@oisincoveney/pipeline 3.11.16 → 3.11.17

package/dist/argo-workflow.js

@@ -1,4 +1,5 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
+import { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -322,10 +323,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			mountPath: OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR,
 			name: "opencode-openai-accounts",
-			readOnly: true,
-			subPath: "accounts.json"
+			readOnly: true
 		});
 	}
 	if (options.gitCredentialsSecretName) {

package/dist/cli/doctor.js

@@ -5,8 +5,8 @@ import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
 const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);

package/dist/codex-auth-sync.js

@@ -1,7 +1,7 @@
 import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { parse } from "jsonc-parser";
 //#region src/codex-auth-sync.ts
 const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";

package/dist/config/schemas.d.ts

@@ -233,8 +233,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -262,8 +262,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -306,10 +306,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -385,10 +385,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/gates.js

@@ -1,7 +1,7 @@
 import "./safe-json.js";
 import { existsSync } from "node:fs";
-import "execa";
 import { join } from "node:path";
+import "execa";
 import "package-manager-detector/commands";
 import "package-manager-detector/detect";
 //#region src/gates.ts

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    pass: "pass";
     fail: "fail";
+    pass: "pass";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/install-commands/shared.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/install-commands/shared.ts
 const GENERATED_MARKER = "<!-- Generated by @oisincoveney/pipeline. -->";
 const GENERATED_TS_MARKER = "// Generated by @oisincoveney/pipeline.";

package/dist/install-hooks.js

@@ -1,9 +1,9 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { execa } from "execa";
-import { dirname, join, relative } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { execa } from "execa";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-hooks.ts

package/dist/install-rules.js

@@ -1,6 +1,6 @@
-import { execa } from "execa";
-import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { execa } from "execa";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
 const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";

package/dist/mcp/gateway.js

@@ -6,8 +6,8 @@ import { resolveRepoLocalBackendSpecs } from "./repo-local-backends.js";
 import { renderToolHiveVmcpInventory } from "./toolhive-vmcp.js";
 import { Effect } from "effect";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";

package/dist/moka-global-config.js

@@ -3,8 +3,8 @@ import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-s
 import "./config.js";
 import { z } from "zod";
 import { Effect } from "effect";
-import { join } from "node:path";
 import { homedir } from "node:os";
+import { join } from "node:path";
 //#region src/moka-global-config.ts
 const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
 const mokaSubmitGlobalConfigSchema = z.object({

package/dist/path-refs.js

@@ -1,5 +1,5 @@
-import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
 //#region src/path-refs.ts
 function resolveFileReference(basePath, pathRef) {
 	if (pathRef === "~") return homedir();

package/dist/run-state/git-refs.js

@@ -1,8 +1,8 @@
 import { GitPorcelainService, GitPorcelainServiceLive } from "../runtime/services/git-porcelain-service.js";
 import { Effect } from "effect";
 import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, resolve } from "node:path";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
 const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";

package/dist/run-state/opencode-accounts.js

@@ -0,0 +1,24 @@
+import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+//#region src/run-state/opencode-accounts.ts
+const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
+const STAGED_ACCOUNTS_FILE = join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json");
+const ACCOUNTS_FILE_NAME = "oc-codex-multi-auth-accounts.json";
+/**
+* Copy the staged codex-multi-auth accounts secret to the writable plugin path
+* so the plugin can persist rotated tokens. A no-op (copied: false) when no
+* staged secret is mounted — local dev, tests, and configs without the accounts
+* secret keep whatever account store already exists.
+*/
+function prepareOpencodeAccounts(options = {}) {
+	const stagedPath = options.stagedPath ?? STAGED_ACCOUNTS_FILE;
+	if (!existsSync(stagedPath)) return { copied: false };
+	const destPath = options.destPath ?? join(homedir(), ".opencode", ACCOUNTS_FILE_NAME);
+	mkdirSync(dirname(destPath), { recursive: true });
+	copyFileSync(stagedPath, destPath);
+	chmodSync(destPath, 384);
+	return { copied: true };
+}
+//#endregion
+export { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeAccounts };

package/dist/runner-command/run.js

@@ -100,6 +100,16 @@ function runRunnerCommandEffect(options, runtime) {
 			phase: "git.workspace.prepare",
 			status: "finish"
 		}, "git.workspace.prepare finish");
+		logger.info({
+			phase: "opencode.accounts.prepare",
+			status: "start"
+		}, "opencode.accounts.prepare start");
+		const accountsPrep = yield* io.prepareOpencodeAccounts();
+		logger.info({
+			copied: accountsPrep.copied,
+			phase: "opencode.accounts.prepare",
+			status: "finish"
+		}, "opencode.accounts.prepare finish");
 		logger.info({
 			phase: "config.load",
 			status: "start"

package/dist/runner-event-schema.d.ts

@@ -108,8 +108,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     nodeId: z.ZodOptional<z.ZodString>;
     outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     status: z.ZodEnum<{
-      pass: "pass";
       fail: "fail";
+      pass: "pass";
       skip: "skip";
     }>;
     summary: z.ZodOptional<z.ZodString>;
@@ -286,8 +286,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       nodeId: z.ZodOptional<z.ZodString>;
       outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       status: z.ZodEnum<{
-        pass: "pass";
         fail: "fail";
+        pass: "pass";
         skip: "skip";
       }>;
       summary: z.ZodOptional<z.ZodString>;

package/dist/runner.js

@@ -1,7 +1,7 @@
 import { Data } from "effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 //#region src/runner.ts
 var RunnerCapabilityError = class extends Data.TaggedError("RunnerCapabilityError") {
 	constructor(message) {

package/dist/runtime/hooks/hooks.js

@@ -8,8 +8,8 @@ import { CommandExecutor, CommandExecutorLive } from "../services/command-execut
 import { parseHookResult } from "../../hooks.js";
 import { Effect } from "effect";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/runtime/hooks/hooks.ts
 async function dispatchHooks(context, event, failure, node, gateId) {

package/dist/runtime/services/runner-command-io-service.js

@@ -1,3 +1,4 @@
+import { prepareOpencodeAccounts } from "../../run-state/opencode-accounts.js";
 import { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef } from "../../run-state/git-refs.js";
 import { runScheduledWorkflowTask } from "../../pipeline-runtime.js";
 import { resolveRunnerEventSinkAuthToken } from "../../runner-command-contract.js";
@@ -45,6 +46,10 @@ const RunnerCommandIoServiceLive = Layer.succeed(RunnerCommandIoService, {
 		try: () => mergeDependencyRefs(options),
 		catch: (error) => error
 	}),
+	prepareOpencodeAccounts: () => Effect.try({
+		try: () => prepareOpencodeAccounts(),
+		catch: (error) => error
+	}),
 	prepareRunnerGitWorkspace: (payload, options) => Effect.tryPromise({
 		try: () => prepareRunnerGitWorkspace(payload, options),
 		catch: (error) => error

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.16",
+  "version": "3.11.17",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",