chore: pin dev frontend auth fix

2026-05-18 13:06:14 +00:00
parent c09beb0d54
commit 0c0c979a56
12 changed files with 993 additions and 160 deletions
@@ -535,7 +535,17 @@ function promptLineCount(text: string): number {
  return text.length > 0 ? text.split(/\r\n|\r|\n/u).length : 0;
 }

-function taskDisplayPrompt(task: any): string {
+function previewTextField(value: any): string {
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object" && !Array.isArray(value) && typeof value.text === "string") return value.text;
+  return "";
+}
+
+function taskDisplayPrompt(task: any, options: AnyRecord = {}): string {
+  if (options.preview === true) {
+    const preview = previewTextField(task?.displayPromptPreview || task?.basePromptPreview || task?.promptPreview);
+    if (preview.length > 0) return preview;
+  }
  const explicit = String(task?.displayPrompt || "");
  if (explicit.length > 0) return explicit;
  const prompt = String(task?.prompt || "");
@@ -640,7 +650,9 @@ function traceSummaryIsCurrent(task: any): boolean {
 function taskBasePromptText(task: any): string {
  const summaryPrompt = taskPromptSummary(task);
  const basePrompt = String(summaryPrompt.basePrompt || "");
-  return basePrompt.length > 0 ? basePrompt : taskDisplayPrompt(task);
+  if (basePrompt.length > 0) return basePrompt;
+  const direct = String(task?.basePrompt || "");
+  return direct.length > 0 ? direct : taskDisplayPrompt(task);
 }

 function taskFinalResponseText(task: any): string {
@@ -1473,7 +1485,7 @@ function TaskCard({ task, selected, onSelect, onCopy, onReference, onMarkRead, c
        }, markingRead ? "标记中" : "标为已读") : null,
      ),
    ),
-    h("strong", null, shortText(taskDisplayPrompt(task), 120) || "空任务"),
+    h("strong", null, shortText(taskDisplayPrompt(task, { preview: true }), 120) || "空任务"),
    h("div", { className: "codex-task-meta" },
      h("span", null, `queue=${taskQueueLabel(task)}`),
      h("span", null, `provider=${task?.providerId || "D601"}`),
@@ -2229,6 +2241,9 @@ export function CodeQueuePage({ microservices, onRaw, apiBaseUrl = "/api", initi
      task?.providerId,
      task?.model,
      task?.cwd,
+      previewTextField(task?.displayPromptPreview),
+      previewTextField(task?.basePromptPreview),
+      previewTextField(task?.promptPreview),
      task?.displayPrompt,
      task?.basePrompt,
      task?.prompt,
@@ -497,16 +497,6 @@ fn preview(text: &str, max_chars: usize) -> String {
    result
 }

-fn prefix_preview(text: &str, max_chars: usize) -> String {
-    if text.chars().count() <= max_chars {
-        return text.to_string();
-    }
-    let take = max_chars.saturating_sub(1);
-    let mut result = text.chars().take(take).collect::<String>();
-    result.push('…');
-    result
-}
-
 fn strip_after_marker(text: &str, marker: &str) -> Option<String> {
    text.find(marker).map(|index| text[index + marker.len()..].trim_start().to_string())
 }
@@ -611,6 +601,17 @@ fn final_response(task: &TaskMeta) -> String {
        .to_string()
 }

+fn text_preview(value: &str, max_chars: usize) -> Value {
+    let chars = value.chars().count();
+    let truncated = chars > max_chars;
+    json!({
+        "text": if truncated { preview(value, max_chars) } else { value.to_string() },
+        "chars": chars,
+        "truncated": truncated,
+        "omittedChars": if truncated { chars.saturating_sub(max_chars.saturating_sub(20)) } else { 0 }
+    })
+}
+
 fn text_from_output(item: &Value) -> String {
    item.get("text").and_then(Value::as_str).unwrap_or("").to_string()
 }
@@ -664,13 +665,17 @@ fn task_list_response(_state: &AppState, task: &TaskMeta, lite: bool) -> Value {
    };
    let final_text = final_response(task);
    let agent_port = code_agent_port(&task.model);
+    let preview_limit = if lite { 360 } else { 2000 };
    json!({
        "id": task.id,
        "queueId": task.queue_id,
        "queueEnteredAt": task.task_json.as_ref().and_then(|value| value.get("queueEnteredAt")).and_then(Value::as_str).unwrap_or(&task.created_at),
-        "prompt": if lite { prefix_preview(&display_prompt, 360) } else { preview(&task.prompt, 2000) },
-        "basePrompt": if lite { prefix_preview(&task.base_prompt, 360) } else { preview(&task.base_prompt, 2000) },
-        "displayPrompt": if lite { prefix_preview(&display_prompt, 360) } else { preview(&display_prompt, 2000) },
+        "prompt": task.prompt,
+        "basePrompt": task.base_prompt,
+        "displayPrompt": display_prompt,
+        "promptPreview": text_preview(&task.prompt, preview_limit),
+        "basePromptPreview": text_preview(&task.base_prompt, preview_limit),
+        "displayPromptPreview": text_preview(&display_prompt, preview_limit),
        "promptChars": task.prompt.chars().count(),
        "basePromptChars": task.base_prompt.chars().count(),
        "displayPromptChars": display_prompt.chars().count(),
@@ -729,8 +734,15 @@ fn task_meta_response(state: &AppState, task: &TaskMeta) -> Value {
    let map = base.as_object_mut().expect("task response object");
    let output_count = json_array_len(task.task_json.as_ref(), "output", task.output_count);
    let prompt_history_count = json_array_len(task.task_json.as_ref(), "promptHistory", 0);
+    let display_prompt = if task.base_prompt.is_empty() {
+        user_prompt_for_display(&task.prompt)
+    } else {
+        task.base_prompt.clone()
+    };
    map.insert("prompt".to_string(), json!(task.prompt));
    map.insert("basePrompt".to_string(), json!(task.base_prompt));
+    map.insert("displayPrompt".to_string(), json!(display_prompt));
+    map.insert("initialPrompt".to_string(), json!(task.prompt));
    map.insert("finalResponse".to_string(), json!(final_response(task)));
    map.insert(
        "promptHistory".to_string(),
@@ -1,5 +1,6 @@
 import postgres from "postgres";
 import { createHourlyJsonlWriter, logRetentionBytesForService } from "../../../shared/src/rotating-jsonl";
+import { codeQueuePromptResponseFields, safePreview } from "./prompt-observation";

 type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
 type JsonRecord = Record<string, JsonValue>;
@@ -434,12 +435,6 @@ function timestampMs(value: string | Date | null | undefined): number | null {
  return Number.isFinite(ms) ? ms : null;
 }

-function safePreview(value: unknown, maxChars: number): string {
-  const text = String(value ?? "");
-  if (text.length <= maxChars) return text;
-  return `${text.slice(0, Math.max(0, maxChars - 20))}\n...<truncated>`;
-}
-
 function prefixPreview(value: unknown, maxChars: number): string {
  const text = String(value ?? "");
  return text.length <= maxChars ? text : `${text.slice(0, Math.max(0, maxChars - 1))}…`;
@@ -1635,17 +1630,12 @@ function taskStatisticsSummary(tasks: QueueTask[], days = 14): JsonRecord {
 }

 function taskListResponse(task: QueueTask, lite = true): JsonRecord {
-  const displayPrompt = task.basePrompt || userPromptForDisplay(task.prompt);
+  const promptFields = codeQueuePromptResponseFields(task, { lite, userPromptForDisplay });
  return {
    id: task.id,
    queueId: queueIdOf(task),
    queueEnteredAt: task.queueEnteredAt,
-    prompt: lite ? prefixPreview(displayPrompt, 360) : safePreview(displayPrompt, 2000),
-    basePrompt: lite ? prefixPreview(task.basePrompt, 360) : safePreview(task.basePrompt, 2000),
-    displayPrompt: lite ? prefixPreview(displayPrompt, 360) : safePreview(displayPrompt, 2000),
-    promptChars: task.prompt.length,
-    basePromptChars: task.basePrompt.length,
-    displayPromptChars: displayPrompt.length,
+    ...promptFields,
    promptEditable: queuedTaskPromptEditable(task),
    finalResponseChars: task.finalResponse.length,
    stepCount: numberField(task.stepCount ?? task.llmStepCount, 0),
@@ -1695,6 +1685,8 @@ function taskMetaResponse(task: QueueTask): JsonRecord {
    ...taskListResponse(task, false),
    prompt: task.prompt,
    basePrompt: task.basePrompt,
+    displayPrompt: task.basePrompt || userPromptForDisplay(task.prompt),
+    initialPrompt: task.prompt,
    finalResponse: task.finalResponse,
    promptHistory: toJsonValue(task.promptHistory),
    attempts: toJsonValue(task.attempts),
@@ -88,7 +88,7 @@ rules:
    resources: ["namespaces"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: [""]
-    resources: ["configmaps", "services", "pods", "pods/log"]
+    resources: ["configmaps", "secrets", "services", "services/proxy", "pods", "pods/log"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
@@ -701,6 +701,8 @@ spec:
        backend_commit="$(params.backend-core-commit)"
        frontend_commit="$(params.frontend-commit)"
        code_queue_commit="$(params.code-queue-commit)"
+        app_image="$(params.app-image)"
+        database_url="postgres://unidesk_ci:unidesk_ci_password@postgres-dev.$ns.svc.cluster.local:5432/unidesk_ci"
        kube_api="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}"
        kube_token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
        kube_ca="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
@@ -719,6 +721,48 @@ spec:
          cat /tmp/unidesk-dev-e2e-delete-response >&2
          return 1
        }
+        proxy_get() {
+          local service_name="$1"
+          local path="$2"
+          curl -fsS --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" \
+            "$kube_api/api/v1/namespaces/$ns/services/${service_name}:4222/proxy$path"
+        }
+        proxy_json() {
+          local method="$1"
+          local service_name="$2"
+          local path="$3"
+          local body="${4:-}"
+          if [ -n "$body" ]; then
+            curl -fsS --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" -H "Content-Type: application/json" \
+              -X "$method" --data "$body" \
+              "$kube_api/api/v1/namespaces/$ns/services/${service_name}:4222/proxy$path"
+          else
+            curl -fsS --cacert "$kube_ca" -H "Authorization: Bearer $kube_token" \
+              -X "$method" \
+              "$kube_api/api/v1/namespaces/$ns/services/${service_name}:4222/proxy$path"
+          fi
+        }
+        wait_deployment_available() {
+          local deployment="$1"
+          local timeout_seconds="$2"
+          local deadline=$((SECONDS + timeout_seconds))
+          while [ "$SECONDS" -lt "$deadline" ]; do
+            status="$(kube GET "$kube_api/apis/apps/v1/namespaces/$ns/deployments/$deployment")"
+            replicas="$(printf '%s' "$status" | jq -r '.spec.replicas // 1')"
+            available="$(printf '%s' "$status" | jq -r '.status.availableReplicas // 0')"
+            updated="$(printf '%s' "$status" | jq -r '.status.updatedReplicas // 0')"
+            observed="$(printf '%s' "$status" | jq -r '.status.observedGeneration // 0')"
+            generation="$(printf '%s' "$status" | jq -r '.metadata.generation // 0')"
+            if [ "$available" -ge "$replicas" ] && [ "$updated" -ge "$replicas" ] && [ "$observed" -ge "$generation" ]; then
+              echo "dev_e2e_rollout=available deployment=$deployment namespace=$ns replicas=$available generation=$generation"
+              return 0
+            fi
+            sleep 2
+          done
+          echo "dev_e2e_rollout=timeout deployment=$deployment namespace=$ns" >&2
+          kube GET "$kube_api/apis/apps/v1/namespaces/$ns/deployments/$deployment" >&2
+          return 1
+        }
        cleanup() {
          if [ "$keep" = "true" ]; then
            echo "dev_e2e_namespace_retained=$ns"
@@ -767,162 +811,640 @@ spec:
          --data-binary @/tmp/dev-e2e-configmap.yaml \
          "$kube_api/api/v1/namespaces/$ns/configmaps/desired-manifest?fieldManager=unidesk-ci&force=true" >/dev/null

-        cat >/tmp/dev-e2e-target.yaml <<YAML
+        database_url_b64="$(printf '%s' "$database_url" | base64 -w0)"
+        cat >/tmp/dev-e2e-secret.yaml <<YAML
+        apiVersion: v1
+        kind: Secret
+        metadata:
+          name: code-queue-dev-e2e-env
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: ci-dev-e2e
+            app.kubernetes.io/part-of: unidesk
+        type: Opaque
+        data:
+          DATABASE_URL: "$database_url_b64"
+        YAML
+        kube PATCH \
+          -H "Content-Type: application/apply-patch+yaml" \
+          --data-binary @/tmp/dev-e2e-secret.yaml \
+          "$kube_api/api/v1/namespaces/$ns/secrets/code-queue-dev-e2e-env?fieldManager=unidesk-ci&force=true" >/dev/null
+
+        cat >/tmp/dev-e2e-postgres.yaml <<YAML
        apiVersion: apps/v1
        kind: Deployment
        metadata:
-          name: dev-e2e-target
+          name: postgres-dev
          namespace: $ns
          labels:
-            app.kubernetes.io/name: unidesk-dev-namespace-e2e
-            app.kubernetes.io/component: smoke-target
+            app.kubernetes.io/name: postgres-dev
+            app.kubernetes.io/component: database
            app.kubernetes.io/part-of: unidesk
        spec:
          replicas: 1
          selector:
            matchLabels:
-              app.kubernetes.io/name: unidesk-dev-namespace-e2e
-              app.kubernetes.io/component: smoke-target
+              app.kubernetes.io/name: postgres-dev
+              app.kubernetes.io/component: database
          template:
            metadata:
              labels:
-                app.kubernetes.io/name: unidesk-dev-namespace-e2e
-                app.kubernetes.io/component: smoke-target
+                app.kubernetes.io/name: postgres-dev
+                app.kubernetes.io/component: database
                app.kubernetes.io/part-of: unidesk
            spec:
              nodeSelector:
                unidesk.ai/node-id: D601
              terminationGracePeriodSeconds: 5
              containers:
-                - name: smoke-target
-                  image: "$(params.app-image)"
+                - name: postgres
+                  image: postgres:16-alpine
                  imagePullPolicy: IfNotPresent
-                  command:
-                    - bun
-                    - -e
-                    - |
-                      const port = Number(process.env.PORT || 8080);
-                      const payload = {
-                        ok: true,
-                        environment: "dev",
-                        namespace: process.env.CI_E2E_NAMESPACE,
-                        deployCommit: process.env.CI_E2E_DEPLOY_COMMIT,
-                        backendCoreCommit: process.env.BACKEND_CORE_COMMIT,
-                        frontendCommit: process.env.FRONTEND_COMMIT,
-                        codeQueueCommit: process.env.CODE_QUEUE_COMMIT
-                      };
-                      Bun.serve({
-                        hostname: "0.0.0.0",
-                        port,
-                        fetch(req) {
-                          const url = new URL(req.url);
-                          if (url.pathname === "/health" || url.pathname === "/") {
-                            return Response.json(payload);
-                          }
-                          return new Response("not found", { status: 404 });
-                        }
-                      });
-                      console.log(JSON.stringify({ listening: port, ...payload }));
-                      await new Promise(() => {});
                  ports:
-                    - name: http
-                      containerPort: 8080
+                    - name: postgres
+                      containerPort: 5432
                  env:
-                    - name: PORT
-                      value: "8080"
-                    - name: CI_E2E_NAMESPACE
-                      value: "$ns"
-                    - name: CI_E2E_DEPLOY_COMMIT
-                      value: "$(params.deploy-commit)"
-                    - name: BACKEND_CORE_COMMIT
-                      value: "$backend_commit"
-                    - name: FRONTEND_COMMIT
-                      value: "$frontend_commit"
-                    - name: CODE_QUEUE_COMMIT
-                      value: "$code_queue_commit"
+                    - name: POSTGRES_USER
+                      value: unidesk_ci
+                    - name: POSTGRES_PASSWORD
+                      value: unidesk_ci_password
+                    - name: POSTGRES_DB
+                      value: unidesk_ci
                  readinessProbe:
-                    httpGet:
-                      path: /health
-                      port: http
-                    periodSeconds: 3
-                    timeoutSeconds: 2
-                    failureThreshold: 20
+                    exec:
+                      command:
+                        - pg_isready
+                        - -U
+                        - unidesk_ci
+                        - -d
+                        - unidesk_ci
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 24
                  resources:
                    requests:
-                      cpu: 20m
-                      memory: 64Mi
+                      cpu: 50m
+                      memory: 128Mi
                    limits:
-                      memory: 256Mi
+                      cpu: 250m
+                      memory: 512Mi
+                  volumeMounts:
+                    - name: data
+                      mountPath: /var/lib/postgresql/data
+              volumes:
+                - name: data
+                  emptyDir: {}
        ---
        apiVersion: v1
        kind: Service
        metadata:
-          name: dev-e2e-target
+          name: postgres-dev
          namespace: $ns
          labels:
-            app.kubernetes.io/name: unidesk-dev-namespace-e2e
-            app.kubernetes.io/component: smoke-target
+            app.kubernetes.io/name: postgres-dev
+            app.kubernetes.io/component: database
            app.kubernetes.io/part-of: unidesk
        spec:
          type: ClusterIP
          selector:
-            app.kubernetes.io/name: unidesk-dev-namespace-e2e
-            app.kubernetes.io/component: smoke-target
+            app.kubernetes.io/name: postgres-dev
+            app.kubernetes.io/component: database
+          ports:
+            - name: postgres
+              port: 5432
+              targetPort: postgres
+        YAML
+        csplit -s -f /tmp/dev-e2e-postgres- /tmp/dev-e2e-postgres.yaml '/^---$/' '{*}'
+        kube PATCH \
+          -H "Content-Type: application/apply-patch+yaml" \
+          --data-binary @/tmp/dev-e2e-postgres-00 \
+          "$kube_api/apis/apps/v1/namespaces/$ns/deployments/postgres-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH \
+          -H "Content-Type: application/apply-patch+yaml" \
+          --data-binary @/tmp/dev-e2e-postgres-01 \
+          "$kube_api/api/v1/namespaces/$ns/services/postgres-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        wait_deployment_available postgres-dev 180
+
+        cat >/tmp/dev-e2e-code-queue.yaml <<YAML
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: code-queue-scheduler-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: scheduler
+            app.kubernetes.io/part-of: unidesk
+            unidesk.ai/ci-run-id: "$(params.run-id)"
+            unidesk.ai/deploy-service-id: code-queue
+        spec:
+          replicas: 1
+          strategy:
+            type: Recreate
+          selector:
+            matchLabels:
+              app.kubernetes.io/name: code-queue
+              app.kubernetes.io/component: scheduler
+              unidesk.ai/ci-run-id: "$(params.run-id)"
+          template:
+            metadata:
+              labels:
+                app.kubernetes.io/name: code-queue
+                app.kubernetes.io/component: scheduler
+                app.kubernetes.io/part-of: unidesk
+                unidesk.ai/ci-run-id: "$(params.run-id)"
+                unidesk.ai/node-id: D601
+                unidesk.ai/deploy-service-id: code-queue
+            spec:
+              nodeSelector:
+                unidesk.ai/node-id: D601
+              terminationGracePeriodSeconds: 10
+              containers:
+                - name: code-queue
+                  image: "$app_image"
+                  imagePullPolicy: Never
+                  ports:
+                    - name: http
+                      containerPort: 4222
+                  envFrom:
+                    - secretRef:
+                        name: code-queue-dev-e2e-env
+                  env:
+                    - name: HOST
+                      value: "0.0.0.0"
+                    - name: PORT
+                      value: "4222"
+                    - name: UNIDESK_ENV
+                      value: dev
+                    - name: UNIDESK_NAMESPACE
+                      value: "$ns"
+                    - name: UNIDESK_DATABASE_NAME
+                      value: unidesk_ci
+                    - name: UNIDESK_DEPLOY_REF
+                      value: origin/master:deploy.json#environments.dev
+                    - name: UNIDESK_DEPLOY_SERVICE_ID
+                      value: code-queue
+                    - name: CODE_QUEUE_DEPLOY_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_DEPLOY_REQUESTED_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_INSTANCE_ID
+                      value: D601-dev-ci-scheduler
+                    - name: CODE_QUEUE_SERVICE_ROLE
+                      value: scheduler
+                    - name: CODE_QUEUE_SCHEDULER_ENABLED
+                      value: "true"
+                    - name: CODE_QUEUE_MAX_ACTIVE_QUEUES
+                      value: "0"
+                    - name: CODE_QUEUE_DATABASE_POOL_MAX
+                      value: "2"
+                    - name: CODE_QUEUE_MAIN_PROVIDER_ID
+                      value: D601-dev
+                    - name: CODE_QUEUE_EXECUTION_PROVIDER_IDS
+                      value: D601-dev
+                    - name: CODE_QUEUE_WORKDIR
+                      value: /workspace-dev
+                    - name: CODE_QUEUE_REMOTE_WORKDIR
+                      value: /home/ubuntu/unidesk-dev-workspace
+                    - name: CODE_QUEUE_DATA_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: CODE_QUEUE_CODEX_HOME
+                      value: /var/lib/unidesk-dev-e2e/code-queue/codex-home
+                    - name: CODE_QUEUE_OPENCODE_XDG_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue/opencode-xdg
+                    - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_CODEX_SQLITE_LOG_EXPORT_ENABLED
+                      value: "false"
+                    - name: OA_EVENT_FLOW_BASE_URL
+                      value: http://127.0.0.1:9
+                    - name: LOG_FILE
+                      value: /var/log/unidesk/code-queue-scheduler-dev-e2e.jsonl
+                    - name: NODE_OPTIONS
+                      value: --max-old-space-size=512
+                  readinessProbe:
+                    httpGet:
+                      path: /health
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 24
+                  startupProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 60
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 256Mi
+                    limits:
+                      cpu: 500m
+                      memory: 1Gi
+                  volumeMounts:
+                    - name: state
+                      mountPath: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: logs
+                      mountPath: /var/log/unidesk
+              volumes:
+                - name: state
+                  emptyDir: {}
+                - name: logs
+                  emptyDir: {}
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: code-queue-scheduler-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: scheduler
+            app.kubernetes.io/part-of: unidesk
+        spec:
+          type: ClusterIP
+          selector:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: scheduler
+            unidesk.ai/ci-run-id: "$(params.run-id)"
          ports:
            - name: http
-              port: 8080
+              port: 4222
+              targetPort: http
+        ---
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: code-queue-read-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: read
+            app.kubernetes.io/part-of: unidesk
+            unidesk.ai/ci-run-id: "$(params.run-id)"
+            unidesk.ai/deploy-service-id: code-queue
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app.kubernetes.io/name: code-queue
+              app.kubernetes.io/component: read
+              unidesk.ai/ci-run-id: "$(params.run-id)"
+          template:
+            metadata:
+              labels:
+                app.kubernetes.io/name: code-queue
+                app.kubernetes.io/component: read
+                app.kubernetes.io/part-of: unidesk
+                unidesk.ai/ci-run-id: "$(params.run-id)"
+                unidesk.ai/node-id: D601
+                unidesk.ai/deploy-service-id: code-queue
+            spec:
+              nodeSelector:
+                unidesk.ai/node-id: D601
+              terminationGracePeriodSeconds: 10
+              containers:
+                - name: code-queue
+                  image: "$app_image"
+                  imagePullPolicy: Never
+                  ports:
+                    - name: http
+                      containerPort: 4222
+                  envFrom:
+                    - secretRef:
+                        name: code-queue-dev-e2e-env
+                  env:
+                    - name: HOST
+                      value: "0.0.0.0"
+                    - name: PORT
+                      value: "4222"
+                    - name: UNIDESK_ENV
+                      value: dev
+                    - name: UNIDESK_NAMESPACE
+                      value: "$ns"
+                    - name: UNIDESK_DATABASE_NAME
+                      value: unidesk_ci
+                    - name: UNIDESK_DEPLOY_REF
+                      value: origin/master:deploy.json#environments.dev
+                    - name: UNIDESK_DEPLOY_SERVICE_ID
+                      value: code-queue
+                    - name: CODE_QUEUE_DEPLOY_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_DEPLOY_REQUESTED_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_INSTANCE_ID
+                      value: D601-dev-ci-read
+                    - name: CODE_QUEUE_SERVICE_ROLE
+                      value: read
+                    - name: CODE_QUEUE_SCHEDULER_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_DATABASE_POOL_MAX
+                      value: "2"
+                    - name: CODE_QUEUE_MAIN_PROVIDER_ID
+                      value: D601-dev
+                    - name: CODE_QUEUE_EXECUTION_PROVIDER_IDS
+                      value: D601-dev
+                    - name: CODE_QUEUE_WORKDIR
+                      value: /workspace-dev
+                    - name: CODE_QUEUE_REMOTE_WORKDIR
+                      value: /home/ubuntu/unidesk-dev-workspace
+                    - name: CODE_QUEUE_DATA_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: CODE_QUEUE_CODEX_HOME
+                      value: /var/lib/unidesk-dev-e2e/code-queue/codex-home
+                    - name: CODE_QUEUE_OPENCODE_XDG_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue/opencode-xdg
+                    - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_CODEX_SQLITE_LOG_EXPORT_ENABLED
+                      value: "false"
+                    - name: OA_EVENT_FLOW_BASE_URL
+                      value: http://127.0.0.1:9
+                    - name: LOG_FILE
+                      value: /var/log/unidesk/code-queue-read-dev-e2e.jsonl
+                    - name: NODE_OPTIONS
+                      value: --max-old-space-size=512
+                  readinessProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 24
+                  startupProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 60
+                  resources:
+                    requests:
+                      cpu: 80m
+                      memory: 192Mi
+                    limits:
+                      cpu: 300m
+                      memory: 768Mi
+                  volumeMounts:
+                    - name: state
+                      mountPath: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: logs
+                      mountPath: /var/log/unidesk
+              volumes:
+                - name: state
+                  emptyDir: {}
+                - name: logs
+                  emptyDir: {}
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: code-queue-read-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: read
+            app.kubernetes.io/part-of: unidesk
+        spec:
+          type: ClusterIP
+          selector:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: read
+            unidesk.ai/ci-run-id: "$(params.run-id)"
+          ports:
+            - name: http
+              port: 4222
+              targetPort: http
+        ---
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: code-queue-write-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: write
+            app.kubernetes.io/part-of: unidesk
+            unidesk.ai/ci-run-id: "$(params.run-id)"
+            unidesk.ai/deploy-service-id: code-queue
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app.kubernetes.io/name: code-queue
+              app.kubernetes.io/component: write
+              unidesk.ai/ci-run-id: "$(params.run-id)"
+          template:
+            metadata:
+              labels:
+                app.kubernetes.io/name: code-queue
+                app.kubernetes.io/component: write
+                app.kubernetes.io/part-of: unidesk
+                unidesk.ai/ci-run-id: "$(params.run-id)"
+                unidesk.ai/node-id: D601
+                unidesk.ai/deploy-service-id: code-queue
+            spec:
+              nodeSelector:
+                unidesk.ai/node-id: D601
+              terminationGracePeriodSeconds: 10
+              containers:
+                - name: code-queue
+                  image: "$app_image"
+                  imagePullPolicy: Never
+                  ports:
+                    - name: http
+                      containerPort: 4222
+                  envFrom:
+                    - secretRef:
+                        name: code-queue-dev-e2e-env
+                  env:
+                    - name: HOST
+                      value: "0.0.0.0"
+                    - name: PORT
+                      value: "4222"
+                    - name: UNIDESK_ENV
+                      value: dev
+                    - name: UNIDESK_NAMESPACE
+                      value: "$ns"
+                    - name: UNIDESK_DATABASE_NAME
+                      value: unidesk_ci
+                    - name: UNIDESK_DEPLOY_REF
+                      value: origin/master:deploy.json#environments.dev
+                    - name: UNIDESK_DEPLOY_SERVICE_ID
+                      value: code-queue
+                    - name: CODE_QUEUE_DEPLOY_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_DEPLOY_REQUESTED_COMMIT
+                      value: "$code_queue_commit"
+                    - name: CODE_QUEUE_INSTANCE_ID
+                      value: D601-dev-ci-write
+                    - name: CODE_QUEUE_SERVICE_ROLE
+                      value: write
+                    - name: CODE_QUEUE_SCHEDULER_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_DATABASE_POOL_MAX
+                      value: "2"
+                    - name: CODE_QUEUE_MAIN_PROVIDER_ID
+                      value: D601-dev
+                    - name: CODE_QUEUE_EXECUTION_PROVIDER_IDS
+                      value: D601-dev
+                    - name: CODE_QUEUE_WORKDIR
+                      value: /workspace-dev
+                    - name: CODE_QUEUE_REMOTE_WORKDIR
+                      value: /home/ubuntu/unidesk-dev-workspace
+                    - name: CODE_QUEUE_DATA_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: CODE_QUEUE_CODEX_HOME
+                      value: /var/lib/unidesk-dev-e2e/code-queue/codex-home
+                    - name: CODE_QUEUE_OPENCODE_XDG_DIR
+                      value: /var/lib/unidesk-dev-e2e/code-queue/opencode-xdg
+                    - name: CODE_QUEUE_EGRESS_PROXY_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_NOTIFY_CLAUDEQQ_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_STARTUP_OA_BACKFILL_ENABLED
+                      value: "false"
+                    - name: CODE_QUEUE_CODEX_SQLITE_LOG_EXPORT_ENABLED
+                      value: "false"
+                    - name: OA_EVENT_FLOW_BASE_URL
+                      value: http://127.0.0.1:9
+                    - name: LOG_FILE
+                      value: /var/log/unidesk/code-queue-write-dev-e2e.jsonl
+                    - name: NODE_OPTIONS
+                      value: --max-old-space-size=512
+                  readinessProbe:
+                    httpGet:
+                      path: /health
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 24
+                  startupProbe:
+                    httpGet:
+                      path: /live
+                      port: http
+                    periodSeconds: 5
+                    timeoutSeconds: 3
+                    failureThreshold: 60
+                  resources:
+                    requests:
+                      cpu: 80m
+                      memory: 192Mi
+                    limits:
+                      cpu: 300m
+                      memory: 768Mi
+                  volumeMounts:
+                    - name: state
+                      mountPath: /var/lib/unidesk-dev-e2e/code-queue
+                    - name: logs
+                      mountPath: /var/log/unidesk
+              volumes:
+                - name: state
+                  emptyDir: {}
+                - name: logs
+                  emptyDir: {}
+        ---
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: code-queue-write-dev
+          namespace: $ns
+          labels:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: write
+            app.kubernetes.io/part-of: unidesk
+        spec:
+          type: ClusterIP
+          selector:
+            app.kubernetes.io/name: code-queue
+            app.kubernetes.io/component: write
+            unidesk.ai/ci-run-id: "$(params.run-id)"
+          ports:
+            - name: http
+              port: 4222
              targetPort: http
        YAML
-        csplit -s -f /tmp/dev-e2e-target- /tmp/dev-e2e-target.yaml '/^---$/' '{*}'
-        kube PATCH \
-          -H "Content-Type: application/apply-patch+yaml" \
-          --data-binary @/tmp/dev-e2e-target-00 \
-          "$kube_api/apis/apps/v1/namespaces/$ns/deployments/dev-e2e-target?fieldManager=unidesk-ci&force=true" >/dev/null
-        kube PATCH \
-          -H "Content-Type: application/apply-patch+yaml" \
-          --data-binary @/tmp/dev-e2e-target-01 \
-          "$kube_api/api/v1/namespaces/$ns/services/dev-e2e-target?fieldManager=unidesk-ci&force=true" >/dev/null
+        csplit -s -f /tmp/dev-e2e-code-queue- /tmp/dev-e2e-code-queue.yaml '/^---$/' '{*}'
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-00 "$kube_api/apis/apps/v1/namespaces/$ns/deployments/code-queue-scheduler-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-01 "$kube_api/api/v1/namespaces/$ns/services/code-queue-scheduler-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-02 "$kube_api/apis/apps/v1/namespaces/$ns/deployments/code-queue-read-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-03 "$kube_api/api/v1/namespaces/$ns/services/code-queue-read-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-04 "$kube_api/apis/apps/v1/namespaces/$ns/deployments/code-queue-write-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        kube PATCH -H "Content-Type: application/apply-patch+yaml" --data-binary @/tmp/dev-e2e-code-queue-05 "$kube_api/api/v1/namespaces/$ns/services/code-queue-write-dev?fieldManager=unidesk-ci&force=true" >/dev/null
+        wait_deployment_available code-queue-scheduler-dev 420
+        wait_deployment_available code-queue-read-dev 420
+        wait_deployment_available code-queue-write-dev 420

-        deadline=$((SECONDS + 180))
-        while [ "$SECONDS" -lt "$deadline" ]; do
-          status="$(kube GET "$kube_api/apis/apps/v1/namespaces/$ns/deployments/dev-e2e-target")"
-          available="$(printf '%s' "$status" | jq -r '.status.availableReplicas // 0')"
-          observed="$(printf '%s' "$status" | jq -r '.status.observedGeneration // 0')"
-          generation="$(printf '%s' "$status" | jq -r '.metadata.generation // 0')"
-          if [ "$available" -ge 1 ] && [ "$observed" -ge "$generation" ]; then
-            echo "dev_e2e_target_rollout=available namespace=$ns"
-            break
-          fi
-          sleep 2
-        done
-        if [ "$SECONDS" -ge "$deadline" ]; then
-          echo "dev_e2e_target_rollout=timeout namespace=$ns" >&2
-          kube GET "$kube_api/apis/apps/v1/namespaces/$ns/deployments/dev-e2e-target" >&2
-          exit 1
-        fi
+        proxy_get code-queue-write-dev /health >"$run_dir/code-queue-write-health.json"
+        proxy_get code-queue-scheduler-dev /health >"$run_dir/code-queue-scheduler-health.json"
+        proxy_get code-queue-read-dev /live >"$run_dir/code-queue-read-live.json"
+        proxy_get code-queue-read-dev /api/workdirs >"$run_dir/code-queue-read-workdirs.json"
+        proxy_json POST code-queue-write-dev /api/workdirs '{"providerId":"D601-dev","executionMode":"default","path":"/home/ubuntu/unidesk-dev-workspace/ci-workdirs-smoke"}' >"$run_dir/code-queue-workdir-created.json"
+        proxy_get code-queue-write-dev '/api/workdirs?providerId=D601-dev&executionMode=default' >"$run_dir/code-queue-write-workdirs.json"
+        proxy_json DELETE code-queue-write-dev /api/workdirs/D601-dev/default/%2Fhome%2Fubuntu%2Funidesk-dev-workspace%2Fci-workdirs-smoke >"$run_dir/code-queue-workdir-deleted.json"

-        bun - "$ns" "$(params.deploy-commit)" "$backend_commit" "$frontend_commit" "$code_queue_commit" "$result_json" <<'BUN'
-        const [ns, deployCommit, backendCommit, frontendCommit, codeQueueCommit, resultPath] = process.argv.slice(2);
-        const url = `http://dev-e2e-target.${ns}.svc.cluster.local:8080/health`;
-        const started = performance.now();
-        const response = await fetch(url);
-        const elapsedMs = Math.round(performance.now() - started);
-        const body = await response.json();
-        const checks = [
-          response.ok,
-          body.ok === true,
-          body.environment === "dev",
-          body.namespace === ns,
-          body.deployCommit === deployCommit,
-          body.backendCoreCommit === backendCommit,
-          body.frontendCommit === frontendCommit,
-          body.codeQueueCommit === codeQueueCommit
-        ];
-        const result = { ok: checks.every(Boolean), elapsedMs, url, body };
-        await Bun.write(resultPath, JSON.stringify(result, null, 2) + "\n");
-        console.log(JSON.stringify(result));
-        if (!result.ok) process.exit(1);
-        BUN
+        python3 - "$ns" "$(params.deploy-commit)" "$backend_commit" "$frontend_commit" "$code_queue_commit" "$app_image" "$result_json" "$run_dir" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+ns, deploy_commit, backend_commit, frontend_commit, code_queue_commit, app_image, result_path, run_dir = sys.argv[1:]
+run_path = Path(run_dir)
+
+def read_json(name):
+    with (run_path / name).open("r", encoding="utf-8") as handle:
+        return json.load(handle)
+
+health = read_json("code-queue-write-health.json")
+scheduler = read_json("code-queue-scheduler-health.json")
+read_live = read_json("code-queue-read-live.json")
+initial_workdirs = read_json("code-queue-read-workdirs.json")
+created = read_json("code-queue-workdir-created.json")
+listed = read_json("code-queue-write-workdirs.json")
+deleted = read_json("code-queue-workdir-deleted.json")
+checks = [
+    health.get("ok") is True and health.get("role") == "write" and health.get("deploy", {}).get("commit") == code_queue_commit,
+    scheduler.get("ok") is True and scheduler.get("role") == "scheduler" and scheduler.get("schedulerEnabled") is True,
+    read_live.get("ok") is True and read_live.get("role") == "read",
+    initial_workdirs.get("ok") is True and isinstance(initial_workdirs.get("workdirs"), list),
+    created.get("ok") is True and created.get("workdir", {}).get("providerId") == "D601-dev" and created.get("workdir", {}).get("path") == "/home/ubuntu/unidesk-dev-workspace/ci-workdirs-smoke",
+    listed.get("ok") is True and any(item.get("path") == "/home/ubuntu/unidesk-dev-workspace/ci-workdirs-smoke" for item in listed.get("workdirs", [])),
+    deleted.get("ok") is True,
+]
+result = {
+    "ok": all(checks),
+    "namespace": ns,
+    "deployCommit": deploy_commit,
+    "backendCoreCommit": backend_commit,
+    "frontendCommit": frontend_commit,
+    "codeQueueCommit": code_queue_commit,
+    "codeQueueImage": app_image,
+    "accessPath": "kubernetes-api-service-proxy",
+    "services": ["code-queue-scheduler-dev", "code-queue-read-dev", "code-queue-write-dev"],
+    "health": health,
+    "scheduler": scheduler,
+    "readLive": read_live,
+    "initialWorkdirs": initial_workdirs,
+    "created": created,
+    "listed": listed,
+    "deleted": deleted,
+}
+Path(result_path).write_text(json.dumps(result, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+print(json.dumps(result, ensure_ascii=False))
+if not result["ok"]:
+    raise SystemExit(1)
+PY
 ---
 apiVersion: tekton.dev/v1
 kind: Pipeline