From 475cdc2c2c4cfc0a8363aa4e3680a8f212c0b604 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Sun, 6 Sep 2026 09:01:18 +0800
Subject: [PATCH] fix(deploy): prefix vendor image tag options with the GHCR
 repo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

resolve_vendor_image_tags only resolves bare tags (e.g. "0.9.0-claude") —
it just confirms a tag exists on GHCR, it has no opinion on registry/repo.
The Stable/Beta <select> in deploy.ts used that bare tag directly as its
option value, and deploy_provision_agent/build_default_k8s_manifest write
whatever `image` the panel sends straight into the ECS task def / pod spec
with no normalization. So picking Stable/Beta (anything but Custom) sent a
bare tag as the image, which kubelet/ECS resolve against Docker Hub's
`library/<tag>` instead of GHCR — ImagePullBackOff, "repository does not
exist or may require 'docker login'".

Build the full `ghcr.io/openabdev/openab:<tag>` ref once in deploy.ts
before it ever leaves the panel; labels keep showing the short tag.

Co-authored-by: Orca (ecs-claude) <orca@openab.dev>
---
 console/src/deploy.ts | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index 8e2b56e..7d99910 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -73,6 +73,16 @@ interface VendorImageTagsResponse {
 // be completed from this wizard, has to happen after the agent is up.
 const DEVICE_AUTH_VENDORS = new Set(["codex", "kiro"]);
 
+// `resolve_vendor_image_tags` (vendor_images.rs) only resolves bare GHCR
+// tags (e.g. "0.9.0-claude") — it has no opinion on registry/repo, it's
+// just answering "does this tag exist". `deploy_provision_agent`/k8s's
+// `build_default_k8s_manifest` write whatever `image` this panel sends
+// straight into the ECS task def / pod spec with no normalization, so a
+// bare tag becomes a literal image *name* to the container runtime —
+// Docker Hub's `library/<tag>` — not a GHCR pull. Full ref has to be
+// built here, once, before it ever leaves this panel.
+const IMAGE_REPO = "ghcr.io/openabdev/openab";
+
 // studio#128: pre-fills the Agent name field; still freely editable.
 const GREEK_GODS = [
   "Zeus", "Hera", "Poseidon", "Demeter", "Athena", "Apollo", "Artemis", "Ares",
@@ -258,8 +268,9 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   const IMAGE_CUSTOM_SENTINEL = "__custom__";
 
   // studio#136: which value is actually in play — a resolved Stable/Beta
-  // <option> (its value is the real image tag directly) or the free-text
-  // Custom field.
+  // <option> (its value is already the full `ghcr.io/...` ref, built in
+  // `loadVendorImage` below) or the free-text Custom field, where the user
+  // is expected to type the full ref themselves.
   const currentImage = (): string =>
     imageSelectEl.value === IMAGE_CUSTOM_SENTINEL ? imageCustomInput.value.trim() : imageSelectEl.value;
 
@@ -282,8 +293,11 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     if (invoke) {
       try {
         const res = await invoke<VendorImageTagsResponse>("resolve_vendor_image_tags", { vendor });
-        if (res.stable) opts.push({ value: res.stable, label: `Stable (${res.stable})` });
-        if (res.beta) opts.push({ value: res.beta, label: `Beta (${res.beta})` });
+        // `res.stable`/`res.beta` are bare tags (see IMAGE_REPO above) —
+        // the label keeps the short tag for readability, the value carries
+        // the full ref that actually gets pulled.
+        if (res.stable) opts.push({ value: `${IMAGE_REPO}:${res.stable}`, label: `Stable (${res.stable})` });
+        if (res.beta) opts.push({ value: `${IMAGE_REPO}:${res.beta}`, label: `Beta (${res.beta})` });
       } catch (e) {
         setStatus(deployStatusEl, `image tag lookup unavailable: ${errText(e)}`, "err");
       }