@oisincoveney/pipeline 3.12.3 → 3.12.4

package/README.md

@@ -45,10 +45,10 @@ moka init
 
 `moka init` installs or refreshes the whole per-machine harness in one step:
 the package's default skills, generated host command surfaces, the singleton
-`pipeline-gateway` MCP entry, copied hook files from the private
-`oisin-ee/agent-hooks` repository, and global instruction files. OpenCode is the
-package default runtime. The command does not create repo-local `.pipeline`
-config files.
+`pipeline-gateway` MCP entry, copied hook files from private
+`oisin-ee/agent/hooks`, and global instruction files from `oisin-ee/agent/rules`.
+OpenCode is the package default runtime. The command does not create repo-local
+`.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -59,7 +59,7 @@ export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' |
 ```
 
 Verify the generated harness (commands, hooks, rules) is current after package
-upgrades or edits to `oisin-ee/agent-hooks`, without writing anything:
+upgrades or edits to `oisin-ee/agent`, without writing anything:
 
 ```shell
 moka init --check

package/dist/agent-assets.js

@@ -0,0 +1,7 @@
+//#region src/agent-assets.ts
+const AGENT_ASSET_SOURCE = "oisin-ee/agent";
+const AGENT_SKILL_SOURCE = "oisin-ee/agent/skills";
+const AGENT_HOOKS_DIR = "hooks";
+const AGENT_RULES_DIR = "rules";
+//#endregion
+export { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR, AGENT_RULES_DIR, AGENT_SKILL_SOURCE };

package/dist/config/lint.js

@@ -61,7 +61,7 @@ function missingFileReferenceWarning(path, value) {
 }
 function missingFileReferenceMessage(path, value) {
 	const base = `${path} references missing file '${value}'`;
-	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/skills\`.`;
+	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/agent/skills\`.`;
 	return base;
 }
 function resolveLintPathReference(projectRoot, ref) {

package/dist/config/schemas.d.ts

@@ -233,8 +233,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -262,8 +262,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -306,10 +306,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -385,10 +385,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/install-hooks.js

@@ -1,4 +1,5 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
+import { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR } from "./agent-assets.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -7,7 +8,7 @@ import { execa } from "execa";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-hooks.ts
-const DEFAULT_HOOK_INSTALL_SOURCE = "oisin-ee/agent-hooks";
+const DEFAULT_HOOK_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const HOOK_HOSTS = [
 	"claude-code",
 	"codex",
@@ -19,6 +20,7 @@ const HOST_TARGET_ROOT = {
 	codex: ".codex",
 	opencode: ".opencode"
 };
+const NON_HOOK_OWNED_TARGETS = new Set([".opencode/opencode.json"]);
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
@@ -63,8 +65,8 @@ async function cloneHookRepository(targetDir) {
 	], { stdio: "inherit" });
 }
 async function withHookSource(useSource) {
-	const parent = await mkdtemp(join(tmpdir(), "moka-agent-hooks-"));
-	const source = join(parent, "agent-hooks");
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-"));
+	const source = join(parent, "agent");
 	try {
 		await cloneHookRepository(source);
 		return await useSource(source);
@@ -86,17 +88,17 @@ async function listFiles(root) {
 }
 async function sourceHookFiles(source) {
 	return (await Promise.all(HOOK_HOSTS.map(async (host) => {
-		const hostRoot = join(source, host);
-		return (await listFiles(hostRoot)).map((file) => {
+		const hostRoot = join(source, AGENT_HOOKS_DIR, host);
+		return (await listFiles(hostRoot)).flatMap((file) => {
 			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
 			const content = readFileSync(file);
 			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
-			return {
+			return isHookOwnedTarget(path) ? [{
 				content,
 				hash: targetIdentityHash(path, content),
 				host,
 				path
-			};
+			}] : [];
 		});
 	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
 }
@@ -110,6 +112,9 @@ function emptyManifest() {
 		version: 1
 	};
 }
+function isHookOwnedTarget(path) {
+	return !NON_HOOK_OWNED_TARGETS.has(path);
+}
 function readManifest(host) {
 	const path = manifestPath(host);
 	if (!existsSync(path)) return emptyManifest();
@@ -153,18 +158,22 @@ function planFiles(files, force, manifests) {
 function planObsoleteFiles(desiredPaths, force, manifests) {
 	const obsolete = [];
 	for (const [host, manifest] of manifests) for (const [path, entry] of Object.entries(manifest.files)) {
-		if (desiredPaths.has(path)) continue;
-		const target = targetPath(path);
-		if (!existsSync(target)) continue;
-		const currentHash = hashContent(readFileSync(target));
-		obsolete.push({
-			action: force || currentHash === entry.hash ? "delete" : "conflict",
-			host,
-			path
-		});
+		const planned = planObsoleteFile(host, path, entry, force, desiredPaths);
+		if (planned) obsolete.push(planned);
 	}
 	return obsolete.sort((a, b) => a.path.localeCompare(b.path));
 }
+function planObsoleteFile(host, path, entry, force, desiredPaths) {
+	if (desiredPaths.has(path) || !isHookOwnedTarget(path)) return;
+	const target = targetPath(path);
+	if (!existsSync(target)) return;
+	const currentHash = hashContent(readFileSync(target));
+	return {
+		action: force || currentHash === entry.hash ? "delete" : "conflict",
+		host,
+		path
+	};
+}
 async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);

package/dist/install-rules.js

@@ -1,9 +1,10 @@
+import { AGENT_ASSET_SOURCE, AGENT_RULES_DIR } from "./agent-assets.js";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { execa } from "execa";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
-const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";
+const DEFAULT_RULES_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const RULESYNC_PACKAGE = "rulesync@8.30.1";
 const RULESYNC_TARGETS = [
 	"claudecode",
@@ -23,8 +24,8 @@ async function cloneRulesRepository(targetDir) {
 }
 async function withRulesSource(sourceOverride, useSource) {
 	if (sourceOverride !== void 0) return useSource(sourceOverride);
-	const parent = await mkdtemp(join(tmpdir(), "moka-rules-"));
-	const source = join(parent, "rules");
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-rules-"));
+	const source = join(parent, "agent");
 	try {
 		await cloneRulesRepository(source);
 		return await useSource(source);
@@ -52,7 +53,7 @@ async function defaultRulesyncRunner(args, opts) {
 	}
 }
 async function buildRootRule(source) {
-	const rulesDir = join(source, "rules");
+	const rulesDir = join(source, AGENT_RULES_DIR);
 	let entries = [];
 	try {
 		entries = (await readdir(rulesDir, { withFileTypes: true })).filter((d) => d.isFile() && d.name.endsWith(".md")).map((d) => d.name).sort((a, b) => a.localeCompare(b));

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -98,13 +98,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -216,13 +216,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/pipeline-init.js

@@ -1,9 +1,10 @@
+import { AGENT_SKILL_SOURCE } from "./agent-assets.js";
 import { installCommands } from "./install-commands.js";
 import { installHooks } from "./install-hooks.js";
 import { installRules } from "./install-rules.js";
 import { execa } from "execa";
 //#region src/pipeline-init.ts
-const DEFAULT_SKILL_INSTALL_SOURCE = "oisin-ee/skills";
+const DEFAULT_SKILL_INSTALL_SOURCE = AGENT_SKILL_SOURCE;
 const SKILL_INSTALL_AGENT_ARGS = [
 	"--agent",
 	"opencode",
@@ -84,7 +85,7 @@ function formatPipelineInitResult(result, mode = {}) {
 	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
 		copy.headline,
-		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/rules; inherited by every repo with no per-repo copy",
+		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/agent/rules; inherited by every repo with no per-repo copy",
 		...result.files.map((path) => `${copy.fileVerb} ${path}`),
 		copy.footer
 	].join("\n");

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -256,8 +256,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -303,10 +303,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runtime/opencode-session-executor.js

@@ -29,14 +29,10 @@ function executeOpencodeSession(deps, plan, options) {
 function boundByAgentTimeout(plan) {
 	return (effect) => {
 		const timeoutMs = plan.timeoutMs;
-		process.stderr.write(`[agent-timeout] wired nodeId=${plan.nodeId} timeoutMs=${String(timeoutMs)}\n`);
 		if (!timeoutMs || timeoutMs <= 0) return effect;
 		return Effect.timeoutFail(Effect.disconnect(effect), {
 			duration: Duration.millis(timeoutMs),
-			onTimeout: () => {
-				process.stderr.write(`[agent-timeout] FIRED nodeId=${plan.nodeId} after ${timeoutMs}ms\n`);
-				return /* @__PURE__ */ new Error(`agent session timed out after ${timeoutMs}ms`);
-			}
+			onTimeout: () => /* @__PURE__ */ new Error(`agent session timed out after ${timeoutMs}ms`)
 		});
 	};
 }

package/docs/config-architecture.md

@@ -152,7 +152,7 @@ receive explicit grants:
 - `output`: text, JSON, JSONL, or JSON Schema output.
 
 Default skills resolve from project-installed skill files created by
-`moka init` via `npx --yes skills add oisin-ee/skills`:
+`moka init` via `npx --yes skills add oisin-ee/agent/skills`:
 
 ```yaml
 skills:
@@ -164,14 +164,13 @@ Project-authored skill and rule paths resolve from the project root and must
 exist for runtime use. If default skill files are missing, run `moka init` to
 install them before executing workflows.
 
-Default agent hooks are copied by `moka init` from the private
-`oisin-ee/agent-hooks` repository. That source repository has one canonical
-host-level layout:
+Default agent hooks are copied by `moka init` from private `oisin-ee/agent`.
+That source repository has one canonical hook layout:
 
 ```text
-claude-code/
-codex/
-opencode/
+hooks/claude-code/
+hooks/codex/
+hooks/opencode/
 ```
 
 Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
@@ -215,7 +214,7 @@ OpenCode host resources are generated from the same profile registry:
 - `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
   generates agents, commands, plugins, and project config.
 - Additional manually authored OpenCode hook plugins can be copied from
-  `oisin-ee/agent-hooks/opencode/` by `moka init`.
+  `oisin-ee/agent/hooks/opencode/` by `moka init`.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and

package/docs/mcp-gateway.md

@@ -128,3 +128,45 @@ The package-owned MCP inventory exposed through the ecosystem manifest includes
 Backlog, GitHub, and Neon. Repo-scoped backends must bind to
 `PIPELINE_TARGET_PATH` or the current workspace path supplied by the gateway
 configuration.
+
+## Browser automation backend (Steel)
+
+The `Playwright` backend's tools (`playwright_browser_*`) are served by a
+self-hosted **Steel Browser** (Chromium) pool, not a browser launched inside the
+MCP pod. Microsoft's `@playwright/mcp` connects to Steel over CDP, so the tool
+surface is unchanged — agents keep calling the same `playwright_browser_*` tools
+through `pipeline-gateway`.
+
+Topology (infra repo, `k8s/charts/pipeline-mcp-gateway`):
+
+- A StatefulSet of N backend pods (`playwright.backendReplicas`, default 3). Each
+  pod is `mcp` (`@playwright/mcp`) + a private `steel` sidecar (its own Chrome on
+  `localhost:3000`) + an `auth-seed` native sidecar. One pod = one isolated,
+  verify-bot-authenticated browser.
+- Auth: the seed runs a real headless Zitadel login and POSTs the session into
+  the pod's Steel (`POST /v1/sessions`); the pod stays NotReady until the first
+  seed lands (fail-closed — an unauthenticated browser is never served) and
+  re-seeds every ~3 days, inside the oauth2-proxy 7-day cookie window.
+
+Usage:
+
+- **One authenticated browser (default).** Call `playwright_browser_*` through
+  `pipeline-gateway` (`https://pipeline-mcp.momokaya.ee/mcp/`). You get a single,
+  pre-authenticated browser. After a gateway backend restart the vMCP client
+  session can drop — reconnect the MCP client (do not bounce pods).
+- **N concurrent isolated browsers.** The single gateway/proxy endpoint does
+  **not** auto-distribute sessions across the pool — toolhive pins every session
+  to one backend pod (Redis session storage and scaling proxy replicas do not
+  change this). To use the pool concurrently, address the backend pods directly:
+  each pod's `@playwright/mcp` listens on port `8931` and is a full
+  `playwright_browser_*` endpoint (`http://<pod-ip-or-headless-dns>:8931/mcp`).
+  Proven: 3 concurrent per-pod sessions, each on a distinct authenticated
+  browser.
+- Scale the pool with `playwright.backendReplicas`.
+
+Operational notes: Steel runs as root in-pod (its bundled nginx requires it,
+otherwise `nginx [emerg] chown(/var/lib/nginx/body) Operation not permitted`);
+health is `GET /v1/health`; on ARM nodes set `SKIP_FINGERPRINT_INJECTION=true`;
+CDP over a service-DNS host needs `--cdp-header "Host: localhost"` (Chrome's
+anti-DNS-rebinding check), but the in-pod `localhost:3000` path needs no header.
+See infra `INFRA-074`.

package/docs/operator-guide.md

@@ -177,8 +177,8 @@ OpenBao, publish Secret values, or mutate ESO resources from this package.
 
 Installs or refreshes the whole per-machine harness in one command: the
 package's default skills, generated host-native command surfaces and MCP
-entries, copied agent hooks from the private `oisin-ee/agent-hooks` repository,
-and global instruction files generated via rulesync from `oisin-ee/rules`.
+entries, copied agent hooks from private `oisin-ee/agent/hooks`, and global
+instruction files generated via rulesync from `oisin-ee/agent/rules`.
 OpenCode is the package default runtime. The harness is always installed
 globally (`~/.claude`, `~/.config/opencode`, `~/.codex`); there is no `--scope`.
 `moka init` does not create repo-local `.pipeline` config files.
@@ -192,12 +192,10 @@ moka init --force     # overwrite manually edited harness files
 
 `--check` and `--dry-run` write nothing and skip the network skill install.
 By default `moka init` refuses to overwrite manually edited hook or command
-files; `--force` overwrites them. For agent hooks, Moka clones
-`oisin-ee/agent-hooks`, copies files, and tracks installed hashes so later runs
-update unchanged owned files, delete removed owned files, and (without `--force`)
-refuse to clobber manual edits. The hook source repository has only host folders
-(`claude-code/`, `codex/`, `opencode/`); there is no source override flag and no
-symlink mode.
+files; `--force` overwrites them. For agent hooks, Moka clones `oisin-ee/agent`,
+copies files from `hooks/<host>`, and tracks installed hashes so later runs update
+unchanged owned files, delete removed owned files, and (without `--force`) refuse
+to clobber manual edits. There is no source override flag and no symlink mode.
 
 Use `PIPELINE_TARGET_PATH=/path/to/repo` when invoking `moka` from outside the
 target worktree.
@@ -384,9 +382,9 @@ Claude Code: /moka-quick, /moka-execute, /moka-inspect
 - `.opencode/opencode.json` with LSP, the singleton `pipeline-gateway` MCP
   server, and pinned package-selected plugins
 
-`moka init` also copies hook files from `oisin-ee/agent-hooks` by overlaying
-`opencode/`, `claude-code/`, and `codex/` onto the host config roots. Hook files
-are authored in the hook repo, not generated by Moka.
+`moka init` also copies hook files from `oisin-ee/agent/hooks` by overlaying
+`hooks/opencode/`, `hooks/claude-code/`, and `hooks/codex/` onto the host config
+roots. Hook files are authored in the agent asset repo, not generated by Moka.
 
 For Claude Code, `moka init` generates `.claude/commands/moka-<entrypoint>.md`
 slash commands.

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.12.3",
+  "version": "3.12.4",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",