@oisincoveney/pipeline 3.11.15 → 3.11.17

package/README.md

@@ -43,10 +43,12 @@ Initialize package-owned pipeline support:
 moka init
 ```
 
-`moka init` installs the package's default skills, generated host command
-surfaces, the singleton `pipeline-gateway` MCP entry, and copied hook files from
-the private `oisin-ee/agent-hooks` repository. OpenCode is the package default
-runtime. The command does not create repo-local `.pipeline` config files.
+`moka init` installs or refreshes the whole per-machine harness in one step:
+the package's default skills, generated host command surfaces, the singleton
+`pipeline-gateway` MCP entry, copied hook files from the private
+`oisin-ee/agent-hooks` repository, and global instruction files. OpenCode is the
+package default runtime. The command does not create repo-local `.pipeline`
+config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -56,16 +58,17 @@ value before starting OpenCode when using a protected gateway:
 export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-Check or refresh generated host files after package upgrades:
+Verify the generated harness (commands, hooks, rules) is current after package
+upgrades or edits to `oisin-ee/agent-hooks`, without writing anything:
 
 ```shell
-moka install-commands --host all --check
+moka init --check
 ```
 
-Check or refresh copied agent hooks after editing `oisin-ee/agent-hooks`:
+Refresh it, overwriting any locally edited harness files:
 
 ```shell
-moka install-hooks --check
+moka init --force
 ```
 
 Check local prerequisites and config health:
@@ -103,10 +106,10 @@ Canonical commands:
 - `moka stop <run-id> [node-id]`: abort a run or one active node.
 - `moka export <run-id> --sanitize`: print a portable evidence bundle.
 - `moka doctor`: check local prerequisites and config health.
-- `moka init`: install package-owned host resources for a repository.
-- `moka install-hooks`: copy manually authored hooks from `oisin-ee/agent-hooks`.
-- `moka refresh-harnesses`: force-refresh the per-machine (global) agent
-  harnesses. The harness is always installed globally; there is no `--scope`.
+- `moka init`: install or refresh the whole per-machine harness (skills,
+  command surfaces, hooks, rules). `--check` verifies without writing,
+  `--dry-run` previews, `--force` overwrites locally edited files. The harness
+  is always installed globally; there is no `--scope`.
 
 ```shell
 moka run "Implement PIPE-123 user-facing behavior"
@@ -118,7 +121,7 @@ moka run --effort normal "Implement a standard fix"
 moka run --target remote --effort thorough "Submit a full hosted graph run"
 moka run --read-only "Inspect the repository without edits"
 moka run --target remote --command -- opencode run "fix this bug"
-moka refresh-harnesses
+moka init --force
 ```
 
 Flag defaults and choices:

package/defaults/pipeline.yaml

@@ -83,12 +83,12 @@ runner_command:
       # Set up package-owned pipeline support + the opencode model registration
       # (.opencode/opencode.json, which declares the gpt-5.5-* reasoning selectors)
       # on every run, so opencode-backed agents in the pod resolve their models
-      # instead of failing with "Model not found". Both commands are idempotent
-      # and write no repo-local pipeline config.
+      # instead of failing with "Model not found". `moka init` installs the full
+      # per-machine harness (skills + commands + hooks + rules); --force refreshes
+      # a pre-baked/version-skewed settings.json instead of refusing it. Idempotent,
+      # writes no repo-local pipeline config.
       - command: moka
-        args: [init]
-      - command: moka
-        args: [install-commands]
+        args: [init, --force]
 scheduler:
   commands:
     quick:

package/dist/argo-workflow.js

@@ -1,4 +1,5 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
+import { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -322,10 +323,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			mountPath: OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR,
 			name: "opencode-openai-accounts",
-			readOnly: true,
-			subPath: "accounts.json"
+			readOnly: true
 		});
 	}
 	if (options.gitCredentialsSecretName) {

package/dist/cli/doctor.js

@@ -5,8 +5,8 @@ import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
 const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);

package/dist/cli/program.js

@@ -15,9 +15,7 @@ import { registerRunnerCommandCommand } from "../commands/runner-command-command
 import { MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, resolveMokaRun } from "./run-resolver.js";
 import { registerTicketCommand } from "../commands/ticket-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
-import { formatInstallCommandsResult, installCommands, parseCommandHost } from "../install-commands.js";
-import { formatInstallHooksResult, installHooks } from "../install-hooks.js";
-import { formatPipelineInitResult, formatRefreshAgentHarnessesResult, initPipelineProject, refreshAgentHarnesses } from "../pipeline-init.js";
+import { formatPipelineInitResult, initPipelineProject } from "../pipeline-init.js";
 import { createRun, runControlStatusPaths, updateRunController } from "../run-control/store.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { startDetachedRunController } from "../run-control/detach.js";
@@ -304,12 +302,7 @@ function createCliProgram(options = {}) {
 		const config = loadPipelineConfig(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), { allowMissingLintFileReferences: true });
 		console.log(renderGatewayConfig(config));
 	});
-	gatewayCommand.command("configure-host").description("Rewrite host MCP config to the singleton pipeline gateway").addOption(new Option$1("--host <host>", "host config to update").choices([
-		"all",
-		"opencode",
-		"claude-code",
-		"codex"
-	]).default("all").argParser(parseGatewayHost)).addOption(new Option$1("--scope <scope>", "config scope to update").choices(["project", "global"]).default("project").argParser(parseGatewayHostScope)).action((flags) => {
+	gatewayCommand.command("configure-host").description("Rewrite host MCP config to the singleton pipeline gateway").addOption(new Option$1("--host <host>", "host config to update").choices(["all", "opencode"]).default("all").argParser(parseGatewayHost)).addOption(new Option$1("--scope <scope>", "config scope to update").choices(["project", "global"]).default("project").argParser(parseGatewayHostScope)).action((flags) => {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		const result = configureGatewayHosts(loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), {
 			cwd,
@@ -337,29 +330,15 @@ function createCliProgram(options = {}) {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		console.log(await localGatewayStatus(cwd));
 	});
-	program.command("init").description("Initialize package-owned pipeline support without repo-local config (global per-machine install: ~/.claude, ~/.config/opencode, ~/.codex)").action(async () => {
-		const result = await initPipelineProject({ cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd() });
-		console.log(formatPipelineInitResult(result));
-	});
-	program.command("refresh-harnesses").description("Force-refresh generated agent harnesses (global per-machine install: ~/.claude, ~/.config/opencode, ~/.codex)").action(async () => {
-		const result = await refreshAgentHarnesses({ cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd() });
-		console.log(formatRefreshAgentHarnessesResult(result));
-	});
-	program.command("install-commands").description("Install generated slash-command adapters into per-machine host dirs (~/.claude, ~/.config/opencode, ~/.codex)").addOption(new Option$1("--host <host>", "host command set to install").choices([
-		"all",
-		"opencode",
-		"claude-code",
-		"codex"
-	]).default("all").argParser(parseCommandHost)).option("--dry-run", "show planned changes without writing files").option("--check", "fail if generated command files are missing or stale").option("--force", "overwrite manually edited command files").action(async (flags) => {
-		const result = await installCommands({
+	program.command("init").description("Install or refresh package-owned pipeline support: per-machine harness (skills + slash-command adapters + agent hooks + global instruction files) installed globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config").option("--check", "verify the generated harness is current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited harness files").action(async (flags) => {
+		const result = await initPipelineProject({
 			...flags,
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()
 		});
-		console.log(formatInstallCommandsResult(result));
-	});
-	program.command("install-hooks").description("Install agent hooks from oisin-ee/agent-hooks into per-machine host dirs (~/.claude, ~/.config/opencode, ~/.codex)").option("--dry-run", "show planned changes without writing files").option("--check", "fail if installed hook files are missing or stale").option("--force", "overwrite manually edited hook files").action(async (flags) => {
-		const result = await installHooks({ ...flags });
-		console.log(formatInstallHooksResult(result));
+		console.log(formatPipelineInitResult(result, {
+			check: flags.check,
+			dryRun: flags.dryRun
+		}));
 	});
 	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
 		const result = syncLocalCodexAuth({

package/dist/codex-auth-sync.js

@@ -1,7 +1,7 @@
 import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { parse } from "jsonc-parser";
 //#region src/codex-auth-sync.ts
 const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";

package/dist/commands/pipeline-command.js

@@ -6,8 +6,6 @@ const BUILTIN_PIPE_COMMANDS = new Set([
 	"explain-plan",
 	"doctor",
 	"init",
-	"refresh-harnesses",
-	"install-commands",
 	"mcp",
 	"submit",
 	"argo",

package/dist/gates.js

@@ -1,7 +1,7 @@
 import "./safe-json.js";
 import { existsSync } from "node:fs";
-import "execa";
 import { join } from "node:path";
+import "execa";
 import "package-manager-detector/commands";
 import "package-manager-detector/detect";
 //#region src/gates.ts

package/dist/install-commands/shared.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/install-commands/shared.ts
 const GENERATED_MARKER = "<!-- Generated by @oisincoveney/pipeline. -->";
 const GENERATED_TS_MARKER = "// Generated by @oisincoveney/pipeline.";

package/dist/install-commands.js

@@ -31,9 +31,6 @@ function selectedInstallHosts(host) {
 function isActiveCommandHost(host) {
 	return host === "opencode" || host === "claude-code";
 }
-function isInstallHost(host) {
-	return INSTALL_HOSTS.some((candidate) => candidate === host);
-}
 function selectedCommandHosts(host) {
 	return selectedInstallHosts(host).filter(isActiveCommandHost);
 }
@@ -274,14 +271,5 @@ async function installCommands(options = {}) {
 	assertInstallCheckCurrent(options, items);
 	return { items };
 }
-function parseCommandHost(value) {
-	const host = value ?? "all";
-	if (host === "all") return host;
-	if (isInstallHost(host)) return host;
-	throw new Error(`Unsupported host "${host}". Supported values: all, ${INSTALL_HOSTS.join(", ")}.`);
-}
-function formatInstallCommandsResult(result) {
-	return result.items.map((item) => `${item.action} ${item.host}: ${item.path} (${item.invocation})`).join("\n");
-}
 //#endregion
-export { formatInstallCommandsResult, installCommands, parseCommandHost };
+export { installCommands };

package/dist/install-hooks.js

@@ -1,9 +1,9 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { execa } from "execa";
-import { dirname, join, relative } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { execa } from "execa";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-hooks.ts
@@ -247,8 +247,5 @@ function installHooks(options = {}) {
 		};
 	});
 }
-function formatInstallHooksResult(result) {
-	return result.items.map((item) => `${item.action} ${item.host}: ${item.path}`).join("\n");
-}
 //#endregion
-export { formatInstallHooksResult, installHooks };
+export { installHooks };

package/dist/install-rules.js

@@ -1,6 +1,6 @@
-import { execa } from "execa";
-import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { execa } from "execa";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
 const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";
@@ -48,7 +48,7 @@ async function defaultRulesyncRunner(args, opts) {
 		});
 	} catch (error) {
 		const cause = error instanceof Error ? `: ${error.message}` : "";
-		throw new Error(`Failed to generate global rules from ${DEFAULT_RULES_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access with \`gh auth login\` and rerun \`moka refresh-harnesses\`.`);
+		throw new Error(`Failed to generate global rules from ${DEFAULT_RULES_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access with \`gh auth login\` and rerun \`moka init\`.`);
 	}
 }
 async function buildRootRule(source) {

package/dist/mcp/gateway.js

@@ -6,8 +6,8 @@ import { resolveRepoLocalBackendSpecs } from "./repo-local-backends.js";
 import { renderToolHiveVmcpInventory } from "./toolhive-vmcp.js";
 import { Effect } from "effect";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";

package/dist/moka-global-config.js

@@ -3,8 +3,8 @@ import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-s
 import "./config.js";
 import { z } from "zod";
 import { Effect } from "effect";
-import { join } from "node:path";
 import { homedir } from "node:os";
+import { join } from "node:path";
 //#region src/moka-global-config.ts
 const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
 const mokaSubmitGlobalConfigSchema = z.object({

package/dist/path-refs.js

@@ -1,5 +1,5 @@
-import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
 //#region src/path-refs.ts
 function resolveFileReference(basePath, pathRef) {
 	if (pathRef === "~") return homedir();

package/dist/pipeline-init.js

@@ -33,44 +33,61 @@ async function installDefaultSkills(cwd) {
 		throw new Error(`Failed to install default skills from ${DEFAULT_SKILL_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access for npx skills add and rerun \`moka init\`.`);
 	}
 }
-function installDefaultHooks() {
-	return installHooks({ force: true });
-}
 function hookInstallerFiles(result) {
 	return "items" in result ? result.items.map((item) => item.path) : result.files;
 }
 async function initPipelineProject(options = {}) {
 	const cwd = options.cwd ?? process.cwd();
-	const skillInstaller = options.skillInstaller ?? installDefaultSkills;
-	const hookInstaller = options.hookInstaller ?? installDefaultHooks;
-	const rulesInstaller = options.rulesInstaller ?? ((_target) => installRules({}));
-	await skillInstaller(cwd);
+	const { check, dryRun, force } = options;
+	const installerFlags = {
+		check,
+		dryRun,
+		force
+	};
+	if (!(check || dryRun)) await (options.skillInstaller ?? installDefaultSkills)(cwd);
 	const result = await installCommands({
 		cwd,
-		force: true,
-		host: "all"
+		host: "all",
+		...installerFlags
 	});
-	const hooks = await hookInstaller(cwd);
-	const rulesResult = await rulesInstaller(cwd);
+	const hooks = await (options.hookInstaller ?? (() => installHooks(installerFlags)))(cwd);
+	const rulesResult = await (options.rulesInstaller ?? (() => installRules(installerFlags)))(cwd);
 	return { files: [
 		...result.items.map((item) => item.path),
 		...hookInstallerFiles(hooks),
 		...rulesResult.items.map((item) => item.path)
 	] };
 }
-function refreshAgentHarnesses(options = {}) {
-	return initPipelineProject(options);
+const INIT_RESULT_COPY = {
+	install: {
+		headline: "Initialized package-owned pipeline support:",
+		fileVerb: "generated",
+		footer: "no repo-local pipeline config files were created"
+	},
+	check: {
+		headline: "Verified package-owned pipeline support is current:",
+		fileVerb: "current",
+		footer: "harness verified; no changes written"
+	},
+	dryRun: {
+		headline: "Planned package-owned pipeline support:",
+		fileVerb: "would generate",
+		footer: "dry run; no changes written"
+	}
+};
+function initResultMode(mode) {
+	if (mode.check) return "check";
+	if (mode.dryRun) return "dryRun";
+	return "install";
 }
-function formatPipelineInitResult(result) {
+function formatPipelineInitResult(result, mode = {}) {
+	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
-		"Initialized package-owned pipeline support:",
-		"installed the per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/rules; inherited by every repo with no per-repo copy",
-		...result.files.map((path) => `generated ${path}`),
-		"no repo-local pipeline config files were created"
+		copy.headline,
+		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/rules; inherited by every repo with no per-repo copy",
+		...result.files.map((path) => `${copy.fileVerb} ${path}`),
+		copy.footer
 	].join("\n");
 }
-function formatRefreshAgentHarnessesResult(result) {
-	return [formatPipelineInitResult(result), "global harness refreshed; no repo commit (per-machine install)"].join("\n");
-}
 //#endregion
-export { formatPipelineInitResult, formatRefreshAgentHarnessesResult, initPipelineProject, refreshAgentHarnesses };
+export { formatPipelineInitResult, initPipelineProject };

package/dist/run-state/git-refs.js

@@ -1,8 +1,8 @@
 import { GitPorcelainService, GitPorcelainServiceLive } from "../runtime/services/git-porcelain-service.js";
 import { Effect } from "effect";
 import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, resolve } from "node:path";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
 const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";

package/dist/run-state/opencode-accounts.js

@@ -0,0 +1,24 @@
+import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+//#region src/run-state/opencode-accounts.ts
+const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
+const STAGED_ACCOUNTS_FILE = join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json");
+const ACCOUNTS_FILE_NAME = "oc-codex-multi-auth-accounts.json";
+/**
+* Copy the staged codex-multi-auth accounts secret to the writable plugin path
+* so the plugin can persist rotated tokens. A no-op (copied: false) when no
+* staged secret is mounted — local dev, tests, and configs without the accounts
+* secret keep whatever account store already exists.
+*/
+function prepareOpencodeAccounts(options = {}) {
+	const stagedPath = options.stagedPath ?? STAGED_ACCOUNTS_FILE;
+	if (!existsSync(stagedPath)) return { copied: false };
+	const destPath = options.destPath ?? join(homedir(), ".opencode", ACCOUNTS_FILE_NAME);
+	mkdirSync(dirname(destPath), { recursive: true });
+	copyFileSync(stagedPath, destPath);
+	chmodSync(destPath, 384);
+	return { copied: true };
+}
+//#endregion
+export { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeAccounts };

package/dist/runner-command/run.js

@@ -100,6 +100,16 @@ function runRunnerCommandEffect(options, runtime) {
 			phase: "git.workspace.prepare",
 			status: "finish"
 		}, "git.workspace.prepare finish");
+		logger.info({
+			phase: "opencode.accounts.prepare",
+			status: "start"
+		}, "opencode.accounts.prepare start");
+		const accountsPrep = yield* io.prepareOpencodeAccounts();
+		logger.info({
+			copied: accountsPrep.copied,
+			phase: "opencode.accounts.prepare",
+			status: "finish"
+		}, "opencode.accounts.prepare finish");
 		logger.info({
 			phase: "config.load",
 			status: "start"

package/dist/runner.js

@@ -1,7 +1,7 @@
 import { Data } from "effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 //#region src/runner.ts
 var RunnerCapabilityError = class extends Data.TaggedError("RunnerCapabilityError") {
 	constructor(message) {

package/dist/runtime/hooks/hooks.js

@@ -8,8 +8,8 @@ import { CommandExecutor, CommandExecutorLive } from "../services/command-execut
 import { parseHookResult } from "../../hooks.js";
 import { Effect } from "effect";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/runtime/hooks/hooks.ts
 async function dispatchHooks(context, event, failure, node, gateId) {

package/dist/runtime/opencode-session-executor.js

@@ -310,10 +310,58 @@ function describeMessageError(error) {
 	const detail = data && typeof data.message === "string" ? `: ${data.message}` : "";
 	return `${error.name}${detail}`;
 }
-function unwrap(response) {
-	if (response.error) throw new Error(typeof response.error === "string" ? response.error : JSON.stringify(response.error));
-	if (response.data === void 0) throw new Error("opencode response contained no data");
-	return response.data;
+function unwrap(result) {
+	if (result.error) throw new Error(resultErrorMessage(result));
+	if (result.data === void 0) throw new Error(`opencode response contained no data${httpContext(result)}`);
+	return result.data;
+}
+/**
+* Build the richest available message for a failed opencode result tuple. The
+* runner reads the result-tuple path (not throwOnError), so the SDK leaves
+* `error` as the raw parsed body — which for a 5xx/timeout is an empty `{}` that
+* stringifies to nothing useful. Walk an ordered precedence (body message →
+* raw string → non-empty JSON body → HTTP status line) so a gateway timeout
+* surfaces as "POST …/prompt → 504 Gateway Timeout" instead of "{}". Mirrors the
+* SDK's own error-interceptor describe().
+*/
+function resultErrorMessage(result) {
+	const detail = errorDetail(result.error);
+	if (detail) return `${detail}${httpContext(result)}`;
+	return httpStatusLine(result) ?? "opencode error with empty response body";
+}
+function errorDetail(error) {
+	return bodyMessage(error) ?? nonEmptyString(error) ?? nonEmptyJson(error);
+}
+function bodyMessage(error) {
+	if (!isRecord(error)) return;
+	return stringField(error.data, "message") ?? stringField(error, "message") ?? stringField(error, "name");
+}
+function nonEmptyString(error) {
+	return typeof error === "string" && error.length > 0 ? error : void 0;
+}
+function nonEmptyJson(error) {
+	if (error === void 0) return;
+	const json = JSON.stringify(error);
+	return json && json !== "{}" ? json : void 0;
+}
+function httpContext(result) {
+	const status = httpStatusLine(result);
+	return status ? ` (${status})` : "";
+}
+function httpStatusLine(result) {
+	const status = result.response?.status;
+	const { request } = result;
+	if (!(request?.method || request?.url || status)) return;
+	return `${requestTarget(request)}${statusSuffix(status)}`;
+}
+function requestTarget(request) {
+	return `${request?.method ?? "?"} ${request?.url ?? "?"}`;
+}
+function statusSuffix(status) {
+	return status ? ` → HTTP ${status}` : "";
+}
+function stringField(value, field) {
+	if (isRecord(value) && typeof value[field] === "string" && value[field]) return value[field];
 }
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);

package/dist/runtime/services/runner-command-io-service.js

@@ -1,3 +1,4 @@
+import { prepareOpencodeAccounts } from "../../run-state/opencode-accounts.js";
 import { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef } from "../../run-state/git-refs.js";
 import { runScheduledWorkflowTask } from "../../pipeline-runtime.js";
 import { resolveRunnerEventSinkAuthToken } from "../../runner-command-contract.js";
@@ -45,6 +46,10 @@ const RunnerCommandIoServiceLive = Layer.succeed(RunnerCommandIoService, {
 		try: () => mergeDependencyRefs(options),
 		catch: (error) => error
 	}),
+	prepareOpencodeAccounts: () => Effect.try({
+		try: () => prepareOpencodeAccounts(),
+		catch: (error) => error
+	}),
 	prepareRunnerGitWorkspace: (payload, options) => Effect.tryPromise({
 		try: () => prepareRunnerGitWorkspace(payload, options),
 		catch: (error) => error

package/docs/config-architecture.md

@@ -164,9 +164,9 @@ Project-authored skill and rule paths resolve from the project root and must
 exist for runtime use. If default skill files are missing, run `moka init` to
 install them before executing workflows.
 
-Default agent hooks are copied by `moka init` and `moka install-hooks` from the
-private `oisin-ee/agent-hooks` repository. That source repository has one
-canonical host-level layout:
+Default agent hooks are copied by `moka init` from the private
+`oisin-ee/agent-hooks` repository. That source repository has one canonical
+host-level layout:
 
 ```text
 claude-code/
@@ -215,7 +215,7 @@ OpenCode host resources are generated from the same profile registry:
 - `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
   generates agents, commands, plugins, and project config.
 - Additional manually authored OpenCode hook plugins can be copied from
-  `oisin-ee/agent-hooks/opencode/` by `moka install-hooks`.
+  `oisin-ee/agent-hooks/opencode/` by `moka init`.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and
@@ -455,8 +455,8 @@ rather than re-emitting it into every project.
 
 ## Troubleshooting
 
-- Missing host resources: run `moka install-commands`; `moka run` loads the
-  installed package config.
+- Missing host resources: run `moka init`; `moka run` loads the installed
+  package config.
 - Capability error: reduce the profile grants or choose a runner whose declared
   capabilities include the requested tools, filesystem, network, output, rules,
   skills, or MCP access.

package/docs/mcp-gateway.md

@@ -94,7 +94,7 @@ contains only `pipeline-gateway`.
 OpenCode receives that gateway through `.opencode/opencode.json` alongside the
 package-owned runtime projection: `lsp: true`, pinned plugin entries, generated
 agents, projected skills, explicit permissions, and local TypeScript plugins.
-`moka init` and `moka install-commands` merge this OpenCode project config:
+`moka init` merges this OpenCode project config:
 existing repo-local plugin entries are preserved while missing package defaults
 such as `oc-codex-multi-auth` are appended. Existing `mcp.pipeline-gateway`
 settings are also preserved; use `moka mcp gateway configure-host` when the
@@ -116,8 +116,8 @@ Qdrant, Fallow, Serena, or Backlog declarations. Use
 health, required `tools/list` prefixes, local ToolHive availability for local
 mode, and legacy direct MCP entries. Use `moka init` to install generated
 OpenCode and Claude Code host surfaces with the singleton `pipeline-gateway`
-remote entry. Use `moka install-commands --host all` to refresh generated host
-files after package upgrades, and use
+remote entry, and `moka init --check` to verify generated host files are current
+after package upgrades. Use
 `moka mcp gateway configure-host` as an explicit migration or repair command
 when existing host MCP config must be rewritten with a backup. The hosted gateway
 requires `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to be set in the OpenCode

package/docs/operator-guide.md

@@ -175,54 +175,29 @@ OpenBao, publish Secret values, or mutate ESO resources from this package.
 
 `moka init`
 
-Installs the package's default skills, generated host resources, and copied
-agent hooks from the private `oisin-ee/agent-hooks` repository. OpenCode is the
-package default runtime. `moka init` does not create repo-local `.pipeline`
-config files.
+Installs or refreshes the whole per-machine harness in one command: the
+package's default skills, generated host-native command surfaces and MCP
+entries, copied agent hooks from the private `oisin-ee/agent-hooks` repository,
+and global instruction files generated via rulesync from `oisin-ee/rules`.
+OpenCode is the package default runtime. The harness is always installed
+globally (`~/.claude`, `~/.config/opencode`, `~/.codex`); there is no `--scope`.
+`moka init` does not create repo-local `.pipeline` config files.
 
 ```shell
-moka init
+moka init             # install or refresh everything
+moka init --check     # verify the generated harness is current; fail if stale
+moka init --dry-run   # show planned changes without writing
+moka init --force     # overwrite manually edited harness files
 ```
 
-`moka install-commands`
-
-Refreshes or checks generated host-native command surfaces and MCP entries after
-package upgrades or manual edits. Initial setup should use `moka init`.
-
-```shell
-moka install-commands --host opencode --dry-run
-moka install-commands --host all --force
-```
-
-Host choices are `all` and `opencode`.
-
-`moka install-hooks`
-
-Copies manually authored hook files from the private `oisin-ee/agent-hooks`
-repository into the selected harness scope. The hook source repository has only
-host folders: `claude-code/`, `codex/`, and `opencode/`. Install scope controls
-the destination; it is not represented in the source repository.
-
-```shell
-moka install-hooks --scope global --check
-moka install-hooks --scope project --force
-```
-
-There is no source override flag and no symlink mode. Moka clones
+`--check` and `--dry-run` write nothing and skip the network skill install.
+By default `moka init` refuses to overwrite manually edited hook or command
+files; `--force` overwrites them. For agent hooks, Moka clones
 `oisin-ee/agent-hooks`, copies files, and tracks installed hashes so later runs
-can update unchanged owned files, delete removed owned files, and refuse to
-overwrite manually edited hook files unless `--force` is supplied.
-
-`moka refresh-harnesses`
-
-Force-refreshes package-owned skills, generated agent harnesses, and copied hook
-files, stages only owned harness/resource paths, and commits them with
-`--no-verify`. The default commit message is `chore: update agent harnesses`.
-
-```shell
-moka refresh-harnesses
-moka refresh-harnesses --message "chore: refresh moka harnesses"
-```
+update unchanged owned files, delete removed owned files, and (without `--force`)
+refuse to clobber manual edits. The hook source repository has only host folders
+(`claude-code/`, `codex/`, `opencode/`); there is no source override flag and no
+symlink mode.
 
 Use `PIPELINE_TARGET_PATH=/path/to/repo` when invoking `moka` from outside the
 target worktree.
@@ -399,7 +374,7 @@ OpenCode:    /moka-quick, /moka-execute, /moka-inspect
 Claude Code: /moka-quick, /moka-execute, /moka-inspect
 ```
 
-`moka init` and `moka install-commands --host opencode` generate:
+`moka init` generates, for OpenCode:
 
 - `.opencode/commands/moka-<entrypoint>.md` for `/moka-quick`, `/moka-execute`, and `/moka-inspect`
 - `.opencode/agents/*.md` for primary and subagent profiles with explicit
@@ -409,13 +384,12 @@ Claude Code: /moka-quick, /moka-execute, /moka-inspect
 - `.opencode/opencode.json` with LSP, the singleton `pipeline-gateway` MCP
   server, and pinned package-selected plugins
 
-`moka init` and `moka install-hooks` also copy hook files from
-`oisin-ee/agent-hooks` by overlaying `opencode/`, `claude-code/`, and `codex/`
-onto the selected host config roots. Hook files are authored in the hook repo,
-not generated by Moka.
+`moka init` also copies hook files from `oisin-ee/agent-hooks` by overlaying
+`opencode/`, `claude-code/`, and `codex/` onto the host config roots. Hook files
+are authored in the hook repo, not generated by Moka.
 
-`moka install-commands --host claude-code` generates `.claude/commands/moka-<entrypoint>.md`
-slash commands for Claude Code.
+For Claude Code, `moka init` generates `.claude/commands/moka-<entrypoint>.md`
+slash commands.
 
 Package defaults select OpenCode for built-in profiles and runner-command
 orchestration. Codex is not a supported runtime host.
@@ -554,7 +528,7 @@ After changing profile grants or registries, check all three surfaces:
 ```shell
 moka validate --strict
 moka explain-plan --workflow <workflow-id>
-moka install-commands --host all --check
+moka init --check
 ```
 
 ## Runner Image Verification

package/docs/slash-command-adapter-contract.md

@@ -8,7 +8,7 @@ Install generated resources during setup, then check drift with:
 
 ```sh
 moka init
-moka install-commands --host all --check
+moka init --check
 ```
 
 ## Host Mappings

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.15",
+  "version": "3.11.17",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",