@oisincoveney/pipeline 3.11.17 → 3.11.18

package/dist/argo-workflow.js

@@ -1,5 +1,5 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
+import { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -303,10 +303,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.local/share/opencode/auth.json",
+			mountPath: OPENCODE_AUTH_STAGING_DIR,
 			name: "opencode-auth",
-			readOnly: true,
-			subPath: "auth.json"
+			readOnly: true
 		});
 	}
 	if (options.opencodeOpenaiAccountsSecret) {

package/dist/hooks.d.ts

@@ -13,8 +13,8 @@ declare const hookResultSchema: z.ZodObject<{
     taskContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
   }, z.core.$strict>>;
   status: z.ZodEnum<{
-    fail: "fail";
     pass: "pass";
+    fail: "fail";
     skip: "skip";
   }>;
   summary: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -207,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/run-state/opencode-accounts.js

@@ -1,24 +1,42 @@
 import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 //#region src/run-state/opencode-accounts.ts
 const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
-const STAGED_ACCOUNTS_FILE = join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json");
-const ACCOUNTS_FILE_NAME = "oc-codex-multi-auth-accounts.json";
+const OPENCODE_AUTH_STAGING_DIR = "/etc/pipeline/opencode-auth";
+const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
+	destFromHome: [".opencode", "oc-codex-multi-auth-accounts.json"],
+	stagedPath: join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json")
+}, {
+	destFromHome: [
+		".local",
+		"share",
+		"opencode",
+		"auth.json"
+	],
+	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, "auth.json")
+}];
 /**
-* Copy the staged codex-multi-auth accounts secret to the writable plugin path
-* so the plugin can persist rotated tokens. A no-op (copied: false) when no
-* staged secret is mounted — local dev, tests, and configs without the accounts
-* secret keep whatever account store already exists.
+* Copy each staged opencode credential secret to its writable live path so the
+* plugin can rewrite tokens. Only files whose staged source exists are copied
+* (local dev / tests / configs without a given secret keep whatever store is
+* already present). Returns the basenames copied, for run-log evidence.
 */
-function prepareOpencodeAccounts(options = {}) {
-	const stagedPath = options.stagedPath ?? STAGED_ACCOUNTS_FILE;
-	if (!existsSync(stagedPath)) return { copied: false };
-	const destPath = options.destPath ?? join(homedir(), ".opencode", ACCOUNTS_FILE_NAME);
-	mkdirSync(dirname(destPath), { recursive: true });
-	copyFileSync(stagedPath, destPath);
-	chmodSync(destPath, 384);
-	return { copied: true };
+function prepareOpencodeCredentials(options = {}) {
+	const home = homedir();
+	const files = options.files ?? WRITABLE_OPENCODE_CREDENTIAL_FILES.map((file) => ({
+		destPath: join(home, ...file.destFromHome),
+		stagedPath: file.stagedPath
+	}));
+	const copied = [];
+	for (const { stagedPath, destPath } of files) {
+		if (!existsSync(stagedPath)) continue;
+		mkdirSync(dirname(destPath), { recursive: true });
+		copyFileSync(stagedPath, destPath);
+		chmodSync(destPath, 384);
+		copied.push(basename(destPath));
+	}
+	return { copied };
 }
 //#endregion
-export { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeAccounts };
+export { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeCredentials };

package/dist/runner-command/run.js

@@ -101,15 +101,15 @@ function runRunnerCommandEffect(options, runtime) {
 			status: "finish"
 		}, "git.workspace.prepare finish");
 		logger.info({
-			phase: "opencode.accounts.prepare",
+			phase: "opencode.credentials.prepare",
 			status: "start"
-		}, "opencode.accounts.prepare start");
-		const accountsPrep = yield* io.prepareOpencodeAccounts();
+		}, "opencode.credentials.prepare start");
+		const credentialsPrep = yield* io.prepareOpencodeCredentials();
 		logger.info({
-			copied: accountsPrep.copied,
-			phase: "opencode.accounts.prepare",
+			copied: credentialsPrep.copied,
+			phase: "opencode.credentials.prepare",
 			status: "finish"
-		}, "opencode.accounts.prepare finish");
+		}, "opencode.credentials.prepare finish");
 		logger.info({
 			phase: "config.load",
 			status: "start"

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -108,8 +108,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     nodeId: z.ZodOptional<z.ZodString>;
     outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     status: z.ZodEnum<{
-      fail: "fail";
       pass: "pass";
+      fail: "fail";
       skip: "skip";
     }>;
     summary: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;
@@ -286,8 +286,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       nodeId: z.ZodOptional<z.ZodString>;
       outputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       status: z.ZodEnum<{
-        fail: "fail";
         pass: "pass";
+        fail: "fail";
         skip: "skip";
       }>;
       summary: z.ZodOptional<z.ZodString>;

package/dist/runtime/services/runner-command-io-service.js

@@ -1,4 +1,4 @@
-import { prepareOpencodeAccounts } from "../../run-state/opencode-accounts.js";
+import { prepareOpencodeCredentials } from "../../run-state/opencode-accounts.js";
 import { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef } from "../../run-state/git-refs.js";
 import { runScheduledWorkflowTask } from "../../pipeline-runtime.js";
 import { resolveRunnerEventSinkAuthToken } from "../../runner-command-contract.js";
@@ -46,8 +46,8 @@ const RunnerCommandIoServiceLive = Layer.succeed(RunnerCommandIoService, {
 		try: () => mergeDependencyRefs(options),
 		catch: (error) => error
 	}),
-	prepareOpencodeAccounts: () => Effect.try({
-		try: () => prepareOpencodeAccounts(),
+	prepareOpencodeCredentials: () => Effect.try({
+		try: () => prepareOpencodeCredentials(),
 		catch: (error) => error
 	}),
 	prepareRunnerGitWorkspace: (payload, options) => Effect.tryPromise({

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.17",
+  "version": "3.11.18",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",