@oisincoveney/pipeline 3.11.18 → 3.11.20

package/dist/argo-workflow.js

@@ -21,6 +21,9 @@ const RUNNER_RETRY_STRATEGY = {
 const RUNNER_OPENCODE_ENV = [{
 	name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
 	value: "0"
+}, {
+	name: "PIPELINE_AGENT_TIMEOUT_MS",
+	value: "1200000"
 }];
 const DEFAULT_RUNNER_RESOURCES = {
 	limits: {
@@ -32,7 +35,7 @@ const DEFAULT_RUNNER_RESOURCES = {
 		memory: "5Gi"
 	}
 };
-const DEFAULT_RUNNER_DEADLINE_SECONDS = 3600;
+const DEFAULT_RUNNER_DEADLINE_SECONDS = 5400;
 const kubernetesNameSchema = z.string().min(1);
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
+  "node.finish": "node.finish";
+  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
-  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
-  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -207,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/run-state/opencode-accounts.js

@@ -1,26 +1,30 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync } from "node:fs";
+import { isRecord } from "../safe-json.js";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 //#region src/run-state/opencode-accounts.ts
 const OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR = "/etc/pipeline/opencode-openai-accounts";
 const OPENCODE_AUTH_STAGING_DIR = "/etc/pipeline/opencode-auth";
+const ACCOUNTS_FILE_NAME = "oc-codex-multi-auth-accounts.json";
+const AUTH_FILE_NAME = "auth.json";
+const HOST_OPENAI_PROVIDER = "openai";
 const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
-	destFromHome: [".opencode", "oc-codex-multi-auth-accounts.json"],
+	destFromHome: [".opencode", ACCOUNTS_FILE_NAME],
 	stagedPath: join(OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, "accounts.json")
 }, {
 	destFromHome: [
 		".local",
 		"share",
 		"opencode",
-		"auth.json"
+		AUTH_FILE_NAME
 	],
-	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, "auth.json")
+	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, AUTH_FILE_NAME)
 }];
 /**
-* Copy each staged opencode credential secret to its writable live path so the
-* plugin can rewrite tokens. Only files whose staged source exists are copied
-* (local dev / tests / configs without a given secret keep whatever store is
-* already present). Returns the basenames copied, for run-log evidence.
+* Copy each staged opencode credential secret to its writable live path, then
+* sync the account pool's active openai token into auth.json's openai entry.
+* Only files whose staged source exists are copied (local dev / tests / configs
+* without a given secret keep whatever store is already present).
 */
 function prepareOpencodeCredentials(options = {}) {
 	const home = homedir();
@@ -36,7 +40,53 @@ function prepareOpencodeCredentials(options = {}) {
 		chmodSync(destPath, 384);
 		copied.push(basename(destPath));
 	}
-	return { copied };
+	const accountsPath = files.find((file) => basename(file.destPath) === ACCOUNTS_FILE_NAME)?.destPath;
+	const authPath = files.find((file) => basename(file.destPath) === AUTH_FILE_NAME)?.destPath;
+	return {
+		copied,
+		hostOpenaiTokenSynced: accountsPath !== void 0 && authPath !== void 0 && syncHostOpenaiToken(accountsPath, authPath)
+	};
+}
+function activeAccountOAuth(accountsRaw) {
+	if (!isRecord(accountsRaw)) return;
+	const accounts = accountsRaw.accounts;
+	if (!Array.isArray(accounts)) return;
+	const account = accounts[activeAccountIndex(accountsRaw)] ?? accounts[0];
+	return isRecord(account) ? oauthFromAccount(account) : void 0;
+}
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function oauthFromAccount(account) {
+	const { accessToken, refreshToken, expiresAt } = account;
+	if (nonEmptyString(accessToken) && nonEmptyString(refreshToken) && typeof expiresAt === "number") return {
+		access: accessToken,
+		expires: expiresAt,
+		refresh: refreshToken
+	};
+}
+function activeAccountIndex(accountsRaw) {
+	const byFamily = accountsRaw.activeIndexByFamily;
+	if (isRecord(byFamily) && typeof byFamily.codex === "number") return byFamily.codex;
+	return typeof accountsRaw.activeIndex === "number" ? accountsRaw.activeIndex : 0;
+}
+function syncHostOpenaiToken(accountsPath, authPath) {
+	if (!(existsSync(accountsPath) && existsSync(authPath))) return false;
+	const token = activeAccountOAuth(JSON.parse(readFileSync(accountsPath, "utf8")));
+	if (!token) return false;
+	const auth = JSON.parse(readFileSync(authPath, "utf8"));
+	if (!isRecord(auth)) return false;
+	const next = {
+		...auth,
+		[HOST_OPENAI_PROVIDER]: {
+			access: token.access,
+			expires: token.expires,
+			refresh: token.refresh,
+			type: "oauth"
+		}
+	};
+	writeFileSync(authPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 384 });
+	return true;
 }
 //#endregion
 export { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR, prepareOpencodeCredentials };

package/dist/runner-command/run.js

@@ -107,6 +107,7 @@ function runRunnerCommandEffect(options, runtime) {
 		const credentialsPrep = yield* io.prepareOpencodeCredentials();
 		logger.info({
 			copied: credentialsPrep.copied,
+			hostOpenaiTokenSynced: credentialsPrep.hostOpenaiTokenSynced,
 			phase: "opencode.credentials.prepare",
 			status: "finish"
 		}, "opencode.credentials.prepare finish");

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.start": "workflow.start";
     "workflow.planned": "workflow.planned";
+    "workflow.start": "workflow.start";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
-    "node.start": "node.start";
-    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.start": "workflow.start";
       "workflow.planned": "workflow.planned";
+      "workflow.start": "workflow.start";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
-      "node.start": "node.start";
-      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
+      "node.finish": "node.finish";
+      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runtime/events/events.js

@@ -1,5 +1,5 @@
-import { flattenNodes } from "../../planning/graph.js";
 import { isRecord } from "../../safe-json.js";
+import { flattenNodes } from "../../planning/graph.js";
 import { runtimeActorId } from "../actor-ids.js";
 import { parseRuntimeOutput, validateJsonSchemaSource } from "../json-validation/json-validation.js";
 import "../json-validation/index.js";

package/dist/runtime/json-validation/json-validation.js

@@ -1,5 +1,5 @@
-import { standardOutputSchemaJson, standardOutputSchemaNameFromPath } from "../../standard-output-schemas.js";
 import { isRecord, parseJson, parseJsonRecord } from "../../safe-json.js";
+import { standardOutputSchemaJson, standardOutputSchemaNameFromPath } from "../../standard-output-schemas.js";
 import { FileSystemService, FileSystemServiceLive, runFileSystemSync } from "../services/file-system-service.js";
 import { Effect } from "effect";
 import { join } from "node:path";

package/dist/runtime/opencode-session-executor.js

@@ -24,7 +24,17 @@ function executeOpencodeEffect(deps, plan, options) {
 function executeOpencodeSession(deps, plan, options) {
 	return Effect.gen(function* () {
 		return successResult(plan, yield* driveSession(deps, plan, options));
-	}).pipe(Effect.catchAll((error) => Effect.succeed(failureResult(plan, error))));
+	}).pipe(withAgentTimeout(plan), Effect.catchAll((error) => Effect.succeed(failureResult(plan, error))));
+}
+function withAgentTimeout(plan) {
+	return (effect) => {
+		const timeoutMs = plan.timeoutMs;
+		if (!timeoutMs || timeoutMs <= 0) return effect;
+		return Effect.timeoutFail(effect, {
+			duration: Duration.millis(timeoutMs),
+			onTimeout: () => /* @__PURE__ */ new Error(`agent session timed out after ${timeoutMs}ms`)
+		});
+	};
 }
 function validateOpencodePlan(plan) {
 	if (plan.type === "opencode") return Effect.void;

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.11.18",
+  "version": "3.11.20",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",