@oisincoveney/pipeline 3.7.2 → 3.8.0

package/README.md

@@ -43,10 +43,10 @@ Initialize package-owned pipeline support:
 moka init
 ```
 
-`moka init` vendors the package's default project skills, then writes generated
-OpenCode command surfaces plus the singleton `pipeline-gateway` MCP entry.
-OpenCode is the package default runtime. The command does not create repo-local
-`.pipeline` config files.
+`moka init` installs the package's default skills, generated host command
+surfaces, the singleton `pipeline-gateway` MCP entry, and copied hook files from
+the private `oisin-ee/agent-hooks` repository. OpenCode is the package default
+runtime. The command does not create repo-local `.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -62,6 +62,12 @@ Check or refresh generated host files after package upgrades:
 moka install-commands --host all --check
 ```
 
+Check or refresh copied agent hooks after editing `oisin-ee/agent-hooks`:
+
+```shell
+moka install-hooks --scope global --check
+```
+
 Check local prerequisites and config health:
 
 ```shell
@@ -98,6 +104,7 @@ Canonical commands:
 - `moka export <run-id> --sanitize`: print a portable evidence bundle.
 - `moka doctor`: check local prerequisites and config health.
 - `moka init`: install package-owned host resources for a repository.
+- `moka install-hooks`: copy manually authored hooks from `oisin-ee/agent-hooks`.
 - `moka refresh-harnesses`: force-refresh generated agent harnesses and commit
   owned resource changes.
 

package/dist/argo-submit.d.ts

@@ -21,6 +21,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -39,6 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1).optional(),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -89,6 +90,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		name: options.name,
 		namespace: options.namespace,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/argo-workflow.js

@@ -296,6 +296,26 @@ function runnerWorkflowStorage(options, tasks) {
 			subPath: "auth.json"
 		});
 	}
+	if (options.opencodeOpenaiAccountsSecret) {
+		const accountsKey = options.opencodeOpenaiAccountsSecret.key ?? "accounts.json";
+		volumes.push({
+			name: "opencode-openai-accounts",
+			secret: {
+				defaultMode: 256,
+				items: [{
+					key: accountsKey,
+					path: "accounts.json"
+				}],
+				secretName: options.opencodeOpenaiAccountsSecret.name
+			}
+		});
+		volumeMounts.push({
+			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			name: "opencode-openai-accounts",
+			readOnly: true,
+			subPath: "accounts.json"
+		});
+	}
 	if (options.gitCredentialsSecretName) {
 		volumes.push({
 			name: "runner-git-credentials",

package/dist/cli/program.js

@@ -16,6 +16,7 @@ import { MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, resolveMokaRun } from "./run-resolv
 import { registerTicketCommand } from "../commands/ticket-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "../install-commands.js";
+import { formatInstallHooksResult, installHooks } from "../install-hooks.js";
 import { formatPipelineInitResult, formatRefreshAgentHarnessesResult, initPipelineProject, refreshAgentHarnesses } from "../pipeline-init.js";
 import { createRun, runControlStatusPaths, updateRunController } from "../run-control/store.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
@@ -357,6 +358,13 @@ function createCliProgram(options = {}) {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
+	program.command("install-hooks").description("Install agent hooks from oisin-ee/agent-hooks (global per-machine by default)").addOption(new Option$1("--scope <scope>", "where to install: global (~/.claude, ~/.config/opencode, ~/.codex) or project (repo-local)").choices(["global", "project"]).default("global")).option("--dry-run", "show planned changes without writing files").option("--check", "fail if installed hook files are missing or stale").option("--force", "overwrite manually edited hook files").action(async (flags) => {
+		const result = await installHooks({
+			...flags,
+			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()
+		});
+		console.log(formatInstallHooksResult(result));
+	});
 	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
 		const result = syncLocalCodexAuth({
 			check: flags.check,

package/dist/cli/submit-options.js

@@ -49,6 +49,7 @@ function mokaCommonSubmitOptions(input) {
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/install-hooks.js

@@ -0,0 +1,223 @@
+import { resolveHarnessTarget } from "./install-commands/shared.js";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { execa } from "execa";
+import { dirname, join, relative } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+//#region src/install-hooks.ts
+const DEFAULT_HOOK_INSTALL_SOURCE = "oisin-ee/agent-hooks";
+const HOOK_HOSTS = [
+	"claude-code",
+	"codex",
+	"opencode"
+];
+const MANIFEST_FILE = ".moka-agent-hooks.json";
+const HOST_TARGET_ROOT = {
+	"claude-code": ".claude",
+	codex: ".codex",
+	opencode: ".opencode"
+};
+function hashContent(content) {
+	return createHash("sha256").update(content).digest("hex");
+}
+async function cloneHookRepository(targetDir) {
+	await execa("gh", [
+		"repo",
+		"clone",
+		DEFAULT_HOOK_INSTALL_SOURCE,
+		targetDir,
+		"--",
+		"--depth=1"
+	], { stdio: "inherit" });
+}
+async function withHookSource(useSource) {
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-hooks-"));
+	const source = join(parent, "agent-hooks");
+	try {
+		await cloneHookRepository(source);
+		return await useSource(source);
+	} finally {
+		await rm(parent, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function listFiles(root) {
+	if (!existsSync(root)) return [];
+	if (statSync(root).isFile()) return [root];
+	const entries = await readdir(root, { withFileTypes: true });
+	return (await Promise.all(entries.map((entry) => {
+		const path = join(root, entry.name);
+		return entry.isDirectory() ? listFiles(path) : [path];
+	}))).flat();
+}
+async function sourceHookFiles(source) {
+	return (await Promise.all(HOOK_HOSTS.map(async (host) => {
+		const hostRoot = join(source, host);
+		return (await listFiles(hostRoot)).map((file) => {
+			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
+			const content = readFileSync(file);
+			return {
+				content,
+				hash: hashContent(content),
+				host,
+				path: `${HOST_TARGET_ROOT[host]}/${relativePath}`
+			};
+		});
+	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
+}
+function manifestPath(scope, cwd, host) {
+	return resolveHarnessTarget(scope, cwd, `${HOST_TARGET_ROOT[host]}/${MANIFEST_FILE}`);
+}
+function emptyManifest() {
+	return {
+		files: {},
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+}
+function readManifest(scope, cwd, host) {
+	const path = manifestPath(scope, cwd, host);
+	if (!existsSync(path)) return emptyManifest();
+	try {
+		return normalizeManifest(JSON.parse(readFileSync(path, "utf8")));
+	} catch {
+		return emptyManifest();
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeManifest(value) {
+	const files = {};
+	const manifestFiles = isRecord(value) ? value.files : void 0;
+	if (!isRecord(manifestFiles)) return {
+		files,
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+	for (const [path, entry] of Object.entries(manifestFiles)) if (isRecord(entry) && typeof entry.hash === "string") files[path] = { hash: entry.hash };
+	return {
+		files,
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+}
+function targetPath(scope, cwd, path) {
+	return resolveHarnessTarget(scope, cwd, path);
+}
+function actionForFile(file, scope, cwd, force, manifests) {
+	const target = targetPath(scope, cwd, file.path);
+	if (!existsSync(target)) return "create";
+	const currentHash = hashContent(readFileSync(target));
+	if (currentHash === file.hash) return "unchanged";
+	if (force) return "update";
+	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
+}
+function planFiles(files, scope, cwd, force, manifests) {
+	return files.map((file) => ({
+		...file,
+		action: actionForFile(file, scope, cwd, force, manifests)
+	}));
+}
+function planObsoleteFiles(desiredPaths, scope, cwd, force, manifests) {
+	const obsolete = [];
+	for (const [host, manifest] of manifests) for (const [path, entry] of Object.entries(manifest.files)) {
+		if (desiredPaths.has(path)) continue;
+		const target = targetPath(scope, cwd, path);
+		if (!existsSync(target)) continue;
+		const currentHash = hashContent(readFileSync(target));
+		obsolete.push({
+			action: force || currentHash === entry.hash ? "delete" : "conflict",
+			host,
+			path
+		});
+	}
+	return obsolete.sort((a, b) => a.path.localeCompare(b.path));
+}
+async function writePlannedFile(file, scope, cwd) {
+	if (file.action === "conflict" || file.action === "unchanged") return;
+	const target = targetPath(scope, cwd, file.path);
+	await mkdir(dirname(target), { recursive: true });
+	await writeFile(target, file.content);
+}
+function itemFor(file) {
+	return {
+		action: file.action,
+		host: file.host,
+		path: file.path
+	};
+}
+function itemForObsolete(file) {
+	return {
+		action: file.action,
+		host: file.host,
+		path: file.path
+	};
+}
+async function removeObsoleteFile(file, scope, cwd) {
+	if (file.action !== "delete") return;
+	await rm(targetPath(scope, cwd, file.path), { force: true });
+}
+function assertNoConflicts(items, dryRun) {
+	if (dryRun) return;
+	const conflicts = items.filter((item) => item.action === "conflict");
+	if (conflicts.length === 0) return;
+	throw new Error([
+		"Refusing to overwrite manually edited hook files.",
+		...conflicts.map((item) => `- ${item.path}`),
+		"Re-run with --force to overwrite them."
+	].join("\n"));
+}
+function assertCheckCurrent(items, check) {
+	if (!check) return;
+	const changed = items.filter((item) => item.action !== "unchanged");
+	if (changed.length === 0) return;
+	throw new Error(["Installed hook files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
+}
+async function writeManifests(files, scope, cwd) {
+	const byHost = /* @__PURE__ */ new Map();
+	for (const host of HOOK_HOSTS) byHost.set(host, emptyManifest());
+	for (const file of files) {
+		const manifest = byHost.get(file.host);
+		if (manifest) manifest.files[file.path] = { hash: file.hash };
+	}
+	await Promise.all([...byHost.entries()].map(async ([host, manifest]) => {
+		const path = manifestPath(scope, cwd, host);
+		if (Object.keys(manifest.files).length === 0) {
+			await rm(path, { force: true });
+			return;
+		}
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`);
+	}));
+}
+function installHooks(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const scope = options.scope ?? "global";
+	return withHookSource(async (source) => {
+		const files = await sourceHookFiles(source);
+		const manifests = new Map(HOOK_HOSTS.map((host) => [host, readManifest(scope, cwd, host)]));
+		const planned = planFiles(files, scope, cwd, Boolean(options.force), manifests);
+		const obsolete = planObsoleteFiles(new Set(files.map((file) => file.path)), scope, cwd, Boolean(options.force), manifests);
+		const items = [...planned.map(itemFor), ...obsolete.map(itemForObsolete)];
+		assertCheckCurrent(items, Boolean(options.check));
+		assertNoConflicts(items, Boolean(options.dryRun));
+		if (!(options.check || options.dryRun)) {
+			for (const file of planned) await writePlannedFile(file, scope, cwd);
+			for (const file of obsolete) await removeObsoleteFile(file, scope, cwd);
+			await writeManifests(planned, scope, cwd);
+		}
+		return {
+			items,
+			source: DEFAULT_HOOK_INSTALL_SOURCE
+		};
+	});
+}
+function formatInstallHooksResult(result) {
+	return result.items.map((item) => `${item.action} ${item.host}: ${item.path}`).join("\n");
+}
+//#endregion
+export { formatInstallHooksResult, installHooks };

package/dist/moka-global-config.d.ts

@@ -16,6 +16,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
       opencodeAuthSecretName: z.ZodString;
+      opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -15,6 +15,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -148,6 +148,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -260,6 +261,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -324,6 +326,7 @@ interface MokaWorkflowSubmitOptions {
   name?: string;
   namespace: string;
   opencodeAuthSecretName?: string;
+  opencodeOpenaiAccountsSecretName?: string;
   payloadJson: string;
   scheduleYaml: string;
   serviceAccountName?: string;

package/dist/moka-submit.js

@@ -78,6 +78,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
 	serviceAccountName: z.string().min(1).optional()
@@ -300,6 +301,7 @@ function workflowSubmitOptions(options) {
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecretName: options.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: options.serviceAccountName
 	};
 }

package/dist/pipeline-init.js

@@ -1,5 +1,6 @@
 import "./install-commands/shared.js";
 import { installCommands } from "./install-commands.js";
+import { installHooks } from "./install-hooks.js";
 import { existsSync } from "node:fs";
 import { execa } from "execa";
 import { join } from "node:path";
@@ -33,8 +34,12 @@ const OWNED_HARNESS_PATHS = [
 	".agents/skills",
 	".claude/agents",
 	".claude/commands",
+	".claude/hooks",
+	".claude/.moka-agent-hooks.json",
 	".claude/settings.json",
 	".claude/skills",
+	".codex/hooks",
+	".codex/.moka-agent-hooks.json",
 	".codex/skills",
 	".opencode",
 	"AGENTS.md",
@@ -57,17 +62,30 @@ async function installDefaultSkills(cwd, scope) {
 		throw new Error(`Failed to install default skills from ${DEFAULT_SKILL_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access for npx skills add and rerun \`moka init\`.`);
 	}
 }
+function installDefaultHooks(cwd, scope) {
+	return installHooks({
+		cwd,
+		scope
+	});
+}
+function hookInstallerFiles(result) {
+	return "items" in result ? result.items.map((item) => item.path) : result.files;
+}
 async function initPipelineProject(options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	const scope = options.scope ?? "global";
-	await (options.skillInstaller ?? ((target) => installDefaultSkills(target, skillScopeFor(scope))))(cwd);
+	const skillInstaller = options.skillInstaller ?? ((target) => installDefaultSkills(target, skillScopeFor(scope)));
+	const hookInstaller = options.hookInstaller ?? installDefaultHooks;
+	await skillInstaller(cwd);
+	const result = await installCommands({
+		cwd,
+		force: true,
+		host: "all",
+		scope
+	});
+	const hooks = await hookInstaller(cwd, scope);
 	return {
-		files: (await installCommands({
-			cwd,
-			force: true,
-			host: "all",
-			scope
-		})).items.map((item) => item.path),
+		files: [...result.items.map((item) => item.path), ...hookInstallerFiles(hooks)],
 		scope
 	};
 }
@@ -75,6 +93,7 @@ async function refreshAgentHarnesses(options = {}) {
 	const context = refreshAgentHarnessesContext(options);
 	const init = await initPipelineProject({
 		cwd: context.cwd,
+		hookInstaller: options.hookInstaller,
 		scope: options.scope,
 		skillInstaller: options.skillInstaller
 	});

package/dist/runtime/opencode-session-executor.js

@@ -324,18 +324,7 @@ function unwrap(response) {
 	return response.data;
 }
 function errorMessage(error) {
-	if (!(error instanceof Error)) return String(error);
-	const messages = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		seen.add(current);
-		const code = current.code;
-		const codeSuffix = typeof code === "string" ? ` (${code})` : "";
-		messages.push(`${current.message}${codeSuffix}`);
-		current = current.cause;
-	}
-	return messages.join(": ");
+	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
 export { createOpencodeExecutor, createOpencodeSessionRegistry };

package/docs/config-architecture.md

@@ -164,6 +164,22 @@ Project-authored skill and rule paths resolve from the project root and must
 exist for runtime use. If default skill files are missing, run `moka init` to
 install them before executing workflows.
 
+Default agent hooks are copied by `moka init` and `moka install-hooks` from the
+private `oisin-ee/agent-hooks` repository. That source repository has one
+canonical host-level layout:
+
+```text
+claude-code/
+codex/
+opencode/
+```
+
+Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
+project scope, or the corresponding per-machine host config directories for
+global scope. Moka tracks installed hashes in host-local manifests so it can
+update unchanged owned hook files, delete owned files removed from the hook
+repository, and reject manual drift unless `--force` is used.
+
 `moka init --skill-scope` (PIPE-83.12) chooses how the default set is installed:
 `project` (default) vendors a repo-local copy (`skills add … --copy`,
 `skills-lock.json`); `personal` installs once at user/global scope
@@ -198,6 +214,8 @@ OpenCode host resources are generated from the same profile registry:
   resolved model, explicit permissions, and task access to generated agents only.
 - `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
   generates agents, commands, plugins, and project config.
+- Additional manually authored OpenCode hook plugins can be copied from
+  `oisin-ee/agent-hooks/opencode/` by `moka install-hooks`.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and

package/docs/operator-guide.md

@@ -175,8 +175,8 @@ OpenBao, publish Secret values, or mutate ESO resources from this package.
 
 `moka init`
 
-Vendors the package's default project skills and generated OpenCode host
-resources, including the singleton `pipeline-gateway` MCP entry. OpenCode is the
+Installs the package's default skills, generated host resources, and copied
+agent hooks from the private `oisin-ee/agent-hooks` repository. OpenCode is the
 package default runtime. `moka init` does not create repo-local `.pipeline`
 config files.
 
@@ -196,11 +196,28 @@ moka install-commands --host all --force
 
 Host choices are `all` and `opencode`.
 
+`moka install-hooks`
+
+Copies manually authored hook files from the private `oisin-ee/agent-hooks`
+repository into the selected harness scope. The hook source repository has only
+host folders: `claude-code/`, `codex/`, and `opencode/`. Install scope controls
+the destination; it is not represented in the source repository.
+
+```shell
+moka install-hooks --scope global --check
+moka install-hooks --scope project --force
+```
+
+There is no source override flag and no symlink mode. Moka clones
+`oisin-ee/agent-hooks`, copies files, and tracks installed hashes so later runs
+can update unchanged owned files, delete removed owned files, and refuse to
+overwrite manually edited hook files unless `--force` is supplied.
+
 `moka refresh-harnesses`
 
-Force-refreshes package-owned skills and generated agent harnesses, stages only
-owned harness/resource paths, and commits them with `--no-verify`. The default
-commit message is `chore: update agent harnesses`.
+Force-refreshes package-owned skills, generated agent harnesses, and copied hook
+files, stages only owned harness/resource paths, and commits them with
+`--no-verify`. The default commit message is `chore: update agent harnesses`.
 
 ```shell
 moka refresh-harnesses
@@ -392,6 +409,11 @@ Claude Code: /moka-quick, /moka-execute, /moka-inspect
 - `.opencode/opencode.json` with LSP, the singleton `pipeline-gateway` MCP
   server, and pinned package-selected plugins
 
+`moka init` and `moka install-hooks` also copy hook files from
+`oisin-ee/agent-hooks` by overlaying `opencode/`, `claude-code/`, and `codex/`
+onto the selected host config roots. Hook files are authored in the hook repo,
+not generated by Moka.
+
 `moka install-commands --host claude-code` generates `.claude/commands/moka-<entrypoint>.md`
 slash commands for Claude Code.
 

package/package.json

@@ -126,7 +126,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.7.2",
+  "version": "3.8.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",