@oisincoveney/pipeline 3.7.2 → 3.9.0

package/README.md

@@ -43,10 +43,10 @@ Initialize package-owned pipeline support:
 moka init
 ```
 
-`moka init` vendors the package's default project skills, then writes generated
-OpenCode command surfaces plus the singleton `pipeline-gateway` MCP entry.
-OpenCode is the package default runtime. The command does not create repo-local
-`.pipeline` config files.
+`moka init` installs the package's default skills, generated host command
+surfaces, the singleton `pipeline-gateway` MCP entry, and copied hook files from
+the private `oisin-ee/agent-hooks` repository. OpenCode is the package default
+runtime. The command does not create repo-local `.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -62,6 +62,12 @@ Check or refresh generated host files after package upgrades:
 moka install-commands --host all --check
 ```
 
+Check or refresh copied agent hooks after editing `oisin-ee/agent-hooks`:
+
+```shell
+moka install-hooks --scope global --check
+```
+
 Check local prerequisites and config health:
 
 ```shell
@@ -98,6 +104,7 @@ Canonical commands:
 - `moka export <run-id> --sanitize`: print a portable evidence bundle.
 - `moka doctor`: check local prerequisites and config health.
 - `moka init`: install package-owned host resources for a repository.
+- `moka install-hooks`: copy manually authored hooks from `oisin-ee/agent-hooks`.
 - `moka refresh-harnesses`: force-refresh generated agent harnesses and commit
   owned resource changes.
 

package/dist/argo-submit.d.ts

@@ -21,6 +21,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   scheduleYaml: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;

package/dist/argo-submit.js

@@ -39,6 +39,7 @@ const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1).optional(),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	scheduleYaml: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
@@ -89,6 +90,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		name: options.name,
 		namespace: options.namespace,
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecret: options.opencodeOpenaiAccountsSecretName ? { name: options.opencodeOpenaiAccountsSecretName } : void 0,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,

package/dist/argo-workflow.js

@@ -296,6 +296,26 @@ function runnerWorkflowStorage(options, tasks) {
 			subPath: "auth.json"
 		});
 	}
+	if (options.opencodeOpenaiAccountsSecret) {
+		const accountsKey = options.opencodeOpenaiAccountsSecret.key ?? "accounts.json";
+		volumes.push({
+			name: "opencode-openai-accounts",
+			secret: {
+				defaultMode: 256,
+				items: [{
+					key: accountsKey,
+					path: "accounts.json"
+				}],
+				secretName: options.opencodeOpenaiAccountsSecret.name
+			}
+		});
+		volumeMounts.push({
+			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			name: "opencode-openai-accounts",
+			readOnly: true,
+			subPath: "accounts.json"
+		});
+	}
 	if (options.gitCredentialsSecretName) {
 		volumes.push({
 			name: "runner-git-credentials",

package/dist/cli/program.js

@@ -16,6 +16,7 @@ import { MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, resolveMokaRun } from "./run-resolv
 import { registerTicketCommand } from "../commands/ticket-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "../install-commands.js";
+import { formatInstallHooksResult, installHooks } from "../install-hooks.js";
 import { formatPipelineInitResult, formatRefreshAgentHarnessesResult, initPipelineProject, refreshAgentHarnesses } from "../pipeline-init.js";
 import { createRun, runControlStatusPaths, updateRunController } from "../run-control/store.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
@@ -357,6 +358,13 @@ function createCliProgram(options = {}) {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
+	program.command("install-hooks").description("Install agent hooks from oisin-ee/agent-hooks (global per-machine by default)").addOption(new Option$1("--scope <scope>", "where to install: global (~/.claude, ~/.config/opencode, ~/.codex) or project (repo-local)").choices(["global", "project"]).default("global")).option("--dry-run", "show planned changes without writing files").option("--check", "fail if installed hook files are missing or stale").option("--force", "overwrite manually edited hook files").action(async (flags) => {
+		const result = await installHooks({
+			...flags,
+			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()
+		});
+		console.log(formatInstallHooksResult(result));
+	});
 	program.command("codex-auth").description("Manage local Codex multi-auth integration").command("sync-local").description("Use one local oc-codex account pool and declare the plugin in dev repos").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
 		const result = syncLocalCodexAuth({
 			check: flags.check,

package/dist/cli/submit-options.js

@@ -49,6 +49,7 @@ function mokaCommonSubmitOptions(input) {
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
 		opencodeAuthSecretName: momokaya?.submit.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecretName: momokaya?.submit.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/install-commands/shared.js

@@ -9,8 +9,6 @@ const OWNER_TS_MARKER_PREFIX = "// @oisincoveney/pipeline:";
 const OWNER_YAML_MARKER_PREFIX = "# @oisincoveney/pipeline:";
 const AGENTS_MD_START = "<!-- @oisincoveney/pipeline:agents:start -->";
 const AGENTS_MD_END = "<!-- @oisincoveney/pipeline:agents:end -->";
-const INSTRUCTIONS_START = "<!-- @oisincoveney/pipeline:instructions:start -->";
-const INSTRUCTIONS_END = "<!-- @oisincoveney/pipeline:instructions:end -->";
 const SINGLE_OPENCODE_PLUGIN_ARRAY_RE = /\n {2}"plugin": \[\n {4}("[^"]+")\n {2}\]/;
 const OPENCODE_PROJECT_CONFIG_PATH = ".opencode/opencode.json";
 const CLAUDE_PROJECT_CONFIG_PATH = ".claude/settings.json";
@@ -94,4 +92,4 @@ function commandIdForHost(host, entrypointId) {
 	return entrypointId;
 }
 //#endregion
-export { AGENTS_MD_END, AGENTS_MD_START, CLAUDE_PROJECT_CONFIG_PATH, COMMAND_HOSTS, DEFAULT_HARNESS_SCOPE, ENTRYPOINT_PATH_PATTERNS, GENERATED_MARKER, GENERATED_TS_MARKER, GENERATED_YAML_MARKER, INSTRUCTIONS_END, INSTRUCTIONS_START, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, OWNER_YAML_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries, resolveHarnessTarget };
+export { AGENTS_MD_END, AGENTS_MD_START, CLAUDE_PROJECT_CONFIG_PATH, COMMAND_HOSTS, DEFAULT_HARNESS_SCOPE, ENTRYPOINT_PATH_PATTERNS, GENERATED_MARKER, GENERATED_TS_MARKER, GENERATED_YAML_MARKER, OPENCODE_PROJECT_CONFIG_PATH, OWNER_MARKER_PREFIX, OWNER_TS_MARKER_PREFIX, OWNER_YAML_MARKER_PREFIX, SINGLE_OPENCODE_PLUGIN_ARRAY_RE, commandIdForHost, compactLines, entrypointDescription, entrypointEntries, instructionsPointer, invocationForHost, profileEntries, resolveHarnessTarget };

package/dist/install-commands.js

@@ -3,7 +3,6 @@ import "./config.js";
 import { COMMAND_HOSTS, ENTRYPOINT_PATH_PATTERNS, invocationForHost, resolveHarnessTarget } from "./install-commands/shared.js";
 import { opencodeAdapter } from "./install-commands/opencode.js";
 import { claudeCodeAdapter } from "./install-commands/claude-code.js";
-import { INSTRUCTION_PATHS, globalInstructionDefinitions } from "./install-commands/instructions.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { mkdir, readdir, rm, writeFile } from "node:fs/promises";
@@ -156,18 +155,15 @@ function commandInstallPlanItem(definition, action) {
 	};
 }
 const PROJECT_ONLY_PATHS = new Set(["AGENTS.md"]);
-const GLOBAL_ONLY_PATHS = new Set(INSTRUCTION_PATHS);
 function scopedDefinitions(definitions, scope) {
 	if (scope === "global") return definitions.filter((definition) => !PROJECT_ONLY_PATHS.has(definition.path));
-	return definitions.filter((definition) => !GLOBAL_ONLY_PATHS.has(definition.path));
+	return definitions;
 }
 function installCommandsContext(options) {
 	const cwd = options.cwd ?? process.cwd();
 	const host = options.host ?? "all";
 	const scope = options.scope ?? "global";
-	const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
-	const instructionDefinitions = globalInstructionDefinitions().filter((definition) => host === "all" || definition.host === host);
-	const definitions = scopedDefinitions([...definitionsFor(host, config, cwd), ...instructionDefinitions], scope);
+	const definitions = scopedDefinitions(definitionsFor(host, loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }), cwd), scope);
 	return {
 		cwd,
 		definitions,

package/dist/install-hooks.js

@@ -0,0 +1,223 @@
+import { resolveHarnessTarget } from "./install-commands/shared.js";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { execa } from "execa";
+import { dirname, join, relative } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+//#region src/install-hooks.ts
+const DEFAULT_HOOK_INSTALL_SOURCE = "oisin-ee/agent-hooks";
+const HOOK_HOSTS = [
+	"claude-code",
+	"codex",
+	"opencode"
+];
+const MANIFEST_FILE = ".moka-agent-hooks.json";
+const HOST_TARGET_ROOT = {
+	"claude-code": ".claude",
+	codex: ".codex",
+	opencode: ".opencode"
+};
+function hashContent(content) {
+	return createHash("sha256").update(content).digest("hex");
+}
+async function cloneHookRepository(targetDir) {
+	await execa("gh", [
+		"repo",
+		"clone",
+		DEFAULT_HOOK_INSTALL_SOURCE,
+		targetDir,
+		"--",
+		"--depth=1"
+	], { stdio: "inherit" });
+}
+async function withHookSource(useSource) {
+	const parent = await mkdtemp(join(tmpdir(), "moka-agent-hooks-"));
+	const source = join(parent, "agent-hooks");
+	try {
+		await cloneHookRepository(source);
+		return await useSource(source);
+	} finally {
+		await rm(parent, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function listFiles(root) {
+	if (!existsSync(root)) return [];
+	if (statSync(root).isFile()) return [root];
+	const entries = await readdir(root, { withFileTypes: true });
+	return (await Promise.all(entries.map((entry) => {
+		const path = join(root, entry.name);
+		return entry.isDirectory() ? listFiles(path) : [path];
+	}))).flat();
+}
+async function sourceHookFiles(source) {
+	return (await Promise.all(HOOK_HOSTS.map(async (host) => {
+		const hostRoot = join(source, host);
+		return (await listFiles(hostRoot)).map((file) => {
+			const relativePath = relative(hostRoot, file).replaceAll("\\", "/");
+			const content = readFileSync(file);
+			return {
+				content,
+				hash: hashContent(content),
+				host,
+				path: `${HOST_TARGET_ROOT[host]}/${relativePath}`
+			};
+		});
+	}))).flat().sort((a, b) => a.path.localeCompare(b.path));
+}
+function manifestPath(scope, cwd, host) {
+	return resolveHarnessTarget(scope, cwd, `${HOST_TARGET_ROOT[host]}/${MANIFEST_FILE}`);
+}
+function emptyManifest() {
+	return {
+		files: {},
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+}
+function readManifest(scope, cwd, host) {
+	const path = manifestPath(scope, cwd, host);
+	if (!existsSync(path)) return emptyManifest();
+	try {
+		return normalizeManifest(JSON.parse(readFileSync(path, "utf8")));
+	} catch {
+		return emptyManifest();
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeManifest(value) {
+	const files = {};
+	const manifestFiles = isRecord(value) ? value.files : void 0;
+	if (!isRecord(manifestFiles)) return {
+		files,
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+	for (const [path, entry] of Object.entries(manifestFiles)) if (isRecord(entry) && typeof entry.hash === "string") files[path] = { hash: entry.hash };
+	return {
+		files,
+		repository: DEFAULT_HOOK_INSTALL_SOURCE,
+		version: 1
+	};
+}
+function targetPath(scope, cwd, path) {
+	return resolveHarnessTarget(scope, cwd, path);
+}
+function actionForFile(file, scope, cwd, force, manifests) {
+	const target = targetPath(scope, cwd, file.path);
+	if (!existsSync(target)) return "create";
+	const currentHash = hashContent(readFileSync(target));
+	if (currentHash === file.hash) return "unchanged";
+	if (force) return "update";
+	return (manifests.get(file.host)?.files[file.path])?.hash === currentHash ? "update" : "conflict";
+}
+function planFiles(files, scope, cwd, force, manifests) {
+	return files.map((file) => ({
+		...file,
+		action: actionForFile(file, scope, cwd, force, manifests)
+	}));
+}
+function planObsoleteFiles(desiredPaths, scope, cwd, force, manifests) {
+	const obsolete = [];
+	for (const [host, manifest] of manifests) for (const [path, entry] of Object.entries(manifest.files)) {
+		if (desiredPaths.has(path)) continue;
+		const target = targetPath(scope, cwd, path);
+		if (!existsSync(target)) continue;
+		const currentHash = hashContent(readFileSync(target));
+		obsolete.push({
+			action: force || currentHash === entry.hash ? "delete" : "conflict",
+			host,
+			path
+		});
+	}
+	return obsolete.sort((a, b) => a.path.localeCompare(b.path));
+}
+async function writePlannedFile(file, scope, cwd) {
+	if (file.action === "conflict" || file.action === "unchanged") return;
+	const target = targetPath(scope, cwd, file.path);
+	await mkdir(dirname(target), { recursive: true });
+	await writeFile(target, file.content);
+}
+function itemFor(file) {
+	return {
+		action: file.action,
+		host: file.host,
+		path: file.path
+	};
+}
+function itemForObsolete(file) {
+	return {
+		action: file.action,
+		host: file.host,
+		path: file.path
+	};
+}
+async function removeObsoleteFile(file, scope, cwd) {
+	if (file.action !== "delete") return;
+	await rm(targetPath(scope, cwd, file.path), { force: true });
+}
+function assertNoConflicts(items, dryRun) {
+	if (dryRun) return;
+	const conflicts = items.filter((item) => item.action === "conflict");
+	if (conflicts.length === 0) return;
+	throw new Error([
+		"Refusing to overwrite manually edited hook files.",
+		...conflicts.map((item) => `- ${item.path}`),
+		"Re-run with --force to overwrite them."
+	].join("\n"));
+}
+function assertCheckCurrent(items, check) {
+	if (!check) return;
+	const changed = items.filter((item) => item.action !== "unchanged");
+	if (changed.length === 0) return;
+	throw new Error(["Installed hook files are not up to date.", ...changed.map((item) => `- ${item.path}: ${item.action}`)].join("\n"));
+}
+async function writeManifests(files, scope, cwd) {
+	const byHost = /* @__PURE__ */ new Map();
+	for (const host of HOOK_HOSTS) byHost.set(host, emptyManifest());
+	for (const file of files) {
+		const manifest = byHost.get(file.host);
+		if (manifest) manifest.files[file.path] = { hash: file.hash };
+	}
+	await Promise.all([...byHost.entries()].map(async ([host, manifest]) => {
+		const path = manifestPath(scope, cwd, host);
+		if (Object.keys(manifest.files).length === 0) {
+			await rm(path, { force: true });
+			return;
+		}
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, `${JSON.stringify(manifest, null, 2)}\n`);
+	}));
+}
+function installHooks(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const scope = options.scope ?? "global";
+	return withHookSource(async (source) => {
+		const files = await sourceHookFiles(source);
+		const manifests = new Map(HOOK_HOSTS.map((host) => [host, readManifest(scope, cwd, host)]));
+		const planned = planFiles(files, scope, cwd, Boolean(options.force), manifests);
+		const obsolete = planObsoleteFiles(new Set(files.map((file) => file.path)), scope, cwd, Boolean(options.force), manifests);
+		const items = [...planned.map(itemFor), ...obsolete.map(itemForObsolete)];
+		assertCheckCurrent(items, Boolean(options.check));
+		assertNoConflicts(items, Boolean(options.dryRun));
+		if (!(options.check || options.dryRun)) {
+			for (const file of planned) await writePlannedFile(file, scope, cwd);
+			for (const file of obsolete) await removeObsoleteFile(file, scope, cwd);
+			await writeManifests(planned, scope, cwd);
+		}
+		return {
+			items,
+			source: DEFAULT_HOOK_INSTALL_SOURCE
+		};
+	});
+}
+function formatInstallHooksResult(result) {
+	return result.items.map((item) => `${item.action} ${item.host}: ${item.path}`).join("\n");
+}
+//#endregion
+export { formatInstallHooksResult, installHooks };

package/dist/install-rules.js

@@ -0,0 +1,127 @@
+import "./install-commands/shared.js";
+import { execa } from "execa";
+import { dirname, join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+//#region src/install-rules.ts
+const DEFAULT_RULES_INSTALL_SOURCE = "oisin-ee/rules";
+const RULESYNC_TARGETS = [
+	"claudecode",
+	"codexcli",
+	"geminicli",
+	"opencode"
+];
+function packageRoot() {
+	return join(dirname(fileURLToPath(import.meta.url)), "..");
+}
+const PACKAGE_ROOT = packageRoot();
+async function cloneRulesRepository(targetDir) {
+	await execa("gh", [
+		"repo",
+		"clone",
+		DEFAULT_RULES_INSTALL_SOURCE,
+		targetDir,
+		"--",
+		"--depth=1"
+	], { stdio: "inherit" });
+}
+async function withRulesSource(sourceOverride, useSource) {
+	if (sourceOverride !== void 0) return useSource(sourceOverride);
+	const parent = await mkdtemp(join(tmpdir(), "moka-rules-"));
+	const source = join(parent, "rules");
+	try {
+		await cloneRulesRepository(source);
+		return await useSource(source);
+	} finally {
+		await rm(parent, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function defaultRulesyncRunner(args, opts) {
+	try {
+		await execa("rulesync", args, {
+			cwd: opts.cwd,
+			env: opts.env,
+			localDir: PACKAGE_ROOT,
+			preferLocal: true,
+			stdio: "inherit"
+		});
+	} catch (error) {
+		const cause = error instanceof Error ? `: ${error.message}` : "";
+		throw new Error(`Failed to generate global rules from ${DEFAULT_RULES_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access with \`gh auth login\` and rerun \`moka refresh-harnesses --scope global\`.`);
+	}
+}
+async function buildRootRule(source) {
+	const rulesDir = join(source, "rules");
+	let entries = [];
+	try {
+		entries = (await readdir(rulesDir, { withFileTypes: true })).filter((d) => d.isFile() && d.name.endsWith(".md")).map((d) => d.name).sort((a, b) => a.localeCompare(b));
+	} catch {}
+	const rootContent = `---
+root: true
+targets:
+  - "*"
+---
+
+${(await Promise.all(entries.map(async (name) => {
+		return (await readFile(join(rulesDir, name), "utf8")).trimEnd();
+	}))).join("\n\n")}\n`;
+	const rulesyncRulesDir = join(source, ".rulesync", "rules");
+	await mkdir(rulesyncRulesDir, { recursive: true });
+	await writeFile(join(rulesyncRulesDir, "_root.md"), rootContent);
+}
+function installRules(options = {}) {
+	if ((options.scope ?? "global") !== "global") return Promise.resolve({
+		items: [],
+		source: DEFAULT_RULES_INSTALL_SOURCE
+	});
+	const runner = options.rulesyncRunner ?? defaultRulesyncRunner;
+	return withRulesSource(options.sourceOverride, async (source) => {
+		await buildRootRule(source);
+		const home = process.env.HOME_DIR ?? homedir();
+		const args = [
+			"generate",
+			"-t",
+			RULESYNC_TARGETS.join(","),
+			"-f",
+			"rules",
+			"--delete"
+		];
+		if (options.dryRun) args.push("--dry-run");
+		if (options.check) args.push("--check");
+		await runner(args, {
+			cwd: source,
+			env: {
+				...process.env,
+				HOME_DIR: home
+			}
+		});
+		const action = options.dryRun ?? options.check ? "skip" : "generate";
+		return {
+			items: [
+				{
+					action,
+					path: join(home, ".claude/CLAUDE.md")
+				},
+				{
+					action,
+					path: join(home, ".codex/AGENTS.md")
+				},
+				{
+					action,
+					path: join(home, ".gemini/GEMINI.md")
+				},
+				{
+					action,
+					path: join(home, ".config/opencode/AGENTS.md")
+				}
+			],
+			source: DEFAULT_RULES_INSTALL_SOURCE
+		};
+	});
+}
+//#endregion
+export { installRules };

package/dist/moka-global-config.d.ts

@@ -16,6 +16,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
       opencodeAuthSecretName: z.ZodString;
+      opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -15,6 +15,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
 	opencodeAuthSecretName: z.string().min(1),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
-  "node.finish": "node.finish";
-  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
+  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
+  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -148,6 +148,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -206,13 +207,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
+    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
+    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -260,6 +261,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
   opencodeAuthSecretName: z.ZodOptional<z.ZodString>;
+  opencodeOpenaiAccountsSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     sha: z.ZodOptional<z.ZodString>;
@@ -324,6 +326,7 @@ interface MokaWorkflowSubmitOptions {
   name?: string;
   namespace: string;
   opencodeAuthSecretName?: string;
+  opencodeOpenaiAccountsSecretName?: string;
   payloadJson: string;
   scheduleYaml: string;
   serviceAccountName?: string;

package/dist/moka-submit.js

@@ -78,6 +78,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
 	opencodeAuthSecretName: z.string().min(1).optional(),
+	opencodeOpenaiAccountsSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
 	serviceAccountName: z.string().min(1).optional()
@@ -300,6 +301,7 @@ function workflowSubmitOptions(options) {
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
 		opencodeAuthSecretName: options.opencodeAuthSecretName,
+		opencodeOpenaiAccountsSecretName: options.opencodeOpenaiAccountsSecretName,
 		serviceAccountName: options.serviceAccountName
 	};
 }

package/dist/pipeline-init.js

@@ -1,5 +1,7 @@
 import "./install-commands/shared.js";
 import { installCommands } from "./install-commands.js";
+import { installHooks } from "./install-hooks.js";
+import { installRules } from "./install-rules.js";
 import { existsSync } from "node:fs";
 import { execa } from "execa";
 import { join } from "node:path";
@@ -33,8 +35,12 @@ const OWNED_HARNESS_PATHS = [
 	".agents/skills",
 	".claude/agents",
 	".claude/commands",
+	".claude/hooks",
+	".claude/.moka-agent-hooks.json",
 	".claude/settings.json",
 	".claude/skills",
+	".codex/hooks",
+	".codex/.moka-agent-hooks.json",
 	".codex/skills",
 	".opencode",
 	"AGENTS.md",
@@ -57,17 +63,39 @@ async function installDefaultSkills(cwd, scope) {
 		throw new Error(`Failed to install default skills from ${DEFAULT_SKILL_INSTALL_SOURCE}${cause}. If this is a private repository, authenticate GitHub access for npx skills add and rerun \`moka init\`.`);
 	}
 }
+function installDefaultHooks(cwd, scope) {
+	return installHooks({
+		cwd,
+		scope
+	});
+}
+function hookInstallerFiles(result) {
+	return "items" in result ? result.items.map((item) => item.path) : result.files;
+}
 async function initPipelineProject(options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	const scope = options.scope ?? "global";
-	await (options.skillInstaller ?? ((target) => installDefaultSkills(target, skillScopeFor(scope))))(cwd);
+	const skillInstaller = options.skillInstaller ?? ((target) => installDefaultSkills(target, skillScopeFor(scope)));
+	const hookInstaller = options.hookInstaller ?? installDefaultHooks;
+	const rulesInstaller = options.rulesInstaller ?? ((target, s) => installRules({
+		cwd: target,
+		scope: s
+	}));
+	await skillInstaller(cwd);
+	const result = await installCommands({
+		cwd,
+		force: true,
+		host: "all",
+		scope
+	});
+	const hooks = await hookInstaller(cwd, scope);
+	const rulesResult = await rulesInstaller(cwd, scope);
 	return {
-		files: (await installCommands({
-			cwd,
-			force: true,
-			host: "all",
-			scope
-		})).items.map((item) => item.path),
+		files: [
+			...result.items.map((item) => item.path),
+			...hookInstallerFiles(hooks),
+			...rulesResult.items.map((item) => item.path)
+		],
 		scope
 	};
 }
@@ -75,6 +103,8 @@ async function refreshAgentHarnesses(options = {}) {
 	const context = refreshAgentHarnessesContext(options);
 	const init = await initPipelineProject({
 		cwd: context.cwd,
+		hookInstaller: options.hookInstaller,
+		rulesInstaller: options.rulesInstaller,
 		scope: options.scope,
 		skillInstaller: options.skillInstaller
 	});
@@ -99,7 +129,7 @@ async function refreshAgentHarnessesCommitResult(context) {
 function formatPipelineInitResult(result) {
 	return [
 		"Initialized package-owned pipeline support:",
-		result.scope === "global" ? "installed the per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); inherited by every repo with no per-repo copy" : "installed default skills and host config repo-local",
+		result.scope === "global" ? "installed the per-machine harness globally (user/global skills + ~/.claude, ~/.config/opencode, ~/.codex); global instruction files generated via rulesync from oisin-ee/rules; inherited by every repo with no per-repo copy" : "installed default skills and host config repo-local",
 		...result.files.map((path) => `generated ${path}`),
 		"no repo-local pipeline config files were created"
 	].join("\n");

package/dist/runner-event-schema.d.ts

@@ -11,8 +11,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   runId: z.ZodString;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.planned": "workflow.planned";
     "workflow.start": "workflow.start";
+    "workflow.planned": "workflow.planned";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -58,10 +58,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
+    "node.start": "node.start";
+    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
-    "node.finish": "node.finish";
-    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -189,8 +189,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     runId: z.ZodString;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.planned": "workflow.planned";
       "workflow.start": "workflow.start";
+      "workflow.planned": "workflow.planned";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -236,10 +236,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
+      "node.start": "node.start";
+      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
-      "node.finish": "node.finish";
-      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runtime/opencode-session-executor.js

@@ -324,18 +324,7 @@ function unwrap(response) {
 	return response.data;
 }
 function errorMessage(error) {
-	if (!(error instanceof Error)) return String(error);
-	const messages = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	while (current instanceof Error && !seen.has(current)) {
-		seen.add(current);
-		const code = current.code;
-		const codeSuffix = typeof code === "string" ? ` (${code})` : "";
-		messages.push(`${current.message}${codeSuffix}`);
-		current = current.cause;
-	}
-	return messages.join(": ");
+	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
 export { createOpencodeExecutor, createOpencodeSessionRegistry };

package/docs/config-architecture.md

@@ -164,6 +164,22 @@ Project-authored skill and rule paths resolve from the project root and must
 exist for runtime use. If default skill files are missing, run `moka init` to
 install them before executing workflows.
 
+Default agent hooks are copied by `moka init` and `moka install-hooks` from the
+private `oisin-ee/agent-hooks` repository. That source repository has one
+canonical host-level layout:
+
+```text
+claude-code/
+codex/
+opencode/
+```
+
+Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
+project scope, or the corresponding per-machine host config directories for
+global scope. Moka tracks installed hashes in host-local manifests so it can
+update unchanged owned hook files, delete owned files removed from the hook
+repository, and reject manual drift unless `--force` is used.
+
 `moka init --skill-scope` (PIPE-83.12) chooses how the default set is installed:
 `project` (default) vendors a repo-local copy (`skills add … --copy`,
 `skills-lock.json`); `personal` installs once at user/global scope
@@ -198,6 +214,8 @@ OpenCode host resources are generated from the same profile registry:
   resolved model, explicit permissions, and task access to generated agents only.
 - `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
   generates agents, commands, plugins, and project config.
+- Additional manually authored OpenCode hook plugins can be copied from
+  `oisin-ee/agent-hooks/opencode/` by `moka install-hooks`.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and

package/docs/operator-guide.md

@@ -175,8 +175,8 @@ OpenBao, publish Secret values, or mutate ESO resources from this package.
 
 `moka init`
 
-Vendors the package's default project skills and generated OpenCode host
-resources, including the singleton `pipeline-gateway` MCP entry. OpenCode is the
+Installs the package's default skills, generated host resources, and copied
+agent hooks from the private `oisin-ee/agent-hooks` repository. OpenCode is the
 package default runtime. `moka init` does not create repo-local `.pipeline`
 config files.
 
@@ -196,11 +196,28 @@ moka install-commands --host all --force
 
 Host choices are `all` and `opencode`.
 
+`moka install-hooks`
+
+Copies manually authored hook files from the private `oisin-ee/agent-hooks`
+repository into the selected harness scope. The hook source repository has only
+host folders: `claude-code/`, `codex/`, and `opencode/`. Install scope controls
+the destination; it is not represented in the source repository.
+
+```shell
+moka install-hooks --scope global --check
+moka install-hooks --scope project --force
+```
+
+There is no source override flag and no symlink mode. Moka clones
+`oisin-ee/agent-hooks`, copies files, and tracks installed hashes so later runs
+can update unchanged owned files, delete removed owned files, and refuse to
+overwrite manually edited hook files unless `--force` is supplied.
+
 `moka refresh-harnesses`
 
-Force-refreshes package-owned skills and generated agent harnesses, stages only
-owned harness/resource paths, and commits them with `--no-verify`. The default
-commit message is `chore: update agent harnesses`.
+Force-refreshes package-owned skills, generated agent harnesses, and copied hook
+files, stages only owned harness/resource paths, and commits them with
+`--no-verify`. The default commit message is `chore: update agent harnesses`.
 
 ```shell
 moka refresh-harnesses
@@ -392,6 +409,11 @@ Claude Code: /moka-quick, /moka-execute, /moka-inspect
 - `.opencode/opencode.json` with LSP, the singleton `pipeline-gateway` MCP
   server, and pinned package-selected plugins
 
+`moka init` and `moka install-hooks` also copy hook files from
+`oisin-ee/agent-hooks` by overlaying `opencode/`, `claude-code/`, and `codex/`
+onto the selected host config roots. Hook files are authored in the hook repo,
+not generated by Moka.
+
 `moka install-commands --host claude-code` generates `.claude/commands/moka-<entrypoint>.md`
 slash commands for Claude Code.
 

package/package.json

@@ -1,6 +1,7 @@
 {
   "dependencies": {
     "@dagrejs/graphlib": "^4.0.1",
+    "rulesync": "8.30.1",
     "@kubernetes/client-node": "^1.4.0",
     "@opencode-ai/sdk": "1.17.4",
     "ajv": "^8.20.0",
@@ -126,7 +127,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "3.7.2",
+  "version": "3.9.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/defaults/instructions/global.md

@@ -1,68 +0,0 @@
-# Caveman Mode (default ON)
-
-Operate in caveman mode by default on every response: terse, smart-caveman phrasing — drop filler, keep ALL technical substance, code, commands, paths, and accuracy. This is active every response and does not drift off over a long session. Defer to the `caveman` skill for the exact compression rules and intensity levels. Turn off only when the user says "stop caveman" or "normal mode".
-
-# Global Behavior
-
-- Answer fully and stop. Never end with "Want me to do X?" or "Should I implement this?" — if the user wants more, they'll ask.
-- Research before acting — know how components and libraries work before making changes.
-- When uncertain, ask — don't guess.
-- The answer to "Why is X an improvement?" should never be "I'm not sure."
-
-## Before writing code
-
-- Search for existing implementations before creating new code.
-- Check for existing utilities before adding helpers.
-- Don't add dependencies without checking if functionality already exists in current deps.
-- Reuse patterns from similar files in the codebase.
-
-## Problem-solving
-
-- Is this a real problem? Reject over-engineering.
-- Is there a simpler way? Always seek the simplest solution.
-- Will it break anything? Backward compatibility matters.
-
-# Anti-Patterns
-
-## Code quality
-
-- NEVER manually edit auto-generated files — regenerate them instead.
-- NEVER suppress type errors (`as any`, `@ts-ignore`, `@ts-expect-error`).
-- NEVER use bandaids or hacks — proper fixes only.
-- NEVER create new Zod schemas when generated ones exist.
-- NEVER use `var` declarations.
-- NEVER add `.unwrap()` calls in Rust code.
-
-## Error handling
-
-- Silent error handling is NEVER permitted.
-- Every fallback and default value MUST have specific business-logic reasoning.
-- Unexpected errors MUST be logged, not swallowed.
-- Errors affecting user flow MUST surface to the user — never hide failures.
-
-## Testing
-
-- NEVER commit code without tests for new functionality.
-- NEVER skip tests or mark them skipped to make CI pass.
-- NEVER disable or delete existing tests — fix the code, not the tests.
-- Test both success and error cases.
-
-# Verification
-
-- Run tests, lint, and typecheck after every change.
-- Self-assessment is unreliable — use external signals (build output, test results) as ground truth.
-- Don't claim something works without running it.
-- If a test suite exists, run it. Don't skip it because "the change is small."
-
-# Coding Style
-
-- 120 char line width.
-- Trailing commas everywhere.
-
-## Git
-
-- NEVER commit/push directly to main.
-- NEVER amend commits or rewrite history after pushing.
-- NEVER use `--force` without explicit approval.
-- Always create new commits — never amend, squash, or rebase unless explicitly asked.
-- Conventional commit format: `feat|fix|chore|docs|test|refactor(scope): description`.

package/dist/install-commands/instructions.js

@@ -1,62 +0,0 @@
-import { resolvePackageAssetPath } from "../package-assets.js";
-import { GENERATED_MARKER, INSTRUCTIONS_END, INSTRUCTIONS_START, OWNER_MARKER_PREFIX } from "./shared.js";
-import { readFileSync } from "node:fs";
-//#region src/install-commands/instructions.ts
-/**
-* The canonical global agent instruction body, package-owned so every machine,
-* k8s job, and host renders the same behavior. Shipped in `defaults/` (see
-* package.json `files`).
-*/
-const INSTRUCTION_BODY = readFileSync(resolvePackageAssetPath("defaults/instructions/global.md"), "utf8").trimEnd();
-/**
-* The global instruction memory file each host reads, and the repo-relative
-* path that `resolveHarnessTarget` rebases onto its per-machine config dir.
-* Distinct from the bare `AGENTS.md` project guidance file, so these coexist
-* with (and never trip) the PROJECT_ONLY AGENTS.md handling.
-*/
-const INSTRUCTION_TARGETS = [
-	{
-		host: "claude-code",
-		path: ".claude/CLAUDE.md"
-	},
-	{
-		host: "codex",
-		path: ".codex/AGENTS.md"
-	},
-	{
-		host: "gemini",
-		path: ".gemini/GEMINI.md"
-	}
-];
-/** Repo-relative paths of every generated instruction file (global scope). */
-const INSTRUCTION_PATHS = INSTRUCTION_TARGETS.map((target) => target.path);
-function instructionContent(host) {
-	return `${[
-		INSTRUCTIONS_START,
-		GENERATED_MARKER,
-		`${OWNER_MARKER_PREFIX}host=${host} -->`,
-		"",
-		INSTRUCTION_BODY,
-		"",
-		INSTRUCTIONS_END
-	].join("\n")}\n`;
-}
-/**
-* Per-host global instruction definitions. Each is upserted as a marker block
-* so any user-authored content outside the markers in the target file is
-* preserved. Emitted in global scope only (see GLOBAL_ONLY_PATHS).
-*/
-function globalInstructionDefinitions() {
-	return INSTRUCTION_TARGETS.map(({ host, path }) => ({
-		block: {
-			end: INSTRUCTIONS_END,
-			start: INSTRUCTIONS_START
-		},
-		content: instructionContent(host),
-		host,
-		invocation: "(global instructions)",
-		path
-	}));
-}
-//#endregion
-export { INSTRUCTION_PATHS, globalInstructionDefinitions };