@oisincoveney/pipeline 1.27.17 → 1.27.19

package/README.md

@@ -241,7 +241,7 @@ runner.
 
 | Host | Generated files | Invocation |
 | --- | --- | --- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` |
 
 The installer is idempotent, supports `--check` and `--dry-run`, and refuses to
 overwrite manually edited files unless `--force` is supplied.

package/dist/argo-submit.d.ts

@@ -8,6 +8,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodOptional<z.ZodString>;
   image: z.ZodOptional<z.ZodString>;
   imagePullPolicy: z.ZodOptional<z.ZodEnum<{
@@ -18,7 +19,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodString;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   queueName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -24,6 +24,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: z.string().min(1).optional(),
 	generateName: z.string().min(1).optional(),
+	gitCredentialsSecretName: z.string().min(1).optional(),
 	githubAuthSecretName: z.string().min(1).optional(),
 	image: z.string().min(1).optional(),
 	imagePullPolicy: z.enum([
@@ -34,7 +35,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	imagePullSecretName: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
-	namespace: z.string().min(1).default("momokaya-pipeline"),
+	namespace: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	queueName: z.string().min(1).optional(),
@@ -72,6 +73,7 @@ async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,
+		gitCredentialsSecretName: options.gitCredentialsSecretName,
 		githubAuthSecretName: options.githubAuthSecretName,
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,

package/dist/argo-workflow.d.ts

@@ -102,6 +102,7 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
           key: z.ZodString;
           path: z.ZodString;
         }, z.core.$strict>>>;
+        optional: z.ZodOptional<z.ZodBoolean>;
         secretName: z.ZodString;
       }, z.core.$strict>>;
     }, z.core.$strict>>;
@@ -112,6 +113,7 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
   githubAuthSecretName: z.ZodOptional<z.ZodString>;
   annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   image: z.ZodDefault<z.ZodString>;

package/dist/argo-workflow.js

@@ -10,6 +10,11 @@ const RUNNER_WORKFLOW_SERVICE_ACCOUNT = "pipeline-runner";
 const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
 const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
 const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
+const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
+const RUNNER_OPENCODE_ENV = [{
+	name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
+	value: "0"
+}];
 const kubernetesNameSchema = z.string().min(1);
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
@@ -26,6 +31,7 @@ const secretVolumeSchema = z.object({
 		key: z.string().min(1),
 		path: z.string().min(1)
 	}).strict()).optional(),
+	optional: z.boolean().optional(),
 	secretName: kubernetesNameSchema
 }).strict();
 const argoWorkflowVolumeSchema = z.object({
@@ -110,6 +116,7 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: kubernetesNameSchema.optional(),
 	generateName: z.string().min(1).optional(),
+	gitCredentialsSecretName: kubernetesNameSchema.optional(),
 	githubAuthSecretName: kubernetesNameSchema.optional(),
 	annotations: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
 	image: z.string().min(1).default(RUNNER_WORKFLOW_IMAGE),
@@ -270,38 +277,51 @@ function runnerWorkflowStorage(options, tasks) {
 			subPath: "auth.json"
 		});
 	}
-	if (options.githubAuthSecretName) {
+	if (options.gitCredentialsSecretName) {
 		volumes.push({
-			name: "github-auth",
+			name: "runner-git-credentials",
 			secret: {
+				defaultMode: 256,
 				items: [
 					{
-						key: "gitconfig",
-						path: "gitconfig"
+						key: "username",
+						path: "username"
 					},
 					{
-						key: "git-credentials",
-						path: "git-credentials"
+						key: "password",
+						path: "password"
 					},
 					{
-						key: "hosts.yml",
-						path: "hosts.yml"
+						key: "identity",
+						path: "identity"
+					},
+					{
+						key: "known_hosts",
+						path: "known_hosts"
 					}
 				],
-				secretName: options.githubAuthSecretName
+				optional: true,
+				secretName: options.gitCredentialsSecretName
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.gitconfig",
-			name: "github-auth",
-			readOnly: true,
-			subPath: "gitconfig"
-		}, {
-			mountPath: "/root/.git-credentials",
+			mountPath: RUNNER_GIT_CREDENTIALS_PATH,
+			name: "runner-git-credentials",
+			readOnly: true
+		});
+	}
+	if (options.githubAuthSecretName) {
+		volumes.push({
 			name: "github-auth",
-			readOnly: true,
-			subPath: "git-credentials"
-		}, {
+			secret: {
+				items: [{
+					key: "hosts.yml",
+					path: "hosts.yml"
+				}],
+				secretName: options.githubAuthSecretName
+			}
+		});
+		volumeMounts.push({
 			mountPath: "/root/.config/gh/hosts.yml",
 			name: "github-auth",
 			readOnly: true,
@@ -330,6 +350,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -352,6 +373,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/codex-auth-sync.js

@@ -0,0 +1,98 @@
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { parse } from "jsonc-parser";
+//#region src/codex-auth-sync.ts
+const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth";
+const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
+function syncLocalCodexAuth(options) {
+	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
+	const hasErrors = items.some((item) => item.action === "error");
+	const checkFailed = options.check === true && hasRequiredChanges;
+	return {
+		items,
+		ok: !(hasErrors || checkFailed)
+	};
+}
+function formatCodexAuthSyncResult(result) {
+	const lines = result.items.map((item) => {
+		const suffix = item.message ? `: ${item.message}` : "";
+		return `${item.action} ${item.path}${suffix}`;
+	});
+	if (!result.ok) lines.push("codex-auth sync-local check failed");
+	return lines.join("\n");
+}
+function syncGlobalPluginConfig(path, options) {
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const parsed = parseJsonObject(currentText ?? "{}");
+	if (!parsed.ok) return {
+		action: "error",
+		message: formatParseErrors(parsed.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, `${JSON.stringify({
+		...parsed.value,
+		perProjectAccounts: false
+	}, null, 2)}\n`, options);
+}
+function syncProjectOpenCodeConfig(repo, options) {
+	const path = join(repo, ".opencode/opencode.json");
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const merged = mergeOpenCodeProjectConfig(currentText, { plugin: [CODEX_MULTI_AUTH_PLUGIN] });
+	if (!merged.ok) return {
+		action: "error",
+		message: formatParseErrors(merged.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, merged.content, options);
+}
+function writeIfChanged(path, currentText, nextText, options) {
+	if (currentText === nextText) return {
+		action: "unchanged",
+		path
+	};
+	const action = currentText === void 0 ? "create" : "update";
+	if (!(options.check || options.dryRun)) {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, nextText);
+	}
+	return {
+		action,
+		path
+	};
+}
+function discoverGitRepositories(root) {
+	return readdirSync(root).map((name) => join(root, name)).filter((path) => isDirectory(path) && existsSync(join(path, ".git"))).sort((a, b) => a.localeCompare(b));
+}
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function parseJsonObject(content) {
+	const errors = [];
+	const value = parse(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0 || !isRecord(value)) return {
+		errors,
+		ok: false
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function formatParseErrors(errors) {
+	return errors.length > 0 ? `invalid JSONC (${errors.length} parse error${errors.length === 1 ? "" : "s"})` : "expected a JSON object";
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { formatCodexAuthSyncResult, syncLocalCodexAuth };

package/dist/config.js

@@ -315,7 +315,7 @@ hooks:
 runner_command:
   environment:
     setup:
-      - command: pnpm
+      - command: bun
         args: [install, --frozen-lockfile]
 scheduler:
   commands:

package/dist/index.js

@@ -4,12 +4,14 @@ import { PipelineConfigError, loadPipelineConfig } from "./config.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
+import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "./codex-auth-sync.js";
 import { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands } from "./commands/pipeline-command.js";
 import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
 import { registerRunnerCommandCommand } from "./commands/runner-command-command.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { loadMokaGlobalConfig } from "./moka-global-config.js";
 import { submitMoka } from "./moka-submit.js";
 import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
@@ -288,6 +290,15 @@ function createCliProgram() {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
+	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
+		const result = syncLocalCodexAuth({
+			check: flags.check,
+			dryRun: flags.dryRun,
+			root: resolve(flags.root ?? process.env.PIPELINE_TARGET_PATH ?? process.cwd())
+		});
+		console.log(formatCodexAuthSyncResult(result));
+		if (!result.ok) process.exitCode = 1;
+	});
 	addMokaSubmitOptions(program.command("submit").description("Submit work to Momokaya as an Argo Workflow").argument("[input...]", "task description, or command argv with --command")).action(async (input, flags) => {
 		const result = await runMokaSubmitFromCli(input, flags);
 		console.log(`Workflow submitted: ${result.workflowName} in ${result.namespace}`);
@@ -313,31 +324,40 @@ function addMokaSubmitOptions(command) {
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+	const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
+	const globalConfig = loadMokaGlobalConfig();
 	const commonOptions = mokaCommonSubmitOptions({
-		config: loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }),
+		config,
 		cwd,
-		eventUrl: resolveMokaEventUrl(flags),
-		flags
+		eventUrl: resolveMokaEventUrl(flags, globalConfig),
+		flags,
+		globalConfig
 	});
 	if (flags.command) return submitMokaCommandFromCli(input, flags, commonOptions);
 	return submitMokaGraphFromCli(input, flags, commonOptions);
 }
-function resolveMokaEventUrl(flags) {
-	return flags.eventUrl ?? process.env.PIPELINE_EVENT_URL ?? "https://pipeline-console.momokaya.ee/api/pipeline/runner-events";
+function resolveMokaEventUrl(flags, globalConfig) {
+	return flags.eventUrl ?? globalConfig?.momokaya.submit.eventUrl;
 }
 function mokaCommonSubmitOptions(input) {
+	const momokaya = input.globalConfig?.momokaya;
 	return {
 		config: input.config,
 		eventUrl: input.eventUrl,
+		eventAuthSecretKey: momokaya?.submit.eventAuthSecretKey,
+		eventAuthSecretName: momokaya?.submit.eventAuthSecretName,
 		generateName: input.flags.generateName,
+		gitCredentialsSecretName: momokaya?.submit.gitCredentialsSecretName,
+		githubAuthSecretName: momokaya?.submit.githubAuthSecretName,
 		image: input.flags.image,
 		imagePullPolicy: parseImagePullPolicy(input.flags.imagePullPolicy),
-		imagePullSecretName: input.flags.imagePullSecret,
-		kubeconfigPath: input.flags.kubeconfig,
+		imagePullSecretName: input.flags.imagePullSecret ?? momokaya?.submit.imagePullSecretName,
+		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
-		namespace: input.flags.namespace,
-		queueName: input.flags.queueName,
-		serviceAccountName: input.flags.serviceAccount,
+		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
+		queueName: input.flags.queueName ?? momokaya?.submit.queueName,
+		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};
 }
@@ -377,7 +397,7 @@ function parseGatewayHostScope(value) {
 	throw new Error("scope must be project or global");
 }
 function addRunnerArgoOptions(command, options = {}) {
-	command.option("--name <name>", "Workflow metadata.name").option("--generate-name <prefix>", "Workflow metadata.generateName").option("--namespace <namespace>", "Workflow namespace", "momokaya-pipeline");
+	command.option("--name <name>", "Workflow metadata.name").option("--generate-name <prefix>", "Workflow metadata.generateName").option("--namespace <namespace>", "Workflow namespace");
 	if (options.kubeconfig) command.option("--kubeconfig <path>", "kubeconfig path");
 	return command.option("--queue-name <name>", "Kueue LocalQueue label for Workflow pods").option("--service-account <name>", "Workflow service account").option("--image <image>", "runner image").addOption(new Option("--image-pull-policy <policy>", "runner image pull policy").choices([
 		"Always",

package/dist/install-commands.js

@@ -1,8 +1,8 @@
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, loadPipelineConfig } from "./config.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { renderOpenCodeGatewayConfig } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
-import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import matter from "gray-matter";
@@ -18,7 +18,8 @@ const AGENTS_MD_START = "<!-- @oisincoveney/pipeline:agents:start -->";
 const AGENTS_MD_END = "<!-- @oisincoveney/pipeline:agents:end -->";
 const SINGLE_OPENCODE_PLUGIN_ARRAY_RE = /\n {2}"plugin": \[\n {4}("[^"]+")\n {2}\]/;
 const OPENCODE_PROJECT_CONFIG_PATH = ".opencode/opencode.json";
-const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/([^/]+)\.md$/] };
+const OPENCODE_COMMAND_PREFIX = "moka-";
+const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/(?:moka-)?([^/]+)\.md$/] };
 const COMMAND_HOSTS = ["opencode"];
 const OPENCODE_ORCHESTRATOR_AGENT_ID = "MoKa Orchestrator";
 const MOKA_PROFILE_PREFIX = "moka-";
@@ -172,7 +173,7 @@ function entrypointDispatchBlock(host, config, id, entrypoint) {
 		`The schedule policy is \`${entrypoint.schedule}\`.`,
 		id === "quick" ? "Run `moka submit --quick <task description>` to submit the graph as an Argo Workflow." : `Run \`moka submit <task description>\` to submit the \`${id}\` graph as an Argo Workflow.`,
 		"The pipeline runtime executes as Argo DAG tasks using the package-owned runner image.",
-		"Use `--kubeconfig <path>` and `--namespace <namespace>` to target a local or remote Kubernetes cluster.",
+		"Configure the target in `~/.config/moka/config.yaml`; use `--kubeconfig <path>` and `--namespace <namespace>` only for explicit command overrides.",
 		"Use `moka submit --schedule <schedule.yaml> <task description>` only when rerunning an existing schedule artifact."
 	].join("\n");
 }
@@ -334,7 +335,7 @@ function opencodeDefinitions(config, cwd) {
 			]).join("\n")),
 			host: "opencode",
 			invocation: invocationForHost("opencode", id),
-			path: `.opencode/commands/${id}.md`
+			path: `.opencode/commands/${commandIdForHost("opencode", id)}.md`
 		})),
 		{
 			content: renderOpenCodeProjectConfig(config),
@@ -401,7 +402,7 @@ function projectAgentsMdDefinition(cwd, host) {
 			"",
 			"This repository uses package-owned `@oisincoveney/pipeline` config.",
 			"",
-			"- Use `/quick`, `/execute`, or `/inspect` for OpenCode slash-command entrypoints when available.",
+			"- Use `/moka-quick`, `/moka-execute`, or `/moka-inspect` for OpenCode slash-command entrypoints when available.",
 			"- Load and follow the relevant skill from `.agents/skills` before doing specialized work.",
 			"- Prefer the package-defined pipeline profiles and generated command surfaces over ad hoc subagent prompts.",
 			"",
@@ -446,7 +447,8 @@ function selectedHosts(host) {
 const GENERATED_RESOURCE_ROOTS = { opencode: [
 	".opencode/commands",
 	".opencode/agents",
-	".opencode/plugins"
+	".opencode/plugins",
+	".opencode/skills"
 ] };
 async function listFiles(root) {
 	if (!existsSync(root)) return [];
@@ -484,7 +486,11 @@ function entrypointIdFromGeneratedPath(host, path) {
 	}
 }
 function invocationForHost(host, entrypointId = "execute") {
-	return `${{ opencode: "/" }[host]}${entrypointId} <task description>`;
+	return `${{ opencode: "/" }[host]}${commandIdForHost(host, entrypointId)} <task description>`;
+}
+function commandIdForHost(host, entrypointId) {
+	if (host === "opencode") return `${OPENCODE_COMMAND_PREFIX}${entrypointId}`;
+	return entrypointId;
 }
 function resolveDefinitionContent(definition, target) {
 	if (definition.path !== OPENCODE_PROJECT_CONFIG_PATH || !existsSync(target)) return {

package/dist/moka-global-config.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+
+//#region src/moka-global-config.d.ts
+declare const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
+declare const mokaGlobalConfigSchema: z.ZodObject<{
+  momokaya: z.ZodObject<{
+    kubernetes: z.ZodObject<{
+      kubeconfig: z.ZodOptional<z.ZodString>;
+      namespace: z.ZodString;
+    }, z.core.$strict>;
+    submit: z.ZodObject<{
+      eventAuthSecretKey: z.ZodString;
+      eventAuthSecretName: z.ZodString;
+      eventUrl: z.ZodString;
+      gitCredentialsSecretName: z.ZodString;
+      githubAuthSecretName: z.ZodString;
+      imagePullSecretName: z.ZodString;
+      opencodeAuthSecretName: z.ZodString;
+      queueName: z.ZodString;
+      serviceAccountName: z.ZodString;
+    }, z.core.$strict>;
+  }, z.core.$strict>;
+}, z.core.$strict>;
+type MokaGlobalConfig = z.infer<typeof mokaGlobalConfigSchema>;
+declare function mokaGlobalConfigPath(homeDir?: string): string;
+declare function loadMokaGlobalConfig(): MokaGlobalConfig | null;
+declare function parseMokaGlobalConfig(source: string, sourcePath: string): MokaGlobalConfig;
+//#endregion
+export { MOKA_GLOBAL_CONFIG_PATH, MokaGlobalConfig, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };

package/dist/moka-global-config.js

@@ -0,0 +1,56 @@
+import { PipelineConfigError } from "./config.js";
+import { parseDocument } from "yaml";
+import { z } from "zod";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+//#region src/moka-global-config.ts
+const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
+const mokaSubmitGlobalConfigSchema = z.object({
+	eventAuthSecretKey: z.string().min(1),
+	eventAuthSecretName: z.string().min(1),
+	eventUrl: z.string().url(),
+	gitCredentialsSecretName: z.string().min(1),
+	githubAuthSecretName: z.string().min(1),
+	imagePullSecretName: z.string().min(1),
+	opencodeAuthSecretName: z.string().min(1),
+	queueName: z.string().min(1),
+	serviceAccountName: z.string().min(1)
+}).strict();
+const mokaKubernetesGlobalConfigSchema = z.object({
+	kubeconfig: z.string().min(1).optional(),
+	namespace: z.string().min(1)
+}).strict();
+const mokaGlobalConfigSchema = z.object({ momokaya: z.object({
+	kubernetes: mokaKubernetesGlobalConfigSchema,
+	submit: mokaSubmitGlobalConfigSchema
+}).strict() }).strict();
+function mokaGlobalConfigPath(homeDir = homedir()) {
+	return join(homeDir, MOKA_GLOBAL_CONFIG_PATH);
+}
+function loadMokaGlobalConfig() {
+	const configPath = mokaGlobalConfigPath();
+	if (!existsSync(configPath)) return null;
+	return parseMokaGlobalConfig(readFileSync(configPath, "utf8"), configPath);
+}
+function parseMokaGlobalConfig(source, sourcePath) {
+	const document = parseDocument(source, {
+		prettyErrors: false,
+		uniqueKeys: true
+	});
+	if (document.errors.length > 0) throw new PipelineConfigError("PIPELINE_CONFIG_PARSE_ERROR", `Failed to parse ${sourcePath}`, document.errors.map((err) => ({
+		message: err.message,
+		path: sourcePath
+	})));
+	const parsed = mokaGlobalConfigSchema.safeParse(document.toJS());
+	if (!parsed.success) {
+		const issues = parsed.error.issues.map((issue) => ({
+			path: issue.path.join("."),
+			message: issue.message
+		}));
+		throw new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", [`Invalid ${sourcePath}:`, ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
+	}
+	return parsed.data;
+}
+//#endregion
+export { MOKA_GLOBAL_CONFIG_PATH, loadMokaGlobalConfig, mokaGlobalConfigPath, mokaGlobalConfigSchema, parseMokaGlobalConfig };

package/dist/moka-submit.d.ts

@@ -73,16 +73,17 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
-  eventAuthSecretKey: z.ZodDefault<z.ZodString>;
-  eventAuthSecretName: z.ZodDefault<z.ZodString>;
-  eventUrl: z.ZodDefault<z.ZodString>;
+  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
+  eventAuthSecretName: z.ZodOptional<z.ZodString>;
+  eventUrl: z.ZodOptional<z.ZodString>;
   events: z.ZodOptional<z.ZodObject<{
     authHeader: z.ZodDefault<z.ZodString>;
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
+  githubAuthSecretName: z.ZodOptional<z.ZodString>;
   hookPolicy: z.ZodOptional<z.ZodObject<{
     allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
     allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
@@ -142,12 +143,12 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     IfNotPresent: "IfNotPresent";
     Never: "Never";
   }>>;
-  imagePullSecretName: z.ZodDefault<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
-  opencodeAuthSecretName: z.ZodDefault<z.ZodString>;
-  queueName: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodOptional<z.ZodString>;
+  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  queueName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -158,7 +159,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     project: z.ZodString;
     requestedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
     quick: "quick";
     full: "full";
@@ -185,16 +186,17 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
-  eventAuthSecretKey: z.ZodDefault<z.ZodString>;
-  eventAuthSecretName: z.ZodDefault<z.ZodString>;
-  eventUrl: z.ZodDefault<z.ZodString>;
+  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
+  eventAuthSecretName: z.ZodOptional<z.ZodString>;
+  eventUrl: z.ZodOptional<z.ZodString>;
   events: z.ZodOptional<z.ZodObject<{
     authHeader: z.ZodDefault<z.ZodString>;
     authTokenFile: z.ZodOptional<z.ZodString>;
     url: z.ZodString;
   }, z.core.$strict>>;
   generateName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
+  githubAuthSecretName: z.ZodOptional<z.ZodString>;
   hookPolicy: z.ZodOptional<z.ZodObject<{
     allowCommandHooks: z.ZodOptional<z.ZodBoolean>;
     allowUntrustedCommandHooks: z.ZodOptional<z.ZodBoolean>;
@@ -254,12 +256,12 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     IfNotPresent: "IfNotPresent";
     Never: "Never";
   }>>;
-  imagePullSecretName: z.ZodDefault<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodDefault<z.ZodString>;
-  opencodeAuthSecretName: z.ZodDefault<z.ZodString>;
-  queueName: z.ZodDefault<z.ZodString>;
+  namespace: z.ZodOptional<z.ZodString>;
+  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  queueName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -270,7 +272,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     project: z.ZodString;
     requestedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strict>>;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
   commandArgv: z.ZodArray<z.ZodString>;
   task: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"prompt">;
@@ -315,13 +317,14 @@ interface MokaWorkflowSubmitOptions {
   eventAuthSecretKey?: string;
   eventAuthSecretName?: string;
   generateName?: string;
+  gitCredentialsSecretName?: string;
   githubAuthSecretName?: string;
   image?: string;
   imagePullPolicy?: "Always" | "IfNotPresent" | "Never";
   imagePullSecretName?: string;
   kubeconfigPath?: string;
   name?: string;
-  namespace?: string;
+  namespace: string;
   opencodeAuthSecretName?: string;
   payloadJson: string;
   queueName?: string;

package/dist/moka-submit.js

@@ -9,14 +9,6 @@ import parseGitUrl from "git-url-parse";
 import { resolve } from "node:path";
 import { simpleGit } from "simple-git";
 //#region src/moka-submit.ts
-const MOMOKAYA_EVENT_AUTH_SECRET_KEY = "OISIN_PIPELINE_EVENT_AUTH_TOKEN";
-const MOMOKAYA_EVENT_AUTH_SECRET_NAME = "pipeline-runner-event-auth";
-const MOMOKAYA_EVENT_URL = "https://pipeline-console.momokaya.ee/api/pipeline/runner-events";
-const MOMOKAYA_GITHUB_AUTH_SECRET_NAME = "oisin-bot-github-auth";
-const MOMOKAYA_IMAGE_PULL_SECRET_NAME = "ghcr-pull-secret";
-const MOMOKAYA_OPENCODE_AUTH_SECRET_NAME = "opencode-auth-1";
-const MOMOKAYA_QUEUE_NAME = "momokaya-pipeline";
-const MOMOKAYA_RUNNER_SERVICE_ACCOUNT_NAME = "pipeline-runner";
 const imagePullPolicySchema = z.enum([
 	"Always",
 	"IfNotPresent",
@@ -69,25 +61,26 @@ const mokaSubmitResultSchema = workflowSubmitResultSchema;
 const mokaSubmitBaseOptionsSchema = z.object({
 	delivery: runnerDeliverySchema.default({ pullRequest: false }),
 	eventSink: mokaSubmitEventsSchema.optional(),
-	eventAuthSecretKey: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_KEY),
-	eventAuthSecretName: z.string().min(1).default(MOMOKAYA_EVENT_AUTH_SECRET_NAME),
-	eventUrl: z.string().url().default(MOMOKAYA_EVENT_URL),
+	eventAuthSecretKey: z.string().min(1).optional(),
+	eventAuthSecretName: z.string().min(1).optional(),
+	eventUrl: z.string().url().optional(),
 	events: mokaSubmitEventsSchema.optional(),
 	generateName: z.string().min(1).optional(),
-	githubAuthSecretName: z.string().min(1).default(MOMOKAYA_GITHUB_AUTH_SECRET_NAME),
+	gitCredentialsSecretName: z.string().min(1).optional(),
+	githubAuthSecretName: z.string().min(1).optional(),
 	hookPolicy: mokaSubmitHookPolicySchema.optional(),
 	hooks: mokaSubmitDirectHooksSchema.optional(),
 	image: z.string().min(1).optional(),
 	imagePullPolicy: imagePullPolicySchema,
-	imagePullSecretName: z.string().min(1).default(MOMOKAYA_IMAGE_PULL_SECRET_NAME),
+	imagePullSecretName: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
-	namespace: z.string().min(1).default("momokaya-pipeline"),
-	opencodeAuthSecretName: z.string().min(1).default(MOMOKAYA_OPENCODE_AUTH_SECRET_NAME),
-	queueName: z.string().min(1).default(MOMOKAYA_QUEUE_NAME),
+	namespace: z.string().min(1).optional(),
+	opencodeAuthSecretName: z.string().min(1).optional(),
+	queueName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
-	serviceAccountName: z.string().min(1).default(MOMOKAYA_RUNNER_SERVICE_ACCOUNT_NAME)
+	serviceAccountName: z.string().min(1).optional()
 }).strict();
 const mokaGraphSubmitOptionsSchema = mokaSubmitBaseOptionsSchema.extend({
 	mode: z.enum(["full", "quick"]),
@@ -107,6 +100,11 @@ const mokaSubmitOptionsSchema = z.discriminatedUnion("type", [mokaGraphSubmitOpt
 		message: "Choose either eventSink or events, not both",
 		path: ["eventSink"]
 	});
+	if (data.eventSink === void 0 && data.events === void 0 && data.eventUrl === void 0) ctx.addIssue({
+		code: "custom",
+		message: "eventUrl is required unless eventSink or events is provided",
+		path: ["eventUrl"]
+	});
 });
 const submitHookId = (event) => `moka-submit-${event.replaceAll(".", "-")}`;
 function objectWithoutUndefined(value) {
@@ -284,18 +282,23 @@ function workflowSubmitOptions(options) {
 	return {
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
+		gitCredentialsSecretName: options.gitCredentialsSecretName,
 		githubAuthSecretName: options.githubAuthSecretName,
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,
 		imagePullSecretName: options.imagePullSecretName,
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
-		namespace: options.namespace,
+		namespace: requireSubmitOption(options.namespace, "namespace"),
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		queueName: options.queueName,
 		serviceAccountName: options.serviceAccountName
 	};
 }
+function requireSubmitOption(value, name) {
+	if (!value) throw new Error(`${name} is required for moka submit`);
+	return value;
+}
 function runnerPayloadJson(input) {
 	return JSON.stringify(buildRunnerCommandPayload({
 		delivery: input.options.delivery,
@@ -323,6 +326,7 @@ function runnerEvents(options) {
 		authTokenFile: eventSink.authTokenFile ?? eventAuthTokenFile(options),
 		url: eventSink.url
 	};
+	if (!options.eventUrl) throw new Error("eventUrl is required unless eventSink or events is provided");
 	return {
 		authHeader: "Authorization",
 		authTokenFile: eventAuthTokenFile(options),
@@ -330,19 +334,23 @@ function runnerEvents(options) {
 	};
 }
 function eventAuthTokenFile(options) {
+	if (!options.eventAuthSecretKey) throw new Error("eventAuthSecretKey is required unless eventSink.authTokenFile is provided");
 	return `/etc/pipeline/event-auth/${options.eventAuthSecretKey}`;
 }
 async function resolveSubmissionContext(options, dependencies, runId) {
 	const explicitContext = explicitSubmissionContext(options);
 	if (explicitContext) return explicitContext;
 	const git = await resolveRequiredGit(options, dependencies);
+	const repository = repositoryContext(options, git);
+	assertRepositoryCredentialConfiguration(options);
 	return {
-		repository: repositoryContext(options, git),
+		repository,
 		run: runContext(options, git, runId)
 	};
 }
 function explicitSubmissionContext(options) {
 	if (!(options.repository && options.run)) return null;
+	assertRepositoryCredentialConfiguration(options);
 	return {
 		repository: options.repository,
 		run: options.run
@@ -359,6 +367,9 @@ function repositoryContext(options, git) {
 		url: git.url
 	};
 }
+function assertRepositoryCredentialConfiguration(options) {
+	if (!options.gitCredentialsSecretName) throw new Error("gitCredentialsSecretName is required for runner git clone, fetch, and push operations");
+}
 function runContext(options, git, runId) {
 	return options.run ?? {
 		id: runId,

package/dist/run-state/git-refs.js

@@ -1,14 +1,15 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
-const DEFAULT_GIT_CREDENTIAL_STORE = "/root/.git-credentials";
+const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
 const WRITABLE_GIT_CREDENTIAL_STORE = resolve(tmpdir(), "pipeline-git-credentials");
+const SCP_LIKE_SSH_REMOTE_RE = /^[^@\s]+@[^:\s]+:.+/u;
 const execGit = promisify(execFile);
-let preparedCredentialStore;
+let preparedBasicAuthCredentialStore;
 function runnerGitRefs(payload, nodeId) {
 	const prefix = `refs/heads/pipeline/runs/${payload.run.id}/${payload.workflow.id}`;
 	return {
@@ -102,21 +103,19 @@ async function configureGitCommitter(worktreePath, committer) {
 	]);
 }
 function runnerGitCommandArgs(args) {
-	return [...gitCredentialConfigArgs(), ...args];
+	return [...gitCredentialConfigArgs(remoteUrlFromGitArgs(args)), ...args];
 }
 async function runGit(cwd, args) {
+	const remoteUrl = remoteUrlFromGitArgs(args);
 	const { stdout } = await execGit("git", runnerGitCommandArgs(args), {
 		cwd,
 		encoding: "utf8",
-		env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		}
+		env: runnerGitEnv(remoteUrl)
 	});
 	return stdout;
 }
-function gitCredentialConfigArgs() {
-	const writablePath = prepareWritableGitCredentialStore();
+function gitCredentialConfigArgs(remoteUrl) {
+	const writablePath = prepareWritableGitCredentialStore(remoteUrl);
 	if (!writablePath) return [];
 	return [
 		"-c",
@@ -125,26 +124,102 @@ function gitCredentialConfigArgs() {
 		`credential.helper=store --file=${writablePath}`
 	];
 }
-function prepareWritableGitCredentialStore() {
-	const sourcePath = availableGitCredentialStore();
-	if (!sourcePath) return;
+function prepareWritableGitCredentialStore(remoteUrl) {
 	const writablePath = writableGitCredentialStore();
-	copyGitCredentialStore(sourcePath, writablePath);
-	return writablePath;
+	const basicAuth = availableBasicAuthCredentials();
+	if (basicAuth) return prepareBasicAuthCredentialStore(basicAuth, writablePath, remoteUrl);
+}
+function availableBasicAuthCredentials() {
+	const credentialsDir = gitCredentialsDir();
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return;
+	return {
+		password: readCredentialFile(passwordPath),
+		username: readCredentialFile(usernamePath)
+	};
 }
-function availableGitCredentialStore() {
-	const sourcePath = process.env.PIPELINE_GIT_CREDENTIAL_STORE ?? DEFAULT_GIT_CREDENTIAL_STORE;
-	return existsSync(sourcePath) ? sourcePath : void 0;
+function gitCredentialsDir() {
+	return process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR;
 }
 function writableGitCredentialStore() {
 	return process.env.PIPELINE_WRITABLE_GIT_CREDENTIAL_STORE ?? WRITABLE_GIT_CREDENTIAL_STORE;
 }
-function copyGitCredentialStore(sourcePath, writablePath) {
-	if (preparedCredentialStore === writablePath) return;
+function writeGitCredentialStore(credentials, writablePath, host) {
 	mkdirSync(dirname(writablePath), { recursive: true });
-	copyFileSync(sourcePath, writablePath);
+	writeFileSync(writablePath, `https://${encodeURIComponent(credentials.username)}:${encodeURIComponent(credentials.password)}@${host}\n`, { mode: 384 });
 	chmodSync(writablePath, 384);
-	preparedCredentialStore = writablePath;
+}
+function prepareBasicAuthCredentialStore(credentials, writablePath, remoteUrl) {
+	const host = remoteUrl ? credentialHost(remoteUrl) : void 0;
+	if (!host) return existingPreparedBasicAuthCredentialStore(writablePath);
+	if (isPreparedBasicAuthCredentialStore(writablePath, host)) return writablePath;
+	writeGitCredentialStore(credentials, writablePath, host);
+	preparedBasicAuthCredentialStore = {
+		host,
+		path: writablePath
+	};
+	return writablePath;
+}
+function existingPreparedBasicAuthCredentialStore(writablePath) {
+	return preparedBasicAuthCredentialStore?.path === writablePath ? writablePath : void 0;
+}
+function isPreparedBasicAuthCredentialStore(writablePath, host) {
+	return preparedBasicAuthCredentialStore?.path === writablePath && preparedBasicAuthCredentialStore.host === host;
+}
+function runnerGitEnv(remoteUrl) {
+	const env = {
+		...process.env,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+	if (remoteUrl && isSshRemote(remoteUrl)) {
+		const sshCommand = gitSshCommand();
+		if (sshCommand) env.GIT_SSH_COMMAND = sshCommand;
+	}
+	return env;
+}
+function gitSshCommand() {
+	const credentialsDir = gitCredentialsDir();
+	const identityPath = resolve(credentialsDir, "identity");
+	const knownHostsPath = resolve(credentialsDir, "known_hosts");
+	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return;
+	chmodSync(identityPath, 256);
+	return [
+		"ssh",
+		"-i",
+		shellQuote(identityPath),
+		"-o",
+		"IdentitiesOnly=yes",
+		"-o",
+		`UserKnownHostsFile=${shellQuote(knownHostsPath)}`,
+		"-o",
+		"StrictHostKeyChecking=yes"
+	].join(" ");
+}
+function readCredentialFile(path) {
+	return readFileSync(path, "utf8").trim();
+}
+function remoteUrlFromGitArgs(args) {
+	if (args[0] === "clone") return args.find((arg) => isRemoteUrl(arg));
+}
+function isRemoteUrl(value) {
+	return value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
+}
+function isSshRemote(value) {
+	return value.startsWith("ssh://") || isScpLikeSshRemote(value);
+}
+function isScpLikeSshRemote(value) {
+	return SCP_LIKE_SSH_REMOTE_RE.test(value);
+}
+function credentialHost(remoteUrl) {
+	try {
+		return new URL(remoteUrl).host || void 0;
+	} catch {
+		return;
+	}
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 //#endregion
 export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef };

package/docs/operator-guide.md

@@ -129,11 +129,27 @@ description and current git context, creates payload/schedule ConfigMaps, and
 submits an Argo Workflow that runs the graph as DAG tasks using the package-owned
 runner image.
 
-`moka submit` uses the Momokaya default event sink unless overridden with
-`PIPELINE_EVENT_URL` or `--event-url`.
+`moka submit` reads the private Momokaya target from
+`~/.config/moka/config.yaml`.
+
+```yaml
+momokaya:
+  kubernetes:
+    kubeconfig: /path/to/cluster.kubeconfig
+    namespace: <workflow-namespace>
+  submit:
+    eventAuthSecretKey: <event-auth-secret-key>
+    eventAuthSecretName: <event-auth-secret-name>
+    eventUrl: <runner-event-sink-url>
+    gitCredentialsSecretName: <git-credentials-secret-name>
+    githubAuthSecretName: <github-auth-secret-name>
+    imagePullSecretName: <image-pull-secret-name>
+    opencodeAuthSecretName: <opencode-auth-secret-name>
+    queueName: <local-queue-name>
+    serviceAccountName: <runner-service-account-name>
+```
 
 ```shell
-export PIPELINE_EVENT_URL="https://console.example.com/api/pipeline/runner-events"
 moka submit "fix the login bug" --quick
 moka submit "Implement PIPE-54"
 ```
@@ -142,7 +158,7 @@ For a local cluster, point the same commands at that cluster with
 `--kubeconfig <path>` and `--namespace <namespace>`:
 
 ```shell
-moka submit "fix the login bug" --quick --kubeconfig ~/.kube/config --namespace momokaya-pipeline
+moka submit "fix the login bug" --quick --kubeconfig ~/.kube/config --namespace <workflow-namespace>
 ```
 
 There is no separate workstation-local `submit` path; local submission means
@@ -169,7 +185,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Workflow
 metadata:
   generateName: pipeline-run-alpha-
-  namespace: momokaya-pipeline
+  namespace: <workflow-namespace>
 spec:
   entrypoint: pipeline
   onExit: pipeline-finalizer
@@ -211,17 +227,28 @@ Secret volume at the path configured in `events.authTokenFile`.
 
 Expected namespace resources:
 
-- ServiceAccount `pipeline-runner` with the required RBAC
-- Secret `opencode-auth-1` with key `auth.json`
-- Secret `pipeline-runner-event-auth` with key
-  `OISIN_PIPELINE_EVENT_AUTH_TOKEN`
-- Secret `oisin-bot-github-auth` with keys `gitconfig`, `git-credentials`, and
-  `hosts.yml`
+- The ServiceAccount named by `submit.serviceAccountName` with the required RBAC
+- The OpenCode auth Secret named by `submit.opencodeAuthSecretName` with key
+  `auth.json`
+- The event auth Secret named by `submit.eventAuthSecretName` with the key named
+  by `submit.eventAuthSecretKey`
+- The git credentials Secret named by `submit.gitCredentialsSecretName` using
+  the same key conventions as Flux `GitRepository` credentials: `username` and
+  `password` for HTTPS remotes, or `identity` and `known_hosts` for SSH remotes
+- The GitHub CLI auth Secret named by `submit.githubAuthSecretName` with key
+  `hosts.yml`; this Secret is for `gh` and pull request delivery, not git
+  clone/fetch/push authentication
 - A pipeline-console event sink reachable from the pod
 
-Credential rotation is owned by the infra repository scripts. `moka submit`
-references the managed Momokaya Secret names; it does not accept per-run auth
-Secret overrides.
+Credential issuance and rotation are owned by the cluster/infra layer, not by
+runner payloads; existing infra repository scripts can continue to own the
+operator-facing lifecycle. Recommended production setups use External Secrets
+Operator or Secrets Store CSI Driver. For GitHub HTTPS, prefer a GitHub App
+installation token materialized by External Secrets Operator's
+`GithubAccessToken` generator with a refresh interval below the token lifetime,
+then template it as `username`/`password`. For SSH, materialize `identity` and
+`known_hosts` from the external secret manager. `moka submit` references
+configured Secret names; it does not accept per-run secret values.
 
 ## Payload Contract
 
@@ -260,13 +287,13 @@ Troubleshooting:
 Generated invocations include:
 
 ```text
-OpenCode: /quick, /execute, /inspect
+OpenCode: /moka-quick, /moka-execute, /moka-inspect
 Codex:    $quick, $execute, $inspect
 ```
 
 `moka init` and `moka install-commands --host opencode` generate:
 
-- `.opencode/commands/<entrypoint>.md` for `/quick`, `/execute`, and `/inspect`
+- `.opencode/commands/moka-<entrypoint>.md` for `/moka-quick`, `/moka-execute`, and `/moka-inspect`
 - `.opencode/agents/*.md` for primary and subagent profiles with explicit
   `permission` maps, `task` grants, and denied ungranted tools
 - `.opencode/skills/*/SKILL.md` from `npx skills add`, not Moka generation

package/docs/pipeline-console-runner-contract.md

@@ -43,7 +43,7 @@ validation, tests, and docs.
   "events": {
     "url": "https://console.example/api/pipeline/runner-events",
     "authHeader": "Authorization",
-    "authTokenFile": "/etc/pipeline/event-auth/OISIN_PIPELINE_EVENT_AUTH_TOKEN"
+    "authTokenFile": "/etc/pipeline/event-auth/<event-auth-secret-key>"
   }
 }
 ```
@@ -160,11 +160,16 @@ environment and mounted secrets.
 
 Expected runner Job secrets and mounts include:
 
-- `opencode-auth-1` mounted at `/root/.local/share/opencode/auth.json`
-- `pipeline-runner-event-auth` mounted at
-  `/etc/pipeline/event-auth/OISIN_PIPELINE_EVENT_AUTH_TOKEN`
+- The configured OpenCode auth Secret mounted at
+  `/root/.local/share/opencode/auth.json`
+- The configured event auth Secret mounted at
+  `/etc/pipeline/event-auth/<event-auth-secret-key>`
 - MCP gateway auth Secret mounted at a path referenced by the runner
-- `oisin-bot-github-auth` mounted for GitHub auth usable by both `git` and `gh`
+- The configured git credentials Secret mounted for `git`; HTTPS remotes use
+  `username` and `password`, and SSH remotes use `identity` and `known_hosts`
+  following Flux `GitRepository` credential conventions
+- The configured GitHub CLI auth Secret mounted for `gh` when pull request
+  delivery is enabled
 
 The runner image sets `HOME=/root`; Kubernetes must project each numbered auth
 Secret with the key `auth.json` into the target directory. The runner does not
@@ -172,6 +177,12 @@ read event auth tokens or payloads from environment variables. No
 `OISIN_PIPELINE_RUNNER_PAYLOAD_JSON`, `PIPELINE_EVENT_API_TOKEN`, or
 `OPENCODE_AUTH_JSON` env vars are used.
 
+Git credential issuance and rotation are cluster concerns. For GitHub HTTPS,
+operators should prefer GitHub App installation tokens generated by External
+Secrets Operator or equivalent control-plane automation. For SSH, operators
+must provide both the private identity and pinned `known_hosts` data. Runner
+payloads never carry credential values or Secret names.
+
 ## Boundary
 
 The `moka` command is its own user-facing command and runtime. Argo

package/docs/slash-command-adapter-contract.md

@@ -15,7 +15,7 @@ moka install-commands --host all --check
 
 | Host     | Generated resources                                            | Invocation                        | Mechanical path                                                                                       |
 | -------- | -------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
 
 ## Projection Rules
 

package/package.json

@@ -70,6 +70,10 @@
       "types": "./dist/moka-submit.d.ts",
       "import": "./dist/moka-submit.js"
     },
+    "./moka-global-config": {
+      "types": "./dist/moka-global-config.d.ts",
+      "import": "./dist/moka-global-config.js"
+    },
     "./planner": {
       "types": "./dist/workflow-planner.d.ts",
       "import": "./dist/workflow-planner.js"
@@ -118,7 +122,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.27.17",
+  "version": "1.27.19",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",