@jr2/cli 0.3.0 → 0.5.1

package/src/output.ts

@@ -24,7 +24,7 @@ export type Io = {
   kubeAdmin?: KubeAdmin;
   /** Override the image build port; default → pnpm + docker + kind subprocesses. */
   build?: BuildPort;
-  /** Override `jr2 up`'s Instance typecheck (ADR-0050); default → the Instance's own `tsc`. */
+  /** Override the Instance typecheck of `jr2 up` and `jr2 check` (ADR-0050); default → the Instance's own `tsc`. */
   typecheck?: TypecheckPort;
   /** Where kit-checkout detection starts walking up from (ADR-0038); default → the CLI's own
    * module directory, which is the whole signal: a checkout resolves the kit sources, an npm

package/src/repo-sweep.ts

@@ -11,7 +11,7 @@
 // no Repos — the one read that may answer "none" — while any other failure throws and the caller
 // sweeps nothing.
 
-import { ANNOTATION_REPO_LAST_ATTACHED, LABEL_REPO_BOUND } from "@jr2/orchestrator";
+import { ANNOTATION_REPO_LAST_ATTACHED, LABEL_REPO_BOUND } from "@jr2/orchestrator/internal";
 import { LABEL_INSTANCE } from "./deploy.ts";
 import { isMissingResourceType, type KubeAdmin } from "./kube.ts";
 import { activity, type Io } from "./output.ts";

package/src/sweep.ts

@@ -7,11 +7,12 @@
 // is not this instance's garbage):
 //   1. the `jr2-images` ConfigMap of every jr2 instance (namespaces labeled `jr2.dev/instance`) — what
 //      FUTURE Sandboxes will be provisioned with;
-//   2. every Sandbox CR's `spec.image` in those namespaces — a parked Workspace must survive a pod
-//      restart, and `imagePullPolicy: IfNotPresent` cannot re-pull a local tag;
-//   3. every pod's container images in those namespaces plus `jr2-system` — what is actually running
-//      (orchestrator, Instance Harness, Custodians, Sandboxes, operator), mid-roll pods INCLUDED,
-//      without naming Deployments one by one.
+//   2. every Sandbox CR's `spec.image`, sidecar, init container and `image` volume in those
+//      namespaces — a parked Workspace must survive a pod restart, and `imagePullPolicy:
+//      IfNotPresent` cannot re-pull a local tag;
+//   3. every pod's container and `image` volume refs in those namespaces plus `jr2-system` — what is
+//      actually running (orchestrator, Instance Harness, Custodians, Sandboxes, operator), mid-roll
+//      pods INCLUDED, without naming Deployments one by one.
 // The keep set is their union. "Kit images are never pruned" is not a rule here: a kit ref is kept
 // because some instance's map or pod names it, and collects like anything else when the last
 // instance leaves the cluster.
@@ -23,12 +24,13 @@
 // all: a cluster with no Sandbox CRD holds no Sandbox CRs, so that read's "none" is complete (see
 // `listSandboxes`).
 //
-// Accepted, and written down so nobody adds a name filter to "fix" it (ADR-0039): the host keep set
-// only sees the CURRENT context's roots, so a second checkout converging to a different cluster can
-// have its host kit generation swept. The rebuild is BuildKit-cached seconds. Re-introducing a name
-// filter would resurrect the exact primitive this ADR deletes.
+// Written down so nobody adds a name filter to "fix" it (ADR-0039): the host keep set only sees the
+// CURRENT context's roots, so a converge to a different cluster — a second checkout's, or this
+// one's — can lose a host image it built and has not used yet. `jr2 up` answers that itself: a tag
+// it counted on and finds missing is rebuilt (BuildKit-cached seconds) and the use retried.
+// Re-introducing a name filter would resurrect the exact primitive this ADR deletes.
 
-import { IMAGES_CONFIGMAP, IMAGES_KEY } from "@jr2/orchestrator";
+import { IMAGES_CONFIGMAP, IMAGES_KEY } from "@jr2/orchestrator/internal";
 import { formatBytes, mergeSweeps, sweepHost, sweepNodes, type BuildPort, type SweepResult } from "./build.ts";
 import { LABEL_INSTANCE, OPERATOR_NAMESPACE } from "./deploy.ts";
 import { isMissingResourceType, type KubeAdmin } from "./kube.ts";
@@ -53,13 +55,18 @@ export type Roots = { keep: Set<string>; namespaces: string[] };
 
 type NamespacedObject = { metadata: { name: string; namespace?: string } };
 type ConfigMapObject = NamespacedObject & { data?: Record<string, string> };
-type SandboxObject = NamespacedObject & { spec?: { image?: string; sidecars?: ContainerSpec[] } };
+type SandboxObject = NamespacedObject & {
+  spec?: { image?: string; sidecars?: ContainerSpec[]; initContainers?: ContainerSpec[]; volumes?: VolumeSpec[] };
+};
 type ContainerSpec = { image?: string };
+/** Only an `image` volume names a ref: every Sandbox's `/opt/jr2` is one, of the harness image (ADR-0037). */
+type VolumeSpec = { image?: { reference?: string } };
 type PodObject = NamespacedObject & {
   spec?: {
     containers?: ContainerSpec[];
     initContainers?: ContainerSpec[];
     ephemeralContainers?: ContainerSpec[];
+    volumes?: VolumeSpec[];
   };
 };
 
@@ -93,18 +100,20 @@ export async function readRoots(kube: KubeAdmin, ctx: { context?: string } = {})
   }
 
   // 2. what a parked Workspace's pod will be recreated with — the Sandbox Image AND every sidecar's
-  // ref. The CR always carries the Custodian as a sidecar (sandbox-kubectl.ts), and its ref is not
+  // ref. The CR always carries the Custodian as a sidecar (sandbox-kube.ts), and its ref is not
   // covered by the other roots: a running Sandbox is deliberately never re-imaged, so an `up` that
   // moved the Custodian's pin leaves the CR naming the OLD one while the map names the new. If that pod
   // is then lost (node restart, eviction, drain), the recreated one pulls the CR's sidecar ref —
-  // and `IfNotPresent` cannot re-pull a local tag a sweep took.
+  // and `IfNotPresent` cannot re-pull a local tag a sweep took. The same holds for the harness ref: it
+  // reaches the pod only as the `runtime` image volume (ADR-0037), never as a container's image.
   const sandboxes = await listSandboxes(kube, ctx);
   for (const sandbox of sandboxes) {
     if (!instanceNs.has(sandbox.metadata.namespace ?? "")) continue;
     if (sandbox.spec?.image) keep.add(sandbox.spec.image);
-    for (const sidecar of sandbox.spec?.sidecars ?? []) {
-      if (sidecar.image) keep.add(sidecar.image);
+    for (const c of [...(sandbox.spec?.sidecars ?? []), ...(sandbox.spec?.initContainers ?? [])]) {
+      if (c.image) keep.add(c.image);
     }
+    for (const ref of volumeRefs(sandbox.spec?.volumes)) keep.add(ref);
   }
 
   // 3. what is running right now — plus the operator, which lives in the shared `jr2-system`.
@@ -116,11 +125,17 @@ export async function readRoots(kube: KubeAdmin, ctx: { context?: string } = {})
     for (const c of [...(spec.containers ?? []), ...(spec.initContainers ?? []), ...(spec.ephemeralContainers ?? [])]) {
       if (c.image) keep.add(c.image);
     }
+    for (const ref of volumeRefs(spec.volumes)) keep.add(ref);
   }
 
   return { keep, namespaces };
 }
 
+/** The refs a volume list mounts as `image` volumes — invisible to a read of containers alone. */
+function volumeRefs(volumes: VolumeSpec[] | undefined): string[] {
+  return (volumes ?? []).flatMap((v) => (v.image?.reference ? [v.image.reference] : []));
+}
+
 /**
  * Root #2's read, with the ONE degradation the fail-closed rule allows: a cluster that has no
  * `sandboxes.core.jr2.dev` resource type can hold no Sandbox CRs, so "no Sandboxes" is the complete