@oisincoveney/pipeline 3.15.6 → 3.17.0

package/dist/argo-submit.d.ts

@@ -5,6 +5,15 @@ import { z } from "zod";
 
 //#region src/argo-submit.d.ts
 declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  brokerAuth: z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+    url: z.ZodDefault<z.ZodString>;
+  }, z.core.$strict>;
+  dbAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   eventAuthSecretKey: z.ZodOptional<z.ZodString>;
   eventAuthSecretName: z.ZodOptional<z.ZodString>;
   generateName: z.ZodOptional<z.ZodString>;
@@ -20,11 +29,6 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
-  brokerAuth: z.ZodObject<{
-    secretKey: z.ZodDefault<z.ZodString>;
-    secretName: z.ZodString;
-    url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -1,4 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
+import { dbAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
@@ -24,6 +25,8 @@ const configMapSchema = z.object({
 	}).strict()
 }).strict();
 const submitRunnerArgoWorkflowOptionsSchema = z.object({
+	brokerAuth: brokerAuthOptionSchema,
+	dbAuth: dbAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1).optional(),
 	eventAuthSecretName: z.string().min(1).optional(),
 	generateName: z.string().min(1).optional(),
@@ -39,7 +42,6 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
-	brokerAuth: brokerAuthOptionSchema,
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -78,6 +80,8 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			"pipeline.oisin.dev/ticket-project": payload.run.project,
 			"pipeline.oisin.dev/ticket-title": payload.task.title
 		} : {},
+		brokerAuth: options.brokerAuth,
+		dbAuth: options.dbAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,
@@ -89,7 +93,6 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
-		brokerAuth: options.brokerAuth,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/cli/program.js

@@ -4,13 +4,13 @@ import { registerBenchCommand } from "../commands/bench-command.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
 import { registerRunnerCommandCommand } from "../commands/runner-command-command.js";
 import { registerTicketCommand } from "../commands/ticket-command.js";
+import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { registerBootstrapCommands } from "./bootstrap-commands.js";
 import { registerLoopCommand } from "./loop-commands.js";
 import { registerMcpGatewayCommands } from "./mcp-gateway-commands.js";
 import { registerPlanCommands } from "./plan-commands.js";
 import { execute } from "./run-service.js";
-import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { printMokaSubmitResult, registerRunCommands } from "./run-commands.js";
 import { Effect } from "effect";
 import { readFileSync } from "node:fs";

package/dist/cli/run-commands.js

@@ -1,7 +1,7 @@
 import { MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, resolveMokaRun } from "./run-resolver.js";
+import { runMokaSubmitFromCli } from "./submit-options.js";
 import { dispatchMokaRunCommand } from "./run-command.js";
 import { execute, runDetachedResolvedTask, runLocalResolvedTask } from "./run-service.js";
-import { runMokaSubmitFromCli } from "./submit-options.js";
 import { Option } from "commander";
 //#region src/cli/run-commands.ts
 function registerRunCommands(program, options = {}) {

package/dist/cli/run-service.js

@@ -1,15 +1,15 @@
 import { flattenNodes } from "../planning/graph.js";
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
+import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
 import { compileWorkflowPlan } from "../planning/compile.js";
 import { generateRuntimeRunId, resolveWorkflowSelection } from "../runtime/context/context.js";
 import "../runtime/context/index.js";
-import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "../planning/generate.js";
-import { withRunControlStoreScoped } from "../run-control/run-control-store.js";
+import { compileScheduleArtifact, generateScheduleArtifactInMemory, parseScheduleArtifact } from "../planning/generate.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
+import { createRunStoreRuntimeReporter } from "../run-control/runtime-reporter.js";
 import { createTerminalRuntimeReporter, formatRuntimeFailure, formatRuntimeResult } from "./format.js";
 import { startDetachedRunController } from "../run-control/detach.js";
-import { createRunStoreRuntimeReporter } from "../run-control/runtime-reporter.js";
 import { createRunControlSupervisor } from "../run-control/supervisor.js";
 import { Effect } from "effect";
 import { readFileSync } from "node:fs";
@@ -82,14 +82,7 @@ function persistDetachedRunController(input) {
 		yield* store.createRun(detachedRunRecord(input));
 		const launch = yield* Effect.tryPromise({
 			catch: (error) => error,
-			try: () => startDetachedRunController({
-				entrypoint: input.prepared.entrypoint,
-				runId: input.runId,
-				schedule: input.prepared.schedule,
-				task: input.task,
-				workflow: input.prepared.workflow,
-				workspaceRoot: input.worktreePath
-			})
+			try: () => startDetachedRunController(detachedRunControllerInput(input))
 		});
 		yield* store.updateRunController({
 			controller: {
@@ -103,6 +96,16 @@ function persistDetachedRunController(input) {
 		});
 	})));
 }
+function detachedRunControllerInput(input) {
+	return {
+		entrypoint: input.prepared.entrypoint,
+		runId: input.runId,
+		...input.prepared.schedule ? { schedule: input.prepared.schedule } : {},
+		task: input.task,
+		workflow: input.prepared.workflow,
+		workspaceRoot: input.worktreePath
+	};
+}
 function detachedRunRecord(input) {
 	return {
 		...resolvedRunControlOptions(input.runControl),
@@ -149,16 +152,16 @@ async function runConfiguredPipeline(rawInputs) {
 			});
 			return;
 		}
-		const result = await generateScheduleArtifact({
+		const result = await generateScheduleArtifactInMemory({
 			config,
 			entrypointId: scheduledEntrypoint,
 			runId: inputs.runId,
 			task: inputs.task,
 			worktreePath: inputs.worktreePath
 		});
-		console.log(`Schedule generated: ${result.path}`);
-		const scheduleYaml = readFileSync(resolve(inputs.worktreePath, result.path), "utf8");
-		const compiled = compileScheduleArtifact(config, parseScheduleArtifact(scheduleYaml, result.path), inputs.worktreePath);
+		console.log("Schedule generated in memory");
+		const scheduleYaml = result.yaml;
+		const compiled = compileScheduleArtifact(config, parseScheduleArtifact(scheduleYaml, "schedule.yaml"), inputs.worktreePath);
 		await runAndPrintPipeline({
 			...inputs,
 			config: compiled.config,
@@ -327,20 +330,18 @@ async function prepareDetachedRun(input) {
 		entrypoint: input.execution.entrypoint,
 		workflow: input.execution.workflow
 	};
-	const result = await generateScheduleArtifact({
+	const result = await generateScheduleArtifactInMemory({
 		config: input.config,
 		entrypointId: scheduledEntrypoint,
 		runId: input.runId,
 		task: input.task,
 		worktreePath: input.worktreePath
 	});
-	console.log(`Schedule generated: ${result.path}`);
-	const schedule = resolve(input.worktreePath, result.path);
-	const scheduleYaml = readFileSync(schedule, "utf8");
-	const compiled = compileScheduleArtifact(input.config, parseScheduleArtifact(scheduleYaml, result.path), input.worktreePath);
+	console.log("Schedule generated in memory");
+	const scheduleYaml = result.yaml;
+	const compiled = compileScheduleArtifact(input.config, parseScheduleArtifact(scheduleYaml, "schedule.yaml"), input.worktreePath);
 	return {
 		config: compiled.config,
-		schedule,
 		scheduleArtifact: scheduleYaml,
 		workflow: compiled.workflowId
 	};

package/dist/cli/submit-options.js

@@ -93,4 +93,4 @@ function parseImagePullPolicy(value) {
 	return "Always";
 }
 //#endregion
-export { addMokaSubmitOptions, runMokaSubmitFromCli };
+export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, runMokaSubmitFromCli };

package/dist/config/defaults.d.ts

@@ -80,8 +80,6 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
     default_stack: true;
     id: string;
     name: string;
-    role: string;
-    source: string;
     package?: string | undefined;
     plugin?: {
       kind: "local";
@@ -91,6 +89,8 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
       kind: "npm";
       package: string;
     } | undefined;
+    role: string;
+    source: string;
   }[];
   generated_by: "@oisincoveney/pipeline";
   host_capabilities: {
@@ -108,9 +108,9 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
     credentials: string[];
     id: string;
     locality: string;
+    name?: string | undefined;
     required: boolean;
     role: string;
-    name?: string | undefined;
   }[];
   official_dependencies: {
     dependency_scope: string;
@@ -121,9 +121,9 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
   }[];
   prompts: {
     id: string;
-    used_by: string[];
     path?: string | undefined;
     source?: string | undefined;
+    used_by: string[];
   }[];
   runtime: {
     compatibility_runners: string[];
@@ -133,9 +133,9 @@ declare const DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST: {
   };
   skills: {
     id: string;
-    used_by: string[];
     path?: string | undefined;
     source?: string | undefined;
+    used_by: string[];
   }[];
   sources: {
     label: string;

package/dist/config/schemas.d.ts

@@ -92,10 +92,10 @@ declare const workflowNodeBaseSchema: z.ZodObject<{
   models: z.ZodOptional<z.ZodArray<z.ZodString>>;
   needs: z.ZodOptional<z.ZodArray<z.ZodString>>;
   reasoning_effort: z.ZodOptional<z.ZodEnum<{
-    none: "none";
+    high: "high";
     low: "low";
     medium: "medium";
-    high: "high";
+    none: "none";
     xhigh: "xhigh";
   }>>;
   retries: z.ZodOptional<z.ZodObject<{
@@ -176,8 +176,8 @@ declare const configSchema: z.ZodObject<{
           "workspace-write": "workspace-write";
         }>>;
         network: z.ZodOptional<z.ZodEnum<{
-          inherit: "inherit";
           disabled: "disabled";
+          inherit: "inherit";
         }>>;
       }, z.core.$strict>>;
       returns: z.ZodOptional<z.ZodObject<{
@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -251,8 +251,8 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     host_scope: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       global: "global";
+      project: "project";
     }>>;
     mode: z.ZodEnum<{
       hosted: "hosted";
@@ -294,16 +294,16 @@ declare const configSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
     network: z.ZodOptional<z.ZodObject<{
       mode: z.ZodEnum<{
-        inherit: "inherit";
         disabled: "disabled";
+        inherit: "inherit";
       }>;
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        text: "text";
         json: "json";
-        jsonl: "jsonl";
         json_schema: "json_schema";
+        jsonl: "jsonl";
+        text: "text";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -313,10 +313,10 @@ declare const configSchema: z.ZodObject<{
       schema_path: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     reasoning_effort: z.ZodOptional<z.ZodEnum<{
-      none: "none";
+      high: "high";
       low: "low";
       medium: "medium";
-      high: "high";
+      none: "none";
       xhigh: "xhigh";
     }>>;
     rules: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -328,13 +328,13 @@ declare const configSchema: z.ZodObject<{
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-      task: "task";
-      read: "read";
-      list: "list";
-      grep: "grep";
-      glob: "glob";
       bash: "bash";
       edit: "edit";
+      glob: "glob";
+      grep: "grep";
+      list: "list";
+      read: "read";
+      task: "task";
       write: "write";
     }>>>;
   }, z.core.$strict>>>;
@@ -361,8 +361,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -375,25 +375,25 @@ declare const configSchema: z.ZodObject<{
       mcp_servers: z.ZodOptional<z.ZodBoolean>;
       native_subagents: z.ZodOptional<z.ZodBoolean>;
       network: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        inherit: "inherit";
         disabled: "disabled";
+        inherit: "inherit";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        text: "text";
         json: "json";
-        jsonl: "jsonl";
         json_schema: "json_schema";
+        jsonl: "jsonl";
+        text: "text";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        task: "task";
-        read: "read";
-        list: "list";
-        grep: "grep";
-        glob: "glob";
         bash: "bash";
         edit: "edit";
+        glob: "glob";
+        grep: "grep";
+        list: "list";
+        read: "read";
+        task: "task";
         write: "write";
       }>>>;
     }, z.core.$strict>;
@@ -401,10 +401,10 @@ declare const configSchema: z.ZodObject<{
     host_models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     model: z.ZodOptional<z.ZodString>;
     reasoning_effort: z.ZodOptional<z.ZodEnum<{
-      none: "none";
+      high: "high";
       low: "low";
       medium: "medium";
-      high: "high";
+      none: "none";
       xhigh: "xhigh";
     }>>;
     type: z.ZodEnum<{
@@ -490,10 +490,10 @@ declare const configSchema: z.ZodObject<{
         models: z.ZodArray<z.ZodString>;
         profile: z.ZodString;
         reasoning_effort: z.ZodOptional<z.ZodEnum<{
-          none: "none";
+          high: "high";
           low: "low";
           medium: "medium";
-          high: "high";
+          none: "none";
           xhigh: "xhigh";
         }>>;
       }, z.core.$strict>>>;
@@ -503,8 +503,8 @@ declare const configSchema: z.ZodObject<{
   schedules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
     baseline: z.ZodEnum<{
-      quick: "quick";
       execute: "execute";
+      quick: "quick";
     }>;
     max_parallel_nodes: z.ZodOptional<z.ZodNumber>;
     node_catalog: z.ZodOptional<z.ZodString>;
@@ -516,8 +516,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      project: "project";
       package: "package";
+      project: "project";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/install-commands/shared.js

@@ -95,4 +95,4 @@ function commandIdForHost(host, entrypointId) {
 	return entrypointId;
 }
 //#endregion
-export { AGENTS_MD_END, AGENTS_MD_START, CLAUDE_PROJECT_CONFIG_PATH, CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, GENERATED_MARKER, GENERATED_TS_MARKER, GENERATED_YAML_MARKER, INSTALL_HOSTS, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, OWNER_YAML_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries, resolveHarnessTarget };
+export { AGENTS_MD_END, AGENTS_MD_START, CLAUDE_PROJECT_CONFIG_PATH, CLAUDE_USER_CONFIG_PATH, CODEX_CONFIG_PATH, COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, GENERATED_MARKER, GENERATED_TS_MARKER, GENERATED_YAML_MARKER, INSTALL_HOSTS, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, OWNER_YAML_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, claudeGlobalConfigDir, codexGlobalConfigDir, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, opencodeGlobalConfigDir, profileEntries, resolveHarnessTarget };

package/dist/install-hooks.js

@@ -5,8 +5,8 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { execa } from "execa";
 import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { createHash } from "node:crypto";
 import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 //#region src/install-hooks.ts
 const DEFAULT_HOOK_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
 const HOOK_HOSTS = [
@@ -24,8 +24,12 @@ const NON_HOOK_OWNED_TARGETS = new Set([".opencode/opencode.json"]);
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
-const MERGE_MANAGED = { ".claude/settings.json": ["hooks"] };
-function mergeKeyFor(path) {
+const MERGE_MANAGED = { ".claude/settings.json": [
+	["hooks"],
+	["skillListingBudgetFraction"],
+	["skillOverrides"]
+] };
+function mergeKeysFor(path) {
 	return MERGE_MANAGED[path];
 }
 function canonicalize(value) {
@@ -51,8 +55,12 @@ function managedSubtree(text, keyPath) {
 	return cursor;
 }
 function targetIdentityHash(path, content) {
-	const mergeKey = mergeKeyFor(path);
-	return mergeKey ? hashJson(managedSubtree(content.toString("utf8"), mergeKey)) : hashContent(content);
+	const mergeKeys = mergeKeysFor(path);
+	if (!mergeKeys) return hashContent(content);
+	const text = content.toString("utf8");
+	const subtrees = {};
+	for (const keyPath of mergeKeys) subtrees[keyPath.join(".")] = managedSubtree(text, keyPath);
+	return hashJson(subtrees);
 }
 async function cloneHookRepository(targetDir) {
 	await execa("gh", [
@@ -178,9 +186,15 @@ async function writePlannedFile(file) {
 	if (file.action === "conflict" || file.action === "unchanged") return;
 	const target = targetPath(file.path);
 	await mkdir(dirname(target), { recursive: true });
-	const mergeKey = mergeKeyFor(file.path);
-	if (mergeKey && existsSync(target)) {
-		await writeFile(target, ensureTrailingNewline(applyJsonEdit(readFileSync(target, "utf8"), mergeKey, managedSubtree(file.content.toString("utf8"), mergeKey))));
+	const mergeKeys = mergeKeysFor(file.path);
+	if (mergeKeys && existsSync(target)) {
+		const sourceText = file.content.toString("utf8");
+		let merged = readFileSync(target, "utf8");
+		for (const keyPath of mergeKeys) {
+			const desired = managedSubtree(sourceText, keyPath);
+			if (desired !== void 0) merged = applyJsonEdit(merged, keyPath, desired);
+		}
+		await writeFile(target, ensureTrailingNewline(merged));
 		return;
 	}
 	await writeFile(target, file.content);

package/dist/install-rules.js

@@ -1,7 +1,8 @@
+import { resolveHarnessTarget } from "./install-commands/shared.js";
 import { AGENT_ASSET_SOURCE, AGENT_RULES_DIR } from "./agent-assets.js";
 import { execa } from "execa";
-import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 //#region src/install-rules.ts
 const DEFAULT_RULES_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
@@ -12,6 +13,24 @@ const RULESYNC_TARGETS = [
 	"geminicli",
 	"opencode"
 ];
+const RULE_OUTPUTS = [
+	{
+		generatedPath: ".claude/CLAUDE.md",
+		targetPath: ".claude/CLAUDE.md"
+	},
+	{
+		generatedPath: ".codex/AGENTS.md",
+		targetPath: ".codex/AGENTS.md"
+	},
+	{
+		generatedPath: ".gemini/GEMINI.md",
+		targetPath: ".gemini/GEMINI.md"
+	},
+	{
+		generatedPath: ".config/opencode/AGENTS.md",
+		targetPath: ".opencode/AGENTS.md"
+	}
+];
 async function cloneRulesRepository(targetDir) {
 	await execa("gh", [
 		"repo",
@@ -71,50 +90,110 @@ ${(await Promise.all(entries.map(async (name) => {
 	await mkdir(rulesyncRulesDir, { recursive: true });
 	await writeFile(join(rulesyncRulesDir, "_root.md"), rootContent);
 }
+async function withRulesyncHome(useHome) {
+	const home = await mkdtemp(join(tmpdir(), "moka-rules-home-"));
+	try {
+		return await useHome(home);
+	} finally {
+		await rm(home, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+function rulesyncArgs(options) {
+	const args = [
+		"generate",
+		"-t",
+		RULESYNC_TARGETS.join(","),
+		"-f",
+		"rules",
+		"--delete",
+		"--global"
+	];
+	if (options.dryRun) args.push("--dry-run");
+	if (options.silent) args.push("--silent");
+	return args;
+}
+async function runRulesyncGenerate(input) {
+	await input.runner(rulesyncArgs(input), {
+		cwd: input.source,
+		env: {
+			...process.env,
+			HOME_DIR: input.home
+		}
+	});
+}
+function ruleItems(action) {
+	return RULE_OUTPUTS.map((output) => ({
+		action,
+		path: resolveHarnessTarget(output.targetPath)
+	}));
+}
+function readGeneratedRuleFiles(home) {
+	return Promise.all(RULE_OUTPUTS.map(async (output) => ({
+		content: await readFile(join(home, output.generatedPath), "utf8"),
+		path: resolveHarnessTarget(output.targetPath)
+	})));
+}
+async function writeGeneratedRuleFiles(files) {
+	for (const file of files) {
+		await mkdir(dirname(file.path), { recursive: true });
+		await writeFile(file.path, file.content);
+	}
+}
+async function installedRuleAction(file) {
+	try {
+		return await readFile(file.path, "utf8") === file.content ? "unchanged" : "update";
+	} catch {
+		return "create";
+	}
+}
+async function assertInstalledRulesCurrent(files) {
+	const changed = (await Promise.all(files.map(async (file) => ({
+		action: await installedRuleAction(file),
+		path: file.path
+	})))).filter((item) => item.action !== "unchanged");
+	if (changed.length === 0) return;
+	throw new Error(["Installed rule files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
+}
 function installRules(options = {}) {
 	const runner = options.rulesyncRunner ?? defaultRulesyncRunner;
 	return withRulesSource(options.sourceOverride, async (source) => {
 		await buildRootRule(source);
-		const home = process.env.HOME_DIR ?? homedir();
-		const args = [
-			"generate",
-			"-t",
-			RULESYNC_TARGETS.join(","),
-			"-f",
-			"rules",
-			"--delete"
-		];
-		if (options.dryRun) args.push("--dry-run");
-		if (options.check) args.push("--check");
-		await runner(args, {
-			cwd: source,
-			env: {
-				...process.env,
-				HOME_DIR: home
+		return withRulesyncHome(async (home) => {
+			if (options.dryRun) {
+				await runRulesyncGenerate({
+					dryRun: true,
+					home,
+					runner,
+					source
+				});
+				return {
+					items: ruleItems("skip"),
+					source: DEFAULT_RULES_INSTALL_SOURCE
+				};
+			}
+			await runRulesyncGenerate({
+				home,
+				runner,
+				silent: options.check,
+				source
+			});
+			const files = await readGeneratedRuleFiles(home);
+			if (options.check) {
+				await assertInstalledRulesCurrent(files);
+				return {
+					items: ruleItems("skip"),
+					source: DEFAULT_RULES_INSTALL_SOURCE
+				};
 			}
+			await writeGeneratedRuleFiles(files);
+			return {
+				items: ruleItems("generate"),
+				source: DEFAULT_RULES_INSTALL_SOURCE
+			};
 		});
-		const action = options.dryRun ?? options.check ? "skip" : "generate";
-		return {
-			items: [
-				{
-					action,
-					path: join(home, ".claude/CLAUDE.md")
-				},
-				{
-					action,
-					path: join(home, ".codex/AGENTS.md")
-				},
-				{
-					action,
-					path: join(home, ".gemini/GEMINI.md")
-				},
-				{
-					action,
-					path: join(home, ".config/opencode/AGENTS.md")
-				}
-			],
-			source: DEFAULT_RULES_INSTALL_SOURCE
-		};
 	});
 }
 //#endregion