Omar Sobh
11b274edc6
Reviewed the changelog rather than bumping on principle. 2.1.220 → 2.1.223 for one
reason that bears on how we use subagents:
2.1.222 — "Fixed PreToolUse auto-allow hooks bypassing tool restrictions in
background agent tasks."
Subagents run in the background by default since 2.1.198, and the `verifier`
role's entire guarantee is a TOOL restriction — no Edit, no Write. So on 2.1.220
the one property we rely on was the one that bug could undo. 2.1.221 also fixes
`--mcp-config` servers not connecting before the first turn in print mode, which
is the mode we run and will matter when the MCP door reaches a VM.
Two findings from the changelog that we already had at 2.1.220, both worth knowing:
- 2.1.219: subagents can nest to depth 3 (was 1), so our roles can delegate
further than assumed.
- 2.1.212: a subagent inherits the parent's permission mode, which confirms the
verifier's read-only property must come from `tools` and not from permissions.
That is how it was written; now the reasoning is recorded next to it.
And a correctness fix that follows from the background default: the verifier is now
`background: false`. A background verifier lets the lead carry on and write its
report before the check has finished — the finding would arrive after the
conclusion it was supposed to inform.
Verified on tank: image reports 2.1.223, rootfs rebuilt, `--vm-selftest` all green
including a real agent turn on subscription auth, egress allow and deny both firing.
49 lines
2.5 KiB
Docker
49 lines
2.5 KiB
Docker
# Plan A6, first of three: one image per agent CLI, independently versioned.
|
|
#
|
|
# Everything shared lives in agent-toolchain (git, node, rust, scanners, tea).
|
|
# This layer is only the CLI and its env contract, so bumping Claude Code does
|
|
# not rebuild 3 GB of toolchain and cannot disturb agent-kimi / agent-glm.
|
|
#
|
|
# Build (on the node that will run it — see agent-toolchain for why this is not
|
|
# in AGENT_IMAGES):
|
|
#
|
|
# ssh osobh@tank "cd ~/clawmates && \
|
|
# docker build -f images/agent-toolchain/Dockerfile -t clawmates/agent-toolchain:dev images/agent-toolchain/ && \
|
|
# docker build -f images/agent-claude/Dockerfile -t clawmates/agent-claude:dev images/agent-claude/"
|
|
#
|
|
# Then turn it into a microVM rootfs and prove a VM boots from it:
|
|
#
|
|
# scripts/fc-build-rootfs.sh osobh@tank clawmates/agent-claude:dev claude 8G
|
|
FROM clawmates/agent-toolchain:dev
|
|
|
|
# Pinned: an unpinned `npm i -g` makes the image's behaviour depend on the day
|
|
# it was built, and a mission that regresses would have no version to compare.
|
|
#
|
|
# 2.1.223, up from 2.1.220, for one reason that matters to how we use subagents:
|
|
# 2.1.222 "Fixed PreToolUse auto-allow hooks bypassing tool restrictions in
|
|
# background agent tasks". Subagents run in the background by default since
|
|
# 2.1.198, and our `verifier` role's whole guarantee is a TOOL RESTRICTION — no
|
|
# Edit, no Write — so on 2.1.220 the one property we rely on was the one the bug
|
|
# could undo. 2.1.221 also fixes `--mcp-config` servers not connecting before the
|
|
# first turn in print mode, which is exactly the mode we run and will matter when
|
|
# the MCP door reaches a VM.
|
|
ARG CLAUDE_CODE_VERSION=2.1.223
|
|
RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /root/.npm \
|
|
&& claude --version
|
|
|
|
# The CLI reads its credentials from $HOME/.claude. On the container path HOME is
|
|
# /zeroclaw-data because the daemon owns it; here there is no daemon, so HOME is
|
|
# just root's home. Credential injection (B4.4) writes into this directory over
|
|
# vsock at VM start so the credentials live and die with the VM and are never
|
|
# baked into the image.
|
|
ENV HOME=/root \
|
|
CLAWMATES_AGENT_CLI=claude
|
|
RUN mkdir -p /root/.claude
|
|
|
|
# No ANTHROPIC_API_KEY, and none is accepted: this backend authenticates by
|
|
# subscription via CLAUDE_CODE_OAUTH_TOKEN. An API key present in the
|
|
# environment silently overrides the subscription OAuth (fixed once already,
|
|
# task #16) and would bill per-token against a plan we already pay for.
|