Make runtime defaults release-owned

[laurenceputra]

Summary

• make node:22-slim, opencode-ai, and internal runtime paths release-owned instead of persistent user config
• enforce and record Node 22 metadata, forcing docker build --pull for missing, stale, or incompatible images
• generate a secure override-only config while preserving existing user files and safety controls across self-update
• update runtime/release contracts, CI checks, docs, and release version to 0.4.0

Validation

• VERSION_GUARD_BASE_REF=origin/main bash tests/version_guard.sh
• focused runtime-default, self-update, bootstrap, build-version, and Dockerfile contract tests
• bash -n for touched shell scripts
• git diff --check
• production-readiness review: no blocking/high/medium findings

Environment limitations

• Docker and shellcheck are unavailable in the current container, so local Docker build/runtime and shellcheck validation could not run.
• The full test runner intermittently hits the existing session-retention fixture race (runtime-helper removed before scheduler startup); the same failure was reproduced unchanged on origin/main. Targeted changed tests pass.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It reworks security- and operations-sensitive runtime defaults, self-update re-exec behavior, and config generation across many files, which warrants human sign-off despite the strong test coverage.

Review effort: Balanced
Findings: 1

Open (1)

• Persistent OPENCODE_WEB_AUTO_PULL config is now ignored · New

What changed in this PR

This PR (release 0.4.0) makes the runtime's core defaults "release-owned" rather than user-configurable persistent settings. The Docker base image (node:22-slim), the OpenCode npm package (opencode-ai), and the internal serve hostname/home/workdir/cleanup are now fixed in the wrapper and Dockerfile. It adds a Node-22 build assertion plus /opt Node metadata, and a compatibility rebuild path that forces docker build --pull when the image is missing, when wrapper-version metadata drifts, or when Node metadata is missing/malformed/non-22. The generated config becomes a mode-0600, override-only commented template, and one-shot/troubleshooting controls captured from the caller's environment are no longer honored from the config file. Docs, skills, CI, and tests are updated to match.

Changes:

• Pin and enforce node:22-slim + opencode-ai at build time; record Node version/major metadata and drive compatibility --pull rebuilds for legacy/missing/non-22 images.
• Rework config loading so release-owned runtime paths are fixed after sourcing, and troubleshooting controls are env-only (not persistent); regenerate a secure override-only config template.
• Update VERSION/CHANGELOG to 0.4.0 and align README/TECHNICAL/skills/CI plus a new test_runtime_defaults.sh.

File	Description
VERSION	Bumps release to 0.4.0.
.opencode_web_yolo.Dockerfile	Fixes FROM node:22-slim, adds Node-22 build assertion, drops BASE_IMAGE/OPENCODE_NPM_PACKAGE args, records Node metadata.
.opencode_web_yolo.sh	Adds node_version_is_22, compatibility --pull on Node/wrapper/missing-image drift, secure override-only config generation, health Node fields; removes base-image/npm-package/playwright-pin usage.
.opencode_web_yolo_config.sh	Captures troubleshooting env before sourcing config, fixes release-owned runtime settings after sourcing, drops removed defaults.
tests/​test_runtime_defaults.sh	New test for release-owned defaults and Node-22 rebuild behavior.
tests/​test_helpers.sh	Fake docker gains Node metadata, missing-image, wrapper-version drift, and build-log hooks.
tests/​test_build_expected_version.sh, tests/​test_self_update.sh, tests/​test_install_bootstrap.sh, tests/​test_playwright_dockerfile_contract.sh, tests/​run.sh	Update assertions for pin removal, config preservation, Node metadata, and register the new test.
.github/​workflows/​ci.yml	Adds syntax/shellcheck for the new test and Node-22 metadata validation job.
README.md, TECHNICAL.md, CHANGELOG.md, skills/​*	Document release-owned defaults, compatibility rebuild rules, and override-only config.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It reworks security-and-runtime-critical config loading, build/pull, self-update, and Docker image contracts that could not be validated locally with Docker/shellcheck, warranting human sign-off.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Persistent OPENCODE_WEB_AUTO_PULL config is now ignored