@esuyo/coding-container 1.0.15 → 1.0.17

package/Dockerfile

@@ -61,9 +61,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # --- Coding agents / CLIs ---------------------------------------------------
-# opencode (installer adds PATH for interactive shells only; ENV + profile.d
+# opencode v2 (installer adds PATH for interactive shells only; ENV + profile.d
 # cover non-interactive shells and login shells)
-RUN curl -fsSL https://opencode.ai/install | bash
+RUN curl -fsSL https://opencode.ai/v2/install | bash && /root/.opencode/bin/opencode --version
 ENV PATH="/root/.opencode/bin:${PATH}"
 RUN printf 'export PATH="/root/.opencode/bin:$PATH"\n' > /etc/profile.d/opencode.sh
 # pi (pi.dev)
@@ -101,7 +101,7 @@ RUN mkdir -p /root/.ssh && \
 # sshd builds each session's environment from scratch (USER/HOME/PATH/SHELL +
 # PAM), so the container's env (image ENV + pod spec) is not visible in SSH
 # sessions; the entrypoint republishes it for login shells.
-RUN cat > /entrypoint.sh <<'ENTRYPOINT' && chmod +x /entrypoint.sh
+RUN cat > /entrypoint.sh <<'ENTRYPOINT' && sed -i 's/\r$//' /entrypoint.sh && chmod +x /entrypoint.sh
 #!/bin/bash
 mkdir -p /run/sshd
 : > /etc/profile.d/99-container-env.sh

package/README.md

@@ -129,5 +129,6 @@ MIT. See [LICENSE](./LICENSE).
 - [Project Structure](./docs/project-structure.md) — Folder layout
 - [Development Guide](./docs/development.md) — Local setup for contributors
 - [App config & setup files](./docs/config-files.md) — Persisting tool configs via /workspace
+- [Windows setup](./docs/windows-setup.md) — Docker, kubectl, K3s, registry, and kubeconfig on Windows
 - [Plan: Additional NFS volumes](./docs/build/additional-volumes.md) — Design history for extra volumes
 - [Plan: Public prebuilt images](./docs/build/public-images.md) — Design history for public images

package/config.yaml

@@ -8,6 +8,7 @@ project: my-project
 
 k8s:
   nodePort: 30022
+  # namespace: unset here -> global default; use one name per developer for private work, or one shared name per team.
   # Pin the pod to one named cluster node (kubectl get nodes). Empty/unset ->
   # the scheduler picks a node.
   # nodeName: worker-02

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esuyo/coding-container",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "CLI to build, publish and deploy SSH-accessible coding containers on k3s",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
     "start": "node src/index.js",
     "dev": "node web/dev.js",
     "dev:kill": "node web/kill-dev.js",
+    "dev-stop": "node web/kill-dev.js",
     "dev:cli": "node src/index.js",
     "dev:server": "node web/server/server.js",
     "dev:client": "npm --prefix web/client run dev",

package/src/commands/build.js

@@ -20,6 +20,22 @@ export async function buildImage(cfg) {
         `Fix image.context in your config.`
     );
   }
+  // A Dockerfile with Windows (CRLF) line endings bakes '\r' into the
+  // /entrypoint.sh heredoc, and the image then fails at boot with
+  // `exec /entrypoint.sh: no such file or directory` (exit 255).
+  // Normalizing line endings is content-preserving for the build, so fix
+  // it in place here (with a visible warning) instead of failing and
+  // asking the user to hand-edit the file.
+  const dockerfileText = fs.readFileSync(cfg.image.dockerfilePath, "utf8");
+  if (dockerfileText.includes("\r")) {
+    fs.writeFileSync(
+      cfg.image.dockerfilePath,
+      dockerfileText.replaceAll("\r\n", "\n").replaceAll("\r", "\n")
+    );
+    console.warn(
+      `warning: normalized Windows (CRLF) line endings to Unix (LF) in ${cfg.image.dockerfilePath}`
+    );
+  }
   const ref = imageRef(cfg);
   const args = ["build", "-t", ref, "-f", cfg.image.dockerfilePath];
   for (const [key, value] of Object.entries(cfg.image.buildArgs || {})) {

package/src/commands/deploy.js

@@ -8,8 +8,10 @@ import { imageRef } from "../config.js";
 import { addHostEntry, ephemeralKnownHostsFile, removeLegacyKnownHostsFile, sshAlias, sshConfigPath } from "../utils/ssh-config.js";
 import { findNodePortOwner } from "../utils/project.js";
 import { kubectlExec, resolveDeployTag, SYSTEM_CM_NAME } from "../utils/system-config.js";
+import { NAMESPACE_LABEL } from "../utils/namespaces.js";
+import { setupAnnotationPairs } from "./setup.js";
 
-export async function ensureNamespace(ns) {
+export async function ensureNamespace(ns, { setupValues } = {}) {
   const { cmd, args, opts } = kubectlExec();
   try {
     exec(cmd, [...args, "get", "namespace", ns], opts);
@@ -17,6 +19,13 @@ export async function ensureNamespace(ns) {
     console.log(`Creating namespace ${ns} ...`);
     await run(cmd, [...args, "create", "namespace", ns], opts);
   }
+  // Re-assert the label on every deploy/init: unlabeled namespaces are not
+  // listed as coding-container namespaces, so the invariant repairs itself.
+  await run(cmd, [...args, "label", "namespace", ns, NAMESPACE_LABEL, "--overwrite"], opts);
+  const pairs = setupAnnotationPairs(setupValues);
+  if (pairs.length) {
+    await run(cmd, [...args, "annotate", "namespace", ns, "--overwrite", ...pairs], opts);
+  }
 }
 
 export async function deploy(cfg, { wait = true } = {}) {
@@ -35,7 +44,13 @@ export async function deploy(cfg, { wait = true } = {}) {
   const publicKey = readPublicKey(publicPath);
 
   const ns = cfg.k8s.namespace;
-  await ensureNamespace(ns);
+  await ensureNamespace(ns, {
+    setupValues: {
+      registry: cfg.image?.registry,
+      nfsServer: cfg.nfs?.server,
+      nfsBasePath: cfg.nfs?.basePath,
+    },
+  });
 
   // Fail fast on a taken NodePort: applying anyway leaves a partial state
   // (deployment + ingress created, service invalid).

package/src/commands/setup.js

@@ -3,15 +3,74 @@ import path from "node:path";
 import readline from "node:readline/promises";
 import { globalConfigDir, globalConfigPath, PROJECT_ROOT } from "../config.js";
 import { ensureKeyPair } from "../utils/keys.js";
+import { exec, run } from "../utils/exec.js";
+import { kubectlExec } from "../utils/system-config.js";
+import { NAMESPACE_LABEL, SETUP_ANNOTATIONS, readNamespaceSetupValues, readDeploymentSetupValues } from "../utils/namespaces.js";
 
 // Values that differ per environment. When neither a flag nor a prompt supplies
 // one, the generated config gets a clearly-marked placeholder instead of a guess.
-const PLACEHOLDERS = {
+export const PLACEHOLDERS = {
   registry: "your-registry.example.com/you",
   nfsServer: "your-nas-ip-or-hostname",
   nfsBasePath: "/path/to/shared/workspaces",
+  namespace: "coding",
 };
 
+// Same DNS-1123 pattern as defaultNamespace() in src/utils/instance.js:
+// lowercase alphanumerics and '-', max 63 chars.
+const NAMESPACE_RE = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+
+export function normalizeNamespace(value) {
+  const v = String(value ?? "").trim();
+  if (v.length < 1 || v.length > 63 || !NAMESPACE_RE.test(v)) {
+    throw new Error(
+      `namespace must be a valid k8s name (lowercase alphanumerics and '-', max 63 chars), got: ${JSON.stringify(value)}`
+    );
+  }
+  return v;
+}
+
+/**
+ * Which of the three setup-value annotations to (re)write. Skips blanks
+ * and the setup placeholders so a never-configured environment never
+ * pollutes cluster annotations with "your-registry.example.com/you".
+ */
+export function setupAnnotationPairs(setupValues) {
+  const skip = new Set(Object.values(PLACEHOLDERS));
+  const pairs = [];
+  if (!setupValues || typeof setupValues !== "object") return pairs;
+  for (const [field, key] of Object.entries(SETUP_ANNOTATIONS)) {
+    const v = setupValues[field];
+    if (typeof v !== "string") continue;
+    const t = v.trim();
+    if (!t || skip.has(t)) continue;
+    pairs.push(`${key}=${t}`);
+  }
+  return pairs;
+}
+
+/**
+ * Label + annotate an existing namespace; best effort, never throws.
+ * Only touches a namespace that already exists (creation happens on
+ * deploy/init), so setup stays fully usable offline.
+ */
+async function tagNamespaceBestEffort(ns, setupValues) {
+  try {
+    const { cmd, args, opts } = kubectlExec();
+    exec(cmd, [...args, "get", "namespace", ns], opts);
+    await run(cmd, [...args, "label", "namespace", ns, NAMESPACE_LABEL, "--overwrite"], opts);
+    const pairs = setupAnnotationPairs(setupValues);
+    if (pairs.length) {
+      await run(cmd, [...args, "annotate", "namespace", ns, "--overwrite", ...pairs], opts);
+    }
+  } catch (err) {
+    console.warn(
+      `warning: could not tag namespace "${ns}" (it will be tagged on the next deploy): ` +
+        String(err.message ?? err).split("\n")[0]
+    );
+  }
+}
+
 // Emit a YAML double-quoted scalar so special characters (":", "/", etc.) are safe.
 function yamlValue(v) {
   return JSON.stringify(v);
@@ -48,7 +107,7 @@ image:
     EXTRA_NPM_PACKAGES: ""
 
 k8s:
-  namespace: coding
+  namespace: ${yamlValue(values.namespace)}
   replicas: 1
   serviceType: NodePort
   nodePort: 30022   # default; override per project if several run at once
@@ -92,13 +151,29 @@ container:
 
 // Copy the Dockerfile from the repo into the global folder (the build context)
 // and add a .dockerignore so the SSH keys / this config never enter the build
-// context. Existing files are never overwritten.
+// context. Existing files are never overwritten. The copy is normalized to
+// Unix (LF) line endings: a Windows (CRLF) checkout would otherwise bake
+// '\r' into /entrypoint.sh via the Dockerfile heredoc, and the image then
+// fails at boot with `exec /entrypoint.sh: no such file or directory`
+// (the kernel looks for the interpreter `/bin/bash\r`).
 function provisionDockerfile(dir) {
   const dst = path.join(dir, "Dockerfile");
   if (fs.existsSync(dst)) {
-    console.log(`kept:    ${dst} (already exists, left untouched)`);
+    // An existing Dockerfile from an older setup may carry Windows (CRLF)
+    // line endings, which would bake '\r' into /entrypoint.sh. Normalizing
+    // is content-preserving for the build, so repair it in place rather
+    // than leaving a file that can only produce a broken image.
+    const existing = fs.readFileSync(dst, "utf8");
+    if (existing.includes("\r")) {
+      fs.writeFileSync(dst, existing.replaceAll("\r\n", "\n").replaceAll("\r", "\n"));
+      console.log(`normalized: ${dst} (converted CRLF to LF)`);
+    } else {
+      console.log(`kept:    ${dst} (already exists, left untouched)`);
+    }
   } else {
-    fs.copyFileSync(path.join(PROJECT_ROOT, "Dockerfile"), dst);
+    const src = path.join(PROJECT_ROOT, "Dockerfile");
+    const content = fs.readFileSync(src, "utf8").replaceAll("\r\n", "\n");
+    fs.writeFileSync(dst, content);
     console.log(`created: ${dst} (copied from the repo)`);
   }
   const ignore = path.join(dir, ".dockerignore");
@@ -136,12 +211,14 @@ async function captureEnvironment(opts) {
   const rl = interactive
     ? readline.createInterface({ input: process.stdin, output: process.stdout })
     : null;
-  const willPrompt = Boolean(rl && (!opts.registry || !opts.nfsServer || !opts.nfsBasePath));
+  const willPrompt = Boolean(
+    rl && (!opts.registry || !opts.nfsServer || !opts.nfsBasePath || !opts.namespace)
+  );
   if (willPrompt) {
     console.log("A few questions about your environment (Enter skips to a placeholder):");
   }
   try {
-    return {
+    const values = {
       registry: await ask(rl, opts.registry, {
         flagName: "registry",
         label: "Container registry",
@@ -160,7 +237,15 @@ async function captureEnvironment(opts) {
         example: "/workspaces",
         placeholder: PLACEHOLDERS.nfsBasePath,
       }),
+      namespace: await ask(rl, opts.namespace, {
+        flagName: "namespace",
+        label: "Coding namespace",
+        example: "coding / team-alpha",
+        placeholder: PLACEHOLDERS.namespace,
+      }),
     };
+    values.namespace = normalizeNamespace(values.namespace);
+    return values;
   } finally {
     if (rl) rl.close();
   }
@@ -175,10 +260,45 @@ export async function setup(opts = {}) {
   const cfgFile = globalConfigPath();
   if (fs.existsSync(cfgFile)) {
     console.log(`kept:    ${cfgFile} (already exists, left untouched)`);
+    // An explicit --namespace still tags that namespace (label + any
+    // explicitly-passed values) without touching the kept config file.
+    if (typeof opts.namespace === "string" && opts.namespace.trim()) {
+      await tagNamespaceBestEffort(normalizeNamespace(opts.namespace), {
+        registry: opts.registry,
+        nfsServer: opts.nfsServer,
+        nfsBasePath: opts.nfsBasePath,
+      });
+    }
   } else {
-    const values = await captureEnvironment(opts);
+    // Existing-namespace flow: the GUI hides registry/NFS and sends only
+    // --namespace. Fill blanks from the namespace's stored annotations so
+    // a reselect needs no retyping. Legacy namespaces created before the
+    // annotations existed carry no stored values, so fall back to the live
+    // workloads (deployment NFS volume + image registry). Missing/offline
+    // degrades to the normal prompt-or-placeholder path below.
+    const effective = { ...opts };
+    if (typeof effective.namespace === "string" && effective.namespace.trim()) {
+      try {
+        const ns = normalizeNamespace(effective.namespace);
+        const stored = readNamespaceSetupValues(ns);
+        for (const field of ["registry", "nfsServer", "nfsBasePath"]) {
+          if (!effective[field] && stored[field]) effective[field] = stored[field];
+        }
+        const missing = ["registry", "nfsServer", "nfsBasePath"].some((f) => !effective[f]);
+        if (missing) {
+          const inferred = readDeploymentSetupValues(ns);
+          for (const field of ["registry", "nfsServer", "nfsBasePath"]) {
+            if (!effective[field] && inferred[field]) effective[field] = inferred[field];
+          }
+        }
+      } catch {
+        /* invalid name surfaces via captureEnvironment validation */
+      }
+    }
+    const values = await captureEnvironment(effective);
     fs.writeFileSync(cfgFile, renderTemplate(values));
     console.log(`created: ${cfgFile}`);
+    await tagNamespaceBestEffort(values.namespace, values);
   }
 
   const pair = ensureKeyPair(path.join(dir, "keys"), "id_ed25519");

package/src/commands/system.js

@@ -64,7 +64,13 @@ export async function systemInit(cfg, { tag, keep = 10 } = {}) {
   } catch (err) {
     if (!/not found/i.test(err.message)) throw err;
   }
-  await ensureNamespace(ns);
+  await ensureNamespace(ns, {
+    setupValues: {
+      registry: cfg.image?.registry,
+      nfsServer: cfg.nfs?.server,
+      nfsBasePath: cfg.nfs?.basePath,
+    },
+  });
   await patchSystemConfig(ns, { current: tag, previous: undefined, maxEver: tag, keep });
   console.log(
     `Created ${SYSTEM_CM_NAME} in namespace ${ns}: current=${tag} maxEver=${tag} keep=${keep}`

package/src/index.js

@@ -99,6 +99,16 @@ program
   .option("--registry <registry>", "container registry (e.g. registry.example.com/you)")
   .option("--nfs-server <server>", "NFS server IP or hostname (your NAS)")
   .option("--nfs-base-path <path>", "NFS base path for per-project workspaces")
+  // Same DNS-1123 pattern as defaultNamespace() in src/utils/instance.js.
+  .option("--namespace <name>", "coding namespace (e.g. coding or team-alpha)", (value) => {
+    const v = String(value).trim();
+    if (v.length < 1 || v.length > 63 || !/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(v)) {
+      throw new Error(
+        `--namespace must be a valid k8s name (lowercase alphanumerics and '-', max 63 chars), got: ${JSON.stringify(value)}`
+      );
+    }
+    return v;
+  })
   .action(async (opts) => {
     await setup(opts);
   });

package/src/utils/exec.js

@@ -8,7 +8,13 @@ import { spawn, spawnSync } from "node:child_process";
 export function dockerExec() {
   const overridden = Boolean(process.env.DOCKER_BIN);
   const cmd = process.env.DOCKER_BIN || "docker";
-  const opts = overridden && process.platform === "win32" ? { shell: true } : {};
+  // windowsHide keeps console tools (docker/kubectl/ssh-keygen) from
+  // flashing a terminal window when the parent has no console (notably the
+  // packaged desktop app). No-op on other platforms.
+  const opts = {
+    windowsHide: true,
+    ...(overridden && process.platform === "win32" ? { shell: true } : {}),
+  };
   return { cmd, opts };
 }
 
@@ -64,6 +70,7 @@ export function ensureDockerAvailable() {
  */
 export function exec(cmd, args = [], opts = {}) {
   const res = spawnSync(cmd, args, {
+    windowsHide: true,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     ...opts,
@@ -81,7 +88,7 @@ export function exec(cmd, args = [], opts = {}) {
  */
 export function run(cmd, args = [], opts = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn(cmd, args, { stdio: "inherit", ...opts });
+    const child = spawn(cmd, args, { windowsHide: true, stdio: "inherit", ...opts });
     child.on("error", reject);
     child.on("close", (code) => {
       if (code === 0) resolve();
@@ -96,6 +103,7 @@ export function run(cmd, args = [], opts = {}) {
 export function runWithInput(cmd, args = [], input = "", opts = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(cmd, args, {
+      windowsHide: true,
       stdio: ["pipe", "inherit", "inherit"],
       ...opts,
     });
@@ -114,5 +122,5 @@ export function runWithInput(cmd, args = [], input = "", opts = {}) {
  * Spawn a long-running command, returning the child handle.
  */
 export function start(cmd, args = [], opts = {}) {
-  return spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"], ...opts });
+  return spawn(cmd, args, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"], ...opts });
 }

package/src/utils/namespaces.js

@@ -0,0 +1,248 @@
+import { exec } from "./exec.js";
+import { kubectlExec, SYSTEM_CM_NAME } from "./system-config.js";
+
+/**
+ * Label every coding-container namespace carries. The namespaces endpoint
+ * lists with `-l coding-container=true` server-side, so unlabeled namespaces
+ * are not coding-container namespaces by definition and never show up.
+ */
+export const NAMESPACE_LABEL = "coding-container=true";
+
+/**
+ * Free-form setup values live in annotations (labels are for selection).
+ * Written at setup/init time, read back to prefill the Setup form when an
+ * existing namespace is picked.
+ */
+export const SETUP_ANNOTATIONS = {
+  registry: "coding-container.io/registry",
+  nfsServer: "coding-container.io/nfs-server",
+  nfsBasePath: "coding-container.io/nfs-base-path",
+};
+
+function coerceItems(json) {
+  let parsed = json;
+  if (typeof parsed === "string") {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return null;
+    }
+  }
+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.items)) {
+    return null;
+  }
+  return parsed.items;
+}
+
+/**
+ * Pure merge of `kubectl get ns -l coding-container=true -o json` with
+ * `kubectl get cm coding-system -A -o json`. A namespace counts as
+ * `initialized` when a coding-system ConfigMap lives in it. Namespaces
+ * without annotations prefill namespace-only (setupValues {}).
+ *
+ * Both inputs accept an already-parsed object or a raw JSON string.
+ * Anything unparseable or wrongly shaped degrades to [] so Setup stays
+ * usable offline with a manual-input fallback.
+ */
+export function parseNamespaces(nsJson, cmJson) {
+  const nsItems = coerceItems(nsJson);
+  if (!nsItems) return [];
+  const cmItems = coerceItems(cmJson) ?? [];
+  const initializedByNs = new Set();
+  for (const cm of cmItems) {
+    const cmNs = cm?.metadata?.namespace;
+    // The kubectl call is already name-filtered server-side; the name check
+    // keeps the pure function honest when handed an unfiltered list.
+    if (typeof cmNs === "string" && cm?.metadata?.name === SYSTEM_CM_NAME) {
+      initializedByNs.add(cmNs);
+    }
+  }
+  const out = [];
+  for (const item of nsItems) {
+    const name = item?.metadata?.name;
+    if (typeof name !== "string" || !name) continue;
+    const annotations = item?.metadata?.annotations;
+    const setupValues = {};
+    if (annotations && typeof annotations === "object") {
+      for (const [field, key] of Object.entries(SETUP_ANNOTATIONS)) {
+        const v = annotations[key];
+        if (typeof v === "string" && v.trim()) setupValues[field] = v;
+      }
+    }
+    out.push({
+      name,
+      initialized: initializedByNs.has(name),
+      setupValues,
+      createdAt:
+        typeof item?.metadata?.creationTimestamp === "string"
+          ? item.metadata.creationTimestamp
+          : undefined,
+    });
+  }
+  out.sort((a, b) => a.name.localeCompare(b.name));
+  return out;
+}
+
+/**
+ * Read-only cluster edge: exactly two `get` calls, never anything
+ * destructive. A failed namespace list means the cluster is unreachable and
+ * throws (the namespaces endpoint maps that to `{ ok: false }`); a failed
+ * ConfigMap read degrades to all-`initialized: false` so a partial answer
+ * still lists the namespaces.
+ */
+export function getNamespaces() {
+  const { cmd, args, opts } = kubectlExec();
+  let nsJson;
+  try {
+    nsJson = exec(cmd, [...args, "get", "ns", "-l", NAMESPACE_LABEL, "-o", "json"], opts);
+  } catch (err) {
+    throw new Error(`cannot list coding-container namespaces:\n${err.message}`);
+  }
+  let cmJson = '{"items":[]}';
+  try {
+    cmJson = exec(cmd, [...args, "get", "cm", SYSTEM_CM_NAME, "-A", "-o", "json"], opts);
+  } catch {
+    cmJson = '{"items":[]}';
+  }
+  return parseNamespaces(nsJson, cmJson);
+}
+
+/**
+ * Extract the setup registry (everything before the image name) from a
+ * container image reference. Strips tag/digest first, then drops the last
+ * path segment (the image name):
+ *   "registry.example.com/you/coding-container:v1.0.0" -> "registry.example.com/you"
+ *   "10.0.0.5:5000/coding-container:v1.0.0"            -> "10.0.0.5:5000"
+ * Returns "" when there is no registry prefix to infer.
+ */
+export function registryFromImage(image) {
+  const raw = String(image ?? "").trim();
+  if (!raw) return "";
+  let s = raw.split("@")[0];
+  const lastSlash = s.lastIndexOf("/");
+  const lastColon = s.lastIndexOf(":");
+  if (lastColon > lastSlash) s = s.slice(0, lastColon);
+  const slash = s.lastIndexOf("/");
+  if (slash <= 0) return "";
+  return s.slice(0, slash).trim();
+}
+
+/**
+ * Placeholder values that must never count as live cluster state. Mirrors
+ * PLACEHOLDERS in src/commands/setup.js (kept local to avoid a cycle:
+ * setup.js imports this module). A broken deploy written from placeholders
+ * (e.g. the legacy `wicked` case) must not poison inference for the rest.
+ */
+const PLACEHOLDER_VALUES = new Set([
+  "your-registry.example.com/you",
+  "your-nas-ip-or-hostname",
+  "/path/to/shared/workspaces",
+]);
+
+function isUsableSetupValue(v) {
+  if (typeof v !== "string") return false;
+  const t = v.trim();
+  return Boolean(t) && !PLACEHOLDER_VALUES.has(t);
+}
+
+/**
+ * Pure extraction of setup values from `kubectl get deploy -n <ns> -o json`.
+ * Reads the NFS volume (`volumes[].nfs.{server,path}`) and the container
+ * image registry across all workloads and returns the most common value
+ * per field (majority vote), so one broken deploy written from placeholders
+ * cannot override the healthy majority. Placeholders and blanks are ignored.
+ * Accepts an already-parsed object or a raw JSON string; anything
+ * unparseable or wrongly shaped degrades to {}.
+ */
+export function parseDeploymentSetupValues(deployJson) {
+  let parsed = deployJson;
+  if (typeof parsed === "string") {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return {};
+    }
+  }
+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.items)) return {};
+  const votes = { registry: new Map(), nfsServer: new Map(), nfsBasePath: new Map() };
+  const vote = (field, value) => {
+    if (!isUsableSetupValue(value)) return;
+    const t = value.trim();
+    votes[field].set(t, (votes[field].get(t) ?? 0) + 1);
+  };
+  for (const item of parsed.items) {
+    const podSpec = item?.spec?.template?.spec;
+    if (!podSpec || typeof podSpec !== "object") continue;
+    const volumes = Array.isArray(podSpec.volumes) ? podSpec.volumes : [];
+    for (const vol of volumes) {
+      const nfs = vol?.nfs;
+      if (!nfs || typeof nfs !== "object") continue;
+      vote("nfsServer", nfs.server);
+      let basePath = typeof nfs.path === "string" ? nfs.path.trim() : "";
+      if (basePath) basePath = basePath.replace(/\/+$/, "") || "/";
+      vote("nfsBasePath", basePath);
+    }
+    const containers = Array.isArray(podSpec.containers) ? podSpec.containers : [];
+    for (const c of containers) vote("registry", registryFromImage(c?.image));
+  }
+  const out = {};
+  for (const [field, counts] of Object.entries(votes)) {
+    let best = "";
+    let bestN = 0;
+    for (const [value, n] of counts) {
+      if (n > bestN) {
+        best = value;
+        bestN = n;
+      }
+    }
+    if (best) out[field] = best;
+  }
+  return out;
+}
+
+/**
+ * Best-effort read of one namespace's live workload values (deployments).
+ * Returns {} when the namespace has no deployments, is unreachable, or
+ * carries no NFS/image info. Never throws, so `setup` stays usable offline.
+ */
+export function readDeploymentSetupValues(ns) {
+  const name = String(ns ?? "").trim();
+  if (!name) return {};
+  try {
+    const { cmd, args, opts } = kubectlExec();
+    const out = exec(cmd, [...args, "get", "deploy", "-n", name, "-o", "json"], opts);
+    return parseDeploymentSetupValues(out);
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Best-effort read of one namespace's stored setup values (annotations).
+ * Returns {} when the namespace is missing, unreachable, or has no
+ * annotations. Never throws, so `setup` stays usable offline.
+ */
+export function readNamespaceSetupValues(ns) {
+  const name = String(ns ?? "").trim();
+  if (!name) return {};
+  try {
+    const { cmd, args, opts } = kubectlExec();
+    const out = exec(cmd, [...args, "get", "namespace", name, "-o", "json"], opts);
+    let obj;
+    try {
+      obj = typeof out === "string" ? JSON.parse(out) : out;
+    } catch {
+      return {};
+    }
+    const annotations = obj?.metadata?.annotations;
+    if (!annotations || typeof annotations !== "object") return {};
+    const values = {};
+    for (const [field, key] of Object.entries(SETUP_ANNOTATIONS)) {
+      const v = annotations[key];
+      if (typeof v === "string" && v.trim()) values[field] = v.trim();
+    }
+    return values;
+  } catch {
+    return {};
+  }
+}

package/src/utils/registry.js

@@ -88,6 +88,7 @@ export function queryCredentialHelper(store, host, spawn = spawnSync) {
           encoding: "utf8",
           stdio: ["pipe", "pipe", "pipe"],
           timeout: 15000,
+          windowsHide: true,
         });
         if (res.error || res.status !== 0 || !res.stdout) continue;
         const parsed = JSON.parse(res.stdout.trim());

package/src/utils/system-config.js

@@ -31,12 +31,16 @@ export const INIT_HINT =
 export function kubectlExec() {
   const bin = process.env.KUBECTL_BIN || "kubectl";
   if (process.env.KUBECTL_BIN && /\.(c|m)?js$/.test(bin)) {
-    return { cmd: process.execPath, args: [bin], opts: {} };
+    return { cmd: process.execPath, args: [bin], opts: { windowsHide: true } };
   }
-  const opts =
-    process.env.KUBECTL_BIN && process.platform === "win32" && /\.(cmd|bat)$/i.test(bin)
+  // windowsHide keeps kubectl from flashing a terminal window when the
+  // parent has no console (notably the packaged desktop app). No-op elsewhere.
+  const opts = {
+    windowsHide: true,
+    ...(process.env.KUBECTL_BIN && process.platform === "win32" && /\.(cmd|bat)$/i.test(bin)
       ? { shell: true }
-      : {};
+      : {}),
+  };
   return { cmd: bin, args: [], opts };
 }