From 1c9be5229141eadef2e6caa7b265c5ae1cdb9dd3 Mon Sep 17 00:00:00 2001 From: Omar Sobh Date: Fri, 18 Sep 2026 12:26:49 -0500 Subject: [PATCH] build(runtime): pin Claude Code 2.1.276 and Kimi 0.41.0; missions run the image we ship MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two things found while asking "what version of Claude Code do missions run?" Mission containers are created from CLAWMATES_RUNTIME_IMAGE, which on both stacks still pointed at clawmates-runtime:hooks — zeroclaw 0.8.4, Claude Code 2.1.237 (2.1.228 locally), built 2026-08-21. The v0.8.5 upgrade on 09-06 rebuilt only the persistent clawmates-runtime container, which container-tier missions do not drive their turns through. Every measured mission this month ran on 0.8.4/2.1.237; the measurements stand (one image throughout) but the version attached to them in the handoff and in memory was wrong, and has been corrected there. The drift itself came from `npm install -g @anthropic-ai/claude-code` with no version: each rebuild takes whatever npm has that day, so two builds three weeks apart shipped two CLIs and nothing recorded either. The changelog shows why that is not merely untidy — 2.1.265 and 2.1.275 each broke every turn on ANTHROPIC_BASE_URL endpoints, the path the GLM and Kimi backends use — and today's floating local build silently took Kimi 2.0.1, a major version. Both are ARGs now, defaulting to what was verified. Verified before promoting: two local missions on 0.8.5 + 2.1.276 — tool arguments recorded on 40/40 and 123/123 calls, gate.installed, skill reads, judge met and independent with the correction loop closing, spend rows with provider and model, and with delegation forced, 4 Agent spawns → 45 subagent calls across 4 ids all typed general-purpose (44/4 on the old CLI). The hook payload did not move. Prod's .env now names clawmates-runtime:v085-cc276, built on tank from the fork at 57635deb with this Dockerfile. The local override's CLAWMATES_RUNTIME_IMAGE points at :toolchain, which is the same lineage plus cmake/python3-dev for `cargo test` on cmake-driven deps. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz --- deploy/clawmates-runtime/Dockerfile | 13 ++++++++++++- deploy/compose/docker-compose.override.yml | 2 +- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/deploy/clawmates-runtime/Dockerfile b/deploy/clawmates-runtime/Dockerfile index 9feaa8b..ed776f3 100644 --- a/deploy/clawmates-runtime/Dockerfile +++ b/deploy/clawmates-runtime/Dockerfile @@ -31,10 +31,21 @@ FROM debian:bookworm-slim # on it too) to install BOTH agent CLIs that the subprocess providers spawn: # `claude -p` (claude_cli, Claude subscription) and `kimi -p` (kimi_cli, Kimi # membership) — subscription-backed, no per-minute API TPM ceiling. +# PINNED. These two binaries are what every mission agent runs, and an +# unpinned install takes whatever npm has on build day: prod's mission image +# (`:hooks`, built 2026-08-21) carried Claude Code 2.1.237 for a month while the +# persistent runtime, rebuilt on 2026-09-06, got 2.1.263 — two versions in one +# deployment and nothing recording either. Worse, 2.1.265 and 2.1.275 each +# broke every turn on ANTHROPIC_BASE_URL endpoints (HTTP 400), which is how the +# GLM and Kimi backends reach `claude`; a rebuild landing on either day would +# have shipped that silently. Bump these on purpose, run a mission on the +# result (attribution, gate, tap, skills, judge), then promote. +ARG CLAUDE_CODE_VERSION=2.1.276 +ARG KIMI_CODE_VERSION=0.41.0 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg git \ && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y --no-install-recommends nodejs \ - && npm install -g @anthropic-ai/claude-code @moonshot-ai/kimi-code \ + && npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} @moonshot-ai/kimi-code@${KIMI_CODE_VERSION} \ && npm cache clean --force \ && rm -rf /var/lib/apt/lists/* /root/.npm diff --git a/deploy/compose/docker-compose.override.yml b/deploy/compose/docker-compose.override.yml index b5fbe6c..467b7d2 100644 --- a/deploy/compose/docker-compose.override.yml +++ b/deploy/compose/docker-compose.override.yml @@ -156,7 +156,7 @@ services: # the agents build the user's repo inside them. The built-in default is # `clawmates-runtime:sync` (mission_runtime.rs DEFAULT_IMAGE), which has # no cmake, so a coding phase could not compile clawhdf5 at all. - CLAWMATES_RUNTIME_IMAGE: clawmates-runtime:hooks + CLAWMATES_RUNTIME_IMAGE: clawmates-runtime:toolchain # Per-mission containers default to forwarding ANTHROPIC_API_KEY, which is # dead here ("credit balance is too low"). Claude Code ranks that key ABOVE # the subscription token, so forwarding it doesn't just fail — it WINS over