@oisincoveney/pipeline 3.11.16 → 3.11.18

package/dist/argo-workflow.js

@@ -1,4 +1,5 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
+import { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -302,10 +303,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.local/share/opencode/auth.json",
+			mountPath: OPENCODE_AUTH_STAGING_DIR,
 			name: "opencode-auth",
-			readOnly: true,
-			subPath: "auth.json"
+			readOnly: true
 		});
 	}
 	if (options.opencodeOpenaiAccountsSecret) {
@@ -322,10 +322,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			mountPath: OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR,
 			name: "opencode-openai-accounts",
-			readOnly: true,
-			subPath: "accounts.json"
+			readOnly: true
 		});
 	}
 	if (options.gitCredentialsSecretName) {

package/dist/cli/doctor.js

@@ -5,8 +5,8 @@ import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
 const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);

package/dist/codex-auth-sync.js

@@ -1,7 +1,7 @@
 import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { parse } from "jsonc-parser";
 //#region src/codex-auth-sync.ts
 const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";

package/dist/config/schemas.d.ts

@@ -233,8 +233,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -262,8 +262,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -306,10 +306,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -385,10 +385,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/gates.js

@@ -1,7 +1,7 @@
 import "./safe-json.js";
 import { existsSync } from "node:fs";
-import "execa";
 import { join } from "node:path";
+import "execa";
 import "package-manager-detector/commands";
 import "package-manager-detector/detect";
 //#region src/gates.ts

package/dist/install-commands/shared.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/install-commands/shared.ts
 const GENERATED_MARKER = "<!-- Generated by @oisincoveney/pipeline. -->";
 const GENERATED_TS_MARKER = "// Generated by @oisincoveney/pipeline.";

package/dist/install-hooks.js

@@ -1,9 +1,9 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { execa } from "execa";
-import { dirname, join, relative } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { execa } from "execa";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-hooks.ts

package/dist/install-rules.js

@@ -1,6 +1,6 @@
-import { execa } from "execa";
-import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { execa } from "execa";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
 const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";

package/dist/mcp/gateway.js

@@ -6,8 +6,8 @@ import { resolveRepoLocalBackendSpecs } from "./repo-local-backends.js";
 import { renderToolHiveVmcpInventory } from "./toolhive-vmcp.js";
 import { Effect } from "effect";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";

package/dist/moka-global-config.js

@@ -3,8 +3,8 @@ import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-s
 import "./config.js";
 import { z } from "zod";
 import { Effect } from "effect";
-import { join } from "node:path";
 import { homedir } from "node:os";
+import { join } from "node:path";
 //#region src/moka-global-config.ts
 const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
 const mokaSubmitGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -207,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/path-refs.js

@@ -1,5 +1,5 @@
-import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
 //#region src/path-refs.ts
 function resolveFileReference(basePath, pathRef) {
 	if (pathRef === "~") return homedir();

package/dist/run-state/git-refs.js

@@ -1,8 +1,8 @@
 import { GitPorcelainService, GitPorcelainServiceLive } from "../runtime/services/git-porcelain-service.js";
 import { Effect } from "effect";
 import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { dirname, resolve } from "node:path";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
 const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";

package/dist/run-state/opencode-accounts.js

@@ -0,0 +1,42 @@
+import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+//#region src/run-state/opencode-accounts.ts
+const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
+const OPENCODE_AUTH_STAGING_DIR = "/etc/pipeline/opencode-auth";
+const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
+	destFromHome: [".opencode", "oc-codex-multi-auth-accounts.json"],
+	stagedPath: join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json")
+}, {
+	destFromHome: [
+		".local",
+		"share",
+		"opencode",
+		"auth.json"
+	],
+	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, "auth.json")
+}];
+/**
+* Copy each staged opencode credential secret to its writable live path so the
+* plugin can rewrite tokens. Only files whose staged source exists are copied
+* (local dev / tests / configs without a given secret keep whatever store is
+* already present). Returns the basenames copied, for run-log evidence.
+*/
+function prepareOpencodeCredentials(options = {}) {
+	const home = homedir();
+	const files = options.files ?? WRITABLE_OPENCODE_CREDENTIAL_FILES.map((file) => ({
+		destPath: join(home, ...file.destFromHome),
+		stagedPath: file.stagedPath
+	}));
+	const copied = [];
+	for (const { stagedPath, destPath } of files) {
+		if (!existsSync(stagedPath)) continue;
+		mkdirSync(dirname(destPath), { recursive: true });
+		copyFileSync(stagedPath, destPath);
+		chmodSync(destPath, 384);
+		copied.push(basename(destPath));
+	}
+	return { copied };
+}
+//#endregion
+export { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeCredentials };

package/dist/runner-command/run.js

@@ -100,6 +100,16 @@ function runRunnerCommandEffect(options, runtime) {
 			phase: "git.workspace.prepare",
 			status: "finish"
 		}, "git.workspace.prepare finish");
+		logger.info({
+			phase: "opencode.credentials.prepare",
+			status: "start"
+		}, "opencode.credentials.prepare start");
+		const credentialsPrep = yield* io.prepareOpencodeCredentials();
+		logger.info({
+			copied: credentialsPrep.copied,
+			phase: "opencode.credentials.prepare",
+			status: "finish"
+		}, "opencode.credentials.prepare finish");
 		logger.info({
 			phase: "config.load",
 			status: "start"

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runner.js

@@ -1,7 +1,7 @@
 import { Data } from "effect";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { execa } from "execa";
 import { join } from "node:path";
+import { execa } from "execa";
 //#region src/runner.ts
 var RunnerCapabilityError = class extends Data.TaggedError("RunnerCapabilityError") {
 	constructor(message) {

package/dist/runtime/hooks/hooks.js

@@ -8,8 +8,8 @@ import { CommandExecutor, CommandExecutorLive } from "../services/command-execut
 import { parseHookResult } from "../../hooks.js";
 import { Effect } from "effect";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/runtime/hooks/hooks.ts
 async function dispatchHooks(context, event, failure, node, gateId) {

package/dist/runtime/services/runner-command-io-service.js

@@ -1,3 +1,4 @@
+import { prepareOpencodeCredentials } from "../../run-state/opencode-accounts.js";
 import { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef } from "../../run-state/git-refs.js";
 import { runScheduledWorkflowTask } from "../../pipeline-runtime.js";
 import { resolveRunnerEventSinkAuthToken } from "../../runner-command-contract.js";
@@ -45,6 +46,10 @@ const RunnerCommandIoServiceLive = Layer.succeed(RunnerCommandIoService, {
 		try: () => mergeDependencyRefs(options),
 		catch: (error) => error
 	}),
+	prepareOpencodeCredentials: () => Effect.try({
+		try: () => prepareOpencodeCredentials(),
+		catch: (error) => error
+	}),
 	prepareRunnerGitWorkspace: (payload, options) => Effect.tryPromise({
 		try: () => prepareRunnerGitWorkspace(payload, options),
 		catch: (error) => error

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.16",
+  "version": "3.11.18",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",