@oisincoveney/pipeline 1.27.18 → 1.27.19

package/README.md

@@ -241,7 +241,7 @@ runner.
 
 | Host | Generated files | Invocation |
 | --- | --- | --- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` |
 
 The installer is idempotent, supports `--check` and `--dry-run`, and refuses to
 overwrite manually edited files unless `--force` is supplied.

package/dist/argo-workflow.js

@@ -11,6 +11,10 @@ const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
 const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
 const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
 const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
+const RUNNER_OPENCODE_ENV = [{
+	name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
+	value: "0"
+}];
 const kubernetesNameSchema = z.string().min(1);
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
@@ -346,6 +350,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -368,6 +373,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/codex-auth-sync.js

@@ -0,0 +1,98 @@
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { parse } from "jsonc-parser";
+//#region src/codex-auth-sync.ts
+const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth";
+const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
+function syncLocalCodexAuth(options) {
+	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
+	const hasErrors = items.some((item) => item.action === "error");
+	const checkFailed = options.check === true && hasRequiredChanges;
+	return {
+		items,
+		ok: !(hasErrors || checkFailed)
+	};
+}
+function formatCodexAuthSyncResult(result) {
+	const lines = result.items.map((item) => {
+		const suffix = item.message ? `: ${item.message}` : "";
+		return `${item.action} ${item.path}${suffix}`;
+	});
+	if (!result.ok) lines.push("codex-auth sync-local check failed");
+	return lines.join("\n");
+}
+function syncGlobalPluginConfig(path, options) {
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const parsed = parseJsonObject(currentText ?? "{}");
+	if (!parsed.ok) return {
+		action: "error",
+		message: formatParseErrors(parsed.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, `${JSON.stringify({
+		...parsed.value,
+		perProjectAccounts: false
+	}, null, 2)}\n`, options);
+}
+function syncProjectOpenCodeConfig(repo, options) {
+	const path = join(repo, ".opencode/opencode.json");
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const merged = mergeOpenCodeProjectConfig(currentText, { plugin: [CODEX_MULTI_AUTH_PLUGIN] });
+	if (!merged.ok) return {
+		action: "error",
+		message: formatParseErrors(merged.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, merged.content, options);
+}
+function writeIfChanged(path, currentText, nextText, options) {
+	if (currentText === nextText) return {
+		action: "unchanged",
+		path
+	};
+	const action = currentText === void 0 ? "create" : "update";
+	if (!(options.check || options.dryRun)) {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, nextText);
+	}
+	return {
+		action,
+		path
+	};
+}
+function discoverGitRepositories(root) {
+	return readdirSync(root).map((name) => join(root, name)).filter((path) => isDirectory(path) && existsSync(join(path, ".git"))).sort((a, b) => a.localeCompare(b));
+}
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function parseJsonObject(content) {
+	const errors = [];
+	const value = parse(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0 || !isRecord(value)) return {
+		errors,
+		ok: false
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function formatParseErrors(errors) {
+	return errors.length > 0 ? `invalid JSONC (${errors.length} parse error${errors.length === 1 ? "" : "s"})` : "expected a JSON object";
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { formatCodexAuthSyncResult, syncLocalCodexAuth };

package/dist/config.d.ts

@@ -362,8 +362,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -387,8 +387,8 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -431,10 +431,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -485,8 +485,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -503,10 +503,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
@@ -613,8 +613,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      quick: "quick";
       execute: "execute";
+      quick: "quick";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;
@@ -626,8 +626,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/config.js

@@ -315,7 +315,7 @@ hooks:
 runner_command:
   environment:
     setup:
-      - command: pnpm
+      - command: bun
         args: [install, --frozen-lockfile]
 scheduler:
   commands:

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    pass: "pass";
     fail: "fail";
+    pass: "pass";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -4,6 +4,7 @@ import { PipelineConfigError, loadPipelineConfig } from "./config.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
+import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "./codex-auth-sync.js";
 import { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands } from "./commands/pipeline-command.js";
 import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
@@ -289,6 +290,15 @@ function createCliProgram() {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
+	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
+		const result = syncLocalCodexAuth({
+			check: flags.check,
+			dryRun: flags.dryRun,
+			root: resolve(flags.root ?? process.env.PIPELINE_TARGET_PATH ?? process.cwd())
+		});
+		console.log(formatCodexAuthSyncResult(result));
+		if (!result.ok) process.exitCode = 1;
+	});
 	addMokaSubmitOptions(program.command("submit").description("Submit work to Momokaya as an Argo Workflow").argument("[input...]", "task description, or command argv with --command")).action(async (input, flags) => {
 		const result = await runMokaSubmitFromCli(input, flags);
 		console.log(`Workflow submitted: ${result.workflowName} in ${result.namespace}`);

package/dist/install-commands.js

@@ -1,8 +1,8 @@
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, loadPipelineConfig } from "./config.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { renderOpenCodeGatewayConfig } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
-import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import matter from "gray-matter";
@@ -18,7 +18,8 @@ const AGENTS_MD_START = "<!-- @oisincoveney/pipeline:agents:start -->";
 const AGENTS_MD_END = "<!-- @oisincoveney/pipeline:agents:end -->";
 const SINGLE_OPENCODE_PLUGIN_ARRAY_RE = /\n {2}"plugin": \[\n {4}("[^"]+")\n {2}\]/;
 const OPENCODE_PROJECT_CONFIG_PATH = ".opencode/opencode.json";
-const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/([^/]+)\.md$/] };
+const OPENCODE_COMMAND_PREFIX = "moka-";
+const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/(?:moka-)?([^/]+)\.md$/] };
 const COMMAND_HOSTS = ["opencode"];
 const OPENCODE_ORCHESTRATOR_AGENT_ID = "MoKa Orchestrator";
 const MOKA_PROFILE_PREFIX = "moka-";
@@ -334,7 +335,7 @@ function opencodeDefinitions(config, cwd) {
 			]).join("\n")),
 			host: "opencode",
 			invocation: invocationForHost("opencode", id),
-			path: `.opencode/commands/${id}.md`
+			path: `.opencode/commands/${commandIdForHost("opencode", id)}.md`
 		})),
 		{
 			content: renderOpenCodeProjectConfig(config),
@@ -401,7 +402,7 @@ function projectAgentsMdDefinition(cwd, host) {
 			"",
 			"This repository uses package-owned `@oisincoveney/pipeline` config.",
 			"",
-			"- Use `/quick`, `/execute`, or `/inspect` for OpenCode slash-command entrypoints when available.",
+			"- Use `/moka-quick`, `/moka-execute`, or `/moka-inspect` for OpenCode slash-command entrypoints when available.",
 			"- Load and follow the relevant skill from `.agents/skills` before doing specialized work.",
 			"- Prefer the package-defined pipeline profiles and generated command surfaces over ad hoc subagent prompts.",
 			"",
@@ -485,7 +486,11 @@ function entrypointIdFromGeneratedPath(host, path) {
 	}
 }
 function invocationForHost(host, entrypointId = "execute") {
-	return `${{ opencode: "/" }[host]}${entrypointId} <task description>`;
+	return `${{ opencode: "/" }[host]}${commandIdForHost(host, entrypointId)} <task description>`;
+}
+function commandIdForHost(host, entrypointId) {
+	if (host === "opencode") return `${OPENCODE_COMMAND_PREFIX}${entrypointId}`;
+	return entrypointId;
 }
 function resolveDefinitionContent(definition, target) {
 	if (definition.path !== OPENCODE_PROJECT_CONFIG_PATH || !existsSync(target)) return {

package/dist/moka-submit.d.ts

@@ -161,8 +161,8 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;

package/dist/runner-command-contract.d.ts

@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -104,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      full: "full";
       quick: "quick";
+      full: "full";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;

package/docs/operator-guide.md

@@ -287,13 +287,13 @@ Troubleshooting:
 Generated invocations include:
 
 ```text
-OpenCode: /quick, /execute, /inspect
+OpenCode: /moka-quick, /moka-execute, /moka-inspect
 Codex:    $quick, $execute, $inspect
 ```
 
 `moka init` and `moka install-commands --host opencode` generate:
 
-- `.opencode/commands/<entrypoint>.md` for `/quick`, `/execute`, and `/inspect`
+- `.opencode/commands/moka-<entrypoint>.md` for `/moka-quick`, `/moka-execute`, and `/moka-inspect`
 - `.opencode/agents/*.md` for primary and subagent profiles with explicit
   `permission` maps, `task` grants, and denied ungranted tools
 - `.opencode/skills/*/SKILL.md` from `npx skills add`, not Moka generation

package/docs/slash-command-adapter-contract.md

@@ -15,7 +15,7 @@ moka install-commands --host all --check
 
 | Host     | Generated resources                                            | Invocation                        | Mechanical path                                                                                       |
 | -------- | -------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
 
 ## Projection Rules
 

package/package.json

@@ -122,7 +122,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.27.18",
+  "version": "1.27.19",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",