@oisincoveney/pipeline 3.11.0 → 3.11.2

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    fail: "fail";
     pass: "pass";
+    fail: "fail";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/install-hooks.js

@@ -1,3 +1,4 @@
+import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { execa } from "execa";
@@ -21,6 +22,36 @@ const HOST_TARGET_ROOT = {
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
+const MERGE_MANAGED = { ".claude/settings.json": ["hooks"] };
+function mergeKeyFor(path) {
+	return MERGE_MANAGED[path];
+}
+function canonicalize(value) {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (isRecord(value)) {
+		const out = {};
+		for (const key of Object.keys(value).sort()) out[key] = canonicalize(value[key]);
+		return out;
+	}
+	return value;
+}
+function hashJson(value) {
+	return hashContent(Buffer.from(JSON.stringify(canonicalize(value) ?? null)));
+}
+function managedSubtree(text, keyPath) {
+	const parsed = parseJsonRecord(text);
+	if (!parsed.ok) return;
+	let cursor = parsed.value;
+	for (const key of keyPath) {
+		if (!isRecord(cursor)) return;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+function targetIdentityHash(path, content) {
+	const mergeKey = mergeKeyFor(path);
+	return mergeKey ? hashJson(managedSubtree(content.toString("utf8"), mergeKey)) : hashContent(content);
+}
 async function cloneHookRepository(targetDir) {
 	await execa("gh", [
 		"repo",
@@ -59,11 +90,12 @@ async function sourceHookFiles(source) {
 		return (await listFiles(hostRoot)).map((file) => {
 			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
 			const content = readFileSync(file);
+			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
 			return {
 				content,
-				hash: hashContent(content),
+				hash: targetIdentityHash(path, content),
 				host,
-				path: `${HOST_TARGET_ROOT[host]}/${relativePath}`
+				path
 			};
 		});
 	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
@@ -111,7 +143,7 @@ function targetPath(path) {
 function actionForFile(file, force, manifests) {
 	const target = targetPath(file.path);
 	if (!existsSync(target)) return "create";
-	const currentHash = hashContent(readFileSync(target));
+	const currentHash = targetIdentityHash(file.path, readFileSync(target));
 	if (currentHash === file.hash) return "unchanged";
 	if (force) return "update";
 	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
@@ -141,6 +173,11 @@ async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);
 	await mkdir(dirname(target), { recursive: true });
+	const mergeKey = mergeKeyFor(file.path);
+	if (mergeKey && existsSync(target)) {
+		await writeFile(target, ensureTrailingNewline(applyJsonEdit(readFileSync(target, "utf8"), mergeKey, managedSubtree(file.content.toString("utf8"), mergeKey))));
+		return;
+	}
 	await writeFile(target, file.content);
 }
 function itemFor(file) {

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
+  "node.finish": "node.finish";
+  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
-  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
-  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -207,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/planning/generate.d.ts

@@ -1593,6 +1593,17 @@ interface SchedulePlanningContext {
   parentWorkUnits: BacklogWorkUnit[];
   workUnits: BacklogWorkUnit[];
 }
+/**
+ * A backlog ticket's frontmatter may declare dependencies on sibling tickets
+ * that are not part of this run (e.g. submitting TOVA-766.03 alone when its
+ * frontmatter depends on TOVA-766.01). Those out-of-scope ids must not reach the
+ * planner: it is instructed to preserve Backlog dependency ids as needs edges,
+ * and an edge to a work unit that no node serves fails schedule validation. Prune
+ * each unit's dependencies to the ids actually in scope (parent + work units) —
+ * the same predicate workUnitDependencyIssues applies after generation — so the
+ * planner prompt context and downstream validation stay consistent.
+ */
+declare function pruneOutOfScopeDependencies(context: SchedulePlanningContext): SchedulePlanningContext;
 declare function parseScheduleArtifact(source: string, sourcePath?: string): ScheduleArtifact;
 declare const ScheduleArtifactError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "ScheduleArtifactError";
@@ -1606,4 +1617,4 @@ declare function compileScheduleArtifact(config: PipelineConfig, artifact: Sched
 declare function generateScheduleArtifact(options: GenerateScheduleOptions): Promise<GenerateScheduleResult>;
 declare function scheduleArtifactPath(worktreePath: string, scheduleId: string): string;
 //#endregion
-export { BacklogWorkUnit, CompiledScheduleArtifact, GenerateScheduleOptions, GenerateScheduleResult, ScheduleArtifact, ScheduleArtifactError, SchedulePlanningContext, compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact, scheduleArtifactPath };
+export { BacklogWorkUnit, CompiledScheduleArtifact, GenerateScheduleOptions, GenerateScheduleResult, ScheduleArtifact, ScheduleArtifactError, SchedulePlanningContext, compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact, pruneOutOfScopeDependencies, scheduleArtifactPath };

package/dist/planning/generate.js

@@ -49,6 +49,27 @@ const scheduleArtifactSchema = z.object({
 	version: z.literal(1),
 	workflows: z.record(z.string().regex(ID_RE), workflowSchema)
 }).strict();
+/**
+* A backlog ticket's frontmatter may declare dependencies on sibling tickets
+* that are not part of this run (e.g. submitting TOVA-766.03 alone when its
+* frontmatter depends on TOVA-766.01). Those out-of-scope ids must not reach the
+* planner: it is instructed to preserve Backlog dependency ids as needs edges,
+* and an edge to a work unit that no node serves fails schedule validation. Prune
+* each unit's dependencies to the ids actually in scope (parent + work units) —
+* the same predicate workUnitDependencyIssues applies after generation — so the
+* planner prompt context and downstream validation stay consistent.
+*/
+function pruneOutOfScopeDependencies(context) {
+	const inScope = new Set([...context.parentWorkUnits, ...context.workUnits].map((unit) => unit.id));
+	const prune = (unit) => unit.dependencies ? {
+		...unit,
+		dependencies: unit.dependencies.filter((id) => inScope.has(id))
+	} : unit;
+	return {
+		parentWorkUnits: context.parentWorkUnits.map(prune),
+		workUnits: context.workUnits.map(prune)
+	};
+}
 function parseScheduleArtifact(source, sourcePath = "schedule.yaml") {
 	const document = parseDocument(source, {
 		prettyErrors: false,
@@ -93,7 +114,7 @@ async function generateScheduleArtifact(options) {
 		runId: options.runId,
 		task: options.task
 	});
-	const planningContext = { ...loadBacklogPlanningContext(options.task, options.worktreePath) };
+	const planningContext = pruneOutOfScopeDependencies({ ...loadBacklogPlanningContext(options.task, options.worktreePath) });
 	const generatedArtifact = await planScheduleArtifact(baseline, policy.planner_profile, options, planningContext);
 	assertSchedulePassOrder();
 	const artifact = hydrateScheduleTaskContexts(canonicalizeGeneratedScheduleIds(applyNodeCatalogModelFallbacks(options.config, policy.node_catalog, appendPullRequestDelivery(options.config, integrateParallelWriteFanout(options.config, addGeneratedImplementationCoverage(options.config, generatedArtifact))))), planningContext);
@@ -385,4 +406,4 @@ function flattenWorkflowNodes(nodes) {
 	return flattenNodes(nodes, (node) => node.kind === "parallel" ? node.nodes : void 0);
 }
 //#endregion
-export { ScheduleArtifactError, compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact, scheduleArtifactPath };
+export { ScheduleArtifactError, compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact, pruneOutOfScopeDependencies, scheduleArtifactPath };

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.start": "workflow.start";
     "workflow.planned": "workflow.planned";
+    "workflow.start": "workflow.start";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
-    "node.start": "node.start";
-    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -108,8 +108,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     nodeId: z.ZodOptional<z.ZodString>;
     outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     status: z.ZodEnum<{
-      fail: "fail";
       pass: "pass";
+      fail: "fail";
       skip: "skip";
     }>;
     summary: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.start": "workflow.start";
       "workflow.planned": "workflow.planned";
+      "workflow.start": "workflow.start";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
-      "node.start": "node.start";
-      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
+      "node.finish": "node.finish";
+      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;
@@ -286,8 +286,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       nodeId: z.ZodOptional<z.ZodString>;
       outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       status: z.ZodEnum<{
-        fail: "fail";
         pass: "pass";
+        fail: "fail";
         skip: "skip";
       }>;
       summary: z.ZodOptional<z.ZodString>;

package/docs/okteto-runner.md

@@ -0,0 +1,50 @@
+# Okteto Runner Pod
+
+Use the Okteto inner loop for hands-on local work inside the same container
+shape as Argo runner tasks. One command stands the pod up and attaches a shell:
+
+```sh
+mise run dev
+```
+
+`mise run dev` applies the runner Deployment (`k8s/runner-dev/deployment.yaml`)
+into the pipeline namespace (default `momokaya-pipeline`, overridable with
+`PIPELINE_DEV_NAMESPACE`) and then runs `okteto up runner`, which syncs your
+local checkout onto the pod and drops you into a bash terminal at
+`/workspace/oisin-pipeline`. The pod runs `ghcr.io/oisin-ee/pipeline-runner:latest`
+with the `pipeline-runner` service account and `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`.
+
+Inside the pod, run a local entrypoint:
+
+```sh
+moka run --entrypoint quick "inspect the current branch"
+```
+
+Local `moka run` uses the live terminal renderer by default after PIPE-61; no
+extra output-format flag is required.
+
+Tear it down when done:
+
+```sh
+mise run dev:down
+```
+
+`dev:down` detaches the inner loop (`okteto down runner`) and removes the runner
+Deployment.
+
+Required namespace secrets and credentials in `momokaya-pipeline`:
+
+- `ghcr-pull-secret` for pulling the private runner image.
+- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
+- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
+- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
+
+Caveat: this recipe is for interactive `moka run` sessions, not Argo
+`runner-command` pods. It intentionally does not mount per-run payload, schedule,
+or task descriptor ConfigMaps.
+
+Parity: the dev runner pod is the inner-loop twin of the production Argo runner
+pod built by `buildRunnerArgoWorkflowManifest` in `src/argo-workflow.ts`. Keep
+`k8s/runner-dev/deployment.yaml` in step with that builder (same image, service
+account, env, and secret mounts) so "dev pod == prod runner pod" (the original
+PIPE-62 intent) holds.

package/package.json

@@ -127,7 +127,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.0",
+  "version": "3.11.2",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/docs/devspace-runner.md

@@ -1,26 +0,0 @@
-# DevSpace Runner Pod
-
-Use the runner profile for hands-on local work inside the same container shape as Argo runner tasks:
-
-```sh
-devspace dev --profile runner
-```
-
-DevSpace deploys a long-lived `pipeline-runner` pod with `ghcr.io/oisin-ee/pipeline-runner:latest`, the `pipeline-runner` service account, `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`, and a synced checkout at `/workspace/oisin-pipeline`. The terminal starts in that workdir.
-
-Inside the pod, run a local entrypoint:
-
-```sh
-moka run --entrypoint quick "inspect the current branch"
-```
-
-Local `moka run` uses the live terminal renderer by default after PIPE-61; no extra output-format flag is required.
-
-Required namespace secrets and credentials in `momokaya-pipeline`:
-
-- `ghcr-pull-secret` for pulling the private runner image.
-- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
-- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
-- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
-
-Caveat: this recipe is for interactive `moka run` sessions, not Argo `runner-command` pods. It intentionally does not mount per-run payload, schedule, or task descriptor ConfigMaps.