Merge branch 'master' into docs/docker-disk-maintenance

Author: gatezh

.devcontainer/init-plugins.sh

@@ -46,9 +46,11 @@ done
 
 # Initialize rtk global hook for Claude Code (auto-rewrite mode).
 # --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
-# WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs in
-# non-interactive environments. timeout + RTK_TELEMETRY_DISABLED work around it.
-# Remove when upstream fixes it: https://github.com/rtk-ai/rtk/issues/1307
+# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
+# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
+# would otherwise block on stdin here. rtk's own TTY check is not enough — a
+# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
+# interactive. timeout stays as a backstop against a future init-time hang.
 echo "Initializing rtk (token optimizer)..."
 RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch || {
     echo "Note: rtk init may have already been configured or rtk not available"

.github/renovate.json5

@@ -29,11 +29,17 @@
     },
     {
       // Group the four tools into one PR and auto-merge once CI passes.
-      // platformAutomerge:false => Renovate performs the merge itself only
-      // after it observes the branch tests are green, so CI gating needs no
-      // branch-protection rule. (Optional hardening: enable branch protection
-      // requiring the CI checks and set platformAutomerge:true for native
-      // GitHub auto-merge.)
+      //
+      // Relies on Renovate's default platformAutomerge:true — GitHub's native
+      // auto-merge merges on green with no second Renovate run. The previous
+      // explicit platformAutomerge:false is what broke this: only a Renovate
+      // run could merge, and every run found a newer claude-code, force-pushed
+      // the branch and ended before CI finished (#121 sat green for 3.5 weeks).
+      //
+      // Requires: repo setting "Allow auto-merge", and a ruleset on master
+      // requiring the "CI complete" check (.github/workflows/ci.yml). Without
+      // that required check nothing blocks the PR, GitHub never offers native
+      // auto-merge, and Renovate silently falls back to the broken path.
       matchPackageNames: [
         'rtk-ai/rtk',
         'umputun/ralphex',
@@ -42,7 +48,18 @@
       ],
       groupName: 'devcontainer agent tools',
       automerge: true,
-      platformAutomerge: false,
+
+      // These bumps merge unreviewed and publish straight to ghcr.io, so let a
+      // release soak before adopting it. internalChecksFilter defaults to
+      // 'strict', so a too-young version is simply not offered yet — the group
+      // PR carries whichever tools are currently eligible.
+      minimumReleaseAge: '3 days',
+    },
+    {
+      // ...except claude-code, which is tracked at latest deliberately.
+      // Later packageRules win, so this clears the soak period above.
+      matchPackageNames: ['@anthropic-ai/claude-code'],
+      minimumReleaseAge: null,
     },
   ],
 }

.github/workflows/ci.yml

@@ -3,11 +3,10 @@ name: CI
 on:
   pull_request:
     branches: [master]
-    paths:
-      - '**/Dockerfile'
-      - '**/*.sh'
-      - '.github/workflows/**'
-      - '.hadolint.yaml'
+    # Deliberately unfiltered: "CI complete" below is the required status check
+    # for master, and a required check that never runs blocks a PR forever -- a
+    # docs-only PR would deadlock. Image builds are still skipped per-image via
+    # detect-changes; the always-on jobs are lint-only and take seconds.
 
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
@@ -194,3 +193,52 @@ jobs:
           IMAGE_TAG: ${{ matrix.image }}:test
           VERIFY_CMD: ${{ matrix.verify }}
         run: docker run --rm --entrypoint sh "$IMAGE_TAG" -c "$VERIFY_CMD"
+
+  # -- Single required status check for branch protection ------------------
+  # Aggregates every job above so master needs exactly one required check.
+  # Passes when each job succeeded or was legitimately skipped (path-filtered
+  # builds), and fails if any job failed or was cancelled.
+  #
+  # Any job added to this workflow must also be added to `needs` below: this is
+  # the only required check on master and Renovate auto-merges on it, so an
+  # unwatched job would go red while the gate stayed green. The first step
+  # enforces that rather than trusting anyone to remember.
+  ci-complete:
+    name: CI complete
+    # always(), not !cancelled(): GitHub counts a *skipped* required check as
+    # passing, so !cancelled() would let a cancelled run report a green gate.
+    if: always()
+    needs: [lint-dockerfiles, lint-workflows, detect-changes, build-and-verify]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Verify every job is watched
+        env:
+          WATCHED: ${{ toJSON(needs) }}
+        run: |
+          missing=""
+          for job in $(yq '.jobs | keys | .[]' .github/workflows/ci.yml); do
+            [ "$job" = "ci-complete" ] && continue
+            jq -e --arg j "$job" 'has($j)' <<< "$WATCHED" > /dev/null || missing="$missing $job"
+          done
+          if [ -n "$missing" ]; then
+            echo "::error::Jobs missing from ci-complete.needs:$missing"
+            exit 1
+          fi
+
+      - name: Check results of all CI jobs
+        env:
+          WATCHED: ${{ toJSON(needs) }}
+        run: |
+          jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$WATCHED"
+          bad=$(jq -r '
+            to_entries[]
+            | select(.value.result != "success" and .value.result != "skipped")
+            | "\(.key) (\(.value.result))"' <<< "$WATCHED")
+          if [ -n "$bad" ]; then
+            echo "::error::CI jobs did not pass: $(echo "$bad" | tr '\n' ' ')"
+            exit 1
+          fi
+          echo "All CI jobs passed or were skipped."

claude-code/.devcontainer/Dockerfile

@@ -20,7 +20,7 @@
 FROM alpine:3.21 AS rtk-download
 RUN apk add --no-cache curl
 # renovate: datasource=github-releases depName=rtk-ai/rtk
-ARG RTK_VERSION=0.43.0
+ARG RTK_VERSION=0.48.0
 RUN set -eux; \
     ARCH="$(uname -m)"; \
     case "$ARCH" in \
@@ -36,7 +36,7 @@ RUN set -eux; \
 FROM alpine:3.21 AS ralphex-download
 RUN apk add --no-cache curl
 # renovate: datasource=github-releases depName=umputun/ralphex
-ARG RALPHEX_VERSION=1.6.0
+ARG RALPHEX_VERSION=1.7.0
 RUN set -eux; \
     ARCH="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"; \
     curl -fsSL -o /tmp/ralphex.tar.gz \
@@ -184,7 +184,7 @@ USER node
 # A later `chown -R` in another layer would duplicate every file (overlayfs
 # treats an ownership change as a rewrite), adding hundreds of MB.
 # renovate: datasource=npm depName=@anthropic-ai/claude-code
-ARG CLAUDE_CODE_VERSION=2.1.216
+ARG CLAUDE_CODE_VERSION=2.1.266
 RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
 
 # ─── DEFAULT — full dev environment ───────────────────────────────────────────
@@ -229,7 +229,7 @@ ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
 # Installed as the node user (see claude-code install above for rationale).
 # Version pinned and kept up to date by Renovate (see .github/renovate.json5).
 # renovate: datasource=npm depName=agent-browser
-ARG AGENT_BROWSER_VERSION=0.32.3
+ARG AGENT_BROWSER_VERSION=0.37.1
 RUN npm install -g agent-browser@${AGENT_BROWSER_VERSION}
 
 LABEL org.opencontainers.image.source="https://github.com/gatezh/devcontainers" \

claude-code/.devcontainer/init-plugins.sh

@@ -70,9 +70,11 @@ done
 # ── rtk init (token-optimized CLI proxy) ────────────────────────────────────
 # Global hook-first mode: installs only the PreToolUse rewrite hook to ~/.claude/,
 # no workspace artifacts (CLAUDE.md, .rtk/). Safe to run multiple times.
-# WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs in
-# non-interactive environments. timeout + RTK_TELEMETRY_DISABLED work around it.
-# Remove when upstream fixes it: https://github.com/rtk-ai/rtk/issues/1307
+# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
+# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
+# would otherwise block on stdin here. rtk's own TTY check is not enough — a
+# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
+# interactive. timeout stays as a backstop against a future init-time hang.
 if command -v rtk &>/dev/null; then
     RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
 fi

ralphex-fe/Dockerfile

@@ -48,7 +48,7 @@ RUN set -eux; \
 FROM alpine:3.21 AS rtk-download
 RUN apk add --no-cache curl
 # renovate: datasource=github-releases depName=rtk-ai/rtk
-ARG RTK_VERSION=0.43.0
+ARG RTK_VERSION=0.48.0
 RUN set -eux; \
     ARCH="$(uname -m)"; \
     case "$ARCH" in \
@@ -65,7 +65,7 @@ RUN set -eux; \
 FROM alpine:3.21 AS ralphex-download
 RUN apk add --no-cache curl
 # renovate: datasource=github-releases depName=umputun/ralphex
-ARG RALPHEX_VERSION=1.6.0
+ARG RALPHEX_VERSION=1.7.0
 RUN set -eux; \
     ARCH="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"; \
     curl -fsSL -o /tmp/ralphex.tar.gz \
@@ -160,7 +160,7 @@ WORKDIR /workspace
 # See: claude-code/.devcontainer/Dockerfile for rationale.
 # Version pinned and kept up to date by Renovate (see .github/renovate.json5).
 # renovate: datasource=npm depName=@anthropic-ai/claude-code
-ARG CLAUDE_CODE_VERSION=2.1.216
+ARG CLAUDE_CODE_VERSION=2.1.266
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
 

ralphex-fe/init-docker.sh

@@ -29,11 +29,14 @@ if [ -d /mnt/claude ]; then
     chown -R app:app /home/app/.claude
 
     # ── RTK: ensure rewrite hook is configured ─────────────────────────────
-    # Host mount usually brings the hook, but init idempotently to cover
-    # standalone usage (no host mount). --hook-only avoids workspace artifacts.
-    # WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs
-    # in non-interactive environments. Remove when upstream fixes it:
-    # https://github.com/rtk-ai/rtk/issues/1307
+    # The host mount usually brings the hook; re-init idempotently in case the
+    # mounted ~/.claude carries none. --hook-only avoids workspace artifacts.
+    # Scope: this sits inside the /mnt/claude guard, so a container started
+    # without the host mount gets no rtk hook and rtk stays inert.
+    # RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround:
+    # since rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent
+    # prompt that would otherwise block on stdin here. timeout stays as a
+    # backstop against a future init-time hang.
     if command -v rtk >/dev/null 2>&1; then
         RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
     fi