fix: assemble UniDesk SSH endpoint env

scripts/src/gitops-render.ts

@@ -39,7 +39,13 @@ interface CatalogService {
   provenance?: JsonRecord;
 }
 
+interface EnvVarValue {
+  name: string;
+  value: string;
+}
+
 const defaultBootRepoUrl = "http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/agentrun.git";
+const unideskSshEndpointEnvNames = new Set(["UNIDESK_MAIN_SERVER_IP", "UNIDESK_MAIN_SERVER_HOST", "UNIDESK_FRONTEND_URL"]);
 
 export async function runGitopsRenderCli(argv: string[]): Promise<void> {
   try {
@@ -57,6 +63,7 @@ export async function renderGitops(options: RenderOptions): Promise<JsonRecord>
   const runtimeNamespace = stringField(deploy, "runtimeNamespace", "agentrun-v01");
   const gitopsBranch = stringField(deploy, "gitopsBranch", "v0.1-gitops");
   const runtimePath = stringField(deploy, "runtimePath", "deploy/gitops/g14/runtime-v01");
+  const unideskSshEndpointEnv = optionalUnideskSshEndpointEnv(deploy);
   const catalog = await loadCatalog(options, gitopsBranch);
   const image = imageForService(catalog, "agentrun-mgr", options);
 
@@ -70,9 +77,9 @@ export async function renderGitops(options: RenderOptions): Promise<JsonRecord>
   await writeFile(path.join(options.outDir, "runtime-v01", "kustomization.yaml"), kustomizationYaml());
   await writeFile(path.join(options.outDir, "runtime-v01", "namespace.yaml"), namespaceYaml(runtimeNamespace));
   await writeFile(path.join(options.outDir, "runtime-v01", "postgres.yaml"), postgresYaml(runtimeNamespace));
-  await writeFile(path.join(options.outDir, "runtime-v01", "mgr.yaml"), managerYaml(runtimeNamespace, image, options.sourceCommit));
+  await writeFile(path.join(options.outDir, "runtime-v01", "mgr.yaml"), managerYaml(runtimeNamespace, image, options.sourceCommit, unideskSshEndpointEnv));
   await writeFile(path.join(options.outDir, "runtime-v01", "runner-rbac.yaml"), runnerRbacYaml(runtimeNamespace));
-  return { outDir: options.outDir, runtimeNamespace, gitopsBranch, runtimePath, image: repositoryDigestForService(image), sourceCommit: options.sourceCommit, envIdentity: image.envIdentity ?? null, artifactStatus: image.status ?? null };
+  return { outDir: options.outDir, runtimeNamespace, gitopsBranch, runtimePath, image: repositoryDigestForService(image), sourceCommit: options.sourceCommit, envIdentity: image.envIdentity ?? null, artifactStatus: image.status ?? null, unideskSshEndpointEnv: unideskSshEndpointEnv ? { name: unideskSshEndpointEnv.name, valuesPrinted: false } : null };
 }
 
 async function loadCatalog(options: RenderOptions, gitopsBranch: string): Promise<ArtifactCatalog> {
@@ -239,9 +246,10 @@ spec:
 `;
 }
 
-function managerYaml(namespace: string, image: CatalogService, sourceCommit: string): string {
+function managerYaml(namespace: string, image: CatalogService, sourceCommit: string, unideskSshEndpointEnv: EnvVarValue | null): string {
   const imageRef = repositoryDigestForService(image);
   const envIdentity = image.envIdentity ?? image.imageTag ?? "unknown";
+  const unideskSshEndpointEnvYaml = unideskSshEndpointEnv ? `            - name: ${unideskSshEndpointEnv.name}\n              value: ${JSON.stringify(unideskSshEndpointEnv.value)}\n` : "";
   return `apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -314,6 +322,7 @@ spec:
               value: ${JSON.stringify(imageRef)}
             - name: AGENTRUN_RUNNER_SERVICE_ACCOUNT
               value: "agentrun-v01-runner"
+${unideskSshEndpointEnvYaml}
           readinessProbe:
             httpGet:
               path: /health/readiness
@@ -456,3 +465,15 @@ function stringField(record: JsonRecord, key: string, fallback: string): string
   const value = record[key];
   return typeof value === "string" && value.length > 0 ? value : fallback;
 }
+
+function optionalUnideskSshEndpointEnv(deploy: JsonRecord): EnvVarValue | null {
+  const value = deploy.unideskSshEndpointEnv;
+  if (value === undefined) return null;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new AgentRunError("schema-invalid", "unideskSshEndpointEnv must be an object", { httpStatus: 2 });
+  const record = value as JsonRecord;
+  const name = record.name;
+  const envValue = record.value;
+  if (typeof name !== "string" || !unideskSshEndpointEnvNames.has(name)) throw new AgentRunError("schema-invalid", "unideskSshEndpointEnv.name must be UNIDESK_MAIN_SERVER_IP, UNIDESK_MAIN_SERVER_HOST, or UNIDESK_FRONTEND_URL", { httpStatus: 2 });
+  if (typeof envValue !== "string" || envValue.length === 0) throw new AgentRunError("schema-invalid", "unideskSshEndpointEnv.value must be a non-empty string", { httpStatus: 2 });
+  return { name, value: envValue };
+}