@telorun/k8s-runner 0.10.2 → 0.12.0

package/dist/k8s/workspace-configmap.d.ts

@@ -0,0 +1,24 @@
+import type { K8sRunnerConfig } from "../config.js";
+import type { KubeClient } from "./client.js";
+export declare function workspaceConfigMapName(): string;
+/** Create the ConfigMap if it is not already there. Content-addressed, so an
+ *  existing one with this name already holds exactly these bytes and a 409 is
+ *  success rather than a conflict to resolve. */
+export declare function ensureWorkspaceConfigMap(kube: KubeClient, config: K8sRunnerConfig): Promise<string>;
+/**
+ * Delete workspace-app ConfigMaps no live pod mounts.
+ *
+ * The name is content-addressed, so every release that changes the manifest
+ * leaves the previous one behind — permanently, since nothing else removes it.
+ * Run at boot, alongside the orphan pod reap: a session that survives a runner
+ * restart is impossible (the registry is in memory), so anything a live pod
+ * still references is a pod this process is about to reap anyway.
+ *
+ * Keeps the CURRENT hash unconditionally, and skips any map a pod still lists —
+ * a mounted ConfigMap that disappears makes the kubelet fail the pod.
+ */
+export declare function sweepWorkspaceConfigMaps(kube: KubeClient, config: K8sRunnerConfig, log: {
+    info(obj: unknown, msg: string): void;
+    warn(obj: unknown, msg: string): void;
+}): Promise<void>;
+//# sourceMappingURL=workspace-configmap.d.ts.map

package/dist/k8s/workspace-configmap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-configmap.d.ts","sourceRoot":"","sources":["../../src/k8s/workspace-configmap.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmB9C,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED;;iDAEiD;AACjD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE;IAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpF,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/k8s/workspace-configmap.js

@@ -0,0 +1,124 @@
+import { createHash } from "node:crypto";
+import { workspaceAppManifest, WORKSPACE_APP_FILENAME } from "@telorun/runner-core";
+/**
+ * The workspace application's manifest, delivered to the pod as a ConfigMap.
+ *
+ * Named by a hash of its own content, so a runner upgrade that changes the
+ * manifest creates a NEW ConfigMap and leaves running sessions mounting the one
+ * they booted with — a mutable name would swap a manifest under a live pod, and
+ * kubelet ConfigMap propagation is asynchronous, so the failure would be a
+ * workspace container that restarts into a different surface at an arbitrary
+ * moment.
+ *
+ * Reconciled by the runner rather than shipped by the chart, so the manifest and
+ * the code that depends on it version as one artifact: a chart-only upgrade
+ * cannot leave them skewed. The cost is one RBAC rule (`configmaps: get, create`
+ * in the session namespace).
+ */
+const WORKSPACE_CONFIGMAP_PREFIX = "telo-workspace-app-";
+export function workspaceConfigMapName() {
+    const digest = createHash("sha256").update(workspaceAppManifest()).digest("hex").slice(0, 12);
+    return `${WORKSPACE_CONFIGMAP_PREFIX}${digest}`;
+}
+/** Create the ConfigMap if it is not already there. Content-addressed, so an
+ *  existing one with this name already holds exactly these bytes and a 409 is
+ *  success rather than a conflict to resolve. */
+export async function ensureWorkspaceConfigMap(kube, config) {
+    const name = workspaceConfigMapName();
+    try {
+        await kube.core.readNamespacedConfigMap({ name, namespace: config.sessionNamespace });
+        return name;
+    }
+    catch (err) {
+        if (!isNotFound(err))
+            throw err;
+    }
+    try {
+        await kube.core.createNamespacedConfigMap({
+            namespace: config.sessionNamespace,
+            body: {
+                apiVersion: "v1",
+                kind: "ConfigMap",
+                metadata: {
+                    name,
+                    namespace: config.sessionNamespace,
+                    labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+                },
+                data: { [WORKSPACE_APP_FILENAME]: workspaceAppManifest() },
+            },
+        });
+    }
+    catch (err) {
+        // Two runners (or two concurrent starts) racing to create the same
+        // content-addressed name is not a failure — the loser mounts the winner's
+        // identical bytes.
+        if (!isConflict(err))
+            throw err;
+    }
+    return name;
+}
+function statusOf(err) {
+    const e = err;
+    return e?.statusCode ?? e?.code ?? e?.response?.statusCode;
+}
+function isNotFound(err) {
+    return statusOf(err) === 404;
+}
+function isConflict(err) {
+    return statusOf(err) === 409;
+}
+/**
+ * Delete workspace-app ConfigMaps no live pod mounts.
+ *
+ * The name is content-addressed, so every release that changes the manifest
+ * leaves the previous one behind — permanently, since nothing else removes it.
+ * Run at boot, alongside the orphan pod reap: a session that survives a runner
+ * restart is impossible (the registry is in memory), so anything a live pod
+ * still references is a pod this process is about to reap anyway.
+ *
+ * Keeps the CURRENT hash unconditionally, and skips any map a pod still lists —
+ * a mounted ConfigMap that disappears makes the kubelet fail the pod.
+ */
+export async function sweepWorkspaceConfigMaps(kube, config, log) {
+    const keep = new Set([workspaceConfigMapName()]);
+    let pods;
+    let maps;
+    try {
+        [pods, maps] = await Promise.all([
+            kube.core.listNamespacedPod({ namespace: config.sessionNamespace }),
+            kube.core.listNamespacedConfigMap({
+                namespace: config.sessionNamespace,
+                labelSelector: `app.kubernetes.io/managed-by=${config.managedByLabel}`,
+            }),
+        ]);
+    }
+    catch (err) {
+        // Housekeeping, not correctness — a runner that cannot list is a runner
+        // whose next boot will try again.
+        log.warn({ err }, "could not sweep workspace-app ConfigMaps");
+        return;
+    }
+    for (const pod of pods.items ?? []) {
+        for (const volume of pod.spec?.volumes ?? []) {
+            if (volume.configMap?.name)
+                keep.add(volume.configMap.name);
+        }
+    }
+    let removed = 0;
+    for (const map of maps.items ?? []) {
+        const name = map.metadata?.name;
+        if (!name?.startsWith(WORKSPACE_CONFIGMAP_PREFIX) || keep.has(name))
+            continue;
+        try {
+            await kube.core.deleteNamespacedConfigMap({ name, namespace: config.sessionNamespace });
+            removed += 1;
+        }
+        catch (err) {
+            if (!isNotFound(err))
+                log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
+        }
+    }
+    if (removed > 0)
+        log.info({ removed }, "swept stale workspace-app ConfigMaps");
+}
+//# sourceMappingURL=workspace-configmap.js.map

package/dist/k8s/workspace-configmap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-configmap.js","sourceRoot":"","sources":["../../src/k8s/workspace-configmap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAKpF;;;;;;;;;;;;;;GAcG;AACH,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEzD,MAAM,UAAU,sBAAsB;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,0BAA0B,GAAG,MAAM,EAAE,CAAC;AAClD,CAAC;AAED;;iDAEiD;AACjD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAgB,EAChB,MAAuB;IAEvB,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,gBAAgB;YAClC,IAAI,EAAE;gBACJ,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE;oBACR,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,gBAAgB;oBAClC,MAAM,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,cAAc,EAAE;iBAClE;gBACD,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,oBAAoB,EAAE,EAAE;aAC3D;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,0EAA0E;QAC1E,mBAAmB;QACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,CAAC,GAAG,GAAiF,CAAC;IAC5F,OAAO,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAgB,EAChB,MAAuB,EACvB,GAAqF;IAErF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;IACjD,IAAI,IAAkE,CAAC;IACvE,IAAI,IAAwE,CAAC;IAC7E,IAAI,CAAC;QACH,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC;gBAChC,SAAS,EAAE,MAAM,CAAC,gBAAgB;gBAClC,aAAa,EAAE,gCAAgC,MAAM,CAAC,cAAc,EAAE;aACvE,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,kCAAkC;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,8CAA8C,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,sCAAsC,CAAC,CAAC;AACjF,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAKhB,KAAK,aAAa,EAClB,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAM3F,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;qFACiF;IACjF,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAkCzE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAMhB,KAAK,aAAa,EAClB,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAO3F,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;qFACiF;IACjF,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAwCzE"}

package/dist/server.js

@@ -1,16 +1,18 @@
-import { BaseImageCatalog, buildServer as coreBuildServer, loadResolvedApps, loadTermsFromEnv, stopAllSessions, } from "@telorun/runner-core";
+import { BaseImageCatalog, buildServer as coreBuildServer, coResidentAgentNames, loadResolvedApps, loadTermsFromEnv, stopAllSessions, } from "@telorun/runner-core";
 import packageJson from "../package.json" with { type: "json" };
 import { BundleStore } from "./bundle-store.js";
 import { kubernetesRunnerCapabilities } from "./capabilities.js";
 import { loadK8sRunnerConfig, RunnerConfigError } from "./config.js";
 import { createKubernetesBackend } from "./k8s/backend.js";
 import { createKubeClient } from "./k8s/client.js";
+import { sweepWorkspaceConfigMaps } from "./k8s/workspace-configmap.js";
 const VERSION = packageJson.version;
 export async function buildServer(deps) {
     const { catalog } = deps;
     // Load terms once; the capabilities getter is re-resolved per request so a
     // refreshed catalog (new tags) shows up without restarting the runner.
     const terms = loadTermsFromEnv(process.env);
+    const apps = loadResolvedApps(process.env);
     const handle = await coreBuildServer({
         backend: deps.backend,
         config: deps.config,
@@ -21,11 +23,16 @@ export async function buildServer(deps) {
             defaultImage: deps.config.defaultImage,
             terms,
             imageEnum: catalog?.current(),
+            watch: deps.config.watch.enabled,
+            // Only entries that declare a port: the session route refuses an agent
+            // without one, and advertising what will be rejected is what makes the
+            // editor attach an agent to every run and every run fail.
+            agents: deps.config.watch.enabled ? coResidentAgentNames(apps) : undefined,
         }),
         defaultRegistryUrl: process.env.TELO_REGISTRY_URL,
         // Operator-predefined apps (RUNNER_APPS; none when unset). Advertised on
         // /v1/capabilities; app sessions run the catalog image directly (no build).
-        apps: loadResolvedApps(process.env),
+        apps,
         validateConfig: catalog
             ? (sessionConfig) => catalog.isAllowed(sessionConfig.image)
                 ? undefined
@@ -75,6 +82,9 @@ async function main() {
     // Reap pods orphaned by a prior runner process (in-memory registry).
     if (backend.reapOrphans) {
         await backend.reapOrphans().catch((err) => app.log.warn({ err }, "orphan reap failed"));
+        // After the pods are gone: a content-addressed workspace ConfigMap outlives
+        // every release that changed the manifest, and nothing else removes it.
+        await sweepWorkspaceConfigMaps(kube, config, app.log);
     }
     try {
         await app.listen({ port: config.port, host: "0.0.0.0" });

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,IAAI,eAAe,EAC9B,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAIhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAW5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,GAAG,EAAE,CACjB,4BAA4B,CAAC;YAC3B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,KAAK;YACL,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;SAC9B,CAAC;QACJ,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACjD,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;QACnC,cAAc,EAAE,OAAO;YACrB,CAAC,CAAC,CAAC,aAA4B,EAAsB,EAAE,CACnD,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,aAAa,CAAC,KAAK,mCAAmC;oBACrE,mBAAmB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC7C,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU;YAC9C,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;YACtC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK;YACpC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,gFAAgF;IAChF,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO;aACV,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAC/F,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,IAAI,YAAY,EAAE,CAAC;IACjB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,IAAI,eAAe,EAC9B,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAIhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAwB,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,OAAO,GAAW,WAAW,CAAC,OAAO,CAAC;AAW5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,GAAG,EAAE,CACjB,4BAA4B,CAAC;YAC3B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,KAAK;YACL,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO;YAChC,uEAAuE;YACvE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;QACJ,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACjD,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI;QACJ,cAAc,EAAE,OAAO;YACrB,CAAC,CAAC,CAAC,aAA4B,EAAsB,EAAE,CACnD,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,aAAa,CAAC,KAAK,mCAAmC;oBACrE,mBAAmB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO;QAC7C,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU;YAC9C,UAAU,EAAE,MAAM,CAAC,YAAY;YAC/B,MAAM,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;YACtC,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK;YACpC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,CAAC,iBAAiB;SAC7D,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvF,gFAAgF;IAChF,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO;aACV,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uEAAuE,CAAC,CAC/F,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,qEAAqE;IACrE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACxF,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,IAAI,YAAY,EAAE,CAAC;IACjB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/k8s-runner",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "Telo Kubernetes Runner - HTTP service that runs Telo Applications as sandboxed Kubernetes Pods. A backend over @telorun/runner-core, sibling to docker-runner.",
   "keywords": [
     "telo",
@@ -23,7 +23,7 @@
   "dependencies": {
     "@kubernetes/client-node": "^1.4.0",
     "fastify": "^5.12.1",
-    "@telorun/runner-core": "0.8.2"
+    "@telorun/runner-core": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/src/capabilities.ts

@@ -12,6 +12,11 @@ export interface KubernetesRunnerCapabilitiesOptions {
   defaultImage: string;
   terms?: RunnerTerms;
   imageEnum?: string[];
+  /** Whether the operator enabled watch sessions. Advertised so a client knows
+   *  before it asks — a runner with watch off rejects the field. */
+  watch: boolean;
+  /** Catalog names admissible as a session's co-resident `agent`. */
+  agents?: string[];
 }
 
 /** What k8s-runner advertises on `/v1/capabilities`. The runner serves
@@ -33,7 +38,15 @@ export function kubernetesRunnerCapabilities(
   return {
     displayName,
     description,
-    features: { io: true, ports: true },
+    features: {
+      // Both attach modes: the kubernetes attach subresource without a TTY
+      // already gives separate stdout and stderr channels, so `streams` invents
+      // nothing at the transport layer.
+      io: ["tty", "streams"],
+      ports: true,
+      watch: opts.watch,
+      ...(opts.agents && opts.agents.length > 0 ? { agents: opts.agents } : {}),
+    },
     config: {
       schema: sessionConfigSchema({
         imageDefault: defaultImage,

package/src/k8s/backend.ts

@@ -1,10 +1,11 @@
 import { PassThrough, Writable } from "node:stream";
 
-import type { V1ContainerState, V1ContainerStatus, V1Pod } from "@kubernetes/client-node";
+import type { V1Pod } from "@kubernetes/client-node";
 import type {
   AvailabilityReport,
   BackendSession,
   BackendStartSpec,
+  PortMapping,
   ProbeConfig,
   RunStatus,
   RunnerBackend,
@@ -18,6 +19,19 @@ import type { KubeClient } from "./client.js";
 import { ensureSessionImage } from "./image-build.js";
 import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
 import { buildAppPod, buildSessionPod, INSPECT_PORT } from "./pod-spec.js";
+import {
+  deletePod,
+  is404,
+  msg,
+  podFailureMessage,
+  podStatus,
+  podPhase,
+  provisionMessage,
+  terminalStatus,
+} from "./pod-status.js";
+import { startWatchSession } from "./watch-session.js";
+
+export { podFailureMessage } from "./pod-status.js";
 
 /** Minimal surface of the websocket client-node's Attach returns. */
 interface ResizableSocket {
@@ -42,7 +56,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
   const { kube, config, bundleStore } = deps;
   const ns = config.sessionNamespace;
 
-  async function probe(_probe: ProbeConfig): Promise<AvailabilityReport> {
+  async function probe(probeConfig: ProbeConfig): Promise<AvailabilityReport> {
     try {
       await kube.core.readNamespace({ name: ns });
     } catch {
@@ -64,7 +78,23 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
   }
 
   async function start(spec: BackendStartSpec): Promise<BackendSession> {
+    // A watch session is a different pod shape and a different lifetime — it
+    // outlives its runs — so it takes its own path rather than accreting
+    // branches through this one. It also never builds an image: the build path
+    // exists to put a dependency closure on disk before boot, and a watch
+    // session fetches its own and keeps it for the pod's life.
+    if (spec.mode === "watch") {
+      return startWatchSession({ kube, config }, spec);
+    }
+    return startRunSession(spec);
+  }
+
+  async function startRunSession(spec: BackendStartSpec): Promise<BackendSession> {
     const podName = `telo-run-${spec.sessionId}`;
+    // A run session is one application by construction — `apps` carries exactly
+    // one entry, defaulted by core when the request declared none.
+    const app = spec.apps[0]!;
+    const appName = app.name;
     // The /v1 contract carries no per-request limits yet, so `requested` is
     // undefined and the configured ceiling is always the effective limit. When
     // a control plane begins passing limits, plumb them here — the clamp is
@@ -82,7 +112,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         sessionId: spec.sessionId,
         podName,
         env: spec.env,
-        ports: spec.ports,
+        ports: app.ports,
         limits,
         image: spec.config.image,
         pullPolicy: spec.config.pullPolicy,
@@ -103,10 +133,10 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         },
         {
           bundle: spec.bundle,
-          entryRelativePath: spec.entryRelativePath,
+          entryRelativePath: app.entryRelativePath,
           baseImage: spec.config.image || config.defaultImage,
           pullPolicy: spec.config.pullPolicy,
-          onProgress: (message, done) => spec.onProgress("build", message, done),
+          onProgress: (message, done) => spec.onProgress("build", message, done, appName),
         },
       );
 
@@ -118,9 +148,9 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         config,
         sessionId: spec.sessionId,
         podName,
-        entryRelativePath: spec.entryRelativePath,
+        entryRelativePath: app.entryRelativePath,
         env: spec.env,
-        ports: spec.ports,
+        ports: app.ports,
         limits,
         image,
         bundleUrl,
@@ -151,8 +181,8 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
 
     const stdin = new PassThrough();
     const stdout = new Writable({
-      write(chunk: Buffer, _enc, cb) {
-        if (chunk?.byteLength) spec.onOutput(Buffer.from(chunk));
+      write(chunk: Buffer, encoding, cb) {
+        if (chunk?.byteLength) spec.onOutput(appName, Buffer.from(chunk), "tty");
         cb();
       },
     });
@@ -189,7 +219,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
     const flipRunning = (): void => {
       if (readyFlipped || finished) return;
       readyFlipped = true;
-      spec.onStatus({ kind: "running", endpoints: endpointsFor(config, spec.sessionId, spec.ports) });
+      spec.onStatus({ kind: "running", endpoints: endpointsFor(config, spec.sessionId, app.ports) });
     };
 
     let resolveRunning!: () => void;
@@ -207,7 +237,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         const provision = provisionMessage(obj);
         if (provision && provision !== lastProvision) {
           lastProvision = provision;
-          spec.onProgress("provision", provision);
+          spec.onProgress("provision", provision, undefined, appName);
         }
       }
       if (phase === "Running" && !runningSeen) {
@@ -253,7 +283,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         const req = await kube.watch.watch(
           `/api/v1/namespaces/${ns}/pods`,
           { fieldSelector: `metadata.name=${podName}` },
-          (_type: string, obj: unknown) => handlePhase(obj),
+          (type: string, obj: unknown) => handlePhase(obj),
           () => {
             if (finished) return;
             void reconcileOnce().then(() => {
@@ -303,12 +333,12 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
       socket = ws as unknown as ResizableSocket;
     } catch (err) {
       // Attach failure isn't fatal — status still flows; surface the degraded PTY.
-      spec.onOutput(Buffer.from(`\r\n[runner] failed to attach PTY: ${msg(err)}\r\n`));
+      spec.onOutput(appName, Buffer.from(`\r\n[runner] failed to attach PTY: ${msg(err)}\r\n`), "tty");
     }
 
-    if (config.sessionIngressBaseDomain && spec.ports.length > 0) {
-      await createIngress(deps, spec.sessionId, podName, podUid, spec.ports).catch((err) => {
-        spec.onOutput(Buffer.from(`\r\n[runner] failed to create ingress: ${msg(err)}\r\n`));
+    if (config.sessionIngressBaseDomain && app.ports.length > 0) {
+      await createIngress(deps, spec.sessionId, podName, podUid, app.ports).catch((err) => {
+        spec.onOutput(appName, Buffer.from(`\r\n[runner] failed to create ingress: ${msg(err)}\r\n`), "tty");
       });
     }
 
@@ -331,11 +361,11 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
       if (ip) {
         void relayDebugStream({
           url: `http://${ip}:${INSPECT_PORT}/events`,
-          onFrame: spec.onDebug,
+          onFrame: (frame) => spec.onDebug(appName, frame),
           signal: debugAbort.signal,
         });
       } else {
-        spec.onOutput(Buffer.from("\r\n[runner] debug stream unavailable: pod IP unknown\r\n"));
+        spec.onOutput(appName, Buffer.from("\r\n[runner] debug stream unavailable: pod IP unknown\r\n"), "tty");
       }
     }
 
@@ -343,7 +373,7 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
     // wrong port) is unreachable on the pod network and surfaces only as a
     // downstream 502. Watch each advertised tcp port from the runner and report
     // per-port state to studio's endpoint badge. Background; finish() aborts it.
-    const tcpPorts = spec.ports.filter((p) => p.protocol === "tcp").map((p) => p.port);
+    const tcpPorts = app.ports.filter((p) => p.protocol === "tcp").map((p) => p.port);
     if (tcpPorts.length > 0) {
       void (async () => {
         const ip = await resolvePodIP();
@@ -351,13 +381,13 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
         if (!ip) {
           // Couldn't resolve the pod IP to probe — report unverified rather than
           // leaving the badge spinning forever.
-          for (const port of tcpPorts) spec.onReachability(port, "unreachable");
+          for (const port of tcpPorts) spec.onReachability(appName, port, "unreachable");
           return;
         }
         await watchReachability({
           host: ip,
           ports: tcpPorts,
-          onState: (port, state) => spec.onReachability(port, state),
+          onState: (port, state) => spec.onReachability(appName, port, state),
           signal: reachAbort.signal,
         });
       })();
@@ -366,14 +396,14 @@ export function createKubernetesBackend(deps: K8sBackendDeps): RunnerBackend {
     // `flipRunning` already announced `running` from the watch's Running
     // transition (which `await running` above waited on).
     return {
-      writeStdin(bytes) {
+      writeStdin(app, bytes) {
         try {
           stdin.write(Buffer.from(bytes));
         } catch {
           /* stream ended */
         }
       },
-      resize(cols, rows) {
+      resize(app, cols, rows) {
         if (!socket) return;
         try {
           const payload = Buffer.from(JSON.stringify({ Width: cols, Height: rows }));
@@ -423,7 +453,7 @@ async function createIngress(
   sessionId: string,
   podName: string,
   podUid: string,
-  ports: BackendStartSpec["ports"],
+  ports: PortMapping[],
 ): Promise<void> {
   const { kube, config } = deps;
   const ns = config.sessionNamespace;
@@ -442,15 +472,6 @@ async function createIngress(
   await kube.networking.createNamespacedIngress({ namespace: ns, body: ingress });
 }
 
-async function deletePod(kube: KubeClient, ns: string, name: string): Promise<void> {
-  try {
-    await kube.core.deleteNamespacedPod({ name, namespace: ns, gracePeriodSeconds: 0 });
-  } catch (err) {
-    // 404 = already gone (natural exit + GC). Anything else is a real failure.
-    if (!is404(err)) throw err;
-  }
-}
-
 async function clusterReachable(kube: KubeClient): Promise<boolean> {
   try {
     await kube.core.listNamespace();
@@ -459,126 +480,3 @@ async function clusterReachable(kube: KubeClient): Promise<boolean> {
     return false;
   }
 }
-
-function podStatus(obj: unknown): V1Pod["status"] | undefined {
-  return (obj as V1Pod | undefined)?.status;
-}
-
-function podPhase(obj: unknown): string | undefined {
-  return podStatus(obj)?.phase;
-}
-
-/** A coming-up message for the studio feed while the Pod is still scheduling /
- *  pulling / delivering the body / creating the container; undefined once running. */
-function provisionMessage(obj: unknown): string | undefined {
-  const status = podStatus(obj);
-  if (status?.phase !== "Pending") return undefined;
-  const containers = [
-    ...(status.initContainerStatuses ?? []),
-    ...(status.containerStatuses ?? []),
-  ];
-  for (const cs of containers) {
-    const reason = cs.state?.waiting?.reason;
-    if (reason) return humanizeWaitReason(reason);
-  }
-  return "Scheduling";
-}
-
-function humanizeWaitReason(reason: string): string {
-  switch (reason) {
-    case "ContainerCreating":
-      return "Creating container";
-    case "PodInitializing":
-      return "Delivering application";
-    case "ErrImagePull":
-    case "ImagePullBackOff":
-      return "Pulling image";
-    default:
-      return reason;
-  }
-}
-
-function terminalStatus(obj: unknown, userStopped: boolean): RunStatus {
-  if (userStopped) return { kind: "stopped" };
-  const phase = podPhase(obj);
-  if (phase === "Succeeded") return { kind: "exited", code: containerExitCode(obj) ?? 0 };
-  return { kind: "failed", message: podFailureMessage(obj) };
-}
-
-// Exit code of the main session container — used to report a clean exit.
-function containerExitCode(obj: unknown): number | null {
-  const term = podStatus(obj)?.containerStatuses?.[0]?.state?.terminated;
-  return typeof term?.exitCode === "number" ? term.exitCode : null;
-}
-
-const MAX_FAILURE_DETAIL = 500;
-
-/**
- * Builds an actionable failure message from a terminal Pod status. Init
- * containers are inspected first: a failed init container leaves the main
- * container unstarted, so reading only `containerStatuses` would fall through
- * to the bare "pod failed". For prebuilt session pods the common failure is the
- * main container itself (image pull, OOM, a non-zero exit).
- */
-export function podFailureMessage(obj: unknown): string {
-  const status = podStatus(obj);
-  const fromContainer = firstContainerProblem(status);
-  if (fromContainer) return fromContainer;
-  if (status?.message) return truncateDetail(status.message);
-  if (status?.reason) return status.reason;
-  return "pod failed";
-}
-
-function firstContainerProblem(status: V1Pod["status"] | undefined): string | undefined {
-  const groups: Array<[string, V1ContainerStatus[] | undefined]> = [
-    ["init container", status?.initContainerStatuses],
-    ["container", status?.containerStatuses],
-  ];
-  for (const [label, statuses] of groups) {
-    for (const cs of statuses ?? []) {
-      const problem = containerStateProblem(cs.state) ?? containerStateProblem(cs.lastState);
-      if (problem) return `${label} "${cs.name}" ${problem}`;
-    }
-  }
-  return undefined;
-}
-
-function containerStateProblem(state: V1ContainerState | undefined): string | undefined {
-  const term = state?.terminated;
-  if (term && term.exitCode !== 0) {
-    const reason = term.reason ? `${term.reason} ` : "";
-    const detail = term.message ? `: ${truncateDetail(term.message)}` : "";
-    return `failed: ${reason}(exit code ${term.exitCode ?? "unknown"})${detail}`;
-  }
-  const waiting = state?.waiting;
-  if (waiting?.reason && isBlockingWaitReason(waiting.reason)) {
-    const detail = waiting.message ? `: ${truncateDetail(waiting.message)}` : "";
-    return `waiting: ${waiting.reason}${detail}`;
-  }
-  return undefined;
-}
-
-// Benign transient reasons the kubelet reports while a Pod is still coming up.
-function isBlockingWaitReason(reason: string): boolean {
-  return reason !== "PodInitializing" && reason !== "ContainerCreating";
-}
-
-function truncateDetail(text: string): string {
-  const trimmed = text.trim();
-  return trimmed.length > MAX_FAILURE_DETAIL ? `${trimmed.slice(0, MAX_FAILURE_DETAIL)}…` : trimmed;
-}
-
-function is404(err: unknown): boolean {
-  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
-  return e?.statusCode === 404 || e?.code === 404 || e?.response?.statusCode === 404;
-}
-
-function msg(err: unknown): string {
-  if (err instanceof Error) return err.message;
-  if (typeof err === "string") return err;
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
-}