@oisincoveney/pipeline 3.17.3 → 3.18.0

package/dist/argo-submit.d.ts

@@ -27,6 +27,10 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
   payloadJson: z.ZodString;

package/dist/argo-submit.js

@@ -1,5 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
-import { dbAuthOptionSchema } from "./remote/argo/model.js";
+import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
@@ -40,6 +40,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	]).optional(),
 	imagePullSecretName: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
+	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
 	payloadJson: z.string().min(1),
@@ -82,6 +83,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		} : {},
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
+		mcpGatewayAuth: options.mcpGatewayAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,

package/dist/cli/submit-options.js

@@ -37,6 +37,7 @@ function mokaCommonSubmitOptions(input) {
 		brokerAuth: resolveMokaBrokerAuth(input.globalConfig),
 		config: input.config,
 		dbAuth: momokaya?.submit.dbAuth,
+		mcpGatewayAuth: momokaya?.submit.mcpGatewayAuth,
 		delivery: { pullRequest: input.flags.openPr === true },
 		eventUrl: input.eventUrl,
 		eventAuthSecretKey: momokaya?.submit.eventAuthSecretKey,

package/dist/moka-global-config.d.ts

@@ -22,6 +22,10 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
         secretKey: z.ZodDefault<z.ZodString>;
         secretName: z.ZodString;
       }, z.core.$strict>>;
+      mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+        secretKey: z.ZodDefault<z.ZodString>;
+        secretName: z.ZodString;
+      }, z.core.$strict>>;
       eventAuthSecretKey: z.ZodString;
       eventAuthSecretName: z.ZodString;
       eventUrl: z.ZodString;

package/dist/moka-global-config.js

@@ -1,4 +1,4 @@
-import { dbAuthOptionSchema } from "./remote/argo/model.js";
+import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { PipelineConfigError, configIssuesFromZodError, validationError } from "./config/schemas.js";
 import { ConfigIoService, runConfigIoSync } from "./runtime/services/config-io-service.js";
@@ -19,6 +19,7 @@ const mokaDbGlobalConfigSchema = z.object({ url: z.string().url().refine((value)
 const mokaSubmitGlobalConfigSchema = z.object({
 	brokerAuth: brokerAuthOptionSchema,
 	dbAuth: dbAuthOptionSchema.optional(),
+	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1),
 	eventAuthSecretName: z.string().min(1),
 	eventUrl: z.string().url(),

package/dist/moka-submit.d.ts

@@ -110,6 +110,10 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
   }, z.core.$strict>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -219,6 +223,10 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
   }, z.core.$strict>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -345,6 +353,10 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
   }, z.core.$strict>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -466,6 +478,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
   }, z.core.$strict>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";
@@ -591,6 +607,10 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
   }, z.core.$strict>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   delivery: z.ZodDefault<z.ZodObject<{
     mode: z.ZodDefault<z.ZodEnum<{
       "create-new-pr": "create-new-pr";

package/dist/moka-submit.js

@@ -1,4 +1,4 @@
-import { dbAuthOptionSchema } from "./remote/argo/model.js";
+import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { runnerDeliverySchema, runnerHookPolicySchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskSchema } from "./runner-command-contract.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
@@ -48,6 +48,7 @@ const mokaSubmitResultSchema = workflowSubmitResultSchema;
 const mokaSubmitBaseOptionsSchema = z.object({
 	brokerAuth: brokerAuthOptionSchema,
 	dbAuth: dbAuthOptionSchema.optional(),
+	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	delivery: runnerDeliverySchema.default({
 		mode: "create-new-pr",
 		pullRequest: false

package/dist/remote/argo/model.d.ts

@@ -26,6 +26,10 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
   labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
+  mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
+    secretKey: z.ZodDefault<z.ZodString>;
+    secretName: z.ZodString;
+  }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;

package/dist/remote/argo/model.js

@@ -14,6 +14,20 @@ const dbAuthOptionSchema = z.object({
 	secretKey: z.string().min(1).default("db-url"),
 	secretName: kubernetesNameSchema
 }).strict();
+/**
+* Submit-time secret ref for PIPELINE_MCP_GATEWAY_AUTHORIZATION injection in
+* runner pods. Lets runner-side agents reach the pipeline-gateway vMCP (the
+* verify-bot-authed browser-automation tools) the same way Coder dev-workspaces
+* do: the shared dotfiles opencode MCP config reads the gateway basic-auth
+* header from this env. The single owner of the option shape — the
+* runner-workflow model, argo-submit, and moka-submit all reference this rather
+* than redeclaring it. `secretKey` defaults to "pipeline-mcp-gateway-authorization"
+* (the ExternalSecret-projected key); absent mcpGatewayAuth → no env emitted.
+*/
+const mcpGatewayAuthOptionSchema = z.object({
+	secretKey: z.string().min(1).default("pipeline-mcp-gateway-authorization"),
+	secretName: kubernetesNameSchema
+}).strict();
 const labelValueSchema = z.string().min(1);
 const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
 const configMapVolumeSchema = z.object({
@@ -152,6 +166,7 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	]).default("Always"),
 	imagePullSecretName: kubernetesNameSchema.optional(),
 	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
+	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
@@ -168,4 +183,4 @@ const buildRunnerArgoWorkflowOptionsSchema = z.object({
 	}).strict().optional()
 }).strict().refine((options) => options.name !== void 0 || options.generateName !== void 0, { message: "Runner Workflow options must declare name or generateName" });
 //#endregion
-export { argoWorkflowVolumeMountSchema, argoWorkflowVolumeSchema, buildRunnerArgoWorkflowOptionsSchema, createRunnerArgoWorkflowManifestSchema, dbAuthOptionSchema };
+export { argoWorkflowVolumeMountSchema, argoWorkflowVolumeSchema, buildRunnerArgoWorkflowOptionsSchema, createRunnerArgoWorkflowManifestSchema, dbAuthOptionSchema, mcpGatewayAuthOptionSchema };

package/dist/remote/argo/policy.js

@@ -68,6 +68,13 @@ function runnerContainerEnv(options) {
 				key: options.dbAuth.secretKey,
 				name: options.dbAuth.secretName
 			} }
+		}],
+		...options.mcpGatewayAuth === void 0 ? [] : [{
+			name: "PIPELINE_MCP_GATEWAY_AUTHORIZATION",
+			valueFrom: { secretKeyRef: {
+				key: options.mcpGatewayAuth.secretKey,
+				name: options.mcpGatewayAuth.secretName
+			} }
 		}]
 	];
 }

package/dist/remote/submit/argo-submission.d.ts

@@ -19,6 +19,10 @@ interface MokaWorkflowSubmitOptions {
   imagePullPolicy?: "Always" | "IfNotPresent" | "Never";
   imagePullSecretName?: string;
   kubeconfigPath?: string;
+  mcpGatewayAuth?: {
+    secretKey?: string;
+    secretName: string;
+  };
   name?: string;
   namespace: string;
   payloadJson: string;

package/dist/remote/submit/argo-submission.js

@@ -21,6 +21,7 @@ function workflowSubmitOptions(options) {
 	return {
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
+		mcpGatewayAuth: options.mcpGatewayAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
 		eventAuthSecretName: options.eventAuthSecretName,
 		generateName: options.generateName,

package/package.json

@@ -132,7 +132,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.17.3",
+  "version": "3.18.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",