@oisincoveney/pipeline 3.12.4 → 3.13.0

package/dist/argo-submit.d.ts

@@ -20,6 +20,11 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;

package/dist/argo-submit.js

@@ -1,4 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
 import { buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } from "./argo-workflow.js";
@@ -38,6 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
@@ -89,6 +91,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		brokerAuth: options.brokerAuth,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
 		payloadConfigMapName,

package/dist/argo-workflow.d.ts

@@ -27,10 +27,18 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
       container: z.ZodOptional<z.ZodObject<{
         args: z.ZodArray<z.ZodString>;
         command: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        env: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        env: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
           name: z.ZodString;
           value: z.ZodString;
-        }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+          name: z.ZodString;
+          valueFrom: z.ZodObject<{
+            secretKeyRef: z.ZodObject<{
+              key: z.ZodString;
+              name: z.ZodString;
+            }, z.core.$strict>;
+          }, z.core.$strict>;
+        }, z.core.$strict>]>>>;
         image: z.ZodString;
         imagePullPolicy: z.ZodEnum<{
           Always: "Always";
@@ -137,6 +145,11 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecret: z.ZodOptional<z.ZodObject<{
     key: z.ZodOptional<z.ZodString>;

package/dist/argo-workflow.js

@@ -92,14 +92,21 @@ const argoWorkflowRetryStrategySchema = z.object({
 		"OnTransientError"
 	])
 }).strict();
+const argoWorkflowEnvVarSchema = z.union([z.object({
+	name: z.string().min(1),
+	value: z.string()
+}).strict(), z.object({
+	name: z.string().min(1),
+	valueFrom: z.object({ secretKeyRef: z.object({
+		key: z.string().min(1),
+		name: kubernetesNameSchema
+	}).strict() }).strict()
+}).strict()]);
 const argoWorkflowTemplateSchema = z.object({
 	container: z.object({
 		args: z.array(z.string().min(1)).min(1),
 		command: z.array(z.string().min(1)).min(1).optional(),
-		env: z.array(z.object({
-			name: z.string().min(1),
-			value: z.string()
-		}).strict()).optional(),
+		env: z.array(argoWorkflowEnvVarSchema).optional(),
 		image: z.string().min(1),
 		imagePullPolicy: z.enum([
 			"Always",
@@ -169,6 +176,11 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
+	brokerAuth: z.object({
+		secretKey: z.string().min(1).default("api-key"),
+		secretName: kubernetesNameSchema,
+		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
+	}).strict().optional(),
 	opencodeAuthSecretName: kubernetesNameSchema.optional(),
 	opencodeOpenaiAccountsSecret: z.object({
 		key: z.string().min(1).optional(),
@@ -374,6 +386,28 @@ function runnerWorkflowStorage(options, tasks) {
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+/**
+* The runner container env: the static opencode/agent tuning plus, when broker
+* auth is configured, BROKER_URL (literal) and BROKER_API_KEY (sourced from the
+* broker secret key, never inlined into the manifest).
+*/
+function runnerContainerEnv(options) {
+	if (!options.brokerAuth) return [...RUNNER_OPENCODE_ENV];
+	return [
+		...RUNNER_OPENCODE_ENV,
+		{
+			name: "BROKER_URL",
+			value: options.brokerAuth.url
+		},
+		{
+			name: "BROKER_API_KEY",
+			valueFrom: { secretKeyRef: {
+				key: options.brokerAuth.secretKey,
+				name: options.brokerAuth.secretName
+			} }
+		}
+	];
+}
 function runnerLifecycleTemplate(options, volumeMounts) {
 	return {
 		container: {
@@ -387,7 +421,7 @@ function runnerLifecycleTemplate(options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -416,7 +450,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -441,7 +475,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/broker-auth.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+//#region src/broker-auth.d.ts
+/**
+ * Submit-time broker auth options: the runner sources BROKER_API_KEY from
+ * `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+ * entrypoint so the broker wiring is declared in exactly one place.
+ */
+declare const brokerAuthOptionSchema: z.ZodObject<{
+  secretKey: z.ZodDefault<z.ZodString>;
+  secretName: z.ZodString;
+  url: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+type BrokerAuthOption = z.input<typeof brokerAuthOptionSchema>;
+//#endregion
+export { BrokerAuthOption };

package/dist/broker-auth.js

@@ -0,0 +1,172 @@
+import { applyJsonEdit, ensureTrailingNewline, formatJson, parseJsonRecord } from "./json-config-merge.js";
+import { z } from "zod";
+//#region src/broker-auth.ts
+/**
+* Central CLIProxyAPI broker auth for codex + opencode.
+*
+* When `BROKER_API_KEY` is present, codex and opencode authenticate through the
+* central broker (an OpenAI-compatible `/v1` endpoint) instead of materializing
+* the bespoke multi-auth account pool. The broker owns OAuth refresh / rotation
+* / failover, so the runner no longer stages `oc-codex-multi-auth` accounts, the
+* mounted `~/.codex/auth.json`, or the multi-auth opencode plugin.
+*
+* This mirrors the proven coder dev-workspace template
+* (infra: coder-templates/dev-workspace/main.tf):
+*   - codex  ~/.codex/config.toml: `model_provider = "broker"` +
+*     `[model_providers.broker]` base_url=<broker>/v1 env_key=BROKER_API_KEY
+*     wire_api="responses".
+*   - opencode global config: `provider.openai.options.baseURL=<broker>/v1`
+*     plus `store=false` and `include=["reasoning.encrypted_content"]` (required
+*     by the Codex/Responses backend the broker fronts).
+*   - opencode auth store: `{"openai":{"type":"api","key":<BROKER_API_KEY>}}`.
+*/
+const BROKER_API_KEY_ENV = "BROKER_API_KEY";
+const BROKER_URL_ENV = "BROKER_URL";
+const DEFAULT_BROKER_URL = "https://cliproxy.momokaya.ee";
+const TRAILING_SLASH_RE = /\/+$/;
+const CODEX_BROKER_PROVIDER_ID = "broker";
+const OPENCODE_OPENAI_PROVIDER_ID = "openai";
+/** Plugin removed from opencode config in broker mode (broker fronts auth). */
+const OC_CODEX_MULTI_AUTH_PLUGIN_NAME = "oc-codex-multi-auth";
+/**
+* Submit-time broker auth options: the runner sources BROKER_API_KEY from
+* `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+* entrypoint so the broker wiring is declared in exactly one place.
+*/
+const brokerAuthOptionSchema = z.object({
+	secretKey: z.string().min(1).default("api-key"),
+	secretName: z.string().min(1),
+	url: z.string().min(1).default(DEFAULT_BROKER_URL)
+}).strict();
+/**
+* Resolve broker credentials from the environment, or `undefined` when the
+* runner is not broker-authenticated (local dev, non-broker fallback). The
+* `BROKER_URL` env is optional and defaults to the production broker origin.
+*/
+function resolveBrokerCredentials(env = process.env) {
+	const apiKey = env[BROKER_API_KEY_ENV];
+	if (apiKey === void 0 || apiKey.length === 0) return;
+	const rawUrl = env[BROKER_URL_ENV];
+	return {
+		apiKey,
+		baseUrl: rawUrl !== void 0 && rawUrl.length > 0 ? rawUrl.replace(TRAILING_SLASH_RE, "") : DEFAULT_BROKER_URL
+	};
+}
+/** The broker's OpenAI-compatible endpoint (`<baseUrl>/v1`). */
+function brokerV1Url(credentials) {
+	return `${credentials.baseUrl}/v1`;
+}
+/**
+* opencode host auth store contents for broker mode — the `openai` provider
+* authenticates with the broker api-key. Other providers in an existing store
+* are intentionally NOT preserved here: in broker mode the runner owns this
+* file outright (the multi-auth pool that previously populated it is gone).
+*/
+function renderOpencodeBrokerAuthJson(credentials) {
+	return formatJson({ [OPENCODE_OPENAI_PROVIDER_ID]: {
+		key: credentials.apiKey,
+		type: "api"
+	} });
+}
+/**
+* Inject the codex broker model provider into an existing `config.toml`,
+* preserving every other section. Idempotent: re-running replaces the
+* `[model_providers.broker]` block and the top-level `model_provider` key.
+*/
+function applyCodexBrokerProvider(currentText, credentials) {
+	const withoutProvider = removeCodexBrokerSections(currentText ?? "");
+	const projection = renderCodexBrokerProvider(credentials);
+	return ensureTrailingNewline([withoutProvider.trimEnd(), projection.trimEnd()].filter(Boolean).join("\n\n"));
+}
+function renderCodexBrokerProvider(credentials) {
+	return [
+		`model_provider = "${CODEX_BROKER_PROVIDER_ID}"`,
+		"",
+		`[model_providers.${CODEX_BROKER_PROVIDER_ID}]`,
+		`name = "${CODEX_BROKER_PROVIDER_ID}"`,
+		`base_url = "${brokerV1Url(credentials)}"`,
+		`env_key = "${BROKER_API_KEY_ENV}"`,
+		"wire_api = \"responses\""
+	].join("\n");
+}
+const CODEX_BROKER_SECTION_HEADER = `[model_providers.${CODEX_BROKER_PROVIDER_ID}]`;
+const CODEX_MODEL_PROVIDER_KEY_RE = /^\s*model_provider\s*=/;
+function removeCodexBrokerSections(content) {
+	const lines = content.split("\n");
+	const kept = [];
+	let removing = false;
+	for (const line of lines) {
+		if (line.trim() === CODEX_BROKER_SECTION_HEADER) {
+			removing = true;
+			continue;
+		}
+		if (removing && isTomlSectionHeader(line)) removing = false;
+		if (removing) continue;
+		if (CODEX_MODEL_PROVIDER_KEY_RE.test(line)) continue;
+		kept.push(line);
+	}
+	return kept.join("\n");
+}
+function isTomlSectionHeader(line) {
+	const trimmed = line.trim();
+	return trimmed.startsWith("[") && trimmed.endsWith("]");
+}
+/**
+* Point an opencode config (global or project `opencode.json`) at the broker:
+* set `provider.openai.options.{baseURL,store,include}` and drop the
+* `oc-codex-multi-auth` plugin entry. Preserves all other config (models, mcp,
+* other plugins). Creates a minimal config when `currentText` is undefined.
+*/
+function applyOpencodeBrokerProvider(currentText, credentials) {
+	const options = {
+		baseURL: brokerV1Url(credentials),
+		include: ["reasoning.encrypted_content"],
+		store: false
+	};
+	if (currentText === void 0) return { content: formatJson({
+		$schema: "https://opencode.ai/config.json",
+		provider: { [OPENCODE_OPENAI_PROVIDER_ID]: { options } }
+	}) };
+	const parsed = parseJsonRecord(currentText);
+	if (!parsed.ok) return { error: "invalid opencode config JSON" };
+	const withProvider = applyJsonEdit(currentText, [
+		"provider",
+		OPENCODE_OPENAI_PROVIDER_ID,
+		"options"
+	], mergeOpenaiOptions(parsed.value, options));
+	const nextPlugins = pluginsWithoutMultiAuth(parsed.value.plugin);
+	return { content: ensureTrailingNewline(nextPlugins === void 0 ? withProvider : applyJsonEdit(withProvider, ["plugin"], nextPlugins)) };
+}
+function mergeOpenaiOptions(parsed, options) {
+	return {
+		...currentOpenaiOptions(parsed),
+		...options
+	};
+}
+function currentOpenaiOptions(parsed) {
+	const provider = parsed.provider;
+	if (!isRecord(provider)) return {};
+	const openai = provider[OPENCODE_OPENAI_PROVIDER_ID];
+	if (!isRecord(openai)) return {};
+	return isRecord(openai.options) ? openai.options : {};
+}
+/**
+* Return the plugin array with every `oc-codex-multi-auth` entry removed, or
+* `undefined` when there was nothing to remove (so the caller can skip the
+* edit). Handles bare-string and `[name, opts]` tuple plugin specifiers.
+*/
+function pluginsWithoutMultiAuth(plugin) {
+	if (!Array.isArray(plugin)) return;
+	const filtered = plugin.filter((entry) => !isMultiAuthPlugin(entry));
+	return filtered.length === plugin.length ? void 0 : filtered;
+}
+function isMultiAuthPlugin(entry) {
+	const specifier = Array.isArray(entry) ? entry[0] : entry;
+	if (typeof specifier !== "string") return false;
+	return (specifier.indexOf("@", 1) === -1 ? specifier : specifier.slice(0, specifier.indexOf("@", 1))) === OC_CODEX_MULTI_AUTH_PLUGIN_NAME;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { applyCodexBrokerProvider, applyOpencodeBrokerProvider, brokerAuthOptionSchema, renderOpencodeBrokerAuthJson, resolveBrokerCredentials };

package/dist/cli/program.js

@@ -415,6 +415,7 @@ function buildLoopSubmitInput(options) {
 		githubAuthSecretName: momokaya?.submit.githubAuthSecretName,
 		kubeconfigPath: momokaya?.kubernetes.kubeconfig,
 		namespace: momokaya?.kubernetes.namespace,
+		brokerAuth: momokaya?.submit.brokerAuth,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: momokaya?.submit.serviceAccountName,

package/dist/cli/submit-options.js

@@ -48,6 +48,7 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		brokerAuth: momokaya?.submit.brokerAuth,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,

package/dist/cluster-doctor.js

@@ -62,19 +62,21 @@ function clusterResources() {
 	const configured = loadMokaGlobalConfig()?.momokaya.submit;
 	return configured ? {
 		...DEFAULT_RESOURCES,
+		brokerAuthSecretName: configured.brokerAuth?.secretName,
 		eventAuthSecretName: configured.eventAuthSecretName,
 		gitCredentialsSecretName: configured.gitCredentialsSecretName,
 		githubAuthSecretName: configured.githubAuthSecretName,
 		imagePullSecretName: configured.imagePullSecretName,
-		opencodeAuthSecretName: configured.opencodeAuthSecretName,
+		opencodeAuthSecretName: configured.opencodeAuthSecretName ?? DEFAULT_RESOURCES.opencodeAuthSecretName,
 		serviceAccountName: configured.serviceAccountName
 	} : DEFAULT_RESOURCES;
 }
 function secretChecks(namespace, kubectlOptions, resources) {
+	const authSecretCheck = resources.brokerAuthSecretName ? [resources.brokerAuthSecretName, `Secret ${resources.brokerAuthSecretName} missing in ${namespace}; expected broker api-key mount by name.`] : [resources.opencodeAuthSecretName, `Secret ${resources.opencodeAuthSecretName} missing in ${namespace}; expected OpenCode auth mount by name.`];
 	return [
 		[resources.eventAuthSecretName, eventAuthMissingDetail(namespace)],
 		[resources.imagePullSecretName, `Secret ${resources.imagePullSecretName} missing in ${namespace}; expected imagePullSecret for ghcr.io/oisin-ee/pipeline-runner.`],
-		[resources.opencodeAuthSecretName, `Secret ${resources.opencodeAuthSecretName} missing in ${namespace}; expected OpenCode auth mount by name.`],
+		authSecretCheck,
 		[resources.gitCredentialsSecretName, `Secret ${resources.gitCredentialsSecretName} missing in ${namespace}; expected runner git credentials mount by name.`],
 		[resources.githubAuthSecretName, `Secret ${resources.githubAuthSecretName} missing in ${namespace}; expected GitHub auth mount by name.`]
 	].map(([name, missingDetail]) => checkNamespacedResource(`secret/${name}`, [

package/dist/codex-auth-sync.js

@@ -1,3 +1,4 @@
+import { applyOpencodeBrokerProvider, resolveBrokerCredentials } from "./broker-auth.js";
 import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -7,7 +8,8 @@ import { parse } from "jsonc-parser";
 const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";
 const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
 function syncLocalCodexAuth(options) {
-	const items = [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	const broker = options.broker === void 0 ? resolveBrokerCredentials() : options.broker;
+	const items = broker ? discoverGitRepositories(options.root).map((repo) => syncProjectBrokerConfig(repo, broker, options)) : [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
 	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
 	const hasErrors = items.some((item) => item.action === "error");
 	const checkFailed = options.check === true && hasRequiredChanges;
@@ -48,6 +50,17 @@ function syncProjectOpenCodeConfig(repo, options) {
 	};
 	return writeIfChanged(path, currentText, merged.content, options);
 }
+function syncProjectBrokerConfig(repo, broker, options) {
+	const path = join(repo, ".opencode/opencode.json");
+	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+	const result = applyOpencodeBrokerProvider(currentText, broker);
+	if ("error" in result) return {
+		action: "error",
+		message: result.error,
+		path
+	};
+	return writeIfChanged(path, currentText, result.content, options);
+}
 function writeIfChanged(path, currentText, nextText, options) {
 	if (currentText === nextText) return {
 		action: "unchanged",

package/dist/install-commands/claude-code.js

@@ -1,6 +1,6 @@
+import { CLAUDE_PROJECT_CONFIG_PATH, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost } from "./shared.js";
 import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { mergeClaudeSettings } from "../claude-settings-config.js";
-import { CLAUDE_PROJECT_CONFIG_PATH, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost } from "./shared.js";
 import { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, projectAgentsMdDefinition, resolvedHostModel } from "./opencode.js";
 //#region src/install-commands/claude-code.ts
 const CLAUDE_CODE_HOST = "claude-code";

package/dist/install-commands/opencode.js

@@ -1,3 +1,4 @@
+import { AGENTS_MD_END, AGENTS_MD_START, COMMAND_HOSTS, GENERATED_MARKER, GENERATED_TS_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries } from "./shared.js";
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST } from "../config/defaults.js";
 import { resolvePackageAssetPath } from "../package-assets.js";
 import "../config.js";
@@ -6,7 +7,6 @@ import { renderOpenCodeGatewayConfig } from "../mcp/gateway.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
 import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { mergeOpenCodeProjectConfig } from "../opencode-project-config.js";
-import { AGENTS_MD_END, AGENTS_MD_START, COMMAND_HOSTS, GENERATED_MARKER, GENERATED_TS_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries } from "./shared.js";
 import { Effect } from "effect";
 import { basename } from "node:path";
 import matter from "gray-matter";

package/dist/install-commands.js

@@ -1,10 +1,10 @@
+import { isRecord } from "./json-config-merge.js";
+import { CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, INSTALL_HOSTS, invocationForHost, resolveHarnessTarget } from "./install-commands/shared.js";
 import { loadPipelineConfig } from "./config/load.js";
 import "./config.js";
-import { isRecord } from "./json-config-merge.js";
 import { mergeClaudeUserConfig } from "./claude-user-config.js";
 import { mergeCodexConfig } from "./codex-config.js";
 import { renderClaudeGatewayUserConfig, renderCodexGatewayConfig } from "./mcp/gateway.js";
-import { CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, INSTALL_HOSTS, invocationForHost, resolveHarnessTarget } from "./install-commands/shared.js";
 import { opencodeAdapter } from "./install-commands/opencode.js";
 import { claudeCodeAdapter } from "./install-commands/claude-code.js";
 import { existsSync, readFileSync, statSync } from "node:fs";

package/dist/install-hooks.js

@@ -1,6 +1,6 @@
 import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
-import { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR } from "./agent-assets.js";
 import { resolveHarnessTarget } from "./install-commands/shared.js";
+import { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR } from "./agent-assets.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";

package/dist/loop/loop-command.js

@@ -80,6 +80,7 @@ function loopControllerSubmitInput(input) {
 		image: input.image,
 		kubeconfigPath: input.kubeconfigPath,
 		namespace: input.namespace,
+		brokerAuth: input.brokerAuth,
 		opencodeAuthSecretName: input.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: input.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.serviceAccountName,

package/dist/moka-global-config.d.ts

@@ -9,13 +9,18 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       namespace: z.ZodString;
     }, z.core.$strict>;
     submit: z.ZodObject<{
+      brokerAuth: z.ZodOptional<z.ZodObject<{
+        secretKey: z.ZodDefault<z.ZodString>;
+        secretName: z.ZodString;
+        url: z.ZodDefault<z.ZodString>;
+      }, z.core.$strict>>;
       eventAuthSecretKey: z.ZodString;
       eventAuthSecretName: z.ZodString;
       eventUrl: z.ZodString;
       gitCredentialsSecretName: z.ZodString;
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
-      opencodeAuthSecretName: z.ZodString;
+      opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
       opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -1,3 +1,4 @@
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { PipelineConfigError } from "./config/schemas.js";
 import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-service.js";
 import "./config.js";
@@ -8,13 +9,14 @@ import { join } from "node:path";
 //#region src/moka-global-config.ts
 const MOKA_GLOBAL_CONFIG_PATH = ".config/moka/config.yaml";
 const mokaSubmitGlobalConfigSchema = z.object({
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1),
 	eventAuthSecretName: z.string().min(1),
 	eventUrl: z.string().url(),
 	gitCredentialsSecretName: z.string().min(1),
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
-	opencodeAuthSecretName: z.string().min(1),
+	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();

package/dist/moka-submit.d.ts

@@ -1,4 +1,5 @@
 import { PipelineConfig } from "./config/schemas.js";
+import { BrokerAuthOption } from "./broker-auth.js";
 import { generateScheduleArtifact } from "./planning/generate.js";
 import { z } from "zod";
 
@@ -151,6 +152,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
@@ -269,6 +275,11 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  brokerAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
   opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
@@ -323,6 +334,7 @@ interface SubmitMokaDependencies {
   submitWorkflow?: (options: MokaWorkflowSubmitOptions) => Promise<MokaSubmitOutput>;
 }
 interface MokaWorkflowSubmitOptions {
+  brokerAuth?: BrokerAuthOption;
   config: PipelineConfig;
   eventAuthSecretKey?: string;
   eventAuthSecretName?: string;

package/dist/moka-submit.js

@@ -1,3 +1,4 @@
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { buildRunnerCommandPayload, runnerDeliverySchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
 import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
@@ -80,6 +81,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
+	brokerAuth: brokerAuthOptionSchema.optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
 	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
@@ -305,6 +307,7 @@ function workflowSubmitOptions(options) {
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
+		brokerAuth: options.brokerAuth,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
 		opencodeOpenaiAccountsSecretName: options.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: options.serviceAccountName

package/dist/run-state/opencode-accounts.js

@@ -1,3 +1,5 @@
+import { applyCodexBrokerProvider, applyOpencodeBrokerProvider, renderOpencodeBrokerAuthJson, resolveBrokerCredentials } from "../broker-auth.js";
+import { resolveHarnessTarget } from "../install-commands/shared.js";
 import { isRecord } from "../safe-json.js";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -21,12 +23,51 @@ const WRITABLE_OPENCODE_CREDENTIAL_FILES = [{
 	stagedPath: join(OPENCODE_AUTH_STAGING_DIR, AUTH_FILE_NAME)
 }];
 /**
-* Copy each staged opencode credential secret to its writable live path, then
-* sync the account pool's active openai token into auth.json's openai entry.
-* Only files whose staged source exists are copied (local dev / tests / configs
-* without a given secret keep whatever store is already present).
+* Prepare codex + opencode runner credentials. In broker mode, writes the
+* broker provider config and api-key and skips the legacy pool staging. In
+* legacy mode, copies each staged secret to its writable live path and syncs
+* the pool's active openai token into auth.json.
 */
 function prepareOpencodeCredentials(options = {}) {
+	const broker = options.broker === void 0 ? resolveBrokerCredentials() : options.broker;
+	if (broker) return {
+		brokerConfigured: configureBrokerCredentials(broker, options.brokerPaths),
+		copied: [],
+		hostOpenaiTokenSynced: false
+	};
+	return {
+		brokerConfigured: [],
+		...prepareLegacyPoolCredentials(options)
+	};
+}
+function defaultBrokerConfigPaths() {
+	return {
+		codexConfigPath: resolveHarnessTarget(".codex/config.toml"),
+		opencodeAuthPath: join(homedir(), ".local", "share", "opencode", AUTH_FILE_NAME),
+		opencodeConfigPath: resolveHarnessTarget(".opencode/opencode.json")
+	};
+}
+function configureBrokerCredentials(broker, pathsOverride) {
+	const paths = pathsOverride ?? defaultBrokerConfigPaths();
+	const configured = [];
+	writeFileEnsured(paths.opencodeAuthPath, renderOpencodeBrokerAuthJson(broker), 384);
+	configured.push(basename(paths.opencodeAuthPath));
+	writeFileEnsured(paths.codexConfigPath, applyCodexBrokerProvider(readIfExists(paths.codexConfigPath), broker));
+	configured.push(basename(paths.codexConfigPath));
+	const opencodeConfig = applyOpencodeBrokerProvider(readIfExists(paths.opencodeConfigPath), broker);
+	if ("error" in opencodeConfig) throw new Error(`Cannot configure opencode broker provider: ${opencodeConfig.error}`);
+	writeFileEnsured(paths.opencodeConfigPath, opencodeConfig.content);
+	configured.push(basename(paths.opencodeConfigPath));
+	return configured;
+}
+function readIfExists(path) {
+	return existsSync(path) ? readFileSync(path, "utf8") : void 0;
+}
+function writeFileEnsured(path, content, mode) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, content, mode === void 0 ? void 0 : { mode });
+}
+function prepareLegacyPoolCredentials(options) {
 	const home = homedir();
 	const files = options.files ?? WRITABLE_OPENCODE_CREDENTIAL_FILES.map((file) => ({
 		destPath: join(home, ...file.destFromHome),

package/dist/runner-command/run.js

@@ -106,6 +106,7 @@ function runRunnerCommandEffect(options, runtime) {
 		}, "opencode.credentials.prepare start");
 		const credentialsPrep = yield* io.prepareOpencodeCredentials();
 		logger.info({
+			brokerConfigured: credentialsPrep.brokerConfigured,
 			copied: credentialsPrep.copied,
 			hostOpenaiTokenSynced: credentialsPrep.hostOpenaiTokenSynced,
 			phase: "opencode.credentials.prepare",

package/package.json

@@ -128,7 +128,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.12.4",
+  "version": "3.13.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",