@telorun/k8s-runner 0.13.0 → 0.14.0

package/README.md

@@ -31,40 +31,40 @@ for status, attaches a PTY over the Pod `attach` subresource for the interactive
 per-session Service + Ingress (`<sessionId>.<base-domain>`) garbage-collected via
 an ownerReference to the Pod.
 
-**Every session runs a prebuilt per-app image** — there is no in-pod install
-path. On a session-create the runner stages the bundle plus a generated
-`Dockerfile` (`FROM <base>`, `ENV TELO_CACHE_DIR=/telo-cache`, `RUN telo install`),
-runs a trusted **Kaniko** Job in the `telo-builds` namespace that bakes every
-controller and module manifest into `/telo-cache/{manifests,npm}` and pushes the
-result, then runs the session pod from that image — so the session never installs
-anything on the start path and a slow/unreachable package registry can't stall it.
-
-**The image is keyed on the dependency closure, not the whole bundle** — the
-`imports:` set plus any controllers declared by inline `Telo.Definition` docs
-(see `extractDependencyKey`). A body-only edit (resource config, CEL) reuses the
-existing image; only an import or controller change rebuilds. The per-session
-**body is delivered at boot**, not baked: a body-fetch initContainer untars the
-staged bundle into a writable `/app` emptyDir, and the session runs `telo run
-/app/<entry> --no-cache-write` — reading the baked deps from the read-only
-`/telo-cache` and validating in-memory, so `readOnlyRootFilesystem` stays on with
-nothing written to the cache. Builds are existence-checked before building and
-single-flighted; a build failure surfaces as an actionable error carrying the
-build pod's log tail. `RUNNER_IMAGE_REPOSITORY` is therefore **required** — the
-runner refuses to start without a registry to build into.
+**Every session runs the plain kernel image.** A body-fetch initContainer untars
+the staged bundle into a writable `/app` emptyDir and the session container runs
+`telo run /app/<entry>`, resolving its own module closure into a `/telo-cache`
+emptyDir on the way up. `readOnlyRootFilesystem` stays on — every write lands on
+a mounted emptyDir. The runner needs **no image registry of its own**: it builds
+nothing, pushes nothing, and creates no Jobs.
+
+The runner used to prebuild a self-contained per-app image with an on-cluster
+Kaniko Job, so that a slow package registry could not stall the start path. That
+is gone, and the cost is where it now shows: **a run session downloads its
+closure on every start**, since the cache lives and dies with the pod. A watch
+session pays it once and keeps the cache for the pod's life, which is the shape
+to reach for when start latency matters.
 
 **Coming-up progress** is reported over the `/v1` SSE stream as `progress` events
-(`build` → `provision`) while the session is still `starting`. The session is
-created with a fast `201` carrying the `streamUrl` **before** the build runs, so
-the client connects immediately and sees build + provision progress live; the
-backend then runs in the background and a start failure surfaces as a terminal
-`failed` status on the stream. The session flips to `running` when the Pod reaches
-`Running`.
+(`provision` → `boot`) while the session is still `starting`. The session is
+created with a fast `201` carrying the `streamUrl` **before** the pod is created,
+so the client connects immediately and sees provisioning live; the backend then
+runs in the background and a start failure surfaces as a terminal `failed` status
+on the stream. The session flips to `running` when the Pod reaches `Running`.
 
 Sandbox hardening is always on (non-root, read-only rootfs, drop-all caps, no
 service-account token, seccomp `RuntimeDefault`); a sandbox RuntimeClass
-(gVisor/Kata) is layered on when configured. In the prebuilt path the per-app
-image is single-tenant, so install scripts run normally inside the trusted build
-(native/postinstall controllers work) with no cross-tenant cache to poison.
+(gVisor/Kata) is layered on when configured. A controller whose install needs to
+run scripts or build native code runs them **inside the session pod** under that
+hardening — there is no trusted build step to run them in.
+
+**A Kubernetes API rejection reaches the client as its status and `reason`, never
+as the exception.** The API's error carries the full HTTP dump — the raw `Status`
+body naming the runner's ServiceAccount, the audit id, every response header —
+and a start failure's message travels verbatim to the client as the session's
+terminal status. So the client is told the operation, the HTTP code and the
+one-word reason (`Forbidden`, `NotFound`), plus who can fix a `403`; the raw
+exception rides along as the error's `cause` and lands in the runner's log.
 
 ## Watch sessions
 
@@ -74,7 +74,7 @@ different — a **workspace that runs continuously**. One pod holds a shared
 `/workspace` volume, a `workspace` container serving the editor's file routes, one
 `app-<name>` container per application running `telo run --watch`, and optionally
 a co-resident `agent` drawn from the `RUNNER_APPS` catalog. An edit then costs a
-kernel reload instead of a pod: no schedule, no pull, no build.
+kernel reload instead of a pod: no schedule, no pull, no module re-resolve.
 
 Off unless `RUNNER_WATCH_SESSIONS` is set. Run sessions are entirely unaffected.
 
@@ -128,10 +128,10 @@ runner reconciles into a content-addressed ConfigMap — there is no third image
 build, and a runner upgrade that changes the manifest leaves running sessions
 mounting the one they booted with.
 
-**Watch sessions never build an image.** The build path exists to put a dependency
-closure on disk before boot; a watch session resolves its own into the workspace
-volume, which lives as long as the pod, so the download happens once per session
-and every later reload resolves from local disk.
+**A watch session resolves its closure once.** It lands in the workspace volume,
+which lives as long as the pod, so the download happens once per session and
+every later reload resolves from local disk — where a run session, whose cache
+dies with its pod, pays for it on every start.
 
 **One cache for the whole session.** The runner seeds `telo-workspace.yaml` at
 the workspace root when the session starts, and the kernel anchors its `.telo`
@@ -144,13 +144,11 @@ manifest lives outside the workspace and the walk-up would never reach the
 marker. A workspace that brings its own marker keeps it — overwriting one with a
 real `modules:` list would change what `telo release` discovers.
 
-**Egress moves into the session namespace.** Module fetches used to be scoped to
-the build namespace; a watch session resolves them itself, so the session
-namespace's NetworkPolicy has to reach module registries as well as the model
-provider. Core NetworkPolicy is CIDR-only and registries sit behind rotating-IP
-CDNs, so a locked-down operator needs a CNI with FQDN policy or an egress proxy
-here — the same stated dependency the build namespace already carries, one
-namespace over.
+**Egress lives in the session namespace.** Every session resolves its own module
+closure, so the session namespace's NetworkPolicy has to reach the module
+registries as well as the model provider. Core NetworkPolicy is CIDR-only and
+registries sit behind rotating-IP CDNs, so a locked-down operator needs a CNI
+with FQDN policy or an egress proxy here.
 
 ### Two nouns on one stream
 
@@ -288,14 +286,15 @@ outcome than a URL that silently reaches the wrong app.
 | `PORT` | `8062` | HTTP listen port |
 | `RUNNER_DISPLAY_NAME` | `Telo Runner` | Display name advertised on `/v1/capabilities` (the editor's runner label) |
 | `RUNNER_DESCRIPTION` | `Runs the Telo application in a cloud environment` | Description advertised on `/v1/capabilities` |
-| `RUNNER_APPS` | _(unset → no apps)_ | JSON map of operator-predefined apps launchable by name (chart: inline `apps.catalog`, or `apps.catalogSecret` referencing a Secret holding the JSON — use the Secret whenever entries embed secrets in `env`); see the docker-runner README for the entry shape, including the `port` an entry must declare to be usable as a session's co-resident `agent`. App sessions run the catalog image directly as a pod — no on-cluster build |
+| `RUNNER_APPS` | _(unset → no apps)_ | JSON map of operator-predefined apps launchable by name (chart: inline `apps.catalog`, or `apps.catalogSecret` referencing a Secret holding the JSON — use the Secret whenever entries embed secrets in `env`); see the docker-runner README for the entry shape, including the `port` an entry must declare to be usable as a session's co-resident `agent`. App sessions run the catalog image directly as a pod |
 | `RUNNER_APP_MAX_CPU` | `500m` | CPU ceiling for predefined-app pods (separate from the anonymous-session ceiling) |
 | `RUNNER_APP_MAX_MEMORY` | `512Mi` | Memory ceiling for predefined-app pods |
 | `RUNNER_APP_MAX_TTL_SECONDS` | `21600` | Wall-clock TTL for predefined-app pods (agent sessions are long-lived) |
 | `RUNNER_APP_MAX_EPHEMERAL_STORAGE` | `1Gi` | Ephemeral-storage ceiling for predefined-app pods |
 | `RUNNER_SESSION_NAMESPACE` | `telo-sessions` | Namespace for session objects |
 | `RUNNER_IMAGE` | _(baked at build: the CLI version for a released runner, `telorun/node:latest-slim` for a dev build)_ | Default base image; always offered in the picker and the fallback when the catalog is unreachable. Leave the chart's `session.image` empty to keep the session kernel in lockstep with the runner |
-| `RUNNER_INIT_IMAGE` | `busybox:stable` | Build-context fetch initContainer image (wget + tar) |
+| `RUNNER_INIT_IMAGE` | `busybox:stable` | Bundle-fetch initContainer image (wget + tar) |
+| `RUNNER_IMAGE_PULL_SECRET` | _(unset)_ | dockerconfig Secret (in `telo-sessions`) the kubelet pulls session images with — needed only for a kernel or catalog image in a private registry |
 | `RUNNER_RUNTIME_CLASS` | _(unset → runc)_ | Sandbox RuntimeClass (gvisor/kata) |
 | `SESSION_INGRESS_BASE_DOMAIN` | _(unset → logs-only)_ | Wildcard base for per-session ingress |
 | `SESSION_INGRESS_TLS_SECRET` | _(unset → no TLS block)_ | `kubernetes.io/tls` Secret (in `telo-sessions`) the session Ingress presents; must cover `*.<base-domain>`. Set for Cloudflare Full (Strict) / any origin-cert upstream |
@@ -327,12 +326,9 @@ against the same list, so a client that skips the editor can't widen the set.
 unreachable. Disable the catalog to lock `image` to `RUNNER_IMAGE`.
 
 Pinned tags (e.g. `0.30.1-slim`) are immutable. A picked **moving** tag like
-`latest-slim` only refreshes when the session's `pullPolicy` is `always`: the
-build then pins the per-app image to the base's current digest, so a moved tag
-yields a new image and rebuilds (otherwise the cached build — keyed on the tag
-string — is reused). Movement detection reads the digest from Docker Hub, so a
-base hosted elsewhere (GHCR, a private registry) can't be tracked — `always`
-degrades to reusing the cached build for it, same as `missing` / `never`.
+`latest-slim` only refreshes when the session's `pullPolicy` is `always`, which
+is the Pod's own `imagePullPolicy`: the kubelet re-pulls the tag on every
+session. `missing` and `never` reuse whatever that node already cached.
 
 | Env | Default | Purpose |
 | --- | --- | --- |
@@ -346,53 +342,38 @@ degrades to reusing the cached build for it, same as `missing` / `never`.
 | `RUNNER_BASE_IMAGE_LIMIT` | `20` | Cap on advertised tags (newest first) |
 | `RUNNER_BASE_IMAGE_REFRESH_SECONDS` | `3600` | Catalog re-fetch cadence |
 
-### Image build (required)
-
-| Env | Default | Purpose |
-| --- | --- | --- |
-| `RUNNER_IMAGE_REPOSITORY` | _(required)_ | Registry repo for per-app images; tag = bundle hash |
-| `RUNNER_BUILD_NAMESPACE` | `telo-builds` | Namespace the trusted Kaniko build Jobs run in |
-| `RUNNER_BUILDER_IMAGE` | `gcr.io/kaniko-project/executor:latest` | Image builder |
-| `RUNNER_BUILD_TIMEOUT_SECONDS` | `600` | Build Job deadline / wait budget |
-| `RUNNER_REGISTRY_INSECURE` | `false` | Push/pull over HTTP / self-signed |
-| `RUNNER_REGISTRY_API_URL` | _(unset → always build)_ | HTTP(S) base for the manifest existence check (authenticated via the push Secret) |
-| `RUNNER_REGISTRY_PUSH_SECRET` | _(unset)_ | dockerconfig Secret (in `telo-builds`) Kaniko pushes with; also authenticates the existence check |
-| `RUNNER_IMAGE_PULL_SECRET` | _(unset)_ | dockerconfig Secret (in `telo-sessions`) the kubelet pulls per-app images with |
-
 ## Deploy (Helm)
 
-The runner **requires a registry to build into** (there is no in-pod install
-fallback), so point it at one your cluster's kubelet can pull from:
+The chart is published as an OCI artifact at
+`oci://ghcr.io/telorun/charts/k8s-runner`:
 
 ```bash
-helm install telo-runner ./chart \
-  --set build.repository=registry.example.com/telo-sessions \
-  --set-file registry.dockerconfigjson=./dockerconfig.json \  # private-registry auth
+helm install telo-runner oci://ghcr.io/telorun/charts/k8s-runner \
+  --set watch.enabled=true \
   --set session.runtimeClass=gvisor
 ```
 
-For a private registry, `registry.dockerconfigjson` creates the dockerconfig
-Secret in **both** namespaces (push in `telo-builds`, pull in `telo-sessions`) and
-wires `RUNNER_REGISTRY_PUSH_SECRET` + `RUNNER_IMAGE_PULL_SECRET` — the kubelet
-needs the pull copy because the per-app image is private. (Or manage the Secrets
-yourself and reference them via `build.pushSecretName` / `build.pullSecretName`.)
-The push Secret doubles as the credential for the manifest existence check, so
-the runner can see an already-built image in a private registry and skip the
-rebuild — without it a private registry answers `401` and every run rebuilds.
-A no-auth registry needs none of this.
+Helm resolves the newest release when no `--version` is given; pass one to pin.
+From a checkout, `./chart` works the same way and is what you want when changing
+the chart itself.
+
+**The chart's version IS the runner's.** `version` and `appVersion` both carry
+`@telorun/k8s-runner`'s package version, stamped in the release PR and checked on
+every PR — so chart `0.13.0` installs runner image `0.13.0`, with no lookup
+table. That is also why `image.tag` defaults to empty and resolves to the chart's
+own `appVersion` rather than to `latest`: `--version 0.13.0` has to mean one
+thing, where a floating tag meant whatever it had moved to overnight.
 
 The chart provisions the static scaffolding: the runner Deployment (single
 replica — the registry is in-memory and the runner reaps orphaned pods on boot),
-Service, scoped RBAC, the `telo-runner` / restricted-PSS `telo-sessions` /
-baseline-PSS `telo-builds` namespaces, a `ResourceQuota`, and NetworkPolicies
-(session pod-to-pod isolation + the build namespace's registry egress). The
-runner creates per-session and per-build objects at runtime.
+Service, scoped RBAC, the `telo-runner` and restricted-PSS `telo-sessions`
+namespaces, a `ResourceQuota`, and the session pod-to-pod NetworkPolicy. The
+runner creates per-session objects at runtime. Nothing else is required — no
+image registry, no build namespace, no push credentials.
 
-The optional in-cluster registry (`--set registry.enabled=true --set
-build.insecureRegistry=true`) derives `build.repository` for you, but works only
-on clusters whose **nodes are configured to trust it** — otherwise an external/
-cloud registry is simpler. Installing with neither a `build.repository` nor
-`registry.enabled` is rejected at template time.
+For a kernel image or an operator catalog image held in a **private registry**,
+create the dockerconfigjson Secret in `telo-sessions` yourself and point
+`session.imagePullSecret` at it; the kubelet pulls with it.
 
 ### Origin TLS (Cloudflare et al.)
 
@@ -416,18 +397,17 @@ Either wires `SESSION_INGRESS_TLS_SECRET`, and the runner stamps a `spec.tls`
 block on every session Ingress. Leave all three empty to skip TLS at the origin
 (terminated entirely upstream).
 
-> **Egress notes.** (1) The kubelet pulls session images directly and does **not**
-> use cluster DNS, so the in-cluster registry only works where nodes trust it
-> (e.g. containerd `registries.conf`). (2) Core NetworkPolicy is CIDR-only and
-> cannot express the package-registry FQDN allowlist the build namespace needs —
-> use a CNI with FQDN policy (Cilium) or an egress proxy to tighten it.
+> **Egress note.** Core NetworkPolicy is CIDR-only and cannot express the
+> package-registry FQDN allowlist the session namespace needs — use a CNI with
+> FQDN policy (Cilium) or an egress proxy to tighten it.
 
 ## Development
 
 ```bash
 pnpm --filter @telorun/k8s-runner build   # tsc
-pnpm --filter @telorun/k8s-runner test    # vitest (limits clamp, tar, bundle token)
+pnpm --filter @telorun/k8s-runner test    # vitest (pod specs, limits clamp, tar, API errors)
 ```
 
 The Kubernetes backend can't be exercised without a cluster; unit tests cover the
-backend-independent logic (limit clamping, the tar writer, bundle tokens).
+backend-independent logic (the pod specs, limit clamping, the tar writer, and
+what an API rejection is allowed to tell a client).

package/dist/bundle-store.d.ts

@@ -1,9 +1,9 @@
 import type { FastifyInstance } from "fastify";
 import type { RunBundle } from "@telorun/runner-core";
 /**
- * Holds image-build contexts in memory and serves them over a tokenized,
- * cluster-internal URL the build Job's initContainer fetches once. The
- * per-build unguessable token prevents cross-build disclosure; the entry is
+ * Holds session bundles in memory and serves them over a tokenized,
+ * cluster-internal URL the session pod's initContainer fetches once. The
+ * per-session unguessable token prevents cross-session disclosure; the entry is
  * dropped after first fetch (or explicitly on cleanup).
  */
 export declare class BundleStore {
@@ -11,16 +11,9 @@ export declare class BundleStore {
     private readonly bundles;
     constructor(selfUrl: string);
     /**
-     * Stages an image-build context — the bundle plus a generated `Dockerfile` at
-     * the context root — and returns the tokenized, single-use URL the build Job's
-     * initContainer fetches. Keyed by `id` (a build id).
-     */
-    stageBuildContext(id: string, bundle: RunBundle, dockerfile: string): Promise<string>;
-    /**
-     * Stages the raw session bundle (no Dockerfile) and returns the tokenized,
-     * single-use URL the session Pod's body-delivery initContainer fetches into
-     * `/app`. Keyed by `sessionId`. The image is keyed only on the dependency
-     * closure, so the per-session body is delivered here at boot rather than baked.
+     * Stages the session bundle and returns the tokenized, single-use URL the
+     * session Pod's body-delivery initContainer fetches into `/app`. Keyed by
+     * `sessionId`.
      */
     stageSessionBundle(sessionId: string, bundle: RunBundle): Promise<string>;
     private stage;

package/dist/bundle-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-store.d.ts","sourceRoot":"","sources":["../src/bundle-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AActD;;;;;GAKG;AACH,qBAAa,WAAW;IAGV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;gBAE9B,OAAO,EAAE,MAAM;IAE5C;;;;OAIG;IACG,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO3F;;;;;OAKG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;YAIjE,KAAK;IAUnB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM7B,OAAO,CAAC,IAAI;IASZ,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI;CAiB1C"}
+{"version":3,"file":"bundle-store.d.ts","sourceRoot":"","sources":["../src/bundle-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AActD;;;;;GAKG;AACH,qBAAa,WAAW;IAGV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;gBAE9B,OAAO,EAAE,MAAM;IAE5C;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;YAIjE,KAAK;IAUnB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM7B,OAAO,CAAC,IAAI;IASZ,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI;CAiB1C"}

package/dist/bundle-store.js

@@ -4,9 +4,9 @@ import { makeBundleTarGz } from "./tar.js";
  *  stuck/never-started Pod can't grow the store unbounded. */
 const STAGING_TTL_MS = 5 * 60 * 1000;
 /**
- * Holds image-build contexts in memory and serves them over a tokenized,
- * cluster-internal URL the build Job's initContainer fetches once. The
- * per-build unguessable token prevents cross-build disclosure; the entry is
+ * Holds session bundles in memory and serves them over a tokenized,
+ * cluster-internal URL the session pod's initContainer fetches once. The
+ * per-session unguessable token prevents cross-session disclosure; the entry is
  * dropped after first fetch (or explicitly on cleanup).
  */
 export class BundleStore {
@@ -16,21 +16,9 @@ export class BundleStore {
         this.selfUrl = selfUrl;
     }
     /**
-     * Stages an image-build context — the bundle plus a generated `Dockerfile` at
-     * the context root — and returns the tokenized, single-use URL the build Job's
-     * initContainer fetches. Keyed by `id` (a build id).
-     */
-    async stageBuildContext(id, bundle, dockerfile) {
-        return this.stage(id, {
-            entryRelativePath: bundle.entryRelativePath,
-            files: [...bundle.files, { relativePath: "Dockerfile", contents: dockerfile }],
-        });
-    }
-    /**
-     * Stages the raw session bundle (no Dockerfile) and returns the tokenized,
-     * single-use URL the session Pod's body-delivery initContainer fetches into
-     * `/app`. Keyed by `sessionId`. The image is keyed only on the dependency
-     * closure, so the per-session body is delivered here at boot rather than baked.
+     * Stages the session bundle and returns the tokenized, single-use URL the
+     * session Pod's body-delivery initContainer fetches into `/app`. Keyed by
+     * `sessionId`.
      */
     async stageSessionBundle(sessionId, bundle) {
         return this.stage(sessionId, bundle);

package/dist/bundle-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-store.js","sourceRoot":"","sources":["../src/bundle-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAQ3C;8DAC8D;AAC9D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAGO;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,MAAiB,EAAE,UAAkB;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;YACpB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,MAAiB;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,MAAiB;QAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7E,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,OAAO,qBAAqB,EAAE,UAAU,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAEO,IAAI,CAAC,SAAiB,EAAE,KAAa;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,GAAoB;QAChC,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,KAAK;iBACF,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC;iBAC1C,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;iBACnC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"bundle-store.js","sourceRoot":"","sources":["../src/bundle-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK3D,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAQ3C;8DAC8D;AAC9D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAGO;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,MAAiB;QAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,MAAiB;QAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7E,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC,OAAO,qBAAqB,EAAE,UAAU,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAEO,IAAI,CAAC,SAAiB,EAAE,KAAa;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,aAAa,CAAC,GAAoB;QAChC,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,KAAK;iBACF,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC;iBAC1C,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;iBACnC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/capabilities.d.ts

@@ -19,9 +19,9 @@ export interface KubernetesRunnerCapabilitiesOptions {
  *  studio renders an editable dropdown constrained to that allowlist — which the
  *  session route re-validates server-side. Without a catalog (disabled /
  *  first-fetch failure) the list collapses to the single `defaultImage` (locked
- *  via `enforced`). `pullPolicy` is client-editable: `always` re-pulls the base
- *  image when its tag has moved upstream (rebuilding the per-app image), which
- *  is how a picked moving tag like `latest-slim` stays current.
+ *  via `enforced`). `pullPolicy` is client-editable and is the pod's own
+ *  `imagePullPolicy`: `always` re-pulls the kernel image, which is how a picked
+ *  moving tag like `latest-slim` stays current.
  *
  *  `terms`, when set (operator-provided via RUNNER_TERMS_*), are enforced: a
  *  session won't start until the client acknowledges the current version. */

package/dist/capabilities.js

@@ -5,9 +5,9 @@ import { sessionConfigSchema, } from "@telorun/runner-core";
  *  studio renders an editable dropdown constrained to that allowlist — which the
  *  session route re-validates server-side. Without a catalog (disabled /
  *  first-fetch failure) the list collapses to the single `defaultImage` (locked
- *  via `enforced`). `pullPolicy` is client-editable: `always` re-pulls the base
- *  image when its tag has moved upstream (rebuilding the per-app image), which
- *  is how a picked moving tag like `latest-slim` stays current.
+ *  via `enforced`). `pullPolicy` is client-editable and is the pod's own
+ *  `imagePullPolicy`: `always` re-pulls the kernel image, which is how a picked
+ *  moving tag like `latest-slim` stays current.
  *
  *  `terms`, when set (operator-provided via RUNNER_TERMS_*), are enforced: a
  *  session won't start until the client acknowledges the current version. */
@@ -30,7 +30,7 @@ export function kubernetesRunnerCapabilities(opts) {
                 imageDefault: defaultImage,
                 enforced: true,
                 imageEnum,
-                pullPolicyDescription: "Base-image freshness. `always` rebuilds the session image when the base tag has moved upstream (Docker Hub only); `missing` and `never` reuse the cached build.",
+                pullPolicyDescription: "Kernel-image freshness, applied as the Pod's imagePullPolicy. `always` re-pulls on every session, so a moving tag like `latest-slim` picks up a new release. `missing` pulls only when the node has no copy. `never` never pulls at all — on a node that has not already cached the image the session fails to start (ErrImageNeverPull), so it suits a cluster that pre-loads its images and nothing else.",
             }),
         },
         terms,

package/dist/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAiB9B;;;;;;;;;;;6EAW6E;AAC7E,MAAM,UAAU,4BAA4B,CAC1C,IAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1E,OAAO;QACL,WAAW;QACX,WAAW;QACX,QAAQ,EAAE;YACR,qEAAqE;YACrE,0EAA0E;YAC1E,kCAAkC;YAClC,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;QACD,MAAM,EAAE;YACN,MAAM,EAAE,mBAAmB,CAAC;gBAC1B,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,qBAAqB,EACnB,iKAAiK;aACpK,CAAC;SACH;QACD,KAAK;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAiB9B;;;;;;;;;;;6EAW6E;AAC7E,MAAM,UAAU,4BAA4B,CAC1C,IAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC1E,OAAO;QACL,WAAW;QACX,WAAW;QACX,QAAQ,EAAE;YACR,qEAAqE;YACrE,0EAA0E;YAC1E,kCAAkC;YAClC,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E;QACD,MAAM,EAAE;YACN,MAAM,EAAE,mBAAmB,CAAC;gBAC1B,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,qBAAqB,EACnB,6YAA6Y;aAChZ,CAAC;SACH;QACD,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -34,33 +34,6 @@ export interface LimitCeilings {
     /** Per-Pod ephemeral-storage limit, e.g. "512Mi". */
     ephemeralStorage: string;
 }
-/**
- * On-cluster image-build settings. The runner ALWAYS prebuilds a self-contained
- * per-app image (controllers + module manifests baked in via `telo install`) and
- * the session pod runs it directly — there is no in-pod install fallback, so a
- * registry repository (`RUNNER_IMAGE_REPOSITORY`) is required.
- */
-export interface ImageBuildConfig {
-    /** Registry repository the per-app image is pushed to / pulled from; the tag
-     *  is the bundle content hash (e.g. `registry.telo-runner.svc:5000/telo-sessions`). */
-    repository: string;
-    /** Namespace the trusted Kaniko build Jobs run in (registry egress lives here). */
-    namespace: string;
-    /** Builder image — Kaniko (or a compatible `--context`/`--destination` executor). */
-    builderImage: string;
-    /** Build Job `activeDeadlineSeconds` and the runner's wait budget. */
-    timeoutSeconds: number;
-    /** Push/pull to an insecure (HTTP / self-signed) registry — the in-cluster default. */
-    insecureRegistry: boolean;
-    /** HTTP(S) base for a best-effort manifest existence check (skip build on hit);
-     *  undefined → always build. */
-    registryApiUrl?: string;
-    /** Optional dockerconfig Secret (in the build namespace) Kaniko pushes with. */
-    pushSecretName?: string;
-    /** Optional dockerconfig Secret (in the session namespace) the kubelet uses to
-     *  pull per-app images from a private registry. */
-    imagePullSecret?: string;
-}
 export interface K8sRunnerConfig extends RunnerCoreConfig {
     /** Identity advertised on `/v1/capabilities` — studio labels the runner
      *  with these. */
@@ -72,8 +45,12 @@ export interface K8sRunnerConfig extends RunnerCoreConfig {
      *  image as `RUNNER_IMAGE` at build time (the kernel version the runner was
      *  built against); the literal fallback below is for a source checkout only. */
     defaultImage: string;
-    /** Small image for the bundle/build-context fetch initContainer (needs wget + tar). */
+    /** Small image for the bundle-fetch initContainer (needs wget + tar). */
     initImage: string;
+    /** Optional dockerconfig Secret (in the session namespace) the kubelet pulls
+     *  session images with — the kernel image, and any operator catalog image
+     *  (`RUNNER_APPS`) held in a private registry. */
+    imagePullSecret?: string;
     /** Optional sandbox RuntimeClass (gvisor/kata). Unset → cluster default (runc). */
     runtimeClass?: string;
     /** Wildcard base domain for per-session ingress; unset → logs-only. */
@@ -84,10 +61,8 @@ export interface K8sRunnerConfig extends RunnerCoreConfig {
      *  Ingress presents so an upstream (e.g. Cloudflare Full (Strict)) can validate
      *  the origin. Must cover the wildcard `*.<sessionIngressBaseDomain>`. Unset → no TLS block. */
     sessionIngressTlsSecretName?: string;
-    /** On-cluster image build — the only delivery path (always present). */
-    build: ImageBuildConfig;
-    /** Runner's own in-cluster base URL, used to build the bundle/build-context
-     *  fetch URL the initContainer curls (e.g. http://k8s-runner.telo-runner:8062). */
+    /** Runner's own in-cluster base URL, used to build the bundle fetch URL the
+     *  initContainer curls (e.g. http://k8s-runner.telo-runner:8062). */
     selfUrl: string;
     /** Label applied to every session object, used for orphan reaping. */
     managedByLabel: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B;2FACuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAC;IAC1B;oCACgC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;sBACkB;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;oFAEgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;oGAEgG;IAChG,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,wEAAwE;IACxE,KAAK,EAAE,gBAAgB,CAAC;IACxB;uFACmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6BAGyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AA0CD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAkE3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD;sBACkB;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;oFAEgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;sDAEkD;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;oGAEgG;IAChG,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;yEACqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB;;;6BAGyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C;AA0CD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAmD3E"}

package/dist/config.js

@@ -34,23 +34,6 @@ export function loadK8sRunnerConfig(env) {
         throw new RunnerConfigError("RUNNER_SELF_URL env var is required. Set it to the runner's in-cluster base URL " +
             "(e.g. http://k8s-runner.telo-runner.svc:8062) so session initContainers can fetch the bundle.");
     }
-    const repository = env.RUNNER_IMAGE_REPOSITORY?.trim();
-    if (!repository) {
-        throw new RunnerConfigError("RUNNER_IMAGE_REPOSITORY env var is required. The runner prebuilds a per-app session image for " +
-            "every run (there is no in-pod install fallback); set it to the registry repository the built " +
-            "images are pushed to / pulled from (e.g. registry.example.com/telo-sessions). The tag is the " +
-            "bundle content hash.");
-    }
-    const build = {
-        repository: repository.replace(/\/+$/, ""),
-        namespace: env.RUNNER_BUILD_NAMESPACE?.trim() || "telo-builds",
-        builderImage: env.RUNNER_BUILDER_IMAGE?.trim() || "gcr.io/kaniko-project/executor:latest",
-        timeoutSeconds: parsePositiveInt(env.RUNNER_BUILD_TIMEOUT_SECONDS, 600, "RUNNER_BUILD_TIMEOUT_SECONDS"),
-        insecureRegistry: env.RUNNER_REGISTRY_INSECURE?.trim() === "true",
-        registryApiUrl: env.RUNNER_REGISTRY_API_URL?.trim() || undefined,
-        pushSecretName: env.RUNNER_REGISTRY_PUSH_SECRET?.trim() || undefined,
-        imagePullSecret: env.RUNNER_IMAGE_PULL_SECRET?.trim() || undefined,
-    };
     return {
         ...loadCoreConfig(env, { port: DEFAULT_PORT }),
         displayName: env.RUNNER_DISPLAY_NAME?.trim() || "Telo Runner",
@@ -58,18 +41,27 @@ export function loadK8sRunnerConfig(env) {
         sessionNamespace: env.RUNNER_SESSION_NAMESPACE?.trim() || "telo-sessions",
         defaultImage: env.RUNNER_IMAGE?.trim() || "telorun/node:latest-slim",
         initImage: env.RUNNER_INIT_IMAGE?.trim() || "busybox:stable",
+        imagePullSecret: env.RUNNER_IMAGE_PULL_SECRET?.trim() || undefined,
         runtimeClass: env.RUNNER_RUNTIME_CLASS?.trim() || undefined,
         sessionIngressBaseDomain: env.SESSION_INGRESS_BASE_DOMAIN?.trim() || undefined,
         sessionIngressClassName: env.SESSION_INGRESS_CLASS?.trim() || undefined,
         sessionIngressTlsSecretName: env.SESSION_INGRESS_TLS_SECRET?.trim() || undefined,
-        build,
         selfUrl: selfUrl.replace(/\/+$/, ""),
         managedByLabel: env.RUNNER_MANAGED_BY?.trim() || "telo-k8s-runner",
+        // Sized for a pod that RESOLVES ITS OWN module closure. They used to be
+        // 50m / 100Mi / 512Mi, which described a different workload: the closure
+        // arrived in image layers, so the pod only ran it. It now downloads,
+        // unpacks and resolves it in-pod, into an emptyDir that counts against
+        // ephemeral-storage — so the old numbers meant an OOMKill on the memory
+        // ceiling and an eviction on the storage one, for the ordinary case. The
+        // watch path already ran this workload and already carried the roomier
+        // ceiling; these match it. `appLimits` stays separate: it still differs in
+        // TTL, and both remain the operator's policy to tighten.
         limits: {
-            cpu: env.RUNNER_MAX_CPU?.trim() || "50m",
-            memory: env.RUNNER_MAX_MEMORY?.trim() || "100Mi",
+            cpu: env.RUNNER_MAX_CPU?.trim() || "500m",
+            memory: env.RUNNER_MAX_MEMORY?.trim() || "512Mi",
             ttlSeconds: parsePositiveInt(env.RUNNER_MAX_TTL_SECONDS, 3600, "RUNNER_MAX_TTL_SECONDS"),
-            ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "512Mi",
+            ephemeralStorage: env.RUNNER_MAX_EPHEMERAL_STORAGE?.trim() || "1Gi",
         },
         appLimits: {
             cpu: env.RUNNER_APP_MAX_CPU?.trim() || "500m",

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AA0G7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CACzB,gGAAgG;YAC9F,+FAA+F;YAC/F,+FAA+F;YAC/F,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAqB;QAC9B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC9D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,uCAAuC;QACzF,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,4BAA4B,EAChC,GAAG,EACH,8BAA8B,CAC/B;QACD,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,KAAK,MAAM;QACjE,cAAc,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,cAAc,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QACpE,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;KACnE,CAAC;IAEF,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC7D,WAAW,EACT,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,kDAAkD;QACtF,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe;QACzE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,wBAAwB,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9E,uBAAuB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QACvE,2BAA2B,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChF,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,KAAK;YACxC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,OAAO;SACtE;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM;YAC7C,MAAM,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO;YACpD,UAAU,EAAE,gBAAgB,CAC1B,GAAG,CAAC,0BAA0B,EAC9B,KAAK,EACL,4BAA4B,CAC7B;YACD,gBAAgB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,KAAK;SACxE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAGlB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAgF7B,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAuB,EAAE,KAAa;IAC3D,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,uCAAwC,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAsB;IACxD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,mCAAmC,CAAC;QACpG,UAAU,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,cAAc;QAChE,MAAM,EAAE;YACN,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,CAAC;YAC/F,iBAAiB,EAAE,SAAS,CAC1B,GAAG,CAAC,oCAAoC,EACxC,IAAI,EACJ,sCAAsC,CACvC;YACD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;YAClF,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACnF;QACD,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACnF,iBAAiB,EACf,gBAAgB,CACd,GAAG,CAAC,iCAAiC,EACrC,IAAI,EACJ,mCAAmC,CACpC,GAAG,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kFAAkF;YAChF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,aAAa;QAC7D,WAAW,EACT,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,kDAAkD;QACtF,gBAAgB,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,eAAe;QACzE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,0BAA0B;QACpE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,gBAAgB;QAC5D,eAAe,EAAE,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,SAAS;QAClE,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,wBAAwB,EAAE,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9E,uBAAuB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;QACvE,2BAA2B,EAAE,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAChF,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAClE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,MAAM;YACzC,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO;YAChD,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACxF,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,KAAK;SACpE;QACD,SAAS,EAAE;YACT,GAAG,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,MAAM;YAC7C,MAAM,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,OAAO;YACpD,UAAU,EAAE,gBAAgB,CAC1B,GAAG,CAAC,0BAA0B,EAC9B,KAAK,EACL,4BAA4B,CAC7B;YACD,gBAAgB,EAAE,GAAG,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,KAAK;SACxE;QACD,gBAAgB,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/k8s/api-error.d.ts

@@ -0,0 +1,34 @@
+import { SessionStartError, type StartFailureStage } from "@telorun/runner-core";
+/**
+ * A Kubernetes API rejection, phrased for the person who clicked Run.
+ *
+ * `ApiException.message` is a full HTTP dump — status line, the raw `Status`
+ * body and every response header — and a start failure's message travels
+ * verbatim to the client as the session's terminal `failed` status. That put
+ * the runner's ServiceAccount name, the request's audit id and its flowschema
+ * UIDs on an end user's screen, none of which they can act on.
+ *
+ * So the client sees the operation, the HTTP status and the API's own one-word
+ * `reason` — enough for an operator to know what was refused — and never the
+ * body or the headers. The raw exception rides along as the error's `cause`,
+ * which the runner's log serializer records, so nothing is swallowed: the detail
+ * moves to the log, it does not disappear.
+ */
+export declare function apiFailure(err: unknown, stage: StartFailureStage, action: string): SessionStartError;
+/** Attach the original error as `cause` so a log serializer can reach it.
+ *  Every wrap on a failure path goes through here — a rewrap that drops the
+ *  cause silently undoes the whole point of summarizing the message. */
+export declare function withCause<E extends Error>(error: E, cause: unknown): E;
+/** The client-safe half of a Kubernetes API error: what was refused, and who
+ *  can act on it — never the `Status` message, which names cluster identities. */
+export declare function apiReason(err: unknown): string;
+/**
+ * The HTTP status an error carries, or `undefined` when it carries none.
+ *
+ * The number check is the whole point: `code` is also where Node puts a system
+ * error's string code and where a `DOMException` puts its legacy numeric one, so
+ * an unreachable apiserver and an aborted request both arrive here looking like
+ * a status. Only a value in the HTTP range is one.
+ */
+export declare function statusCode(err: unknown): number | undefined;
+//# sourceMappingURL=api-error.d.ts.map

package/dist/k8s/api-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../src/k8s/api-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAKnB;AAED;;wEAEwE;AACxE,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAGtE;AAED;kFACkF;AAClF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAoB9C;AAuDD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAM3D"}