@oisincoveney/pipeline 3.11.1 → 3.11.3

package/defaults/pipeline.yaml

@@ -66,7 +66,10 @@ runner_command:
           - |
             if [ -f .moka/bootstrap.sh ]; then
               echo "moka: running repo bootstrap (.moka/bootstrap.sh)"
-              sh .moka/bootstrap.sh
+              # Run under the script's own shebang (e.g. bash), not forced `sh`:
+              # forcing dash breaks bash-feature bootstraps (`set -o pipefail`).
+              chmod +x .moka/bootstrap.sh
+              ./.moka/bootstrap.sh
             elif [ -f package.json ] && grep -q '"moka:setup"' package.json; then
               echo "moka: running repo bootstrap (npm run moka:setup)"
               npm run moka:setup

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
@@ -481,8 +481,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      quick: "quick";
       execute: "execute";
+      quick: "quick";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;

package/dist/install-hooks.js

@@ -1,3 +1,4 @@
+import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { execa } from "execa";
@@ -21,6 +22,36 @@ const HOST_TARGET_ROOT = {
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
+const MERGE_MANAGED = { ".claude/settings.json": ["hooks"] };
+function mergeKeyFor(path) {
+	return MERGE_MANAGED[path];
+}
+function canonicalize(value) {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (isRecord(value)) {
+		const out = {};
+		for (const key of Object.keys(value).sort()) out[key] = canonicalize(value[key]);
+		return out;
+	}
+	return value;
+}
+function hashJson(value) {
+	return hashContent(Buffer.from(JSON.stringify(canonicalize(value) ?? null)));
+}
+function managedSubtree(text, keyPath) {
+	const parsed = parseJsonRecord(text);
+	if (!parsed.ok) return;
+	let cursor = parsed.value;
+	for (const key of keyPath) {
+		if (!isRecord(cursor)) return;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+function targetIdentityHash(path, content) {
+	const mergeKey = mergeKeyFor(path);
+	return mergeKey ? hashJson(managedSubtree(content.toString("utf8"), mergeKey)) : hashContent(content);
+}
 async function cloneHookRepository(targetDir) {
 	await execa("gh", [
 		"repo",
@@ -59,11 +90,12 @@ async function sourceHookFiles(source) {
 		return (await listFiles(hostRoot)).map((file) => {
 			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
 			const content = readFileSync(file);
+			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
 			return {
 				content,
-				hash: hashContent(content),
+				hash: targetIdentityHash(path, content),
 				host,
-				path: `${HOST_TARGET_ROOT[host]}/${relativePath}`
+				path
 			};
 		});
 	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
@@ -111,7 +143,7 @@ function targetPath(path) {
 function actionForFile(file, force, manifests) {
 	const target = targetPath(file.path);
 	if (!existsSync(target)) return "create";
-	const currentHash = hashContent(readFileSync(target));
+	const currentHash = targetIdentityHash(file.path, readFileSync(target));
 	if (currentHash === file.hash) return "unchanged";
 	if (force) return "update";
 	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
@@ -141,6 +173,11 @@ async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);
 	await mkdir(dirname(target), { recursive: true });
+	const mergeKey = mergeKeyFor(file.path);
+	if (mergeKey && existsSync(target)) {
+		await writeFile(target, ensureTrailingNewline(applyJsonEdit(readFileSync(target, "utf8"), mergeKey, managedSubtree(file.content.toString("utf8"), mergeKey))));
+		return;
+	}
 	await writeFile(target, file.content);
 }
 function itemFor(file) {

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -161,8 +161,8 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;
@@ -207,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/runner-command-contract.d.ts

@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -104,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      full: "full";
       quick: "quick";
+      full: "full";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/docs/okteto-runner.md

@@ -0,0 +1,50 @@
+# Okteto Runner Pod
+
+Use the Okteto inner loop for hands-on local work inside the same container
+shape as Argo runner tasks. One command stands the pod up and attaches a shell:
+
+```sh
+mise run dev
+```
+
+`mise run dev` applies the runner Deployment (`k8s/runner-dev/deployment.yaml`)
+into the pipeline namespace (default `momokaya-pipeline`, overridable with
+`PIPELINE_DEV_NAMESPACE`) and then runs `okteto up runner`, which syncs your
+local checkout onto the pod and drops you into a bash terminal at
+`/workspace/oisin-pipeline`. The pod runs `ghcr.io/oisin-ee/pipeline-runner:latest`
+with the `pipeline-runner` service account and `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`.
+
+Inside the pod, run a local entrypoint:
+
+```sh
+moka run --entrypoint quick "inspect the current branch"
+```
+
+Local `moka run` uses the live terminal renderer by default after PIPE-61; no
+extra output-format flag is required.
+
+Tear it down when done:
+
+```sh
+mise run dev:down
+```
+
+`dev:down` detaches the inner loop (`okteto down runner`) and removes the runner
+Deployment.
+
+Required namespace secrets and credentials in `momokaya-pipeline`:
+
+- `ghcr-pull-secret` for pulling the private runner image.
+- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
+- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
+- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
+
+Caveat: this recipe is for interactive `moka run` sessions, not Argo
+`runner-command` pods. It intentionally does not mount per-run payload, schedule,
+or task descriptor ConfigMaps.
+
+Parity: the dev runner pod is the inner-loop twin of the production Argo runner
+pod built by `buildRunnerArgoWorkflowManifest` in `src/argo-workflow.ts`. Keep
+`k8s/runner-dev/deployment.yaml` in step with that builder (same image, service
+account, env, and secret mounts) so "dev pod == prod runner pod" (the original
+PIPE-62 intent) holds.

package/package.json

@@ -127,7 +127,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.1",
+  "version": "3.11.3",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/docs/devspace-runner.md

@@ -1,26 +0,0 @@
-# DevSpace Runner Pod
-
-Use the runner profile for hands-on local work inside the same container shape as Argo runner tasks:
-
-```sh
-devspace dev --profile runner
-```
-
-DevSpace deploys a long-lived `pipeline-runner` pod with `ghcr.io/oisin-ee/pipeline-runner:latest`, the `pipeline-runner` service account, `CODEX_AUTH_PER_PROJECT_ACCOUNTS=0`, and a synced checkout at `/workspace/oisin-pipeline`. The terminal starts in that workdir.
-
-Inside the pod, run a local entrypoint:
-
-```sh
-moka run --entrypoint quick "inspect the current branch"
-```
-
-Local `moka run` uses the live terminal renderer by default after PIPE-61; no extra output-format flag is required.
-
-Required namespace secrets and credentials in `momokaya-pipeline`:
-
-- `ghcr-pull-secret` for pulling the private runner image.
-- `opencode-auth-1` with `auth.json`, mounted at `/root/.local/share/opencode/auth.json`.
-- `oisin-bot-git-credentials` with `username`, `password`, `identity`, and `known_hosts`, mounted at `/etc/pipeline/git-credentials`.
-- `oisin-bot-github-auth` with `hosts.yml`, mounted at `/root/.config/gh/hosts.yml`.
-
-Caveat: this recipe is for interactive `moka run` sessions, not Argo `runner-command` pods. It intentionally does not mount per-run payload, schedule, or task descriptor ConfigMaps.