@oisincoveney/pipeline 2.0.0 → 2.1.0

package/.agents/skills/claude-code-opencode-execute/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: claude-code-opencode-execute
+description: Use in Claude Code when executing Moka work locally through OpenCode; loads execute first, then spawns Claude Task agents that run opencode run with the correct MoKa agent prompts.
+allowed-tools: Bash(opencode run *) Bash(pwd) Bash(git status *) Task
+---
+
+# Claude Code OpenCode Execute
+
+Use this skill when Claude Code is the interactive host, but the work should be executed by local OpenCode MoKa agents through `opencode run` subprocesses.
+
+This skill is a host adapter. It does not replace [[execute]]. Load and follow [[execute]] first; use this skill only for the Claude Code dispatch mechanics.
+
+## Contract
+
+1. Load [[execute]] and let it classify the request, required companion skills, acceptance criteria, and verification path.
+2. Keep the execution doctrine from [[execute]]: vertical slices, test-first for behavior, root-cause fixes, fidelity checks, critique, and verification.
+3. Use Claude Code `Task` subagents as wrappers around local OpenCode subprocesses when work can be delegated.
+4. Each delegated Task agent should run exactly one MoKa-flavored OpenCode command and return the command, exit status, parsed evidence, touched files, and blockers.
+5. Batch independent nodes in parallel, wait at barriers, synthesize outputs, then decide the next batch.
+
+## OpenCode command shape
+
+Task agents should run OpenCode with this shape from the repository root:
+
+```sh
+opencode run --agent "<MoKa Agent Name>" --format json --dir "$PWD" '<node prompt>'
+```
+
+Use `--format json` so the parent can inspect structured event output. If the output contains multiple assistant text candidates, prefer the latest candidate that satisfies the requested JSON or evidence contract.
+
+Do not use `moka submit` for this local Claude Code adapter unless the user explicitly asks to submit an Argo Workflow. `moka submit` is the durable pipeline path; this skill is for interactive local orchestration through Claude Task agents and `opencode run`.
+
+## Agent Selection
+
+Select the MoKa agent by the slice's role:
+
+| Role | OpenCode agent |
+| --- | --- |
+| Intake, repository research, requirements clarification | `MoKa Researcher` |
+| Read-only code inspection | `MoKa Inspector` |
+| Schedule graph generation or schedule review | `MoKa Schedule Planner` |
+| Focused failing tests | `MoKa Test Writer` |
+| Production implementation | `MoKa Code Writer` |
+| Acceptance criteria audit | `MoKa Acceptance Reviewer` |
+| Final quality review | `MoKa Thermo Nuclear Reviewer` |
+| Verification evidence and command checks | `MoKa Verifier` |
+| Durable lessons after a completed run | `MoKa Learner` |
+
+Do not delegate normal child work to `MoKa Orchestrator`; the Claude Code parent is the local orchestrator for this adapter.
+
+## Prompt Contract
+
+Every `opencode run` prompt must include:
+
+- The original user task.
+- The current execution contract from [[execute]].
+- The node id and role.
+- The selected MoKa agent name and why it was selected.
+- The exact files or modules in scope, or a read-only discovery scope.
+- Dependency outputs from earlier nodes.
+- The acceptance criteria this node owns.
+- The output shape expected by the parent.
+
+Use this template for delegated prompts:
+
+```text
+You are running as <MoKa Agent Name> for a Claude Code local Moka execution.
+
+Original task:
+<user task>
+
+Execution contract:
+<contract produced by execute>
+
+Node:
+- id: <node id>
+- role: <role>
+- selected agent: <MoKa Agent Name>
+- scope: <files/modules/commands>
+
+Dependency outputs:
+<summaries or "none">
+
+Acceptance criteria owned by this node:
+<criteria>
+
+Instructions:
+- Follow the skills and grants configured for this MoKa agent.
+- Stay inside this node's scope.
+- Do not claim completion without fresh evidence.
+- Return only the requested output shape.
+
+Output shape:
+<JSON or concise evidence contract>
+```
+
+## Batching Rules
+
+- Run read-only discovery agents in parallel when their scopes do not require a shared conclusion first.
+- Run test-writing before production implementation for behavior changes.
+- Run multiple `MoKa Code Writer` agents in the same batch only when [[execute]] has produced independent vertical slices with disjoint files or clearly isolated worktrees.
+- Never let two write-capable agents edit the same file in the same batch.
+- Run acceptance review, final quality review, and verifier after implementation outputs have been integrated.
+- If any delegated command fails, stop the batch, read the output, classify the blocker, and return to [[execute]] routing instead of retrying blindly.
+
+## Parent Responsibilities
+
+The Claude Code parent must:
+
+- Inspect outputs before launching the next batch.
+- Integrate or reconcile changes itself when multiple agents wrote code.
+- Run the verification required by [[execute]] in the real repository context.
+- Inspect the final diff for accidental edits, secrets, generated churn, and unrelated changes.
+- Report partial verification honestly if the real command path cannot be exercised.
+
+This skill is complete only when [[execute]] would allow the parent to claim completion.

package/defaults/opencode-ecosystem.yaml

@@ -64,7 +64,7 @@ ecosystem_code:
     package: oc-codex-multi-auth
     plugin:
       kind: npm
-      package: oc-codex-multi-auth
+      package: oc-codex-multi-auth@6.3.2
     role: ChatGPT Plus/Pro OAuth with multi-account rotation, health checks, and Codex/GPT-5 routing for OpenCode
     default_stack: true
     source: https://github.com/ndycode/oc-codex-multi-auth
@@ -83,6 +83,56 @@ ecosystem_code:
     role: OpenCode policy enforcement through tool execution hooks
     default_stack: true
     source: https://cupcake.eqtylab.io/getting-started/usage/opencode/
+provider_models:
+  # Reasoning-effort variant selectors for ChatGPT OAuth Codex routing.
+  # Each id must match the oc-codex-multi-auth MODEL_MAP exactly; the plugin
+  # normalizes the selector back to the base API model (gpt-5.5) and the
+  # reasoning effort is carried by the generated options.reasoningEffort.
+  - id: gpt-5.5-none
+    provider: openai
+    role: zero-reasoning GPT-5.5 selector for mechanical low-stakes work
+    options:
+      reasoningEffort: none
+      reasoningSummary: auto
+      textVerbosity: medium
+      include: [reasoning.encrypted_content]
+      store: false
+  - id: gpt-5.5-low
+    provider: openai
+    role: low-reasoning GPT-5.5 selector for cheap inspection and bookkeeping roles
+    options:
+      reasoningEffort: low
+      reasoningSummary: auto
+      textVerbosity: medium
+      include: [reasoning.encrypted_content]
+      store: false
+  - id: gpt-5.5-medium
+    provider: openai
+    role: default-reasoning GPT-5.5 selector for research and coverage roles
+    options:
+      reasoningEffort: medium
+      reasoningSummary: auto
+      textVerbosity: medium
+      include: [reasoning.encrypted_content]
+      store: false
+  - id: gpt-5.5-high
+    provider: openai
+    role: high-reasoning GPT-5.5 selector for implementation roles
+    options:
+      reasoningEffort: high
+      reasoningSummary: detailed
+      textVerbosity: medium
+      include: [reasoning.encrypted_content]
+      store: false
+  - id: gpt-5.5-xhigh
+    provider: openai
+    role: maximum-reasoning GPT-5.5 selector for schedule planning
+    options:
+      reasoningEffort: xhigh
+      reasoningSummary: detailed
+      textVerbosity: medium
+      include: [reasoning.encrypted_content]
+      store: false
 mcp_backends:
   - id: pipeline-gateway
     locality: project-remote

package/dist/argo-workflow.js

@@ -303,25 +303,6 @@ function runnerWorkflowStorage(options, tasks) {
 			name: "runner-git-credentials",
 			secret: {
 				defaultMode: 256,
-				items: [
-					{
-						key: "username",
-						path: "username"
-					},
-					{
-						key: "password",
-						path: "password"
-					},
-					{
-						key: "identity",
-						path: "identity"
-					},
-					{
-						key: "known_hosts",
-						path: "known_hosts"
-					}
-				],
-				optional: true,
 				secretName: options.gitCredentialsSecretName
 			}
 		});

package/dist/cli/program.d.ts

@@ -26,6 +26,7 @@ interface DoctorResult {
 interface DoctorFlags {
   cluster?: boolean | string;
   kubeContext?: string;
+  kubeconfig?: string;
 }
 declare function createCliProgram(): Command;
 declare function runCli(argv: string[]): Promise<void>;

package/dist/cli/program.js

@@ -5,6 +5,7 @@ import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "../runner.
 import { compileWorkflowPlan } from "../workflow-planner.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "../schedule/planner.js";
 import "../schedule-planner.js";
+import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "../codex-auth-sync.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
@@ -133,7 +134,7 @@ function createCliProgram() {
 		const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 		console.log(formatSelectedWorkflowPlan(config, cwd, flags));
 	});
-	program.command("doctor").description("Check local prerequisites for pipeline init and execution").option("--cluster [namespace]", "also check runner-job Kubernetes prerequisites").option("--kube-context <context>", "kubectl context for cluster checks").action(async (flags) => {
+	program.command("doctor").description("Check local prerequisites for pipeline init and execution").option("--cluster [namespace]", "also check runner-job Kubernetes prerequisites").option("--kube-context <context>", "kubectl context for cluster checks").option("--kubeconfig <path>", "kubeconfig path for cluster checks").action(async (flags) => {
 		const result = await runDoctor(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), flags);
 		console.log(formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
@@ -149,7 +150,7 @@ function createCliProgram() {
 		const config = loadPipelineConfig(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), { allowMissingLintFileReferences: true });
 		console.log(renderGatewayConfig(config));
 	});
-	gatewayCommand.command("configure-host").description("Rewrite host MCP config to the singleton pipeline gateway").addOption(new Option("--host <host>", "host config to update").choices(["all", "opencode"]).default("all").argParser(parseCommandHost)).addOption(new Option("--scope <scope>", "config scope to update").choices(["project", "global"]).default("project").argParser(parseGatewayHostScope)).action((flags) => {
+	gatewayCommand.command("configure-host").description("Rewrite host MCP config to the singleton pipeline gateway").addOption(new Option("--host <host>", "host config to update").choices(["all", "opencode"]).default("all").argParser(parseGatewayHost)).addOption(new Option("--scope <scope>", "config scope to update").choices(["project", "global"]).default("project").argParser(parseGatewayHostScope)).action((flags) => {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		const result = configureGatewayHosts(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), {
 			cwd,
@@ -181,7 +182,11 @@ function createCliProgram() {
 		const result = await initPipelineProject({ cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd() });
 		console.log(formatPipelineInitResult(result));
 	});
-	program.command("install-commands").description("Install generated slash-command adapters into this repository").addOption(new Option("--host <host>", "host command set to install").choices(["all", "opencode"]).default("all").argParser(parseCommandHost)).option("--dry-run", "show planned changes without writing files").option("--check", "fail if generated command files are missing or stale").option("--force", "overwrite manually edited command files").action(async (flags) => {
+	program.command("install-commands").description("Install generated slash-command adapters into this repository").addOption(new Option("--host <host>", "host command set to install").choices([
+		"all",
+		"opencode",
+		"claude-code"
+	]).default("all").argParser(parseCommandHost)).option("--dry-run", "show planned changes without writing files").option("--check", "fail if generated command files are missing or stale").option("--force", "overwrite manually edited command files").action(async (flags) => {
 		const result = await installCommands({
 			...flags,
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()
@@ -231,6 +236,10 @@ function parseGatewayHostScope(value) {
 	if (value === "project" || value === "global") return value;
 	throw new Error("scope must be project or global");
 }
+function parseGatewayHost(value) {
+	if (value === "all" || value === "opencode") return value;
+	throw new Error(`Unsupported gateway host "${value}"`);
+}
 async function runCli(argv) {
 	await createCliProgram().parseAsync(argv, { from: "node" });
 }
@@ -241,9 +250,11 @@ async function runDoctor(cwd, options = {}) {
 		checkCommand("fallow", ["--version"], cwd)
 	]);
 	const configCheck = checkPipelineConfig(cwd);
+	const globalConfig = loadMokaGlobalConfig();
 	const clusterResult = options.cluster ? await runClusterDoctor({
 		kubeContext: options.kubeContext,
-		namespace: clusterNamespace(options.cluster)
+		kubeconfigPath: options.kubeconfig ?? globalConfig?.momokaya.kubernetes.kubeconfig,
+		namespace: clusterNamespace(options.cluster, globalConfig?.momokaya.kubernetes.namespace)
 	}) : { checks: [] };
 	const checks = [
 		...commandChecks,
@@ -255,8 +266,8 @@ async function runDoctor(cwd, options = {}) {
 		passed: checks.every((check) => check.passed)
 	};
 }
-function clusterNamespace(value) {
-	return typeof value === "string" && value.length > 0 ? value : defaultClusterDoctorNamespace();
+function clusterNamespace(value, configuredNamespace) {
+	return typeof value === "string" && value.length > 0 ? value : configuredNamespace ?? defaultClusterDoctorNamespace();
 }
 function checkCommand(name, args, cwd) {
 	return checkCommandWithRunner(name, name, args, cwd);

package/dist/cluster-doctor.js

@@ -13,33 +13,38 @@ const DEFAULT_RESOURCES = {
 	queueName: "pipeline-runner",
 	serviceAccountName: "pipeline-runner"
 };
+const FORBIDDEN_RE = /forbidden/i;
 async function runClusterDoctor(options = {}) {
 	const resources = clusterResources();
 	const namespace = options.namespace ?? DEFAULT_NAMESPACE;
+	const kubectlOptions = {
+		kubeContext: options.kubeContext,
+		kubeconfigPath: options.kubeconfigPath
+	};
 	const checks = await Promise.all([
-		checkKubectlNamespace(namespace, options.kubeContext),
-		...secretChecks(namespace, options.kubeContext, resources),
-		checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, options.kubeContext),
-		checkClusterSecretStore("openbao", options.kubeContext),
-		checkServiceAccount(namespace, resources.serviceAccountName, options.kubeContext),
-		checkServiceAccountPermission(namespace, resources.serviceAccountName, {
-			kubeContext: options.kubeContext,
+		checkKubectlNamespace(namespace, kubectlOptions),
+		...secretChecks(namespace, kubectlOptions, resources),
+		checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, kubectlOptions),
+		checkClusterSecretStore("openbao", kubectlOptions),
+		checkServiceAccount(namespace, resources.serviceAccountName, kubectlOptions),
+		checkWorkflowSubmitPermission(namespace, {
 			resource: "workflows.argoproj.io",
-			verb: "create"
+			verb: "create",
+			...kubectlOptions
 		}),
-		checkLocalQueue(namespace, resources.queueName, options.kubeContext),
+		checkLocalQueue(namespace, resources.queueName, kubectlOptions),
 		checkClusterResource("argo-workflow-crd", [
 			"get",
 			"crd",
 			"workflows.argoproj.io"
-		], options.kubeContext),
+		], kubectlOptions),
 		checkClusterResource("argo-workflow-controller", [
 			"get",
 			"pods",
 			"-A",
 			"-l",
 			"app=workflow-controller"
-		], options.kubeContext)
+		], kubectlOptions)
 	]);
 	return {
 		checks,
@@ -62,7 +67,7 @@ function clusterResources() {
 		serviceAccountName: configured.serviceAccountName
 	} : DEFAULT_RESOURCES;
 }
-function secretChecks(namespace, kubeContext, resources) {
+function secretChecks(namespace, kubectlOptions, resources) {
 	return [
 		[resources.eventAuthSecretName, eventAuthMissingDetail(namespace)],
 		[resources.imagePullSecretName, `Secret ${resources.imagePullSecretName} missing in ${namespace}; expected imagePullSecret for ghcr.io/oisin-ee/pipeline-runner.`],
@@ -75,30 +80,31 @@ function secretChecks(namespace, kubeContext, resources) {
 		name,
 		"-n",
 		namespace
-	], missingDetail, kubeContext));
+	], missingDetail, kubectlOptions));
 }
 function eventAuthMissingDetail(namespace) {
 	return `Secret pipeline-runner-event-auth missing in ${namespace}; expected ExternalSecret pipeline-runner-event-auth to sync it from agent-runtime/pipeline-runner/event-auth.`;
 }
-function checkKubectlNamespace(namespace, kubeContext) {
+function checkKubectlNamespace(namespace, kubectlOptions) {
 	return checkNamespacedResource(`namespace/${namespace}`, [
 		"get",
 		"namespace",
 		namespace
-	], `Namespace ${namespace} missing or inaccessible.`, kubeContext);
+	], `Namespace ${namespace} missing or inaccessible.`, kubectlOptions);
 }
-async function checkNamespacedResource(name, args, missingDetail, kubeContext) {
-	return (await kubectl(args, kubeContext)).ok ? {
+async function checkNamespacedResource(name, args, missingDetail, kubectlOptions) {
+	const result = await kubectl(args, kubectlOptions);
+	return result.ok ? {
 		detail: "present",
 		name,
 		passed: true
 	} : {
-		detail: missingDetail,
+		detail: inaccessibleOrMissingDetail(name, missingDetail, result),
 		name,
 		passed: false
 	};
 }
-async function checkExternalSecret(namespace, name, remoteRef, kubeContext) {
+async function checkExternalSecret(namespace, name, remoteRef, kubectlOptions) {
 	const result = await kubectl([
 		"get",
 		"externalsecret",
@@ -107,76 +113,79 @@ async function checkExternalSecret(namespace, name, remoteRef, kubeContext) {
 		namespace,
 		"-o",
 		"json"
-	], kubeContext);
-	if (!result.ok) return {
-		detail: `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`,
-		name: `externalsecret/${name}`,
-		passed: false
-	};
+	], kubectlOptions);
+	if (!result.ok) {
+		const missingDetail = `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`;
+		return {
+			detail: inaccessibleOrMissingDetail(`externalsecret/${name}`, missingDetail, result),
+			name: `externalsecret/${name}`,
+			passed: false
+		};
+	}
 	return readyConditionCheck(`externalsecret/${name}`, result.stdout);
 }
-async function checkClusterSecretStore(name, kubeContext) {
+async function checkClusterSecretStore(name, kubectlOptions) {
 	const result = await kubectl([
 		"get",
 		"clustersecretstore",
 		name,
 		"-o",
 		"json"
-	], kubeContext);
-	if (!result.ok) return {
-		detail: `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`,
-		name: `clustersecretstore/${name}`,
-		passed: false
-	};
+	], kubectlOptions);
+	if (!result.ok) {
+		const missingDetail = `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`;
+		return {
+			detail: inaccessibleOrMissingDetail(`clustersecretstore/${name}`, missingDetail, result),
+			name: `clustersecretstore/${name}`,
+			passed: false
+		};
+	}
 	return readyConditionCheck(`clustersecretstore/${name}`, result.stdout);
 }
-function checkServiceAccount(namespace, name, kubeContext) {
+function checkServiceAccount(namespace, name, kubectlOptions) {
 	return checkNamespacedResource(`serviceaccount/${name}`, [
 		"get",
 		"serviceaccount",
 		name,
 		"-n",
 		namespace
-	], `ServiceAccount ${name} missing in ${namespace}; runner pods must use this account for workflow execution.`, kubeContext);
+	], `ServiceAccount ${name} missing in ${namespace}; runner pods must use this account for workflow execution.`, kubectlOptions);
 }
-async function checkServiceAccountPermission(namespace, serviceAccountName, options) {
-	const subject = `system:serviceaccount:${namespace}:${serviceAccountName}`;
+async function checkWorkflowSubmitPermission(namespace, options) {
 	return (await kubectl([
 		"auth",
 		"can-i",
 		options.verb,
 		options.resource,
-		"--as",
-		subject,
 		"-n",
 		namespace
-	], options.kubeContext)).stdout.trim() === "yes" ? {
-		detail: `${subject} can ${options.verb} ${options.resource}`,
+	], options)).stdout.trim() === "yes" ? {
+		detail: `current kube identity can ${options.verb} ${options.resource}`,
 		name: "rbac/workflow-create",
 		passed: true
 	} : {
-		detail: `${subject} cannot ${options.verb} ${options.resource}; check runner ServiceAccount RBAC.`,
+		detail: `current kube identity cannot ${options.verb} ${options.resource}; check submitter RBAC for Workflow creation.`,
 		name: "rbac/workflow-create",
 		passed: false
 	};
 }
-function checkLocalQueue(namespace, queueName, kubeContext) {
+function checkLocalQueue(namespace, queueName, kubectlOptions) {
 	return checkNamespacedResource(`localqueue/${queueName}`, [
 		"get",
 		"localqueue",
 		queueName,
 		"-n",
 		namespace
-	], `Kueue LocalQueue ${queueName} missing in ${namespace}; runner Workflow pods cannot be admitted to the expected queue.`, kubeContext);
+	], `Kueue LocalQueue ${queueName} missing in ${namespace}; runner Workflow pods cannot be admitted to the expected queue.`, kubectlOptions);
 }
-async function checkClusterResource(name, args, kubeContext) {
-	const result = await kubectl(args, kubeContext);
+async function checkClusterResource(name, args, kubectlOptions) {
+	const result = await kubectl(args, kubectlOptions);
 	return result.ok ? {
 		detail: "present",
 		name,
 		passed: true
 	} : {
-		detail: result.stderr || "missing or inaccessible",
+		detail: isForbidden(result) ? inaccessibleDetail(name, result) : result.stderr || "missing or inaccessible",
 		name,
 		passed: false
 	};
@@ -193,9 +202,12 @@ function readyConditionCheck(name, source) {
 		passed: false
 	};
 }
-async function kubectl(args, kubeContext) {
+async function kubectl(args, options) {
 	try {
-		const result = await execa("kubectl", kubectlArgs(args, kubeContext), { stdin: "ignore" });
+		const result = await execa("kubectl", kubectlArgs(args, options.kubeContext), {
+			env: options.kubeconfigPath ? { KUBECONFIG: options.kubeconfigPath } : void 0,
+			stdin: "ignore"
+		});
 		return {
 			ok: true,
 			stderr: result.stderr,
@@ -217,6 +229,15 @@ function kubectlArgs(args, kubeContext) {
 		...args
 	] : args;
 }
+function inaccessibleOrMissingDetail(name, missingDetail, result) {
+	return isForbidden(result) ? inaccessibleDetail(name, result) : missingDetail;
+}
+function inaccessibleDetail(name, result) {
+	return `${name} inaccessible with the current kube identity: ${result.stderr}`;
+}
+function isForbidden(result) {
+	return FORBIDDEN_RE.test(result.stderr);
+}
 function parseJson(source) {
 	try {
 		return JSON.parse(source);

package/dist/codex-auth-sync.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import { parse } from "jsonc-parser";
 //#region src/codex-auth-sync.ts
-const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth";
+const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";
 const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
 function syncLocalCodexAuth(options) {
 	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];

package/dist/config/defaults.d.ts

@@ -55,6 +55,31 @@ declare const openCodeEcosystemManifestSchema: z.ZodObject<{
     source: z.ZodOptional<z.ZodString>;
     used_by: z.ZodArray<z.ZodString>;
   }, z.core.$strict>>;
+  provider_models: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    options: z.ZodObject<{
+      include: z.ZodArray<z.ZodString>;
+      reasoningEffort: z.ZodEnum<{
+        none: "none";
+        low: "low";
+        medium: "medium";
+        high: "high";
+        xhigh: "xhigh";
+      }>;
+      reasoningSummary: z.ZodEnum<{
+        auto: "auto";
+        detailed: "detailed";
+      }>;
+      store: z.ZodLiteral<false>;
+      textVerbosity: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+      }>;
+    }, z.core.$strict>;
+    provider: z.ZodString;
+    role: z.ZodString;
+  }, z.core.$strict>>;
   runtime: z.ZodObject<{
     compatibility_runners: z.ZodArray<z.ZodString>;
     default_runner: z.ZodLiteral<"opencode">;
@@ -125,6 +150,18 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
     path?: string | undefined;
     source?: string | undefined;
   }[];
+  provider_models: {
+    id: string;
+    options: {
+      include: string[];
+      reasoningEffort: "none" | "low" | "medium" | "high" | "xhigh";
+      reasoningSummary: "auto" | "detailed";
+      store: false;
+      textVerbosity: "low" | "medium" | "high";
+    };
+    provider: string;
+    role: string;
+  }[];
   runtime: {
     compatibility_runners: string[];
     default_runner: "opencode";