# infra/agent/versions.env — pins for the `agent-runner` image (the PM agent service).
#
# WHAT THIS FILE DOES *NOT* PIN: the platform toolchain. The agent-runner is built FROM
# the pinned dev toolbox (infra/devcontainer/), which already pins fedora, python3,
# git, sops, age, flux, kubectl, kyverno, chainsaw, promtool, yamllint and
# check-jsonschema in ONE place. A worker agent runs `./ci/gate.sh` before it pushes, so
# it needs exactly that toolchain — and CLAUDE.md §3 is explicit that only the pinned
# toolbox result counts. Re-pinning those versions here would create a second source of
# truth and, the first time the two drifted, the worker's "green" would stop meaning the
# gate's green. So this file pins ONLY what the toolbox does not carry.

# The toolbox image the runner is layered on. Built by `infra/devcontainer/dev.sh build`
# (tag `home-k3s-dev:local`); infra/agent/build-image.sh asserts it exists rather than
# silently building a different base.
AGENT_BASE_IMAGE=home-k3s-dev:local

# Node.js — the runtime for the Claude Code CLI, installed from the Fedora base's module
# stream. A major version, not a patch: the CLI supports the active LTS line and the
# distro package is the reproducible way to get it inside a pinned base.
NODEJS_MAJOR=22

# Claude Code CLI (npm `@anthropic-ai/claude-code`), EXACT version.
#
# WHY 2.1.285 AND NOT `latest`: `latest` makes the image non-reproducible, and the
# autoupdater is disabled in the runtime anyway (see the Containerfile), so a floating
# tag would only move under us at build time. 2.1.285 is the version the registry
# publishes under the `stable` dist-tag (measured 2026-10-05:
# `curl -s https://registry.npmjs.org/@anthropic-ai/claude-code | jq .'dist-tags'`
# -> {"stable":"2.1.285","latest":"2.1.290","next":"2.1.290"}).
#
# FLOOR, NOT PREFERENCE: pm-dispatch and pm-worker both pass
# `--permission-prompts none`, which requires >= 2.1.259. A downgrade below that floor
# does not fail at build — it fails at 3am with a worker waiting forever for a
# permission answer nobody can give. build-image.sh asserts the floor.
CLAUDE_CODE_VERSION=2.1.285
CLAUDE_CODE_MIN_VERSION=2.1.259

# The model the PM persona and the worker agents run on. `claude-opus-5` is the current
# most-capable general model; the worker does real repository work against a gate, so this
# is deliberately not a cheaper tier. Overridable per-deployment via the ConfigMap
# (PM_MODEL / PM_WORKER_MODEL) without rebuilding the image.
AGENT_MODEL=claude-opus-5

# Image coordinates. The repository path is NOT a preference: the admission policy
# platform/kyverno/admission/pm-agent-job-shape.yaml admits a worker Job only when its
# image is `${AGENT_IMAGE_REPO}@sha256:<digest>`. A different path is a DENIED Job.
AGENT_IMAGE_REPO=gitea.home.keithjackson.dev/home-network/agent-runner