@valescoagency/runway 0.14.0 → 0.14.1

package/README.md

@@ -541,7 +541,7 @@ These are tractable, just not v1.
 
 ## Status
 
-0.14.0 — production-shaped and dogfooded against live Linear queues.
+0.14.1 — production-shaped and dogfooded against live Linear queues.
 The end-to-end pipeline (init → run → review → PR) is stable; surface
 may still shift as the orchestrator's policy and iteration mechanics
 mature. See [CHANGELOG.md](./CHANGELOG.md) for per-release detail.

package/dist/repo-upgrade.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { AUTH_MODE_ENV_VAR, TEMPLATES_DIR, } from "./scaffolder.js";
 import { buildAgentImage } from "./scaffolder-image.js";
@@ -80,7 +80,36 @@ export function parseOpRefs(schema, opts) {
 // ---------------------------------------------------------------------------
 // Render: Dockerfile
 // ---------------------------------------------------------------------------
-function renderDockerfile(cwd, tier, opts, enforceManualEditGuard) {
+/**
+ * VA-466: read every historical snapshot under `templates/history/`
+ * that matches the base Dockerfile naming pattern, flatten them to
+ * the set of lines that have ever shipped as canonical content.
+ *
+ * Files are named `Dockerfile.claude-code.base.v<n>` (where `<n>` is
+ * the runway version that owned that exact content). The detector
+ * doesn't care about version ordering — it just needs the union of
+ * lines so a target Dockerfile rendered at any prior version doesn't
+ * trigger false-positive "manual edit" reports.
+ *
+ * Missing or empty `history/` directory returns an empty list — both
+ * are valid states (a fresh checkout that hasn't accumulated history
+ * yet, or a tier-1 repo whose template never changed).
+ */
+function historicalBaseTemplateLines() {
+    const historyDir = join(TEMPLATES_DIR, "history");
+    if (!existsSync(historyDir))
+        return [];
+    const out = [];
+    for (const name of readdirSync(historyDir)) {
+        if (!name.startsWith("Dockerfile.claude-code.base"))
+            continue;
+        const contents = readFileSync(join(historyDir, name), "utf8");
+        for (const line of contents.split("\n"))
+            out.push(line);
+    }
+    return out;
+}
+export function renderDockerfile(cwd, tier, opts, enforceManualEditGuard) {
     const dockerfilePath = join(cwd, ".sandcastle", "Dockerfile");
     const before = readFileSync(dockerfilePath, "utf8");
     const base = readFileSync(join(TEMPLATES_DIR, "Dockerfile.claude-code.base"), "utf8");
@@ -98,8 +127,22 @@ function renderDockerfile(cwd, tier, opts, enforceManualEditGuard) {
     }
     // Detect manual user edits: any line in `before` that isn't in the
     // expected re-rendered output is foreign. Warn loudly unless --force.
+    //
+    // VA-466: expectedLines unions the current template with every
+    // historical canonical template snapshot under `templates/history/`.
+    // Without this, a target repo's Dockerfile rendered by an older
+    // runway version flags every cross-version line delta as a "manual
+    // edit" — false-positive that forces operators to pass `--force`
+    // and lose the detector's real signal. Each release that mutates
+    // `Dockerfile.claude-code.base` snapshots the prior version into
+    // `templates/history/Dockerfile.claude-code.base.v<n>` BEFORE the
+    // edit lands; the detector unions all of them so any line that
+    // ever shipped as canonical stays trusted.
     if (before !== after && !opts.force && enforceManualEditGuard) {
         const expectedLines = new Set(after.split("\n"));
+        for (const line of historicalBaseTemplateLines()) {
+            expectedLines.add(line);
+        }
         const foreign = before
             .split("\n")
             .filter((l) => l.trim().length && !expectedLines.has(l));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valescoagency/runway",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Linear-driven orchestrator + scaffolder for coding agents on Sandcastle. `runway init` scaffolds a target repo (sandcastle + varlock + 1Password); `runway run` drains a Linear queue against it; `runway doctor`, `runway upgrade`, `runway upgrade-repo` round out the lifecycle.",
   "license": "MIT",
   "author": {

package/templates/history/Dockerfile.claude-code.base.v0.13.0

@@ -0,0 +1,79 @@
+# Canonical claude-code Dockerfile — vendored from
+# @ai-hero/sandcastle's InitService.ts (CLAUDE_CODE_DOCKERFILE constant).
+# Kept here so `runway init` can write it directly, without invoking
+# `sandcastle init` (which has interactive prompts that hang in
+# non-TTY environments like CI / Mac Mini cron).
+#
+# Drift policy: when sandcastle bumps its claude-code Dockerfile,
+# refresh this file. The diff should be tiny — runway's tier 2 layer
+# patches AFTER this base, so adopters re-run `runway init --force`
+# to roll forward.
+
+FROM node:24-bookworm
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+  git \
+  curl \
+  jq \
+  && rm -rf /var/lib/apt/lists/*
+
+# Build-args for UID/GID alignment: defaults match the host user's
+# UID/GID at build time so image-built files and bind-mounted files
+# share an owner without runtime chown.
+ARG AGENT_UID=1000
+ARG AGENT_GID=1000
+
+# Rename the base image's "node" user to "agent" and align UID/GID.
+#
+# Divergence from sandcastle's stock Dockerfile: stock runs
+# `groupmod -g $AGENT_GID node` unconditionally, which fails on macOS
+# hosts where the host GID is 20 (`staff`) — Debian's `dialout` group
+# already has GID 20, and `groupmod` refuses to assign a duplicate
+# GID. We guard with `getent group` so groupmod only runs if the
+# target GID is unused; if it's already taken, we point the agent
+# user at the pre-existing group via `usermod -g <gid>` and the
+# image still works (the in-image group name is irrelevant — only the
+# numeric GID matters for bind-mount permissions).
+RUN if ! getent group $AGENT_GID >/dev/null; then \
+      groupmod -g $AGENT_GID node; \
+    fi \
+ && usermod -u $AGENT_UID -g $AGENT_GID -d /home/agent -m -l agent node
+
+# VA-351: bake the container env up front so agents don't manually
+# work around host-path leaks, missing pnpm, or unset HOME on every
+# iteration. Without these, every agent run repeats the same
+# corepack/TURBO_CACHE_DIR/HOME setup commands — see VA-312's run log
+# for the receipts.
+ENV HOME=/home/agent
+ENV XDG_CACHE_HOME=/home/agent/.cache
+ENV TURBO_CACHE_DIR=/tmp/turbo-cache
+ENV pnpm_config_cache=/home/agent/.cache/pnpm
+
+# Pre-create cache dirs with agent ownership so the first pnpm/turbo
+# run doesn't have to chown them. Both are inside paths the agent owns
+# anyway; this just makes them exist.
+RUN mkdir -p /home/agent/.cache /home/agent/.cache/pnpm /tmp/turbo-cache \
+ && chown -R $AGENT_UID:$AGENT_GID /home/agent/.cache /tmp/turbo-cache
+
+# Bake pnpm via corepack at build time so `pnpm` is on PATH inside the
+# container before any agent command runs. Pin a default; target repos
+# can override at runtime via `packageManager` in package.json +
+# `corepack use`.
+RUN corepack enable \
+ && corepack prepare pnpm@11.1.1 --activate
+
+USER ${AGENT_UID}:${AGENT_GID}
+
+# Install Claude Code CLI
+RUN curl -fsSL https://claude.ai/install.sh | bash
+
+# Add Claude to PATH
+ENV PATH="/home/agent/.local/bin:$PATH"
+
+WORKDIR /home/agent
+
+# In worktree sandbox mode, Sandcastle bind-mounts the git worktree at
+# the sandbox repo dir and overrides the working directory to that dir
+# at container start.
+ENTRYPOINT ["sleep", "infinity"]