From ee0a3813e325b233d6a00ed9bee0a1997de081a8 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Tue, 8 Sep 2026 21:18:58 +0800
Subject: [PATCH 1/2] fix(console): pin Beta channel to a versioned release,
 default ACP deploys to it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

resolve_vendor_image_tags's "Beta" resolved to the rolling pre-beta-<vendor>
moving tag, and the wizard's Image tag select had no link to the ACP
checkbox at all — picking the implicit default (Stable) with ACP on
silently sent whatever Stable currently resolves to. Stable is pinned to
0.9.0 right now (no 0.10.0 GA has cut yet), which predates ACP being wired
as a first-class adapter (openab#1418, first in 0.10.0-beta.2) — so that
combination reproduces the exact "no adapter configured" crash currently
hitting Nike.

Beta now resolves to the newest beta-named release (<version>-beta.N)
confirmed to have a matching GHCR image, same verify-don't-infer pattern
Stable already used, instead of a tag with no version number to reason
about. The console defaults the Image tag select to Beta the moment ACP is
checked, and re-applies that on every ACP toggle.
---
 console/src/deploy.ts              |  24 +++++-
 crates/oab-mcp/src/lib.rs          |   2 +-
 crates/oabctl/src/vendor_images.rs | 130 ++++++++++++++++++++++-------
 3 files changed, 125 insertions(+), 31 deletions(-)

diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index 6e27ebc..2bf5eed 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -281,6 +281,20 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     if (isCustom) imageCustomInput.focus();
   };
 
+  // studio#153: ACP-enabled deploys need an image with ACP wired as a
+  // first-class adapter (openab#1418, first shipped in 0.10.0-beta.2) —
+  // Stable can lag behind that fix for a long stretch (it did: Stable was
+  // pinned to 0.9.0, which predates the fix entirely, and picking it for an
+  // ACP-enabled agent reproduces the exact "no adapter configured" crash
+  // this was written to catch). ACP-on should not silently inherit the
+  // select's implicit first-option default. Only nudges *into* Beta the
+  // moment ACP is turned on; never fights a selection made afterward.
+  const preferBetaForAcp = (): void => {
+    if (!acpCheckbox.checked) return;
+    const betaOption = Array.from(imageSelectEl.options).find((o) => o.textContent?.startsWith("Beta"));
+    if (betaOption) imageSelectEl.value = betaOption.value;
+  };
+
   // studio#128/#136: a real <select> of GHCR's actually-published tags for
   // the selected vendor (Stable/Beta, whichever resolved) plus a "Custom…"
   // escape hatch — rebuilding the option list on every vendor change (not
@@ -313,7 +327,9 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     }
     // No selected-attribute set above, so the browser defaults to the first
     // option — Stable if it resolved, else Beta, else Custom (never stuck
-    // on a meaningless blank selection).
+    // on a meaningless blank selection) — unless ACP is already on, in
+    // which case preferBetaForAcp overrides that default (see its comment).
+    preferBetaForAcp();
     applyImageMode();
   };
 
@@ -480,7 +496,11 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   });
   imageSelectEl.addEventListener("change", applyImageMode);
   chatPlatformSel.addEventListener("change", applyChatPlatformMode);
-  acpCheckbox.addEventListener("change", applyAcpMode);
+  acpCheckbox.addEventListener("change", () => {
+    applyAcpMode();
+    preferBetaForAcp();
+    applyImageMode();
+  });
   acpTokenGenerateBtn.addEventListener("click", () => {
     // Same shape the sidecar generates itself (uuid v4) when this field is
     // left blank — a convenience for operators who want to know the token
diff --git a/crates/oab-mcp/src/lib.rs b/crates/oab-mcp/src/lib.rs
index 132ff02..bf9b5fa 100644
--- a/crates/oab-mcp/src/lib.rs
+++ b/crates/oab-mcp/src/lib.rs
@@ -253,7 +253,7 @@ pub fn tools() -> Vec<Tool> {
         ),
         Tool::new(
             "resolve_vendor_image_tags",
-            "Resolve a vendor's real, currently-published Stable/Beta image tags on ghcr.io/openabdev/openab (studio#128 — backs the New Fleet wizard's Vendor + Image tag fields). \"Beta\" is the hourly rolling pre-beta-<vendor> build; \"Stable\" is the newest openab release whose matching <version>-<vendor> image is confirmed to actually exist (a release existing doesn't guarantee a matching image was ever built — the build workflow is a manual, disconnected step). Anonymous GHCR/GitHub access, no auth needed (public package/repo). Either or both fields come back null if nothing verified — not an error; the caller should fall back to a plain editable text field.",
+            "Resolve a vendor's real, currently-published Stable/Beta image tags on ghcr.io/openabdev/openab (studio#128 — backs the New Fleet wizard's Vendor + Image tag fields). Both are pinned <version>-<vendor> tags, never a rolling moving tag: \"Beta\" is the newest beta-named openab release (<version>-beta.N) whose matching <version>-beta.N-<vendor> image is confirmed to actually exist; \"Stable\" is the newest non-beta release whose matching <version>-<vendor> image is confirmed to actually exist (a release existing doesn't guarantee a matching image was ever built — the build workflow is a manual, disconnected step). Anonymous GHCR/GitHub access, no auth needed (public package/repo). Either or both fields come back null if nothing verified — not an error; the caller should fall back to a plain editable text field.",
             as_map(json!({
                 "type": "object",
                 "properties": {
diff --git a/crates/oabctl/src/vendor_images.rs b/crates/oabctl/src/vendor_images.rs
index 2d8ff50..b7a9f67 100644
--- a/crates/oabctl/src/vendor_images.rs
+++ b/crates/oabctl/src/vendor_images.rs
@@ -1,15 +1,19 @@
 //! Vendor image tag resolution (studio#128): resolves a vendor name (e.g.
 //! `claude`, `codex`, `cursor`, `kiro`, `antigravity`) to real,
 //! currently-published `ghcr.io/openabdev/openab` image tags — "Beta" (the
-//! hourly rolling `pre-beta-<vendor>` build) and "Stable" (the newest
-//! openab release whose matching `<version>-<vendor>` image is confirmed to
-//! actually exist).
+//! newest beta-named openab release, `<version>-beta.N`, whose matching
+//! `<version>-beta.N-<vendor>` image is confirmed to exist) and "Stable"
+//! (the newest non-beta release whose matching `<version>-<vendor>` image
+//! is confirmed to exist). Both are pinned version tags, never the rolling
+//! `pre-beta-<vendor>`/`nightly-<vendor>` moving tags — a caller (or a
+//! human reading the dropdown) needs an actual version number to reason
+//! about "is this new enough for fix X", which a moving tag can't answer.
 //!
 //! A GitHub release tag existing does **not** guarantee a matching image
 //! was ever published: the image-build workflow (`build-images.yml`) is a
 //! manual `workflow_dispatch` step, completely disconnected from cutting a
-//! release — confirmed by reading both workflows. So "stable" has to be
-//! verified against GHCR directly, not inferred from the release list
+//! release — confirmed by reading both workflows. So both channels have to
+//! be verified against GHCR directly, not inferred from the release list
 //! alone.
 //!
 //! All access here is anonymous — no GitHub token needed. `ghcr.io` speaks
@@ -72,13 +76,13 @@ struct GhRelease {
     prerelease: bool,
 }
 
-/// Real (non-beta) openab release version numbers, newest first — matches
-/// GitHub's own default ordering for this endpoint. Filters on both the
-/// `prerelease` flag *and* the tag name itself: at least one real release
-/// (`openab-0.10.0-beta.3`) has `prerelease: false` despite its name, so
-/// the flag alone isn't reliable.
-async fn openab_release_versions(client: &reqwest::Client) -> Result<Vec<String>> {
-    let releases: Vec<GhRelease> = client
+/// One GitHub API call, split into the two channels `resolve_vendor_image_tags`
+/// walks — newest first in both, matching GitHub's own default ordering for
+/// this endpoint. `prerelease` alone isn't a reliable channel signal (at
+/// least one real release, `openab-0.10.0-beta.3`, has `prerelease: false`
+/// despite its name) — the tag name itself decides stable vs. beta.
+async fn fetch_openab_releases(client: &reqwest::Client) -> Result<Vec<GhRelease>> {
+    client
         .get("https://api.github.com/repos/openabdev/openab/releases")
         // GitHub's REST API rejects requests with no User-Agent.
         .header("User-Agent", "openab-studio")
@@ -89,19 +93,40 @@ async fn openab_release_versions(client: &reqwest::Client) -> Result<Vec<String>
         .context("GitHub releases API returned an error")?
         .json()
         .await
-        .context("GitHub releases API returned invalid JSON")?;
-    Ok(releases
-        .into_iter()
+        .context("GitHub releases API returned invalid JSON")
+}
+
+/// Real (non-beta) openab release version numbers, newest first.
+fn stable_release_versions(releases: &[GhRelease]) -> Vec<String> {
+    releases
+        .iter()
         .filter(|r| !r.prerelease && r.tag_name.starts_with("openab-") && !r.tag_name.contains("-beta"))
         .map(|r| r.tag_name.trim_start_matches("openab-").to_string())
-        .collect())
+        .collect()
+}
+
+/// Beta-named openab release version numbers (`<version>-beta.N`), newest
+/// first — same "trust the tag name, not the `prerelease` flag" reasoning
+/// as `stable_release_versions`.
+fn beta_release_versions(releases: &[GhRelease]) -> Vec<String> {
+    releases
+        .iter()
+        .filter(|r| r.tag_name.starts_with("openab-") && r.tag_name.contains("-beta"))
+        .map(|r| r.tag_name.trim_start_matches("openab-").to_string())
+        .collect()
 }
 
 #[derive(Debug, Clone, Default, Serialize)]
 pub struct VendorImageTags {
-    /// `pre-beta-<vendor>` if the GHCR check confirms it exists.
+    /// The newest beta release version (`<version>-beta.N`) whose
+    /// `<version>-beta.N-<vendor>` image is confirmed to exist on GHCR.
+    /// Pinned, not the old rolling `pre-beta-<vendor>` moving tag — a
+    /// caller needs a version number to reason about (e.g. "is this
+    /// build new enough for fix X"), which a moving tag can't give.
+    /// `None` if no beta release has a matching image yet (or the
+    /// GitHub/GHCR calls themselves failed).
     pub beta: Option<String>,
-    /// The newest release version whose `<version>-<vendor>` image is
+    /// The newest stable release version whose `<version>-<vendor>` image is
     /// confirmed to exist on GHCR. `None` if no release has a matching
     /// image yet (or the GitHub/GHCR calls themselves failed).
     pub stable: Option<String>,
@@ -120,20 +145,69 @@ pub async fn resolve_vendor_image_tags(vendor: &str) -> VendorImageTags {
         return out;
     };
 
-    let beta_tag = format!("pre-beta-{vendor}");
-    if ghcr_tag_exists(&client, &token, &beta_tag).await.unwrap_or(false) {
-        out.beta = Some(beta_tag);
+    let Ok(releases) = fetch_openab_releases(&client).await else {
+        return out;
+    };
+
+    for version in beta_release_versions(&releases) {
+        let candidate = format!("{version}-{vendor}");
+        if ghcr_tag_exists(&client, &token, &candidate).await.unwrap_or(false) {
+            out.beta = Some(candidate);
+            break;
+        }
     }
 
-    if let Ok(versions) = openab_release_versions(&client).await {
-        for version in versions {
-            let candidate = format!("{version}-{vendor}");
-            if ghcr_tag_exists(&client, &token, &candidate).await.unwrap_or(false) {
-                out.stable = Some(candidate);
-                break;
-            }
+    for version in stable_release_versions(&releases) {
+        let candidate = format!("{version}-{vendor}");
+        if ghcr_tag_exists(&client, &token, &candidate).await.unwrap_or(false) {
+            out.stable = Some(candidate);
+            break;
         }
     }
 
     out
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn release(tag_name: &str, prerelease: bool) -> GhRelease {
+        GhRelease { tag_name: tag_name.to_string(), prerelease }
+    }
+
+    // Real-world snapshot (2026-09-08, `gh api repos/openabdev/openab/releases`):
+    // newest-first, mixes stable/beta/unrelated tags, and includes the
+    // `prerelease: false` beta release that makes the flag alone unreliable.
+    fn sample_releases() -> Vec<GhRelease> {
+        vec![
+            release("oabctl-pre-beta", true),
+            release("openab-0.10.0-beta.3", false),
+            release("openab-0.10.0-beta.2", false),
+            release("openab-0.10.0-beta.1", false),
+            release("openab-0.9.0", false),
+            release("openab-0.9.0-beta.12", false),
+            release("pre-seed-utils-v2.35.13-ghp0.3.2", false),
+        ]
+    }
+
+    #[test]
+    fn stable_versions_excludes_beta_and_unrelated_tags() {
+        assert_eq!(stable_release_versions(&sample_releases()), vec!["0.9.0"]);
+    }
+
+    #[test]
+    fn beta_versions_newest_first_ignores_prerelease_flag() {
+        assert_eq!(
+            beta_release_versions(&sample_releases()),
+            vec!["0.10.0-beta.3", "0.10.0-beta.2", "0.10.0-beta.1", "0.9.0-beta.12"]
+        );
+    }
+
+    #[test]
+    fn both_channels_ignore_non_openab_prefixed_releases() {
+        let releases = vec![release("oabctl-pre-beta", true), release("pre-seed-utils-v2.35.13-ghp0.3.2", false)];
+        assert!(stable_release_versions(&releases).is_empty());
+        assert!(beta_release_versions(&releases).is_empty());
+    }
+}

From 21843a89b9044c3dbbd1f81c5f25dc7766fb9af5 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Tue, 8 Sep 2026 21:23:17 +0800
Subject: [PATCH 2/2] fix(console): wire Add-instance for an existing k8s fleet
 instead of blocking it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

studio#152 blocked Add-instance on a k8s fleet to stop it from silently
deploying an ECS service (deploy.ts's compose step assumed ECS whenever it
wasn't in "new-fleet" mode, since the k8s identity step is skipped for
add-instance). That traded a silent wrong-provider deploy for a dead end:
there was no way to add an instance to an existing k8s fleet at all.

DeployMode's add-instance variant now carries the target fleet's existing
runtime/context/namespace/expected_principal (main.ts already has this on
hand from FleetConfigEntry — the fleet the operator drilled into). A new
currentK8sTarget() helper in deploy.ts is the single place that decides
whether a submit targets k8s and with what context/namespace/service
account: new-fleet reads it live off the identity step's fields (the only
mode with that step), add-instance reads it off the fleet's existing
binding. No new identity step needed for add-instance — a k8s fleet's
placement was fixed at creation, this wizard never re-asks for it.

deploy_provision_agent/provision_agent_k8s already rebuild the manifest
fresh on every call regardless of whether the fleet is new, so this is a
pure console-side wiring fix — no backend change needed.
---
 console/src/deploy.ts | 88 +++++++++++++++++++++++++++++++------------
 console/src/main.ts   | 33 ++++++++--------
 2 files changed, 80 insertions(+), 41 deletions(-)

diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index 2bf5eed..7d2d6b9 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -92,7 +92,23 @@ function randomGreekName(): string {
   return GREEK_GODS[Math.floor(Math.random() * GREEK_GODS.length)];
 }
 
-export type DeployMode = { kind: "new-fleet" } | { kind: "add-instance"; fleetName: string };
+// studio#153: "add-instance" now carries the target fleet's existing
+// runtime binding (read once, by the caller, from `FleetConfigEntry` —
+// `main.ts` already has it in hand from the fleet the operator drilled
+// into) instead of assuming ECS. This wizard has no k8s identity step for
+// "add-instance" (that only exists for "new-fleet"), so there's nothing to
+// re-collect from the operator — a k8s fleet's context/namespace/service
+// account were fixed the moment the fleet was created.
+export type DeployMode =
+  | { kind: "new-fleet" }
+  | {
+      kind: "add-instance";
+      fleetName: string;
+      runtime: "ecs" | "k8s";
+      context: string | null;
+      namespace: string | null;
+      expectedPrincipal: string | null;
+    };
 
 // What the panel reports back once a deploy + fleets.toml write both succeed —
 // enough for the caller (`main.ts`) to log it and re-derive screen state
@@ -365,15 +381,42 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
       ? k8sNamespaceNewInput.value.trim()
       : k8sNamespaceSel.value;
 
+  // studio#153: the single source of truth for "is this submit targeting
+  // k8s, and with what context/namespace/service-account" — "new-fleet"
+  // reads it live off the identity step's fields (the only mode with that
+  // step); "add-instance" reads it off the fleet binding `open()` was given
+  // (see the `DeployMode` comment), since that fleet's k8s placement was
+  // fixed at creation and this wizard never re-asks for it. `null` means
+  // "not a k8s deploy" (ecs, or a new-fleet submit with Provider left on
+  // "aws").
+  const currentK8sTarget = (): { context?: string; namespace: string; expectedPrincipal?: string } | null => {
+    if (mode?.kind === "new-fleet") {
+      if (providerSel.value !== "k8s") return null;
+      const namespace = currentNamespace() || "default";
+      const serviceAccount = k8sServiceAccountSel.value;
+      return {
+        context: k8sContextSel.value || undefined,
+        namespace,
+        expectedPrincipal: serviceAccount ? `system:serviceaccount:${namespace}:${serviceAccount}` : undefined,
+      };
+    }
+    if (mode?.kind === "add-instance") {
+      if (mode.runtime !== "k8s") return null;
+      return {
+        context: mode.context ?? undefined,
+        namespace: mode.namespace ?? "default",
+        expectedPrincipal: mode.expectedPrincipal ?? undefined,
+      };
+    }
+    return null;
+  };
+
   // The `oab-${namespace}-${name}` service-name convention (mirrored from the
   // deploy submit handler below) was previously discoverable only by reading
   // source — nothing in the wizard showed what actually lands in fleets.toml's
-  // `members` array (Brett, 2026-09-07). "add-instance" into an existing k8s
-  // fleet isn't wired through this wizard yet (see the isK8s check below), so
-  // it's always the ecs/"default" namespace outside "new-fleet" + k8s.
+  // `members` array (Brett, 2026-09-07).
   const updateNamePreview = (): void => {
-    const isK8s = mode?.kind === "new-fleet" && providerSel.value === "k8s";
-    const namespace = isK8s ? currentNamespace() || "default" : "default";
+    const namespace = currentK8sTarget()?.namespace ?? "default";
     const name = agentNameInput.value.trim() || "<name>";
     agentNamePreviewEl.textContent = `→ recorded in fleets.toml as oab-${namespace}-${name}`;
   };
@@ -554,9 +597,8 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     // appendFleetBlock always appends a brand-new `[fleet.<name>]` block, so
     // reusing an existing name would otherwise only surface as a
     // duplicate-key TOML parse error *after* the instance was already
-    // deployed (it has no partial/merge fallback; "add instance to an
-    // existing k8s fleet" isn't wired through this wizard yet either — see
-    // the isK8s check in the deploy submit handler below).
+    // deployed (it has no partial/merge fallback — use "Add instance" on
+    // that fleet instead, per the error message below).
     try {
       const current = await deps.source.fleetConfig();
       if (fleetBlockExists(current.text, fleetName)) {
@@ -595,22 +637,18 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
       setStatus(deployStatusEl, "image tag is required", "err");
       return;
     }
-    // Only "new-fleet" ever reaches provider "k8s" — identityForm (where the
-    // provider <select> lives) is skipped for "add-instance", and reset()
-    // (run on every open()) puts the <select> back to its "aws" default, so
-    // an add-instance submit always sees "aws" here regardless of the fleet
-    // it's adding to. Adding an instance to an *existing* k8s fleet isn't
-    // wired through this wizard yet.
-    const isK8s = mode.kind === "new-fleet" && providerSel.value === "k8s";
-    const namespace = isK8s ? currentNamespace() || "default" : "default";
-    const context = isK8s ? k8sContextSel.value || undefined : undefined;
-    const serviceAccount = isK8s ? k8sServiceAccountSel.value : "";
-    // studio-cp's provision_agent_k8s expects the full
-    // `system:serviceaccount:<ns>:<name>` form (it extracts the bare name
-    // itself) — same shape as K8sFleetBinding.expected_principal.
-    const expectedPrincipal = serviceAccount
-      ? `system:serviceaccount:${namespace}:${serviceAccount}`
-      : undefined;
+    // studio#153: "new-fleet" reads this live off the identity step;
+    // "add-instance" reads it off the existing fleet's binding — either way
+    // `currentK8sTarget()` is the single place that decides it (see its
+    // comment). `expectedPrincipal` here is already in
+    // `system:serviceaccount:<ns>:<name>` form either way — `new-fleet`
+    // builds it fresh from the service-account picker, `add-instance`
+    // inherits it as-is from `K8sFleetBinding.expected_principal`.
+    const k8sTarget = currentK8sTarget();
+    const isK8s = k8sTarget !== null;
+    const namespace = k8sTarget?.namespace ?? "default";
+    const context = k8sTarget?.context;
+    const expectedPrincipal = k8sTarget?.expectedPrincipal;
     const chatPlatform = chatPlatformSel.value || undefined;
     // k8s deploys refuse a chat platform server-side (config.toml secret
     // resolution needs AWS credentials a k8s pod doesn't have) — check here
diff --git a/console/src/main.ts b/console/src/main.ts
index 3067be7..e828bb3 100644
--- a/console/src/main.ts
+++ b/console/src/main.ts
@@ -722,23 +722,24 @@ if (fleetDetailEl) {
       return;
     }
     if (target.closest('[data-action="add-instance"]') && activeFleet) {
-      // studio#146 final-review pass: now that a k8s fleet can actually be
-      // drilled into, this button became reachable for one — but
-      // `deploy.ts`'s compose step assumes ECS whenever it isn't in
-      // "new-fleet" mode (the provider <select> only lives in the identity
-      // step, skipped for "add instance"), so submitting here would silently
-      // deploy an ECS service into a k8s fleet instead of erroring. Block it
-      // with the same clear-message pattern the wizard already uses for its
-      // own not-yet-supported k8s-provider case, rather than let that happen.
+      // studio#153: the k8s block studio#146's final-review pass added here
+      // is gone — `deploy.ts`'s submit handler now reads the target fleet's
+      // runtime/context/namespace/expected_principal straight off
+      // `FleetConfigEntry` (this lookup) instead of assuming ECS, so an
+      // "add instance" submit against a k8s fleet provisions into that
+      // fleet's actual context/namespace rather than silently targeting
+      // ECS. `fleet` should always resolve here (the operator already
+      // drilled into this fleet to see the button); fall back to "ecs" only
+      // to keep the type checker happy, not because it's an expected case.
       const fleet = fleetConfig?.fleets.find((f) => f.name === activeFleet);
-      if (fleet?.runtime === "k8s") {
-        note(
-          "info",
-          `fleet "${activeFleet}" is a k8s fleet — adding an instance to an existing k8s fleet isn't supported yet`,
-        );
-        return;
-      }
-      deployPanel?.open({ kind: "add-instance", fleetName: activeFleet });
+      deployPanel?.open({
+        kind: "add-instance",
+        fleetName: activeFleet,
+        runtime: fleet?.runtime ?? "ecs",
+        context: fleet?.context ?? null,
+        namespace: fleet?.namespace ?? null,
+        expectedPrincipal: fleet?.expected_principal ?? null,
+      });
       return;
     }
     if (target.closest('[data-action="fleet-debug"]') && activeFleet) {