@oisincoveney/pipeline 1.27.17 → 1.27.18

package/dist/argo-submit.d.ts

@@ -8,6 +8,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodOptional<z.ZodString>;
   image: z.ZodOptional<z.ZodString>;
   imagePullPolicy: z.ZodOptional<z.ZodEnum<{
@@ -18,7 +19,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodString;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   queueName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -24,6 +24,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: z.string().min(1).optional(),
 	generateName: z.string().min(1).optional(),
+	gitCredentialsSecretName: z.string().min(1).optional(),
 	githubAuthSecretName: z.string().min(1).optional(),
 	image: z.string().min(1).optional(),
 	imagePullPolicy: z.enum([
@@ -34,7 +35,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	imagePullSecretName: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
-	namespace: z.string().min(1).default("momokaya-pipeline"),
+	namespace: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	queueName: z.string().min(1).optional(),
@@ -72,6 +73,7 @@ async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,
+		gitCredentialsSecretName: options.gitCredentialsSecretName,
 		githubAuthSecretName: options.githubAuthSecretName,
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,

package/dist/argo-workflow.d.ts

@@ -102,6 +102,7 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
           key: z.ZodString;
           path: z.ZodString;
         }, z.core.$strict>>>;
+        optional: z.ZodOptional<z.ZodBoolean>;
         secretName: z.ZodString;
       }, z.core.$strict>>;
     }, z.core.$strict>>;
@@ -112,6 +113,7 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodOptional<z.ZodString>;
   annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   image: z.ZodDefault<z.ZodString>;

package/dist/argo-workflow.js

@@ -10,6 +10,7 @@ const RUNNER_WORKFLOW_SERVICE_ACCOUNT = "pipeline-runner";
 const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
 const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
 const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
+const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
 const kubernetesNameSchema = z.string().min(1);
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
@@ -26,6 +27,7 @@ const secretVolumeSchema = z.object({
 		key: z.string().min(1),
 		path: z.string().min(1)
 	}).strict()).optional(),
+	optional: z.boolean().optional(),
 	secretName: kubernetesNameSchema
 }).strict();
 const argoWorkflowVolumeSchema = z.object({
@@ -110,6 +112,7 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: kubernetesNameSchema.optional(),
 	generateName: z.string().min(1).optional(),
+	gitCredentialsSecretName: kubernetesNameSchema.optional(),
 	githubAuthSecretName: kubernetesNameSchema.optional(),
 	annotations: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
 	image: z.string().min(1).default(RUNNER_WORKFLOW_IMAGE),
@@ -270,38 +273,51 @@ function runnerWorkflowStorage(options, tasks) {
 			subPath: "auth.json"
 		});
 	}
-	if (options.githubAuthSecretName) {
+	if (options.gitCredentialsSecretName) {
 		volumes.push({
-			name: "github-auth",
+			name: "runner-git-credentials",
 			secret: {
+				defaultMode: 256,
 				items: [
 					{
-						key: "gitconfig",
-						path: "gitconfig"
+						key: "username",
+						path: "username"
 					},
 					{
-						key: "git-credentials",
-						path: "git-credentials"
+						key: "password",
+						path: "password"
 					},
 					{
-						key: "hosts.yml",
-						path: "hosts.yml"
+						key: "identity",
+						path: "identity"
+					},
+					{
+						key: "known_hosts",
+						path: "known_hosts"
 					}
 				],
-				secretName: options.githubAuthSecretName
+				optional: true,
+				secretName: options.gitCredentialsSecretName
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.gitconfig",
-			name: "github-auth",
-			readOnly: true,
-			subPath: "gitconfig"
-		}, {
-			mountPath: "/root/.git-credentials",
+			mountPath: RUNNER_GIT_CREDENTIALS_PATH,
+			name: "runner-git-credentials",
+			readOnly: true
+		});
+	}
+	if (options.githubAuthSecretName) {
+		volumes.push({
 			name: "github-auth",
-			readOnly: true,
-			subPath: "git-credentials"
-		}, {
+			secret: {
+				items: [{
+					key: "hosts.yml",
+					path: "hosts.yml"
+				}],
+				secretName: options.githubAuthSecretName
+			}
+		});
+		volumeMounts.push({
 			mountPath: "/root/.config/gh/hosts.yml",
 			name: "github-auth",
 			readOnly: true,

package/dist/config.d.ts

@@ -362,8 +362,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -387,8 +387,8 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -431,10 +431,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -485,8 +485,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -503,10 +503,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
@@ -613,8 +613,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      execute: "execute";
       quick: "quick";
+      execute: "execute";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;
@@ -626,8 +626,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    fail: "fail";
     pass: "pass";
+    fail: "fail";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -10,6 +10,7 @@ import { resolvePackageAssetPath } from "./package-assets.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
 import { registerRunnerCommandCommand } from "./commands/runner-command-command.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { loadMokaGlobalConfig } from "./moka-global-config.js";
 import { submitMoka } from "./moka-submit.js";
 import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
@@ -313,31 +314,40 @@ function addMokaSubmitOptions(command) {
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+	const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
+	const globalConfig = loadMokaGlobalConfig();
 	const commonOptions = mokaCommonSubmitOptions({
-		config: loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }),
+		config,
 		cwd,
-		eventUrl: resolveMokaEventUrl(flags),
-		flags
+		eventUrl: resolveMokaEventUrl(flags, globalConfig),
+		flags,
+		globalConfig
 	});
 	if (flags.command) return submitMokaCommandFromCli(input, flags, commonOptions);
 	return submitMokaGraphFromCli(input, flags, commonOptions);
 }
-function resolveMokaEventUrl(flags) {
-	return flags.eventUrl ?? process.env.PIPELINE_EVENT_URL ?? "https://pipeline-console.momokaya.ee/api/pipeline/runner-events";
+function resolveMokaEventUrl(flags, globalConfig) {
+	return flags.eventUrl ?? globalConfig?.momokaya.submit.eventUrl;
 }
 function mokaCommonSubmitOptions(input) {
+	const momokaya = input.globalConfig?.momokaya;
 	return {
 		config: input.config,
 		eventUrl: input.eventUrl,
+		eventAuthSecretKey: momokaya?.submit.eventAuthSecretKey,
+		eventAuthSecretName: momokaya?.submit.eventAuthSecretName,
 		generateName: input.flags.generateName,
+		gitCredentialsSecretName: momokaya?.submit.gitCredentialsSecretName,
+		githubAuthSecretName: momokaya?.submit.githubAuthSecretName,
 		image: input.flags.image,
 		imagePullPolicy: parseImagePullPolicy(input.flags.imagePullPolicy),
-		imagePullSecretName: input.flags.imagePullSecret,
-		kubeconfigPath: input.flags.kubeconfig,
+		imagePullSecretName: input.flags.imagePullSecret ?? momokaya?.submit.imagePullSecretName,
+		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
-		namespace: input.flags.namespace,
-		queueName: input.flags.queueName,
-		serviceAccountName: input.flags.serviceAccount,
+		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
+		queueName: input.flags.queueName ?? momokaya?.submit.queueName,
+		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};
 }
@@ -377,7 +387,7 @@ function parseGatewayHostScope(value) {
 	throw new Error("scope must be project or global");
 }
 function addRunnerArgoOptions(command, options = {}) {
-	command.option("--name <name>", "Workflow metadata.name").option("--generate-name <prefix>", "Workflow metadata.generateName").option("--namespace <namespace>", "Workflow namespace", "momokaya-pipeline");
+	command.option("--name <name>", "Workflow metadata.name").option("--generate-name <prefix>", "Workflow metadata.generateName").option("--namespace <namespace>", "Workflow namespace");
 	if (options.kubeconfig) command.option("--kubeconfig <path>", "kubeconfig path");
 	return command.option("--queue-name <name>", "Kueue LocalQueue label for Workflow pods").option("--service-account <name>", "Workflow service account").option("--image <image>", "runner image").addOption(new Option("--image-pull-policy <policy>", "runner image pull policy").choices([
 		"Always",

package/dist/install-commands.js

@@ -172,7 +172,7 @@ function entrypointDispatchBlock(host, config, id, entrypoint) {
 		`The schedule policy is \`${entrypoint.schedule}\`.`,
 		id === "quick" ? "Run `moka submit --quick <task description>` to submit the graph as an Argo Workflow." : `Run \`moka submit <task description>\` to submit the \`${id}\` graph as an Argo Workflow.`,
 		"The pipeline runtime executes as Argo DAG tasks using the package-owned runner image.",
-		"Use `--kubeconfig <path>` and `--namespace <namespace>` to target a local or remote Kubernetes cluster.",
+		"Configure the target in `~/.config/moka/config.yaml`; use `--kubeconfig <path>` and `--namespace <namespace>` only for explicit command overrides.",
 		"Use `moka submit --schedule <schedule.yaml> <task description>` only when rerunning an existing schedule artifact."
 	].join("\n");
 }
@@ -446,7 +446,8 @@ function selectedHosts(host) {
 const GENERATED_RESOURCE_ROOTS = { opencode: [
 	".opencode/commands",
 	".opencode/agents",
-	".opencode/plugins"
+	".opencode/plugins",
+	".opencode/skills"
 ] };
 async function listFiles(root) {
 	if (!existsSync(root)) return [];

package/dist/moka-global-config.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+
+//#region src/moka-global-config.d.ts
+declare const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
+declare const mokaGlobalConfigSchema: z.ZodObject<{
+  momokaya: z.ZodObject<{
+    kubernetes: z.ZodObject<{
+      kubeconfig: z.ZodOptional<z.ZodString>;
+      namespace: z.ZodString;
+    }, z.core.$strict>;
+    submit: z.ZodObject<{
+      eventAuthSecretKey: z.ZodString;
+      eventAuthSecretName: z.ZodString;
+      eventUrl: z.ZodString;
+      gitCredentialsSecretName: z.ZodString;
+      githubAuthSecretName: z.ZodString;
+      imagePullSecretName: z.ZodString;
+      opencodeAuthSecretName: z.ZodString;
+      queueName: z.ZodString;
+      serviceAccountName: z.ZodString;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type MokaGlobalConfig = z.infer<typeof mokaGlobalConfigSchema>;
+declare function mokaGlobalConfigPath(homeDir?: string): string;
+declare function loadMokaGlobalConfig(): MokaGlobalConfig | null;
+declare function parseMokaGlobalConfig(source: string, sourcePath: string): MokaGlobalConfig;
+//#endregion
+export { MOKA_GLOBAL_CONFIG_PATH, MokaGlobalConfig, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };

package/dist/moka-global-config.js

@@ -0,0 +1,56 @@
+import { PipelineConfigError } from "./config.js";
+import { parseDocument } from "yaml";
+import { z } from "zod";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+//#region src/moka-global-config.ts
+const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
+const mokaSubmitGlobalConfigSchema = z.object({
+	eventAuthSecretKey: z.string().min(1),
+	eventAuthSecretName: z.string().min(1),
+	eventUrl: z.string().url(),
+	gitCredentialsSecretName: z.string().min(1),
+	githubAuthSecretName: z.string().min(1),
+	imagePullSecretName: z.string().min(1),
+	opencodeAuthSecretName: z.string().min(1),
+	queueName: z.string().min(1),
+	serviceAccountName: z.string().min(1)
+}).strict();
+const mokaKubernetesGlobalConfigSchema = z.object({
+	kubeconfig: z.string().min(1).optional(),
+	namespace: z.string().min(1)
+}).strict();
+const mokaGlobalConfigSchema = z.object({ momokaya: z.object({
+	kubernetes: mokaKubernetesGlobalConfigSchema,
+	submit: mokaSubmitGlobalConfigSchema
+}).strict() }).strict();
+function mokaGlobalConfigPath(homeDir = homedir()) {
+	return join(homeDir, MOKA_GLOBAL_CONFIG_PATH);
+}
+function loadMokaGlobalConfig() {
+	const configPath = mokaGlobalConfigPath();
+	if (!existsSync(configPath)) return null;
+	return parseMokaGlobalConfig(readFileSync(configPath, "utf8"), configPath);
+}
+function parseMokaGlobalConfig(source, sourcePath) {
+	const document = parseDocument(source, {
+		prettyErrors: false,
+		uniqueKeys: true
+	});
+	if (document.errors.length > 0) throw new PipelineConfigError("PIPELINE_CONFIG_PARSE_ERROR", `Failed to parse ${sourcePath}`, document.errors.map((err) => ({
+		message: err.message,
+		path: sourcePath
+	})));
+	const parsed = mokaGlobalConfigSchema.safeParse(document.toJS());
+	if (!parsed.success) {
+		const issues = parsed.error.issues.map((issue) => ({
+			path: issue.path.join("."),
+			message: issue.message
+		}));
+		throw new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", [`Invalid ${sourcePath}:`, ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
+	}
+	return parsed.data;
+}
+//#endregion
+export { MOKA_GLOBAL_CONFIG_PATH, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };

package/dist/moka-submit.d.ts

@@ -73,16 +73,17 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
-  eventAuthSecretKey: z.ZodDefault<z.ZodString>;
-  eventAuthSecretName: z.ZodDefault<z.ZodString>;
-  eventUrl: z.ZodDefault<z.ZodString>;
+  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
+  eventAuthSecretName: z.ZodOptional<z.ZodString>;
+  eventUrl: z.ZodOptional<z.ZodString>;
   events: z.ZodOptional<z.ZodObject<{
     authHeader: z.ZodDefault<z.ZodString>;
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
+  githubAuthSecretName: z.ZodOptional<z.ZodString>;
   hookPolicy: z.ZodOptional<z.ZodObject<{
     allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
     allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
@@ -142,12 +143,12 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     IfNotPresent: "IfNotPresent";
     Never: "Never";
   }>>;
-  imagePullSecretName: z.ZodDefault<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
-  opencodeAuthSecretName: z.ZodDefault<z.ZodString>;
-  queueName: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodOptional<z.ZodString>;
+  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  queueName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -158,10 +159,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     project: z.ZodString;
     requestedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
-    quick: "quick";
     full: "full";
+    quick: "quick";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;
@@ -185,16 +186,17 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
-  eventAuthSecretKey: z.ZodDefault<z.ZodString>;
-  eventAuthSecretName: z.ZodDefault<z.ZodString>;
-  eventUrl: z.ZodDefault<z.ZodString>;
+  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
+  eventAuthSecretName: z.ZodOptional<z.ZodString>;
+  eventUrl: z.ZodOptional<z.ZodString>;
   events: z.ZodOptional<z.ZodObject<{
     authHeader: z.ZodDefault<z.ZodString>;
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
+  githubAuthSecretName: z.ZodOptional<z.ZodString>;
   hookPolicy: z.ZodOptional<z.ZodObject<{
     allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
     allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
@@ -254,12 +256,12 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     IfNotPresent: "IfNotPresent";
     Never: "Never";
   }>>;
-  imagePullSecretName: z.ZodDefault<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
-  opencodeAuthSecretName: z.ZodDefault<z.ZodString>;
-  queueName: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodOptional<z.ZodString>;
+  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  queueName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -270,7 +272,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     project: z.ZodString;
     requestedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
   commandArgv: z.ZodArray<z.ZodString>;
   task: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"prompt">;
@@ -315,13 +317,14 @@ interface MokaWorkflowSubmitOptions {
   eventAuthSecretKey?: string;
   eventAuthSecretName?: string;
   generateName?: string;
+  gitCredentialsSecretName?: string;
   githubAuthSecretName?: string;
   image?: string;
   imagePullPolicy?: "Always" | "IfNotPresent" | "Never";
   imagePullSecretName?: string;
   kubeconfigPath?: string;
   name?: string;
-  namespace?: string;
+  namespace: string;
   opencodeAuthSecretName?: string;
   payloadJson: string;
   queueName?: string;

package/dist/moka-submit.js

@@ -9,14 +9,6 @@ import parseGitUrl from "git-url-parse";
 import { resolve } from "node:path";
 import { simpleGit } from "simple-git";
 //#region src/moka-submit.ts
-const MOMOKAYA_EVENT_AUTH_SECRET_KEY = "OISIN_PIPELINE_EVENT_AUTH_TOKEN";
-const MOMOKAYA_EVENT_AUTH_SECRET_NAME = "pipeline-runner-event-auth";
-const MOMOKAYA_EVENT_URL = "https://pipeline-console.momokaya.ee/api/pipeline/runner-events";
-const MOMOKAYA_GITHUB_AUTH_SECRET_NAME = "oisin-bot-github-auth";
-const MOMOKAYA_IMAGE_PULL_SECRET_NAME = "ghcr-pull-secret";
-const MOMOKAYA_OPENCODE_AUTH_SECRET_NAME = "opencode-auth-1";
-const MOMOKAYA_QUEUE_NAME = "momokaya-pipeline";
-const MOMOKAYA_RUNNER_SERVICE_ACCOUNT_NAME = "pipeline-runner";
 const imagePullPolicySchema = z.enum([
 	"Always",
 	"IfNotPresent",
@@ -69,25 +61,26 @@ const mokaSubmitResultSchema = workflowSubmitResultSchema;
 const mokaSubmitBaseOptionsSchema = z.object({
 	delivery: runnerDeliverySchema.default({ pullRequest: false }),
 	eventSink: mokaSubmitEventsSchema.optional(),
-	eventAuthSecretKey: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_KEY),
-	eventAuthSecretName: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_NAME),
-	eventUrl: z.string().url().default(MOMOKAYA_EVENT_URL),
+	eventAuthSecretKey: z.string().min(1).optional(),
+	eventAuthSecretName: z.string().min(1).optional(),
+	eventUrl: z.string().url().optional(),
 	events: mokaSubmitEventsSchema.optional(),
 	generateName: z.string().min(1).optional(),
-	githubAuthSecretName: z.string().min(1).default(MOMOKAYA_GITHUB_AUTH_SECRET_NAME),
+	gitCredentialsSecretName: z.string().min(1).optional(),
+	githubAuthSecretName: z.string().min(1).optional(),
 	hookPolicy: mokaSubmitHookPolicySchema.optional(),
 	hooks: mokaSubmitDirectHooksSchema.optional(),
 	image: z.string().min(1).optional(),
 	imagePullPolicy: imagePullPolicySchema,
-	imagePullSecretName: z.string().min(1).default(MOMOKAYA_IMAGE_PULL_SECRET_NAME),
+	imagePullSecretName: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
-	namespace: z.string().min(1).default("momokaya-pipeline"),
-	opencodeAuthSecretName: z.string().min(1).default(MOMOKAYA_OPENCODE_AUTH_SECRET_NAME),
-	queueName: z.string().min(1).default(MOMOKAYA_QUEUE_NAME),
+	namespace: z.string().min(1).optional(),
+	opencodeAuthSecretName: z.string().min(1).optional(),
+	queueName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
-	serviceAccountName: z.string().min(1).default(MOMOKAYA_RUNNER_SERVICE_ACCOUNT_NAME)
+	serviceAccountName: z.string().min(1).optional()
 }).strict();
 const mokaGraphSubmitOptionsSchema = mokaSubmitBaseOptionsSchema.extend({
 	mode: z.enum(["full", "quick"]),
@@ -107,6 +100,11 @@ const mokaSubmitOptionsSchema = z.discriminatedUnion("type", [mokaGraphSubmitOpt
 		message: "Choose either eventSink or events, not both",
 		path: ["eventSink"]
 	});
+	if (data.eventSink === void 0 && data.events === void 0 && data.eventUrl === void 0) ctx.addIssue({
+		code: "custom",
+		message: "eventUrl is required unless eventSink or events is provided",
+		path: ["eventUrl"]
+	});
 });
 const submitHookId = (event) => `moka-submit-${event.replaceAll(".", "-")}`;
 function objectWithoutUndefined(value) {
@@ -284,18 +282,23 @@ function workflowSubmitOptions(options) {
 	return {
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
+		gitCredentialsSecretName: options.gitCredentialsSecretName,
 		githubAuthSecretName: options.githubAuthSecretName,
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,
 		imagePullSecretName: options.imagePullSecretName,
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
-		namespace: options.namespace,
+		namespace: requireSubmitOption(options.namespace, "namespace"),
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		queueName: options.queueName,
 		serviceAccountName: options.serviceAccountName
 	};
 }
+function requireSubmitOption(value, name) {
+	if (!value) throw new Error(`${name} is required for moka submit`);
+	return value;
+}
 function runnerPayloadJson(input) {
 	return JSON.stringify(buildRunnerCommandPayload({
 		delivery: input.options.delivery,
@@ -323,6 +326,7 @@ function runnerEvents(options) {
 		authTokenFile: eventSink.authTokenFile ?? eventAuthTokenFile(options),
 		url: eventSink.url
 	};
+	if (!options.eventUrl) throw new Error("eventUrl is required unless eventSink or events is provided");
 	return {
 		authHeader: "Authorization",
 		authTokenFile: eventAuthTokenFile(options),
@@ -330,19 +334,23 @@ function runnerEvents(options) {
 	};
 }
 function eventAuthTokenFile(options) {
+	if (!options.eventAuthSecretKey) throw new Error("eventAuthSecretKey is required unless eventSink.authTokenFile is provided");
 	return `/etc/pipeline/event-auth/${options.eventAuthSecretKey}`;
 }
 async function resolveSubmissionContext(options, dependencies, runId) {
 	const explicitContext = explicitSubmissionContext(options);
 	if (explicitContext) return explicitContext;
 	const git = await resolveRequiredGit(options, dependencies);
+	const repository = repositoryContext(options, git);
+	assertRepositoryCredentialConfiguration(options);
 	return {
-		repository: repositoryContext(options, git),
+		repository,
 		run: runContext(options, git, runId)
 	};
 }
 function explicitSubmissionContext(options) {
 	if (!(options.repository && options.run)) return null;
+	assertRepositoryCredentialConfiguration(options);
 	return {
 		repository: options.repository,
 		run: options.run
@@ -359,6 +367,9 @@ function repositoryContext(options, git) {
 		url: git.url
 	};
 }
+function assertRepositoryCredentialConfiguration(options) {
+	if (!options.gitCredentialsSecretName) throw new Error("gitCredentialsSecretName is required for runner git clone, fetch, and push operations");
+}
 function runContext(options, git, runId) {
 	return options.run ?? {
 		id: runId,

package/dist/run-state/git-refs.js

@@ -1,14 +1,15 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
-const DEFAULT_GIT_CREDENTIAL_STORE = "/root/.git-credentials";
+const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
 const WRITABLE_GIT_CREDENTIAL_STORE = resolve(tmpdir(), "pipeline-git-credentials");
+const SCP_LIKE_SSH_REMOTE_RE = /^[^@\s]+@[^:\s]+:.+/u;
 const execGit = promisify(execFile);
-let preparedCredentialStore;
+let preparedBasicAuthCredentialStore;
 function runnerGitRefs(payload, nodeId) {
 	const prefix = `refs/heads/pipeline/runs/${payload.run.id}/${payload.workflow.id}`;
 	return {
@@ -102,21 +103,19 @@ async function configureGitCommitter(worktreePath, committer) {
 	]);
 }
 function runnerGitCommandArgs(args) {
-	return [...gitCredentialConfigArgs(), ...args];
+	return [...gitCredentialConfigArgs(remoteUrlFromGitArgs(args)), ...args];
 }
 async function runGit(cwd, args) {
+	const remoteUrl = remoteUrlFromGitArgs(args);
 	const { stdout } = await execGit("git", runnerGitCommandArgs(args), {
 		cwd,
 		encoding: "utf8",
-		env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		}
+		env: runnerGitEnv(remoteUrl)
 	});
 	return stdout;
 }
-function gitCredentialConfigArgs() {
-	const writablePath = prepareWritableGitCredentialStore();
+function gitCredentialConfigArgs(remoteUrl) {
+	const writablePath = prepareWritableGitCredentialStore(remoteUrl);
 	if (!writablePath) return [];
 	return [
 		"-c",
@@ -125,26 +124,102 @@ function gitCredentialConfigArgs() {
 		`credential.helper=store --file=${writablePath}`
 	];
 }
-function prepareWritableGitCredentialStore() {
-	const sourcePath = availableGitCredentialStore();
-	if (!sourcePath) return;
+function prepareWritableGitCredentialStore(remoteUrl) {
 	const writablePath = writableGitCredentialStore();
-	copyGitCredentialStore(sourcePath, writablePath);
-	return writablePath;
+	const basicAuth = availableBasicAuthCredentials();
+	if (basicAuth) return prepareBasicAuthCredentialStore(basicAuth, writablePath, remoteUrl);
+}
+function availableBasicAuthCredentials() {
+	const credentialsDir = gitCredentialsDir();
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return;
+	return {
+		password: readCredentialFile(passwordPath),
+		username: readCredentialFile(usernamePath)
+	};
 }
-function availableGitCredentialStore() {
-	const sourcePath = process.env.PIPELINE_GIT_CREDENTIAL_STORE ?? DEFAULT_GIT_CREDENTIAL_STORE;
-	return existsSync(sourcePath) ? sourcePath : void 0;
+function gitCredentialsDir() {
+	return process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR;
 }
 function writableGitCredentialStore() {
 	return process.env.PIPELINE_WRITABLE_GIT_CREDENTIAL_STORE ?? WRITABLE_GIT_CREDENTIAL_STORE;
 }
-function copyGitCredentialStore(sourcePath, writablePath) {
-	if (preparedCredentialStore === writablePath) return;
+function writeGitCredentialStore(credentials, writablePath, host) {
 	mkdirSync(dirname(writablePath), { recursive: true });
-	copyFileSync(sourcePath, writablePath);
+	writeFileSync(writablePath, `https://${encodeURIComponent(credentials.username)}:${encodeURIComponent(credentials.password)}@${host}\n`, { mode: 384 });
 	chmodSync(writablePath, 384);
-	preparedCredentialStore = writablePath;
+}
+function prepareBasicAuthCredentialStore(credentials, writablePath, remoteUrl) {
+	const host = remoteUrl ? credentialHost(remoteUrl) : void 0;
+	if (!host) return existingPreparedBasicAuthCredentialStore(writablePath);
+	if (isPreparedBasicAuthCredentialStore(writablePath, host)) return writablePath;
+	writeGitCredentialStore(credentials, writablePath, host);
+	preparedBasicAuthCredentialStore = {
+		host,
+		path: writablePath
+	};
+	return writablePath;
+}
+function existingPreparedBasicAuthCredentialStore(writablePath) {
+	return preparedBasicAuthCredentialStore?.path === writablePath ? writablePath : void 0;
+}
+function isPreparedBasicAuthCredentialStore(writablePath, host) {
+	return preparedBasicAuthCredentialStore?.path === writablePath && preparedBasicAuthCredentialStore.host === host;
+}
+function runnerGitEnv(remoteUrl) {
+	const env = {
+		...process.env,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+	if (remoteUrl && isSshRemote(remoteUrl)) {
+		const sshCommand = gitSshCommand();
+		if (sshCommand) env.GIT_SSH_COMMAND = sshCommand;
+	}
+	return env;
+}
+function gitSshCommand() {
+	const credentialsDir = gitCredentialsDir();
+	const identityPath = resolve(credentialsDir, "identity");
+	const knownHostsPath = resolve(credentialsDir, "known_hosts");
+	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return;
+	chmodSync(identityPath, 256);
+	return [
+		"ssh",
+		"-i",
+		shellQuote(identityPath),
+		"-o",
+		"IdentitiesOnly=yes",
+		"-o",
+		`UserKnownHostsFile=${shellQuote(knownHostsPath)}`,
+		"-o",
+		"StrictHostKeyChecking=yes"
+	].join(" ");
+}
+function readCredentialFile(path) {
+	return readFileSync(path, "utf8").trim();
+}
+function remoteUrlFromGitArgs(args) {
+	if (args[0] === "clone") return args.find((arg) => isRemoteUrl(arg));
+}
+function isRemoteUrl(value) {
+	return value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
+}
+function isSshRemote(value) {
+	return value.startsWith("ssh://") || isScpLikeSshRemote(value);
+}
+function isScpLikeSshRemote(value) {
+	return SCP_LIKE_SSH_REMOTE_RE.test(value);
+}
+function credentialHost(remoteUrl) {
+	try {
+		return new URL(remoteUrl).host || void 0;
+	} catch {
+		return;
+	}
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 //#endregion
 export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef };

package/dist/runner-command-contract.d.ts

@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    quick: "quick";
     full: "full";
+    quick: "quick";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -104,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      quick: "quick";
       full: "full";
+      quick: "quick";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;

package/docs/operator-guide.md

@@ -129,11 +129,27 @@ description and current git context, creates payload/schedule ConfigMaps, and
 submits an Argo Workflow that runs the graph as DAG tasks using the package-owned
 runner image.
 
-`moka submit` uses the Momokaya default event sink unless overridden with
-`PIPELINE_EVENT_URL` or `--event-url`.
+`moka submit` reads the private Momokaya target from
+`~/.config/moka/config.yaml`.
+
+```yaml
+momokaya:
+  kubernetes:
+    kubeconfig: /path/to/cluster.kubeconfig
+    namespace: <workflow-namespace>
+  submit:
+    eventAuthSecretKey: <event-auth-secret-key>
+    eventAuthSecretName: <event-auth-secret-name>
+    eventUrl: <runner-event-sink-url>
+    gitCredentialsSecretName: <git-credentials-secret-name>
+    githubAuthSecretName: <github-auth-secret-name>
+    imagePullSecretName: <image-pull-secret-name>
+    opencodeAuthSecretName: <opencode-auth-secret-name>
+    queueName: <local-queue-name>
+    serviceAccountName: <runner-service-account-name>
+```
 
 ```shell
-export PIPELINE_EVENT_URL="https://console.example.com/api/pipeline/runner-events"
 moka submit "fix the login bug" --quick
 moka submit "Implement PIPE-54"
 ```
@@ -142,7 +158,7 @@ For a local cluster, point the same commands at that cluster with
 `--kubeconfig <path>` and `--namespace <namespace>`:
 
 ```shell
-moka submit "fix the login bug" --quick --kubeconfig ~/.kube/config --namespace momokaya-pipeline
+moka submit "fix the login bug" --quick --kubeconfig ~/.kube/config --namespace <workflow-namespace>
 ```
 
 There is no separate workstation-local `submit` path; local submission means
@@ -169,7 +185,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Workflow
 metadata:
   generateName: pipeline-run-alpha-
-  namespace: momokaya-pipeline
+  namespace: <workflow-namespace>
 spec:
   entrypoint: pipeline
   onExit: pipeline-finalizer
@@ -211,17 +227,28 @@ Secret volume at the path configured in `events.authTokenFile`.
 
 Expected namespace resources:
 
-- ServiceAccount `pipeline-runner` with the required RBAC
-- Secret `opencode-auth-1` with key `auth.json`
-- Secret `pipeline-runner-event-auth` with key
-  `OISIN_PIPELINE_EVENT_AUTH_TOKEN`
-- Secret `oisin-bot-github-auth` with keys `gitconfig`, `git-credentials`, and
-  `hosts.yml`
+- The ServiceAccount named by `submit.serviceAccountName` with the required RBAC
+- The OpenCode auth Secret named by `submit.opencodeAuthSecretName` with key
+  `auth.json`
+- The event auth Secret named by `submit.eventAuthSecretName` with the key named
+  by `submit.eventAuthSecretKey`
+- The git credentials Secret named by `submit.gitCredentialsSecretName` using
+  the same key conventions as Flux `GitRepository` credentials: `username` and
+  `password` for HTTPS remotes, or `identity` and `known_hosts` for SSH remotes
+- The GitHub CLI auth Secret named by `submit.githubAuthSecretName` with key
+  `hosts.yml`; this Secret is for `gh` and pull request delivery, not git
+  clone/fetch/push authentication
 - A pipeline-console event sink reachable from the pod
 
-Credential rotation is owned by the infra repository scripts. `moka submit`
-references the managed Momokaya Secret names; it does not accept per-run auth
-Secret overrides.
+Credential issuance and rotation are owned by the cluster/infra layer, not by
+runner payloads; existing infra repository scripts can continue to own the
+operator-facing lifecycle. Recommended production setups use External Secrets
+Operator or Secrets Store CSI Driver. For GitHub HTTPS, prefer a GitHub App
+installation token materialized by External Secrets Operator's
+`GithubAccessToken` generator with a refresh interval below the token lifetime,
+then template it as `username`/`password`. For SSH, materialize `identity` and
+`known_hosts` from the external secret manager. `moka submit` references
+configured Secret names; it does not accept per-run secret values.
 
 ## Payload Contract
 

package/docs/pipeline-console-runner-contract.md

@@ -43,7 +43,7 @@ validation, tests, and docs.
   "events": {
     "url": "https://console.example/api/pipeline/runner-events",
     "authHeader": "Authorization",
-    "authTokenFile": "/etc/pipeline/event-auth/OISIN_PIPELINE_EVENT_AUTH_TOKEN"
+    "authTokenFile": "/etc/pipeline/event-auth/<event-auth-secret-key>"
   }
 }
 ```
@@ -160,11 +160,16 @@ environment and mounted secrets.
 
 Expected runner Job secrets and mounts include:
 
-- `opencode-auth-1` mounted at `/root/.local/share/opencode/auth.json`
-- `pipeline-runner-event-auth` mounted at
-  `/etc/pipeline/event-auth/OISIN_PIPELINE_EVENT_AUTH_TOKEN`
+- The configured OpenCode auth Secret mounted at
+  `/root/.local/share/opencode/auth.json`
+- The configured event auth Secret mounted at
+  `/etc/pipeline/event-auth/<event-auth-secret-key>`
 - MCP gateway auth Secret mounted at a path referenced by the runner
-- `oisin-bot-github-auth` mounted for GitHub auth usable by both `git` and `gh`
+- The configured git credentials Secret mounted for `git`; HTTPS remotes use
+  `username` and `password`, and SSH remotes use `identity` and `known_hosts`
+  following Flux `GitRepository` credential conventions
+- The configured GitHub CLI auth Secret mounted for `gh` when pull request
+  delivery is enabled
 
 The runner image sets `HOME=/root`; Kubernetes must project each numbered auth
 Secret with the key `auth.json` into the target directory. The runner does not
@@ -172,6 +177,12 @@ read event auth tokens or payloads from environment variables. No
 `OISIN_PIPELINE_RUNNER_PAYLOAD_JSON`, `PIPELINE_EVENT_API_TOKEN`, or
 `OPENCODE_AUTH_JSON` env vars are used.
 
+Git credential issuance and rotation are cluster concerns. For GitHub HTTPS,
+operators should prefer GitHub App installation tokens generated by External
+Secrets Operator or equivalent control-plane automation. For SSH, operators
+must provide both the private identity and pinned `known_hosts` data. Runner
+payloads never carry credential values or Secret names.
+
 ## Boundary
 
 The `moka` command is its own user-facing command and runtime. Argo

package/package.json

@@ -70,6 +70,10 @@
       "types": "./dist/moka-submit.d.ts",
       "import": "./dist/moka-submit.js"
     },
+    "./moka-global-config": {
+      "types": "./dist/moka-global-config.d.ts",
+      "import": "./dist/moka-global-config.js"
+    },
     "./planner": {
       "types": "./dist/workflow-planner.d.ts",
       "import": "./dist/workflow-planner.js"
@@ -118,7 +122,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.27.17",
+  "version": "1.27.18",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",