OPENCODE_ORCHESTRATOR_AGENT_ID = "MoKa Orchestrator";
+const MOKA_PROFILE_PREFIX = "moka-";
 function header(host) {
 	return [
 		GENERATED_MARKER,
@@ -32,9 +34,7 @@ function markdown(data, body) {
 	return `${matter.stringify(body.trimEnd(), data).trimEnd()}\n`;
 }
 function profileEntries(config) {
-	const profileIds = /* @__PURE__ */ new Set();
-	for (const workflow of Object.values(config.workflows)) for (const node of workflow.nodes) if (node.kind === "agent" && node.profile) profileIds.add(node.profile);
-	return [...profileIds].sort((a, b) => a.localeCompare(b)).map((id) => [id, config.profiles[id]]);
+	return Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b));
 }
 function entrypointEntries(config) {
 	const entries = Object.entries(config.entrypoints);
@@ -50,7 +50,7 @@ function entrypointCommandDefinitions(_host, config, makeDefinition) {
 	return entrypointEntries(config).map(([id, entrypoint]) => makeDefinition(id, entrypoint));
 }
 function nativeProfileEntries(host, config) {
-	return profileEntries(config).filter(([_, profile]) => canRunNatively(host, profile));
+	return profileEntries(config).filter(([id, profile]) => id !== config.orchestrator?.profile && canRunNatively(host, profile));
 }
 function orchestratorProfile(config) {
 	if (!config.orchestrator) return;
@@ -94,7 +94,7 @@ function dispatchRouteForAgent(host, config, route) {
 			...route,
 			kind: "native-named-agent",
 			...model ? { model } : {},
-			nativeAgentId: route.profileId,
+			nativeAgentId: nativeAgentIdForHost(host, route.profileId),
 			runnerId
 		};
 	}
@@ -104,7 +104,7 @@ function dispatchRouteForAgent(host, config, route) {
 			...route,
 			kind: "native-model-agent",
 			...model ? { model } : {},
-			nativeAgentId: route.profileId,
+			nativeAgentId: nativeAgentIdForHost(host, route.profileId),
 			runnerId
 		};
 	}
@@ -114,6 +114,17 @@ function dispatchRouteForAgent(host, config, route) {
 		runnerId
 	};
 }
+function nativeAgentIdForHost(host, profileId) {
+	return host === "opencode" ? opencodeAgentName(profileId) : profileId;
+}
+function opencodeAgentName(profileId) {
+	if (!profileId.startsWith(MOKA_PROFILE_PREFIX)) return profileId;
+	return `MoKa ${profileId.slice(5).split("-").map(opencodeAgentNamePart).join(" ")}`;
+}
+function opencodeAgentNamePart(part) {
+	if (part === "opencode") return "OpenCode";
+	return `${part.charAt(0).toUpperCase()}${part.slice(1)}`;
+}
 function grants(actor) {
 	return [
 		`model: ${actor.model ?? "default"}`,
@@ -201,7 +212,7 @@ function cliDispatchLine(route) {
 	return `- ${route.nodeId}: ${route.runnerId} CLI profile=${route.profileId} command=\`${runnerCliCommand(route)}\` needs=${needsSummary(route.needs)}`;
 }
 function runnerCliCommand(route) {
-	if (route.runnerId === "opencode") return `opencode run --agent ${route.profileId} --format json --dir <repo-root> <node prompt>`;
+	if (route.runnerId === "opencode") return `opencode run --agent "${opencodeAgentName(route.profileId)}" --format json --dir <repo-root> <node prompt>`;
 	throw new Error(`runner '${route.runnerId}' cannot be represented as a supported native or CLI route`);
 }
 function nodePromptContract(workflowId, routes) {
@@ -352,7 +363,7 @@ function opencodeDefinitions(config, cwd) {
 	return [
 		...entrypointCommandDefinitions("opencode", config, (id, entrypoint) => ({
 			content: markdown({
-				...orchestrator ? { agent: "pipeline-orchestrator" } : {},
+				...orchestrator ? { agent: OPENCODE_ORCHESTRATOR_AGENT_ID } : {},
 				description: entrypointDescription(id, entrypoint)
 			}, compactLines([
 				header("opencode").trimEnd(),
@@ -379,6 +390,7 @@ function opencodeDefinitions(config, cwd) {
 			content: markdown({
 				description: "Orchestrate the configured pipeline and enforce gates.",
 				mode: "primary",
+				name: OPENCODE_ORCHESTRATOR_AGENT_ID,
 				permission: opencodePermission(orchestrator, { allowedTaskAgents: agentDispatchRoutes("opencode", config).filter((route) => route.kind !== "cli").map((route) => route.nativeAgentId).filter((id) => Boolean(id)) })
 			}, compactLines([
 				header("opencode").trimEnd(),
@@ -389,10 +401,11 @@ function opencodeDefinitions(config, cwd) {
 			]).join("\n")),
 			host: "opencode",
 			invocation: invocationForHost("opencode"),
-			path: ".opencode/agents/pipeline-orchestrator.md"
+			path: `.opencode/agents/${OPENCODE_ORCHESTRATOR_AGENT_ID}.md`
 		}] : [],
 		...nativeProfileEntries("opencode", config).map(([id, profile]) => ({
 			content: markdown({
+				name: nativeAgentIdForHost("opencode", id),
 				description: profile.description ?? id,
 				hidden: false,
 				mode: "subagent",
@@ -410,7 +423,7 @@ function opencodeDefinitions(config, cwd) {
 			].join("\n")),
 			host: "opencode",
 			invocation: invocationForHost("opencode"),
-			path: `.opencode/agents/${id}.md`
+			path: `.opencode/agents/${nativeAgentIdForHost("opencode", id)}.md`
 		})),
 		...opencodeSkillProjections(config, cwd).map(opencodeSkillDefinition),
 		...localPluginDefinitions(),

package/dist/moka-submit.d.ts

@@ -3,6 +3,59 @@ import { generateScheduleArtifact } from "./schedule-planner.js";
 import { z } from "zod";
 
 //#region src/moka-submit.d.ts
+declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
+  "workflow.start": "workflow.start";
+  "workflow.success": "workflow.success";
+  "workflow.failure": "workflow.failure";
+  "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
+  "node.success": "node.success";
+  "node.error": "node.error";
+  "node.finish": "node.finish";
+  "gate.failure": "gate.failure";
+}> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
+  failure: z.ZodDefault<z.ZodEnum<{
+    fail: "fail";
+    ignore: "ignore";
+  }>>;
+  input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  publishResult: z.ZodOptional<z.ZodBoolean>;
+  saveResultAs: z.ZodOptional<z.ZodString>;
+  timeoutMs: z.ZodOptional<z.ZodNumber>;
+  where: z.ZodOptional<z.ZodObject<{
+    gate: z.ZodOptional<z.ZodString>;
+    node: z.ZodOptional<z.ZodString>;
+    workflow: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
+  command: z.ZodArray<z.ZodString>;
+  kind: z.ZodLiteral<"command">;
+  outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+  trusted: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+  failure: z.ZodDefault<z.ZodEnum<{
+    fail: "fail";
+    ignore: "ignore";
+  }>>;
+  input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  publishResult: z.ZodOptional<z.ZodBoolean>;
+  saveResultAs: z.ZodOptional<z.ZodString>;
+  timeoutMs: z.ZodOptional<z.ZodNumber>;
+  where: z.ZodOptional<z.ZodObject<{
+    gate: z.ZodOptional<z.ZodString>;
+    node: z.ZodOptional<z.ZodString>;
+    workflow: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>>;
+  kind: z.ZodLiteral<"module">;
+  module: z.ZodString;
+}, z.core.$strict>], "kind">>;
+declare const mokaSubmitHookPolicySchema: z.ZodObject<{
+  allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
+  allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
+  env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  envPassthrough: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+  timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
 declare const mokaSubmitResultSchema: z.ZodObject<{
   namespace: z.ZodString;
   payloadConfigMapName: z.ZodString;
@@ -15,6 +68,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   delivery: z.ZodDefault<z.ZodObject<{
     pullRequest: z.ZodDefault<z.ZodBoolean>;
   }, z.core.$strict>>;
+  eventSink: z.ZodOptional<z.ZodObject<{
+    authHeader: z.ZodDefault<z.ZodString>;
+    authTokenFile: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+  }, z.core.$strict>>;
   eventAuthSecretKey: z.ZodDefault<z.ZodString>;
   eventAuthSecretName: z.ZodDefault<z.ZodString>;
   eventUrl: z.ZodDefault<z.ZodString>;
@@ -25,6 +83,59 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  hookPolicy: z.ZodOptional<z.ZodObject<{
+    allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    envPassthrough: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
+  hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+    "workflow.start": "workflow.start";
+    "workflow.success": "workflow.success";
+    "workflow.failure": "workflow.failure";
+    "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
+    "node.success": "node.success";
+    "node.error": "node.error";
+    "node.finish": "node.finish";
+    "gate.failure": "gate.failure";
+  }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    failure: z.ZodDefault<z.ZodEnum<{
+      fail: "fail";
+      ignore: "ignore";
+    }>>;
+    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    publishResult: z.ZodOptional<z.ZodBoolean>;
+    saveResultAs: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    where: z.ZodOptional<z.ZodObject<{
+      gate: z.ZodOptional<z.ZodString>;
+      node: z.ZodOptional<z.ZodString>;
+      workflow: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    command: z.ZodArray<z.ZodString>;
+    kind: z.ZodLiteral<"command">;
+    outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+    trusted: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$strict>, z.ZodObject<{
+    failure: z.ZodDefault<z.ZodEnum<{
+      fail: "fail";
+      ignore: "ignore";
+    }>>;
+    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    publishResult: z.ZodOptional<z.ZodBoolean>;
+    saveResultAs: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    where: z.ZodOptional<z.ZodObject<{
+      gate: z.ZodOptional<z.ZodString>;
+      node: z.ZodOptional<z.ZodString>;
+      workflow: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"module">;
+    module: z.ZodString;
+  }, z.core.$strict>], "kind">>>;
   image: z.ZodOptional<z.ZodString>;
   imagePullPolicy: z.ZodDefault<z.ZodEnum<{
     Always: "Always";
@@ -49,8 +160,8 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   serviceAccountName: z.ZodDefault<z.ZodString>;
   mode: z.ZodEnum<{
-    quick: "quick";
     full: "full";
+    quick: "quick";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;
@@ -69,6 +180,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   delivery: z.ZodDefault<z.ZodObject<{
     pullRequest: z.ZodDefault<z.ZodBoolean>;
   }, z.core.$strict>>;
+  eventSink: z.ZodOptional<z.ZodObject<{
+    authHeader: z.ZodDefault<z.ZodString>;
+    authTokenFile: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+  }, z.core.$strict>>;
   eventAuthSecretKey: z.ZodDefault<z.ZodString>;
   eventAuthSecretName: z.ZodDefault<z.ZodString>;
   eventUrl: z.ZodDefault<z.ZodString>;
@@ -79,6 +195,59 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  hookPolicy: z.ZodOptional<z.ZodObject<{
+    allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    envPassthrough: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
+  hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+    "workflow.start": "workflow.start";
+    "workflow.success": "workflow.success";
+    "workflow.failure": "workflow.failure";
+    "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
+    "node.success": "node.success";
+    "node.error": "node.error";
+    "node.finish": "node.finish";
+    "gate.failure": "gate.failure";
+  }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    failure: z.ZodDefault<z.ZodEnum<{
+      fail: "fail";
+      ignore: "ignore";
+    }>>;
+    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    publishResult: z.ZodOptional<z.ZodBoolean>;
+    saveResultAs: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    where: z.ZodOptional<z.ZodObject<{
+      gate: z.ZodOptional<z.ZodString>;
+      node: z.ZodOptional<z.ZodString>;
+      workflow: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    command: z.ZodArray<z.ZodString>;
+    kind: z.ZodLiteral<"command">;
+    outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+    trusted: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$strict>, z.ZodObject<{
+    failure: z.ZodDefault<z.ZodEnum<{
+      fail: "fail";
+      ignore: "ignore";
+    }>>;
+    input: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    publishResult: z.ZodOptional<z.ZodBoolean>;
+    saveResultAs: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    where: z.ZodOptional<z.ZodObject<{
+      gate: z.ZodOptional<z.ZodString>;
+      node: z.ZodOptional<z.ZodString>;
+      workflow: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"module">;
+    module: z.ZodString;
+  }, z.core.$strict>], "kind">>>;
   image: z.ZodOptional<z.ZodString>;
   imagePullPolicy: z.ZodDefault<z.ZodEnum<{
     Always: "Always";
@@ -117,6 +286,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>], "type">;
 type MokaSubmitOptionsInput = z.input<typeof mokaSubmitOptionsSchema>;
 type MokaSubmitOptionsOutput = z.output<typeof mokaSubmitOptionsSchema>;
+type MokaSubmitDirectHooksInput = z.input<typeof mokaSubmitDirectHooksSchema>;
+type MokaSubmitDirectHooksOutput = z.output<typeof mokaSubmitDirectHooksSchema>;
+type MokaSubmitHookPolicyInput = z.input<typeof mokaSubmitHookPolicySchema>;
+type MokaSubmitHookPolicyOutput = z.output<typeof mokaSubmitHookPolicySchema>;
 type MokaSubmitInput = MokaSubmitOptionsInput & {
   config: PipelineConfig;
   worktreePath?: string;
@@ -157,4 +330,4 @@ interface MokaWorkflowSubmitOptions {
 }
 declare function submitMoka(rawOptions: MokaSubmitInput, dependencies?: SubmitMokaDependencies): Promise<MokaSubmitOutput>;
 //#endregion
-export { MokaSubmitInput, MokaSubmitOptions, MokaSubmitOptionsInput, MokaSubmitOptionsOutput, MokaSubmitOutput, MokaSubmitResult, mokaSubmitOptionsSchema, mokaSubmitResultSchema, submitMoka };
+export { MokaSubmitDirectHooksInput, MokaSubmitDirectHooksOutput, MokaSubmitHookPolicyInput, MokaSubmitHookPolicyOutput, MokaSubmitInput, MokaSubmitOptions, MokaSubmitOptionsInput, MokaSubmitOptionsOutput, MokaSubmitOutput, MokaSubmitResult, mokaSubmitDirectHooksSchema, mokaSubmitHookPolicySchema, mokaSubmitOptionsSchema, mokaSubmitResultSchema, submitMoka };

package/dist/moka-submit.js

@@ -1,4 +1,4 @@
-import { buildRunnerCommandPayload, runnerDeliverySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
+import { buildRunnerCommandPayload, runnerDeliverySchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import { buildCommandScheduleYaml, submitRunnerArgoWorkflow } from "./argo-submit.js";
@@ -28,15 +28,55 @@ const mokaSubmitEventsSchema = z.object({
 	authTokenFile: z.string().min(1).optional(),
 	url: z.string().url()
 }).strict();
+const MOKA_SUBMIT_HOOK_EVENTS = [
+	"workflow.start",
+	"workflow.success",
+	"workflow.failure",
+	"workflow.complete",
+	"node.start",
+	"node.success",
+	"node.error",
+	"node.finish",
+	"gate.failure"
+];
+const mokaSubmitHookWhereSchema = z.object({
+	gate: z.string().min(1).optional(),
+	node: z.string().min(1).optional(),
+	workflow: z.string().min(1).optional()
+}).strict();
+const mokaSubmitHookBaseSchema = z.object({
+	failure: z.enum(["fail", "ignore"]).default("ignore"),
+	input: z.record(z.string(), z.unknown()).optional(),
+	publishResult: z.boolean().optional(),
+	saveResultAs: z.string().min(1).optional(),
+	timeoutMs: z.number().int().positive().optional(),
+	where: mokaSubmitHookWhereSchema.optional()
+}).strict();
+const mokaSubmitCommandHookSchema = mokaSubmitHookBaseSchema.extend({
+	command: z.array(z.string().min(1)).min(1),
+	kind: z.literal("command"),
+	outputLimitBytes: z.number().int().positive().optional(),
+	trusted: z.boolean().optional()
+}).strict();
+const mokaSubmitModuleHookSchema = mokaSubmitHookBaseSchema.extend({
+	kind: z.literal("module"),
+	module: z.string().min(1)
+}).strict();
+const mokaSubmitDirectHookSchema = z.discriminatedUnion("kind", [mokaSubmitCommandHookSchema, mokaSubmitModuleHookSchema]);
+const mokaSubmitDirectHooksSchema = z.partialRecord(z.enum(MOKA_SUBMIT_HOOK_EVENTS), mokaSubmitDirectHookSchema);
+const mokaSubmitHookPolicySchema = runnerHookPolicySchema;
 const mokaSubmitResultSchema = workflowSubmitResultSchema;
 const mokaSubmitBaseOptionsSchema = z.object({
 	delivery: runnerDeliverySchema.default({ pullRequest: false }),
+	eventSink: mokaSubmitEventsSchema.optional(),
 	eventAuthSecretKey: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_KEY),
 	eventAuthSecretName: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_NAME),
 	eventUrl: z.string().url().default(MOMOKAYA_EVENT_URL),
 	events: mokaSubmitEventsSchema.optional(),
 	generateName: z.string().min(1).optional(),
 	githubAuthSecretName: z.string().min(1).default(MOMOKAYA_GITHUB_AUTH_SECRET_NAME),
+	hookPolicy: mokaSubmitHookPolicySchema.optional(),
+	hooks: mokaSubmitDirectHooksSchema.optional(),
 	image: z.string().min(1).optional(),
 	imagePullPolicy: imagePullPolicySchema,
 	imagePullSecretName: z.string().min(1).default(MOMOKAYA_IMAGE_PULL_SECRET_NAME),
@@ -61,12 +101,88 @@ const mokaCommandSubmitOptionsSchema = mokaSubmitBaseOptionsSchema.extend({
 	task: mokaSubmitTaskInputSchema.optional(),
 	type: z.literal("command")
 }).strict();
-const mokaSubmitOptionsSchema = z.discriminatedUnion("type", [mokaGraphSubmitOptionsSchema, mokaCommandSubmitOptionsSchema]);
+const mokaSubmitOptionsSchema = z.discriminatedUnion("type", [mokaGraphSubmitOptionsSchema, mokaCommandSubmitOptionsSchema]).superRefine((data, ctx) => {
+	if (data.eventSink !== void 0 && data.events !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "Choose either eventSink or events, not both",
+		path: ["eventSink"]
+	});
+});
+const submitHookId = (event) => `moka-submit-${event.replaceAll(".", "-")}`;
+function objectWithoutUndefined(value) {
+	return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
+}
+function hookFunctionForSubmitHook(hook) {
+	if (hook.kind === "module") return objectWithoutUndefined({
+		kind: "module",
+		module: hook.module,
+		timeout_ms: hook.timeoutMs
+	});
+	return objectWithoutUndefined({
+		command: hook.command,
+		kind: "command",
+		output_limit_bytes: hook.outputLimitBytes,
+		protocol: {
+			input: "file",
+			result: "file"
+		},
+		timeout_ms: hook.timeoutMs,
+		trusted: hook.trusted
+	});
+}
+function hookBindingForSubmitHook(event, hook) {
+	const id = submitHookId(event);
+	const result = hook.publishResult === void 0 && hook.saveResultAs === void 0 ? void 0 : objectWithoutUndefined({
+		publish: hook.publishResult,
+		save_as: hook.saveResultAs
+	});
+	return objectWithoutUndefined({
+		failure: hook.failure,
+		function: id,
+		id,
+		result,
+		where: hook.where,
+		with: hook.input
+	});
+}
+function submitHookEntries(hooks) {
+	return Object.entries(hooks ?? {}).filter((entry) => entry[1] !== void 0).map(([event, hook]) => ({
+		event,
+		hook
+	}));
+}
+function cloneHookBindings(on) {
+	return Object.fromEntries(Object.entries(on).map(([event, bindings]) => [event, [...bindings]]));
+}
+function appendSubmitHook(event, hook, target) {
+	const id = submitHookId(event);
+	if (target.functions[id] !== void 0) throw new Error(`Moka submit hook id already exists in config: ${id}`);
+	target.functions[id] = hookFunctionForSubmitHook(hook);
+	target.on[event] = [...target.on[event] ?? [], hookBindingForSubmitHook(event, hook)];
+}
+function configWithSubmitHooks(config, hooks) {
+	const entries = submitHookEntries(hooks);
+	if (entries.length === 0) return config;
+	const target = {
+		functions: { ...config.hooks.functions },
+		on: cloneHookBindings(config.hooks.on)
+	};
+	for (const { event, hook } of entries) appendSubmitHook(event, hook, target);
+	return {
+		...config,
+		hooks: {
+			...config.hooks,
+			functions: target.functions,
+			on: target.on
+		}
+	};
+}
 function submitMoka(rawOptions, dependencies = {}) {
 	const { config, worktreePath, ...schemaOptions } = rawOptions;
+	const options = mokaSubmitOptionsSchema.parse(schemaOptions);
 	const parsedOptions = {
-		...mokaSubmitOptionsSchema.parse(schemaOptions),
-		config,
+		...options,
+		config: configWithSubmitHooks(config, options.hooks),
 		worktreePath
 	};
 	return parsedOptions.type === "command" ? submitMokaCommand(parsedOptions, dependencies) : submitMokaGraph(parsedOptions, dependencies);
@@ -184,6 +300,7 @@ function runnerPayloadJson(input) {
 	return JSON.stringify(buildRunnerCommandPayload({
 		delivery: input.options.delivery,
 		events: runnerEvents(input.options),
+		hookPolicy: input.options.hookPolicy,
 		repository: {
 			baseBranch: input.context.repository.baseBranch,
 			sha: input.context.repository.sha,
@@ -200,10 +317,11 @@ function runnerPayloadJson(input) {
 	}));
 }
 function runnerEvents(options) {
-	if (options.events) return {
-		authHeader: options.events.authHeader,
-		authTokenFile: options.events.authTokenFile ?? eventAuthTokenFile(options),
-		url: options.events.url
+	const eventSink = options.eventSink ?? options.events;
+	if (eventSink) return {
+		authHeader: eventSink.authHeader,
+		authTokenFile: eventSink.authTokenFile ?? eventAuthTokenFile(options),
+		url: eventSink.url
 	};
 	return {
 		authHeader: "Authorization",
@@ -279,4 +397,4 @@ function generateRunId(dependencies) {
 	return dependencies.generateRunId?.() ?? `run-${randomBytes(8).toString("hex")}`;
 }
 //#endregion
-export { mokaSubmitOptionsSchema, mokaSubmitResultSchema, submitMoka };
+export { mokaSubmitDirectHooksSchema, mokaSubmitHookPolicySchema, mokaSubmitOptionsSchema, mokaSubmitResultSchema, submitMoka };

package/dist/runner-command/run.js

@@ -64,7 +64,7 @@ async function runRunnerCommand(rawOptions = {}) {
 		});
 		const result = await runScheduledWorkflowTask({
 			config: compiled.config,
-			hookPolicy: { allowCommandHooks: true },
+			hookPolicy: payload.hookPolicy,
 			nodeId: descriptor.nodeId,
 			reporter: (event) => sink.recordRuntimeEvent(event),
 			runId: payload.run.id,

package/dist/runner-command-contract.d.ts

@@ -1,4 +1,4 @@
-import { PipelineRuntimeEvent } from "./runtime/contracts/contracts.js";
+import { HookRuntimePolicy, PipelineRuntimeEvent } from "./runtime/contracts/contracts.js";
 import { z } from "zod";
 
 //#region src/runner-command-contract.d.ts
@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    quick: "quick";
     full: "full";
+    quick: "quick";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -55,6 +55,14 @@ declare const runnerEventsSchema: z.ZodObject<{
   authTokenFile: z.ZodString;
   url: z.ZodString;
 }, z.core.$strict>;
+declare const runnerHookPolicySchema: z.ZodObject<{
+  allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
+  allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
+  env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  envPassthrough: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+  timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
 declare const runnerMomokayaContextSchema: z.ZodObject<{
   automationNamespace: z.ZodOptional<z.ZodString>;
   previewEnabled: z.ZodBoolean;
@@ -70,6 +78,14 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
     authTokenFile: z.ZodString;
     url: z.ZodString;
   }, z.core.$strict>;
+  hookPolicy: z.ZodOptional<z.ZodObject<{
+    allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    envPassthrough: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    outputLimitBytes: z.ZodOptional<z.ZodNumber>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
   momokaya: z.ZodOptional<z.ZodObject<{
     automationNamespace: z.ZodOptional<z.ZodString>;
     previewEnabled: z.ZodBoolean;
@@ -88,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      quick: "quick";
       full: "full";
+      quick: "quick";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;
@@ -111,6 +127,7 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
 }, z.core.$strict>;
 type RunnerDelivery = z.infer<typeof runnerDeliverySchema>;
 type RunnerEvents = z.infer<typeof runnerEventsSchema>;
+type RunnerHookPolicy = z.infer<typeof runnerHookPolicySchema>;
 type MokaSubmission = z.infer<typeof mokaSubmissionSchema>;
 type RunnerCommandPayload = z.infer<typeof runnerCommandPayloadSchema>;
 type RunnerMomokayaContext = z.infer<typeof runnerMomokayaContextSchema>;
@@ -130,6 +147,7 @@ declare class RunnerCommandPayloadValidationError extends Error {
 interface BuildRunnerCommandPayloadOptions {
   delivery?: RunnerDelivery;
   events: RunnerEvents;
+  hookPolicy?: HookRuntimePolicy;
   momokaya?: RunnerMomokayaContext;
   repository: RunnerRepositoryContext;
   run: RunnerRunIdentity;
@@ -271,4 +289,4 @@ declare function buildRunnerCommandPayload(options: BuildRunnerCommandPayloadOpt
 declare function parseRunnerCommandPayload(rawPayload: string): RunnerCommandPayload;
 declare function mapRuntimeEventToRunnerEventRecords(event: PipelineRuntimeEvent, context: RunnerEventMappingContext): RunnerEventRecord[];
 //#endregion
-export { BuildRunnerCommandPayloadOptions, MokaSubmission, ResolveRunnerEventSinkAuthTokenOptions, RunnerArtifactDetails, RunnerArtifactStatus, RunnerCommandPayload, RunnerCommandPayloadValidationError, RunnerCommandPayloadValidationIssue, RunnerDelivery, RunnerEventMappingContext, RunnerEventRecord, RunnerEvents, RunnerFinalResultDetails, RunnerGateDetails, RunnerGateStatus, RunnerHookResultDetails, RunnerLogDetails, RunnerLogLevel, RunnerMomokayaContext, RunnerNodeDetails, RunnerNodeStatus, RunnerRepositoryContext, RunnerRunIdentity, RunnerTask, RunnerWorkflowEdgeDetails, RunnerWorkflowEdgeRecordDetails, RunnerWorkflowIdentity, RunnerWorkflowNodeDetails, RunnerWorkflowPlanDetails, buildRunnerCommandPayload, gitRemoteUrlSchema, mapRuntimeEventToRunnerEventRecords, parseRunnerCommandPayload, resolveRunnerEventSinkAuthToken, runnerCommandPayloadSchema, runnerDeliverySchema, runnerEventsSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema, runnerWorkflowIdentitySchema };
+export { BuildRunnerCommandPayloadOptions, MokaSubmission, ResolveRunnerEventSinkAuthTokenOptions, RunnerArtifactDetails, RunnerArtifactStatus, RunnerCommandPayload, RunnerCommandPayloadValidationError, RunnerCommandPayloadValidationIssue, RunnerDelivery, RunnerEventMappingContext, RunnerEventRecord, RunnerEvents, RunnerFinalResultDetails, RunnerGateDetails, RunnerGateStatus, RunnerHookPolicy, RunnerHookResultDetails, RunnerLogDetails, RunnerLogLevel, RunnerMomokayaContext, RunnerNodeDetails, RunnerNodeStatus, RunnerRepositoryContext, RunnerRunIdentity, RunnerTask, RunnerWorkflowEdgeDetails, RunnerWorkflowEdgeRecordDetails, RunnerWorkflowIdentity, RunnerWorkflowNodeDetails, RunnerWorkflowPlanDetails, buildRunnerCommandPayload, gitRemoteUrlSchema, mapRuntimeEventToRunnerEventRecords, parseRunnerCommandPayload, resolveRunnerEventSinkAuthToken, runnerCommandPayloadSchema, runnerDeliverySchema, runnerEventsSchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema, runnerWorkflowIdentitySchema };

package/dist/runner-command-contract.js

@@ -43,6 +43,14 @@ const runnerEventsSchema = z.object({
 	authTokenFile: z.string().min(1),
 	url: z.string().url()
 }).strict();
+const runnerHookPolicySchema = z.object({
+	allowCommandHooks: z.boolean().optional(),
+	allowUntrustedCommandHooks: z.boolean().optional(),
+	env: z.record(z.string(), z.string()).optional(),
+	envPassthrough: z.array(z.string().min(1)).optional(),
+	outputLimitBytes: z.number().int().positive().optional(),
+	timeoutMs: z.number().int().positive().optional()
+}).strict();
 const runnerMomokayaContextSchema = z.object({
 	automationNamespace: z.string().min(1).optional(),
 	previewEnabled: z.boolean(),
@@ -52,6 +60,7 @@ const runnerCommandPayloadSchema = z.object({
 	contractVersion: z.literal(RUNNER_COMMAND_CONTRACT_VERSION, { error: "runner command payload contract version must be 1" }).default(RUNNER_COMMAND_CONTRACT_VERSION),
 	delivery: runnerDeliverySchema.default({ pullRequest: false }),
 	events: runnerEventsSchema,
+	hookPolicy: runnerHookPolicySchema.optional(),
 	momokaya: runnerMomokayaContextSchema.optional(),
 	repository: runnerRepositoryContextSchema,
 	run: runnerRunIdentitySchema,
@@ -79,6 +88,7 @@ function buildRunnerCommandPayload(options) {
 		contractVersion: RUNNER_COMMAND_CONTRACT_VERSION,
 		delivery: options.delivery,
 		events: options.events,
+		hookPolicy: options.hookPolicy,
 		...options.momokaya ? { momokaya: options.momokaya } : {},
 		repository: options.repository,
 		run: options.run,
@@ -433,4 +443,4 @@ function throwUnhandledRuntimeEvent(value) {
 	throw new Error(`Unhandled runtime event: ${value.type}`);
 }
 //#endregion
-export { RunnerCommandPayloadValidationError, buildRunnerCommandPayload, gitRemoteUrlSchema, mapRuntimeEventToRunnerEventRecords, parseRunnerCommandPayload, resolveRunnerEventSinkAuthToken, runnerCommandPayloadSchema, runnerDeliverySchema, runnerEventsSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema, runnerWorkflowIdentitySchema };
+export { RunnerCommandPayloadValidationError, buildRunnerCommandPayload, gitRemoteUrlSchema, mapRuntimeEventToRunnerEventRecords, parseRunnerCommandPayload, resolveRunnerEventSinkAuthToken, runnerCommandPayloadSchema, runnerDeliverySchema, runnerEventsSchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema, runnerWorkflowIdentitySchema };

package/dist/runtime/goal-loop.js

@@ -67,7 +67,7 @@ function noProgressResult(state, prompts) {
 function createGoalContinuationLaunchPlan(input) {
 	return createRunnerLaunchPlan(input.config, {
 		nodeId: input.nodeId ?? "goal-continuation",
-		profileId: input.profileId ?? "pipeline-code-writer",
+		profileId: input.profileId ?? "moka-code-writer",
 		prompt: input.prompt,
 		worktreePath: input.worktreePath
 	});

package/dist/schedule-planner.js

@@ -30,9 +30,9 @@ const SCHEDULE_BUILTINS = [
 	"typecheck"
 ];
 const DEFAULT_GENERATED_COVERAGE_PROFILE_PREFERENCE = [
-	"pipeline-verifier",
-	"pipeline-acceptance-reviewer",
-	"pipeline-thermo-nuclear-reviewer"
+	"moka-verifier",
+	"moka-acceptance-reviewer",
+	"moka-thermo-nuclear-reviewer"
 ];
 const scheduleArtifactSchema = z.object({
 	generated_at: z.string().datetime(),
@@ -273,19 +273,19 @@ function quickBaselineWorkflow() {
 			{
 				id: "backlog-intake",
 				kind: "agent",
-				profile: "pipeline-researcher"
+				profile: "moka-researcher"
 			},
 			{
 				id: "red-tests",
 				kind: "agent",
 				needs: ["backlog-intake"],
-				profile: "pipeline-test-writer"
+				profile: "moka-test-writer"
 			},
 			{
 				id: "implement",
 				kind: "agent",
 				needs: ["red-tests"],
-				profile: "pipeline-code-writer"
+				profile: "moka-code-writer"
 			},
 			{
 				builtin: "test",
@@ -330,7 +330,7 @@ function quickBaselineWorkflow() {
 				id: "verify",
 				kind: "agent",
 				needs: ["mechanical-tests", "mechanical-typecheck"],
-				profile: "pipeline-verifier"
+				profile: "moka-verifier"
 			}
 		]
 	} };
@@ -342,13 +342,13 @@ function executeBaselineWorkflow() {
 			{
 				id: "backlog-intake",
 				kind: "agent",
-				profile: "pipeline-researcher"
+				profile: "moka-researcher"
 			},
 			{
 				id: "research",
 				kind: "agent",
 				needs: ["backlog-intake"],
-				profile: "pipeline-researcher"
+				profile: "moka-researcher"
 			},
 			{
 				gates: [{
@@ -377,13 +377,13 @@ function executeBaselineWorkflow() {
 				id: "red-tests",
 				kind: "agent",
 				needs: ["research"],
-				profile: "pipeline-test-writer"
+				profile: "moka-test-writer"
 			},
 			{
 				id: "green-implementation",
 				kind: "agent",
 				needs: ["red-tests"],
-				profile: "pipeline-code-writer"
+				profile: "moka-code-writer"
 			},
 			{
 				builtin: "test",
@@ -428,7 +428,7 @@ function executeBaselineWorkflow() {
 					"mechanical-green-lint",
 					"mechanical-green-fallow"
 				],
-				profile: "pipeline-acceptance-reviewer"
+				profile: "moka-acceptance-reviewer"
 			},
 			{
 				gates: [
@@ -471,13 +471,13 @@ function executeBaselineWorkflow() {
 				id: "verification",
 				kind: "agent",
 				needs: ["acceptance-review"],
-				profile: "pipeline-verifier"
+				profile: "moka-verifier"
 			},
 			{
 				id: "learn",
 				kind: "agent",
 				needs: ["verification"],
-				profile: "pipeline-learner"
+				profile: "moka-learner"
 			}
 		]
 	} };

package/docs/config-architecture.md

@@ -55,7 +55,7 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem:
       mode: read-only
-  pipeline-researcher:
+  moka-researcher:
     runner: opencode
     instructions:
       path: .pipeline/prompts/researcher.md
@@ -106,12 +106,12 @@ workflows:
     nodes:
       - id: inspect
         kind: agent
-        profile: pipeline-inspector
+        profile: moka-inspector
   default:
     nodes:
       - id: research
         kind: agent
-        profile: pipeline-researcher
+        profile: moka-researcher
       - id: verify
         kind: builtin
         builtin: test

package/docs/mcp-gateway.md

@@ -73,9 +73,9 @@ mcp_gateway:
       tool_prefixes: [backlog]
 
 profiles:
-  pipeline-researcher:
+  moka-researcher:
     mcp_servers: [pipeline-gateway]
-  pipeline-test-writer:
+  moka-test-writer:
     mcp_servers: []
 ```
 

package/docs/operator-guide.md

@@ -148,6 +148,16 @@ moka submit "fix the login bug" --quick --kubeconfig ~/.kube/config --namespace
 There is no separate workstation-local `submit` path; local submission means
 submitting to a local Kubernetes cluster.
 
+Pipeline Console and other TypeScript control planes should use
+`@oisincoveney/pipeline/moka-submit` instead of shelling out or importing Argo
+internals. The public API accepts `eventSink` for runner event delivery,
+`hooks` for direct lifecycle hook declarations, and `hookPolicy` for per-run
+hook execution policy. `eventSink` is not a hook mechanism; it is the transport
+used by runner pods to POST durable events back to the control plane. Direct
+submit hooks are normalized into deterministic internal function ids like
+`moka-submit-node-finish`; non-conflicting package hooks remain intact, and a
+generated id collision is rejected before submission.
+
 ### Runner Workflow Shape
 
 The runner container entrypoint is `moka runner-command`. Validation errors exit
@@ -371,7 +381,7 @@ skills:
     path: .agents/skills/accessibility-review/SKILL.md
 
 profiles:
-  pipeline-frontend-reviewer:
+  moka-frontend-reviewer:
     runner: opencode
     instructions:
       path: .pipeline/prompts/frontend-reviewer.md
@@ -390,7 +400,7 @@ mcp_gateway:
   authorization_env: PIPELINE_MCP_GATEWAY_AUTHORIZATION
 
 profiles:
-  pipeline-router:
+  moka-router:
     runner: opencode
     instructions:
       path: .pipeline/prompts/router.md

package/package.json

@@ -120,7 +120,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.26.1",
+  "version": "1.27.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",