smol-symphony 0.2.0 → 0.3.1

package/assets/symphony-mise.system.toml

@@ -0,0 +1,68 @@
+# Symphony-bundled mise (jdx/mise) SYSTEM config — issue 209.
+#
+# The orchestrator stages this file into EVERY agent VM at /etc/mise/config.toml
+# (mise's SYSTEM config = LOWEST precedence; applies everywhere, overridable per
+# project). It is the SINGLE source of truth for the agent runtime (node) + the ACP
+# agent CLIs — read off the host's OWN disk at boot and staged per-dispatch (like the
+# vm-agent launcher), so it is decoupled from the image digest. Bump a pin HERE and
+# restart symphony; NO `npm run build:image` + digest repin is needed. That decoupling
+# is the whole point of issue 209: agent-CLI versioning is no longer coupled to the
+# base image.
+#
+# Pins MUST match the versions the host ACP transport speaks. ALL agent CLIs are
+# pinned DELIBERATELY: an unpinned bump can silently change codex's Responses-API
+# transport, opencode's acp/custom-provider behavior, or Claude Code's model-stream
+# handling (an unpinned claude-code 2.1.156 -> 2.1.160 once stalled dispatches mid-turn,
+# idle on the /v1/messages stream until the stall reaper killed them). Bump these
+# consciously, not by drift.
+#
+# node stays >= 21: the in-VM launcher needs the global WHATWG WebSocket. The agent
+# runtime node is resolved system-scoped (`mise which node` from `/`), so a consuming
+# repo's mise.toml can override `node` for the PROJECT's build/test (the workspace
+# shims) WITHOUT downgrading the agent itself.
+#
+# A consuming repo's own mise.toml / .tool-versions (HIGHER precedence) ADDS project
+# toolchains (rust, go, kotlin+gradle, a different node, ...) on top of this set;
+# `mise install` with cwd = workspace installs the MERGED system + project tool set
+# into the shared, home-based, warm-cached data dir.
+#
+# The `npm:` backend installs an npm package and exposes its bins as mise shims; node
+# comes from mise's core node backend (nodejs.org prebuilts).
+#
+# ── npm lifecycle scripts (load-bearing — issue 209 review) ──────────────────────
+# mise's `npm:` backend installs with `--ignore-scripts=true` by DEFAULT (a supply-
+# chain hardening default; see mise.jdx.dev/dev-tools/backends/npm). That SUPPRESSES
+# the package `postinstall` hooks that some agent CLIs use to materialize their native
+# binary, so a plain string pin would `mise install` cleanly but then fail at RUNTIME
+# when the CLI tries to exec a missing/stub binary. Two of our pins ship a native
+# binary via a `postinstall` (verified against the registry metadata for the pinned
+# versions):
+#   • @anthropic-ai/claude-code  → "postinstall": "node install.cjs"   (bin: claude.exe)
+#   • opencode-ai                → "postinstall": "node ./postinstall.mjs" (bin: opencode.exe)
+# @openai/codex + @zed-industries/codex-acp ship their native binary via
+# optionalDependencies platform packages resolved at runtime by a JS bin shim
+# (bin/codex.js, bin/codex-acp.js) and declare NO install script; they don't strictly
+# need scripts, but we enable them UNIFORMLY across the native-binary CLIs so the
+# contract is robust to version drift and to the platform packages' own install steps.
+# @agentclientprotocol/claude-agent-acp is pure JS (ships dist/) with no native binary
+# and no install hook, so it stays a plain pin.
+#
+# Opting back in uses the per-tool `npm_args = "--ignore-scripts=false"` option, which
+# ONLY takes effect when npm is the active package manager — hence the explicit
+# `[settings.npm] package_manager = "npm"` below. `auto` (the default) would fall back
+# to npm TODAY (the base image ships no bun/pnpm), but a future baked package manager
+# would silently switch and re-suppress scripts; pinning npm locks the contract.
+
+[settings.npm]
+# Force npm as the npm-backend installer so the per-tool `npm_args` below reliably
+# apply (bun/pnpm ignore npm_args and don't run lifecycle scripts by default). The
+# base image ships only `mise`; npm comes from the `node` install above.
+package_manager = "npm"
+
+[tools]
+node = "24"
+"npm:@anthropic-ai/claude-code" = { version = "2.1.156", npm_args = "--ignore-scripts=false" }
+"npm:@openai/codex" = { version = "0.135.0", npm_args = "--ignore-scripts=false" }
+"npm:@agentclientprotocol/claude-agent-acp" = "0.39.0"
+"npm:@zed-industries/codex-acp" = { version = "0.15.0", npm_args = "--ignore-scripts=false" }
+"npm:opencode-ai" = { version = "1.15.12", npm_args = "--ignore-scripts=false" }