Repository navigation
hookprobe: the lock pins the agent runtime, and the image stops installing a second Claude CLI that never ran - #40
Merged
Conversation
…ng a second Claude CLI that never ran The SDK runs the CLI bundled in its wheel before anything on PATH, and nothing here sets cli_path, so the npm CLI this Dockerfile pinned with CLAUDE_CODE_VERSION never ran: the published 0.9.2 image ran the SDK's 2.1.235 while 2.1.259 sat unused on PATH. The build argument and the npm install go; the claude-agent-sdk line in requirements.lock is the pin, and Dependabot proposes it. Node stays for MCP servers started with npx. Read back from a local build: the engine resolves the bundled 2.1.316, nothing named claude is on PATH, node and npx are present, and the image is 1.17 GB where the same lock built 1.69 GB. The real service in that image completed a scripted turn against a recording stand-in model under a third-party model name, with the guard refusing a protected write. Dependabot's comment and the prod compose's memory note are corrected. A new decision note records the choice, and the earlier note from the same day, which left it open, now points at it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The investigator's image stops installing the Claude Code CLI from npm, and the
CLAUDE_CODE_VERSIONbuild argument goes with it. The CLI that runs an investigation is the one inside the claude-agent-sdk wheel, so theclaude-agent-sdkline in the investigator's lock is the agent-runtime pin, and Dependabot proposes it since #35. Node stays for MCP servers started with npx.Why. The SDK runs its bundled binary before anything on PATH, and nothing here sets
cli_path. Read inside the images:claudeon PATHThe pin the Dockerfile documented had decided nothing since the SDK began bundling the CLI, and it was still read as the answer: the 2026-09-03 bump to 2.1.259 for a gateway's model ids changed nothing that ran. Pointing the engine at the npm CLI instead would keep a version Dependabot cannot see and run a CLI older than the one each SDK release ships with. The operator chose the lock.
Read back from this branch's image. The bundled CLI is a native executable and needs no Node; node and npx are still present. The real service completed a scripted turn against a recording stand-in for the model API, on an internal Docker network, under a third-party model name: an allowed read ran, the guard refused a write into
results/and no file appeared, and prompts stay verbatim. CI'sdockerjob builds and boots the image without a key.Also changed. Dependabot's comment no longer lists the CLI among the manual versions. The prod compose's memory note no longer calls the CLI a node process. A decision note records the choice, and the earlier note from the same day, which left it open, now points at it.
claude --versioninside the image now fails;claude_agent_sdk/_cli_version.pynames the CLI instead. Nothing is deployed, and the image change ships at the next release.Gate: STACK GATE GREEN locally; CI read back before merging.