@oisincoveney/pipeline 3.15.0 → 3.15.2

package/defaults/profiles.yaml

@@ -154,6 +154,7 @@ profiles:
     runner: opencode
     scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
+    timeout_ms: 900000
     instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — if a gate flags your test, restructure the test (e.g. move restricted imports into shared support/fixture helpers) rather than suppressing it. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [test]
     mcp_servers: [pipeline-gateway]
@@ -168,6 +169,7 @@ profiles:
     runner: opencode
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
+    timeout_ms: 900000
     instructions: { inline: "Implement the smallest production change that satisfies the failing tests. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — reduce complexity by extracting helpers, remove genuinely dead code, and migrate off deprecated APIs rather than suppressing the warning. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [trace, test, fix, library-first-development]
     mcp_servers: [pipeline-gateway]

package/dist/argo-graph.js

@@ -1,5 +1,6 @@
 import { uniqueStrings } from "./strings.js";
 import { resolveExecutableDependencyIds } from "./planning/dependency-refs.js";
+import { terminalDependencyItems } from "./planning/graph.js";
 import { z } from "zod";
 import { Data } from "effect";
 //#region src/argo-graph.ts
@@ -43,10 +44,11 @@ var ArgoGraphCompiler = class {
 	}
 	compile() {
 		this.compileNodes(this.plan.topologicalOrder, []);
+		const terminalTasks = this.terminalTasks();
 		return {
-			terminalNodeIds: this.terminalTasks().map((task) => task.nodeId),
+			terminalNodeIds: terminalTasks.map((task) => task.nodeId),
 			tasks: this.tasks,
-			terminalTaskNames: this.terminalTasks().map((task) => task.taskName),
+			terminalTaskNames: terminalTasks.map((task) => task.taskName),
 			workflowId: this.plan.workflowId
 		};
 	}
@@ -92,8 +94,7 @@ var ArgoGraphCompiler = class {
 		return uniqueStrings(resolveExecutableDependencyIds(this.nodeById, nodeIds).map((id) => argoTaskName(id)));
 	}
 	terminalTasks() {
-		const dependedOn = new Set(this.tasks.flatMap((task) => task.dependencies));
-		return this.tasks.filter((task) => !dependedOn.has(task.taskName));
+		return terminalDependencyItems(this.tasks, (task) => task.taskName, (task) => task.dependencies);
 	}
 };
 function argoTaskName(nodeId) {

package/dist/cli/program.js

@@ -1,12 +1,12 @@
+import { flattenNodes } from "../planning/graph.js";
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
-import { flattenNodes } from "../planning/graph.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "../runner.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "../planning/generate.js";
 import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
-import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "../mcp/gateway.js";
+import { renderGatewayConfig } from "../mcp/gateway-config.js";
 import { generateRuntimeRunId, resolveWorkflowSelection } from "../runtime/context/context.js";
 import "../runtime/context/index.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
@@ -19,6 +19,9 @@ import { registerTicketCommand } from "../commands/ticket-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
 import { parseLoopFlags, runLoopSubmit } from "../loop/loop-command.js";
 import { runLoopControllerEntrypoint } from "../loop/loop-controller-entrypoint.js";
+import { runGatewayDoctor } from "../mcp/gateway-doctor.js";
+import { localGatewayStatus, reconcileGateway, startLocalGateway } from "../mcp/gateway-reconcile.js";
+import { configureGatewayHosts } from "../mcp/host-config.js";
 import { formatPipelineInitResult, initPipelineProject } from "../pipeline-init.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { startDetachedRunController } from "../run-control/detach.js";

package/dist/commands/bench-command.js

@@ -2,7 +2,7 @@ import { buildEvalReport, renderEvalReport } from "../bench/eval-report.js";
 import { Context, Effect, Layer } from "effect";
 import { readFileSync } from "node:fs";
 //#region src/commands/bench-command.ts
-var BenchCommandService = class extends Context.Tag("BenchCommandService")() {};
+var BenchCommandService = class extends Context.Service()("BenchCommandService") {};
 const BenchCommandServiceLive = Layer.succeed(BenchCommandService, {
 	readResults: (path) => Effect.try(() => JSON.parse(readFileSync(path, "utf8"))),
 	writeReport: (report) => Effect.try(() => process.stdout.write(`${report}\n`))

package/dist/commands/pipeline-command.js

@@ -12,7 +12,7 @@ const BUILTIN_PIPE_COMMANDS = new Set([
 	"runner-command",
 	"ticket"
 ]);
-var EntrypointCommandService = class extends Context.Tag("EntrypointCommandService")() {};
+var EntrypointCommandService = class extends Context.Service()("EntrypointCommandService") {};
 const createEntrypointCommandServiceLive = (runEntrypoint) => Layer.succeed(EntrypointCommandService, { runEntrypoint: (entrypoint, task, opts) => Effect.tryPromise({
 	catch: (error) => error,
 	try: () => runEntrypoint(entrypoint, task, opts)

package/dist/commands/runner-command-command.js

@@ -3,7 +3,7 @@ import { runRunnerFinalize } from "../runner-command/finalize.js";
 import { runRunnerLifecycle } from "../runner-command/lifecycle.js";
 import { Context, Effect, Layer } from "effect";
 //#region src/commands/runner-command-command.ts
-var RunnerCommandService = class extends Context.Tag("RunnerCommandService")() {};
+var RunnerCommandService = class extends Context.Service()("RunnerCommandService") {};
 const RunnerCommandServiceLive = Layer.succeed(RunnerCommandService, {
 	finalize: (options) => Effect.tryPromise({
 		catch: (error) => error,

package/dist/commands/ticket/create.js

@@ -1,7 +1,8 @@
 import { parseTicketPlanEffect } from "../../tickets/ticket-plan.js";
 import { loadPipelineConfig } from "../../config/load.js";
 import "../../config.js";
-import { createRunnerLaunchPlan, runLaunchPlan } from "../../runner.js";
+import { createRunnerLaunchPlan } from "../../runner.js";
+import { runLaunchPlan } from "../../runner/subprocess.js";
 import { normalizeRunnerOutput } from "../../runner-output.js";
 import { BacklogServiceLive } from "../../runtime/services/backlog-service.js";
 import { TicketCommandError, currentWorktreePath, errorMessage, writeLineEffect } from "./shared.js";

package/dist/config/schema/catalog.d.ts

@@ -0,0 +1,11 @@
+//#region src/config/schema/catalog.d.ts
+declare const RUNNER_TYPES: readonly ["opencode", "command"];
+declare const NODE_KINDS: readonly ["agent", "command", "builtin", "group", "parallel"];
+declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "workflow.failure", "workflow.complete", "node.start", "node.success", "node.error", "node.finish", "gate.failure"];
+declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
+declare const SCHEDULE_BASELINES: readonly ["execute", "quick"];
+declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
+declare const MCP_GATEWAY_BACKEND_LOCALITIES: readonly ["repo-local", "repo-scoped-remote", "shared-remote"];
+declare const MCP_GATEWAY_WORKSPACE_PATH_SOURCES: readonly ["PIPELINE_TARGET_PATH", "cwd"];
+//#endregion
+export { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULING_ROLES };

package/dist/config/schema/catalog.js

@@ -0,0 +1,68 @@
+//#region src/config/schema/catalog.ts
+const ID_RE = /^[a-z][a-z0-9-]*$/;
+const REASONING_EFFORTS = [
+	"none",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+];
+const RUNNER_TYPES = ["opencode", "command"];
+const HOOK_EVENTS = [
+	"workflow.start",
+	"workflow.success",
+	"workflow.failure",
+	"workflow.complete",
+	"node.start",
+	"node.success",
+	"node.error",
+	"node.finish",
+	"gate.failure"
+];
+const TOOL_NAMES = [
+	"read",
+	"list",
+	"grep",
+	"glob",
+	"bash",
+	"edit",
+	"write",
+	"task"
+];
+const FILESYSTEM_MODES = ["read-only", "workspace-write"];
+const NETWORK_MODES = ["inherit", "disabled"];
+const OUTPUT_FORMATS = [
+	"text",
+	"json",
+	"jsonl",
+	"json_schema"
+];
+const BUILTIN_GATES = [
+	"duplication",
+	"fallow",
+	"lint",
+	"semgrep",
+	"test",
+	"typecheck"
+];
+const RETRY_REASONS = [
+	"exit_nonzero",
+	"gate_failure",
+	"timeout"
+];
+const SCHEDULE_BASELINES = ["execute", "quick"];
+const SCHEDULE_STRATEGIES = ["planner"];
+const SCHEDULING_ROLES = ["coverage", "implementation"];
+const MCP_GATEWAY_BACKEND_LOCALITIES = [
+	"repo-local",
+	"repo-scoped-remote",
+	"shared-remote"
+];
+const MCP_GATEWAY_WORKSPACE_PATH_SOURCES = ["PIPELINE_TARGET_PATH", "cwd"];
+const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
+const DEFAULT_RUNNER_COMMAND_GIT_COMMITTER = {
+	email: "git@oisin.ee",
+	name: "oisin-bot"
+};
+//#endregion
+export { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, HOOK_EVENTS, ID_RE, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NETWORK_MODES, OUTPUT_FORMATS, PIPELINE_GATEWAY_SERVER_ID, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES };

package/dist/config/schema/mcp.js

@@ -0,0 +1,90 @@
+import { MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES } from "./catalog.js";
+import { z } from "zod";
+//#region src/config/schema/mcp.ts
+const REPO_LOCAL_WORKSPACE_PATH_SOURCE_MESSAGE = [
+	"repo-local gateway backend must declare workspace_path_source",
+	"as",
+	"PIPELINE_TARGET_PATH or cwd"
+].join(" ");
+const mcpServerBaseSchema = z.object({
+	args: z.array(z.string()).optional(),
+	bearer_token_env_var: z.string().min(1).optional(),
+	command: z.string().min(1).optional(),
+	env: z.record(z.string(), z.string()).optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP server url must use http or https" }).optional()
+}).strict();
+const hasCommand = (server) => Boolean(server.command);
+const hasUrl = (server) => Boolean(server.url);
+const hasAuthorizationHeader = (server) => Object.keys(server.headers ?? {}).some((key) => key.toLowerCase() === "authorization");
+const mcpServerRefinements = [
+	{
+		message: "MCP server must declare exactly one of command or url",
+		path: (server) => hasCommand(server) ? ["url"] : ["command"],
+		violates: (server) => hasCommand(server) === hasUrl(server)
+	},
+	{
+		message: "args are only valid for command MCP servers",
+		path: () => ["args"],
+		violates: (server) => hasUrl(server) && Boolean(server.args)
+	},
+	{
+		message: "env is only valid for command MCP servers",
+		path: () => ["env"],
+		violates: (server) => hasUrl(server) && Boolean(server.env)
+	},
+	{
+		message: "headers are only valid for url MCP servers",
+		path: () => ["headers"],
+		violates: (server) => hasCommand(server) && Boolean(server.headers)
+	},
+	{
+		message: "bearer_token_env_var is only valid for url MCP servers",
+		path: () => ["bearer_token_env_var"],
+		violates: (server) => hasCommand(server) && Boolean(server.bearer_token_env_var)
+	},
+	{
+		message: "headers.Authorization cannot be combined with bearer_token_env_var",
+		path: () => ["bearer_token_env_var"],
+		violates: (server) => hasUrl(server) && Boolean(server.bearer_token_env_var) && hasAuthorizationHeader(server)
+	}
+];
+const mcpServerSchema = mcpServerBaseSchema.superRefine((server, ctx) => {
+	for (const refinement of mcpServerRefinements) if (refinement.violates(server)) ctx.addIssue({
+		code: "custom",
+		message: refinement.message,
+		path: refinement.path(server)
+	});
+});
+const mcpGatewayBackendSchema = z.object({
+	locality: z.enum(MCP_GATEWAY_BACKEND_LOCALITIES),
+	required: z.boolean().default(true),
+	tool_prefixes: z.array(z.string().min(1)).min(1),
+	workspace_path_source: z.enum(MCP_GATEWAY_WORKSPACE_PATH_SOURCES).optional()
+}).strict().superRefine((backend, ctx) => {
+	if (backend.locality === "repo-local") {
+		if (!backend.workspace_path_source) ctx.addIssue({
+			code: "custom",
+			message: REPO_LOCAL_WORKSPACE_PATH_SOURCE_MESSAGE,
+			path: ["workspace_path_source"]
+		});
+		return;
+	}
+	if (backend.workspace_path_source) ctx.addIssue({
+		code: "custom",
+		message: "workspace_path_source is only valid for repo-local gateway backends",
+		path: ["workspace_path_source"]
+	});
+});
+const mcpGatewaySchema = z.object({
+	backends: z.record(z.string(), mcpGatewayBackendSchema).default({}),
+	default_profile: z.string().min(1).optional(),
+	host_scope: z.enum(["project", "global"]).default("project"),
+	mode: z.enum(["hosted", "local"]),
+	provider: z.literal("toolhive"),
+	authorization_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_AUTHORIZATION"),
+	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP gateway url must use http or https" }).optional(),
+	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
+}).strict();
+//#endregion
+export { mcpGatewaySchema, mcpServerSchema };

package/dist/config/schema/reference-validation.js

@@ -0,0 +1,83 @@
+//#region src/config/schema/reference-validation.ts
+function validateConfigReferences(config, ctx) {
+	addConfigSchemaIssues(ctx, configReferenceIssues(config));
+}
+function configReferenceIssues(config) {
+	return [
+		...missingRegistryReferenceIssue({
+			message: (_field, value) => `default workflow '${value}' is not declared`,
+			path: ["default_workflow"],
+			registry: config.workflows,
+			value: config.default_workflow
+		}),
+		...registryReferenceIssues("entrypoints", config.entrypoints, [{
+			field: "workflow",
+			message: (entrypointId, value) => `entrypoint '${entrypointId}' references missing workflow '${value}'`,
+			read: (entrypoint) => entrypoint.workflow,
+			registry: config.workflows
+		}, {
+			field: "schedule",
+			message: (entrypointId, value) => `entrypoint '${entrypointId}' references missing schedule '${value}'`,
+			read: (entrypoint) => entrypoint.schedule,
+			registry: config.schedules
+		}]),
+		...registryReferenceIssues("schedules", config.schedules, [{
+			field: "planner_profile",
+			message: (scheduleId, value) => `schedule '${scheduleId}' references missing planner profile '${value}'`,
+			read: (schedule) => schedule.planner_profile,
+			registry: config.profiles
+		}, {
+			field: "node_catalog",
+			message: (scheduleId, value) => `schedule '${scheduleId}' references missing scheduler node catalog '${value}'`,
+			read: (schedule) => schedule.node_catalog,
+			registry: config.scheduler.node_catalogs
+		}]),
+		...registryReferenceIssues("scheduler.commands", config.scheduler.commands, [{
+			field: "catalog",
+			message: (commandId, value) => `scheduler command '${commandId}' references missing node catalog '${value}'`,
+			read: (command) => command.catalog,
+			registry: config.scheduler.node_catalogs
+		}, {
+			field: "schedule",
+			message: (commandId, value) => `scheduler command '${commandId}' references missing schedule '${value}'`,
+			read: (command) => command.schedule,
+			registry: config.schedules
+		}]),
+		...Object.entries(config.scheduler.node_catalogs).flatMap(([catalogId, catalog]) => registryReferenceIssues(`scheduler.node_catalogs.${catalogId}.nodes`, catalog.nodes, [{
+			field: "profile",
+			message: (nodeId, value) => `scheduler node '${catalogId}.${nodeId}' references missing profile '${value}'`,
+			read: (node) => node.profile,
+			registry: config.profiles
+		}]))
+	];
+}
+function registryReferenceIssues(registryPath, records, rules) {
+	return Object.entries(records).flatMap(([recordId, record]) => rules.flatMap((rule) => missingRegistryReferenceIssue({
+		message: (_field, value) => rule.message(recordId, value),
+		path: [
+			registryPath,
+			recordId,
+			rule.field
+		],
+		registry: rule.registry,
+		value: rule.read(record)
+	})));
+}
+function missingRegistryReferenceIssue({ message, path, registry, value }) {
+	return value && !Object.hasOwn(registry, value) ? [{
+		message: message(String(path.at(-1)), value),
+		path
+	}] : [];
+}
+function addConfigSchemaIssues(ctx, issues) {
+	for (const issue of issues) addConfigSchemaIssue(ctx, issue.path, issue.message);
+}
+function addConfigSchemaIssue(ctx, path, message) {
+	ctx.addIssue({
+		code: "custom",
+		path,
+		message
+	});
+}
+//#endregion
+export { validateConfigReferences };

package/dist/config/schemas.d.ts

@@ -1,14 +1,7 @@
+import { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULING_ROLES } from "./schema/catalog.js";
 import { z } from "zod";
 
 //#region src/config/schemas.d.ts
-declare const RUNNER_TYPES: readonly ["opencode", "command"];
-declare const NODE_KINDS: readonly ["agent", "command", "builtin", "group", "parallel"];
-declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "workflow.failure", "workflow.complete", "node.start", "node.success", "node.error", "node.finish", "gate.failure"];
-declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
-declare const SCHEDULE_BASELINES: readonly ["execute", "quick"];
-declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
-declare const MCP_GATEWAY_BACKEND_LOCALITIES: readonly ["repo-local", "repo-scoped-remote", "shared-remote"];
-declare const MCP_GATEWAY_WORKSPACE_PATH_SOURCES: readonly ["PIPELINE_TARGET_PATH", "cwd"];
 type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
   message: string;

package/dist/config/schemas.js

@@ -1,71 +1,10 @@
+import { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, NETWORK_MODES, OUTPUT_FORMATS, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES } from "./schema/catalog.js";
+import { mcpGatewaySchema, mcpServerSchema } from "./schema/mcp.js";
+import { validateConfigReferences } from "./schema/reference-validation.js";
 import { z } from "zod";
 import { Data } from "effect";
 //#region src/config/schemas.ts
-const ID_RE = /^[a-z][a-z0-9-]*$/;
-const reasoningEffortSchema = z.enum([
-	"none",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-const RUNNER_TYPES = ["opencode", "command"];
-const HOOK_EVENTS = [
-	"workflow.start",
-	"workflow.success",
-	"workflow.failure",
-	"workflow.complete",
-	"node.start",
-	"node.success",
-	"node.error",
-	"node.finish",
-	"gate.failure"
-];
-const TOOL_NAMES = [
-	"read",
-	"list",
-	"grep",
-	"glob",
-	"bash",
-	"edit",
-	"write",
-	"task"
-];
-const FILESYSTEM_MODES = ["read-only", "workspace-write"];
-const NETWORK_MODES = ["inherit", "disabled"];
-const OUTPUT_FORMATS = [
-	"text",
-	"json",
-	"jsonl",
-	"json_schema"
-];
-const BUILTIN_GATES = [
-	"duplication",
-	"fallow",
-	"lint",
-	"semgrep",
-	"test",
-	"typecheck"
-];
-const RETRY_REASONS = [
-	"exit_nonzero",
-	"gate_failure",
-	"timeout"
-];
-const SCHEDULE_BASELINES = ["execute", "quick"];
-const SCHEDULE_STRATEGIES = ["planner"];
-const SCHEDULING_ROLES = ["coverage", "implementation"];
-const MCP_GATEWAY_BACKEND_LOCALITIES = [
-	"repo-local",
-	"repo-scoped-remote",
-	"shared-remote"
-];
-const MCP_GATEWAY_WORKSPACE_PATH_SOURCES = ["PIPELINE_TARGET_PATH", "cwd"];
-const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
-const DEFAULT_RUNNER_COMMAND_GIT_COMMITTER = {
-	email: "git@oisin.ee",
-	name: "oisin-bot"
-};
+const reasoningEffortSchema = z.enum(REASONING_EFFORTS);
 var PipelineConfigError = class extends Data.TaggedError("PipelineConfigError") {
 	constructor(code, message, issues = []) {
 		super({
@@ -99,77 +38,6 @@ const pathRefSchema = z.object({
 	path: z.string().min(1),
 	source_root: z.enum(["package", "project"]).default("project")
 }).strict();
-const mcpServerSchema = z.object({
-	args: z.array(z.string()).optional(),
-	bearer_token_env_var: z.string().min(1).optional(),
-	command: z.string().min(1).optional(),
-	env: z.record(z.string(), z.string()).optional(),
-	headers: z.record(z.string(), z.string()).optional(),
-	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP server url must use http or https" }).optional()
-}).strict().superRefine((server, ctx) => {
-	const hasCommand = Boolean(server.command);
-	const hasUrl = Boolean(server.url);
-	if (hasCommand === hasUrl) ctx.addIssue({
-		code: "custom",
-		message: "MCP server must declare exactly one of command or url",
-		path: hasCommand ? ["url"] : ["command"]
-	});
-	if (hasUrl && server.args) ctx.addIssue({
-		code: "custom",
-		message: "args are only valid for command MCP servers",
-		path: ["args"]
-	});
-	if (hasUrl && server.env) ctx.addIssue({
-		code: "custom",
-		message: "env is only valid for command MCP servers",
-		path: ["env"]
-	});
-	if (hasCommand && server.headers) ctx.addIssue({
-		code: "custom",
-		message: "headers are only valid for url MCP servers",
-		path: ["headers"]
-	});
-	if (hasCommand && server.bearer_token_env_var) ctx.addIssue({
-		code: "custom",
-		message: "bearer_token_env_var is only valid for url MCP servers",
-		path: ["bearer_token_env_var"]
-	});
-	if (hasUrl && server.bearer_token_env_var && Object.keys(server.headers ?? {}).some((key) => key.toLowerCase() === "authorization")) ctx.addIssue({
-		code: "custom",
-		message: "headers.Authorization cannot be combined with bearer_token_env_var",
-		path: ["bearer_token_env_var"]
-	});
-});
-const mcpGatewayBackendSchema = z.object({
-	locality: z.enum(MCP_GATEWAY_BACKEND_LOCALITIES),
-	required: z.boolean().default(true),
-	tool_prefixes: z.array(z.string().min(1)).min(1),
-	workspace_path_source: z.enum(MCP_GATEWAY_WORKSPACE_PATH_SOURCES).optional()
-}).strict().superRefine((backend, ctx) => {
-	if (backend.locality === "repo-local") {
-		if (!backend.workspace_path_source) ctx.addIssue({
-			code: "custom",
-			message: "repo-local gateway backend must declare workspace_path_source as PIPELINE_TARGET_PATH or cwd",
-			path: ["workspace_path_source"]
-		});
-		return;
-	}
-	if (backend.workspace_path_source) ctx.addIssue({
-		code: "custom",
-		message: "workspace_path_source is only valid for repo-local gateway backends",
-		path: ["workspace_path_source"]
-	});
-});
-const mcpGatewaySchema = z.object({
-	backends: strictRecord(mcpGatewayBackendSchema).default({}),
-	default_profile: z.string().min(1).optional(),
-	host_scope: z.enum(["project", "global"]).default("project"),
-	mode: z.enum(["hosted", "local"]),
-	provider: z.literal("toolhive"),
-	authorization_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_AUTHORIZATION"),
-	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP gateway url must use http or https" }).optional(),
-	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
-}).strict();
 const instructionsSchema = z.object({
 	inline: z.string().min(1).optional(),
 	path: z.string().min(1).optional()
@@ -553,86 +421,6 @@ const configSchema = z.object({
 	version: z.literal(1),
 	workflows: strictRecord(workflowSchema).default({})
 }).strict().superRefine(validateConfigReferences);
-function validateConfigReferences(config, ctx) {
-	addConfigSchemaIssues(ctx, configReferenceIssues(config));
-}
-function configReferenceIssues(config) {
-	return [
-		...missingRegistryReferenceIssue({
-			message: (_field, value) => `default workflow '${value}' is not declared`,
-			path: ["default_workflow"],
-			registry: config.workflows,
-			value: config.default_workflow
-		}),
-		...registryReferenceIssues("entrypoints", config.entrypoints, [{
-			field: "workflow",
-			message: (entrypointId, value) => `entrypoint '${entrypointId}' references missing workflow '${value}'`,
-			read: (entrypoint) => "workflow" in entrypoint ? entrypoint.workflow : void 0,
-			registry: config.workflows
-		}, {
-			field: "schedule",
-			message: (entrypointId, value) => `entrypoint '${entrypointId}' references missing schedule '${value}'`,
-			read: (entrypoint) => "schedule" in entrypoint ? entrypoint.schedule : void 0,
-			registry: config.schedules
-		}]),
-		...registryReferenceIssues("schedules", config.schedules, [{
-			field: "planner_profile",
-			message: (scheduleId, value) => `schedule '${scheduleId}' references missing planner profile '${value}'`,
-			read: (schedule) => schedule.planner_profile,
-			registry: config.profiles
-		}, {
-			field: "node_catalog",
-			message: (scheduleId, value) => `schedule '${scheduleId}' references missing scheduler node catalog '${value}'`,
-			read: (schedule) => schedule.node_catalog,
-			registry: config.scheduler.node_catalogs
-		}]),
-		...registryReferenceIssues("scheduler.commands", config.scheduler.commands, [{
-			field: "catalog",
-			message: (commandId, value) => `scheduler command '${commandId}' references missing node catalog '${value}'`,
-			read: (command) => command.catalog,
-			registry: config.scheduler.node_catalogs
-		}, {
-			field: "schedule",
-			message: (commandId, value) => `scheduler command '${commandId}' references missing schedule '${value}'`,
-			read: (command) => command.schedule,
-			registry: config.schedules
-		}]),
-		...Object.entries(config.scheduler.node_catalogs).flatMap(([catalogId, catalog]) => registryReferenceIssues(`scheduler.node_catalogs.${catalogId}.nodes`, catalog.nodes, [{
-			field: "profile",
-			message: (nodeId, value) => `scheduler node '${catalogId}.${nodeId}' references missing profile '${value}'`,
-			read: (node) => node.profile,
-			registry: config.profiles
-		}]))
-	];
-}
-function registryReferenceIssues(registryPath, records, rules) {
-	return Object.entries(records).flatMap(([recordId, record]) => rules.flatMap((rule) => missingRegistryReferenceIssue({
-		message: (_field, value) => rule.message(recordId, value),
-		path: [
-			registryPath,
-			recordId,
-			rule.field
-		],
-		registry: rule.registry,
-		value: rule.read(record)
-	})));
-}
-function missingRegistryReferenceIssue({ message, path, registry, value }) {
-	return value && !Object.hasOwn(registry, value) ? [{
-		message: message(String(path.at(-1)), value),
-		path
-	}] : [];
-}
-function addConfigSchemaIssues(ctx, issues) {
-	for (const issue of issues) addConfigSchemaIssue(ctx, issue.path, issue.message);
-}
-function addConfigSchemaIssue(ctx, path, message) {
-	ctx.addIssue({
-		code: "custom",
-		path,
-		message
-	});
-}
 function validationError(issues) {
 	return new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", ["Invalid pipeline config:", ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
 }
@@ -643,4 +431,4 @@ function configIssuesFromZodError(error) {
 	}));
 }
 //#endregion
-export { HOOK_EVENTS, ID_RE, PIPELINE_GATEWAY_SERVER_ID, PipelineConfigError, configIssuesFromZodError, configSchema, pipelineFileSchema, profilesFileSchema, runnersFileSchema, validationError, workflowSchema };
+export { PipelineConfigError, configIssuesFromZodError, configSchema, pipelineFileSchema, profilesFileSchema, runnersFileSchema, validationError, workflowSchema };

package/dist/config/validate.js

@@ -1,4 +1,5 @@
-import { HOOK_EVENTS, ID_RE, PIPELINE_GATEWAY_SERVER_ID, configIssuesFromZodError, configSchema, validationError } from "./schemas.js";
+import { HOOK_EVENTS, ID_RE, PIPELINE_GATEWAY_SERVER_ID } from "./schema/catalog.js";
+import { configIssuesFromZodError, configSchema, validationError } from "./schemas.js";
 import { PACKAGE_ASSET_ROOT } from "../package-assets.js";
 import { resolveFileReference } from "../path-refs.js";
 import { standardOutputSchemaNameFromPath } from "../standard-output-schemas.js";

package/dist/install-commands/opencode.js

@@ -4,9 +4,9 @@ import "../config.js";
 import { protectedPermissionOverlay } from "../runtime/protected-paths/protected-paths.js";
 import { RepoIoService, runRepoIoSync } from "../runtime/services/repo-io-service.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
-import { renderOpenCodeGatewayConfig } from "../mcp/gateway.js";
 import { opencodeAgentName } from "../runtime/opencode-agent-name.js";
 import { AGENTS_MD_END, AGENTS_MD_START, COMMAND_HOSTS, GENERATED_MARKER, GENERATED_TS_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries } from "./shared.js";
+import { renderOpenCodeGatewayConfig } from "../mcp/host-renderers.js";
 import { mergeOpenCodeProjectConfig } from "../opencode-project-config.js";
 import { Effect } from "effect";
 import { basename } from "node:path";