@oisincoveney/pipeline 3.11.1 → 3.11.2

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    fail: "fail";
     pass: "pass";
+    fail: "fail";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/install-hooks.js

@@ -1,3 +1,4 @@
+import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { execa } from "execa";
@@ -21,6 +22,36 @@ const HOST_TARGET_ROOT = {
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
+const MERGE_MANAGED = { ".claude/settings.json": ["hooks"] };
+function mergeKeyFor(path) {
+	return MERGE_MANAGED[path];
+}
+function canonicalize(value) {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (isRecord(value)) {
+		const out = {};
+		for (const key of Object.keys(value).sort()) out[key] = canonicalize(value[key]);
+		return out;
+	}
+	return value;
+}
+function hashJson(value) {
+	return hashContent(Buffer.from(JSON.stringify(canonicalize(value) ?? null)));
+}
+function managedSubtree(text, keyPath) {
+	const parsed = parseJsonRecord(text);
+	if (!parsed.ok) return;
+	let cursor = parsed.value;
+	for (const key of keyPath) {
+		if (!isRecord(cursor)) return;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+function targetIdentityHash(path, content) {
+	const mergeKey = mergeKeyFor(path);
+	return mergeKey ? hashJson(managedSubtree(content.toString("utf8"), mergeKey)) : hashContent(content);
+}
 async function cloneHookRepository(targetDir) {
 	await execa("gh", [
 		"repo",
@@ -59,11 +90,12 @@ async function sourceHookFiles(source) {
 		return (await listFiles(hostRoot)).map((file) => {
 			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
 			const content = readFileSync(file);
+			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
 			return {
 				content,
-				hash: hashContent(content),
+				hash: targetIdentityHash(path, content),
 				host,
-				path: `${HOST_TARGET_ROOT[host]}/${relativePath}`
+				path
 			};
 		});
 	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
@@ -111,7 +143,7 @@ function targetPath(path) {
 function actionForFile(file, force, manifests) {
 	const target = targetPath(file.path);
 	if (!existsSync(target)) return "create";
-	const currentHash = hashContent(readFileSync(target));
+	const currentHash = targetIdentityHash(file.path, readFileSync(target));
 	if (currentHash === file.hash) return "unchanged";
 	if (force) return "update";
 	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
@@ -141,6 +173,11 @@ async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);
 	await mkdir(dirname(target), { recursive: true });
+	const mergeKey = mergeKeyFor(file.path);
+	if (mergeKey && existsSync(target)) {
+		await writeFile(target, ensureTrailingNewline(applyJsonEdit(readFileSync(target, "utf8"), mergeKey, managedSubtree(file.content.toString("utf8"), mergeKey))));
+		return;
+	}
 	await writeFile(target, file.content);
 }
 function itemFor(file) {

package/dist/runner-event-schema.d.ts

@@ -108,8 +108,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     nodeId: z.ZodOptional<z.ZodString>;
     outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     status: z.ZodEnum<{
-      fail: "fail";
       pass: "pass";
+      fail: "fail";
       skip: "skip";
     }>;
     summary: z.ZodOptional<z.ZodString>;
@@ -286,8 +286,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       nodeId: z.ZodOptional<z.ZodString>;
       outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       status: z.ZodEnum<{
-        fail: "fail";
         pass: "pass";
+        fail: "fail";
         skip: "skip";
       }>;
       summary: z.ZodOptional<z.ZodString>;

package/docs/okteto-runner.md

@@ -0,0 +1,50 @@
+# Okteto Runner Pod
+
+Use the Okteto inner loop for hands-on local work inside the same container
+shape as Argo runner tasks. One command stands the pod up and attaches a shell:
+
+```sh
+mise run dev
+```
+
+`mise run dev` applies the runner Deployment (`k8s/runner-dev/deployment.yaml`)
+into the pipeline namespace (default `momokaya-pipeline`, overridable with
+`PIPELINE_DEV_NAMESPACE`) and then runs `okteto up runner`, which syncs your
+local checkout onto the pod and drops you into a bash terminal at
+`/workspace/oisin-pipeline`. The pod runs `ghcr.io/oisin-ee/pipeline-runner:latest`
+with the `pipeline-runner` service account and `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`.
+
+Inside the pod, run a local entrypoint:
+
+```sh
+moka run --entrypoint quick "inspect the current branch"
+```
+
+Local `moka run` uses the live terminal renderer by default after PIPE-61; no
+extra output-format flag is required.
+
+Tear it down when done:
+
+```sh
+mise run dev:down
+```
+
+`dev:down` detaches the inner loop (`okteto down runner`) and removes the runner
+Deployment.
+
+Required namespace secrets and credentials in `momokaya-pipeline`:
+
+- `ghcr-pull-secret` for pulling the private runner image.
+- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
+- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
+- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
+
+Caveat: this recipe is for interactive `moka run` sessions, not Argo
+`runner-command` pods. It intentionally does not mount per-run payload, schedule,
+or task descriptor ConfigMaps.
+
+Parity: the dev runner pod is the inner-loop twin of the production Argo runner
+pod built by `buildRunnerArgoWorkflowManifest` in `src/argo-workflow.ts`. Keep
+`k8s/runner-dev/deployment.yaml` in step with that builder (same image, service
+account, env, and secret mounts) so "dev pod == prod runner pod" (the original
+PIPE-62 intent) holds.

package/package.json

@@ -127,7 +127,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/docs/devspace-runner.md

@@ -1,26 +0,0 @@
-# DevSpace Runner Pod
-
-Use the runner profile for hands-on local work inside the same container shape as Argo runner tasks:
-
-```sh
-devspace dev --profile runner
-```
-
-DevSpace deploys a long-lived `pipeline-runner` pod with `ghcr.io/oisin-ee/pipeline-runner:latest`, the `pipeline-runner` service account, `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`, and a synced checkout at `/workspace/oisin-pipeline`. The terminal starts in that workdir.
-
-Inside the pod, run a local entrypoint:
-
-```sh
-moka run --entrypoint quick "inspect the current branch"
-```
-
-Local `moka run` uses the live terminal renderer by default after PIPE-61; no extra output-format flag is required.
-
-Required namespace secrets and credentials in `momokaya-pipeline`:
-
-- `ghcr-pull-secret` for pulling the private runner image.
-- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
-- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
-- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
-
-Caveat: this recipe is for interactive `moka run` sessions, not Argo `runner-command` pods. It intentionally does not mount per-run payload, schedule, or task descriptor ConfigMaps.