@oisincoveney/pipeline 3.12.4 → 3.14.0

package/defaults/opencode-ecosystem.yaml

@@ -59,15 +59,6 @@ ecosystem_code:
     role: long-running goal mode with /goal slash command, persistent state, evidence-gated completion, and TUI sidebar
     default_stack: true
     source: https://www.npmjs.com/package/@prevalentware/opencode-goal-plugin
-  - id: oc-codex-multi-auth
-    name: oc-codex-multi-auth
-    package: oc-codex-multi-auth
-    plugin:
-      kind: npm
-      package: oc-codex-multi-auth@6.3.2
-    role: ChatGPT Plus/Pro OAuth with multi-account rotation, health checks, and Codex/GPT-5 routing for OpenCode
-    default_stack: true
-    source: https://github.com/ndycode/oc-codex-multi-auth
   - id: opencode-snip
     name: opencode-snip
     role: prompt snippet and command-discipline helper patterns
@@ -86,9 +77,8 @@ ecosystem_code:
 # Reasoning effort is no longer expressed as synthetic per-effort model ids.
 # Pipeline config carries `reasoning_effort` as data on each node/profile and the
 # runner applies it as the opencode model variant (`--variant` / prompt body
-# `variant`) for the selected GPT-5 model. The oc-codex-multi-auth plugin owns
-# the base-model templates and the Codex request options (store:false,
-# reasoning.encrypted_content), so moka registers no provider models here.
+# `variant`) for the selected GPT-5 model. Broker auth owns Codex request
+# options, so moka registers no provider models here.
 mcp_backends:
   - id: pipeline-gateway
     locality: project-remote

package/defaults/pipeline.yaml

@@ -11,10 +11,6 @@ context_handoff:
 # seeded by the node's task + handoff artifacts, within token_budget.
 repo_map:
   enabled: true
-# durability: journal each terminal node result so a killed run resumes from the
-# last passed node without re-running (or re-spending tokens on) finished work.
-durability:
-  enabled: true
 # parallel_worktrees: opt-in git-worktree isolation for parallel child nodes —
 # each parallel child runs on its own branch with its own per-worktree opencode
 # server so concurrent edits and sessions can't collide. OFF by default; enable

package/dist/argo-submit.d.ts

@@ -20,8 +20,11 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
-  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
+  brokerAuth: z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -1,4 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
+import { brokerAuthOptionSchema } from "./broker-auth.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
 import { buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } from "./argo-workflow.js";
@@ -38,8 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
-	opencodeAuthSecretName: z.string().min(1).optional(),
-	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
+	brokerAuth: brokerAuthOptionSchema,
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -89,8 +89,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
-		opencodeAuthSecretName: options.opencodeAuthSecretName,
-		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
+		brokerAuth: options.brokerAuth,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/argo-workflow.d.ts

@@ -27,10 +27,18 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
       container: z.ZodOptional<z.ZodObject<{
         args: z.ZodArray<z.ZodString>;
         command: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        env: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        env: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
           name: z.ZodString;
           value: z.ZodString;
-        }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+          name: z.ZodString;
+          valueFrom: z.ZodObject<{
+            secretKeyRef: z.ZodObject<{
+              key: z.ZodString;
+              name: z.ZodString;
+            }, z.core.$strict>;
+          }, z.core.$strict>;
+        }, z.core.$strict>]>>>;
         image: z.ZodString;
         imagePullPolicy: z.ZodEnum<{
           Always: "Always";
@@ -137,11 +145,11 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
-  opencodeOpenaiAccountsSecret: z.ZodOptional<z.ZodObject<{
-    key: z.ZodOptional<z.ZodString>;
-    name: z.ZodString;
-  }, z.core.$strict>>;
+  brokerAuth: z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{

package/dist/argo-workflow.js

@@ -1,5 +1,4 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -27,6 +26,10 @@ const RUNNER_OPENCODE_ENV = [
 		name: "PIPELINE_AGENT_TIMEOUT_MS",
 		value: "600000"
 	},
+	{
+		name: "PIPELINE_AGENT_IDLE_TIMEOUT_MS",
+		value: "180000"
+	},
 	{
 		name: "PIPELINE_DISABLED_MODELS",
 		value: "opencode-go/qwen3.7-max"
@@ -92,14 +95,21 @@ const argoWorkflowRetryStrategySchema = z.object({
 		"OnTransientError"
 	])
 }).strict();
+const argoWorkflowEnvVarSchema = z.union([z.object({
+	name: z.string().min(1),
+	value: z.string()
+}).strict(), z.object({
+	name: z.string().min(1),
+	valueFrom: z.object({ secretKeyRef: z.object({
+		key: z.string().min(1),
+		name: kubernetesNameSchema
+	}).strict() }).strict()
+}).strict()]);
 const argoWorkflowTemplateSchema = z.object({
 	container: z.object({
 		args: z.array(z.string().min(1)).min(1),
 		command: z.array(z.string().min(1)).min(1).optional(),
-		env: z.array(z.object({
-			name: z.string().min(1),
-			value: z.string()
-		}).strict()).optional(),
+		env: z.array(argoWorkflowEnvVarSchema).optional(),
 		image: z.string().min(1),
 		imagePullPolicy: z.enum([
 			"Always",
@@ -169,11 +179,11 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
-	opencodeAuthSecretName: kubernetesNameSchema.optional(),
-	opencodeOpenaiAccountsSecret: z.object({
-		key: z.string().min(1).optional(),
-		name: kubernetesNameSchema
-	}).strict().optional(),
+	brokerAuth: z.object({
+		secretKey: z.string().min(1).default("api-key"),
+		secretName: kubernetesNameSchema,
+		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
+	}).strict(),
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
 	payloadConfigMapName: kubernetesNameSchema,
 	resources: argoWorkflowResourceRequirementsSchema.optional(),
@@ -300,43 +310,6 @@ function runnerWorkflowStorage(options, tasks) {
 			readOnly: true
 		});
 	}
-	if (options.opencodeAuthSecretName) {
-		volumes.push({
-			name: "opencode-auth",
-			secret: {
-				defaultMode: 256,
-				items: [{
-					key: "auth.json",
-					path: "auth.json"
-				}],
-				secretName: options.opencodeAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: OPENCODE_AUTH_STAGING_DIR,
-			name: "opencode-auth",
-			readOnly: true
-		});
-	}
-	if (options.opencodeOpenaiAccountsSecret) {
-		const accountsKey = options.opencodeOpenaiAccountsSecret.key ?? "accounts.json";
-		volumes.push({
-			name: "opencode-openai-accounts",
-			secret: {
-				defaultMode: 256,
-				items: [{
-					key: accountsKey,
-					path: "accounts.json"
-				}],
-				secretName: options.opencodeOpenaiAccountsSecret.name
-			}
-		});
-		volumeMounts.push({
-			mountPath: OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR,
-			name: "opencode-openai-accounts",
-			readOnly: true
-		});
-	}
 	if (options.gitCredentialsSecretName) {
 		volumes.push({
 			name: "runner-git-credentials",
@@ -374,6 +347,35 @@ function runnerWorkflowStorage(options, tasks) {
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+/**
+* The runner container env: static opencode/agent tuning plus BROKER_URL
+* (literal) and BROKER_API_KEY (sourced from the broker secret key, never
+* inlined into the manifest).
+*/
+function runnerContainerEnv(options) {
+	return [
+		...RUNNER_OPENCODE_ENV,
+		{
+			name: "BROKER_URL",
+			value: options.brokerAuth.url
+		},
+		{
+			name: "PIPELINE_BROKER_SECRET_NAME",
+			value: options.brokerAuth.secretName
+		},
+		{
+			name: "PIPELINE_BROKER_SECRET_KEY",
+			value: options.brokerAuth.secretKey
+		},
+		{
+			name: "BROKER_API_KEY",
+			valueFrom: { secretKeyRef: {
+				key: options.brokerAuth.secretKey,
+				name: options.brokerAuth.secretName
+			} }
+		}
+	];
+}
 function runnerLifecycleTemplate(options, volumeMounts) {
 	return {
 		container: {
@@ -387,7 +389,7 @@ function runnerLifecycleTemplate(options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -416,7 +418,7 @@ function runnerCommandTemplate(task, options, volumeMounts) {
 				RUNNER_WORKFLOW_SCHEDULE_PATH
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",
@@ -441,7 +443,7 @@ function runnerFinalizerTemplate(options, volumeMounts) {
 				"{{workflow.status}}"
 			],
 			command: ["moka"],
-			env: [...RUNNER_OPENCODE_ENV],
+			env: runnerContainerEnv(options),
 			image: options.image,
 			imagePullPolicy: options.imagePullPolicy,
 			name: "runner",

package/dist/broker-auth.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+//#region src/broker-auth.d.ts
+/**
+ * Submit-time broker auth options: the runner sources BROKER_API_KEY from
+ * `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+ * entrypoint so the broker wiring is declared in exactly one place.
+ */
+declare const brokerAuthOptionSchema: z.ZodObject<{
+  secretKey: z.ZodDefault<z.ZodString>;
+  secretName: z.ZodString;
+  url: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+type BrokerAuthOption = z.input<typeof brokerAuthOptionSchema>;
+//#endregion
+export { BrokerAuthOption };

package/dist/broker-auth.js

@@ -0,0 +1,173 @@
+import { applyJsonEdit, ensureTrailingNewline, formatJson, parseJsonRecord } from "./json-config-merge.js";
+import { z } from "zod";
+//#region src/broker-auth.ts
+/**
+* Central CLIProxyAPI broker auth for codex + opencode.
+*
+* When `BROKER_API_KEY` is present, codex and opencode authenticate through the
+* central broker (an OpenAI-compatible `/v1` endpoint) instead of materializing
+* the bespoke multi-auth account pool. The broker owns OAuth refresh / rotation
+* / failover, so the runner no longer stages `oc-codex-multi-auth` accounts, the
+* mounted `~/.codex/auth.json`, or the multi-auth opencode plugin.
+*
+* This mirrors the proven coder dev-workspace template
+* (infra: coder-templates/dev-workspace/main.tf):
+*   - codex  ~/.codex/config.toml: `model_provider = "broker"` +
+*     `[model_providers.broker]` base_url=<broker>/v1 env_key=BROKER_API_KEY
+*     wire_api="responses".
+*   - opencode global config: `provider.openai.options.baseURL=<broker>/v1`
+*     plus `store=false` and `include=["reasoning.encrypted_content"]` (required
+*     by the Codex/Responses backend the broker fronts).
+*   - opencode auth store: `{"openai":{"type":"api","key":<BROKER_API_KEY>}}`.
+*/
+const BROKER_API_KEY_ENV = "BROKER_API_KEY";
+const BROKER_URL_ENV = "BROKER_URL";
+const DEFAULT_BROKER_URL = "https://cliproxy.momokaya.ee";
+const TRAILING_SLASH_RE = /\/+$/;
+const CODEX_BROKER_PROVIDER_ID = "broker";
+const OPENCODE_OPENAI_PROVIDER_ID = "openai";
+/** Plugin removed from opencode config in broker mode (broker fronts auth). */
+const OC_CODEX_MULTI_AUTH_PLUGIN_NAME = "oc-codex-multi-auth";
+/**
+* Submit-time broker auth options: the runner sources BROKER_API_KEY from
+* `secretName[secretKey]` and BROKER_URL from `url`. Shared by every submit
+* entrypoint so the broker wiring is declared in exactly one place.
+*/
+const brokerAuthOptionSchema = z.object({
+	secretKey: z.string().min(1).default("api-key"),
+	secretName: z.string().min(1),
+	url: z.string().min(1).default(DEFAULT_BROKER_URL)
+}).strict();
+/**
+* Resolve broker credentials from the environment, or `undefined` when a
+* non-runner caller has not supplied broker auth. Remote runner manifests always
+* inject BROKER_API_KEY. The `BROKER_URL` env is optional and defaults to the
+* production broker origin.
+*/
+function resolveBrokerCredentials(env = process.env) {
+	const apiKey = env[BROKER_API_KEY_ENV];
+	if (apiKey === void 0 || apiKey.length === 0) return;
+	const rawUrl = env[BROKER_URL_ENV];
+	return {
+		apiKey,
+		baseUrl: rawUrl !== void 0 && rawUrl.length > 0 ? rawUrl.replace(TRAILING_SLASH_RE, "") : DEFAULT_BROKER_URL
+	};
+}
+/** The broker's OpenAI-compatible endpoint (`<baseUrl>/v1`). */
+function brokerV1Url(credentials) {
+	return `${credentials.baseUrl}/v1`;
+}
+/**
+* opencode host auth store contents for broker mode — the `openai` provider
+* authenticates with the broker api-key. Other providers in an existing store
+* are intentionally NOT preserved here: in broker mode the runner owns this
+* file outright (the multi-auth pool that previously populated it is gone).
+*/
+function renderOpencodeBrokerAuthJson(credentials) {
+	return formatJson({ [OPENCODE_OPENAI_PROVIDER_ID]: {
+		key: credentials.apiKey,
+		type: "api"
+	} });
+}
+/**
+* Inject the codex broker model provider into an existing `config.toml`,
+* preserving every other section. Idempotent: re-running replaces the
+* `[model_providers.broker]` block and the top-level `model_provider` key.
+*/
+function applyCodexBrokerProvider(currentText, credentials) {
+	const withoutProvider = removeCodexBrokerSections(currentText ?? "");
+	const projection = renderCodexBrokerProvider(credentials);
+	return ensureTrailingNewline([withoutProvider.trimEnd(), projection.trimEnd()].filter(Boolean).join("\n\n"));
+}
+function renderCodexBrokerProvider(credentials) {
+	return [
+		`model_provider = "${CODEX_BROKER_PROVIDER_ID}"`,
+		"",
+		`[model_providers.${CODEX_BROKER_PROVIDER_ID}]`,
+		`name = "${CODEX_BROKER_PROVIDER_ID}"`,
+		`base_url = "${brokerV1Url(credentials)}"`,
+		`env_key = "${BROKER_API_KEY_ENV}"`,
+		"wire_api = \"responses\""
+	].join("\n");
+}
+const CODEX_BROKER_SECTION_HEADER = `[model_providers.${CODEX_BROKER_PROVIDER_ID}]`;
+const CODEX_MODEL_PROVIDER_KEY_RE = /^\s*model_provider\s*=/;
+function removeCodexBrokerSections(content) {
+	const lines = content.split("\n");
+	const kept = [];
+	let removing = false;
+	for (const line of lines) {
+		if (line.trim() === CODEX_BROKER_SECTION_HEADER) {
+			removing = true;
+			continue;
+		}
+		if (removing && isTomlSectionHeader(line)) removing = false;
+		if (removing) continue;
+		if (CODEX_MODEL_PROVIDER_KEY_RE.test(line)) continue;
+		kept.push(line);
+	}
+	return kept.join("\n");
+}
+function isTomlSectionHeader(line) {
+	const trimmed = line.trim();
+	return trimmed.startsWith("[") && trimmed.endsWith("]");
+}
+/**
+* Point an opencode config (global or project `opencode.json`) at the broker:
+* set `provider.openai.options.{baseURL,store,include}` and drop the
+* `oc-codex-multi-auth` plugin entry. Preserves all other config (models, mcp,
+* other plugins). Creates a minimal config when `currentText` is undefined.
+*/
+function applyOpencodeBrokerProvider(currentText, credentials) {
+	const options = {
+		baseURL: brokerV1Url(credentials),
+		include: ["reasoning.encrypted_content"],
+		store: false
+	};
+	if (currentText === void 0) return { content: formatJson({
+		$schema: "https://opencode.ai/config.json",
+		provider: { [OPENCODE_OPENAI_PROVIDER_ID]: { options } }
+	}) };
+	const parsed = parseJsonRecord(currentText);
+	if (!parsed.ok) return { error: "invalid opencode config JSON" };
+	const withProvider = applyJsonEdit(currentText, [
+		"provider",
+		OPENCODE_OPENAI_PROVIDER_ID,
+		"options"
+	], mergeOpenaiOptions(parsed.value, options));
+	const nextPlugins = pluginsWithoutMultiAuth(parsed.value.plugin);
+	return { content: ensureTrailingNewline(nextPlugins === void 0 ? withProvider : applyJsonEdit(withProvider, ["plugin"], nextPlugins)) };
+}
+function mergeOpenaiOptions(parsed, options) {
+	return {
+		...currentOpenaiOptions(parsed),
+		...options
+	};
+}
+function currentOpenaiOptions(parsed) {
+	const provider = parsed.provider;
+	if (!isRecord(provider)) return {};
+	const openai = provider[OPENCODE_OPENAI_PROVIDER_ID];
+	if (!isRecord(openai)) return {};
+	return isRecord(openai.options) ? openai.options : {};
+}
+/**
+* Return the plugin array with every `oc-codex-multi-auth` entry removed, or
+* `undefined` when there was nothing to remove (so the caller can skip the
+* edit). Handles bare-string and `[name, opts]` tuple plugin specifiers.
+*/
+function pluginsWithoutMultiAuth(plugin) {
+	if (!Array.isArray(plugin)) return;
+	const filtered = plugin.filter((entry) => !isMultiAuthPlugin(entry));
+	return filtered.length === plugin.length ? void 0 : filtered;
+}
+function isMultiAuthPlugin(entry) {
+	const specifier = Array.isArray(entry) ? entry[0] : entry;
+	if (typeof specifier !== "string") return false;
+	return (specifier.indexOf("@", 1) === -1 ? specifier : specifier.slice(0, specifier.indexOf("@", 1))) === OC_CODEX_MULTI_AUTH_PLUGIN_NAME;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { applyCodexBrokerProvider, applyOpencodeBrokerProvider, brokerAuthOptionSchema, renderOpencodeBrokerAuthJson, resolveBrokerCredentials };

package/dist/cli/doctor.js

@@ -1,12 +1,12 @@
 import { PipelineConfigError } from "../config/schemas.js";
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
-import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
+import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
 import { execa } from "execa";
+import { join } from "node:path";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
 const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);

package/dist/cli/program.d.ts

@@ -1,6 +1,6 @@
 import { RunEffort, RunMode, RunTarget } from "../run-control/contracts.js";
 import { RunCommand } from "./run-command.js";
-import { TicketCommandOptions } from "../commands/ticket-command.js";
+import { TicketCommandOptions } from "../commands/ticket/shared.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
 import { Effect } from "effect";
 import { Command } from "commander";