@oisincoveney/pipeline 3.12.3 → 3.13.0

package/README.md

@@ -45,10 +45,10 @@ moka init
 
 `moka init` installs or refreshes the whole per-machine harness in one step:
 the package's default skills, generated host command surfaces, the singleton
-`pipeline-gateway` MCP entry, copied hook files from the private
-`oisin-ee/agent-hooks` repository, and global instruction files. OpenCode is the
-package default runtime. The command does not create repo-local `.pipeline`
-config files.
+`pipeline-gateway` MCP entry, copied hook files from private
+`oisin-ee/agent/hooks`, and global instruction files from `oisin-ee/agent/rules`.
+OpenCode is the package default runtime. The command does not create repo-local
+`.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -59,7 +59,7 @@ export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' |
 ```
 
 Verify the generated harness (commands, hooks, rules) is current after package
-upgrades or edits to `oisin-ee/agent-hooks`, without writing anything:
+upgrades or edits to `oisin-ee/agent`, without writing anything:
 
 ```shell
 moka init --check

package/dist/agent-assets.js

@@ -0,0 +1,7 @@
+//#region src/agent-assets.ts
+const AGENT_ASSET_SOURCE = "oisin-ee/agent";
+const AGENT_SKILL_SOURCE = "oisin-ee/agent/skills";
+const AGENT_HOOKS_DIR = "hooks";
+const AGENT_RULES_DIR = "rules";
+//#endregion
+export { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR, AGENT_RULES_DIR, AGENT_SKILL_SOURCE };

package/dist/argo-submit.d.ts

@@ -20,6 +20,11 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;

package/dist/argo-submit.js

@@ -1,4 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
 import { buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } from "./argo-workflow.js";
@@ -38,6 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
@@ -89,6 +91,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		brokerAuth: options.brokerAuth,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
 		payloadConfigMapName,

package/dist/argo-workflow.d.ts

@@ -27,10 +27,18 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
       container: z.ZodOptional<z.ZodObject<{
         args: z.ZodArray<z.ZodString>;
         command: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        env: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        env: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
           name: z.ZodString;
           value: z.ZodString;
-        }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+          name: z.ZodString;
+          valueFrom: z.ZodObject<{
+            secretKeyRef: z.ZodObject<{
+              key: z.ZodString;
+              name: z.ZodString;
+            }, z.core.$strict>;
+          }, z.core.$strict>;
+        }, z.core.$strict>]>>>;
         image: z.ZodString;
         imagePullPolicy: z.ZodEnum<{
           Always: "Always";
@@ -137,6 +145,11 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecret: z.ZodOptional<z.ZodObject<{
     key: z.ZodOptional<z.ZodString>;

package/dist/argo-workflow.js

@@ -92,14 +92,21 @@ const argoWorkflowRetryStrategySchema = z.object({
 		"OnTransientError"
 	])
 }).strict();
+const argoWorkflowEnvVarSchema = z.union([z.object({
+	name: z.string().min(1),
+	value: z.string()
+}).strict(), z.object({
+	name: z.string().min(1),
+	valueFrom: z.object({ secretKeyRef: z.object({
+		key: z.string().min(1),
+		name: kubernetesNameSchema
+	}).strict() }).strict()
+}).strict()]);
 const argoWorkflowTemplateSchema = z.object({
 	container: z.object({
 		args: z.array(z.string().min(1)).min(1),
 		command: z.array(z.string().min(1)).min(1).optional(),
-		env: z.array(z.object({
-			name: z.string().min(1),
-			value: z.string()
-		}).strict()).optional(),
+		env: z.array(argoWorkflowEnvVarSchema).optional(),
 		image: z.string().min(1),
 		imagePullPolicy: z.enum([
 			"Always",
@@ -169,6 +176,11 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
+	brokerAuth: z.object({
+		secretKey: z.string().min(1).default("api-key"),
+		secretName: kubernetesNameSchema,
+		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
+	}).strict().optional(),
 	opencodeAuthSecretName: kubernetesNameSchema.optional(),
 	opencodeOpenaiAccountsSecret: z.object({
 		key: z.string().min(1).optional(),
@@ -374,6 +386,28 @@ function runnerWorkflowStorage(options, tasks) {
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+/**
+* The runner container env: the static opencode/agent tuning plus, when broker
+* auth is configured, BROKER_URL (literal) and BROKER_API_KEY (sourced from the
+* broker secret key, never inlined into the manifest).
+*/
+function runnerContainerEnv(options) {
+	if (!options.brokerAuth) return [...RUNNER_OPENCODE_ENV];
+	return [
+		...RUNNER_OPENCODE_ENV,
+		{
+			name: "BROKER_URL",
+			value: options.brokerAuth.url
+		},
+		{
+			name: "BROKER_API_KEY",
+			valueFrom: { secretKeyRef: {
+				key: options.brokerAuth.secretKey,
+				name: options.brokerAuth.secretName
+			} }
+		}
+	];
+}
 function runnerLifecycleTemplate(options, volumeMounts) {
 	return {
 		container: {
@@ -387,7 +421,7 @@ function runnerLifecycleTemplate(options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -416,7 +450,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -441,7 +475,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/broker-auth.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+//#region src/broker-auth.d.ts
+/**
+ * Submit-time broker auth options: the runner sources BROKER_API_KEY from
+ * `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+ * entrypoint so the broker wiring is declared in exactly one place.
+ */
+declare const brokerAuthOptionSchema: z.ZodObject<{
+  secretKey: z.ZodDefault<z.ZodString>;
+  secretName: z.ZodString;
+  url: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+type BrokerAuthOption = z.input<typeof brokerAuthOptionSchema>;
+//#endregion
+export { BrokerAuthOption };

package/dist/broker-auth.js

@@ -0,0 +1,172 @@
+import { applyJsonEdit, ensureTrailingNewline, formatJson, parseJsonRecord } from "./json-config-merge.js";
+import { z } from "zod";
+//#region src/broker-auth.ts
+/**
+* Central CLIProxyAPI broker auth for codex + opencode.
+*
+* When `BROKER_API_KEY` is present, codex and opencode authenticate through the
+* central broker (an OpenAI-compatible `/v1` endpoint) instead of materializing
+* the bespoke multi-auth account pool. The broker owns OAuth refresh / rotation
+* / failover, so the runner no longer stages `oc-codex-multi-auth` accounts, the
+* mounted `~/.codex/auth.json`, or the multi-auth opencode plugin.
+*
+* This mirrors the proven coder dev-workspace template
+* (infra: coder-templates/dev-workspace/main.tf):
+*   - codex  ~/.codex/config.toml: `model_provider = "broker"` +
+*     `[model_providers.broker]` base_url=<broker>/v1 env_key=BROKER_API_KEY
+*     wire_api="responses".
+*   - opencode global config: `provider.openai.options.baseURL=<broker>/v1`
+*     plus `store=false` and `include=["reasoning.encrypted_content"]` (required
+*     by the Codex/Responses backend the broker fronts).
+*   - opencode auth store: `{"openai":{"type":"api","key":<BROKER_API_KEY>}}`.
+*/
+const BROKER_API_KEY_ENV = "BROKER_API_KEY";
+const BROKER_URL_ENV = "BROKER_URL";
+const DEFAULT_BROKER_URL = "https://cliproxy.momokaya.ee";
+const TRAILING_SLASH_RE = /\/+$/;
+const CODEX_BROKER_PROVIDER_ID = "broker";
+const OPENCODE_OPENAI_PROVIDER_ID = "openai";
+/** Plugin removed from opencode config in broker mode (broker fronts auth). */
+const OC_CODEX_MULTI_AUTH_PLUGIN_NAME = "oc-codex-multi-auth";
+/**
+* Submit-time broker auth options: the runner sources BROKER_API_KEY from
+* `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+* entrypoint so the broker wiring is declared in exactly one place.
+*/
+const brokerAuthOptionSchema = z.object({
+	secretKey: z.string().min(1).default("api-key"),
+	secretName: z.string().min(1),
+	url: z.string().min(1).default(DEFAULT_BROKER_URL)
+}).strict();
+/**
+* Resolve broker credentials from the environment, or `undefined` when the
+* runner is not broker-authenticated (local dev, non-broker fallback). The
+* `BROKER_URL` env is optional and defaults to the production broker origin.
+*/
+function resolveBrokerCredentials(env = process.env) {
+	const apiKey = env[BROKER_API_KEY_ENV];
+	if (apiKey === void 0 || apiKey.length === 0) return;
+	const rawUrl = env[BROKER_URL_ENV];
+	return {
+		apiKey,
+		baseUrl: rawUrl !== void 0 && rawUrl.length > 0 ? rawUrl.replace(TRAILING_SLASH_RE, "") : DEFAULT_BROKER_URL
+	};
+}
+/** The broker's OpenAI-compatible endpoint (`<baseUrl>/v1`). */
+function brokerV1Url(credentials) {
+	return `${credentials.baseUrl}/v1`;
+}
+/**
+* opencode host auth store contents for broker mode — the `openai` provider
+* authenticates with the broker api-key. Other providers in an existing store
+* are intentionally NOT preserved here: in broker mode the runner owns this
+* file outright (the multi-auth pool that previously populated it is gone).
+*/
+function renderOpencodeBrokerAuthJson(credentials) {
+	return formatJson({ [OPENCODE_OPENAI_PROVIDER_ID]: {
+		key: credentials.apiKey,
+		type: "api"
+	} });
+}
+/**
+* Inject the codex broker model provider into an existing `config.toml`,
+* preserving every other section. Idempotent: re-running replaces the
+* `[model_providers.broker]` block and the top-level `model_provider` key.
+*/
+function applyCodexBrokerProvider(currentText, credentials) {
+	const withoutProvider = removeCodexBrokerSections(currentText ?? "");
+	const projection = renderCodexBrokerProvider(credentials);
+	return ensureTrailingNewline([withoutProvider.trimEnd(), projection.trimEnd()].filter(Boolean).join("\n\n"));
+}
+function renderCodexBrokerProvider(credentials) {
+	return [
+		`model_provider = "${CODEX_BROKER_PROVIDER_ID}"`,
+		"",
+		`[model_providers.${CODEX_BROKER_PROVIDER_ID}]`,
+		`name = "${CODEX_BROKER_PROVIDER_ID}"`,
+		`base_url = "${brokerV1Url(credentials)}"`,
+		`env_key = "${BROKER_API_KEY_ENV}"`,
+		"wire_api = \"responses\""
+	].join("\n");
+}
+const CODEX_BROKER_SECTION_HEADER = `[model_providers.${CODEX_BROKER_PROVIDER_ID}]`;
+const CODEX_MODEL_PROVIDER_KEY_RE = /^\s*model_provider\s*=/;
+function removeCodexBrokerSections(content) {
+	const lines = content.split("\n");
+	const kept = [];
+	let removing = false;
+	for (const line of lines) {
+		if (line.trim() === CODEX_BROKER_SECTION_HEADER) {
+			removing = true;
+			continue;
+		}
+		if (removing && isTomlSectionHeader(line)) removing = false;
+		if (removing) continue;
+		if (CODEX_MODEL_PROVIDER_KEY_RE.test(line)) continue;
+		kept.push(line);
+	}
+	return kept.join("\n");
+}
+function isTomlSectionHeader(line) {
+	const trimmed = line.trim();
+	return trimmed.startsWith("[") && trimmed.endsWith("]");
+}
+/**
+* Point an opencode config (global or project `opencode.json`) at the broker:
+* set `provider.openai.options.{baseURL,store,include}` and drop the
+* `oc-codex-multi-auth` plugin entry. Preserves all other config (models, mcp,
+* other plugins). Creates a minimal config when `currentText` is undefined.
+*/
+function applyOpencodeBrokerProvider(currentText, credentials) {
+	const options = {
+		baseURL: brokerV1Url(credentials),
+		include: ["reasoning.encrypted_content"],
+		store: false
+	};
+	if (currentText === void 0) return { content: formatJson({
+		$schema: "https://opencode.ai/config.json",
+		provider: { [OPENCODE_OPENAI_PROVIDER_ID]: { options } }
+	}) };
+	const parsed = parseJsonRecord(currentText);
+	if (!parsed.ok) return { error: "invalid opencode config JSON" };
+	const withProvider = applyJsonEdit(currentText, [
+		"provider",
+		OPENCODE_OPENAI_PROVIDER_ID,
+		"options"
+	], mergeOpenaiOptions(parsed.value, options));
+	const nextPlugins = pluginsWithoutMultiAuth(parsed.value.plugin);
+	return { content: ensureTrailingNewline(nextPlugins === void 0 ? withProvider : applyJsonEdit(withProvider, ["plugin"], nextPlugins)) };
+}
+function mergeOpenaiOptions(parsed, options) {
+	return {
+		...currentOpenaiOptions(parsed),
+		...options
+	};
+}
+function currentOpenaiOptions(parsed) {
+	const provider = parsed.provider;
+	if (!isRecord(provider)) return {};
+	const openai = provider[OPENCODE_OPENAI_PROVIDER_ID];
+	if (!isRecord(openai)) return {};
+	return isRecord(openai.options) ? openai.options : {};
+}
+/**
+* Return the plugin array with every `oc-codex-multi-auth` entry removed, or
+* `undefined` when there was nothing to remove (so the caller can skip the
+* edit). Handles bare-string and `[name, opts]` tuple plugin specifiers.
+*/
+function pluginsWithoutMultiAuth(plugin) {
+	if (!Array.isArray(plugin)) return;
+	const filtered = plugin.filter((entry) => !isMultiAuthPlugin(entry));
+	return filtered.length === plugin.length ? void 0 : filtered;
+}
+function isMultiAuthPlugin(entry) {
+	const specifier = Array.isArray(entry) ? entry[0] : entry;
+	if (typeof specifier !== "string") return false;
+	return (specifier.indexOf("@", 1) === -1 ? specifier : specifier.slice(0, specifier.indexOf("@", 1))) === OC_CODEX_MULTI_AUTH_PLUGIN_NAME;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { applyCodexBrokerProvider, applyOpencodeBrokerProvider, brokerAuthOptionSchema, renderOpencodeBrokerAuthJson, resolveBrokerCredentials };

package/dist/cli/program.js

@@ -415,6 +415,7 @@ function buildLoopSubmitInput(options) {
 		githubAuthSecretName: momokaya?.submit.githubAuthSecretName,
 		kubeconfigPath: momokaya?.kubernetes.kubeconfig,
 		namespace: momokaya?.kubernetes.namespace,
+		brokerAuth: momokaya?.submit.brokerAuth,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: momokaya?.submit.serviceAccountName,

package/dist/cli/submit-options.js

@@ -48,6 +48,7 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		brokerAuth: momokaya?.submit.brokerAuth,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,

package/dist/cluster-doctor.js

@@ -62,19 +62,21 @@ function clusterResources() {
 	const configured = loadMokaGlobalConfig()?.momokaya.submit;
 	return configured ? {
 		...DEFAULT_RESOURCES,
+		brokerAuthSecretName: configured.brokerAuth?.secretName,
 		eventAuthSecretName: configured.eventAuthSecretName,
 		gitCredentialsSecretName: configured.gitCredentialsSecretName,
 		githubAuthSecretName: configured.githubAuthSecretName,
 		imagePullSecretName: configured.imagePullSecretName,
-		opencodeAuthSecretName: configured.opencodeAuthSecretName,
+		opencodeAuthSecretName: configured.opencodeAuthSecretName ?? DEFAULT_RESOURCES.opencodeAuthSecretName,
 		serviceAccountName: configured.serviceAccountName
 	} : DEFAULT_RESOURCES;
 }
 function secretChecks(namespace, kubectlOptions, resources) {
+	const authSecretCheck = resources.brokerAuthSecretName ? [resources.brokerAuthSecretName, `Secret ${resources.brokerAuthSecretName} missing in ${namespace}; expected broker api-key mount by name.`] : [resources.opencodeAuthSecretName, `Secret ${resources.opencodeAuthSecretName} missing in ${namespace}; expected OpenCode auth mount by name.`];
 	return [
 		[resources.eventAuthSecretName, eventAuthMissingDetail(namespace)],
 		[resources.imagePullSecretName, `Secret ${resources.imagePullSecretName} missing in ${namespace}; expected imagePullSecret for ghcr.io/oisin-ee/pipeline-runner.`],
-		[resources.opencodeAuthSecretName, `Secret ${resources.opencodeAuthSecretName} missing in ${namespace}; expected OpenCode auth mount by name.`],
+		authSecretCheck,
 		[resources.gitCredentialsSecretName, `Secret ${resources.gitCredentialsSecretName} missing in ${namespace}; expected runner git credentials mount by name.`],
 		[resources.githubAuthSecretName, `Secret ${resources.githubAuthSecretName} missing in ${namespace}; expected GitHub auth mount by name.`]
 	].map(([name, missingDetail]) => checkNamespacedResource(`secret/${name}`, [

package/dist/codex-auth-sync.js

@@ -1,3 +1,4 @@
+import { applyOpencodeBrokerProvider, resolveBrokerCredentials } from "./broker-auth.js";
 import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -7,7 +8,8 @@ import { parse } from "jsonc-parser";
 const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";
 const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
 function syncLocalCodexAuth(options) {
-	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	const broker = options.broker === void 0 ? resolveBrokerCredentials() : options.broker;
+	const items = broker ? discoverGitRepositories(options.root).map((repo) => syncProjectBrokerConfig(repo, broker, options)) : [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
 	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
 	const hasErrors = items.some((item) => item.action === "error");
 	const checkFailed = options.check === true && hasRequiredChanges;
@@ -48,6 +50,17 @@ function syncProjectOpenCodeConfig(repo, options) {
 	};
 	return writeIfChanged(path, currentText, merged.content, options);
 }
+function syncProjectBrokerConfig(repo, broker, options) {
+	const path = join(repo, ".opencode/opencode.json");
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const result = applyOpencodeBrokerProvider(currentText, broker);
+	if ("error" in result) return {
+		action: "error",
+		message: result.error,
+		path
+	};
+	return writeIfChanged(path, currentText, result.content, options);
+}
 function writeIfChanged(path, currentText, nextText, options) {
 	if (currentText === nextText) return {
 		action: "unchanged",

package/dist/config/lint.js

@@ -61,7 +61,7 @@ function missingFileReferenceWarning(path, value) {
 }
 function missingFileReferenceMessage(path, value) {
 	const base = `${path} references missing file '${value}'`;
-	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/skills\`.`;
+	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/agent/skills\`.`;
 	return base;
 }
 function resolveLintPathReference(projectRoot, ref) {

package/dist/config/schemas.d.ts

@@ -233,8 +233,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -262,8 +262,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      local: "local";
       hosted: "hosted";
+      local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -306,10 +306,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -385,10 +385,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/install-commands/claude-code.js

@@ -1,6 +1,6 @@
+import { CLAUDE_PROJECT_CONFIG_PATH, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost } from "./shared.js";
 import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { mergeClaudeSettings } from "../claude-settings-config.js";
-import { CLAUDE_PROJECT_CONFIG_PATH, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost } from "./shared.js";
 import { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, projectAgentsMdDefinition, resolvedHostModel } from "./opencode.js";
 //#region src/install-commands/claude-code.ts
 const CLAUDE_CODE_HOST = "claude-code";

package/dist/install-commands/opencode.js

@@ -1,3 +1,4 @@
+import { AGENTS_MD_END, AGENTS_MD_START, COMMAND_HOSTS, GENERATED_MARKER, GENERATED_TS_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries } from "./shared.js";
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST } from "../config/defaults.js";
 import { resolvePackageAssetPath } from "../package-assets.js";
 import "../config.js";
@@ -6,7 +7,6 @@ import { renderOpenCodeGatewayConfig } from "../mcp/gateway.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
 import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { mergeOpenCodeProjectConfig } from "../opencode-project-config.js";
-import { AGENTS_MD_END, AGENTS_MD_START, COMMAND_HOSTS, GENERATED_MARKER, GENERATED_TS_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries } from "./shared.js";
 import { Effect } from "effect";
 import { basename } from "node:path";
 import matter from "gray-matter";

package/dist/install-commands.js

@@ -1,10 +1,10 @@
+import { isRecord } from "./json-config-merge.js";
+import { CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, INSTALL_HOSTS, invocationForHost, resolveHarnessTarget } from "./install-commands/shared.js";
 import { loadPipelineConfig } from "./config/load.js";
 import "./config.js";
-import { isRecord } from "./json-config-merge.js";
 import { mergeClaudeUserConfig } from "./claude-user-config.js";
 import { mergeCodexConfig } from "./codex-config.js";
 import { renderClaudeGatewayUserConfig, renderCodexGatewayConfig } from "./mcp/gateway.js";
-import { CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, INSTALL_HOSTS, invocationForHost, resolveHarnessTarget } from "./install-commands/shared.js";
 import { opencodeAdapter } from "./install-commands/opencode.js";
 import { claudeCodeAdapter } from "./install-commands/claude-code.js";
 import { existsSync, readFileSync, statSync } from "node:fs";

package/dist/install-hooks.js

@@ -1,5 +1,6 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
+import { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR } from "./agent-assets.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
@@ -7,7 +8,7 @@ import { execa } from "execa";
 import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-hooks.ts
-const DEFAULT_HOOK_INSTALL_SOURCE = "oisin-ee/agent-hooks";
+const DEFAULT_HOOK_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const HOOK_HOSTS = [
 	"claude-code",
 	"codex",
@@ -19,6 +20,7 @@ const HOST_TARGET_ROOT = {
 	codex: ".codex",
 	opencode: ".opencode"
 };
+const NON_HOOK_OWNED_TARGETS = new Set([".opencode/opencode.json"]);
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
@@ -63,8 +65,8 @@ async function cloneHookRepository(targetDir) {
 	], { stdio: "inherit" });
 }
 async function withHookSource(useSource) {
-	const parent = await mkdtemp(join(tmpdir(), "moka-agent-hooks-"));
-	const source = join(parent, "agent-hooks");
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-"));
+	const source = join(parent, "agent");
 	try {
 		await cloneHookRepository(source);
 		return await useSource(source);
@@ -86,17 +88,17 @@ async function listFiles(root) {
 }
 async function sourceHookFiles(source) {
 	return (await Promise.all(HOOK_HOSTS.map(async (host) => {
-		const hostRoot = join(source, host);
-		return (await listFiles(hostRoot)).map((file) => {
+		const hostRoot = join(source, AGENT_HOOKS_DIR, host);
+		return (await listFiles(hostRoot)).flatMap((file) => {
 			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
 			const content = readFileSync(file);
 			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
-			return {
+			return isHookOwnedTarget(path) ? [{
 				content,
 				hash: targetIdentityHash(path, content),
 				host,
 				path
-			};
+			}] : [];
 		});
 	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
 }
@@ -110,6 +112,9 @@ function emptyManifest() {
 		version: 1
 	};
 }
+function isHookOwnedTarget(path) {
+	return !NON_HOOK_OWNED_TARGETS.has(path);
+}
 function readManifest(host) {
 	const path = manifestPath(host);
 	if (!existsSync(path)) return emptyManifest();
@@ -153,18 +158,22 @@ function planFiles(files, force, manifests) {
 function planObsoleteFiles(desiredPaths, force, manifests) {
 	const obsolete = [];
 	for (const [host, manifest] of manifests) for (const [path, entry] of Object.entries(manifest.files)) {
-		if (desiredPaths.has(path)) continue;
-		const target = targetPath(path);
-		if (!existsSync(target)) continue;
-		const currentHash = hashContent(readFileSync(target));
-		obsolete.push({
-			action: force || currentHash === entry.hash ? "delete" : "conflict",
-			host,
-			path
-		});
+		const planned = planObsoleteFile(host, path, entry, force, desiredPaths);
+		if (planned) obsolete.push(planned);
 	}
 	return obsolete.sort((a, b) => a.path.localeCompare(b.path));
 }
+function planObsoleteFile(host, path, entry, force, desiredPaths) {
+	if (desiredPaths.has(path) || !isHookOwnedTarget(path)) return;
+	const target = targetPath(path);
+	if (!existsSync(target)) return;
+	const currentHash = hashContent(readFileSync(target));
+	return {
+		action: force || currentHash === entry.hash ? "delete" : "conflict",
+		host,
+		path
+	};
+}
 async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);

package/dist/install-rules.js

@@ -1,9 +1,10 @@
+import { AGENT_ASSET_SOURCE, AGENT_RULES_DIR } from "./agent-assets.js";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { execa } from "execa";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
-const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";
+const DEFAULT_RULES_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const RULESYNC_PACKAGE = "rulesync@8.30.1";
 const RULESYNC_TARGETS = [
 	"claudecode",
@@ -23,8 +24,8 @@ async function cloneRulesRepository(targetDir) {
 }
 async function withRulesSource(sourceOverride, useSource) {
 	if (sourceOverride !== void 0) return useSource(sourceOverride);
-	const parent = await mkdtemp(join(tmpdir(), "moka-rules-"));
-	const source = join(parent, "rules");
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-rules-"));
+	const source = join(parent, "agent");
 	try {
 		await cloneRulesRepository(source);
 		return await useSource(source);
@@ -52,7 +53,7 @@ async function defaultRulesyncRunner(args, opts) {
 	}
 }
 async function buildRootRule(source) {
-	const rulesDir = join(source, "rules");
+	const rulesDir = join(source, AGENT_RULES_DIR);
 	let entries = [];
 	try {
 		entries = (await readdir(rulesDir, { withFileTypes: true })).filter((d) => d.isFile() && d.name.endsWith(".md")).map((d) => d.name).sort((a, b) => a.localeCompare(b));

package/dist/loop/loop-command.js

@@ -80,6 +80,7 @@ function loopControllerSubmitInput(input) {
 		image: input.image,
 		kubeconfigPath: input.kubeconfigPath,
 		namespace: input.namespace,
+		brokerAuth: input.brokerAuth,
 		opencodeAuthSecretName: input.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: input.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.serviceAccountName,

package/dist/moka-global-config.d.ts

@@ -9,13 +9,18 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       namespace: z.ZodString;
     }, z.core.$strict>;
     submit: z.ZodObject<{
+      brokerAuth: z.ZodOptional<z.ZodObject<{
+        secretKey: z.ZodDefault<z.ZodString>;
+        secretName: z.ZodString;
+        url: z.ZodDefault<z.ZodString>;
+      }, z.core.$strict>>;
       eventAuthSecretKey: z.ZodString;
       eventAuthSecretName: z.ZodString;
       eventUrl: z.ZodString;
       gitCredentialsSecretName: z.ZodString;
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
-      opencodeAuthSecretName: z.ZodString;
+      opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
       opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -1,3 +1,4 @@
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { PipelineConfigError } from "./config/schemas.js";
 import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-service.js";
 import "./config.js";
@@ -8,13 +9,14 @@ import { join } from "node:path";
 //#region src/moka-global-config.ts
 const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
 const mokaSubmitGlobalConfigSchema = z.object({
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1),
 	eventAuthSecretName: z.string().min(1),
 	eventUrl: z.string().url(),
 	gitCredentialsSecretName: z.string().min(1),
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
-	opencodeAuthSecretName: z.string().min(1),
+	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();

package/dist/moka-submit.d.ts

@@ -1,17 +1,18 @@
 import { PipelineConfig } from "./config/schemas.js";
+import { BrokerAuthOption } from "./broker-auth.js";
 import { generateScheduleArtifact } from "./planning/generate.js";
 import { z } from "zod";
 
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -98,13 +99,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -151,6 +152,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
@@ -216,13 +222,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -269,6 +275,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
@@ -323,6 +334,7 @@ interface SubmitMokaDependencies {
   submitWorkflow?: (options: MokaWorkflowSubmitOptions) => Promise<MokaSubmitOutput>;
 }
 interface MokaWorkflowSubmitOptions {
+  brokerAuth?: BrokerAuthOption;
   config: PipelineConfig;
   eventAuthSecretKey?: string;
   eventAuthSecretName?: string;

package/dist/moka-submit.js

@@ -1,3 +1,4 @@
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { buildRunnerCommandPayload, runnerDeliverySchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
 import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
@@ -80,6 +81,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
@@ -305,6 +307,7 @@ function workflowSubmitOptions(options) {
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
+		brokerAuth: options.brokerAuth,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: options.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: options.serviceAccountName

package/dist/pipeline-init.js

@@ -1,9 +1,10 @@
+import { AGENT_SKILL_SOURCE } from "./agent-assets.js";
 import { installCommands } from "./install-commands.js";
 import { installHooks } from "./install-hooks.js";
 import { installRules } from "./install-rules.js";
 import { execa } from "execa";
 //#region src/pipeline-init.ts
-const DEFAULT_SKILL_INSTALL_SOURCE = "oisin-ee/skills";
+const DEFAULT_SKILL_INSTALL_SOURCE = AGENT_SKILL_SOURCE;
 const SKILL_INSTALL_AGENT_ARGS = [
 	"--agent",
 	"opencode",
@@ -84,7 +85,7 @@ function formatPipelineInitResult(result, mode = {}) {
 	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
 		copy.headline,
-		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/rules; inherited by every repo with no per-repo copy",
+		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/agent/rules; inherited by every repo with no per-repo copy",
 		...result.files.map((path) => `${copy.fileVerb} ${path}`),
 		copy.footer
 	].join("\n");

package/dist/run-state/opencode-accounts.js

@@ -1,3 +1,5 @@
+import { applyCodexBrokerProvider, applyOpencodeBrokerProvider, renderOpencodeBrokerAuthJson, resolveBrokerCredentials } from "../broker-auth.js";
+import { resolveHarnessTarget } from "../install-commands/shared.js";
 import { isRecord } from "../safe-json.js";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -21,12 +23,51 @@ const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
 	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, AUTH_FILE_NAME)
 }];
 /**
-* Copy each staged opencode credential secret to its writable live path, then
-* sync the account pool's active openai token into auth.json's openai entry.
-* Only files whose staged source exists are copied (local dev / tests / configs
-* without a given secret keep whatever store is already present).
+* Prepare codex + opencode runner credentials. In broker mode, writes the
+* broker provider config and api-key and skips the legacy pool staging. In
+* legacy mode, copies each staged secret to its writable live path and syncs
+* the pool's active openai token into auth.json.
 */
 function prepareOpencodeCredentials(options = {}) {
+	const broker = options.broker === void 0 ? resolveBrokerCredentials() : options.broker;
+	if (broker) return {
+		brokerConfigured: configureBrokerCredentials(broker, options.brokerPaths),
+		copied: [],
+		hostOpenaiTokenSynced: false
+	};
+	return {
+		brokerConfigured: [],
+		...prepareLegacyPoolCredentials(options)
+	};
+}
+function defaultBrokerConfigPaths() {
+	return {
+		codexConfigPath: resolveHarnessTarget(".codex/config.toml"),
+		opencodeAuthPath: join(homedir(), ".local", "share", "opencode", AUTH_FILE_NAME),
+		opencodeConfigPath: resolveHarnessTarget(".opencode/opencode.json")
+	};
+}
+function configureBrokerCredentials(broker, pathsOverride) {
+	const paths = pathsOverride ?? defaultBrokerConfigPaths();
+	const configured = [];
+	writeFileEnsured(paths.opencodeAuthPath, renderOpencodeBrokerAuthJson(broker), 384);
+	configured.push(basename(paths.opencodeAuthPath));
+	writeFileEnsured(paths.codexConfigPath, applyCodexBrokerProvider(readIfExists(paths.codexConfigPath), broker));
+	configured.push(basename(paths.codexConfigPath));
+	const opencodeConfig = applyOpencodeBrokerProvider(readIfExists(paths.opencodeConfigPath), broker);
+	if ("error" in opencodeConfig) throw new Error(`Cannot configure opencode broker provider: ${opencodeConfig.error}`);
+	writeFileEnsured(paths.opencodeConfigPath, opencodeConfig.content);
+	configured.push(basename(paths.opencodeConfigPath));
+	return configured;
+}
+function readIfExists(path) {
+	return existsSync(path) ? readFileSync(path, "utf8") : void 0;
+}
+function writeFileEnsured(path, content, mode) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, content, mode === void 0 ? void 0 : { mode });
+}
+function prepareLegacyPoolCredentials(options) {
 	const home = homedir();
 	const files = options.files ?? WRITABLE_OPENCODE_CREDENTIAL_FILES.map((file) => ({
 		destPath: join(home, ...file.destFromHome),

package/dist/runner-command/run.js

@@ -106,6 +106,7 @@ function runRunnerCommandEffect(options, runtime) {
 		}, "opencode.credentials.prepare start");
 		const credentialsPrep = yield* io.prepareOpencodeCredentials();
 		logger.info({
+			brokerConfigured: credentialsPrep.brokerConfigured,
 			copied: credentialsPrep.copied,
 			hostOpenaiTokenSynced: credentialsPrep.hostOpenaiTokenSynced,
 			phase: "opencode.credentials.prepare",

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -256,8 +256,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -303,10 +303,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runtime/opencode-session-executor.js

@@ -29,14 +29,10 @@ function executeOpencodeSession(deps, plan, options) {
 function boundByAgentTimeout(plan) {
 	return (effect) => {
 		const timeoutMs = plan.timeoutMs;
-		process.stderr.write(`[agent-timeout] wired nodeId=${plan.nodeId} timeoutMs=${String(timeoutMs)}\n`);
 		if (!timeoutMs || timeoutMs <= 0) return effect;
 		return Effect.timeoutFail(Effect.disconnect(effect), {
 			duration: Duration.millis(timeoutMs),
-			onTimeout: () => {
-				process.stderr.write(`[agent-timeout] FIRED nodeId=${plan.nodeId} after ${timeoutMs}ms\n`);
-				return /* @__PURE__ */ new Error(`agent session timed out after ${timeoutMs}ms`);
-			}
+			onTimeout: () => /* @__PURE__ */ new Error(`agent session timed out after ${timeoutMs}ms`)
 		});
 	};
 }

package/docs/config-architecture.md

@@ -152,7 +152,7 @@ receive explicit grants:
 - `output`: text, JSON, JSONL, or JSON Schema output.
 
 Default skills resolve from project-installed skill files created by
-`moka init` via `npx --yes skills add oisin-ee/skills`:
+`moka init` via `npx --yes skills add oisin-ee/agent/skills`:
 
 ```yaml
 skills:
@@ -164,14 +164,13 @@ Project-authored skill and rule paths resolve from the project root and must
 exist for runtime use. If default skill files are missing, run `moka init` to
 install them before executing workflows.
 
-Default agent hooks are copied by `moka init` from the private
-`oisin-ee/agent-hooks` repository. That source repository has one canonical
-host-level layout:
+Default agent hooks are copied by `moka init` from private `oisin-ee/agent`.
+That source repository has one canonical hook layout:
 
 ```text
-claude-code/
-codex/
-opencode/
+hooks/claude-code/
+hooks/codex/
+hooks/opencode/
 ```
 
 Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
@@ -215,7 +214,7 @@ OpenCode host resources are generated from the same profile registry:
 - `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
   generates agents, commands, plugins, and project config.
 - Additional manually authored OpenCode hook plugins can be copied from
-  `oisin-ee/agent-hooks/opencode/` by `moka init`.
+  `oisin-ee/agent/hooks/opencode/` by `moka init`.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and

package/docs/mcp-gateway.md

@@ -128,3 +128,45 @@ The package-owned MCP inventory exposed through the ecosystem manifest includes
 Backlog, GitHub, and Neon. Repo-scoped backends must bind to
 `PIPELINE_TARGET_PATH` or the current workspace path supplied by the gateway
 configuration.
+
+## Browser automation backend (Steel)
+
+The `Playwright` backend's tools (`playwright_browser_*`) are served by a
+self-hosted **Steel Browser** (Chromium) pool, not a browser launched inside the
+MCP pod. Microsoft's `@playwright/mcp` connects to Steel over CDP, so the tool
+surface is unchanged — agents keep calling the same `playwright_browser_*` tools
+through `pipeline-gateway`.
+
+Topology (infra repo, `k8s/charts/pipeline-mcp-gateway`):
+
+- A StatefulSet of N backend pods (`playwright.backendReplicas`, default 3). Each
+  pod is `mcp` (`@playwright/mcp`) + a private `steel` sidecar (its own Chrome on
+  `localhost:3000`) + an `auth-seed` native sidecar. One pod = one isolated,
+  verify-bot-authenticated browser.
+- Auth: the seed runs a real headless Zitadel login and POSTs the session into
+  the pod's Steel (`POST /v1/sessions`); the pod stays NotReady until the first
+  seed lands (fail-closed — an unauthenticated browser is never served) and
+  re-seeds every ~3 days, inside the oauth2-proxy 7-day cookie window.
+
+Usage:
+
+- **One authenticated browser (default).** Call `playwright_browser_*` through
+  `pipeline-gateway` (`https://pipeline-mcp.momokaya.ee/mcp/`). You get a single,
+  pre-authenticated browser. After a gateway backend restart the vMCP client
+  session can drop — reconnect the MCP client (do not bounce pods).
+- **N concurrent isolated browsers.** The single gateway/proxy endpoint does
+  **not** auto-distribute sessions across the pool — toolhive pins every session
+  to one backend pod (Redis session storage and scaling proxy replicas do not
+  change this). To use the pool concurrently, address the backend pods directly:
+  each pod's `@playwright/mcp` listens on port `8931` and is a full
+  `playwright_browser_*` endpoint (`http://<pod-ip-or-headless-dns>:8931/mcp`).
+  Proven: 3 concurrent per-pod sessions, each on a distinct authenticated
+  browser.
+- Scale the pool with `playwright.backendReplicas`.
+
+Operational notes: Steel runs as root in-pod (its bundled nginx requires it,
+otherwise `nginx [emerg] chown(/var/lib/nginx/body) Operation not permitted`);
+health is `GET /v1/health`; on ARM nodes set `SKIP_FINGERPRINT_INJECTION=true`;
+CDP over a service-DNS host needs `--cdp-header "Host: localhost"` (Chrome's
+anti-DNS-rebinding check), but the in-pod `localhost:3000` path needs no header.
+See infra `INFRA-074`.

package/docs/operator-guide.md

@@ -177,8 +177,8 @@ OpenBao, publish Secret values, or mutate ESO resources from this package.
 
 Installs or refreshes the whole per-machine harness in one command: the
 package's default skills, generated host-native command surfaces and MCP
-entries, copied agent hooks from the private `oisin-ee/agent-hooks` repository,
-and global instruction files generated via rulesync from `oisin-ee/rules`.
+entries, copied agent hooks from private `oisin-ee/agent/hooks`, and global
+instruction files generated via rulesync from `oisin-ee/agent/rules`.
 OpenCode is the package default runtime. The harness is always installed
 globally (`~/.claude`, `~/.config/opencode`, `~/.codex`); there is no `--scope`.
 `moka init` does not create repo-local `.pipeline` config files.
@@ -192,12 +192,10 @@ moka init --force     # overwrite manually edited harness files
 
 `--check` and `--dry-run` write nothing and skip the network skill install.
 By default `moka init` refuses to overwrite manually edited hook or command
-files; `--force` overwrites them. For agent hooks, Moka clones
-`oisin-ee/agent-hooks`, copies files, and tracks installed hashes so later runs
-update unchanged owned files, delete removed owned files, and (without `--force`)
-refuse to clobber manual edits. The hook source repository has only host folders
-(`claude-code/`, `codex/`, `opencode/`); there is no source override flag and no
-symlink mode.
+files; `--force` overwrites them. For agent hooks, Moka clones `oisin-ee/agent`,
+copies files from `hooks/<host>`, and tracks installed hashes so later runs update
+unchanged owned files, delete removed owned files, and (without `--force`) refuse
+to clobber manual edits. There is no source override flag and no symlink mode.
 
 Use `PIPELINE_TARGET_PATH=/path/to/repo` when invoking `moka` from outside the
 target worktree.
@@ -384,9 +382,9 @@ Claude Code: /moka-quick, /moka-execute, /moka-inspect
 - `.opencode/opencode.json` with LSP, the singleton `pipeline-gateway` MCP
   server, and pinned package-selected plugins
 
-`moka init` also copies hook files from `oisin-ee/agent-hooks` by overlaying
-`opencode/`, `claude-code/`, and `codex/` onto the host config roots. Hook files
-are authored in the hook repo, not generated by Moka.
+`moka init` also copies hook files from `oisin-ee/agent/hooks` by overlaying
+`hooks/opencode/`, `hooks/claude-code/`, and `hooks/codex/` onto the host config
+roots. Hook files are authored in the agent asset repo, not generated by Moka.
 
 For Claude Code, `moka init` generates `.claude/commands/moka-<entrypoint>.md`
 slash commands.

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.12.3",
+  "version": "3.13.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",