Named-policy route ignores `TERMINALS_KUBERNETES_IMAGE`: `merge_policy_defaults` injects `TERMINALS_IMAGE` (default `:latest`) into every policy spec

Version: terminals 0.2.4 (unchanged on main) · backend kubernetes-operator · installed via the terminals Helm chart 0.7.0, which sets only TERMINALS_KUBERNETES_IMAGE

What happens

terminals/utils/policy_specs.py:

def merge_policy_defaults(policy_data: dict) -> dict:
    defaults = {}
    if settings.image:               # default "ghcr.io/open-webui/open-terminal:latest" — always truthy
        defaults["image"] = settings.image
    return {**defaults, **{k: v for k, v in policy_data.items() if v is not None}}

and backends/kubernetes_operator.py:

image = s.get("image", settings.effective_kubernetes_image)

effective_kubernetes_image (kubernetes_image or image) is only consulted when the spec has no image — but for any request through /p/<policy> the spec always has one, because the merge put settings.image there. So:

• plain route → TERMINALS_KUBERNETES_IMAGE (pinned by the chart) ✔
• /p/<policy> route, policy without image → TERMINALS_IMAGE → open-terminal:latest ✘

The Helm chart never sets TERMINALS_IMAGE, so every chart user who adopts a policy (the only way to get persistence) silently runs an unpinned image. Observed: first policy-provisioned pod pulled open-terminal:latest while terminalImage was pinned to 0.12.5.

Expected

merge_policy_defaults (or _create_terminal_cr) should default to settings.effective_kubernetes_image on the kubernetes backends, i.e. kubernetes_image must win over image when the policy itself does not set one. A policy-set image should of course still override both.

Workaround

Set TERMINALS_IMAGE to the same value as TERMINALS_KUBERNETES_IMAGE (chart: orchestrator.extraEnvVars).

Start in terminals/utils/policy_specs.py at merge_policy_defaults and compare its output with the fallback in backends/kubernetes_operator.py. Trace the named-policy and plain routes, then verify that a policy image still wins while an omitted policy image uses the effective Kubernetes image; confirm the behavior with the relevant policy and Kubernetes backend tests.