@oisincoveney/pipeline 3.13.0 → 3.14.0

package/defaults/opencode-ecosystem.yaml

@@ -59,15 +59,6 @@ ecosystem_code:
     role: long-running goal mode with /goal slash command, persistent state, evidence-gated completion, and TUI sidebar
     default_stack: true
     source: https://www.npmjs.com/package/@prevalentware/opencode-goal-plugin
-  - id: oc-codex-multi-auth
-    name: oc-codex-multi-auth
-    package: oc-codex-multi-auth
-    plugin:
-      kind: npm
-      package: oc-codex-multi-auth@6.3.2
-    role: ChatGPT Plus/Pro OAuth with multi-account rotation, health checks, and Codex/GPT-5 routing for OpenCode
-    default_stack: true
-    source: https://github.com/ndycode/oc-codex-multi-auth
   - id: opencode-snip
     name: opencode-snip
     role: prompt snippet and command-discipline helper patterns
@@ -86,9 +77,8 @@ ecosystem_code:
 # Reasoning effort is no longer expressed as synthetic per-effort model ids.
 # Pipeline config carries `reasoning_effort` as data on each node/profile and the
 # runner applies it as the opencode model variant (`--variant` / prompt body
-# `variant`) for the selected GPT-5 model. The oc-codex-multi-auth plugin owns
-# the base-model templates and the Codex request options (store:false,
-# reasoning.encrypted_content), so moka registers no provider models here.
+# `variant`) for the selected GPT-5 model. Broker auth owns Codex request
+# options, so moka registers no provider models here.
 mcp_backends:
   - id: pipeline-gateway
     locality: project-remote

package/defaults/pipeline.yaml

@@ -11,10 +11,6 @@ context_handoff:
 # seeded by the node's task + handoff artifacts, within token_budget.
 repo_map:
   enabled: true
-# durability: journal each terminal node result so a killed run resumes from the
-# last passed node without re-running (or re-spending tokens on) finished work.
-durability:
-  enabled: true
 # parallel_worktrees: opt-in git-worktree isolation for parallel child nodes —
 # each parallel child runs on its own branch with its own per-worktree opencode
 # server so concurrent edits and sessions can't collide. OFF by default; enable

package/dist/argo-submit.d.ts

@@ -20,13 +20,11 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  brokerAuth: z.ZodOptional<z.ZodObject<{
+  brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>>;
-  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
-  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -39,9 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
-	brokerAuth: brokerAuthOptionSchema.optional(),
-	opencodeAuthSecretName: z.string().min(1).optional(),
-	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
+	brokerAuth: brokerAuthOptionSchema,
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -92,8 +90,6 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		name: options.name,
 		namespace: options.namespace,
 		brokerAuth: options.brokerAuth,
-		opencodeAuthSecretName: options.opencodeAuthSecretName,
-		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/argo-workflow.d.ts

@@ -145,16 +145,11 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  brokerAuth: z.ZodOptional<z.ZodObject<{
+  brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
     url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>>;
-  opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
-  opencodeOpenaiAccountsSecret: z.ZodOptional<z.ZodObject<{
-    key: z.ZodOptional<z.ZodString>;
-    name: z.ZodString;
-  }, z.core.$strict>>;
+  }, z.core.$strict>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{

package/dist/argo-workflow.js

@@ -1,5 +1,4 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { OPENCODE_AUTH_STAGING_DIR, OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR } from "./run-state/opencode-accounts.js";
 import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
 import { stringify } from "yaml";
 import { z } from "zod";
@@ -27,6 +26,10 @@ const RUNNER_OPENCODE_ENV = [
 		name: "PIPELINE_AGENT_TIMEOUT_MS",
 		value: "600000"
 	},
+	{
+		name: "PIPELINE_AGENT_IDLE_TIMEOUT_MS",
+		value: "180000"
+	},
 	{
 		name: "PIPELINE_DISABLED_MODELS",
 		value: "opencode-go/qwen3.7-max"
@@ -180,12 +183,7 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 		secretKey: z.string().min(1).default("api-key"),
 		secretName: kubernetesNameSchema,
 		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
-	}).strict().optional(),
-	opencodeAuthSecretName: kubernetesNameSchema.optional(),
-	opencodeOpenaiAccountsSecret: z.object({
-		key: z.string().min(1).optional(),
-		name: kubernetesNameSchema
-	}).strict().optional(),
+	}).strict(),
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
 	payloadConfigMapName: kubernetesNameSchema,
 	resources: argoWorkflowResourceRequirementsSchema.optional(),
@@ -312,43 +310,6 @@ function runnerWorkflowStorage(options, tasks) {
 			readOnly: true
 		});
 	}
-	if (options.opencodeAuthSecretName) {
-		volumes.push({
-			name: "opencode-auth",
-			secret: {
-				defaultMode: 256,
-				items: [{
-					key: "auth.json",
-					path: "auth.json"
-				}],
-				secretName: options.opencodeAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: OPENCODE_AUTH_STAGING_DIR,
-			name: "opencode-auth",
-			readOnly: true
-		});
-	}
-	if (options.opencodeOpenaiAccountsSecret) {
-		const accountsKey = options.opencodeOpenaiAccountsSecret.key ?? "accounts.json";
-		volumes.push({
-			name: "opencode-openai-accounts",
-			secret: {
-				defaultMode: 256,
-				items: [{
-					key: accountsKey,
-					path: "accounts.json"
-				}],
-				secretName: options.opencodeOpenaiAccountsSecret.name
-			}
-		});
-		volumeMounts.push({
-			mountPath: OPENCODE_OPENAI_ACCOUNTS_STAGING_DIR,
-			name: "opencode-openai-accounts",
-			readOnly: true
-		});
-	}
 	if (options.gitCredentialsSecretName) {
 		volumes.push({
 			name: "runner-git-credentials",
@@ -387,18 +348,25 @@ function runnerWorkflowStorage(options, tasks) {
 	};
 }
 /**
-* The runner container env: the static opencode/agent tuning plus, when broker
-* auth is configured, BROKER_URL (literal) and BROKER_API_KEY (sourced from the
-* broker secret key, never inlined into the manifest).
+* The runner container env: static opencode/agent tuning plus BROKER_URL
+* (literal) and BROKER_API_KEY (sourced from the broker secret key, never
+* inlined into the manifest).
 */
 function runnerContainerEnv(options) {
-	if (!options.brokerAuth) return [...RUNNER_OPENCODE_ENV];
 	return [
 		...RUNNER_OPENCODE_ENV,
 		{
 			name: "BROKER_URL",
 			value: options.brokerAuth.url
 		},
+		{
+			name: "PIPELINE_BROKER_SECRET_NAME",
+			value: options.brokerAuth.secretName
+		},
+		{
+			name: "PIPELINE_BROKER_SECRET_KEY",
+			value: options.brokerAuth.secretKey
+		},
 		{
 			name: "BROKER_API_KEY",
 			valueFrom: { secretKeyRef: {

package/dist/broker-auth.js

@@ -39,9 +39,10 @@ const brokerAuthOptionSchema = z.object({
 	url: z.string().min(1).default(DEFAULT_BROKER_URL)
 }).strict();
 /**
-* Resolve broker credentials from the environment, or `undefined` when the
-* runner is not broker-authenticated (local dev, non-broker fallback). The
-* `BROKER_URL` env is optional and defaults to the production broker origin.
+* Resolve broker credentials from the environment, or `undefined` when a
+* non-runner caller has not supplied broker auth. Remote runner manifests always
+* inject BROKER_API_KEY. The `BROKER_URL` env is optional and defaults to the
+* production broker origin.
 */
 function resolveBrokerCredentials(env = process.env) {
 	const apiKey = env[BROKER_API_KEY_ENV];

package/dist/cli/doctor.js

@@ -1,12 +1,12 @@
 import { PipelineConfigError } from "../config/schemas.js";
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
-import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
+import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
 import { execa } from "execa";
+import { join } from "node:path";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
 const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);

package/dist/cli/program.d.ts

@@ -1,6 +1,6 @@
 import { RunEffort, RunMode, RunTarget } from "../run-control/contracts.js";
 import { RunCommand } from "./run-command.js";
-import { TicketCommandOptions } from "../commands/ticket-command.js";
+import { TicketCommandOptions } from "../commands/ticket/shared.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
 import { Effect } from "effect";
 import { Command } from "commander";

package/dist/cli/program.js

@@ -1,5 +1,6 @@
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
+import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { flattenNodes } from "../planning/graph.js";
 import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "../mcp/gateway.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "../runner.js";
@@ -17,9 +18,8 @@ import { registerTicketCommand } from "../commands/ticket-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
 import { parseLoopFlags, runLoopSubmit } from "../loop/loop-command.js";
 import { runLoopControllerEntrypoint } from "../loop/loop-controller-entrypoint.js";
-import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { formatPipelineInitResult, initPipelineProject } from "../pipeline-init.js";
-import { createRun, runControlStatusPaths, updateRunController } from "../run-control/store.js";
+import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { startDetachedRunController } from "../run-control/detach.js";
 import { createRunStoreRuntimeReporter } from "../run-control/runtime-reporter.js";
@@ -117,8 +117,14 @@ async function runConfiguredPipeline(rawInputs) {
 	});
 }
 async function runAndPrintPipeline(inputs) {
+	await Effect.runPromise(withRunControlStoreScoped(inputs.worktreePath, (store) => Effect.tryPromise({
+		catch: (error) => error,
+		try: () => runAndPrintPipelineWithStore(inputs, store)
+	})));
+}
+async function runAndPrintPipelineWithStore(inputs, store) {
 	const runner = inputs.pipelineRunner ?? runPipelineFromConfig;
-	const runStoreReporter = await createRunStoreReporter(inputs, createTerminalRuntimeReporter());
+	const runStoreReporter = await createRunStoreReporter(inputs, createTerminalRuntimeReporter(), store);
 	if (inputs.supervised) console.log(formatSupervisedRunFollowUp(requireRunId(inputs.runId)));
 	let result;
 	try {
@@ -144,27 +150,28 @@ async function runWithFlushedReporter(flush, run) {
 		await flush();
 	}
 }
-async function createLocalRunStoreRuntimeReporter(inputs, reporter) {
+async function createLocalRunStoreRuntimeReporter(inputs, reporter, store) {
 	const runId = requireRunId(inputs.runId);
-	await createRun({
+	await Effect.runPromise(store.createRun({
 		...resolvedRunControlOptions(inputs.runControl),
 		nodeIds: plannedRunStoreNodeIds(inputs),
-		runId,
-		workspaceRoot: inputs.worktreePath
-	});
+		runId
+	}));
 	return createRunStoreRuntimeReporter({
 		reporter,
 		runId,
+		store,
 		workspaceRoot: inputs.worktreePath
 	});
 }
-function createRunStoreReporter(inputs, reporter) {
+function createRunStoreReporter(inputs, reporter, store) {
 	if (inputs.runStoreMode === "reuse") {
 		const runId = requireRunId(inputs.runId);
 		if (inputs.supervisor) {
 			const supervisor = createRunControlSupervisor({
 				reporter,
 				runId,
+				store,
 				workspaceRoot: inputs.worktreePath
 			});
 			supervisor.start();
@@ -176,10 +183,11 @@ function createRunStoreReporter(inputs, reporter) {
 		return createRunStoreRuntimeReporter({
 			reporter,
 			runId,
+			store,
 			workspaceRoot: inputs.worktreePath
 		});
 	}
-	return createLocalRunStoreRuntimeReporter(inputs, reporter);
+	return createLocalRunStoreRuntimeReporter(inputs, reporter, store);
 }
 function requireRunId(runId) {
 	if (!runId) throw new Error("Run id is required for local run-control persistence.");
@@ -343,7 +351,7 @@ function createCliProgram(options = {}) {
 			dryRun: flags.dryRun
 		}));
 	});
-	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
+	program.command("codex-auth").description("Manage local Codex broker auth integration").command("sync-local").description("Point local dev repos' opencode openai provider at the central CLIProxyAPI broker").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
 		const result = syncLocalCodexAuth({
 			check: flags.check,
 			dryRun: flags.dryRun,
@@ -352,12 +360,7 @@ function createCliProgram(options = {}) {
 		console.log(formatCodexAuthSyncResult(result));
 		if (!result.ok) process.exitCode = 1;
 	});
-	addMokaSubmitOptions(program.command("submit").description([
-		"Submit work to Momokaya as an Argo Workflow.",
-		"Compatibility alias for `moka run \"<task>\" --target remote --effort thorough`.",
-		"Quick equivalent: `moka run \"<task>\" --target remote --effort quick`.",
-		"Command equivalent: `moka run --target remote --command -- <argv...>`."
-	].join("\n")).argument("[input...]", "task description, or command argv with --command")).action(async (input, flags) => {
+	addMokaSubmitOptions(program.command("submit").description("Submit work to Momokaya as an Argo Workflow.").argument("[input...]", "task description, or command argv with --command")).action(async (input, flags) => {
 		printMokaSubmitResult(await runMokaSubmitFromCli(input, flags));
 	});
 	registerLoopCommand(program);
@@ -407,7 +410,10 @@ function buildLoopSubmitInput(options) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 	const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 	const momokaya = loadMokaGlobalConfig()?.momokaya;
+	const brokerAuth = momokaya?.submit.brokerAuth;
+	if (!brokerAuth) throw new Error("momokaya.submit.brokerAuth is required for moka loop submit");
 	return {
+		brokerAuth,
 		config,
 		eventUrl: momokaya?.submit.eventUrl,
 		flags: parseLoopFlags(options),
@@ -415,9 +421,6 @@ function buildLoopSubmitInput(options) {
 		githubAuthSecretName: momokaya?.submit.githubAuthSecretName,
 		kubeconfigPath: momokaya?.kubernetes.kubeconfig,
 		namespace: momokaya?.kubernetes.namespace,
-		brokerAuth: momokaya?.submit.brokerAuth,
-		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
-		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: momokaya?.submit.serviceAccountName,
 		worktreePath: cwd
 	};
@@ -441,43 +444,43 @@ async function runDetachedResolvedTask(task, execution, runControl) {
 		task,
 		worktreePath
 	});
-	await createRun({
-		...resolvedRunControlOptions(runControl),
-		nodeIds: plannedRunStoreNodeIds({
-			config: prepared.config,
-			entrypoint: prepared.entrypoint,
-			runId,
-			runControl,
-			schedule: prepared.schedule,
-			task,
-			workflow: prepared.workflow,
-			worktreePath
-		}),
-		runId,
-		workspaceRoot: worktreePath
-	});
-	const launch = await startDetachedRunController({
-		entrypoint: prepared.entrypoint,
-		runId,
-		schedule: prepared.schedule,
-		task,
-		workflow: prepared.workflow,
-		workspaceRoot: worktreePath
-	});
-	await updateRunController({
-		controller: {
-			argv: launch.argv,
-			cwd: worktreePath,
-			paths: runControlStatusPaths({
+	await Effect.runPromise(withRunControlStoreScoped(worktreePath, (store) => Effect.gen(function* () {
+		yield* store.createRun({
+			...resolvedRunControlOptions(runControl),
+			nodeIds: plannedRunStoreNodeIds({
+				config: prepared.config,
+				entrypoint: prepared.entrypoint,
 				runId,
-				workspaceRoot: worktreePath
+				runControl,
+				schedule: prepared.schedule,
+				task,
+				workflow: prepared.workflow,
+				worktreePath
 			}),
-			pid: launch.pid,
-			startedAt: launch.startedAt
-		},
-		runId,
-		workspaceRoot: worktreePath
-	});
+			runId
+		});
+		const launch = yield* Effect.tryPromise({
+			catch: (error) => error,
+			try: () => startDetachedRunController({
+				entrypoint: prepared.entrypoint,
+				runId,
+				schedule: prepared.schedule,
+				task,
+				workflow: prepared.workflow,
+				workspaceRoot: worktreePath
+			})
+		});
+		yield* store.updateRunController({
+			controller: {
+				argv: launch.argv,
+				cwd: worktreePath,
+				paths: store.statusPaths({ runId }),
+				pid: launch.pid,
+				startedAt: launch.startedAt
+			},
+			runId
+		});
+	})));
 	console.log(formatDetachedRunFollowUp(runId));
 }
 async function prepareDetachedRun(input) {

package/dist/cli/submit-options.js

@@ -1,7 +1,7 @@
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
-import { submitMoka } from "../moka-submit.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
+import { submitMoka } from "../moka-submit.js";
 import { Option } from "commander";
 //#region src/cli/submit-options.ts
 function addMokaSubmitOptions(command) {
@@ -34,6 +34,7 @@ function resolveMokaEventUrl(flags, globalConfig) {
 function mokaCommonSubmitOptions(input) {
 	const momokaya = input.globalConfig?.momokaya;
 	return {
+		brokerAuth: resolveMokaBrokerAuth(input.globalConfig),
 		config: input.config,
 		delivery: { pullRequest: input.flags.openPr === true },
 		eventUrl: input.eventUrl,
@@ -48,13 +49,15 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
-		brokerAuth: momokaya?.submit.brokerAuth,
-		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
-		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};
 }
+function resolveMokaBrokerAuth(globalConfig) {
+	const brokerAuth = globalConfig?.momokaya.submit.brokerAuth;
+	if (!brokerAuth) throw new Error("momokaya.submit.brokerAuth is required for remote submit");
+	return brokerAuth;
+}
 function submitMokaCommandInput(input, flags, commonOptions) {
 	if (flags.quick || flags.schedule) throw new Error("--command cannot be combined with --quick or --schedule");
 	if (input.length === 0) throw new Error("Command argv is required when --command is set");

package/dist/cluster-doctor.js

@@ -1,16 +1,16 @@
-import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { loadMokaGlobalConfig } from "./moka-global-config.js";
+import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { Effect } from "effect";
 //#region src/cluster-doctor.ts
 const DEFAULT_NAMESPACE = "momokaya-pipeline";
 const DEFAULT_RESOURCES = {
+	brokerAuthSecretName: "broker-api-key",
 	eventAuthSecretName: "pipeline-runner-event-auth",
 	eventAuthExternalSecretName: "pipeline-runner-event-auth",
 	externalSecretRemoteRef: "agent-runtime/pipeline-runner/event-auth",
 	gitCredentialsSecretName: "oisin-bot-git-credentials",
 	githubAuthSecretName: "oisin-bot-github-auth",
 	imagePullSecretName: "ghcr-pull-secret",
-	opencodeAuthSecretName: "opencode-auth-1",
 	serviceAccountName: "pipeline-runner"
 };
 const FORBIDDEN_RE = /forbidden/i;
@@ -62,17 +62,16 @@ function clusterResources() {
 	const configured = loadMokaGlobalConfig()?.momokaya.submit;
 	return configured ? {
 		...DEFAULT_RESOURCES,
-		brokerAuthSecretName: configured.brokerAuth?.secretName,
+		brokerAuthSecretName: configured.brokerAuth?.secretName ?? DEFAULT_RESOURCES.brokerAuthSecretName,
 		eventAuthSecretName: configured.eventAuthSecretName,
 		gitCredentialsSecretName: configured.gitCredentialsSecretName,
 		githubAuthSecretName: configured.githubAuthSecretName,
 		imagePullSecretName: configured.imagePullSecretName,
-		opencodeAuthSecretName: configured.opencodeAuthSecretName ?? DEFAULT_RESOURCES.opencodeAuthSecretName,
 		serviceAccountName: configured.serviceAccountName
 	} : DEFAULT_RESOURCES;
 }
 function secretChecks(namespace, kubectlOptions, resources) {
-	const authSecretCheck = resources.brokerAuthSecretName ? [resources.brokerAuthSecretName, `Secret ${resources.brokerAuthSecretName} missing in ${namespace}; expected broker api-key mount by name.`] : [resources.opencodeAuthSecretName, `Secret ${resources.opencodeAuthSecretName} missing in ${namespace}; expected OpenCode auth mount by name.`];
+	const authSecretCheck = [resources.brokerAuthSecretName, `Secret ${resources.brokerAuthSecretName} missing in ${namespace}; expected broker api-key mount by name.`];
 	return [
 		[resources.eventAuthSecretName, eventAuthMissingDetail(namespace)],
 		[resources.imagePullSecretName, `Secret ${resources.imagePullSecretName} missing in ${namespace}; expected imagePullSecret for ghcr.io/oisin-ee/pipeline-runner.`],

package/dist/codex-auth-sync.js

@@ -1,15 +1,25 @@
 import { applyOpencodeBrokerProvider, resolveBrokerCredentials } from "./broker-auth.js";
-import { mergeOpenCodeProjectConfig } from "./opencode-project-config.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { parse } from "jsonc-parser";
 //#region src/codex-auth-sync.ts
-const CODEX_MULTI_AUTH_PLUGIN = "oc-codex-multi-auth@6.3.2";
-const GLOBAL_CODEX_AUTH_CONFIG_PATH = join(homedir(), ".opencode/openai-codex-auth-config.json");
+/**
+* Point each local dev repo's opencode openai provider at the central
+* CLIProxyAPI broker. codex + opencode authenticate through the broker
+* (which owns OAuth refresh / rotation / failover), so there is no per-project
+* account pool to declare. Requires BROKER_API_KEY in the env (or an explicit
+* `broker` override).
+*/
 function syncLocalCodexAuth(options) {
 	const broker = options.broker === void 0 ? resolveBrokerCredentials() : options.broker;
-	const items = broker ? discoverGitRepositories(options.root).map((repo) => syncProjectBrokerConfig(repo, broker, options)) : [syncGlobalPluginConfig(options.globalConfigPath ?? GLOBAL_CODEX_AUTH_CONFIG_PATH, options), ...discoverGitRepositories(options.root).map((repo) => syncProjectOpenCodeConfig(repo, options))];
+	if (!broker) return {
+		items: [{
+			action: "error",
+			message: "BROKER_API_KEY is required: codex + opencode authenticate through the central CLIProxyAPI broker.",
+			path: options.root
+		}],
+		ok: false
+	};
+	const items = discoverGitRepositories(options.root).map((repo) => syncProjectBrokerConfig(repo, broker, options));
 	const hasRequiredChanges = items.some((item) => item.action === "create" || item.action === "update");
 	const hasErrors = items.some((item) => item.action === "error");
 	const checkFailed = options.check === true && hasRequiredChanges;
@@ -26,30 +36,6 @@ function formatCodexAuthSyncResult(result) {
 	if (!result.ok) lines.push("codex-auth sync-local check failed");
 	return lines.join("\n");
 }
-function syncGlobalPluginConfig(path, options) {
-	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
-	const parsed = parseJsonObject(currentText ?? "{}");
-	if (!parsed.ok) return {
-		action: "error",
-		message: formatParseErrors(parsed.errors),
-		path
-	};
-	return writeIfChanged(path, currentText, `${JSON.stringify({
-		...parsed.value,
-		perProjectAccounts: false
-	}, null, 2)}\n`, options);
-}
-function syncProjectOpenCodeConfig(repo, options) {
-	const path = join(repo, ".opencode/opencode.json");
-	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
-	const merged = mergeOpenCodeProjectConfig(currentText, { plugin: [CODEX_MULTI_AUTH_PLUGIN] });
-	if (!merged.ok) return {
-		action: "error",
-		message: formatParseErrors(merged.errors),
-		path
-	};
-	return writeIfChanged(path, currentText, merged.content, options);
-}
 function syncProjectBrokerConfig(repo, broker, options) {
 	const path = join(repo, ".opencode/opencode.json");
 	const currentText = existsSync(path) ? readFileSync(path, "utf8") : void 0;
@@ -86,26 +72,5 @@ function isDirectory(path) {
 		return false;
 	}
 }
-function parseJsonObject(content) {
-	const errors = [];
-	const value = parse(content, errors, {
-		allowTrailingComma: true,
-		disallowComments: false
-	});
-	if (errors.length > 0 || !isRecord(value)) return {
-		errors,
-		ok: false
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function formatParseErrors(errors) {
-	return errors.length > 0 ? `invalid JSONC (${errors.length} parse error${errors.length === 1 ? "" : "s"})` : "expected a JSON object";
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 //#endregion
 export { formatCodexAuthSyncResult, syncLocalCodexAuth };