@oisincoveney/pipeline 1.27.19 → 1.28.0

package/dist/config.d.ts

@@ -452,7 +452,6 @@ declare const configSchema: z.ZodObject<{
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-      task: "task";
       read: "read";
       list: "list";
       grep: "grep";
@@ -460,6 +459,7 @@ declare const configSchema: z.ZodObject<{
       bash: "bash";
       edit: "edit";
       write: "write";
+      task: "task";
     }>>>;
   }, z.core.$strict>>>;
   runner_command: z.ZodDefault<z.ZodObject<{
@@ -511,7 +511,6 @@ declare const configSchema: z.ZodObject<{
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        task: "task";
         read: "read";
         list: "list";
         grep: "grep";
@@ -519,6 +518,7 @@ declare const configSchema: z.ZodObject<{
         bash: "bash";
         edit: "edit";
         write: "write";
+        task: "task";
       }>>>;
     }, z.core.$strict>;
     command: z.ZodOptional<z.ZodString>;

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    fail: "fail";
     pass: "pass";
+    fail: "fail";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/install-commands.js

@@ -163,6 +163,7 @@ function dispatchBlock(host, config, workflowId = config.default_workflow) {
 		"Only package-configured gates are blocking. Do not invent RED, GREEN, full-suite, typecheck, or unrelated-drift gates.",
 		"If a node returns targeted evidence and has no configured blocking gate, advance to the next node.",
 		"Do not bypass configured runner subprocesses or package-configured gates when executing nodes.",
+		"Use the listed Task tool routes for native nodes, and run nodes with satisfied dependencies in parallel whenever the host supports concurrent subagent work.",
 		hostSpecificDispatchGuard(host, nativeRoutes, cliRoutes)
 	].filter((line) => Boolean(line)).join("\n");
 }
@@ -365,7 +366,7 @@ function opencodeDefinitions(config, cwd) {
 				name: nativeAgentIdForHost("opencode", id),
 				description: profile.description ?? id,
 				hidden: false,
-				mode: "subagent",
+				mode: "all",
 				...opencodeModelProjection(config, profile),
 				permission: opencodePermission(profile)
 			}, [

package/dist/run-state/git-refs.js

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
@@ -102,18 +102,26 @@ async function configureGitCommitter(worktreePath, committer) {
 		committer.email
 	]);
 }
-function runnerGitCommandArgs(args) {
-	return [...gitCredentialConfigArgs(remoteUrlFromGitArgs(args)), ...args];
+function runnerGitCommandArgs(args, remoteUrl) {
+	return [...gitCredentialConfigArgs(remoteUrl), ...args];
 }
 async function runGit(cwd, args) {
-	const remoteUrl = remoteUrlFromGitArgs(args);
-	const { stdout } = await execGit("git", runnerGitCommandArgs(args), {
+	const remoteUrl = await remoteUrlFromGitArgs(cwd, args);
+	assertSshCredentialsAvailable(remoteUrl);
+	const { stdout } = await execGit("git", runnerGitCommandArgs(args, remoteUrl), {
 		cwd,
 		encoding: "utf8",
 		env: runnerGitEnv(remoteUrl)
 	});
 	return stdout;
 }
+function assertSshCredentialsAvailable(remoteUrl) {
+	if (!(remoteUrl && isSshRemote(remoteUrl))) return;
+	const credentialsDir = gitCredentialsDir();
+	const missing = [["identity", resolve(credentialsDir, "identity")], ["known_hosts", resolve(credentialsDir, "known_hosts")]].filter(([, filePath]) => !existsSync(filePath)).map(([name]) => name);
+	if (missing.length === 0) return;
+	throw new Error(`SSH git remote ${remoteUrl} requires mounted git credential file(s): ${missing.join(", ")}`);
+}
 function gitCredentialConfigArgs(remoteUrl) {
 	const writablePath = prepareWritableGitCredentialStore(remoteUrl);
 	if (!writablePath) return [];
@@ -125,6 +133,8 @@ function gitCredentialConfigArgs(remoteUrl) {
 	];
 }
 function prepareWritableGitCredentialStore(remoteUrl) {
+	if (!remoteUrl) return existingPreparedBasicAuthCredentialStore(writableGitCredentialStore());
+	if (!isHttpRemote(remoteUrl)) return;
 	const writablePath = writableGitCredentialStore();
 	const basicAuth = availableBasicAuthCredentials();
 	if (basicAuth) return prepareBasicAuthCredentialStore(basicAuth, writablePath, remoteUrl);
@@ -172,10 +182,8 @@ function runnerGitEnv(remoteUrl) {
 		...process.env,
 		GIT_TERMINAL_PROMPT: "0"
 	};
-	if (remoteUrl && isSshRemote(remoteUrl)) {
-		const sshCommand = gitSshCommand();
-		if (sshCommand) env.GIT_SSH_COMMAND = sshCommand;
-	}
+	const sshCommand = gitSshCommand();
+	if (sshCommand && remoteUrl && isSshRemote(remoteUrl)) env.GIT_SSH_COMMAND = sshCommand;
 	return env;
 }
 function gitSshCommand() {
@@ -183,7 +191,7 @@ function gitSshCommand() {
 	const identityPath = resolve(credentialsDir, "identity");
 	const knownHostsPath = resolve(credentialsDir, "known_hosts");
 	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return;
-	chmodSync(identityPath, 256);
+	ensureSshIdentityPermissions(identityPath);
 	return [
 		"ssh",
 		"-i",
@@ -196,11 +204,63 @@ function gitSshCommand() {
 		"StrictHostKeyChecking=yes"
 	].join(" ");
 }
+function ensureSshIdentityPermissions(identityPath) {
+	try {
+		chmodSync(identityPath, 256);
+		return;
+	} catch (error) {
+		if (!(isReadOnlyFileSystemError(error) && isOwnerReadOnly(identityPath))) throw error;
+	}
+}
+function isReadOnlyFileSystemError(error) {
+	return error instanceof Error && "code" in error && error.code === "EROFS";
+}
+function isOwnerReadOnly(path) {
+	const permissions = statSync(path).mode.toString(8).slice(-3);
+	return [
+		"4",
+		"5",
+		"6",
+		"7"
+	].includes(permissions[0] ?? "") && permissions.slice(1) === "00";
+}
 function readCredentialFile(path) {
 	return readFileSync(path, "utf8").trim();
 }
-function remoteUrlFromGitArgs(args) {
+async function remoteUrlFromGitArgs(cwd, args) {
+	const literalRemoteUrl = literalRemoteUrlFromGitArgs(args);
+	if (literalRemoteUrl) return literalRemoteUrl;
+	const remoteName = remoteNameFromGitArgs(args);
+	if (!remoteName) return;
+	return await gitRemoteUrl(cwd, remoteName);
+}
+function literalRemoteUrlFromGitArgs(args) {
 	if (args[0] === "clone") return args.find((arg) => isRemoteUrl(arg));
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = args[1];
+		return remoteArg && isRemoteUrl(remoteArg) ? remoteArg : void 0;
+	}
+}
+function remoteNameFromGitArgs(args) {
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = args[1];
+		if (remoteArg && !remoteArg.startsWith("-") && !isRemoteUrl(remoteArg)) return remoteArg;
+	}
+}
+async function gitRemoteUrl(cwd, remoteName) {
+	const { stdout } = await execGit("git", [
+		"remote",
+		"get-url",
+		remoteName
+	], {
+		cwd,
+		encoding: "utf8",
+		env: {
+			...process.env,
+			GIT_TERMINAL_PROMPT: "0"
+		}
+	});
+	return stdout.trim() || void 0;
 }
 function isRemoteUrl(value) {
 	return value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
@@ -208,6 +268,9 @@ function isRemoteUrl(value) {
 function isSshRemote(value) {
 	return value.startsWith("ssh://") || isScpLikeSshRemote(value);
 }
+function isHttpRemote(value) {
+	return value.startsWith("http://") || value.startsWith("https://");
+}
 function isScpLikeSshRemote(value) {
 	return SCP_LIKE_SSH_REMOTE_RE.test(value);
 }

package/dist/runner-command/run.js

@@ -9,6 +9,7 @@ import { z } from "zod";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { execa } from "execa";
+import pino from "pino";
 //#region src/runner-command/run.ts
 const runnerCommandOptionsSchema = z.object({
 	cwd: z.string().min(1).optional(),
@@ -17,6 +18,7 @@ const runnerCommandOptionsSchema = z.object({
 	payloadFile: z.string().min(1),
 	scheduleFile: z.string().min(1),
 	stderr: z.custom((value) => isOutputStream(value)).optional(),
+	stdout: z.custom((value) => isOutputStream(value)).optional(),
 	taskDescriptorFile: z.string().min(1).optional()
 }).strict();
 const EXIT_PASS = 0;
@@ -25,15 +27,36 @@ const EXIT_VALIDATION = 64;
 const EXIT_STARTUP = 70;
 async function runRunnerCommand(rawOptions = {}) {
 	const parsedOptions = runnerCommandOptionsSchema.safeParse(rawOptions);
-	const stderr = rawOptions.stderr ?? process.stderr;
+	const logger = createRunnerLogger({
+		stderr: isOutputStream(rawOptions.stderr) ? rawOptions.stderr : process.stderr,
+		stdout: isOutputStream(rawOptions.stdout) ? rawOptions.stdout : process.stdout
+	});
 	if (!parsedOptions.success) {
-		stderr.write(`${parsedOptions.error.message}\n`);
+		logger.error({
+			error: parsedOptions.error.message,
+			phase: "options.validate"
+		}, "runner options validation failed");
 		return EXIT_VALIDATION;
 	}
 	const options = parsedOptions.data;
 	try {
+		logger.info({
+			phase: "payload.load",
+			status: "start"
+		}, "payload.load start");
 		const payload = parseRunnerCommandPayload(readFileSync(options.payloadFile, "utf8"));
 		const descriptor = readRunnerTaskDescriptor(options.taskDescriptorFile ?? "/etc/pipeline/task.json");
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "payload.load",
+			runId: payload.run.id,
+			status: "finish",
+			workflowId: payload.workflow.id
+		}, "payload.load finish");
+		logger.info({
+			phase: "event.sink.configure",
+			status: "start"
+		}, "event.sink.configure start");
 		const authToken = resolveRunnerEventSinkAuthToken({ authTokenFile: payload.events.authTokenFile });
 		const sink = createRunnerEventSink({
 			authHeader: payload.events.authHeader,
@@ -42,27 +65,86 @@ async function runRunnerCommand(rawOptions = {}) {
 			runId: payload.run.id,
 			url: payload.events.url
 		});
+		logger.info({
+			phase: "event.sink.configure",
+			status: "finish"
+		}, "event.sink.configure finish");
+		logger.info({
+			hasProvidedCwd: Boolean(options.cwd),
+			phase: "git.workspace.prepare",
+			status: "start"
+		}, "git.workspace.prepare start");
 		const worktreePath = await prepareRunnerGitWorkspace(payload, { cwd: options.cwd });
+		logger.info({
+			phase: "git.workspace.prepare",
+			status: "finish"
+		}, "git.workspace.prepare finish");
+		logger.info({
+			phase: "config.load",
+			status: "start"
+		}, "config.load start");
 		const baseConfig = loadPipelineConfig(worktreePath, { allowMissingLintFileReferences: true });
+		logger.info({
+			phase: "config.load",
+			status: "finish"
+		}, "config.load finish");
+		logger.info({
+			phase: "schedule.compile",
+			status: "start"
+		}, "schedule.compile start");
 		const compiled = compileScheduleArtifact(baseConfig, parseScheduleArtifact(readFileSync(options.scheduleFile, "utf8"), options.scheduleFile), worktreePath);
+		logger.info({
+			phase: "schedule.compile",
+			status: "finish",
+			workflowId: compiled.workflowId
+		}, "schedule.compile finish");
 		if (payload.workflow.id !== compiled.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'`);
 		const node = findPlannedNode(compiled.plan.topologicalOrder, descriptor.nodeId);
 		if (!node) throw new Error(`Argo task '${descriptor.nodeId}' is not declared in workflow '${compiled.workflowId}'`);
+		logger.info({
+			dependencyCount: node.needs.length,
+			nodeId: descriptor.nodeId,
+			phase: "dependency.merge",
+			status: "start"
+		}, "dependency.merge start");
 		await mergeDependencyRefs({
 			committer: compiled.config.runner_command.git.committer,
 			dependencyNodeIds: node.needs,
 			payload,
 			worktreePath
 		});
+		logger.info({
+			dependencyCount: node.needs.length,
+			nodeId: descriptor.nodeId,
+			phase: "dependency.merge",
+			status: "finish"
+		}, "dependency.merge finish");
+		logger.info({
+			commandCount: baseConfig.runner_command.environment.setup.length,
+			phase: "setup.commands",
+			status: "start"
+		}, "setup.commands start");
 		await runSetupCommands(baseConfig.runner_command.environment.setup, {
 			env: options.env ?? process.env,
+			logger,
 			worktreePath
 		});
+		logger.info({
+			commandCount: baseConfig.runner_command.environment.setup.length,
+			phase: "setup.commands",
+			status: "finish"
+		}, "setup.commands finish");
 		sink.recordRunnerCommandPhase("task.start", `Starting ${descriptor.nodeId}`, {
 			kind: node.kind,
 			taskId: descriptor.nodeId,
 			workflowId: payload.workflow.id
 		});
+		logger.info({
+			kind: node.kind,
+			nodeId: descriptor.nodeId,
+			phase: "task.run",
+			status: "start"
+		}, "task.run start");
 		const result = await runScheduledWorkflowTask({
 			config: compiled.config,
 			hookPolicy: payload.hookPolicy,
@@ -73,12 +155,29 @@ async function runRunnerCommand(rawOptions = {}) {
 			workflowId: compiled.workflowId,
 			worktreePath
 		});
+		logger.info({
+			exitCode: result.exitCode,
+			nodeId: descriptor.nodeId,
+			phase: "task.run",
+			resultStatus: result.status,
+			status: "finish"
+		}, "task.run finish");
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "git.node-ref.push",
+			status: "start"
+		}, "git.node-ref.push start");
 		await commitAndPushNodeRef({
 			committer: compiled.config.runner_command.git.committer,
 			nodeId: descriptor.nodeId,
 			payload,
 			worktreePath
 		});
+		logger.info({
+			nodeId: descriptor.nodeId,
+			phase: "git.node-ref.push",
+			status: "finish"
+		}, "git.node-ref.push finish");
 		sink.recordRunnerCommandPhase("task.finish", `Finished ${descriptor.nodeId}`, {
 			evidence: result.evidence,
 			exitCode: result.exitCode,
@@ -86,11 +185,14 @@ async function runRunnerCommand(rawOptions = {}) {
 			taskId: descriptor.nodeId,
 			workflowId: payload.workflow.id
 		});
-		await flushAndReport(sink, stderr);
+		await flushAndReport(sink, logger);
 		return result.status === "passed" ? EXIT_PASS : EXIT_FAIL;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		stderr.write(`${message}\n`);
+		logger.error({
+			error: message,
+			phase: "runner-command"
+		}, message);
 		return error instanceof RunnerCommandPayloadValidationError || error instanceof z.ZodError ? EXIT_VALIDATION : EXIT_STARTUP;
 	}
 }
@@ -102,12 +204,26 @@ function findPlannedNode(nodes, nodeId) {
 	}
 }
 async function runSetupCommands(commands, options) {
-	for (const command of commands) {
+	for (const [index, command] of commands.entries()) {
+		options.logger.info({
+			command: command.command,
+			index: index + 1,
+			phase: "setup.command",
+			status: "start"
+		}, "setup.command start");
 		const result = await execa(command.command, command.args, {
 			cwd: options.worktreePath,
 			env: options.env,
 			reject: false
 		});
+		options.logger.info({
+			command: command.command,
+			exitCode: result.exitCode,
+			index: index + 1,
+			phase: "setup.command",
+			required: command.required,
+			status: "finish"
+		}, "setup.command finish");
 		if (result.exitCode !== 0 && command.required) throw new Error(`runner setup command '${command.command}' failed with exit ${result.exitCode}`);
 	}
 }
@@ -119,13 +235,52 @@ function runnerTaskText(task, worktreePath) {
 function isOutputStream(value) {
 	return typeof value === "object" && value !== null && "write" in value && typeof value.write === "function";
 }
-async function flushAndReport(sink, stderr) {
+async function flushAndReport(sink, logger) {
+	logger.info({
+		phase: "event.flush",
+		status: "start"
+	}, "event.flush start");
 	try {
 		await sink.flush();
+		logger.info({
+			phase: "event.flush",
+			status: "finish"
+		}, "event.flush finish");
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
-		stderr.write(`runner event flush failed: ${message}\n`);
+		logger.error({
+			error: message,
+			phase: "event.flush"
+		}, `runner event flush failed: ${message}`);
 	}
 }
+function createRunnerLogger(options) {
+	const streams = [{
+		level: "info",
+		stream: options.stdout
+	}, {
+		level: "error",
+		stream: options.stderr
+	}];
+	return pino({
+		base: void 0,
+		level: "info",
+		name: "moka-runner",
+		redact: {
+			censor: "[redacted]",
+			paths: [
+				"authToken",
+				"*.authToken",
+				"token",
+				"*.token",
+				"password",
+				"*.password",
+				"identity",
+				"*.identity"
+			]
+		},
+		timestamp: pino.stdTimeFunctions.isoTime
+	}, pino.multistream(streams, { dedupe: true }));
+}
 //#endregion
 export { runRunnerCommand };

package/dist/schedule-planner.js

@@ -472,13 +472,33 @@ function executeBaselineWorkflow() {
 				],
 				id: "verification",
 				kind: "agent",
-				needs: ["acceptance-review"],
+				needs: [
+					"mechanical-green-tests",
+					"mechanical-green-typecheck",
+					"mechanical-green-lint",
+					"mechanical-green-fallow"
+				],
 				profile: "moka-verifier"
 			},
+			{
+				id: "code-quality-review",
+				kind: "agent",
+				needs: [
+					"mechanical-green-tests",
+					"mechanical-green-typecheck",
+					"mechanical-green-lint",
+					"mechanical-green-fallow"
+				],
+				profile: "moka-thermo-nuclear-reviewer"
+			},
 			{
 				id: "learn",
 				kind: "agent",
-				needs: ["verification"],
+				needs: [
+					"acceptance-review",
+					"verification",
+					"code-quality-review"
+				],
 				profile: "moka-learner"
 			}
 		]

package/package.json

@@ -13,6 +13,7 @@
     "micromatch": "^4.0.8",
     "p-limit": "^7.3.0",
     "package-manager-detector": "^1.6.0",
+    "pino": "^10.3.1",
     "secure-json-parse": "^4.1.0",
     "simple-git": "^3.36.0",
     "xstate": "^5.31.1",
@@ -122,7 +123,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.27.19",
+  "version": "1.28.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",