feat: add devops-controlled dev ci flow

scripts/bootstrap/devops-install.sh

@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_url="https://github.com/pikasTech/unidesk"
+commit_id=""
+environment="dev"
+namespace="unidesk-ci"
+work_dir="/home/ubuntu/.unidesk/bootstrap/devops"
+image="unidesk-devops:dev"
+dry_run="0"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  devops-install.sh --commit <commit> [--env dev] [--repo-url URL] [--namespace unidesk-ci] [--dry-run]
+
+This script is a one-shot D601 bootstrapper. It installs or repairs the UniDesk
+DevOps control service in native k3s, then normal CI/CD should use DevOps APIs.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --commit|--commit-id)
+      commit_id="${2:-}"
+      shift 2
+      ;;
+    --env|--environment)
+      environment="${2:-}"
+      shift 2
+      ;;
+    --repo-url)
+      repo_url="${2:-}"
+      shift 2
+      ;;
+    --namespace)
+      namespace="${2:-}"
+      shift 2
+      ;;
+    --work-dir)
+      work_dir="${2:-}"
+      shift 2
+      ;;
+    --dry-run)
+      dry_run="1"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if ! [[ "$commit_id" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
+  echo "--commit must be a 7-40 character git SHA" >&2
+  exit 2
+fi
+
+if [ "$environment" != "dev" ]; then
+  echo "only --env dev is supported by the first bootstrapper" >&2
+  exit 2
+fi
+
+log() {
+  printf '{"at":"%s","event":"%s"}\n' "$(date -Iseconds)" "$*"
+}
+
+need_cmd() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+root_exec() {
+  if [ "$(id -u)" = "0" ]; then
+    "$@"
+  elif sudo -n true >/dev/null 2>&1; then
+    sudo -n "$@"
+  else
+    echo "root access is required for k3s containerd import" >&2
+    exit 1
+  fi
+}
+
+need_cmd git
+need_cmd docker
+need_cmd kubectl
+
+if [ ! -f /etc/rancher/k3s/k3s.yaml ]; then
+  echo "native k3s kubeconfig not found: /etc/rancher/k3s/k3s.yaml" >&2
+  exit 1
+fi
+
+export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+kubectl get nodes >/dev/null
+
+log "bootstrap_preflight_ok"
+if [ "$dry_run" = "1" ]; then
+  exit 0
+fi
+
+repo_dir="$work_dir/repo"
+mkdir -p "$work_dir"
+if [ ! -d "$repo_dir/.git" ]; then
+  rm -rf "$repo_dir"
+  git clone --no-checkout "$repo_url" "$repo_dir"
+fi
+
+git -C "$repo_dir" remote set-url origin "$repo_url"
+git -C "$repo_dir" fetch --no-tags origin "$commit_id" || git -C "$repo_dir" fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
+resolved="$(git -C "$repo_dir" rev-parse --verify "$commit_id^{commit}")"
+git -C "$repo_dir" checkout --detach "$resolved"
+
+log "source_ready commit=$resolved"
+
+docker buildx build --load \
+  --progress=plain \
+  --label "unidesk.ai/service-id=devops" \
+  --label "unidesk.ai/source-repo=$repo_url" \
+  --label "unidesk.ai/source-commit=$resolved" \
+  --label "unidesk.ai/dockerfile=src/components/microservices/devops/Dockerfile" \
+  -t "$image" \
+  -f "$repo_dir/src/components/microservices/devops/Dockerfile" \
+  "$repo_dir"
+
+archive="$work_dir/devops-image.tar"
+rm -f "$archive"
+docker save "$image" -o "$archive"
+root_exec ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images import "$archive"
+
+manifest="$work_dir/devops.k8s.yaml"
+cp "$repo_dir/src/components/microservices/k3sctl-adapter/k3s/devops.k8s.yaml" "$manifest"
+python3 - "$manifest" "$image" "$repo_url" "$resolved" "$commit_id" <<'PY'
+import re
+import sys
+
+path, image, repo, commit, requested = sys.argv[1:]
+text = open(path, encoding="utf-8").read()
+text = re.sub(r"image: unidesk-devops:[^\n]+", f"image: {image}", text)
+text = text.replace("value: https://github.com/pikasTech/unidesk", f"value: {repo}")
+text = text.replace("unidesk.ai/deploy-commit: replace-with-deploy-env-commit", f"unidesk.ai/deploy-commit: {commit}")
+text = text.replace("unidesk.ai/deploy-requested-commit: replace-with-deploy-env-commit", f"unidesk.ai/deploy-requested-commit: {requested}")
+text = text.replace("value: replace-with-deploy-env-commit", f"value: {commit}")
+open(path, "w", encoding="utf-8").write(text)
+PY
+
+kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -
+kubectl apply -f "$manifest"
+kubectl -n "$namespace" rollout status deployment/devops --timeout=180s
+kubectl -n "$namespace" get --raw "/api/v1/namespaces/$namespace/services/http:devops:4286/proxy/health" >/tmp/unidesk-devops-health.json
+
+receipt="$work_dir/receipt.json"
+python3 - "$receipt" "$repo_url" "$resolved" "$commit_id" "$namespace" "$image" </tmp/unidesk-devops-health.json <<'PY'
+import json
+import sys
+from datetime import datetime, timezone
+
+path, repo, commit, requested, namespace, image = sys.argv[1:]
+health = json.load(sys.stdin)
+receipt = {
+    "installedAt": datetime.now(timezone.utc).isoformat(),
+    "repo": repo,
+    "commit": commit,
+    "requestedCommit": requested,
+    "namespace": namespace,
+    "image": image,
+    "health": health,
+}
+with open(path, "w", encoding="utf-8") as handle:
+    json.dump(receipt, handle, ensure_ascii=False, indent=2)
+    handle.write("\n")
+print(json.dumps({"ok": True, "receipt": path, "health": health}, ensure_ascii=False))
+PY

scripts/cli.ts

@@ -58,7 +58,7 @@ function help(): unknown {
       { command: "decision diary show <YYYY-MM-DD|id>", description: "Show one daily diary Markdown entry." },
       { command: "decision list [--type ...] [--status ...] [--level ...] [--linked-goal-id id] [--limit N]", description: "List Decision Center records through the user-service proxy." },
       { command: "decision show <id>", description: "Show one Decision Center record." },
-      { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--dry-run] [--force]", description: "Reconcile services from a repo+commit manifest; --env reads fixed environment refs and can apply supported dev services." },
+      { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--dry-run] [--force]", description: "Reconcile services from a repo+commit manifest; --env reads origin/master:deploy.json environments and can apply supported dev services." },
       { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
       { command: "schedule list|get|runs|run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
@@ -75,7 +75,7 @@ function help(): unknown {
       { command: "debug dispatch [providerId] [docker.ps|provider.upgrade|host.ssh|microservice.http|echo] [--wait-ms N]", description: "Submit a real internal-core dispatch request for CLI debugging." },
       { command: "debug task <taskId|latest>", description: "Read a dispatched task record from internal core for CLI debugging." },
       { command: "network perf [--service code-queue --path /api/tasks/overview?limit=30 --count N --concurrency N --label before|after]", description: "Benchmark frontend -> backend-core -> provider/adapter user-service networking and report latency/proxy-mode distributions." },
-      { command: "ci install|status|run|logs", description: "Manage D601 k3s Tekton CI only; does not deploy CD. CI reads the production PostgreSQL through a temporary read-only Code Queue service." },
+      { command: "ci install|status|run|run-dev-e2e|logs", description: "Manage D601 k3s Tekton CI only; run-dev-e2e manually validates master deploy.json dev state in an isolated temporary namespace." },
       { command: "e2e run [--only pattern[,pattern...]] [--skip pattern[,pattern...]]", description: "Run selected public/internal/Playwright E2E checks; use --only for focused iteration and rerun without filters for final regression." },
     ],
   };
@@ -290,7 +290,10 @@ async function main(): Promise<void> {
   }
 
   if (top === "ci") {
-    emitJson(commandName, runCiCommand(config, args.slice(1)));
+    const result = await runCiCommand(config, args.slice(1));
+    const ok = (result as { ok?: unknown }).ok !== false;
+    emitJson(commandName, result, ok);
+    if (!ok) process.exitCode = 1;
     return;
   }
 

scripts/src/ci.ts

@@ -1,12 +1,11 @@
-import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { runCommand } from "./command";
 import { type UniDeskConfig, repoRoot, rootPath } from "./config";
 import { startJob } from "./jobs";
+import { coreInternalFetch } from "./microservices";
 
-const k3sctlContainerName = "k3sctl-adapter";
-const k3sctlSshKey = "/run/host-ssh/id_ed25519";
-const d601SshTarget = "ubuntu@host.docker.internal";
+const d601ProviderId = "D601";
 const d601Kubeconfig = "/etc/rancher/k3s/k3s.yaml";
 const tektonPipelineVersion = "v1.12.0";
 const tektonTriggersVersion = "v0.34.0";
@@ -14,6 +13,7 @@ const tektonPipelineReleaseUrl = `https://infra.tekton.dev/tekton-releases/pipel
 const tektonTriggersReleaseUrl = `https://infra.tekton.dev/tekton-releases/triggers/previous/${tektonTriggersVersion}/release.yaml`;
 const tektonTriggersInterceptorsUrl = `https://infra.tekton.dev/tekton-releases/triggers/previous/${tektonTriggersVersion}/interceptors.yaml`;
 const providerGatewayWsEgressProxyUrl = "http://127.0.0.1:18789";
+const ciCodeQueueImage = "unidesk-code-queue:dev";
 const ciRuntimeImages = [
   "rancher/mirrored-pause:3.6",
   "rancher/mirrored-library-busybox:1.36.1",
@@ -25,7 +25,7 @@ const ciRuntimeImages = [
   "ghcr.io/tektoncd/triggers/eventlistenersink-7ad1faa98cddbcb0c24990303b220bb8:v0.34.0",
   "oven/bun:1-debian",
   "alpine/git:2.45.2",
-  "unidesk-code-queue:d601",
+  ciCodeQueueImage,
 ];
 
 interface CiOptions {
@@ -34,6 +34,35 @@ interface CiOptions {
   waitMs: number;
 }
 
+interface CiDevE2EOptions {
+  repoUrl: string;
+  desiredRef: string;
+  deployCommit: string;
+  environment: "dev";
+  services: Array<{ id: string; commitId: string; repo: string }>;
+  runId: string;
+  keepNamespace: boolean;
+  waitMs: number;
+  direct: boolean;
+}
+
+interface DispatchResult {
+  ok: boolean;
+  taskId: string | null;
+  status: string | null;
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  raw: unknown;
+}
+
+interface DeployDevManifestSummary {
+  deployCommit: string;
+  desiredRef: string;
+  environment: "dev";
+  services: Array<{ id: string; commitId: string; repo: string }>;
+}
+
 function stringOption(args: string[], name: string): string | null {
   const index = args.indexOf(name);
   if (index === -1) return null;
@@ -56,88 +85,243 @@ function requireRevision(value: string | null): string {
   return value;
 }
 
+function requireDesiredRef(value: string | null): string {
+  const ref = value ?? "master";
+  if (!/^[A-Za-z0-9._/-]{1,160}$/u.test(ref) || ref.startsWith("-") || ref.includes("..")) {
+    throw new Error("ci run-dev-e2e --desired-ref contains unsupported characters");
+  }
+  return ref;
+}
+
+function boolFlag(args: string[], name: string): boolean {
+  return args.includes(name);
+}
+
 function shellQuote(value: string): string {
   return `'${value.replace(/'/gu, "'\\''")}'`;
 }
 
-function dockerExecK3sctl(args: string[]) {
-  return runCommand(["docker", "exec", k3sctlContainerName, ...args], repoRoot);
-}
-
-function dockerExecK3sctlWithInput(args: string[], input: string) {
-  const command = ["docker", "exec", "-i", k3sctlContainerName, ...args];
-  const result = spawnSync(command[0], command.slice(1), {
-    cwd: repoRoot,
-    encoding: "utf8",
-    input,
-    maxBuffer: 1024 * 1024 * 8,
-  });
-  return {
-    command,
-    cwd: repoRoot,
-    exitCode: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? result.error?.message ?? "",
-  };
-}
-
-function remoteKubectlCommand(script: string): string[] {
-  return [
-    "sh",
-    "-lc",
-    [
-      "ssh",
-      "-i",
-      shellQuote(k3sctlSshKey),
-      "-o",
-      "StrictHostKeyChecking=no",
-      "-o",
-      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
-      "-o",
-      "ConnectTimeout=10",
-      shellQuote(d601SshTarget),
-      shellQuote(`KUBECONFIG=${d601Kubeconfig} bash -lc ${shellQuote(script)}`),
-    ].join(" "),
-  ];
-}
-
-function runRemoteKubectl(script: string) {
-  const result = dockerExecK3sctl(remoteKubectlCommand(script));
-  if (result.exitCode !== 0) {
-    throw new Error(`D601 kubectl command failed: ${result.stderr || result.stdout}`);
+function chunks(value: string, size: number): string[] {
+  const result: string[] = [];
+  for (let index = 0; index < value.length; index += size) {
+    result.push(value.slice(index, index + size));
   }
   return result;
 }
 
-function remoteApplyManifest(path: string): void {
-  const absolute = rootPath(path);
-  if (!existsSync(absolute)) throw new Error(`manifest not found: ${path}`);
-  const result = dockerExecK3sctlWithInput([
-    "sh",
-    "-lc",
-    [
-      "ssh",
-      "-i",
-      shellQuote(k3sctlSshKey),
-      "-o",
-      "StrictHostKeyChecking=no",
-      "-o",
-      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
-      "-o",
-      "ConnectTimeout=10",
-      shellQuote(d601SshTarget),
-      shellQuote(`KUBECONFIG=${d601Kubeconfig} kubectl apply -f -`),
-    ].join(" "),
-  ], readFileSync(absolute, "utf8"));
-  if (result.exitCode !== 0) {
-    throw new Error(`kubectl apply failed for ${path}: ${result.stderr || result.stdout}`);
-  }
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
 }
 
-function prewarmCiRuntimeImages(): void {
-  const images = ciRuntimeImages.map(shellQuote).join(" ");
-  runRemoteKubectl([
+function asString(value: unknown): string {
+  return typeof value === "string" ? value : "";
+}
+
+function coreBody(response: unknown): Record<string, unknown> | null {
+  return asRecord(asRecord(response)?.body);
+}
+
+function proxyBody(response: unknown): Record<string, unknown> | null {
+  const body = coreBody(response);
+  const nested = asRecord(body?.body);
+  return nested ?? body;
+}
+
+async function dispatchSsh(command: string, waitMs: number, remoteTimeoutMs: number): Promise<DispatchResult> {
+  const dispatchResponse = coreInternalFetch("/api/dispatch", {
+    method: "POST",
+    body: {
+      providerId: d601ProviderId,
+      command: "host.ssh",
+      payload: {
+        source: "ci-cli",
+        mode: "exec",
+        command,
+        timeoutMs: remoteTimeoutMs,
+        cwd: "/home/ubuntu",
+      },
+    },
+  });
+  const dispatchBody = coreBody(dispatchResponse);
+  const taskId = asString(dispatchBody?.taskId);
+  if (dispatchBody?.ok !== true || taskId.length === 0) {
+    return {
+      ok: false,
+      taskId: taskId || null,
+      status: null,
+      stdout: "",
+      stderr: asString(dispatchBody?.error) || "dispatch did not return a task id",
+      exitCode: null,
+      raw: dispatchResponse,
+    };
+  }
+  const deadline = Date.now() + Math.max(waitMs, remoteTimeoutMs + 10_000);
+  let latest: unknown = null;
+  while (Date.now() < deadline) {
+    latest = coreInternalFetch(`/api/tasks/${encodeURIComponent(taskId)}`, { maxResponseBytes: 3_000_000 });
+    const task = asRecord(coreBody(latest)?.task);
+    const status = asString(task?.status);
+    if (status === "succeeded" || status === "failed") {
+      const result = asRecord(task?.result);
+      const exitCode = typeof result?.exitCode === "number" ? result.exitCode : null;
+      const stdout = asString(result?.stdout);
+      const stderr = asString(result?.stderr);
+      return {
+        ok: status === "succeeded" && (exitCode === null || exitCode === 0),
+        taskId,
+        status,
+        stdout,
+        stderr,
+        exitCode,
+        raw: task,
+      };
+    }
+    await Bun.sleep(500);
+  }
+  return {
+    ok: false,
+    taskId,
+    status: "timeout",
+    stdout: "",
+    stderr: `host.ssh task ${taskId} did not finish within ${Math.max(waitMs, remoteTimeoutMs + 10_000)}ms`,
+    exitCode: null,
+    raw: latest,
+  };
+}
+
+async function runRemoteKubectl(script: string, waitMs = 60_000, remoteTimeoutMs = 45_000): Promise<DispatchResult> {
+  const result = await runRemoteKubectlRaw(script, waitMs, remoteTimeoutMs);
+  if (!result.ok) {
+    throw new Error(`D601 kubectl command failed: ${result.stderr || result.stdout || JSON.stringify(result.raw)}`);
+  }
+  return result;
+}
+
+async function runRemoteKubectlRaw(script: string, waitMs = 60_000, remoteTimeoutMs = 45_000): Promise<DispatchResult> {
+  const command = [
     "set -euo pipefail",
+    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    script,
+  ].join("\n");
+  return dispatchSsh(command, waitMs, remoteTimeoutMs);
+}
+
+async function uploadRemoteBase64(path: string, encoded: string): Promise<DispatchResult> {
+  const init = await dispatchSsh([
+    "set -euo pipefail",
+    `target=${shellQuote(path)}`,
+    "rm -f \"$target\"",
+    ": > \"$target\"",
+    "chmod 600 \"$target\"",
+  ].join("\n"), 20_000, 10_000);
+  if (!init.ok) return init;
+  for (const chunk of chunks(encoded, 950)) {
+    const append = await dispatchSsh([
+      "set -euo pipefail",
+      `target=${shellQuote(path)}`,
+      `printf %s ${shellQuote(chunk)} >> "$target"`,
+    ].join("\n"), 20_000, 10_000);
+    if (!append.ok) return append;
+  }
+  return dispatchSsh([
+    "set -euo pipefail",
+    `target=${shellQuote(path)}`,
+    "wc -c \"$target\"",
+  ].join("\n"), 20_000, 10_000);
+}
+
+async function runRemoteBackground(label: string, script: string, timeoutMs: number): Promise<DispatchResult> {
+  const token = randomUUID().replace(/-/gu, "").slice(0, 12);
+  const safeLabel = label.replace(/[^a-z0-9-]/giu, "-").toLowerCase().slice(0, 48);
+  const base = `/tmp/unidesk-ci-${safeLabel}-${token}`;
+  const scriptPath = `${base}.sh`;
+  const logPath = `${base}.log`;
+  const donePath = `${base}.done`;
+  const encoded = Buffer.from(script, "utf8").toString("base64");
+  const upload = await uploadRemoteBase64(`${scriptPath}.b64`, encoded);
+  if (!upload.ok) return upload;
+  const start = await dispatchSsh([
+    "set -euo pipefail",
+    `script_path=${shellQuote(scriptPath)}`,
+    `log_path=${shellQuote(logPath)}`,
+    `done_path=${shellQuote(donePath)}`,
+    "rm -f \"$script_path\" \"$log_path\" \"$done_path\"",
+    "base64 -d \"$script_path.b64\" > \"$script_path\"",
+    "rm -f \"$script_path.b64\"",
+    "chmod 700 \"$script_path\"",
+    "nohup bash -lc \"bash '$script_path' >'$log_path' 2>&1; code=\\$?; printf '%s\\n' \\\"\\$code\\\" >'$done_path'\" >/tmp/unidesk-ci-nohup.log 2>&1 &",
+    "printf 'remote_job_pid=%s\\nlog=%s\\ndone=%s\\n' \"$!\" \"$log_path\" \"$done_path\"",
+  ].join("\n"), 20_000, 10_000);
+  if (!start.ok) return start;
+
+  const deadline = Date.now() + timeoutMs;
+  let latest: DispatchResult = start;
+  while (Date.now() < deadline) {
+    await Bun.sleep(8_000);
+    latest = await dispatchSsh([
+      "set -euo pipefail",
+      `log_path=${shellQuote(logPath)}`,
+      `done_path=${shellQuote(donePath)}`,
+      "if [ -f \"$done_path\" ]; then",
+      "  code=\"$(cat \"$done_path\" 2>/dev/null || printf 1)\"",
+      "  printf 'REMOTE_DONE:%s\\n' \"$code\"",
+      "else",
+      "  printf 'REMOTE_RUNNING\\n'",
+      "fi",
+      "tail -n 160 \"$log_path\" 2>/dev/null || true",
+    ].join("\n"), 75_000, 12_000);
+    if (!latest.ok) {
+      if (latest.status === "timeout" || latest.stderr.includes("did not finish within")) {
+        continue;
+      }
+      return latest;
+    }
+    const firstLine = latest.stdout.split(/\r?\n/u)[0] ?? "";
+    if (firstLine.startsWith("REMOTE_DONE:")) {
+      const code = Number(firstLine.slice("REMOTE_DONE:".length).trim());
+      return {
+        ...latest,
+        ok: code === 0,
+        exitCode: Number.isInteger(code) ? code : 1,
+        status: code === 0 ? "succeeded" : "failed",
+      };
+    }
+  }
+  return {
+    ...latest,
+    ok: false,
+    status: "timeout",
+    exitCode: 124,
+    stderr: `remote background job ${label} did not finish within ${timeoutMs}ms`,
+  };
+}
+
+async function remoteApplyManifest(path: string): Promise<void> {
+  const absolute = rootPath(path);
+  if (!existsSync(absolute)) throw new Error(`manifest not found: ${path}`);
+  const encoded = Buffer.from(readFileSync(absolute, "utf8"), "utf8").toString("base64");
+  const token = randomUUID().replace(/-/gu, "").slice(0, 12);
+  const b64Path = `/tmp/unidesk-ci-apply-${token}.b64`;
+  const upload = await uploadRemoteBase64(b64Path, encoded);
+  if (!upload.ok) throw new Error(`failed to upload manifest ${path}: ${upload.stderr || upload.stdout}`);
+  const script = [
+    "set -euo pipefail",
+    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    "tmp=$(mktemp /tmp/unidesk-ci-apply.XXXXXX.yaml)",
+    `b64_path=${shellQuote(b64Path)}`,
+    "trap 'rm -f \"$tmp\" \"$b64_path\"' EXIT",
+    "base64 -d \"$b64_path\" > \"$tmp\"",
+    "kubectl apply -f \"$tmp\"",
+  ].join("\n");
+  const result = await runRemoteBackground(`apply-${path.split("/").pop() ?? "manifest"}`, script, 180_000);
+  if (!result.ok) throw new Error(`kubectl apply failed for ${path}: ${result.stderr || result.stdout}`);
+}
+
+async function prewarmCiRuntimeImages(): Promise<void> {
+  const images = ciRuntimeImages.map(shellQuote).join(" ");
+  const script = [
+    "set -euo pipefail",
+    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
     "export DOCKER_CONFIG=/tmp/unidesk-ci-docker-config",
     "mkdir -p \"$DOCKER_CONFIG\"",
     "printf '{}\\n' > \"$DOCKER_CONFIG/config.json\"",
@@ -152,18 +336,37 @@ function prewarmCiRuntimeImages(): void {
     "done",
     "pause_entrypoint=$(docker image inspect rancher/mirrored-pause:3.6 --format '{{json .Config.Entrypoint}}' 2>/dev/null || true)",
     "if ! printf '%s' \"$pause_entrypoint\" | grep -q '\"/pause\"'; then echo native_k3s_pause_image_invalid_entrypoint=$pause_entrypoint >&2; exit 1; fi",
+    "containerd_images=$(/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls 2>/tmp/unidesk-ci-containerd-images.err || true)",
+    "containerd_ready=1",
+    "for image in \"${images[@]}\"; do",
+    "  case \"$image\" in",
+    "    rancher/*|oven/*|alpine/*) ref=\"docker.io/$image\" ;;",
+    "    unidesk-*) ref=\"docker.io/library/$image\" ;;",
+    "    *) ref=\"$image\" ;;",
+    "  esac",
+    "  if ! printf '%s\\n' \"$containerd_images\" | grep -F \"$ref\" >/dev/null; then",
+    "    containerd_ready=0",
+    "    echo ci_runtime_image_containerd_missing=$ref",
+    "  fi",
+    "done",
+    "if [ \"$containerd_ready\" = \"1\" ]; then",
+    "  echo ci_runtime_images_containerd_cached=all",
+    "  exit 0",
+    "fi",
     "rm -f /tmp/unidesk-ci-runtime-images.tar",
     "docker save \"${images[@]}\" -o /tmp/unidesk-ci-runtime-images.tar",
     "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images import --digests --all-platforms /tmp/unidesk-ci-runtime-images.tar >/tmp/unidesk-ci-runtime-images-import.log",
     "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/rancher/mirrored-pause:3.6' >/dev/null",
     "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/oven/bun:1-debian' >/dev/null",
     "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/alpine/git:2.45.2' >/dev/null",
-    "/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F 'docker.io/library/unidesk-code-queue:d601' >/dev/null",
-  ].join("\n"));
+    `/mnt/c/Windows/System32/wsl.exe -u root -- ctr --address /run/k3s/containerd/containerd.sock -n k8s.io images ls | grep -F ${shellQuote(`docker.io/library/${ciCodeQueueImage}`)} >/dev/null`,
+  ].join("\n");
+  const result = await runRemoteBackground("prewarm-runtime-images", script, 900_000);
+  if (!result.ok) throw new Error(`CI runtime image prewarm failed: ${result.stderr || result.stdout}`);
 }
 
-function status(): Record<string, unknown> {
-  const summary = runRemoteKubectl([
+async function status(): Promise<Record<string, unknown>> {
+  const summary = await runRemoteKubectl([
     "set -euo pipefail",
     "printf 'tekton_pipelines='",
     "kubectl get deploy -n tekton-pipelines -o name 2>/dev/null | tr '\\n' ' ' || true",
@@ -175,7 +378,7 @@ function status(): Record<string, unknown> {
   ].join("\n"));
   return {
     ok: true,
-    providerId: "D601",
+    providerId: d601ProviderId,
     orchestrator: "native-k3s",
     tekton: {
       pipelineVersion: tektonPipelineVersion,
@@ -185,23 +388,26 @@ function status(): Record<string, unknown> {
   };
 }
 
-function install(): Record<string, unknown> {
+async function install(): Promise<Record<string, unknown>> {
   if (!existsSync(rootPath("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml"))) {
     throw new Error("CI manifests are missing");
   }
-  prewarmCiRuntimeImages();
-  runRemoteKubectl([
+  await prewarmCiRuntimeImages();
+  const installTektonScript = [
     "set -euo pipefail",
+    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
     `kubectl apply -f ${shellQuote(tektonPipelineReleaseUrl)}`,
     "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines --timeout=900s",
     `kubectl apply -f ${shellQuote(tektonTriggersReleaseUrl)}`,
     `kubectl apply -f ${shellQuote(tektonTriggersInterceptorsUrl)}`,
     "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines --timeout=900s",
     "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines-resolvers --timeout=900s",
-  ].join("\n"));
-  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/tekton-install.yaml");
-  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml");
-  remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.triggers.yaml");
+  ].join("\n");
+  const installTekton = await runRemoteBackground("install-tekton", installTektonScript, 1_200_000);
+  if (!installTekton.ok) throw new Error(`Tekton install failed: ${installTekton.stderr || installTekton.stdout}`);
+  await remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/tekton-install.yaml");
+  await remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml");
+  await remoteApplyManifest("src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.triggers.yaml");
   return status();
 }
 
@@ -233,31 +439,66 @@ spec:
 `;
 }
 
-function remoteCreatePipelineRun(manifest: string): string {
-  const result = dockerExecK3sctlWithInput([
-    "sh",
-    "-lc",
-    [
-      "ssh",
-      "-i",
-      shellQuote(k3sctlSshKey),
-      "-o",
-      "StrictHostKeyChecking=no",
-      "-o",
-      "UserKnownHostsFile=/tmp/unidesk-ci-known-hosts",
-      shellQuote(d601SshTarget),
-      shellQuote(`KUBECONFIG=${d601Kubeconfig} kubectl create -f - -o jsonpath='{.metadata.name}'`),
-    ].join(" "),
-  ], manifest);
-  if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout);
+function devE2EPipelineRunManifest(options: CiDevE2EOptions): string {
+  const deployRevisionLabel = options.deployCommit.slice(0, 40);
+  return `apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  generateName: unidesk-dev-e2e-${options.runId}-
+  namespace: unidesk-ci
+  labels:
+    app.kubernetes.io/name: unidesk-dev-namespace-e2e
+    app.kubernetes.io/part-of: unidesk
+    unidesk.ai/ci-kind: dev-namespace-e2e
+    unidesk.ai/deploy-ref: master-deploy-json-dev
+    unidesk.ai/deploy-commit: ${JSON.stringify(deployRevisionLabel)}
+spec:
+  pipelineRef:
+    name: unidesk-dev-namespace-e2e
+  taskRunTemplate:
+    serviceAccountName: unidesk-ci-runner
+  params:
+    - name: repo-url
+      value: ${JSON.stringify(options.repoUrl)}
+    - name: desired-ref
+      value: ${JSON.stringify(options.desiredRef)}
+    - name: deploy-commit
+      value: ${JSON.stringify(options.deployCommit)}
+    - name: environment
+      value: ${JSON.stringify(options.environment)}
+    - name: run-id
+      value: ${JSON.stringify(options.runId)}
+    - name: keep-namespace
+      value: ${JSON.stringify(options.keepNamespace ? "true" : "false")}
+  workspaces:
+    - name: shared-workspace
+      persistentVolumeClaim:
+        claimName: unidesk-ci-cache
+`;
+}
+
+async function remoteCreatePipelineRun(manifest: string): Promise<string> {
+  const encoded = Buffer.from(manifest, "utf8").toString("base64");
+  const token = randomUUID().replace(/-/gu, "").slice(0, 12);
+  const b64Path = `/tmp/unidesk-ci-pipelinerun-${token}.b64`;
+  const upload = await uploadRemoteBase64(b64Path, encoded);
+  if (!upload.ok) throw new Error(`failed to upload PipelineRun manifest: ${upload.stderr || upload.stdout}`);
+  const result = await runRemoteKubectl([
+    "tmp=$(mktemp /tmp/unidesk-ci-run.XXXXXX.yaml)",
+    `b64_path=${shellQuote(b64Path)}`,
+    "trap 'rm -f \"$tmp\" \"$b64_path\"' EXIT",
+    "base64 -d \"$b64_path\" > \"$tmp\"",
+    "kubectl create -f \"$tmp\" -o jsonpath='{.metadata.name}'",
+  ].join("\n"), 60_000, 45_000);
   return result.stdout.trim();
 }
 
-function run(options: CiOptions): Record<string, unknown> {
-  const name = remoteCreatePipelineRun(pipelineRunManifest(options));
-  const wait = options.waitMs > 0 ? dockerExecK3sctl(remoteKubectlCommand([
+async function waitForPipelineRun(name: string, waitMs: number): Promise<DispatchResult | null> {
+  if (waitMs <= 0) return null;
+  const command = [
     "set -euo pipefail",
-    `deadline=$((SECONDS + ${Math.ceil(options.waitMs / 1000)}))`,
+    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    `deadline=$((SECONDS + ${Math.ceil(waitMs / 1000)}))`,
     "while [ \"$SECONDS\" -lt \"$deadline\" ]; do",
     `  condition="$(kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o jsonpath='{range .status.conditions[?(@.type==\"Succeeded\")]}{.status}{\"\\t\"}{.reason}{\"\\t\"}{.message}{end}' 2>/dev/null || true)"`,
     "  case \"$condition\" in",
@@ -277,7 +518,13 @@ function run(options: CiOptions): Record<string, unknown> {
     `echo "Timed out waiting for pipelinerun/${name}" >&2`,
     `kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o json`,
     "exit 124",
-  ].join("\n"))) : null;
+  ].join("\n");
+  return dispatchSsh(command, waitMs + 30_000, waitMs + 20_000);
+}
+
+async function run(options: CiOptions): Promise<Record<string, unknown>> {
+  const name = await remoteCreatePipelineRun(pipelineRunManifest(options));
+  const wait = await waitForPipelineRun(name, options.waitMs);
   const waitSucceeded = wait === null || wait.exitCode === 0 || wait.stdout.trimStart().startsWith("True\tSucceeded\t");
   return {
     ok: waitSucceeded,
@@ -296,14 +543,111 @@ function run(options: CiOptions): Record<string, unknown> {
   };
 }
 
-function logs(name: string): Record<string, unknown> {
+function resolveDeployDevManifest(desiredRef: string): DeployDevManifestSummary {
+  const remoteRef = `refs/remotes/origin/${desiredRef}`;
+  const fetch = runCommand(["git", "fetch", "--quiet", "origin", `+refs/heads/${desiredRef}:${remoteRef}`], repoRoot);
+  if (fetch.exitCode !== 0) throw new Error(`failed to fetch origin/${desiredRef}: ${fetch.stderr || fetch.stdout}`);
+  const deployCommitResult = runCommand(["git", "rev-parse", `origin/${desiredRef}`], repoRoot);
+  if (deployCommitResult.exitCode !== 0) throw new Error(`failed to resolve origin/${desiredRef}: ${deployCommitResult.stderr || deployCommitResult.stdout}`);
+  const show = runCommand(["git", "show", `origin/${desiredRef}:deploy.json`], repoRoot);
+  if (show.exitCode !== 0) throw new Error(`failed to read deploy.json from origin/${desiredRef}: ${show.stderr || show.stdout}`);
+  const parsed = JSON.parse(show.stdout) as unknown;
+  const record = asRecord(parsed);
+  if (record?.schemaVersion !== 2) throw new Error(`origin/${desiredRef}:deploy.json must use schemaVersion=2`);
+  const environments = asRecord(record.environments);
+  const dev = asRecord(environments?.dev);
+  const rawServices = Array.isArray(dev?.services) ? dev.services : [];
+  const services = rawServices.map((item) => {
+    const service = asRecord(item);
+    return {
+      id: asString(service?.id),
+      commitId: asString(service?.commitId).toLowerCase(),
+      repo: asString(service?.repo),
+    };
+  }).filter((service) => service.id.length > 0 && service.commitId.length > 0);
+  if (services.length === 0) throw new Error(`origin/${desiredRef}:deploy.json has no environments.dev services with commitId`);
+  return {
+    deployCommit: deployCommitResult.stdout.trim(),
+    desiredRef,
+    environment: "dev",
+    services,
+  };
+}
+
+function makeRunId(deployCommit: string): string {
+  const stamp = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14).toLowerCase();
+  return `${stamp}-${deployCommit.slice(0, 8).toLowerCase()}`.replace(/[^a-z0-9-]/gu, "-").slice(0, 48);
+}
+
+async function runDevE2E(options: CiDevE2EOptions): Promise<Record<string, unknown>> {
+  if (!options.direct) {
+    const devopsResponse = coreInternalFetch("/api/microservices/devops/proxy/api/ci/dev-e2e/run", {
+      method: "POST",
+      body: {
+        repoUrl: options.repoUrl,
+        desiredRef: options.desiredRef,
+        environment: options.environment,
+        runId: options.runId,
+        keepNamespace: options.keepNamespace,
+      },
+      maxResponseBytes: 2_000_000,
+    });
+    const devopsBody = proxyBody(devopsResponse);
+    if (devopsBody?.ok === true) {
+      const pipelineRun = asString(devopsBody.pipelineRun);
+      const wait = pipelineRun.length > 0 ? await waitForPipelineRun(pipelineRun, options.waitMs) : null;
+      const waitSucceeded = wait === null || wait.exitCode === 0 || wait.stdout.trimStart().startsWith("True\tSucceeded\t");
+      return {
+        ...devopsBody,
+        ok: waitSucceeded,
+        triggerMode: "devops-service",
+        wait: wait === null ? null : {
+          stdoutTail: wait.stdout.slice(-6000),
+          stderrTail: wait.stderr.slice(-6000),
+        },
+      };
+    }
+    return {
+      ok: false,
+      triggerMode: "devops-service",
+      error: "DevOps service trigger failed or did not return ok=true; use --direct only for CI bootstrap/recovery, never as a service deployment path.",
+      devopsResponse,
+    };
+  }
+  const name = await remoteCreatePipelineRun(devE2EPipelineRunManifest(options));
+  const wait = await waitForPipelineRun(name, options.waitMs);
+  const waitSucceeded = wait === null || wait.exitCode === 0 || wait.stdout.trimStart().startsWith("True\tSucceeded\t");
+  return {
+    ok: waitSucceeded,
+    pipelineRun: name,
+    namespace: "unidesk-ci",
+    temporaryNamespace: `unidesk-ci-e2e-${options.runId}`,
+    repoUrl: options.repoUrl,
+    desiredRef: options.desiredRef,
+    deployCommit: options.deployCommit,
+    environment: options.environment,
+    services: options.services,
+    keepNamespace: options.keepNamespace,
+    triggerMode: "direct-maintenance",
+    wait: wait === null ? null : {
+      stdoutTail: wait.stdout.slice(-6000),
+      stderrTail: wait.stderr.slice(-6000),
+    },
+    next: [
+      `bun scripts/cli.ts ci logs ${name}`,
+      "bun scripts/cli.ts ci status",
+    ],
+  };
+}
+
+async function logs(name: string): Promise<Record<string, unknown>> {
   if (name.length === 0) throw new Error("ci logs requires PipelineRun name");
-  const result = runRemoteKubectl([
+  const result = await runRemoteKubectl([
     "set -euo pipefail",
     `kubectl get pipelinerun/${shellQuote(name)} -n unidesk-ci -o wide`,
     `kubectl get taskrun -n unidesk-ci -l tekton.dev/pipelineRun=${shellQuote(name)} -o wide`,
-    `for pod in $(kubectl get pods -n unidesk-ci -l tekton.dev/pipelineRun=${shellQuote(name)} -o name); do echo "===== $pod"; kubectl logs -n unidesk-ci "$pod" --all-containers=true --tail=160; done`,
-  ].join("\n"));
+    `for pod in $(kubectl get pods -n unidesk-ci -l tekton.dev/pipelineRun=${shellQuote(name)} -o name); do echo "===== $pod"; kubectl logs -n unidesk-ci "$pod" --all-containers=true --tail=160 || true; done`,
+  ].join("\n"), 60_000, 45_000);
   return {
     ok: true,
     pipelineRun: name,
@@ -314,11 +658,12 @@ function logs(name: string): Record<string, unknown> {
 
 function help(): Record<string, unknown> {
   return {
-    command: "ci install|status|run|logs",
+    command: "ci install|status|run|run-dev-e2e|logs",
     description: "Manage the D601 k3s Tekton CI gate. This intentionally does not deploy CD.",
     examples: [
       "bun scripts/cli.ts ci install",
       "bun scripts/cli.ts ci run --revision <commit>",
+      "bun scripts/cli.ts ci run-dev-e2e --wait-ms 600000",
       "bun scripts/cli.ts ci logs <pipelineRun>",
     ],
     tekton: {
@@ -330,10 +675,22 @@ function help(): Record<string, unknown> {
         interceptors: tektonTriggersInterceptorsUrl,
       },
     },
+    runDevE2E: {
+      defaultTriggerMode: "devops-service",
+      directMaintenanceFlag: "--direct",
+      desiredState: "origin/master:deploy.json#environments.dev",
+    },
   };
 }
 
-export function runCiCommand(_config: UniDeskConfig, args: string[]): Record<string, unknown> {
+function requireRunId(value: string): string {
+  if (!/^[a-z0-9]([-a-z0-9]{0,46}[a-z0-9])?$/u.test(value)) {
+    throw new Error("ci run-dev-e2e run id must be DNS-safe lowercase alnum/dash, max 48 chars");
+  }
+  return value;
+}
+
+export async function runCiCommand(_config: UniDeskConfig, args: string[]): Promise<Record<string, unknown>> {
   const [action = "status", nameArg] = args;
   if (action === "help" || action === "--help" || action === "-h") return help();
   if (action === "install") return install();
@@ -344,8 +701,26 @@ export function runCiCommand(_config: UniDeskConfig, args: string[]): Record<str
     const waitMs = numberOption(args, "--wait-ms", 0);
     return run({ repoUrl, revision, waitMs });
   }
+  if (action === "run-dev-e2e") {
+    const repoUrl = stringOption(args, "--repo") ?? stringOption(args, "--repo-url") ?? "https://github.com/pikasTech/unidesk";
+    const desiredRef = requireDesiredRef(stringOption(args, "--desired-ref") ?? stringOption(args, "--deploy-branch"));
+    const manifest = resolveDeployDevManifest(desiredRef);
+    const waitMs = numberOption(args, "--wait-ms", 0);
+    const runId = requireRunId(stringOption(args, "--run-id") ?? makeRunId(manifest.deployCommit));
+    return runDevE2E({
+      repoUrl,
+      desiredRef,
+      deployCommit: manifest.deployCommit,
+      environment: manifest.environment,
+      services: manifest.services,
+      runId,
+      keepNamespace: boolFlag(args, "--keep-namespace"),
+      waitMs,
+      direct: boolFlag(args, "--direct"),
+    });
+  }
   if (action === "logs") return logs(nameArg ?? "");
-  throw new Error("ci command must be one of: install, status, run, logs");
+  throw new Error("ci command must be one of: install, status, run, run-dev-e2e, logs");
 }
 
 export function startCiInstallJob(): Record<string, unknown> {

scripts/src/deploy.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { runCommand } from "./command";
@@ -18,7 +18,7 @@ interface DeployManifestService {
 }
 
 interface DeployManifest {
-  schemaVersion: 1;
+  schemaVersion: 1 | 2;
   environment: DeployEnvironment | null;
   services: DeployManifestService[];
 }
@@ -131,13 +131,14 @@ const nativeK3sInstallVersion = "v1.34.1+k3s1";
 const nativeK3sImage = "rancher/k3s:v1.34.1-k3s1";
 const nativeK3sCtrAddress = "/run/k3s/containerd/containerd.sock";
 const unideskRepoUrl = "https://github.com/pikasTech/unidesk";
-const devApplySupportedServiceIds = new Set(["backend-core", "frontend", "code-queue"]);
+const d601MaintenanceDeployAllowedServiceIds = new Set(["devops"]);
+const devApplySupportedServiceIds = d601MaintenanceDeployAllowedServiceIds;
 const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironmentTarget> = {
   dev: {
     environment: "dev",
     remote: "origin",
-    branch: "deploy/dev",
-    gitRef: "origin/deploy/dev",
+    branch: "master",
+    gitRef: "origin/master",
     namespace: "unidesk-dev",
     runtimeScope: "d601-k3s-dev",
     database: {
@@ -155,8 +156,8 @@ const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironmentTarge
   prod: {
     environment: "prod",
     remote: "origin",
-    branch: "deploy/prod",
-    gitRef: "origin/deploy/prod",
+    branch: "master",
+    gitRef: "origin/master",
     namespace: "unidesk",
     runtimeScope: "prod-main-server-compose-and-d601-k3s",
     database: {
@@ -194,7 +195,7 @@ function deployHelp(action: string | undefined = undefined): Record<string, unkn
     },
     options: [
       { name: "--file <path>", default: defaultDeployFile, description: "Desired-state manifest path relative to the repo root. JSON and ESM JS manifests are supported, for example deploy.json or develop.js." },
-      { name: "--env <dev|prod>", description: "Read deploy.json from the fixed environment ref: dev=origin/deploy/dev, prod=origin/deploy/prod. Apply is currently enabled for supported dev services only." },
+      { name: "--env <dev|prod>", description: "Read the named environment from origin/master:deploy.json. Direct D601 apply is enabled only for DevOps bootstrap/repair." },
       { name: "--service <id>", description: "Limit reconcile to one service from the manifest." },
       { name: "--dry-run", description: "Prepare and validate without mutating the target service." },
       { name: "--force", description: "Redeploy even when the live commit appears up to date." },
@@ -474,23 +475,42 @@ function parseOptions(args: string[]): DeployOptions {
   };
 }
 
-function positionalArgs(args: string[]): string[] {
-  const result: string[] = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const value = args[index] ?? "";
-    if (value.startsWith("--")) {
-      if (!["--run-now", "--force"].includes(value)) index += 1;
-      continue;
-    }
-    result.push(value);
-  }
-  return result;
+function parseDeployManifestService(item: unknown, index: number, seen: Set<string>, path: string): DeployManifestService {
+  const service = asRecord(item);
+  if (service === null) throw new Error(`deploy manifest ${path}[${index}] must be an object`);
+  const id = asString(service.id);
+  const repo = asString(service.repo);
+  const commitId = asString(service.commitId).toLowerCase();
+  if (id.length === 0) throw new Error(`deploy manifest ${path}[${index}].id must be a non-empty string`);
+  if (repo.length === 0) throw new Error(`deploy manifest ${path}[${index}].repo must be a non-empty string`);
+  if (!/^[0-9a-f]{7,40}$/iu.test(commitId)) throw new Error(`deploy manifest ${path}[${index}].commitId must be a 7-40 char git SHA`);
+  if (seen.has(id)) throw new Error(`duplicate deploy manifest service id: ${id}`);
+  seen.add(id);
+  return { id, repo, commitId };
+}
+
+function parseDeployManifestServices(value: unknown, path: string): DeployManifestService[] {
+  if (!Array.isArray(value)) throw new Error(`deploy manifest ${path} must be an array`);
+  const seen = new Set<string>();
+  return value.map((item, index) => parseDeployManifestService(item, index, seen, path));
 }
 
 function parseDeployManifest(parsed: unknown, source: string, expectedEnvironment: DeployEnvironment | null): DeployManifest {
   const record = asRecord(parsed);
   if (record === null) throw new Error(`deploy manifest ${source} must be an object`);
-  if (record.schemaVersion !== 1) throw new Error("deploy manifest schemaVersion must be 1");
+  if (record.schemaVersion !== 1 && record.schemaVersion !== 2) throw new Error("deploy manifest schemaVersion must be 1 or 2");
+  if (record.schemaVersion === 2) {
+    const environments = asRecord(record.environments);
+    if (environments === null) throw new Error("deploy manifest schemaVersion=2 requires environments");
+    if (expectedEnvironment === null) {
+      const prod = asRecord(environments.prod);
+      if (prod === null) throw new Error("deploy manifest schemaVersion=2 requires environments.prod for local compatibility mode");
+      return { schemaVersion: 2, environment: "prod", services: parseDeployManifestServices(prod.services, "environments.prod.services") };
+    }
+    const envRecord = asRecord(environments[expectedEnvironment]);
+    if (envRecord === null) throw new Error(`deploy manifest ${source} does not contain environments.${expectedEnvironment}`);
+    return { schemaVersion: 2, environment: expectedEnvironment, services: parseDeployManifestServices(envRecord.services, `environments.${expectedEnvironment}.services`) };
+  }
   const rawEnvironment = record.environment;
   let environment: DeployEnvironment | null = null;
   if (rawEnvironment !== undefined) {
@@ -505,22 +525,7 @@ function parseDeployManifest(parsed: unknown, source: string, expectedEnvironmen
       throw new Error(`deploy manifest ${source} declares environment=${environment}, refusing --env ${expectedEnvironment}`);
     }
   }
-  if (!Array.isArray(record.services)) throw new Error("deploy manifest services must be an array");
-  const seen = new Set<string>();
-  const services = record.services.map((item, index) => {
-    const service = asRecord(item);
-    if (service === null) throw new Error(`deploy manifest services[${index}] must be an object`);
-    const id = asString(service.id);
-    const repo = asString(service.repo);
-    const commitId = asString(service.commitId).toLowerCase();
-    if (id.length === 0) throw new Error(`deploy manifest services[${index}].id must be a non-empty string`);
-    if (repo.length === 0) throw new Error(`deploy manifest services[${index}].repo must be a non-empty string`);
-    if (!/^[0-9a-f]{7,40}$/iu.test(commitId)) throw new Error(`deploy manifest services[${index}].commitId must be a 7-40 char git SHA`);
-    if (seen.has(id)) throw new Error(`duplicate deploy manifest service id: ${id}`);
-    seen.add(id);
-    return { id, repo, commitId };
-  });
-  return { schemaVersion: 1, environment, services };
+  return { schemaVersion: 1, environment, services: parseDeployManifestServices(record.services, "services") };
 }
 
 function readEnvironmentDeployManifest(environment: DeployEnvironment): { manifest: DeployManifest; source: DeployEnvironmentManifestSource } {
@@ -535,8 +540,9 @@ function readEnvironmentDeployManifest(environment: DeployEnvironment): { manife
   const blob = runGitOrThrow(["rev-parse", `${target.gitRef}:deploy.json`], repoRoot, `failed to resolve ${target.gitRef}:deploy.json`).stdout.trim().toLowerCase();
   if (!/^[0-9a-f]{40}$/iu.test(blob)) throw new Error(`failed to resolve a deploy.json blob for ${target.gitRef}`);
   const raw = runGitOrThrow(["show", `${target.gitRef}:deploy.json`], repoRoot, `failed to read ${target.gitRef}:deploy.json`).stdout;
+  const manifest = parseDeployManifest(JSON.parse(raw) as unknown, `${target.gitRef}:deploy.json#environments.${environment}`, environment);
   return {
-    manifest: parseDeployManifest(JSON.parse(raw) as unknown, `${target.gitRef}:deploy.json`, environment),
+    manifest,
     source: {
       source: "git-ref",
       path: "deploy.json",
@@ -659,6 +665,20 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
       allowedMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"],
       allowedPathPrefixes: ["/", "/api/", "/logs"],
     },
+    devops: {
+      name: "UniDesk DevOps Control",
+      description: "D601 k3s-managed DevOps control plane for normal CI trigger/status/log paths.",
+      dockerfile: "src/components/microservices/devops/Dockerfile",
+      composeFile: "src/components/microservices/k3sctl-adapter/k3s/devops.k3s.json",
+      composeService: "devops",
+      containerName: "k3s:devops",
+      nodeBaseUrl: "k3s://devops",
+      nodePort: 4286,
+      healthPath: "/health",
+      route: "/devops",
+      allowedMethods: ["GET", "HEAD", "POST"],
+      allowedPathPrefixes: ["/health", "/live", "/logs", "/api/"],
+    },
   };
   const spec = specs[id];
   if (spec === undefined) return undefined;
@@ -669,7 +689,7 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
     description: spec.description,
     repository: {
       url: unideskRepoUrl,
-      commitId: "deploy-dev",
+      commitId: "deploy-env",
       dockerfile: spec.dockerfile,
       composeFile: spec.composeFile,
       composeService: spec.composeService,
@@ -677,9 +697,9 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
     },
     backend: {
       nodeBaseUrl: spec.nodeBaseUrl,
-      nodeBindHost: `k3s://unidesk-dev/${spec.composeService}`,
+      nodeBindHost: `k3s://${id === "devops" ? "unidesk-ci" : "unidesk-dev"}/${spec.composeService}`,
       nodePort: spec.nodePort,
-      proxyMode: "dev-k3s-direct",
+      proxyMode: id === "devops" ? "k3sctl-adapter-http" : "dev-k3s-direct",
       frontendOnly: true,
       public: false,
       allowedMethods: spec.allowedMethods,
@@ -691,14 +711,16 @@ function devK3sDeployService(id: string): UniDeskMicroserviceConfig | undefined
       mode: "k3sctl-managed",
       adapterServiceId: "k3sctl-adapter",
       k3sServiceId: spec.composeService,
-      namespace: "unidesk-dev",
+      namespace: id === "devops" ? "unidesk-ci" : "unidesk-dev",
       expectedNodeIds: ["D601"],
       activeNodeId: "D601",
     },
     development: {
       providerId: "D601",
       sshPassthrough: true,
-      worktreePath: id === "code-queue"
+      worktreePath: id === "devops"
+        ? "/home/ubuntu/.unidesk/devops-deploy"
+        : id === "code-queue"
         ? "/home/ubuntu/unidesk-dev-code-queue-deploy/code-queue"
         : `/home/ubuntu/unidesk-dev-core-deploy/${id}`,
     },
@@ -721,10 +743,15 @@ function isCoreDeployService(service: UniDeskMicroserviceConfig): boolean {
 
 function isDevK3sDeployService(service: UniDeskMicroserviceConfig): boolean {
   return service.deployment.mode === "k3sctl-managed"
-    && service.deployment.namespace === deployEnvironmentTargets.dev.namespace
     && devApplySupportedServiceIds.has(service.id);
 }
 
+function isD601MaintenanceDeployBlocked(service: UniDeskMicroserviceConfig): boolean {
+  if (targetIsMain(service)) return false;
+  if (service.providerId !== "D601") return false;
+  return !d601MaintenanceDeployAllowedServiceIds.has(service.id);
+}
+
 function isDirectComposeDeployMode(service: UniDeskMicroserviceConfig): boolean {
   return service.deployment.mode === "unidesk-direct" || service.deployment.mode === "internal-sidecar";
 }
@@ -992,6 +1019,12 @@ function dockerBuildTimeoutMs(service: UniDeskMicroserviceConfig, options: Deplo
   return Math.min(options.timeoutMs, maxBuildMs);
 }
 
+function devK3sPrepullImages(service: UniDeskMicroserviceConfig): string[] {
+  if (!isDevK3sDeployService(service)) return [];
+  if (service.id === "devops") return ["golang:1.23-bookworm", "debian:bookworm-slim"];
+  return ["oven/bun:1-alpine"];
+}
+
 function prepareSourceScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, exportDir: string): string {
   if (targetIsMain(service) && isUnideskRepo(desired.repo)) {
     return [
@@ -1172,11 +1205,11 @@ function buildImageScript(service: UniDeskMicroserviceConfig, desired: DeployMan
     "if ! docker buildx version >/dev/null 2>&1; then",
     "  if ! docker buildx inspect default >/dev/null 2>&1; then echo target_build_builder=missing >&2; exit 1; fi",
     "fi",
-    ...(isDevK3sDeployService(service) ? [
-      "if ! docker image inspect oven/bun:1-alpine >/dev/null 2>&1; then",
-      "  docker pull oven/bun:1-alpine",
+    ...devK3sPrepullImages(service).flatMap((imageName) => [
+      `if ! docker image inspect ${shellQuote(imageName)} >/dev/null 2>&1; then`,
+      `  docker pull ${shellQuote(imageName)}`,
       "fi",
-    ] : []),
+    ]),
     "builder_args=()",
     "if docker buildx inspect --builder default >/dev/null 2>&1; then builder_args=(--builder default); echo target_build_builder=default; else echo target_build_builder=implicit; fi",
     "docker buildx inspect \"${builder_args[@]}\" --bootstrap || true",
@@ -1218,9 +1251,9 @@ function patchDevK3sManifestScript(service: UniDeskMicroserviceConfig, desired:
     "    raise SystemExit(f'dev service {service_id}/{deployment_name} not found in {path}')",
     "patched = []",
     "for segment in kept:",
-    "    segment = segment.replace('unidesk.ai/image-source: deploy-dev-commit', 'unidesk.ai/image-source: deploy-env-commit')",
+    "    segment = segment.replace('unidesk.ai/image-source: deploy-env-commit', 'unidesk.ai/image-source: deploy-env-commit')",
     "    segment = re.sub(r'image: unidesk-[^\\n]+:dev-placeholder', f'image: {image}', segment)",
-    "    segment = re.sub(r'value: replace-with-deploy-dev-commit', f'value: {commit}', segment)",
+    "    segment = re.sub(r'value: replace-with-deploy-env-commit', f'value: {commit}', segment)",
     "    segment = segment.replace('value: https://github.com/pikasTech/unidesk', f'value: {repo}')",
     "    patched.append(segment.strip() + '\\n')",
     "out = '---\\n'.join(patched)",
@@ -2148,6 +2181,15 @@ async function ensureGithubSshIdentityStep(config: UniDeskConfig, service: UniDe
 async function applyOneService(config: UniDeskConfig, service: UniDeskMicroserviceConfig, desired: DeployManifestService, options: DeployOptions): Promise<Record<string, unknown>> {
   const steps: StepResult[] = [];
   const startedAt = nowIso();
+  if (!options.dryRun && isD601MaintenanceDeployBlocked(service)) {
+    return {
+      ok: false,
+      serviceId: service.id,
+      skipped: true,
+      reason: `D601 maintenance-channel direct deployment is allowed only for ${[...d601MaintenanceDeployAllowedServiceIds].join(", ")} bootstrap/repair. Deploy ${service.id} through the DevOps control plane instead.`,
+      steps,
+    };
+  }
   const reason = unsupportedReason(service);
   if (reason !== null) return { ok: false, serviceId: service.id, skipped: true, reason, steps };
   const before = await readRuntimeState(config, service, desired);
@@ -2274,6 +2316,7 @@ function environmentDryRunPlan(
     mutatesRuntime: false,
     environment,
     gitRef: source.ref,
+    environmentPath: `environments.${environment}`,
     manifest: {
       source: source.source,
       path: source.path,
@@ -2283,6 +2326,7 @@ function environmentDryRunPlan(
       commit: source.commit,
       blob: source.blob,
       environment: manifest.environment,
+      environmentPath: `environments.${environment}`,
       fetchedAt: source.fetchedAt,
     },
     target: environmentTargetSummary(target),
@@ -2309,6 +2353,17 @@ function unsupportedDevApplyServices(manifest: DeployManifest, serviceId: string
   return services.map((service) => service.id).filter((id) => !devApplySupportedServiceIds.has(id));
 }
 
+function blockedD601MaintenanceDeployServices(config: UniDeskConfig, manifest: DeployManifest, serviceId: string | null): string[] {
+  return selectServices(config, manifest, serviceId)
+    .map((item) => item.config)
+    .filter(isD601MaintenanceDeployBlocked)
+    .map((service) => service.id);
+}
+
+function d601MaintenanceDeployBlockMessage(blocked: string[]): string {
+  return `D601 maintenance-channel direct deployment is allowed only for ${[...d601MaintenanceDeployAllowedServiceIds].join(", ")} bootstrap/repair; blocked services: ${blocked.join(", ")}. Use the DevOps control plane for other direct/managed microservices.`;
+}
+
 async function runApplyNow(config: UniDeskConfig, manifest: DeployManifest, options: DeployOptions): Promise<Record<string, unknown>> {
   const selected = selectServices(config, manifest, options.serviceId);
   const startedAt = nowIso();
@@ -2333,7 +2388,7 @@ async function runApplyNow(config: UniDeskConfig, manifest: DeployManifest, opti
 function applyJob(config: UniDeskConfig, args: string[], options: DeployOptions): Record<string, unknown> {
   const runArgs = args.includes("--run-now") ? args : [...args, "--run-now"];
   const command = [process.execPath, rootPath("scripts", "cli.ts"), "deploy", ...runArgs];
-  const source = options.environment === null ? options.file : `${deployEnvironmentTargets[options.environment].gitRef}:deploy.json`;
+  const source = options.environment === null ? options.file : `${deployEnvironmentTargets[options.environment].gitRef}:deploy.json#environments.${options.environment}`;
   const job = startJob("deploy_apply", command, `Reconcile services from ${source}${options.serviceId === null ? "" : ` service=${options.serviceId}`}`);
   return {
     ok: true,
@@ -2361,40 +2416,27 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
       throw new Error(`deploy apply --env dev currently supports only ${[...devApplySupportedServiceIds].join(", ")}; unsupported selected services: ${unsupported.join(", ")}`);
     }
     if (config === null) throw new Error("deploy apply --env dev requires config.json");
+    if (!options.dryRun) {
+      const blocked = blockedD601MaintenanceDeployServices(config, manifest, options.serviceId);
+      if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));
+    }
     if (!options.runNow) return applyJob(config, args, options);
     return await runApplyNow(config, manifest, options);
   }
   if (config === null) throw new Error("deploy local manifest mode requires config.json");
   const manifest = resolveManifestCommits(await readDeployManifest(options.file), options.serviceId);
   if (action === "check" || action === "plan") return await checkOrPlan(config, manifest, options, action);
+  if (!options.dryRun) {
+    const blocked = blockedD601MaintenanceDeployServices(config, manifest, options.serviceId);
+    if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));
+  }
   if (!options.runNow) return applyJob(config, args, options);
   return await runApplyNow(config, manifest, options);
 }
 
-export async function runCodeQueueDeployCompatCommand(config: UniDeskConfig, args: string[]): Promise<unknown> {
-  if (args.includes("--skip-build")) throw new Error("codex deploy no longer supports --skip-build; target-side Docker build is mandatory");
+export async function runCodeQueueDeployCompatCommand(_config: UniDeskConfig, args: string[]): Promise<unknown> {
+  if (args.includes("--skip-build")) throw new Error("codex deploy is disabled; --skip-build is not supported");
   const providerId = optionValue(args, ["--provider-id", "--provider"]) ?? "D601";
   if (providerId !== "D601") throw new Error(`codex deploy compatibility path only supports D601; got ${providerId}`);
-  const commitId = optionValue(args, ["--commit", "--commit-id"]) ?? positionalArgs(args)[0] ?? "";
-  if (!/^[0-9a-f]{7,40}$/iu.test(commitId)) throw new Error("codex deploy requires a 7-40 char commit id");
-  const service = config.microservices.find((item) => item.id === "code-queue");
-  if (service === undefined) throw new Error("config.json does not contain microservice id=code-queue");
-  const manifestRelDir = join(".state", "deploy", "manifests");
-  mkdirSync(rootPath(manifestRelDir), { recursive: true });
-  const manifestRelPath = join(manifestRelDir, `code-queue-${commitId.toLowerCase()}.json`);
-  writeFileSync(rootPath(manifestRelPath), `${JSON.stringify({
-    schemaVersion: 1,
-    services: [{ id: "code-queue", repo: service.repository.url, commitId: commitId.toLowerCase() }],
-  }, null, 2)}\n`, "utf8");
-  const deployArgs = [
-    "apply",
-    "--file",
-    manifestRelPath,
-    "--service",
-    "code-queue",
-    ...(args.includes("--run-now") ? ["--run-now"] : []),
-    ...(args.includes("--force") ? ["--force"] : []),
-    ...(optionValue(args, ["--timeout-ms"]) === undefined ? [] : ["--timeout-ms", optionValue(args, ["--timeout-ms"]) as string]),
-  ];
-  return await runDeployCommand(config, deployArgs);
+  throw new Error("codex deploy is disabled because D601 maintenance-channel direct deployment is now reserved for DevOps bootstrap/repair. Use the DevOps control plane for Code Queue deployment.");
 }