@oisincoveney/pipeline 3.23.0 → 3.24.0

package/README.md

@@ -379,6 +379,15 @@ Package and container publishing is owned by GitHub Actions. Do not publish from
 a workstation with `npm publish`, `semantic-release`, Docker pushes, or direct
 registry commands.
 
+The authoritative package version lives in the npm registry, not in this
+repository. `package.json` pins the `0.0.0-development` semantic-release
+sentinel and is never bumped in git; semantic-release derives and publishes the
+real version from commit history at release time. To learn the current version,
+query the registry (`npm view @oisincoveney/pipeline version`) — the repo
+`version` field is intentionally not authoritative. Downstream pins (for example
+pipeline-console) should track the registry via Renovate rather than the git
+field.
+
 Before committing changes in this repository, run:
 
 ```shell

package/defaults/pipeline.yaml

@@ -79,10 +79,11 @@ runner_command:
       # Set up package-owned pipeline support + the opencode model registration
       # (.opencode/opencode.json, which declares the gpt-5.5-* reasoning selectors)
       # on every run, so opencode-backed agents in the pod resolve their models
-      # instead of failing with "Model not found". `moka init` installs the full
-      # per-machine harness (skills + commands + hooks + rules); --force refreshes
-      # a pre-baked/version-skewed settings.json instead of refusing it. Idempotent,
-      # writes no repo-local pipeline config.
+      # instead of failing with "Model not found". `moka init` installs Moka host
+      # adapters only; the shared harness (skills + hooks + rules) is laid down by
+      # chezmoi before this step. --force refreshes a pre-baked/version-skewed
+      # settings.json instead of refusing it. Idempotent, writes no repo-local
+      # pipeline config.
       - command: moka
         args: [init, --force]
 scheduler:

package/dist/cli/bootstrap-commands.js

@@ -10,7 +10,12 @@ function registerBootstrapCommands(program) {
 		console.log(flags.json ? JSON.stringify(result) : formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
 	});
-	program.command("init").description("Install or refresh moka's slash-command adapters (/moka-execute, /moka-inspect, /moka-quick) plus the singleton MCP gateway host config, globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config. The agent harness (skills, hooks, instruction rules) is provisioned separately from oisin-ee/agent via chezmoi, not by moka.").option("--check", "verify the installed adapters are current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited command adapter files").action(async (flags) => {
+	program.command("init").description([
+		"Install or refresh Moka host adapters (/moka-execute, /moka-inspect, /moka-quick command surfaces,",
+		"native-agent projections, and gateway config), globally to ~/.claude, ~/.config/opencode, ~/.codex",
+		"with no repo-local config. The shared agent harness (skills, hooks, instruction rules) is provisioned",
+		"separately from oisin-ee/agent via chezmoi, not by Moka."
+	].join(" ")).option("--check", "verify the installed adapters are current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited command adapter files").action(async (flags) => {
 		const result = await initPipelineProject({
 			...flags,
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()

package/dist/config/lint.js

@@ -61,7 +61,7 @@ function missingFileReferenceWarning(path, value) {
 }
 function missingFileReferenceMessage(path, value) {
 	const base = `${path} references missing file '${value}'`;
-	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/agent/skills\`.`;
+	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`chezmoi apply --refresh-externals always\` to install shared harness skills from oisin-ee/agent.`;
 	return base;
 }
 function resolveLintPathReference(projectRoot, ref) {

package/dist/factory/create-experiment.js

@@ -1,5 +1,6 @@
 import { DEFAULT_RUNNER_COMMAND_GIT_COMMITTER } from "../config/schema/catalog.js";
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -80,7 +81,7 @@ async function runCreateExperiment(options) {
 		previews,
 		...options.templateRef ? { templateRef: options.templateRef } : {},
 		templateSource
-	}));
+	}), { env: githubGitCredentialEnv() });
 	const stampedRegistryEntry = join(stampDir, STAMPED_REGISTRY_DIR, `${name}.yaml`);
 	if (!existsSync(stampedRegistryEntry)) throw new Error(`create-experiment: stamp is missing the registry entry ${STAMPED_REGISTRY_DIR}/${name}.yaml — template contract changed?`);
 	log("create-experiment: committing the stamped tree");

package/dist/factory/exec.js

@@ -3,6 +3,7 @@ import { execa } from "execa";
 //#region src/factory/exec.ts
 const defaultFactoryExec = (command, args, options) => execa(command, [...args], {
 	...options?.cwd ? { cwd: options.cwd } : {},
+	...options?.env ? { env: options.env } : {},
 	stdin: "ignore"
 });
 const defaultFactoryGit = (cwd, args) => runAuthenticatedGit(cwd, args);

package/dist/factory/git-credentials.js

@@ -0,0 +1,37 @@
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+//#region src/factory/git-credentials.ts
+const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
+/**
+* copier fetches the (private) momokaya-template by spawning its OWN git
+* subprocess (`git ls-remote` / `clone`, via plumbum). `runAuthenticatedGit`
+* only configures credentials per-invocation with `-c` flags on the git calls
+* the lane makes itself, so copier's git sees no github.com credential and
+* dies `fatal: could not read Username for 'https://github.com'`.
+*
+* This materializes a process-wide github.com credential from the runner's
+* mounted git-credentials (username + PAT under /etc/pipeline/git-credentials)
+* as `GIT_CONFIG_*` env any child (and grandchild) git process inherits, so
+* copier's template fetch authenticates. The token is written to a 0600 store
+* file and referenced by a `credential.helper=store` entry — it never lands in
+* a URL or argv. No mounted credentials (local dev) -> empty env, so git falls
+* back to ambient auth.
+*/
+function githubGitCredentialEnv(credentialsDir = process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR) {
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return {};
+	const username = readFileSync(usernamePath, "utf8").trim();
+	const password = readFileSync(passwordPath, "utf8").trim();
+	const storePath = join(mkdtempSync(join(tmpdir(), "factory-git-cred-")), ".git-credentials");
+	writeFileSync(storePath, `https://${encodeURIComponent(username)}:${encodeURIComponent(password)}@github.com\n`, { mode: 384 });
+	return {
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "credential.helper",
+		GIT_CONFIG_VALUE_0: `store --file=${storePath}`,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+}
+//#endregion
+export { githubGitCredentialEnv };

package/dist/factory/template-update.js

@@ -1,4 +1,5 @@
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { committerConfigArgs } from "./create-experiment.js";
 import { isStampOf, parseCopierAnswers } from "./stamp-answers.js";
 import { parse } from "yaml";
@@ -101,7 +102,10 @@ async function updateRepo(input) {
 			"--trust",
 			"--defaults",
 			...input.templateRef ? ["--vcs-ref", input.templateRef] : []
-		], { cwd: cloneDir });
+		], {
+			cwd: cloneDir,
+			env: githubGitCredentialEnv()
+		});
 		const status = await git(cloneDir, ["status", "--porcelain"]);
 		if (status.trim().length === 0) return {
 			repo,

package/dist/pipeline-init.js

@@ -1,13 +1,14 @@
 import { installCommands } from "./install-commands.js";
 //#region src/pipeline-init.ts
 /**
-* `moka init` installs only moka's own slash-command adapters
-* (`/moka-execute|inspect|quick`) plus the singleton MCP gateway host config,
-* globally for Claude Code, Codex, and OpenCode. The shared agent harness
+* `moka init` installs only Moka's own host adapters
+* (`/moka-execute|inspect|quick` command surfaces, native-agent projections,
+* and singleton MCP gateway host config) globally for Claude Code, Codex, and
+* OpenCode. The shared agent harness
 * (skills, agent hooks, and global instruction rules) is no longer installed by
-* moka — it is provisioned from `oisin-ee/agent` via chezmoi (the dotfiles'
+* Moka — it is provisioned from `oisin-ee/agent` via chezmoi (the dotfiles'
 * `.chezmoiexternal` clone + `run_onchange` harness installer). Keeping moka's
-* command adapters here means the runner image (and local dev) still gets the
+* host adapters here means the runner image (and local dev) still gets the
 * `/moka-*` entrypoints after `chezmoi apply` lays down the harness.
 */
 async function initPipelineProject(options = {}) {
@@ -27,17 +28,17 @@ function initInstallerFlags(options) {
 }
 const INIT_RESULT_COPY = {
 	install: {
-		headline: "Initialized moka slash-command adapters:",
+		headline: "Initialized Moka host adapters:",
 		fileVerb: "generated",
 		footer: "no repo-local pipeline config files were created"
 	},
 	check: {
-		headline: "Verified moka slash-command adapters are current:",
+		headline: "Verified Moka host adapters are current:",
 		fileVerb: "current",
 		footer: "adapters verified; no changes written"
 	},
 	dryRun: {
-		headline: "Planned moka slash-command adapters:",
+		headline: "Planned Moka host adapters:",
 		fileVerb: "would generate",
 		footer: "dry run; no changes written"
 	}
@@ -51,7 +52,11 @@ function formatPipelineInitResult(result, mode = {}) {
 	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
 		copy.headline,
-		"per-machine slash-command adapters (/moka-execute|inspect|quick) installed globally (~/.claude, ~/.config/opencode, ~/.codex); the agent harness (skills, hooks, instruction rules) comes from oisin-ee/agent via chezmoi, not moka",
+		[
+			"per-machine Moka host adapters (/moka-execute|inspect|quick command surfaces, native-agent projections,",
+			"and gateway config) installed globally (~/.claude, ~/.config/opencode, ~/.codex); the shared agent harness",
+			"(skills, hooks, instruction rules) comes from oisin-ee/agent via chezmoi, not Moka"
+		].join(" "),
 		...result.files.map((path) => `${copy.fileVerb} ${path}`),
 		copy.footer
 	].join("\n");

package/dist/runner-command/pre-schedule.js

@@ -127,6 +127,7 @@ function generateSchedulePhaseEffect(context) {
 				config: context.config,
 				entrypointId,
 				phaseContext,
+				pullRequestDeliveryRequested: context.payload.delivery.pullRequest,
 				runId: context.payload.run.id,
 				task: context.task,
 				worktreePath: context.worktreePath

package/docs/config-architecture.md

@@ -151,8 +151,8 @@ receive explicit grants:
 - `network`: inherited or disabled.
 - `output`: text, JSON, JSONL, or JSON Schema output.
 
-Default skills resolve from project-installed skill files created by
-`moka init` via `npx --yes skills add oisin-ee/agent/skills`:
+Default skills resolve from shared harness skill files installed from
+`oisin-ee/agent` by chezmoi:
 
 ```yaml
 skills:
@@ -161,11 +161,11 @@ skills:
 ```
 
 Project-authored skill and rule paths resolve from the project root and must
-exist for runtime use. If default skill files are missing, run `moka init` to
-install them before executing workflows.
+exist for runtime use. If shared harness skill files are missing, run
+`chezmoi apply --refresh-externals always` before executing workflows.
 
-Default agent hooks are copied by `moka init` from private `oisin-ee/agent`.
-That source repository has one canonical hook layout:
+Default agent hooks are copied by `bin/install-harness.mjs` from private
+`oisin-ee/agent`. That source repository has one canonical hook layout:
 
 ```text
 hooks/claude-code/
@@ -173,18 +173,10 @@ hooks/codex/
 hooks/opencode/
 ```
 
-Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
-project scope, or the corresponding per-machine host config directories for
-global scope. Moka tracks installed hashes in host-local manifests so it can
-update unchanged owned hook files, delete owned files removed from the hook
-repository, and reject manual drift unless `--force` is used.
-
-`moka init --skill-scope` (PIPE-83.12) chooses how the default set is installed:
-`project` (default) vendors a repo-local copy (`skills add … --copy`,
-`skills-lock.json`); `personal` installs once at user/global scope
-(`skills add … --global`) so every repo the user opens inherits the skills with
-no per-repo copy and no project lockfile — the standardization path for a single
-user across many projects.
+The harness installer overlays those folders onto the corresponding per-machine
+host config directories. It tracks installed hashes in host-local manifests so
+it can update unchanged owned hook files, delete owned files removed from the
+hook repository, and reject manual drift unless `--force` is used.
 
 MCP-enabled profiles use one gateway grant:
 
@@ -211,10 +203,10 @@ OpenCode host resources are generated from the same profile registry:
 
 - `.opencode/agents/*.md` declares native agents with `mode`, `description`,
   resolved model, explicit permissions, and task access to generated agents only.
-- `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
-  generates agents, commands, plugins, and project config.
-- Additional manually authored OpenCode hook plugins can be copied from
-  `oisin-ee/agent/hooks/opencode/` by `moka init`.
+- `.agents/skills/*/SKILL.md` is installed by the shared harness; Moka only
+  generates agents, commands, plugins, and host config.
+- Additional manually authored OpenCode hook plugins are copied from
+  `oisin-ee/agent/hooks/opencode/` by the shared harness installer.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and
@@ -454,8 +446,9 @@ rather than re-emitting it into every project.
 
 ## Troubleshooting
 
-- Missing host resources: run `moka init`; `moka run` loads the installed
+- Missing Moka host adapters: run `moka init`; `moka run` loads the installed
   package config.
+- Missing shared harness assets: run `chezmoi apply --refresh-externals always`.
 - Capability error: reduce the profile grants or choose a runner whose declared
   capabilities include the requested tools, filesystem, network, output, rules,
   skills, or MCP access.

package/docs/mcp-gateway.md

@@ -47,7 +47,7 @@ host-specific MCP config.
 3. Configure `mcp_gateway` in package-owned profile config.
 4. Run `moka mcp gateway reconcile` to render and apply the full ToolHive vMCP
    backend inventory for the current workspace.
-5. Run `moka init` to write project OpenCode and Claude Code command surfaces and host
+5. Run `moka init` to write OpenCode and Claude Code command surfaces and host
    MCP config.
 6. Run `moka mcp gateway doctor` to verify gateway health and required tools.
 7. Keep high-risk upstream capabilities controlled by gateway-side policy, not

package/docs/slash-command-adapter-contract.md

@@ -32,9 +32,9 @@ moka init --check
 - OpenCode agents project package profiles as markdown agents with `mode`,
   `description`, resolved `model`, `permission`, `hidden`, and task permission
   maps. The primary orchestrator may call only generated package profile agents.
-- OpenCode skill files are installed by `npx skills add` during `moka init`;
-  Moka does not generate `.opencode/skills`. Generated agent
-  `permission.skill` maps still deny ungranted skills.
+- OpenCode skill files are installed by the shared harness from `oisin-ee/agent`;
+  Moka does not generate skill files. Generated agent `permission.skill` maps
+  still deny ungranted skills.
 - `.opencode/opencode.json` includes the singleton `pipeline-gateway` MCP
   server and enables OpenCode LSP. CLI lint, typecheck, tests, and configured
   gates remain the blocking verification path; LSP is editor/runtime assistance.

package/package.json

@@ -146,7 +146,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.23.0",
+  "version": "3.24.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",