@oisincoveney/pipeline 3.11.17 → 3.11.19

package/dist/argo-workflow.js

@@ -1,5 +1,5 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
+import { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -303,10 +303,9 @@ function runnerWorkflowStorage(options, tasks) {
 			}
 		});
 		volumeMounts.push({
-			mountPath: "/root/.local/share/opencode/auth.json",
+			mountPath: OPENCODE_AUTH_STAGING_DIR,
 			name: "opencode-auth",
-			readOnly: true,
-			subPath: "auth.json"
+			readOnly: true
 		});
 	}
 	if (options.opencodeOpenaiAccountsSecret) {

package/dist/config/schemas.d.ts

@@ -509,8 +509,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      quick: "quick";
       execute: "execute";
+      quick: "quick";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.d.ts

@@ -161,8 +161,8 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
   schedulePath: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodOptional<z.ZodString>;

package/dist/run-state/opencode-accounts.js

@@ -1,24 +1,92 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { isRecord } from "../safe-json.js";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 //#region src/run-state/opencode-accounts.ts
 const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
-const STAGED_ACCOUNTS_FILE = join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json");
+const OPENCODE_AUTH_STAGING_DIR = "/etc/pipeline/opencode-auth";
 const ACCOUNTS_FILE_NAME = "oc-codex-multi-auth-accounts.json";
+const AUTH_FILE_NAME = "auth.json";
+const HOST_OPENAI_PROVIDER = "openai";
+const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
+	destFromHome: [".opencode", ACCOUNTS_FILE_NAME],
+	stagedPath: join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json")
+}, {
+	destFromHome: [
+		".local",
+		"share",
+		"opencode",
+		AUTH_FILE_NAME
+	],
+	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, AUTH_FILE_NAME)
+}];
 /**
-* Copy the staged codex-multi-auth accounts secret to the writable plugin path
-* so the plugin can persist rotated tokens. A no-op (copied: false) when no
-* staged secret is mounted — local dev, tests, and configs without the accounts
-* secret keep whatever account store already exists.
+* Copy each staged opencode credential secret to its writable live path, then
+* sync the account pool's active openai token into auth.json's openai entry.
+* Only files whose staged source exists are copied (local dev / tests / configs
+* without a given secret keep whatever store is already present).
 */
-function prepareOpencodeAccounts(options = {}) {
-	const stagedPath = options.stagedPath ?? STAGED_ACCOUNTS_FILE;
-	if (!existsSync(stagedPath)) return { copied: false };
-	const destPath = options.destPath ?? join(homedir(), ".opencode", ACCOUNTS_FILE_NAME);
-	mkdirSync(dirname(destPath), { recursive: true });
-	copyFileSync(stagedPath, destPath);
-	chmodSync(destPath, 384);
-	return { copied: true };
+function prepareOpencodeCredentials(options = {}) {
+	const home = homedir();
+	const files = options.files ?? WRITABLE_OPENCODE_CREDENTIAL_FILES.map((file) => ({
+		destPath: join(home, ...file.destFromHome),
+		stagedPath: file.stagedPath
+	}));
+	const copied = [];
+	for (const { stagedPath, destPath } of files) {
+		if (!existsSync(stagedPath)) continue;
+		mkdirSync(dirname(destPath), { recursive: true });
+		copyFileSync(stagedPath, destPath);
+		chmodSync(destPath, 384);
+		copied.push(basename(destPath));
+	}
+	const accountsPath = files.find((file) => basename(file.destPath) === ACCOUNTS_FILE_NAME)?.destPath;
+	const authPath = files.find((file) => basename(file.destPath) === AUTH_FILE_NAME)?.destPath;
+	return {
+		copied,
+		hostOpenaiTokenSynced: accountsPath !== void 0 && authPath !== void 0 && syncHostOpenaiToken(accountsPath, authPath)
+	};
+}
+function activeAccountOAuth(accountsRaw) {
+	if (!isRecord(accountsRaw)) return;
+	const accounts = accountsRaw.accounts;
+	if (!Array.isArray(accounts)) return;
+	const account = accounts[activeAccountIndex(accountsRaw)] ?? accounts[0];
+	return isRecord(account) ? oauthFromAccount(account) : void 0;
+}
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function oauthFromAccount(account) {
+	const { accessToken, refreshToken, expiresAt } = account;
+	if (nonEmptyString(accessToken) && nonEmptyString(refreshToken) && typeof expiresAt === "number") return {
+		access: accessToken,
+		expires: expiresAt,
+		refresh: refreshToken
+	};
+}
+function activeAccountIndex(accountsRaw) {
+	const byFamily = accountsRaw.activeIndexByFamily;
+	if (isRecord(byFamily) && typeof byFamily.codex === "number") return byFamily.codex;
+	return typeof accountsRaw.activeIndex === "number" ? accountsRaw.activeIndex : 0;
+}
+function syncHostOpenaiToken(accountsPath, authPath) {
+	if (!(existsSync(accountsPath) && existsSync(authPath))) return false;
+	const token = activeAccountOAuth(JSON.parse(readFileSync(accountsPath, "utf8")));
+	if (!token) return false;
+	const auth = JSON.parse(readFileSync(authPath, "utf8"));
+	if (!isRecord(auth)) return false;
+	const next = {
+		...auth,
+		[HOST_OPENAI_PROVIDER]: {
+			access: token.access,
+			expires: token.expires,
+			refresh: token.refresh,
+			type: "oauth"
+		}
+	};
+	writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 384 });
+	return true;
 }
 //#endregion
-export { OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeAccounts };
+export { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeCredentials };

package/dist/runner-command/run.js

@@ -101,15 +101,16 @@ function runRunnerCommandEffect(options, runtime) {
 			status: "finish"
 		}, "git.workspace.prepare finish");
 		logger.info({
-			phase: "opencode.accounts.prepare",
+			phase: "opencode.credentials.prepare",
 			status: "start"
-		}, "opencode.accounts.prepare start");
-		const accountsPrep = yield* io.prepareOpencodeAccounts();
+		}, "opencode.credentials.prepare start");
+		const credentialsPrep = yield* io.prepareOpencodeCredentials();
 		logger.info({
-			copied: accountsPrep.copied,
-			phase: "opencode.accounts.prepare",
+			copied: credentialsPrep.copied,
+			hostOpenaiTokenSynced: credentialsPrep.hostOpenaiTokenSynced,
+			phase: "opencode.credentials.prepare",
 			status: "finish"
-		}, "opencode.accounts.prepare finish");
+		}, "opencode.credentials.prepare finish");
 		logger.info({
 			phase: "config.load",
 			status: "start"

package/dist/runner-command-contract.d.ts

@@ -43,8 +43,8 @@ declare const runnerDeliverySchema: z.ZodObject<{
 declare const mokaSubmissionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kind: z.ZodLiteral<"graph">;
   mode: z.ZodEnum<{
-    full: "full";
     quick: "quick";
+    full: "full";
   }>;
 }, z.core.$strict>, z.ZodObject<{
   argv: z.ZodArray<z.ZodString>;
@@ -104,8 +104,8 @@ declare const runnerCommandPayloadSchema: z.ZodObject<{
   submission: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"graph">;
     mode: z.ZodEnum<{
-      full: "full";
       quick: "quick";
+      full: "full";
     }>;
   }, z.core.$strict>, z.ZodObject<{
     argv: z.ZodArray<z.ZodString>;

package/dist/runtime/events/events.js

@@ -1,5 +1,5 @@
-import { flattenNodes } from "../../planning/graph.js";
 import { isRecord } from "../../safe-json.js";
+import { flattenNodes } from "../../planning/graph.js";
 import { runtimeActorId } from "../actor-ids.js";
 import { parseRuntimeOutput, validateJsonSchemaSource } from "../json-validation/json-validation.js";
 import "../json-validation/index.js";

package/dist/runtime/json-validation/json-validation.js

@@ -1,5 +1,5 @@
-import { standardOutputSchemaJson, standardOutputSchemaNameFromPath } from "../../standard-output-schemas.js";
 import { isRecord, parseJson, parseJsonRecord } from "../../safe-json.js";
+import { standardOutputSchemaJson, standardOutputSchemaNameFromPath } from "../../standard-output-schemas.js";
 import { FileSystemService, FileSystemServiceLive, runFileSystemSync } from "../services/file-system-service.js";
 import { Effect } from "effect";
 import { join } from "node:path";

package/dist/runtime/services/runner-command-io-service.js

@@ -1,4 +1,4 @@
-import { prepareOpencodeAccounts } from "../../run-state/opencode-accounts.js";
+import { prepareOpencodeCredentials } from "../../run-state/opencode-accounts.js";
 import { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef } from "../../run-state/git-refs.js";
 import { runScheduledWorkflowTask } from "../../pipeline-runtime.js";
 import { resolveRunnerEventSinkAuthToken } from "../../runner-command-contract.js";
@@ -46,8 +46,8 @@ const RunnerCommandIoServiceLive = Layer.succeed(RunnerCommandIoService, {
 		try: () => mergeDependencyRefs(options),
 		catch: (error) => error
 	}),
-	prepareOpencodeAccounts: () => Effect.try({
-		try: () => prepareOpencodeAccounts(),
+	prepareOpencodeCredentials: () => Effect.try({
+		try: () => prepareOpencodeCredentials(),
 		catch: (error) => error
 	}),
 	prepareRunnerGitWorkspace: (payload, options) => Effect.tryPromise({

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.17",
+  "version": "3.11.19",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",