@oisincoveney/pipeline 2.1.0 → 2.2.0

package/defaults/pipeline.yaml

@@ -0,0 +1,111 @@
+version: 1
+default_workflow: inspect
+orchestrator:
+  profile: moka-orchestrator
+entrypoints:
+  quick:
+    schedule: quick-schedule
+    description: Compact planner-generated pipeline for small work
+  execute:
+    schedule: execute-schedule
+    description: Full planner-generated pipeline for repository work
+  inspect:
+    workflow: inspect
+    description: Read-only repository inspection
+hooks:
+  functions:
+    generated-defaults-audit:
+      kind: command
+      command: [node, -e, "const fs=require('node:fs'); fs.writeFileSync(process.env.PIPELINE_HOOK_RESULT, JSON.stringify({status:'pass',summary:'Generated defaults audit passed'}));"]
+      trusted: true
+      timeout_ms: 5000
+      output_limit_bytes: 4096
+  on:
+    workflow.start:
+      - id: generated-defaults-audit
+        function: generated-defaults-audit
+        failure: fail
+runner_command:
+  environment:
+    setup:
+      - command: bun
+        args: [install, --frozen-lockfile]
+scheduler:
+  commands:
+    quick:
+      schedule: quick-schedule
+      catalog: quick
+    execute:
+      schedule: execute-schedule
+      catalog: execute
+  node_catalogs:
+    quick:
+      required_categories: [intake, red, green, mechanical, verification]
+      nodes:
+        backlog-intake:
+          category: intake
+          profile: moka-researcher
+          models: [openai/gpt-5.5-medium]
+        red-tests:
+          category: red
+          profile: moka-test-writer
+          models: [openai/gpt-5.5-high, kimi-for-coding/kimi-k2-thinking]
+        green-implementation:
+          category: green
+          profile: moka-code-writer
+          models: [openai/gpt-5.5-high, kimi-for-coding/k2p6, opencode-go/qwen3.7-max]
+        verification:
+          category: verification
+          profile: moka-verifier
+          models: [openai/gpt-5.5-medium]
+    execute:
+      required_categories: [intake, research, red, green, mechanical, acceptance, verification, learn]
+      nodes:
+        backlog-intake:
+          category: intake
+          profile: moka-researcher
+          models: [openai/gpt-5.5-medium]
+        research:
+          category: research
+          profile: moka-researcher
+          models: [openai/gpt-5.5-medium, kimi-for-coding/k2p6]
+        red-tests:
+          category: red
+          profile: moka-test-writer
+          models: [openai/gpt-5.5-high, kimi-for-coding/kimi-k2-thinking]
+        green-backend:
+          category: green
+          profile: moka-code-writer
+          models: [openai/gpt-5.5-high, kimi-for-coding/k2p6, opencode-go/qwen3.7-max]
+        green-frontend:
+          category: green
+          profile: moka-code-writer
+          models: [openai/gpt-5.5-high, kimi-for-coding/k2p6, opencode-go/qwen3.7-max]
+        acceptance-review:
+          category: acceptance
+          profile: moka-acceptance-reviewer
+          models: [openai/gpt-5.5-medium]
+        verification:
+          category: verification
+          profile: moka-verifier
+          models: [openai/gpt-5.5-medium]
+        learn:
+          category: learn
+          profile: moka-learner
+          models: [openai/gpt-5.5-low]
+schedules:
+  quick-schedule:
+    baseline: quick
+    planner_profile: moka-schedule-planner
+    node_catalog: quick
+  execute-schedule:
+    baseline: execute
+    planner_profile: moka-schedule-planner
+    node_catalog: execute
+workflows:
+  inspect:
+    description: Read-only repository inspection workflow.
+    nodes:
+      - id: inspect
+        kind: agent
+        profile: moka-inspector

package/defaults/profiles.yaml

@@ -0,0 +1,212 @@
+version: 1
+mcp_gateway:
+  provider: toolhive
+  mode: local
+  url: https://pipeline-mcp.momokaya.ee/mcp/
+  url_env: PIPELINE_MCP_GATEWAY_URL
+  authorization_env: PIPELINE_MCP_GATEWAY_AUTHORIZATION
+  default_profile: default
+  backends:
+    context7:
+      locality: shared-remote
+      tool_prefixes: [context7]
+    uidotsh:
+      locality: shared-remote
+      tool_prefixes: [uidotsh]
+    qdrant:
+      locality: repo-scoped-remote
+      tool_prefixes: [qdrant]
+    fallow:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      required: false
+      tool_prefixes: [fallow]
+    serena:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [serena]
+    backlog:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [backlog]
+skills:
+  execute:
+    path: .agents/skills/execute/SKILL.md
+    source_root: package
+  inspect:
+    path: .agents/skills/inspect/SKILL.md
+    source_root: package
+  quick:
+    path: .agents/skills/quick/SKILL.md
+    source_root: package
+  critique:
+    path: .agents/skills/critique/SKILL.md
+    source_root: package
+  doubt:
+    path: .agents/skills/doubt/SKILL.md
+    source_root: package
+  fix:
+    path: .agents/skills/fix/SKILL.md
+    source_root: package
+  library-first-development:
+    path: .agents/skills/library-first-development/SKILL.md
+    source_root: package
+  migrate:
+    path: .agents/skills/migrate/SKILL.md
+    source_root: package
+  optimize:
+    path: .agents/skills/optimize/SKILL.md
+    source_root: package
+  research:
+    path: .agents/skills/research/SKILL.md
+    source_root: package
+  schedule-graph-shaping:
+    path: .agents/skills/schedule-graph-shaping/SKILL.md
+    source_root: package
+  scope:
+    path: .agents/skills/scope/SKILL.md
+    source_root: package
+  secure:
+    path: .agents/skills/secure/SKILL.md
+    source_root: package
+  spec:
+    path: .agents/skills/spec/SKILL.md
+    source_root: package
+  test:
+    path: .agents/skills/test/SKILL.md
+    source_root: package
+  trace:
+    path: .agents/skills/trace/SKILL.md
+    source_root: package
+  verify:
+    path: .agents/skills/verify/SKILL.md
+    source_root: package
+profiles:
+  moka-orchestrator:
+    runner: opencode
+    description: Orchestrate the configured pipeline and enforce gates.
+    instructions: { inline: "Orchestrate the configured pipeline through package-defined entrypoints, native agents, and gates. Do not bypass configured runner subprocesses or package-configured gates." }
+    skills: [execute, quick, inspect]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+  moka-researcher:
+    runner: opencode
+    description: Research the requested task and produce structured findings.
+    instructions: { inline: "Inspect first-party source, tests, docs, and task context for the current task only. Produce concise findings with file references and stop; do not perform open-ended repository exploration." }
+    timeout_ms: 900000
+    skills: [research, spec, scope]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/research.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-inspector:
+    runner: opencode
+    model: openai/gpt-5.5-low
+    description: Inspect the repository without modifying files.
+    instructions: { inline: "Inspect the repository without modifying files." }
+    skills: [research]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+  moka-schedule-planner:
+    runner: opencode
+    model: openai/gpt-5.5-xhigh
+    description: Refine a baseline schedule into a specialized approved-plan artifact.
+    instructions: { inline: "Generate exactly one workflow named root as an explicit schedule graph. Return YAML only." }
+    timeout_ms: 300000
+    skills: [schedule-graph-shaping]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+  moka-test-writer:
+    runner: opencode
+    scheduling_roles: [implementation]
+    description: Add focused failing tests for the requested behavior.
+    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    skills: [test]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash, edit, write]
+    filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-code-writer:
+    runner: opencode
+    scheduling_roles: [implementation]
+    description: Implement production code until the failing tests pass.
+    instructions: { inline: "Implement the smallest production change that satisfies the failing tests. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    skills: [trace, test, fix, library-first-development]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash, edit, write]
+    filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-acceptance-reviewer:
+    runner: opencode
+    scheduling_roles: [coverage]
+    description: Audit the finished change against every acceptance criterion.
+    instructions: { inline: 'Audit the completed change against each canonical acceptance criterion independently. Return only valid JSON with top-level "verdict", "evidence", "acceptance", and optional "violations". Each "acceptance" entry must include "id", "verdict", and non-empty "evidence". Do not use Markdown fences or prose outside the JSON object.' }
+    skills: [critique, doubt]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/acceptance.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-thermo-nuclear-reviewer:
+    runner: opencode
+    scheduling_roles: [coverage]
+    description: Perform the final thermo-nuclear code quality review of the integration branch.
+    instructions: { inline: "Perform the final code quality review of the integration branch." }
+    skills: [critique]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/review.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-verifier:
+    runner: opencode
+    scheduling_roles: [coverage]
+    description: Verify checks, implementation fit, and final evidence.
+    instructions: { inline: 'Verify checks, implementation fit, and final evidence. Return only valid JSON with top-level "verdict", "evidence", and optional "violations". Do not use Markdown fences or prose outside the JSON object.' }
+    skills: [verify, critique, secure, optimize]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/verify.schema.json
+      repair: { enabled: true, max_attempts: 1 }
+  moka-learner:
+    runner: opencode
+    model: openai/gpt-5.5-low
+    description: Store durable lessons from the completed run.
+    instructions: { inline: "Store durable lessons from the completed run when useful." }
+    skills: [migrate]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
+    network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/learn.schema.json
+      repair: { enabled: true, max_attempts: 1 }

package/defaults/runners.yaml

@@ -0,0 +1,24 @@
+version: 1
+runners:
+  opencode:
+    type: opencode
+    capabilities:
+      native_subagents: true
+      rules: true
+      skills: true
+      mcp_servers: true
+      tools: [read, list, grep, glob, bash, edit, write]
+      filesystem: [read-only, workspace-write]
+      network: [inherit, disabled]
+      output_formats: [text, json, jsonl, json_schema]
+  command:
+    type: command
+    capabilities:
+      native_subagents: false
+      rules: false
+      skills: false
+      mcp_servers: false
+      tools: [bash]
+      filesystem: [read-only, workspace-write]
+      network: [inherit, disabled]
+      output_formats: [text, json]

package/dist/argo-graph.js

@@ -1,11 +1,6 @@
 import { uniqueStrings } from "./strings.js";
 import { z } from "zod";
 //#region src/argo-graph.ts
-const EXECUTABLE_NODE_KINDS = [
-	"agent",
-	"builtin",
-	"command"
-];
 const argoExecutableTaskSchema = z.object({
 	dependencies: z.array(z.string().min(1)),
 	nodeId: z.string().min(1),
@@ -18,6 +13,21 @@ const argoExecutionGraphSchema = z.object({
 	terminalTaskNames: z.array(z.string().min(1)),
 	workflowId: z.string().min(1)
 }).strict();
+/**
+* Thrown when the Argo graph compiler encounters a node kind that cannot be
+* lowered to an Argo DAG task. Callers should surface this as a validation
+* failure before attempting a cluster submission.
+*/
+var ArgoGraphCompilerError = class extends Error {
+	kind;
+	nodeId;
+	constructor(kind, nodeId) {
+		super(`Argo graph compiler: node kind '${kind}' on node '${nodeId}' cannot be lowered to an Argo DAG task`);
+		this.name = "ArgoGraphCompilerError";
+		this.kind = kind;
+		this.nodeId = nodeId;
+	}
+};
 function compileArgoExecutionGraph(plan) {
 	const compiler = new ArgoGraphCompiler(plan);
 	return argoExecutionGraphSchema.parse(compiler.compile());
@@ -47,41 +57,63 @@ var ArgoGraphCompiler = class {
 		}
 	}
 	compileNodes(nodes, inheritedNeeds) {
-		for (const node of nodes) {
-			if (isExecutableNode(node)) {
-				const dependencies = this.resolveDependencyTaskNames([...inheritedNeeds, ...node.needs]);
-				const task = argoExecutableTaskSchema.parse({
-					dependencies,
-					nodeId: node.id,
-					taskName: argoTaskName(node.id),
-					templateName: argoTemplateName(node.id)
-				});
-				this.tasks.push(task);
-				continue;
-			}
-			if (node.kind === "group") continue;
-			if (node.kind === "parallel") this.compileNodes(node.children ?? [], [...inheritedNeeds, ...node.needs]);
+		for (const node of nodes) this.compileNode(node, inheritedNeeds);
+	}
+	compileNode(node, inheritedNeeds) {
+		const kind = node.kind;
+		switch (kind) {
+			case "agent":
+			case "builtin":
+			case "command":
+				this.compileExecutableNode(node, inheritedNeeds);
+				return;
+			case "group": return;
+			case "parallel":
+				this.compileParallelNode(node, inheritedNeeds);
+				return;
+			default: throw new ArgoGraphCompilerError(String(kind), node.id);
 		}
 	}
+	compileExecutableNode(node, inheritedNeeds) {
+		const dependencies = this.resolveDependencyTaskNames([...inheritedNeeds, ...node.needs]);
+		const task = argoExecutableTaskSchema.parse({
+			dependencies,
+			nodeId: node.id,
+			taskName: argoTaskName(node.id),
+			templateName: argoTemplateName(node.id)
+		});
+		this.tasks.push(task);
+	}
+	compileParallelNode(node, inheritedNeeds) {
+		this.compileNodes(node.children ?? [], [...inheritedNeeds, ...node.needs]);
+	}
 	resolveDependencyTaskNames(nodeIds) {
 		return uniqueStrings(nodeIds.flatMap((nodeId) => this.resolveDependencyNodeIds(nodeId).map((id) => argoTaskName(id))));
 	}
 	resolveDependencyNodeIds(nodeId) {
 		const node = this.nodeById.get(nodeId);
 		if (!node) return [];
-		if (isExecutableNode(node)) return [node.id];
-		if (node.kind === "group") return uniqueStrings([...node.nodes ?? [], ...node.needs].flatMap((id) => this.resolveDependencyNodeIds(id)));
-		if (node.kind === "parallel") return uniqueStrings((node.children ?? []).flatMap((child) => this.resolveDependencyNodeIds(child.id)));
-		return [];
+		const kind = node.kind;
+		switch (kind) {
+			case "agent":
+			case "builtin":
+			case "command": return [node.id];
+			case "group": return this.resolveGroupNodeIds(node);
+			case "parallel": return this.resolveParallelNodeIds(node);
+			default: throw new ArgoGraphCompilerError(String(kind), node.id);
+		}
+	}
+	resolveGroupNodeIds(node) {
+		return uniqueStrings([...node.nodes ?? [], ...node.needs].flatMap((id) => this.resolveDependencyNodeIds(id)));
+	}
+	resolveParallelNodeIds(node) {
+		return uniqueStrings((node.children ?? []).flatMap((child) => this.resolveDependencyNodeIds(child.id)));
 	}
 	terminalTasks() {
 		const dependedOn = new Set(this.tasks.flatMap((task) => task.dependencies));
 		return this.tasks.filter((task) => !dependedOn.has(task.taskName));
 	}
 };
-function isExecutableNode(node) {
-	return EXECUTABLE_NODE_KINDS.includes(node.kind);
-}
 function argoTaskName(nodeId) {
 	return `node-${nodeId}`;
 }
@@ -89,4 +121,4 @@ function argoTemplateName(nodeId) {
 	return `task-${nodeId}`;
 }
 //#endregion
-export { compileArgoExecutionGraph };
+export { ArgoGraphCompilerError, compileArgoExecutionGraph };

package/dist/argo-submit.js

@@ -1,6 +1,7 @@
-import { compileArgoExecutionGraph } from "./argo-graph.js";
+import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
 import { buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } from "./argo-workflow.js";
+import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./schedule/planner.js";
 import "./schedule-planner.js";
@@ -52,13 +53,16 @@ const commandScheduleOptionsSchema = z.object({
 async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 	const { config, ...schemaOptions } = rawOptions;
 	const options = submitRunnerArgoWorkflowOptionsSchema.parse(schemaOptions);
-	const payload = runnerCommandPayloadSchema.parse(parseRunnerCommandPayload(options.payloadJson));
+	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
+		payload: runnerCommandPayloadSchema.parse(parseRunnerCommandPayload(options.payloadJson)),
+		payloadJson: options.payloadJson
+	});
 	const compiled = compileScheduleArtifact(config, parseScheduleArtifact(options.scheduleYaml, "schedule.yaml"));
 	const payloadConfigMapName = `pipeline-payload-${randomBytes(6).toString("hex")}`;
 	const scheduleArtifactConfigMapName = `pipeline-schedule-${randomBytes(6).toString("hex")}`;
 	const taskDescriptorConfigMapName = `pipeline-task-descriptors-${randomBytes(6).toString("hex")}`;
 	if (payload.workflow.id !== compiled.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'`);
-	const graph = compileArgoExecutionGraph(compiled.plan);
+	const graph = compileSubmitArgoGraph(compiled);
 	const labels = {
 		"pipeline.oisin.dev/project": payload.run.project,
 		"pipeline.oisin.dev/run-id": payload.run.id,
@@ -94,7 +98,7 @@ async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 	await coreApi.createNamespacedConfigMap({
 		body: configMapSchema.parse({
 			apiVersion: "v1",
-			data: { "payload.json": options.payloadJson },
+			data: { "payload.json": payloadJson },
 			kind: "ConfigMap",
 			metadata: {
 				labels,
@@ -168,6 +172,26 @@ function buildCommandScheduleYaml(rawOptions) {
 		}] } }
 	});
 }
+function normalizeRunnerPayloadForSubmit(input) {
+	const repository = normalizeRunnerRepositoryForSubmit(input.payload.repository);
+	if (repository === input.payload.repository) return input;
+	const payload = runnerCommandPayloadSchema.parse({
+		...input.payload,
+		repository
+	});
+	return {
+		payload,
+		payloadJson: JSON.stringify(payload)
+	};
+}
+function compileSubmitArgoGraph(compiled) {
+	try {
+		return compileArgoExecutionGraph(compiled.plan);
+	} catch (err) {
+		if (err instanceof ArgoGraphCompilerError) throw new Error(`Schedule '${compiled.workflowId}' cannot be submitted: ${err.message}`);
+		throw err;
+	}
+}
 function apiClients(options, dependencies) {
 	if (dependencies.coreApi && dependencies.workflowApi) return {
 		coreApi: dependencies.coreApi,

package/dist/claude-settings-config.js

@@ -0,0 +1,44 @@
+import { applyJsonEdit, ensureTrailingNewline, formatJson, isRecord, parseJsonRecord, setIfMissing } from "./json-config-merge.js";
+//#region src/claude-settings-config.ts
+function mergeClaudeSettings(currentText, projection) {
+	if (currentText === void 0) return {
+		content: formatJson(projection),
+		ok: true
+	};
+	const parsed = parseJsonRecord(currentText);
+	if (!parsed.ok) return parsed;
+	return {
+		content: ensureTrailingNewline(applyClaudeProjection(currentText, parsed.value, projection)),
+		ok: true
+	};
+}
+function applyClaudeProjection(currentText, parsed, projection) {
+	return applyPermissionsAllow(applyMcpServersProjection(currentText, parsed, projection), parsed, projection);
+}
+function applyMcpServersProjection(content, parsed, projection) {
+	return Object.entries(projection.mcpServers ?? {}).reduce((nextContent, [name, server]) => setIfMissing(nextContent, parsed, ["mcpServers", name], server), content);
+}
+function applyPermissionsAllow(content, parsed, projection) {
+	const existing = permissionAllowList(parsed);
+	const merged = unionPreservingOrder(existing, projectedAllowList(projection));
+	return sameOrderedList(existing, merged) ? content : applyJsonEdit(content, ["permissions", "allow"], merged);
+}
+function projectedAllowList(projection) {
+	return projection.permissions?.allow ?? [];
+}
+function unionPreservingOrder(existing, extra) {
+	const merged = [...existing];
+	for (const entry of extra) if (!merged.includes(entry)) merged.push(entry);
+	return merged;
+}
+function sameOrderedList(a, b) {
+	return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+function permissionAllowList(parsed) {
+	const permissions = parsed.permissions;
+	if (!isRecord(permissions)) return [];
+	const allow = permissions.allow;
+	return Array.isArray(allow) ? allow.filter((entry) => typeof entry === "string") : [];
+}
+//#endregion
+export { mergeClaudeSettings };

package/dist/cli/program.js

@@ -238,7 +238,7 @@ function parseGatewayHostScope(value) {
 }
 function parseGatewayHost(value) {
 	if (value === "all" || value === "opencode") return value;
-	throw new Error(`Unsupported gateway host "${value}"`);
+	throw new Error("host must be all or opencode");
 }
 async function runCli(argv) {
 	await createCliProgram().parseAsync(argv, { from: "node" });