@oisincoveney/pipeline 1.27.18 → 1.28.0

package/README.md

@@ -241,7 +241,7 @@ runner.
 
 | Host | Generated files | Invocation |
 | --- | --- | --- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/plugins/*.ts`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` |
 
 The installer is idempotent, supports `--check` and `--dry-run`, and refuses to
 overwrite manually edited files unless `--force` is supplied.

package/dist/argo-workflow.js

@@ -11,6 +11,10 @@ const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
 const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
 const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
 const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
+const RUNNER_OPENCODE_ENV = [{
+	name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
+	value: "0"
+}];
 const kubernetesNameSchema = z.string().min(1);
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
@@ -346,6 +350,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -368,6 +373,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
+			env: [...RUNNER_OPENCODE_ENV],
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/codex-auth-sync.js

@@ -0,0 +1,98 @@
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { parse } from "jsonc-parser";
+//#region src/codex-auth-sync.ts
+const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth";
+const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
+function syncLocalCodexAuth(options) {
+	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
+	const hasErrors = items.some((item) => item.action === "error");
+	const checkFailed = options.check === true && hasRequiredChanges;
+	return {
+		items,
+		ok: !(hasErrors || checkFailed)
+	};
+}
+function formatCodexAuthSyncResult(result) {
+	const lines = result.items.map((item) => {
+		const suffix = item.message ? `: ${item.message}` : "";
+		return `${item.action} ${item.path}${suffix}`;
+	});
+	if (!result.ok) lines.push("codex-auth sync-local check failed");
+	return lines.join("\n");
+}
+function syncGlobalPluginConfig(path, options) {
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const parsed = parseJsonObject(currentText ?? "{}");
+	if (!parsed.ok) return {
+		action: "error",
+		message: formatParseErrors(parsed.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, `${JSON.stringify({
+		...parsed.value,
+		perProjectAccounts: false
+	}, null, 2)}\n`, options);
+}
+function syncProjectOpenCodeConfig(repo, options) {
+	const path = join(repo, ".opencode/opencode.json");
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const merged = mergeOpenCodeProjectConfig(currentText, { plugin: [CODEX_MULTI_AUTH_PLUGIN] });
+	if (!merged.ok) return {
+		action: "error",
+		message: formatParseErrors(merged.errors),
+		path
+	};
+	return writeIfChanged(path, currentText, merged.content, options);
+}
+function writeIfChanged(path, currentText, nextText, options) {
+	if (currentText === nextText) return {
+		action: "unchanged",
+		path
+	};
+	const action = currentText === void 0 ? "create" : "update";
+	if (!(options.check || options.dryRun)) {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, nextText);
+	}
+	return {
+		action,
+		path
+	};
+}
+function discoverGitRepositories(root) {
+	return readdirSync(root).map((name) => join(root, name)).filter((path) => isDirectory(path) && existsSync(join(path, ".git"))).sort((a, b) => a.localeCompare(b));
+}
+function isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function parseJsonObject(content) {
+	const errors = [];
+	const value = parse(content, errors, {
+		allowTrailingComma: true,
+		disallowComments: false
+	});
+	if (errors.length > 0 || !isRecord(value)) return {
+		errors,
+		ok: false
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function formatParseErrors(errors) {
+	return errors.length > 0 ? `invalid JSONC (${errors.length} parse error${errors.length === 1 ? "" : "s"})` : "expected a JSON object";
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { formatCodexAuthSyncResult, syncLocalCodexAuth };

package/dist/config.d.ts

@@ -362,8 +362,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -387,8 +387,8 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -431,10 +431,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -452,7 +452,6 @@ declare const configSchema: z.ZodObject<{
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-      task: "task";
       read: "read";
       list: "list";
       grep: "grep";
@@ -460,6 +459,7 @@ declare const configSchema: z.ZodObject<{
       bash: "bash";
       edit: "edit";
       write: "write";
+      task: "task";
     }>>>;
   }, z.core.$strict>>>;
   runner_command: z.ZodDefault<z.ZodObject<{
@@ -485,8 +485,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -503,15 +503,14 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        task: "task";
         read: "read";
         list: "list";
         grep: "grep";
@@ -519,6 +518,7 @@ declare const configSchema: z.ZodObject<{
         bash: "bash";
         edit: "edit";
         write: "write";
+        task: "task";
       }>>>;
     }, z.core.$strict>;
     command: z.ZodOptional<z.ZodString>;
@@ -613,8 +613,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      quick: "quick";
       execute: "execute";
+      quick: "quick";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;
@@ -626,8 +626,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/config.js

@@ -315,7 +315,7 @@ hooks:
 runner_command:
   environment:
     setup:
-      - command: pnpm
+      - command: bun
         args: [install, --frozen-lockfile]
 scheduler:
   commands:

package/dist/index.js

@@ -4,6 +4,7 @@ import { PipelineConfigError, loadPipelineConfig } from "./config.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
+import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "./codex-auth-sync.js";
 import { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands } from "./commands/pipeline-command.js";
 import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
@@ -289,6 +290,15 @@ function createCliProgram() {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
+	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
+		const result = syncLocalCodexAuth({
+			check: flags.check,
+			dryRun: flags.dryRun,
+			root: resolve(flags.root ?? process.env.PIPELINE_TARGET_PATH ?? process.cwd())
+		});
+		console.log(formatCodexAuthSyncResult(result));
+		if (!result.ok) process.exitCode = 1;
+	});
 	addMokaSubmitOptions(program.command("submit").description("Submit work to Momokaya as an Argo Workflow").argument("[input...]", "task description, or command argv with --command")).action(async (input, flags) => {
 		const result = await runMokaSubmitFromCli(input, flags);
 		console.log(`Workflow submitted: ${result.workflowName} in ${result.namespace}`);

package/dist/install-commands.js

@@ -1,8 +1,8 @@
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, loadPipelineConfig } from "./config.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
+import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { renderOpenCodeGatewayConfig } from "./mcp/gateway.js";
 import { resolvePackageAssetPath } from "./package-assets.js";
-import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import matter from "gray-matter";
@@ -18,7 +18,8 @@ const AGENTS_MD_START = "<!-- @oisincoveney/pipeline:agents:start -->";
 const AGENTS_MD_END = "<!-- @oisincoveney/pipeline:agents:end -->";
 const SINGLE_OPENCODE_PLUGIN_ARRAY_RE = /\n {2}"plugin": \[\n {4}("[^"]+")\n {2}\]/;
 const OPENCODE_PROJECT_CONFIG_PATH = ".opencode/opencode.json";
-const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/([^/]+)\.md$/] };
+const OPENCODE_COMMAND_PREFIX = "moka-";
+const ENTRYPOINT_PATH_PATTERNS = { opencode: [/^\.opencode\/commands\/(?:moka-)?([^/]+)\.md$/] };
 const COMMAND_HOSTS = ["opencode"];
 const OPENCODE_ORCHESTRATOR_AGENT_ID = "MoKa Orchestrator";
 const MOKA_PROFILE_PREFIX = "moka-";
@@ -162,6 +163,7 @@ function dispatchBlock(host, config, workflowId = config.default_workflow) {
 		"Only package-configured gates are blocking. Do not invent RED, GREEN, full-suite, typecheck, or unrelated-drift gates.",
 		"If a node returns targeted evidence and has no configured blocking gate, advance to the next node.",
 		"Do not bypass configured runner subprocesses or package-configured gates when executing nodes.",
+		"Use the listed Task tool routes for native nodes, and run nodes with satisfied dependencies in parallel whenever the host supports concurrent subagent work.",
 		hostSpecificDispatchGuard(host, nativeRoutes, cliRoutes)
 	].filter((line) => Boolean(line)).join("\n");
 }
@@ -334,7 +336,7 @@ function opencodeDefinitions(config, cwd) {
 			]).join("\n")),
 			host: "opencode",
 			invocation: invocationForHost("opencode", id),
-			path: `.opencode/commands/${id}.md`
+			path: `.opencode/commands/${commandIdForHost("opencode", id)}.md`
 		})),
 		{
 			content: renderOpenCodeProjectConfig(config),
@@ -364,7 +366,7 @@ function opencodeDefinitions(config, cwd) {
 				name: nativeAgentIdForHost("opencode", id),
 				description: profile.description ?? id,
 				hidden: false,
-				mode: "subagent",
+				mode: "all",
 				...opencodeModelProjection(config, profile),
 				permission: opencodePermission(profile)
 			}, [
@@ -401,7 +403,7 @@ function projectAgentsMdDefinition(cwd, host) {
 			"",
 			"This repository uses package-owned `@oisincoveney/pipeline` config.",
 			"",
-			"- Use `/quick`, `/execute`, or `/inspect` for OpenCode slash-command entrypoints when available.",
+			"- Use `/moka-quick`, `/moka-execute`, or `/moka-inspect` for OpenCode slash-command entrypoints when available.",
 			"- Load and follow the relevant skill from `.agents/skills` before doing specialized work.",
 			"- Prefer the package-defined pipeline profiles and generated command surfaces over ad hoc subagent prompts.",
 			"",
@@ -485,7 +487,11 @@ function entrypointIdFromGeneratedPath(host, path) {
 	}
 }
 function invocationForHost(host, entrypointId = "execute") {
-	return `${{ opencode: "/" }[host]}${entrypointId} <task description>`;
+	return `${{ opencode: "/" }[host]}${commandIdForHost(host, entrypointId)} <task description>`;
+}
+function commandIdForHost(host, entrypointId) {
+	if (host === "opencode") return `${OPENCODE_COMMAND_PREFIX}${entrypointId}`;
+	return entrypointId;
 }
 function resolveDefinitionContent(definition, target) {
 	if (definition.path !== OPENCODE_PROJECT_CONFIG_PATH || !existsSync(target)) return {

package/dist/moka-submit.d.ts

@@ -161,8 +161,8 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;

package/dist/run-state/git-refs.js

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
@@ -102,18 +102,26 @@ async function configureGitCommitter(worktreePath, committer) {
 		committer.email
 	]);
 }
-function runnerGitCommandArgs(args) {
-	return [...gitCredentialConfigArgs(remoteUrlFromGitArgs(args)), ...args];
+function runnerGitCommandArgs(args, remoteUrl) {
+	return [...gitCredentialConfigArgs(remoteUrl), ...args];
 }
 async function runGit(cwd, args) {
-	const remoteUrl = remoteUrlFromGitArgs(args);
-	const { stdout } = await execGit("git", runnerGitCommandArgs(args), {
+	const remoteUrl = await remoteUrlFromGitArgs(cwd, args);
+	assertSshCredentialsAvailable(remoteUrl);
+	const { stdout } = await execGit("git", runnerGitCommandArgs(args, remoteUrl), {
 		cwd,
 		encoding: "utf8",
 		env: runnerGitEnv(remoteUrl)
 	});
 	return stdout;
 }
+function assertSshCredentialsAvailable(remoteUrl) {
+	if (!(remoteUrl && isSshRemote(remoteUrl))) return;
+	const credentialsDir = gitCredentialsDir();
+	const missing = [["identity", resolve(credentialsDir, "identity")], ["known_hosts", resolve(credentialsDir, "known_hosts")]].filter(([, filePath]) => !existsSync(filePath)).map(([name]) => name);
+	if (missing.length === 0) return;
+	throw new Error(`SSH git remote ${remoteUrl} requires mounted git credential file(s): ${missing.join(", ")}`);
+}
 function gitCredentialConfigArgs(remoteUrl) {
 	const writablePath = prepareWritableGitCredentialStore(remoteUrl);
 	if (!writablePath) return [];
@@ -125,6 +133,8 @@ function gitCredentialConfigArgs(remoteUrl) {
 	];
 }
 function prepareWritableGitCredentialStore(remoteUrl) {
+	if (!remoteUrl) return existingPreparedBasicAuthCredentialStore(writableGitCredentialStore());
+	if (!isHttpRemote(remoteUrl)) return;
 	const writablePath = writableGitCredentialStore();
 	const basicAuth = availableBasicAuthCredentials();
 	if (basicAuth) return prepareBasicAuthCredentialStore(basicAuth, writablePath, remoteUrl);
@@ -172,10 +182,8 @@ function runnerGitEnv(remoteUrl) {
 		...process.env,
 		GIT_TERMINAL_PROMPT: "0"
 	};
-	if (remoteUrl && isSshRemote(remoteUrl)) {
-		const sshCommand = gitSshCommand();
-		if (sshCommand) env.GIT_SSH_COMMAND = sshCommand;
-	}
+	const sshCommand = gitSshCommand();
+	if (sshCommand && remoteUrl && isSshRemote(remoteUrl)) env.GIT_SSH_COMMAND = sshCommand;
 	return env;
 }
 function gitSshCommand() {
@@ -183,7 +191,7 @@ function gitSshCommand() {
 	const identityPath = resolve(credentialsDir, "identity");
 	const knownHostsPath = resolve(credentialsDir, "known_hosts");
 	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return;
-	chmodSync(identityPath, 256);
+	ensureSshIdentityPermissions(identityPath);
 	return [
 		"ssh",
 		"-i",
@@ -196,11 +204,63 @@ function gitSshCommand() {
 		"StrictHostKeyChecking=yes"
 	].join(" ");
 }
+function ensureSshIdentityPermissions(identityPath) {
+	try {
+		chmodSync(identityPath, 256);
+		return;
+	} catch (error) {
+		if (!(isReadOnlyFileSystemError(error) && isOwnerReadOnly(identityPath))) throw error;
+	}
+}
+function isReadOnlyFileSystemError(error) {
+	return error instanceof Error && "code" in error && error.code === "EROFS";
+}
+function isOwnerReadOnly(path) {
+	const permissions = statSync(path).mode.toString(8).slice(-3);
+	return [
+		"4",
+		"5",
+		"6",
+		"7"
+	].includes(permissions[0] ?? "") && permissions.slice(1) === "00";
+}
 function readCredentialFile(path) {
 	return readFileSync(path, "utf8").trim();
 }
-function remoteUrlFromGitArgs(args) {
+async function remoteUrlFromGitArgs(cwd, args) {
+	const literalRemoteUrl = literalRemoteUrlFromGitArgs(args);
+	if (literalRemoteUrl) return literalRemoteUrl;
+	const remoteName = remoteNameFromGitArgs(args);
+	if (!remoteName) return;
+	return await gitRemoteUrl(cwd, remoteName);
+}
+function literalRemoteUrlFromGitArgs(args) {
 	if (args[0] === "clone") return args.find((arg) => isRemoteUrl(arg));
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = args[1];
+		return remoteArg && isRemoteUrl(remoteArg) ? remoteArg : void 0;
+	}
+}
+function remoteNameFromGitArgs(args) {
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = args[1];
+		if (remoteArg && !remoteArg.startsWith("-") && !isRemoteUrl(remoteArg)) return remoteArg;
+	}
+}
+async function gitRemoteUrl(cwd, remoteName) {
+	const { stdout } = await execGit("git", [
+		"remote",
+		"get-url",
+		remoteName
+	], {
+		cwd,
+		encoding: "utf8",
+		env: {
+			...process.env,
+			GIT_TERMINAL_PROMPT: "0"
+		}
+	});
+	return stdout.trim() || void 0;
 }
 function isRemoteUrl(value) {
 	return value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
@@ -208,6 +268,9 @@ function isRemoteUrl(value) {
 function isSshRemote(value) {
 	return value.startsWith("ssh://") || isScpLikeSshRemote(value);
 }
+function isHttpRemote(value) {
+	return value.startsWith("http://") || value.startsWith("https://");
+}
 function isScpLikeSshRemote(value) {
 	return SCP_LIKE_SSH_REMOTE_RE.test(value);
 }

package/dist/runner-command/run.js

@@ -9,6 +9,7 @@ import { z } from "zod";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { execa } from "execa";
+import pino from "pino";
 //#region src/runner-command/run.ts
 const runnerCommandOptionsSchema = z.object({
 	cwd: z.string().min(1).optional(),
@@ -17,6 +18,7 @@ const runnerCommandOptionsSchema = z.object({
 	payloadFile: z.string().min(1),
 	scheduleFile: z.string().min(1),
 	stderr: z.custom((value) => isOutputStream(value)).optional(),
+	stdout: z.custom((value) => isOutputStream(value)).optional(),
 	taskDescriptorFile: z.string().min(1).optional()
 }).strict();
 const EXIT_PASS = 0;
@@ -25,15 +27,36 @@ const EXIT_VALIDATION = 64;
 const EXIT_STARTUP = 70;
 async function runRunnerCommand(rawOptions = {}) {
 	const parsedOptions = runnerCommandOptionsSchema.safeParse(rawOptions);
-	const stderr = rawOptions.stderr ?? process.stderr;
+	const logger = createRunnerLogger({
+		stderr: isOutputStream(rawOptions.stderr) ? rawOptions.stderr : process.stderr,
+		stdout: isOutputStream(rawOptions.stdout) ? rawOptions.stdout : process.stdout
+	});
 	if (!parsedOptions.success) {
-		stderr.write(`${parsedOptions.error.message}\n`);
+		logger.error({
+			error: parsedOptions.error.message,
+			phase: "options.validate"
+		}, "runner options validation failed");
 		return EXIT_VALIDATION;
 	}
 	const options = parsedOptions.data;
 	try {
+		logger.info({
+			phase: "payload.load",
+			status: "start"
+		}, "payload.load start");
 		const payload = parseRunnerCommandPayload(readFileSync(options.payloadFile, "utf8"));
 		const descriptor = readRunnerTaskDescriptor(options.taskDescriptorFile ?? "/etc/pipeline/task.json");
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "payload.load",
+			runId: payload.run.id,
+			status: "finish",
+			workflowId: payload.workflow.id
+		}, "payload.load finish");
+		logger.info({
+			phase: "event.sink.configure",
+			status: "start"
+		}, "event.sink.configure start");
 		const authToken = resolveRunnerEventSinkAuthToken({ authTokenFile: payload.events.authTokenFile });
 		const sink = createRunnerEventSink({
 			authHeader: payload.events.authHeader,
@@ -42,27 +65,86 @@ async function runRunnerCommand(rawOptions = {}) {
 			runId: payload.run.id,
 			url: payload.events.url
 		});
+		logger.info({
+			phase: "event.sink.configure",
+			status: "finish"
+		}, "event.sink.configure finish");
+		logger.info({
+			hasProvidedCwd: Boolean(options.cwd),
+			phase: "git.workspace.prepare",
+			status: "start"
+		}, "git.workspace.prepare start");
 		const worktreePath = await prepareRunnerGitWorkspace(payload, { cwd: options.cwd });
+		logger.info({
+			phase: "git.workspace.prepare",
+			status: "finish"
+		}, "git.workspace.prepare finish");
+		logger.info({
+			phase: "config.load",
+			status: "start"
+		}, "config.load start");
 		const baseConfig = loadPipelineConfig(worktreePath, { allowMissingLintFileReferences: true });
+		logger.info({
+			phase: "config.load",
+			status: "finish"
+		}, "config.load finish");
+		logger.info({
+			phase: "schedule.compile",
+			status: "start"
+		}, "schedule.compile start");
 		const compiled = compileScheduleArtifact(baseConfig, parseScheduleArtifact(readFileSync(options.scheduleFile, "utf8"), options.scheduleFile), worktreePath);
+		logger.info({
+			phase: "schedule.compile",
+			status: "finish",
+			workflowId: compiled.workflowId
+		}, "schedule.compile finish");
 		if (payload.workflow.id !== compiled.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'`);
 		const node = findPlannedNode(compiled.plan.topologicalOrder, descriptor.nodeId);
 		if (!node) throw new Error(`Argo task '${descriptor.nodeId}' is not declared in workflow '${compiled.workflowId}'`);
+		logger.info({
+			dependencyCount: node.needs.length,
+			nodeId: descriptor.nodeId,
+			phase: "dependency.merge",
+			status: "start"
+		}, "dependency.merge start");
 		await mergeDependencyRefs({
 			committer: compiled.config.runner_command.git.committer,
 			dependencyNodeIds: node.needs,
 			payload,
 			worktreePath
 		});
+		logger.info({
+			dependencyCount: node.needs.length,
+			nodeId: descriptor.nodeId,
+			phase: "dependency.merge",
+			status: "finish"
+		}, "dependency.merge finish");
+		logger.info({
+			commandCount: baseConfig.runner_command.environment.setup.length,
+			phase: "setup.commands",
+			status: "start"
+		}, "setup.commands start");
 		await runSetupCommands(baseConfig.runner_command.environment.setup, {
 			env: options.env ?? process.env,
+			logger,
 			worktreePath
 		});
+		logger.info({
+			commandCount: baseConfig.runner_command.environment.setup.length,
+			phase: "setup.commands",
+			status: "finish"
+		}, "setup.commands finish");
 		sink.recordRunnerCommandPhase("task.start", `Starting ${descriptor.nodeId}`, {
 			kind: node.kind,
 			taskId: descriptor.nodeId,
 			workflowId: payload.workflow.id
 		});
+		logger.info({
+			kind: node.kind,
+			nodeId: descriptor.nodeId,
+			phase: "task.run",
+			status: "start"
+		}, "task.run start");
 		const result = await runScheduledWorkflowTask({
 			config: compiled.config,
 			hookPolicy: payload.hookPolicy,
@@ -73,12 +155,29 @@ async function runRunnerCommand(rawOptions = {}) {
 			workflowId: compiled.workflowId,
 			worktreePath
 		});
+		logger.info({
+			exitCode: result.exitCode,
+			nodeId: descriptor.nodeId,
+			phase: "task.run",
+			resultStatus: result.status,
+			status: "finish"
+		}, "task.run finish");
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "git.node-ref.push",
+			status: "start"
+		}, "git.node-ref.push start");
 		await commitAndPushNodeRef({
 			committer: compiled.config.runner_command.git.committer,
 			nodeId: descriptor.nodeId,
 			payload,
 			worktreePath
 		});
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "git.node-ref.push",
+			status: "finish"
+		}, "git.node-ref.push finish");
 		sink.recordRunnerCommandPhase("task.finish", `Finished ${descriptor.nodeId}`, {
 			evidence: result.evidence,
 			exitCode: result.exitCode,
@@ -86,11 +185,14 @@ async function runRunnerCommand(rawOptions = {}) {
 			taskId: descriptor.nodeId,
 			workflowId: payload.workflow.id
 		});
-		await flushAndReport(sink, stderr);
+		await flushAndReport(sink, logger);
 		return result.status === "passed" ? EXIT_PASS : EXIT_FAIL;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		stderr.write(`${message}\n`);
+		logger.error({
+			error: message,
+			phase: "runner-command"
+		}, message);
 		return error instanceof RunnerCommandPayloadValidationError || error instanceof z.ZodError ? EXIT_VALIDATION : EXIT_STARTUP;
 	}
 }
@@ -102,12 +204,26 @@ function findPlannedNode(nodes, nodeId) {
 	}
 }
 async function runSetupCommands(commands, options) {
-	for (const command of commands) {
+	for (const [index, command] of commands.entries()) {
+		options.logger.info({
+			command: command.command,
+			index: index + 1,
+			phase: "setup.command",
+			status: "start"
+		}, "setup.command start");
 		const result = await execa(command.command, command.args, {
 			cwd: options.worktreePath,
 			env: options.env,
 			reject: false
 		});
+		options.logger.info({
+			command: command.command,
+			exitCode: result.exitCode,
+			index: index + 1,
+			phase: "setup.command",
+			required: command.required,
+			status: "finish"
+		}, "setup.command finish");
 		if (result.exitCode !== 0 && command.required) throw new Error(`runner setup command '${command.command}' failed with exit ${result.exitCode}`);
 	}
 }
@@ -119,13 +235,52 @@ function runnerTaskText(task, worktreePath) {
 function isOutputStream(value) {
 	return typeof value === "object" && value !== null && "write" in value && typeof value.write === "function";
 }
-async function flushAndReport(sink, stderr) {
+async function flushAndReport(sink, logger) {
+	logger.info({
+		phase: "event.flush",
+		status: "start"
+	}, "event.flush start");
 	try {
 		await sink.flush();
+		logger.info({
+			phase: "event.flush",
+			status: "finish"
+		}, "event.flush finish");
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		stderr.write(`runner event flush failed: ${message}\n`);
+		logger.error({
+			error: message,
+			phase: "event.flush"
+		}, `runner event flush failed: ${message}`);
 	}
 }
+function createRunnerLogger(options) {
+	const streams = [{
+		level: "info",
+		stream: options.stdout
+	}, {
+		level: "error",
+		stream: options.stderr
+	}];
+	return pino({
+		base: void 0,
+		level: "info",
+		name: "moka-runner",
+		redact: {
+			censor: "[redacted]",
+			paths: [
+				"authToken",
+				"*.authToken",
+				"token",
+				"*.token",
+				"password",
+				"*.password",
+				"identity",
+				"*.identity"
+			]
+		},
+		timestamp: pino.stdTimeFunctions.isoTime
+	}, pino.multistream(streams, { dedupe: true }));
+}
 //#endregion
 export { runRunnerCommand };

package/dist/runner-command-contract.d.ts

@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -104,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      full: "full";
       quick: "quick";
+      full: "full";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;

package/dist/schedule-planner.js

@@ -472,13 +472,33 @@ function executeBaselineWorkflow() {
 				],
 				id: "verification",
 				kind: "agent",
-				needs: ["acceptance-review"],
+				needs: [
+					"mechanical-green-tests",
+					"mechanical-green-typecheck",
+					"mechanical-green-lint",
+					"mechanical-green-fallow"
+				],
 				profile: "moka-verifier"
 			},
+			{
+				id: "code-quality-review",
+				kind: "agent",
+				needs: [
+					"mechanical-green-tests",
+					"mechanical-green-typecheck",
+					"mechanical-green-lint",
+					"mechanical-green-fallow"
+				],
+				profile: "moka-thermo-nuclear-reviewer"
+			},
 			{
 				id: "learn",
 				kind: "agent",
-				needs: ["verification"],
+				needs: [
+					"acceptance-review",
+					"verification",
+					"code-quality-review"
+				],
 				profile: "moka-learner"
 			}
 		]

package/docs/operator-guide.md

@@ -287,13 +287,13 @@ Troubleshooting:
 Generated invocations include:
 
 ```text
-OpenCode: /quick, /execute, /inspect
+OpenCode: /moka-quick, /moka-execute, /moka-inspect
 Codex:    $quick, $execute, $inspect
 ```
 
 `moka init` and `moka install-commands --host opencode` generate:
 
-- `.opencode/commands/<entrypoint>.md` for `/quick`, `/execute`, and `/inspect`
+- `.opencode/commands/moka-<entrypoint>.md` for `/moka-quick`, `/moka-execute`, and `/moka-inspect`
 - `.opencode/agents/*.md` for primary and subagent profiles with explicit
   `permission` maps, `task` grants, and denied ungranted tools
 - `.opencode/skills/*/SKILL.md` from `npx skills add`, not Moka generation

package/docs/slash-command-adapter-contract.md

@@ -15,7 +15,7 @@ moka install-commands --host all --check
 
 | Host     | Generated resources                                            | Invocation                        | Mechanical path                                                                                       |
 | -------- | -------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------- |
-| OpenCode | `.opencode/commands/<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/quick <task>`, `/execute <task>`, `/inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
+| OpenCode | `.opencode/commands/moka-<entrypoint>.md`, `.opencode/agents/*.md`, `.opencode/opencode.json` | `/moka-quick <task>`, `/moka-execute <task>`, `/moka-inspect <task>` | Project commands run a primary orchestrator and OpenCode native subagents with package-owned skill, MCP, permission, and LSP projection. |
 
 ## Projection Rules
 

package/package.json

@@ -13,6 +13,7 @@
     "micromatch": "^4.0.8",
     "p-limit": "^7.3.0",
     "package-manager-detector": "^1.6.0",
+    "pino": "^10.3.1",
     "secure-json-parse": "^4.1.0",
     "simple-git": "^3.36.0",
     "xstate": "^5.31.1",
@@ -122,7 +123,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.27.18",
+  "version": "1.28.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",