From 84db3532c90adf0c74f7ae79090d18616ea6e554 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sun, 17 May 2026 14:33:59 +0000
Subject: [PATCH] fix: verify k3s deploy commits independently

---
 scripts/src/deploy.ts | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/scripts/src/deploy.ts b/scripts/src/deploy.ts
index 630e213d..2be24efa 100644
--- a/scripts/src/deploy.ts
+++ b/scripts/src/deploy.ts
@@ -84,8 +84,9 @@ interface ServiceRuntimeState {
 const defaultDeployFile = "deploy.json";
 const defaultTimeoutMs = 900_000;
 const resolveFetchTimeout = "120s";
-const shortDispatchWaitMs = 25_000;
+const shortDispatchWaitMs = 60_000;
 const shortRemoteTimeoutMs = 20_000;
+const providerDispatchCompletionLagMs = 45_000;
 const pollIntervalMs = 5_000;
 const remoteDeployRoot = "/home/ubuntu/.unidesk/deploy";
 const k8sNamespace = "unidesk";
@@ -1307,11 +1308,21 @@ function runtimeCommitVerified(
   orchestratorCommit: string | null,
   desired: string,
 ): boolean {
-  if (healthCommit !== null && healthCommit.length > 0 && !commitMatches(healthCommit, desired)) return false;
   if (service.deployment.mode === "k3sctl-managed") return commitMatches(orchestratorCommit, desired);
+  if (healthCommit !== null && healthCommit.length > 0 && !commitMatches(healthCommit, desired)) return false;
   return commitMatches(imageCommit, desired);
 }
 
+function runtimeCurrentCommit(
+  service: UniDeskMicroserviceConfig,
+  healthCommit: string | null,
+  imageCommit: string | null,
+  orchestratorCommit: string | null,
+): string | null {
+  if (service.deployment.mode === "k3sctl-managed") return orchestratorCommit ?? imageCommit;
+  return healthCommit ?? imageCommit ?? orchestratorCommit;
+}
+
 function coreBody(response: unknown): Record<string, unknown> | null {
   const record = asRecord(response);
   return asRecord(record?.body);
@@ -1352,7 +1363,8 @@ async function dispatchSsh(
       raw: dispatchResponse,
     };
   }
-  const deadline = Date.now() + waitMs;
+  const effectiveWaitMs = Math.max(waitMs, Math.min(remoteTimeoutMs + providerDispatchCompletionLagMs, 120_000));
+  const deadline = Date.now() + effectiveWaitMs;
   let latest: unknown = null;
   while (Date.now() < deadline) {
     latest = coreInternalFetch(`/api/tasks/${encodeURIComponent(taskId)}`);
@@ -1380,7 +1392,7 @@ async function dispatchSsh(
     taskId,
     status: "timeout",
     stdout: "",
-    stderr: `host.ssh task ${taskId} did not finish within ${waitMs}ms`,
+    stderr: `host.ssh task ${taskId} did not finish within ${effectiveWaitMs}ms`,
     exitCode: null,
     raw: latest,
   };
@@ -1554,7 +1566,7 @@ async function readRuntimeState(config: UniDeskConfig, service: UniDeskMicroserv
     readDockerImageCommit(config, service).catch(() => null),
     readK8sCommit(config, service).catch(() => null),
   ]);
-  const currentCommit = healthCommit ?? orchestratorCommit ?? imageCommit;
+  const currentCommit = runtimeCurrentCommit(service, healthCommit, imageCommit, orchestratorCommit);
   return {
     serviceId: service.id,
     ok: reason === null,