@oisincoveney/pipeline 3.19.6 → 3.20.1

package/dist/argo-submit.d.ts

@@ -34,6 +34,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodString;
@@ -68,12 +69,14 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   workflowId: z.ZodString;
 }, z.core.$strict>;
 declare const commandScheduleOptionsSchema: z.ZodObject<{
   command: z.ZodArray<z.ZodString>;
+  deliverPullRequest: z.ZodDefault<z.ZodBoolean>;
   generatedAt: z.ZodDefault<z.ZodDate>;
   scheduleId: z.ZodOptional<z.ZodString>;
   task: z.ZodString;

package/dist/argo-submit.js

@@ -1,6 +1,7 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
 import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
+import { appendPullRequestDelivery } from "./schedule/passes/open-pull-request.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
@@ -48,6 +49,7 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
 };
@@ -61,6 +63,7 @@ const submitDynamicRunnerArgoWorkflowOptionsSchema = z.object({
 }).strict().refine(hasWorkflowName, { message: "Argo submit options must declare name or generateName" });
 const commandScheduleOptionsSchema = z.object({
 	command: z.array(z.string().min(1)).min(1),
+	deliverPullRequest: z.boolean().default(false),
 	generatedAt: z.date().default(() => /* @__PURE__ */ new Date()),
 	scheduleId: scheduleIdSchema.optional(),
 	task: z.string().min(1)
@@ -113,6 +116,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,
@@ -215,6 +219,7 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		serviceAccountName: options.serviceAccountName,
 		workflowId: options.workflowId
@@ -268,7 +273,7 @@ function workflowSubmitResult(response, workflow, base) {
 function buildCommandScheduleYaml(rawOptions) {
 	const options = commandScheduleOptionsSchema.parse(rawOptions);
 	const scheduleId = options.scheduleId ?? `custom-${randomBytes(8).toString("hex")}`;
-	return stringify({
+	const artifact = {
 		generated_at: options.generatedAt.toISOString(),
 		kind: "pipeline-schedule",
 		root_workflow: "root",
@@ -281,7 +286,8 @@ function buildCommandScheduleYaml(rawOptions) {
 			id: "command",
 			kind: "command"
 		}] } }
-	});
+	};
+	return stringify(appendPullRequestDelivery(options.deliverPullRequest, artifact));
 }
 function normalizeRunnerPayloadForSubmit(input) {
 	const repository = normalizeRunnerRepositoryForSubmit(input.payload.repository);

package/dist/cli/submit-options.js

@@ -12,8 +12,12 @@ function resolveOptionalSecretRef(flags, fromGlobalConfig) {
 	};
 	return fromGlobalConfig;
 }
+function resolveOptionalSecretName(flags, fromGlobalConfig) {
+	if (flags.skip) return;
+	return flags.secretName ?? fromGlobalConfig;
+}
 function addMokaSubmitOptions(command) {
-	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config"), { kubeconfig: true });
+	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config").option("--npm-registry-auth-secret-name <name>", "override momokaya.submit.npmRegistryAuthSecretName").option("--skip-npm-registry-auth", "omit the /root/.npmrc mount regardless of global config"), { kubeconfig: true });
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
@@ -68,6 +72,10 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		npmRegistryAuthSecretName: resolveOptionalSecretName({
+			secretName: input.flags.npmRegistryAuthSecretName,
+			skip: input.flags.skipNpmRegistryAuth
+		}, momokaya?.submit.npmRegistryAuthSecretName),
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};

package/dist/moka-global-config.d.ts

@@ -33,6 +33,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       gitCredentialsSecretName: z.ZodString;
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
+      npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -26,6 +26,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	gitCredentialsSecretName: z.string().min(1),
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -201,6 +201,7 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -315,6 +316,7 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -446,6 +448,7 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -572,6 +575,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -702,6 +706,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.js

@@ -70,6 +70,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
 	serviceAccountName: z.string().min(1).optional()

package/dist/planning/generate.js

@@ -16,7 +16,7 @@ import { integrateParallelWriteFanout } from "../schedule/passes/drain-merge.js"
 import { canonicalizeGeneratedScheduleIds } from "../schedule/passes/ids.js";
 import { SCHEDULE_PASS_ORDER } from "../schedule/passes/index.js";
 import { applyNodeCatalogModelFallbacks } from "../schedule/passes/models.js";
-import { appendPullRequestDelivery } from "../schedule/passes/open-pull-request.js";
+import { appendPullRequestDelivery, isPullRequestDeliveryEnabled } from "../schedule/passes/open-pull-request.js";
 import { namespaceScheduleWorkflows } from "../schedule/passes/references.js";
 import { plannerPrompt, plannerRepairPrompt } from "../schedule/prompts.js";
 import { parseDocument, stringify } from "yaml";
@@ -131,7 +131,7 @@ async function generateScheduleArtifactInMemory(options) {
 	});
 	const generatedArtifact = await planScheduleArtifact(baseline, policy.planner_profile, options, planningContext);
 	assertSchedulePassOrder();
-	const artifact = hydrateScheduleTaskContexts(canonicalizeGeneratedScheduleIds(applyNodeCatalogModelFallbacks(options.config, policy.node_catalog, appendPullRequestDelivery(options.config, integrateParallelWriteFanout(options.config, addGeneratedImplementationCoverage(options.config, generatedArtifact))))), planningContext);
+	const artifact = hydrateScheduleTaskContexts(canonicalizeGeneratedScheduleIds(applyNodeCatalogModelFallbacks(options.config, policy.node_catalog, appendPullRequestDelivery(isPullRequestDeliveryEnabled(options.config), integrateParallelWriteFanout(options.config, addGeneratedImplementationCoverage(options.config, generatedArtifact))))), planningContext);
 	validateScheduleArtifact(options.config, artifact, planningContext);
 	compileScheduleArtifact(options.config, artifact, options.worktreePath);
 	return {

package/dist/remote/argo/model.d.ts

@@ -32,6 +32,7 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{
@@ -79,6 +80,7 @@ declare const buildDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{

package/dist/remote/argo/model.js

@@ -198,6 +198,7 @@ const runnerArgoWorkflowBaseOptionsSchema = z.object({
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
+	npmRegistryAuthSecretName: kubernetesNameSchema.optional(),
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
 	payloadConfigMapName: kubernetesNameSchema,
 	resources: argoWorkflowResourceRequirementsSchema.optional(),

package/dist/remote/argo/storage.js

@@ -32,9 +32,7 @@ function runnerWorkflowStorage(options, tasks) {
 		readOnly: true,
 		subPath: "schedule.yaml"
 	}];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
@@ -43,14 +41,18 @@ function runnerWorkflowStorage(options, tasks) {
 function dynamicRunnerWorkflowStorage(options) {
 	const volumes = [runnerPayloadVolume(options)];
 	const volumeMounts = [runnerPayloadVolumeMount()];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+function appendSharedSecretStorage(options, volumes, volumeMounts) {
+	appendEventAuthStorage(options, volumes, volumeMounts);
+	appendGitCredentialsStorage(options, volumes, volumeMounts);
+	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendNpmRegistryAuthStorage(options, volumes, volumeMounts);
+}
 function runnerPayloadVolume(options) {
 	return {
 		configMap: {
@@ -123,5 +125,24 @@ function appendGithubAuthStorage(options, volumes, volumeMounts) {
 		subPath: "hosts.yml"
 	});
 }
+function appendNpmRegistryAuthStorage(options, volumes, volumeMounts) {
+	if (!options.npmRegistryAuthSecretName) return;
+	volumes.push({
+		name: "npm-registry-auth",
+		secret: {
+			items: [{
+				key: "npmrc",
+				path: "npmrc"
+			}],
+			secretName: options.npmRegistryAuthSecretName
+		}
+	});
+	volumeMounts.push({
+		mountPath: "/root/.npmrc",
+		name: "npm-registry-auth",
+		readOnly: true,
+		subPath: "npmrc"
+	});
+}
 //#endregion
 export { dynamicRunnerWorkflowStorage, runnerWorkflowStorage };

package/dist/remote/submit/argo-submission.d.ts

@@ -26,6 +26,7 @@ interface MokaWorkflowSubmitOptions {
   };
   name?: string;
   namespace: string;
+  npmRegistryAuthSecretName?: string;
   payloadJson: string;
   scheduleYaml?: string;
   serviceAccountName?: string;

package/dist/remote/submit/argo-submission.js

@@ -54,6 +54,7 @@ function workflowSubmitOptions(options) {
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		serviceAccountName: options.serviceAccountName
 	};
 }

package/dist/remote/submit/compilation.js

@@ -27,6 +27,7 @@ function compileMokaCommandSubmitPlan(options, runId) {
 	const task = commandTask(options);
 	const scheduleYaml = buildCommandScheduleYaml({
 		command: options.commandArgv,
+		deliverPullRequest: options.delivery.pullRequest,
 		scheduleId: runId,
 		task: taskDescription(task)
 	});

package/dist/runtime/open-pull-request/open-pull-request.js

@@ -109,12 +109,17 @@ function pushHeadBranch(git, headBranch) {
 function submitPullRequest(prCtx, context) {
 	if (prCtx.mode === "update-existing-pr") return handleExistingPr(prCtx.headBranch, prCtx.label, context);
 	return Effect.gen(function* () {
-		const createResult = yield* runGhPrCreate(yield* CommandExecutor, prCtx, extractPrTitle(prCtx.task), context);
-		if (createResult.exitCode === 0) return openPrSuccess(extractPrUrl(createResult.output), "opened");
+		const executor = yield* CommandExecutor;
+		const createResult = yield* runGhPrCreate(executor, prCtx, extractPrTitle(prCtx.task), context);
+		if (createResult.exitCode === 0) return yield* labelCreatedPr(executor, prCtx, createResult, context);
 		if (isPrAlreadyExistsError(createResult.output)) return yield* handleExistingPr(prCtx.headBranch, prCtx.label, context);
 		return createResult;
 	});
 }
+function labelCreatedPr(executor, prCtx, createResult, context) {
+	const url = extractPrUrl(createResult.output);
+	return runGhPrEdit(executor, prCtx.headBranch, prCtx.label, context).pipe(Effect.map((editResult) => editResult.exitCode === 0 ? openPrSuccess(url, "opened") : openPrSuccess(url, "opened", [`open-pull-request: label '${prCtx.label}' not applied — ${editResult.output || `gh pr edit exited ${editResult.exitCode}`}`])));
+}
 function runGhPrCreate(executor, prCtx, title, context) {
 	return executor.execute(buildGhPrCreateArgs(prCtx, title), context).pipe(Effect.catch((e) => Effect.succeed(openPrFailure(errorMessage(e)))));
 }
@@ -143,9 +148,7 @@ function buildGhPrCreateArgs(prCtx, title) {
 		"--title",
 		title,
 		"--body",
-		`Opened by moka run ${prCtx.runId}`,
-		"--label",
-		prCtx.label
+		`Opened by moka run ${prCtx.runId}`
 	];
 }
 function buildGhPrEditArgs(headBranch, label) {
@@ -164,9 +167,9 @@ function isPrAlreadyExistsError(output) {
 function extractPrUrl(output) {
 	return output.split(NEWLINE_RE).map((l) => l.trim()).find((l) => l.startsWith("https://")) ?? output.trim();
 }
-function openPrSuccess(url, action) {
+function openPrSuccess(url, action, extraEvidence = []) {
 	return {
-		evidence: [`open-pull-request: PR ${action} — ${url}`],
+		evidence: [`open-pull-request: PR ${action} — ${url}`, ...extraEvidence],
 		exitCode: 0,
 		output: JSON.stringify({
 			action,

package/dist/schedule/passes/open-pull-request.js

@@ -25,8 +25,8 @@ function buildPrNode(terminalIds, usedIds) {
 	};
 }
 /** Append a final open-pull-request node to the root workflow when enabled. */
-function appendPullRequestDelivery(config, artifact) {
-	if (!isPullRequestDeliveryEnabled(config)) return artifact;
+function appendPullRequestDelivery(enabled, artifact) {
+	if (!enabled) return artifact;
 	const rootWorkflow = artifact.workflows[artifact.root_workflow];
 	if (!rootWorkflow) return artifact;
 	const nodes = rootWorkflow.nodes;
@@ -46,4 +46,4 @@ function appendPullRequestDelivery(config, artifact) {
 	};
 }
 //#endregion
-export { appendPullRequestDelivery };
+export { appendPullRequestDelivery, isPullRequestDeliveryEnabled };

package/docs/operator-guide.md

@@ -236,6 +236,7 @@ momokaya:
     gitCredentialsSecretName: <git-credentials-secret-name>
     githubAuthSecretName: <github-auth-secret-name>
     imagePullSecretName: <image-pull-secret-name>
+    npmRegistryAuthSecretName: <npm-registry-auth-secret-name>  # optional
     brokerAuth:
       secretName: <broker-api-key-secret-name>
       secretKey: api-key
@@ -334,6 +335,12 @@ Expected namespace resources:
 - The GitHub CLI auth Secret named by `submit.githubAuthSecretName` with key
   `hosts.yml`; this Secret is for `gh` and pull request delivery, not git
   clone/fetch/push authentication
+- Optional: the private-registry auth Secret named by
+  `submit.npmRegistryAuthSecretName` with key `npmrc`, mounted at
+  `/root/.npmrc`; lets `.moka/bootstrap.sh`'s dependency install step (e.g.
+  `nub ci`) authenticate to private-scoped package registries, e.g. GitHub
+  Packages. Absent by default — bootstrap then only has public-registry
+  access, matching current behavior
 - A pipeline-console event sink reachable from the pod
 
 Credential issuance and rotation are owned by the cluster/infra layer, not by

package/package.json

@@ -130,6 +130,7 @@
     "test:image": "mkdir -p /tmp/pipeline-test && printf '{}' > /tmp/pipeline-test/payload.json && printf 'kind: pipeline-schedule\\nversion: 1\\nschedule_id: smoke\\ngenerated_at: 2026-06-10T00:00:00.000Z\\nsource_entrypoint: custom\\ntask: smoke\\nroot_workflow: root\\nworkflows:\\n  root:\\n    nodes:\\n      - id: smoke\\n        kind: command\\n        command: [true]\\n' > /tmp/pipeline-test/schedule.yaml && printf '{\"nodeId\":\"smoke\"}' > /tmp/pipeline-test/task.json && printf 'test-token' > /tmp/pipeline-test/event-token && docker build -t pipeline-runner:test . && docker run --rm -v /tmp/pipeline-test/payload.json:/etc/pipeline/payload.json:ro -v /tmp/pipeline-test/schedule.yaml:/etc/pipeline/schedule.yaml:ro -v /tmp/pipeline-test/task.json:/etc/pipeline/task.json:ro -v /tmp/pipeline-test/event-token:/etc/pipeline/event-auth/token:ro pipeline-runner:test runner-command --payload-file /etc/pipeline/payload.json --schedule-file /etc/pipeline/schedule.yaml; test $? -eq 64",
     "test:dogfood": "vitest run tests/dogfood-installed.test.ts",
     "test:live-runners": "PIPELINE_LIVE_RUNNERS=1 vitest run tests/dogfood-live-runners.test.ts",
+    "local-orbstack:migrate": "nub scripts/local-orbstack/migrate-postgres.ts",
     "typecheck": "tsc --noEmit",
     "build": "nub run build:cli",
     "check": "ultracite check",
@@ -137,7 +138,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.19.6",
+  "version": "3.20.1",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",