@codiac.io/codiac-cli 1.3.253 → 1.3.255

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@codiac.io/codiac-cli",
   "description": "Local command line interface for managing enterprise assets and environments.",
-  "version": "1.3.253",
+  "version": "1.3.255",
   "author": "Codiac",
   "bin": {
     "codiac": "./bin/run",

package/skill/references/cli-reference.md

@@ -33,7 +33,7 @@ Top-level: `branch`, `build`, `cli`, `commit`, `deploy`, `dep`, `identity`, `ini
 - **filestore**: `capture`, `forget`, `list`
 - **host**: `map`, `list`, `view`, `delete`
 - **identity**: `list`, `delete`
-- **imageRegistry**: `capture`, `forget`, `list`; `pullSecret set/unset`
+- **imageRegistry**: `capture`, `edit`, `forget`, `list`; `pullSecret set/unset`  *(`-r`/`--registry` and `--chart-repo` take the registry **code**, e.g. `devCodiacContainers`, NOT its url; `edit` fixes an existing registry's url in place)*
 - **images**: `add`, `list`, `patch`, `remove`, `version`, `version bump`
 - **import**: `cluster`
 - **kit**: `create`

package/skill/references/concepts.md

@@ -74,9 +74,32 @@ Lifecycle:
 4. Inspect/operate: `cod asset list`, `cod asset view` (logs/term/exec/env/config/status),
    `cod asset undeploy`, `cod asset recycle`.
 
-**Image registries — policy:** never AWS ECR. Images live in **Docker Hub** or **Azure
-Container Registry (ACR)**. Registries are captured as first-class objects
-(`cod imageRegistry ...`, `cod secretStore ...` for pull secrets).
+**Image registries.** Never AWS ECR — images live in **Docker Hub** or **Azure Container
+Registry (ACR)** (plus generic OCI registries like ghcr/quay/Harbor via provider `other`).
+A registry is a first-class object with two fields you must **not** conflate:
+
+- **`code`** — the Codiac identifier you reference everywhere: `-r`/`--registry` on
+  `asset create`, `--chart-repo`, `asset edit --registry`. Its shape depends on how it was
+  captured — Azure ACR → the resource name (`devCodiacContainers`); Docker Hub →
+  `DockerHub|<org>` (`DockerHub|codiacimages`); generic OCI → `Other|<label>` (`Other|ghcr`);
+  Helm repo → `helm|<provider>|<name>` (`helm|artifactHub|hermes-agent`).
+- **`url`** — the registry endpoint (`devCodiacContainers.azurecr.io`, `index.docker.io`).
+
+`-r`/`--registry` matches the **code**, never the url. Passing the url
+(`devCodiacContainers.azurecr.io`) fails with *"No image registry has code […]"* — which
+reads like it was never registered. **Always `cod imageRegistry list` first** to read the
+exact code.
+
+Managing them: `cod imageRegistry capture` (add — create-only; it *throws* if the code already
+exists), `cod imageRegistry edit` (fix an existing registry's **url** or private/public in
+place — `code`/`provider`/`type` are immutable), `cod imageRegistry forget` (drop the
+reference), `cod imageRegistry list`, and `cod imageRegistry pullSecret set/unset` for auth.
+`cod secretStore ...` holds the pull secrets themselves.
+
+**Gotcha — assets snapshot their registry.** An asset stores a *copy* of `image.registry`
+(url included) at create time, and the deploy path reads that copy, not the registry record.
+So after `cod imageRegistry edit` corrects a url, already-created assets still carry the old
+one — run `cod asset edit --registry <code>` on each to re-resolve its embedded reference.
 
 The `type` of an asset (`helm` vs `service`) changes which config `targetFile`s apply (see §3):
 `[helm]` values for charts, `[env]`/`[footprint]`/etc. for services.