@oisincoveney/pipeline 3.20.1 → 3.22.0

package/dist/cli/bootstrap-commands.js

@@ -10,7 +10,7 @@ function registerBootstrapCommands(program) {
 		console.log(flags.json ? JSON.stringify(result) : formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
 	});
-	program.command("init").description("Install or refresh package-owned pipeline support: per-machine harness (skills + slash-command adapters + agent hooks + global instruction files) installed globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config").option("--check", "verify the generated harness is current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited harness files").action(async (flags) => {
+	program.command("init").description("Install or refresh moka's slash-command adapters (/moka-execute, /moka-inspect, /moka-quick) plus the singleton MCP gateway host config, globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config. The agent harness (skills, hooks, instruction rules) is provisioned separately from oisin-ee/agent via chezmoi, not by moka.").option("--check", "verify the installed adapters are current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited command adapter files").action(async (flags) => {
 		const result = await initPipelineProject({
 			...flags,
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()

package/dist/cli/factory-commands.js

@@ -0,0 +1,33 @@
+import { runCreateExperiment } from "../factory/create-experiment.js";
+import { runTemplateUpdate, summarizeTemplateUpdate } from "../factory/template-update.js";
+import { Option } from "commander";
+//#region src/cli/factory-commands.ts
+function registerFactoryCommands(program) {
+	program.command("create-experiment").description("Birth a fleet experiment: copier-stamp momokaya-template, create+push the org repo, register it in infra's fleet registry").requiredOption("--name <name>", "app name (kebab-case)").addOption(new Option("--flavor <flavor>", "app flavor").choices(["web", "expo-web"]).default("web")).option("--no-db", "skip the database surface").option("--no-previews", "skip per-PR preview environments").option("--org <org>", "GitHub org for the new repo").option("--template-src <source>", "copier template source").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo the registry entry lands in").action(async (flags) => {
+		const result = await runCreateExperiment({
+			db: flags.db,
+			flavor: flags.flavor,
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			name: flags.name,
+			...flags.org ? { org: flags.org } : {},
+			previews: flags.previews,
+			...flags.templateRef ? { templateRef: flags.templateRef } : {},
+			...flags.templateSrc ? { templateSource: flags.templateSrc } : {}
+		});
+		console.log(`Experiment born: ${result.repoUrl} (registry ${result.registryPath} @ infra ${result.infraCommitSha})`);
+	});
+	program.command("template-update").description("Fan copier-update PRs out across repos stamped from momokaya-template").option("--repos <repos>", "comma-separated repo list (skips fleet-registry discovery)").option("--org <org>", "GitHub org the stamped repos live in").option("--template-match <substring>", "answers-file _src_path filter for stamp detection").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo used for discovery").action(async (flags) => {
+		const { results } = await runTemplateUpdate({
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			...flags.org ? { org: flags.org } : {},
+			...flags.repos ? { repos: flags.repos.split(",").map((repo) => repo.trim()).filter((repo) => repo.length > 0) } : {},
+			...flags.templateMatch ? { templateMatch: flags.templateMatch } : {},
+			...flags.templateRef ? { templateRef: flags.templateRef } : {}
+		});
+		const { failed, opened } = summarizeTemplateUpdate(results);
+		console.log(`template-update: ${opened} PR(s) opened, ${failed} error(s)`);
+		if (failed > 0) process.exitCode = 1;
+	});
+}
+//#endregion
+export { registerFactoryCommands };

package/dist/cli/program.js

@@ -7,6 +7,7 @@ import { registerTicketCommand } from "../commands/ticket-command.js";
 import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { registerBootstrapCommands } from "./bootstrap-commands.js";
+import { registerFactoryCommands } from "./factory-commands.js";
 import { registerLoopCommand } from "./loop-commands.js";
 import { registerMcpGatewayCommands } from "./mcp-gateway-commands.js";
 import { registerPlanCommands } from "./plan-commands.js";
@@ -34,6 +35,7 @@ function registerApplicationCommands(program, options) {
 	registerMcpGatewayCommands(program);
 	registerSubmitCommand(program);
 	registerLoopCommand(program);
+	registerFactoryCommands(program);
 	registerRunnerCommandCommand(program);
 	registerBenchCommand(program);
 	registerTicketCommand(program, {

package/dist/commands/pipeline-command.js

@@ -10,7 +10,9 @@ const BUILTIN_PIPE_COMMANDS = /* @__PURE__ */ new Set([
 	"submit",
 	"argo",
 	"runner-command",
-	"ticket"
+	"ticket",
+	"create-experiment",
+	"template-update"
 ]);
 var EntrypointCommandService = class extends Context.Service()("EntrypointCommandService") {};
 const createEntrypointCommandServiceLive = (runEntrypoint) => Layer.succeed(EntrypointCommandService, { runEntrypoint: (entrypoint, task, opts) => Effect.tryPromise({

package/dist/factory/create-experiment.js

@@ -0,0 +1,163 @@
+import { DEFAULT_RUNNER_COMMAND_GIT_COMMITTER } from "../config/schema/catalog.js";
+import { resolveFactorySeams } from "./exec.js";
+import { existsSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { copyFile, mkdir } from "node:fs/promises";
+//#region src/factory/create-experiment.ts
+/**
+* create-experiment lane (INFRA-087.12): one deterministic run births a
+* deployable fleet experiment.
+*
+*   1. headless `copier copy` stamps the app tree from momokaya-template;
+*   2. `gh repo create <org>/<name> --private` + authenticated push publish it;
+*   3. the stamped `infra-registry/config/<name>.yaml` is committed to the
+*      infra repo's fleet registry (`k8s/apps/platform-fleet/config/`), where
+*      the platform-fleet chart renders its previews ApplicationSet
+*      (`lifecycle: experiment` renders previews only, no prod Application).
+*
+* Ordered data-driven steps; each failure surfaces with the step name. No
+* automatic rollback: a partially-born experiment is reported, and retirement
+* (registry `lifecycle: retired` + repo deletion) is the documented cleanup.
+*/
+const EXPERIMENT_NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const DEFAULT_ORG = "oisin-ee";
+const DEFAULT_TEMPLATE_SOURCE = "gh:oisin-ee/momokaya-template";
+const DEFAULT_INFRA_REPO_URL = "https://github.com/oisin-ee/infra.git";
+const FLEET_REGISTRY_DIR = "k8s/apps/platform-fleet/config";
+const STAMPED_REGISTRY_DIR = "infra-registry/config";
+function buildCopierCopyArgs(options) {
+	return [
+		"copy",
+		"--trust",
+		"--defaults",
+		...options.templateRef ? ["--vcs-ref", options.templateRef] : [],
+		"--data",
+		`name=${options.name}`,
+		"--data",
+		`flavor=${options.flavor}`,
+		"--data",
+		`db=${options.db}`,
+		"--data",
+		`previews=${options.previews}`,
+		options.templateSource,
+		options.destination
+	];
+}
+function committerConfigArgs() {
+	return [
+		"-c",
+		`user.name=${DEFAULT_RUNNER_COMMAND_GIT_COMMITTER.name}`,
+		"-c",
+		`user.email=${DEFAULT_RUNNER_COMMAND_GIT_COMMITTER.email}`
+	];
+}
+async function runCreateExperiment(options) {
+	const { exec, git, log } = resolveFactorySeams(options);
+	const name = options.name;
+	if (!EXPERIMENT_NAME_PATTERN.test(name)) throw new Error(`create-experiment: name must be kebab-case (got ${JSON.stringify(name)})`);
+	const org = options.org ?? DEFAULT_ORG;
+	const flavor = options.flavor ?? "web";
+	const db = options.db ?? true;
+	const previews = options.previews ?? true;
+	const templateSource = options.templateSource ?? DEFAULT_TEMPLATE_SOURCE;
+	const infraRepoUrl = options.infraRepoUrl ?? DEFAULT_INFRA_REPO_URL;
+	const workRoot = options.workRoot ?? mkdtempSync(join(tmpdir(), "create-experiment-"));
+	const stampDir = resolve(workRoot, name);
+	const repoUrl = `https://github.com/${org}/${name}`;
+	log(`create-experiment: birthing ${org}/${name} (flavor=${flavor} db=${db} previews=${previews})`);
+	await assertRepoAbsent({
+		exec,
+		name,
+		org
+	});
+	log(`create-experiment: stamping ${templateSource} -> ${stampDir}`);
+	await exec("copier", buildCopierCopyArgs({
+		db,
+		destination: stampDir,
+		flavor,
+		name,
+		previews,
+		...options.templateRef ? { templateRef: options.templateRef } : {},
+		templateSource
+	}));
+	const stampedRegistryEntry = join(stampDir, STAMPED_REGISTRY_DIR, `${name}.yaml`);
+	if (!existsSync(stampedRegistryEntry)) throw new Error(`create-experiment: stamp is missing the registry entry ${STAMPED_REGISTRY_DIR}/${name}.yaml — template contract changed?`);
+	log("create-experiment: committing the stamped tree");
+	await git(stampDir, ["init", "--initial-branch=main"]);
+	await git(stampDir, ["add", "--all"]);
+	await git(stampDir, [
+		...committerConfigArgs(),
+		"commit",
+		"-m",
+		`feat: initial stamp from ${templateSource}`
+	]);
+	log(`create-experiment: creating ${repoUrl} (private)`);
+	await exec("gh", [
+		"repo",
+		"create",
+		`${org}/${name}`,
+		"--private"
+	]);
+	await git(stampDir, [
+		"remote",
+		"add",
+		"origin",
+		`${repoUrl}.git`
+	]);
+	await git(stampDir, [
+		"push",
+		"-u",
+		"origin",
+		"main"
+	]);
+	log(`create-experiment: registering ${name} in the fleet registry`);
+	const infraDir = resolve(workRoot, "infra");
+	await git(workRoot, [
+		"clone",
+		"--depth",
+		"1",
+		"--single-branch",
+		infraRepoUrl,
+		infraDir
+	]);
+	const registryPath = `${FLEET_REGISTRY_DIR}/${name}.yaml`;
+	await mkdir(join(infraDir, FLEET_REGISTRY_DIR), { recursive: true });
+	await copyFile(stampedRegistryEntry, join(infraDir, registryPath));
+	await git(infraDir, [
+		"add",
+		"--",
+		registryPath
+	]);
+	await git(infraDir, [
+		...committerConfigArgs(),
+		"commit",
+		"-m",
+		`feat(fleet): register experiment ${name} (create-experiment lane)`
+	]);
+	await git(infraDir, [
+		"push",
+		"origin",
+		"HEAD:main"
+	]);
+	const infraCommitSha = (await git(infraDir, ["rev-parse", "HEAD"])).trim();
+	log(`create-experiment: done — repo=${repoUrl} registry=${registryPath} infraCommit=${infraCommitSha}`);
+	return {
+		infraCommitSha,
+		registryPath,
+		repoUrl,
+		stampDir
+	};
+}
+async function assertRepoAbsent(input) {
+	const slug = `${input.org}/${input.name}`;
+	if (await input.exec("gh", [
+		"repo",
+		"view",
+		slug,
+		"--json",
+		"name"
+	]).then(() => true).catch(() => false)) throw new Error(`create-experiment: repo ${slug} already exists — pick another name or retire the old experiment first`);
+}
+//#endregion
+export { EXPERIMENT_NAME_PATTERN, buildCopierCopyArgs, committerConfigArgs, runCreateExperiment };

package/dist/factory/exec.js

@@ -0,0 +1,17 @@
+import { runAuthenticatedGit } from "../run-state/git-refs.js";
+import { execa } from "execa";
+//#region src/factory/exec.ts
+const defaultFactoryExec = (command, args, options) => execa(command, [...args], {
+	...options?.cwd ? { cwd: options.cwd } : {},
+	stdin: "ignore"
+});
+const defaultFactoryGit = (cwd, args) => runAuthenticatedGit(cwd, args);
+function resolveFactorySeams(seams = {}) {
+	return {
+		exec: seams.exec ?? defaultFactoryExec,
+		git: seams.git ?? defaultFactoryGit,
+		log: seams.log ?? ((line) => console.log(line))
+	};
+}
+//#endregion
+export { defaultFactoryExec, defaultFactoryGit, resolveFactorySeams };

package/dist/factory/stamp-answers.js

@@ -0,0 +1,28 @@
+import { parse } from "yaml";
+import { z } from "zod";
+//#region src/factory/stamp-answers.ts
+/**
+* `.copier-answers.yml` is copier's stamp receipt: `_src_path` records the
+* template a repo was generated from and `_commit` the template version.
+*
+* The org has MULTIPLE copier templates (e.g. the @oisincoveney/dev scaffold
+* also writes `.copier-answers.yml`), so the marker file alone does NOT mean
+* "momokaya-template stamp" — template-update must filter on `_src_path`
+* before fanning a `copier update` PR out to a repo.
+*/
+const copierAnswersSchema = z.object({
+	_commit: z.string().optional(),
+	_src_path: z.string().optional()
+}).passthrough();
+function parseCopierAnswers(source) {
+	const parsed = copierAnswersSchema.parse(parse(source));
+	return {
+		...parsed._commit === void 0 ? {} : { commit: parsed._commit },
+		...parsed._src_path === void 0 ? {} : { srcPath: parsed._src_path }
+	};
+}
+function isStampOf(receipt, templateMatch) {
+	return receipt.srcPath?.includes(templateMatch) ?? false;
+}
+//#endregion
+export { isStampOf, parseCopierAnswers };

package/dist/factory/template-update.js

@@ -0,0 +1,167 @@
+import { resolveFactorySeams } from "./exec.js";
+import { committerConfigArgs } from "./create-experiment.js";
+import { isStampOf, parseCopierAnswers } from "./stamp-answers.js";
+import { parse } from "yaml";
+import { z } from "zod";
+import { existsSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+//#region src/factory/template-update.ts
+/**
+* template-update lane (INFRA-087.12): when momokaya-template ships a new tag,
+* fan `copier update` PRs out across every repo stamped from it — one PR per
+* repo, never a direct push to an app repo's default branch.
+*
+* Discovery = fleet registry entries (the infra repo's
+* `k8s/apps/platform-fleet/config/*.yaml` → `repo:`) probed for a
+* `.copier-answers.yml` whose `_src_path` matches the template (the marker
+* alone is ambiguous across the org's copier templates — see
+* stamp-answers.ts).
+*/
+const DEFAULT_ORG = "oisin-ee";
+const DEFAULT_TEMPLATE_MATCH = "momokaya-template";
+const DEFAULT_INFRA_REPO_URL = "https://github.com/oisin-ee/infra.git";
+const FLEET_REGISTRY_DIR = "k8s/apps/platform-fleet/config";
+const ANSWERS_FILE = ".copier-answers.yml";
+const registryEntryRepoSchema = z.object({ repo: z.string() }).passthrough();
+function summarizeTemplateUpdate(results) {
+	return {
+		failed: results.filter((entry) => entry.status === "error").length,
+		opened: results.filter((entry) => entry.status === "pr-opened").length
+	};
+}
+async function runTemplateUpdate(options) {
+	const seams = resolveFactorySeams(options);
+	const { log } = seams;
+	const org = options.org ?? DEFAULT_ORG;
+	const templateMatch = options.templateMatch ?? DEFAULT_TEMPLATE_MATCH;
+	const workRoot = options.workRoot ?? mkdtempSync(join(tmpdir(), "template-update-"));
+	const repos = options.repos && options.repos.length > 0 ? [...options.repos] : await discoverRegistryRepos({
+		git: seams.git,
+		infraRepoUrl: options.infraRepoUrl ?? DEFAULT_INFRA_REPO_URL,
+		workRoot
+	});
+	log(`template-update: candidates [${repos.join(", ")}]`);
+	const results = [];
+	for (const repo of repos) results.push(await updateRepo({
+		org,
+		repo,
+		seams,
+		...options.templateRef ? { templateRef: options.templateRef } : {},
+		templateMatch,
+		workRoot
+	}));
+	for (const entry of results) log(`template-update: ${entry.repo} -> ${entry.status}${entry.prUrl ? ` ${entry.prUrl}` : ""}${entry.message ? ` (${entry.message})` : ""}`);
+	return { results };
+}
+async function discoverRegistryRepos(input) {
+	const infraDir = resolve(input.workRoot, "infra-discovery");
+	await input.git(input.workRoot, [
+		"clone",
+		"--depth",
+		"1",
+		"--single-branch",
+		input.infraRepoUrl,
+		infraDir
+	]);
+	const registryDir = join(infraDir, FLEET_REGISTRY_DIR);
+	const repos = readdirSync(registryDir).filter((file) => file.endsWith(".yaml")).map((file) => {
+		return registryEntryRepoSchema.parse(parse(readFileSync(join(registryDir, file), "utf8"))).repo;
+	});
+	return [...new Set(repos)].sort((left, right) => left.localeCompare(right));
+}
+async function updateRepo(input) {
+	const { exec, git } = input.seams;
+	const { repo } = input;
+	try {
+		const cloneDir = resolve(input.workRoot, `update-${repo}`);
+		await git(input.workRoot, [
+			"clone",
+			`https://github.com/${input.org}/${repo}.git`,
+			cloneDir
+		]);
+		const answersPath = join(cloneDir, ANSWERS_FILE);
+		if (!existsSync(answersPath)) return {
+			repo,
+			status: "not-stamped"
+		};
+		const receipt = parseCopierAnswers(readFileSync(answersPath, "utf8"));
+		if (!isStampOf(receipt, input.templateMatch)) return {
+			message: `stamped from ${receipt.srcPath ?? "unknown"}, not ${input.templateMatch}`,
+			repo,
+			status: "not-stamped"
+		};
+		await git(cloneDir, [
+			"checkout",
+			"-b",
+			"template-update/pending"
+		]);
+		await exec("copier", [
+			"update",
+			"--trust",
+			"--defaults",
+			...input.templateRef ? ["--vcs-ref", input.templateRef] : []
+		], { cwd: cloneDir });
+		const status = await git(cloneDir, ["status", "--porcelain"]);
+		if (status.trim().length === 0) return {
+			repo,
+			status: "up-to-date",
+			...receipt.commit === void 0 ? {} : { version: receipt.commit }
+		};
+		const version = parseCopierAnswers(readFileSync(answersPath, "utf8")).commit ?? "unknown";
+		const branch = `chore/template-update-${version}`;
+		const rejects = listRejectFiles(cloneDir, status);
+		await git(cloneDir, [
+			"branch",
+			"-m",
+			branch
+		]);
+		await git(cloneDir, ["add", "--all"]);
+		await git(cloneDir, [
+			...committerConfigArgs(),
+			"commit",
+			"-m",
+			`chore: copier update to ${version}`
+		]);
+		await git(cloneDir, [
+			"push",
+			"-u",
+			"origin",
+			branch
+		]);
+		const prBody = [`Automated \`copier update\` to momokaya-template ${version} (template-update lane).`, ...rejects.length > 0 ? [
+			"",
+			"WARNING — conflict rejects need manual resolution:",
+			...rejects.map((file) => `- \`${file}\``)
+		] : []].join("\n");
+		const { stdout } = await exec("gh", [
+			"pr",
+			"create",
+			"--repo",
+			`${input.org}/${repo}`,
+			"--head",
+			branch,
+			"--title",
+			`chore: copier update to ${version}`,
+			"--body",
+			prBody
+		], { cwd: cloneDir });
+		return {
+			prUrl: stdout.trim(),
+			repo,
+			status: "pr-opened",
+			version
+		};
+	} catch (error) {
+		return {
+			message: error instanceof Error ? error.message : String(error),
+			repo,
+			status: "error"
+		};
+	}
+}
+function listRejectFiles(cloneDir, porcelainStatus) {
+	return porcelainStatus.split("\n").map((line) => line.slice(3).trim()).filter((file) => file.endsWith(".rej") && existsSync(join(cloneDir, file))).map((file) => basename(file));
+}
+//#endregion
+export { runTemplateUpdate, summarizeTemplateUpdate };

package/dist/factory-lane.d.ts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+
+//#region src/factory/factory-lane.d.ts
+/**
+ * Kubernetes Job manifest builder for factory lanes (create-experiment /
+ * template-update). The console front door creates these Jobs directly
+ * (batch/v1, NOT an Argo Workflow): a lane is a single deterministic `moka`
+ * subcommand with no payload repo, no schedule and no node graph, so the
+ * runner-command DAG machinery does not apply. The runner image ENTRYPOINT is
+ * `entrypoint-preflight.sh moka`; the Job overrides only the container args,
+ * so `args: ["create-experiment", ...]` runs `moka create-experiment ...`.
+ *
+ * Credential mounts replicate the runner workflow's secret storage shapes
+ * (src/remote/argo/storage.ts): the git credential store dir at
+ * /etc/pipeline/git-credentials (consumed by runAuthenticatedGit) and the gh
+ * hosts.yml at /root/.config/gh/hosts.yml.
+ */
+declare const factoryLaneJobOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodDefault<z.ZodNumber>;
+  argv: z.ZodArray<z.ZodString>;
+  generateName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodString;
+  githubAuthSecretName: z.ZodString;
+  image: z.ZodString;
+  imagePullPolicy: z.ZodOptional<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
+  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+  namespace: z.ZodString;
+  resources: z.ZodOptional<z.ZodObject<{
+    limits: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    requests: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  }, z.core.$strip>>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlSecondsAfterFinished: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type FactoryLaneJobOptionsInput = z.input<typeof factoryLaneJobOptionsSchema>;
+type FactoryLaneJobOptions = z.output<typeof factoryLaneJobOptionsSchema>;
+declare const FACTORY_LANE_LABEL = "pipeline.oisin.dev/factory-lane";
+declare function buildFactoryLaneJob(input: FactoryLaneJobOptionsInput): {
+  apiVersion: string;
+  kind: string;
+  metadata: {
+    generateName: string;
+    labels: {
+      "pipeline.oisin.dev/factory-lane": string;
+    };
+    namespace: string;
+  };
+  spec: {
+    activeDeadlineSeconds: number;
+    backoffLimit: number;
+    template: {
+      metadata: {
+        labels: {
+          "pipeline.oisin.dev/factory-lane": string;
+        };
+      };
+      spec: {
+        containers: {
+          args: string[];
+          image: string;
+          imagePullPolicy?: string | undefined;
+          name: string;
+          resources?: {
+            limits?: Record<string, string> | undefined;
+            requests?: Record<string, string> | undefined;
+          } | undefined;
+          volumeMounts: ({
+            mountPath: string;
+            name: string;
+            readOnly: boolean;
+            subPath?: undefined;
+          } | {
+            mountPath: string;
+            name: string;
+            readOnly: boolean;
+            subPath: string;
+          })[];
+        }[];
+        imagePullSecrets?: {
+          name: string;
+        }[] | undefined;
+        restartPolicy: string;
+        serviceAccountName?: string | undefined;
+        volumes: ({
+          name: string;
+          secret: {
+            defaultMode: number;
+            secretName: string;
+            items?: undefined;
+          };
+        } | {
+          name: string;
+          secret: {
+            defaultMode?: undefined;
+            items: {
+              key: string;
+              path: string;
+            }[];
+            secretName: string;
+          };
+        })[];
+      };
+    };
+  };
+};
+//#endregion
+export { FACTORY_LANE_LABEL, FactoryLaneJobOptions, FactoryLaneJobOptionsInput, buildFactoryLaneJob, factoryLaneJobOptionsSchema };

package/dist/factory-lane.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+//#region src/factory/factory-lane.ts
+/**
+* Kubernetes Job manifest builder for factory lanes (create-experiment /
+* template-update). The console front door creates these Jobs directly
+* (batch/v1, NOT an Argo Workflow): a lane is a single deterministic `moka`
+* subcommand with no payload repo, no schedule and no node graph, so the
+* runner-command DAG machinery does not apply. The runner image ENTRYPOINT is
+* `entrypoint-preflight.sh moka`; the Job overrides only the container args,
+* so `args: ["create-experiment", ...]` runs `moka create-experiment ...`.
+*
+* Credential mounts replicate the runner workflow's secret storage shapes
+* (src/remote/argo/storage.ts): the git credential store dir at
+* /etc/pipeline/git-credentials (consumed by runAuthenticatedGit) and the gh
+* hosts.yml at /root/.config/gh/hosts.yml.
+*/
+const factoryLaneJobOptionsSchema = z.object({
+	activeDeadlineSeconds: z.number().int().positive().default(1800),
+	argv: z.array(z.string().min(1)).min(1),
+	generateName: z.string().min(1).default("moka-factory-"),
+	gitCredentialsSecretName: z.string().min(1),
+	githubAuthSecretName: z.string().min(1),
+	image: z.string().min(1),
+	imagePullPolicy: z.string().min(1).optional(),
+	imagePullSecretName: z.string().min(1).optional(),
+	labels: z.record(z.string(), z.string()).default({}),
+	namespace: z.string().min(1),
+	resources: z.object({
+		limits: z.record(z.string(), z.string()).optional(),
+		requests: z.record(z.string(), z.string()).optional()
+	}).optional(),
+	serviceAccountName: z.string().min(1).optional(),
+	ttlSecondsAfterFinished: z.number().int().positive().default(86400)
+});
+const FACTORY_LANE_LABEL = "pipeline.oisin.dev/factory-lane";
+function buildFactoryLaneJob(input) {
+	const options = factoryLaneJobOptionsSchema.parse(input);
+	const lane = options.argv[0] ?? "unknown";
+	return {
+		apiVersion: "batch/v1",
+		kind: "Job",
+		metadata: {
+			generateName: options.generateName,
+			labels: {
+				[FACTORY_LANE_LABEL]: lane,
+				...options.labels
+			},
+			namespace: options.namespace
+		},
+		spec: {
+			activeDeadlineSeconds: options.activeDeadlineSeconds,
+			backoffLimit: 0,
+			template: {
+				metadata: { labels: {
+					[FACTORY_LANE_LABEL]: lane,
+					...options.labels
+				} },
+				spec: {
+					containers: [{
+						args: [...options.argv],
+						image: options.image,
+						...options.imagePullPolicy ? { imagePullPolicy: options.imagePullPolicy } : {},
+						name: "lane",
+						...options.resources ? { resources: options.resources } : {},
+						volumeMounts: [{
+							mountPath: "/etc/pipeline/git-credentials",
+							name: "runner-git-credentials",
+							readOnly: true
+						}, {
+							mountPath: "/root/.config/gh/hosts.yml",
+							name: "github-auth",
+							readOnly: true,
+							subPath: "hosts.yml"
+						}]
+					}],
+					...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
+					restartPolicy: "Never",
+					...options.serviceAccountName ? { serviceAccountName: options.serviceAccountName } : {},
+					volumes: [{
+						name: "runner-git-credentials",
+						secret: {
+							defaultMode: 256,
+							secretName: options.gitCredentialsSecretName
+						}
+					}, {
+						name: "github-auth",
+						secret: {
+							items: [{
+								key: "hosts.yml",
+								path: "hosts.yml"
+							}],
+							secretName: options.githubAuthSecretName
+						}
+					}]
+				}
+			}
+		}
+	};
+}
+//#endregion
+export { FACTORY_LANE_LABEL, buildFactoryLaneJob, factoryLaneJobOptionsSchema };

package/dist/pipeline-init.js

@@ -1,102 +1,21 @@
-import { claudeGlobalConfigDir, codexGlobalConfigDir, opencodeGlobalConfigDir } from "./install-commands/shared.js";
-import { AGENT_SKILL_SOURCE } from "./agent-assets.js";
 import { installCommands } from "./install-commands.js";
-import { installHooks } from "./install-hooks.js";
-import { installRules } from "./install-rules.js";
-import { execa } from "execa";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { rm } from "node:fs/promises";
 //#region src/pipeline-init.ts
-const DEFAULT_SKILL_INSTALL_SOURCE = AGENT_SKILL_SOURCE;
-const SKILL_INSTALL_AGENT_ARGS = [
-	"--agent",
-	"opencode",
-	"--agent",
-	"codex",
-	"--agent",
-	"claude-code",
-	"--skill",
-	"*",
-	"--yes",
-	"--global"
-];
 /**
-* Every global location the `skills` CLI writes into for the three agents we
-* manage. The CLI copies each skill's real folder once into the shared master
-* store `~/.agents/skills` and points each agent's global skills dir at it via
-* symlinks, recording install state in `~/.agents/.skill-lock.json` (or
-* `$XDG_STATE_HOME/skills/.skill-lock.json`). Each entry below mirrors that
-* resolution from the skills CLI source (skills `dist/cli.mjs`): per-agent
-* config dirs honor `CLAUDE_CONFIG_DIR` / `CODEX_HOME` /
-* `OPENCODE_CONFIG_DIR`+`XDG_CONFIG_HOME` (reused from install-commands so the
-* test suite's env redirect isolates them), the master store and lock honor
-* the home dir and `XDG_STATE_HOME`.
+* `moka init` installs only moka's own slash-command adapters
+* (`/moka-execute|inspect|quick`) plus the singleton MCP gateway host config,
+* globally for Claude Code, Codex, and OpenCode. The shared agent harness
+* (skills, agent hooks, and global instruction rules) is no longer installed by
+* moka — it is provisioned from `oisin-ee/agent` via chezmoi (the dotfiles'
+* `.chezmoiexternal` clone + `run_onchange` harness installer). Keeping moka's
+* command adapters here means the runner image (and local dev) still gets the
+* `/moka-*` entrypoints after `chezmoi apply` lays down the harness.
 */
-function globalSkillCleanTargets() {
-	const agentsHome = homedir();
-	const skillLockPath = process.env.XDG_STATE_HOME ? join(process.env.XDG_STATE_HOME, "skills", ".skill-lock.json") : join(agentsHome, ".agents", ".skill-lock.json");
-	return [
-		join(claudeGlobalConfigDir(), "skills"),
-		join(codexGlobalConfigDir(), "skills"),
-		join(opencodeGlobalConfigDir(), "skills"),
-		join(agentsHome, ".agents", "skills"),
-		skillLockPath
-	];
-}
-/**
-* Clean-replace step run before the additive `skills add`. `npx skills add`
-* only ever adds, so without this a renamed, removed, or foreign global skill
-* accumulates forever across `moka init` runs. Removing the per-agent symlink
-* farms + shared master store + lock resets global skill state so the post-add
-* set equals exactly the canonical `oisin-ee/agent` source. Safe when absent
-* (rm force); only `skills` subdirs, the master store, and the lock are
-* touched — never a whole host config dir.
-*/
-async function cleanGlobalSkills() {
-	await Promise.all(globalSkillCleanTargets().map((target) => rm(target, {
-		force: true,
-		recursive: true
-	})));
-}
-async function installDefaultSkills(cwd) {
-	try {
-		await cleanGlobalSkills();
-		await execa("npx", [
-			"--yes",
-			"skills",
-			"add",
-			DEFAULT_SKILL_INSTALL_SOURCE,
-			...SKILL_INSTALL_AGENT_ARGS
-		], {
-			cwd,
-			stdio: "inherit"
-		});
-	} catch (error) {
-		const cause = error instanceof Error ? `: ${error.message}` : "";
-		throw new Error(`Failed to install default skills from ${DEFAULT_SKILL_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access for npx skills add and rerun \`moka init\`.`);
-	}
-}
-function hookInstallerFiles(result) {
-	return "items" in result ? result.items.map((item) => item.path) : result.files;
-}
 async function initPipelineProject(options = {}) {
-	const cwd = options.cwd ?? process.cwd();
-	const { check, dryRun } = options;
-	const installerFlags = initInstallerFlags(options);
-	if (!(check || dryRun)) await (options.skillInstaller ?? installDefaultSkills)(cwd);
-	const result = await installCommands({
-		cwd,
+	return { files: (await installCommands({
+		cwd: options.cwd ?? process.cwd(),
 		host: "all",
-		...installerFlags
-	});
-	const hooks = await (options.hookInstaller ?? (() => installHooks(installerFlags)))(cwd);
-	const rulesResult = await (options.rulesInstaller ?? (() => installRules(installerFlags)))(cwd);
-	return { files: [
-		...result.items.map((item) => item.path),
-		...hookInstallerFiles(hooks),
-		...rulesResult.items.map((item) => item.path)
-	] };
+		...initInstallerFlags(options)
+	})).items.map((item) => item.path) };
 }
 function initInstallerFlags(options) {
 	const { check, dryRun } = options;
@@ -108,17 +27,17 @@ function initInstallerFlags(options) {
 }
 const INIT_RESULT_COPY = {
 	install: {
-		headline: "Initialized package-owned pipeline support:",
+		headline: "Initialized moka slash-command adapters:",
 		fileVerb: "generated",
 		footer: "no repo-local pipeline config files were created"
 	},
 	check: {
-		headline: "Verified package-owned pipeline support is current:",
+		headline: "Verified moka slash-command adapters are current:",
 		fileVerb: "current",
-		footer: "harness verified; no changes written"
+		footer: "adapters verified; no changes written"
 	},
 	dryRun: {
-		headline: "Planned package-owned pipeline support:",
+		headline: "Planned moka slash-command adapters:",
 		fileVerb: "would generate",
 		footer: "dry run; no changes written"
 	}
@@ -132,7 +51,7 @@ function formatPipelineInitResult(result, mode = {}) {
 	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
 		copy.headline,
-		"per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/agent/rules; inherited by every repo with no per-repo copy",
+		"per-machine slash-command adapters (/moka-execute|inspect|quick) installed globally (~/.claude, ~/.config/opencode, ~/.codex); the agent harness (skills, hooks, instruction rules) comes from oisin-ee/agent via chezmoi, not moka",
 		...result.files.map((path) => `${copy.fileVerb} ${path}`),
 		copy.footer
 	].join("\n");

package/package.json

@@ -81,6 +81,10 @@
       "types": "./dist/config.d.ts",
       "import": "./dist/config.js"
     },
+    "./factory-lane": {
+      "types": "./dist/factory-lane.d.ts",
+      "import": "./dist/factory-lane.js"
+    },
     "./events": {
       "types": "./dist/runner-event-schema.d.ts",
       "import": "./dist/runner-event-schema.js"
@@ -138,7 +142,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.20.1",
+  "version": "3.22.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/agent-assets.js

@@ -1,7 +0,0 @@
-//#region src/agent-assets.ts
-const AGENT_ASSET_SOURCE = "oisin-ee/agent";
-const AGENT_SKILL_SOURCE = "oisin-ee/agent/skills";
-const AGENT_HOOKS_DIR = "hooks";
-const AGENT_RULES_DIR = "rules";
-//#endregion
-export { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR, AGENT_RULES_DIR, AGENT_SKILL_SOURCE };

package/dist/install-hooks.js

@@ -1,274 +0,0 @@
-import { applyJsonEdit, ensureTrailingNewline, parseJsonRecord } from "./json-config-merge.js";
-import { resolveHarnessTarget } from "./install-commands/shared.js";
-import { AGENT_ASSET_SOURCE, AGENT_HOOKS_DIR } from "./agent-assets.js";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { execa } from "execa";
-import { tmpdir } from "node:os";
-import { dirname, join, relative } from "node:path";
-import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-//#region src/install-hooks.ts
-const DEFAULT_HOOK_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
-const HOOK_HOSTS = [
-	"claude-code",
-	"codex",
-	"opencode"
-];
-const MANIFEST_FILE = ".moka-agent-hooks.json";
-const HOST_TARGET_ROOT = {
-	"claude-code": ".claude",
-	codex: ".codex",
-	opencode: ".opencode"
-};
-const NON_HOOK_OWNED_TARGETS = /* @__PURE__ */ new Set([".opencode/opencode.json"]);
-function hashContent(content) {
-	return createHash("sha256").update(content).digest("hex");
-}
-const MERGE_MANAGED = { ".claude/settings.json": [
-	["hooks"],
-	["skillListingBudgetFraction"],
-	["skillOverrides"]
-] };
-function mergeKeysFor(path) {
-	return MERGE_MANAGED[path];
-}
-function canonicalize(value) {
-	if (Array.isArray(value)) return value.map(canonicalize);
-	if (isRecord(value)) {
-		const out = {};
-		for (const key of Object.keys(value).sort()) out[key] = canonicalize(value[key]);
-		return out;
-	}
-	return value;
-}
-function hashJson(value) {
-	return hashContent(Buffer.from(JSON.stringify(canonicalize(value) ?? null)));
-}
-function managedSubtree(text, keyPath) {
-	const parsed = parseJsonRecord(text);
-	if (!parsed.ok) return;
-	let cursor = parsed.value;
-	for (const key of keyPath) {
-		if (!isRecord(cursor)) return;
-		cursor = cursor[key];
-	}
-	return cursor;
-}
-function targetIdentityHash(path, content) {
-	const mergeKeys = mergeKeysFor(path);
-	if (!mergeKeys) return hashContent(content);
-	const text = content.toString("utf8");
-	const subtrees = {};
-	for (const keyPath of mergeKeys) subtrees[keyPath.join(".")] = managedSubtree(text, keyPath);
-	return hashJson(subtrees);
-}
-async function cloneHookRepository(targetDir) {
-	await execa("gh", [
-		"repo",
-		"clone",
-		DEFAULT_HOOK_INSTALL_SOURCE,
-		targetDir,
-		"--",
-		"--depth=1"
-	], { stdio: "inherit" });
-}
-async function withHookSource(useSource) {
-	const parent = await mkdtemp(join(tmpdir(), "moka-agent-"));
-	const source = join(parent, "agent");
-	try {
-		await cloneHookRepository(source);
-		return await useSource(source);
-	} finally {
-		await rm(parent, {
-			force: true,
-			recursive: true
-		});
-	}
-}
-async function listFiles(root) {
-	if (!existsSync(root)) return [];
-	if (statSync(root).isFile()) return [root];
-	const entries = await readdir(root, { withFileTypes: true });
-	return (await Promise.all(entries.map((entry) => {
-		const path = join(root, entry.name);
-		return entry.isDirectory() ? listFiles(path) : [path];
-	}))).flat();
-}
-async function sourceHookFiles(source) {
-	return (await Promise.all(HOOK_HOSTS.map(async (host) => {
-		const hostRoot = join(source, AGENT_HOOKS_DIR, host);
-		return (await listFiles(hostRoot)).flatMap((file) => {
-			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
-			const content = readFileSync(file);
-			const path = `${HOST_TARGET_ROOT[host]}/${relativePath}`;
-			return isHookOwnedTarget(path) ? [{
-				content,
-				hash: targetIdentityHash(path, content),
-				host,
-				path
-			}] : [];
-		});
-	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
-}
-function manifestPath(host) {
-	return resolveHarnessTarget(`${HOST_TARGET_ROOT[host]}/${MANIFEST_FILE}`);
-}
-function emptyManifest() {
-	return {
-		files: {},
-		repository: DEFAULT_HOOK_INSTALL_SOURCE,
-		version: 1
-	};
-}
-function isHookOwnedTarget(path) {
-	return !NON_HOOK_OWNED_TARGETS.has(path);
-}
-function readManifest(host) {
-	const path = manifestPath(host);
-	if (!existsSync(path)) return emptyManifest();
-	try {
-		return normalizeManifest(JSON.parse(readFileSync(path, "utf8")));
-	} catch {
-		return emptyManifest();
-	}
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function normalizeManifest(value) {
-	const files = {};
-	const manifestFiles = isRecord(value) ? value.files : void 0;
-	if (!isRecord(manifestFiles)) return emptyManifest();
-	for (const [path, entry] of Object.entries(manifestFiles)) if (isRecord(entry) && typeof entry.hash === "string") files[path] = { hash: entry.hash };
-	return {
-		files,
-		repository: DEFAULT_HOOK_INSTALL_SOURCE,
-		version: 1
-	};
-}
-function targetPath(path) {
-	return resolveHarnessTarget(path);
-}
-function actionForFile(file, force, manifests) {
-	const target = targetPath(file.path);
-	if (!existsSync(target)) return "create";
-	const currentHash = targetIdentityHash(file.path, readFileSync(target));
-	if (currentHash === file.hash) return "unchanged";
-	if (force) return "update";
-	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
-}
-function planFiles(files, force, manifests) {
-	return files.map((file) => ({
-		...file,
-		action: actionForFile(file, force, manifests)
-	}));
-}
-function planObsoleteFiles(desiredPaths, force, manifests) {
-	const obsolete = [];
-	for (const [host, manifest] of manifests) for (const [path, entry] of Object.entries(manifest.files)) {
-		const planned = planObsoleteFile(host, path, entry, force, desiredPaths);
-		if (planned) obsolete.push(planned);
-	}
-	return obsolete.sort((a, b) => a.path.localeCompare(b.path));
-}
-function planObsoleteFile(host, path, entry, force, desiredPaths) {
-	if (desiredPaths.has(path) || !isHookOwnedTarget(path)) return;
-	const target = targetPath(path);
-	if (!existsSync(target)) return;
-	const currentHash = hashContent(readFileSync(target));
-	return {
-		action: force || currentHash === entry.hash ? "delete" : "conflict",
-		host,
-		path
-	};
-}
-async function writePlannedFile(file) {
-	if (file.action === "conflict" || file.action === "unchanged") return;
-	const target = targetPath(file.path);
-	await mkdir(dirname(target), { recursive: true });
-	const mergeKeys = mergeKeysFor(file.path);
-	if (mergeKeys && existsSync(target)) {
-		const sourceText = file.content.toString("utf8");
-		let merged = readFileSync(target, "utf8");
-		for (const keyPath of mergeKeys) {
-			const desired = managedSubtree(sourceText, keyPath);
-			if (desired !== void 0) merged = applyJsonEdit(merged, keyPath, desired);
-		}
-		await writeFile(target, ensureTrailingNewline(merged));
-		return;
-	}
-	await writeFile(target, file.content);
-}
-function itemFor(file) {
-	return {
-		action: file.action,
-		host: file.host,
-		path: file.path
-	};
-}
-function itemForObsolete(file) {
-	return {
-		action: file.action,
-		host: file.host,
-		path: file.path
-	};
-}
-async function removeObsoleteFile(file) {
-	if (file.action !== "delete") return;
-	await rm(targetPath(file.path), { force: true });
-}
-function assertNoConflicts(items, dryRun) {
-	if (dryRun) return;
-	const conflicts = items.filter((item) => item.action === "conflict");
-	if (conflicts.length === 0) return;
-	throw new Error([
-		"Refusing to overwrite manually edited hook files.",
-		...conflicts.map((item) => `- ${item.path}`),
-		"Re-run with --force to overwrite them."
-	].join("\n"));
-}
-function assertCheckCurrent(items, check) {
-	if (!check) return;
-	const changed = items.filter((item) => item.action !== "unchanged");
-	if (changed.length === 0) return;
-	throw new Error(["Installed hook files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
-}
-async function writeManifests(files) {
-	const byHost = /* @__PURE__ */ new Map();
-	for (const host of HOOK_HOSTS) byHost.set(host, emptyManifest());
-	for (const file of files) {
-		const manifest = byHost.get(file.host);
-		if (manifest) manifest.files[file.path] = { hash: file.hash };
-	}
-	await Promise.all([...byHost.entries()].map(async ([host, manifest]) => {
-		const path = manifestPath(host);
-		if (Object.keys(manifest.files).length === 0) {
-			await rm(path, { force: true });
-			return;
-		}
-		await mkdir(dirname(path), { recursive: true });
-		await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`);
-	}));
-}
-function installHooks(options = {}) {
-	return withHookSource(async (source) => {
-		const files = await sourceHookFiles(source);
-		const manifests = new Map(HOOK_HOSTS.map((host) => [host, readManifest(host)]));
-		const planned = planFiles(files, Boolean(options.force), manifests);
-		const obsolete = planObsoleteFiles(new Set(files.map((file) => file.path)), Boolean(options.force), manifests);
-		const items = [...planned.map(itemFor), ...obsolete.map(itemForObsolete)];
-		assertCheckCurrent(items, Boolean(options.check));
-		assertNoConflicts(items, Boolean(options.dryRun));
-		if (!(options.check || options.dryRun)) {
-			for (const file of planned) await writePlannedFile(file);
-			for (const file of obsolete) await removeObsoleteFile(file);
-			await writeManifests(planned);
-		}
-		return {
-			items,
-			source: DEFAULT_HOOK_INSTALL_SOURCE
-		};
-	});
-}
-//#endregion
-export { installHooks };

package/dist/install-rules.js

@@ -1,200 +0,0 @@
-import { resolveHarnessTarget } from "./install-commands/shared.js";
-import { AGENT_ASSET_SOURCE, AGENT_RULES_DIR } from "./agent-assets.js";
-import { execa } from "execa";
-import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
-//#region src/install-rules.ts
-const DEFAULT_RULES_INSTALL_SOURCE = AGENT_ASSET_SOURCE;
-const RULESYNC_PACKAGE = "rulesync@8.30.1";
-const RULESYNC_TARGETS = [
-	"claudecode",
-	"codexcli",
-	"geminicli",
-	"opencode"
-];
-const RULE_OUTPUTS = [
-	{
-		generatedPath: ".claude/CLAUDE.md",
-		targetPath: ".claude/CLAUDE.md"
-	},
-	{
-		generatedPath: ".codex/AGENTS.md",
-		targetPath: ".codex/AGENTS.md"
-	},
-	{
-		generatedPath: ".gemini/GEMINI.md",
-		targetPath: ".gemini/GEMINI.md"
-	},
-	{
-		generatedPath: ".config/opencode/AGENTS.md",
-		targetPath: ".opencode/AGENTS.md"
-	}
-];
-async function cloneRulesRepository(targetDir) {
-	await execa("gh", [
-		"repo",
-		"clone",
-		DEFAULT_RULES_INSTALL_SOURCE,
-		targetDir,
-		"--",
-		"--depth=1"
-	], { stdio: "inherit" });
-}
-async function withRulesSource(sourceOverride, useSource) {
-	if (sourceOverride !== void 0) return useSource(sourceOverride);
-	const parent = await mkdtemp(join(tmpdir(), "moka-agent-rules-"));
-	const source = join(parent, "agent");
-	try {
-		await cloneRulesRepository(source);
-		return await useSource(source);
-	} finally {
-		await rm(parent, {
-			force: true,
-			recursive: true
-		});
-	}
-}
-async function defaultRulesyncRunner(args, opts) {
-	try {
-		await execa("npx", [
-			"--yes",
-			RULESYNC_PACKAGE,
-			...args
-		], {
-			cwd: opts.cwd,
-			env: opts.env,
-			stdio: "inherit"
-		});
-	} catch (error) {
-		const cause = error instanceof Error ? `: ${error.message}` : "";
-		throw new Error(`Failed to generate global rules from ${DEFAULT_RULES_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access with \`gh auth login\` and rerun \`moka init\`.`);
-	}
-}
-async function buildRootRule(source) {
-	const rulesDir = join(source, AGENT_RULES_DIR);
-	let entries = [];
-	try {
-		entries = (await readdir(rulesDir, { withFileTypes: true })).filter((d) => d.isFile() && d.name.endsWith(".md")).map((d) => d.name).sort((a, b) => a.localeCompare(b));
-	} catch {}
-	const rootContent = `---
-root: true
-targets:
-  - "*"
----
-
-${(await Promise.all(entries.map(async (name) => {
-		return (await readFile(join(rulesDir, name), "utf8")).trimEnd();
-	}))).join("\n\n")}\n`;
-	const rulesyncRulesDir = join(source, ".rulesync", "rules");
-	await mkdir(rulesyncRulesDir, { recursive: true });
-	await writeFile(join(rulesyncRulesDir, "_root.md"), rootContent);
-}
-async function withRulesyncHome(useHome) {
-	const home = await mkdtemp(join(tmpdir(), "moka-rules-home-"));
-	try {
-		return await useHome(home);
-	} finally {
-		await rm(home, {
-			force: true,
-			recursive: true
-		});
-	}
-}
-function rulesyncArgs(options) {
-	const args = [
-		"generate",
-		"-t",
-		RULESYNC_TARGETS.join(","),
-		"-f",
-		"rules",
-		"--delete",
-		"--global"
-	];
-	if (options.dryRun) args.push("--dry-run");
-	if (options.silent) args.push("--silent");
-	return args;
-}
-async function runRulesyncGenerate(input) {
-	await input.runner(rulesyncArgs(input), {
-		cwd: input.source,
-		env: {
-			...process.env,
-			HOME_DIR: input.home
-		}
-	});
-}
-function ruleItems(action) {
-	return RULE_OUTPUTS.map((output) => ({
-		action,
-		path: resolveHarnessTarget(output.targetPath)
-	}));
-}
-function readGeneratedRuleFiles(home) {
-	return Promise.all(RULE_OUTPUTS.map(async (output) => ({
-		content: await readFile(join(home, output.generatedPath), "utf8"),
-		path: resolveHarnessTarget(output.targetPath)
-	})));
-}
-async function writeGeneratedRuleFiles(files) {
-	for (const file of files) {
-		await mkdir(dirname(file.path), { recursive: true });
-		await writeFile(file.path, file.content);
-	}
-}
-async function installedRuleAction(file) {
-	try {
-		return await readFile(file.path, "utf8") === file.content ? "unchanged" : "update";
-	} catch {
-		return "create";
-	}
-}
-async function assertInstalledRulesCurrent(files) {
-	const changed = (await Promise.all(files.map(async (file) => ({
-		action: await installedRuleAction(file),
-		path: file.path
-	})))).filter((item) => item.action !== "unchanged");
-	if (changed.length === 0) return;
-	throw new Error(["Installed rule files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
-}
-function installRules(options = {}) {
-	const runner = options.rulesyncRunner ?? defaultRulesyncRunner;
-	return withRulesSource(options.sourceOverride, async (source) => {
-		await buildRootRule(source);
-		return withRulesyncHome(async (home) => {
-			if (options.dryRun) {
-				await runRulesyncGenerate({
-					dryRun: true,
-					home,
-					runner,
-					source
-				});
-				return {
-					items: ruleItems("skip"),
-					source: DEFAULT_RULES_INSTALL_SOURCE
-				};
-			}
-			await runRulesyncGenerate({
-				home,
-				runner,
-				silent: options.check,
-				source
-			});
-			const files = await readGeneratedRuleFiles(home);
-			if (options.check) {
-				await assertInstalledRulesCurrent(files);
-				return {
-					items: ruleItems("skip"),
-					source: DEFAULT_RULES_INSTALL_SOURCE
-				};
-			}
-			await writeGeneratedRuleFiles(files);
-			return {
-				items: ruleItems("generate"),
-				source: DEFAULT_RULES_INSTALL_SOURCE
-			};
-		});
-	});
-}
-//#endregion
-export { installRules };