mise.toml

[tools]
# Pinned versions per ADR 0006 (Accepted 2026-05-02). One pin
# applies to Mac, Linux (dev container workspace), and Windows
# (future scoop host). Bump these by hand in a dedicated PR; the
# build-time consistency check in tests/test_mise_pin_consistency.py
# fails the image build if these drift from the SHA-verified
# constants in .devcontainer/features/dotfiles-tools/install.sh.
just = "1.40.0"
markdownlint-cli2 = "0.22.1"
prek = "0.3.11"
uv = "0.11.8"
# `vp` is the mise registry alias for npm:vite-plus (NOT the
# unrelated `vp` npm package). Pin to vite-plus's actual version.
vp = "0.1.20"

# Node runtime. The npm-backed AI CLIs below have a `#!/usr/bin/env
# node` shebang that needs node on PATH at *runtime*, not just at
# the image-build time when mise installs them. The
# `ghcr.io/devcontainers/features/node:1` feature in devcontainer.json
# does install node into /usr/local/bin, but on Coder workspaces the
# `/home/<user>:/root` volume mount can mask the symlink chain. Pin
# node here so /opt/mise/installs/node/24.15.0/bin/node lives outside
# the volume-mount path; mise's shim in /opt/mise/shims wins PATH
# resolution against any bind-mount issue.
node = "24.15.0"

# AI agent CLIs. Installed at build time so the Coder workspace
# boots with them ready on PATH; operators authenticate them on
# first use (`codex login`, `claude /login`, `gemini auth`,
# `copilot auth`, `pi auth`). Source: 2026-05 latest stable.
"npm:@openai/codex" = "0.128.0"
"npm:@google/gemini-cli" = "0.40.1"
"npm:@anthropic-ai/claude-code" = "2.1.126"
"npm:@github/copilot" = "1.0.40"
"npm:@mariozechner/pi-coding-agent" = "0.72.1"

# `~/.npmrc` may set `min-release-age=7` (7-day quarantine, mirrors
# uv's `exclude-newer = "7 days"`). That blocks `mise install` of
# brand-new npm-backed tools (e.g. vp). Override only for mise-driven
# npm calls — the host npmrc is untouched, so app-level installs in
# other repos still get the quarantine.
[env]
npm_config_min_release_age = "0"