fix: use version-agnostic symlinks for runtime paths

Replace hardcoded version-specific paths in runtime.go (e.g.
/mise/installs/go/1.26.0) with /mise/installs/<runtime>/current
symlinks created during Docker build. This decouples runtime version
updates from Go source code, allowing Renovate to update Dockerfile
ARGs without requiring changes to runtime.go.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: koki-develop

Dockerfile

@@ -33,21 +33,24 @@ RUN apt-get update && \
 # renovate: datasource=node-version depName=node
 ARG NODE_VERSION=24.14.0
 ENV PATH="/mise/installs/node/${NODE_VERSION}/bin:$PATH"
-RUN mise use -g node@${NODE_VERSION}
+RUN mise use -g node@${NODE_VERSION} && \
+    ln -s /mise/installs/node/${NODE_VERSION} /mise/installs/node/current
 COPY internal/sandbox/defaults/node-typescript/package.json internal/sandbox/defaults/node-typescript/package-lock.json /mise/ts-node-modules/
 RUN cd /mise/ts-node-modules && npm ci
 
 # Ruby
 # renovate: datasource=ruby-version depName=ruby
 ARG RUBY_VERSION=3.4.8
 ENV PATH="/mise/installs/ruby/${RUBY_VERSION}/bin:$PATH"
-RUN mise settings ruby.compile=false && mise use -g ruby@${RUBY_VERSION}
+RUN mise settings ruby.compile=false && mise use -g ruby@${RUBY_VERSION} && \
+    ln -s /mise/installs/ruby/${RUBY_VERSION} /mise/installs/ruby/current
 
 # Go
 # renovate: datasource=golang-version depName=go
 ARG GO_VERSION=1.26.0
 ENV PATH="/mise/installs/go/${GO_VERSION}/bin:$PATH"
-RUN mise use -g go@${GO_VERSION}
+RUN mise use -g go@${GO_VERSION} && \
+    ln -s /mise/installs/go/${GO_VERSION} /mise/installs/go/current
 RUN CGO_ENABLED=0 GOCACHE=/mise/go-cache go build std
 COPY internal/sandbox/defaults/go/go.mod.tmpl /tmp/preinstall/go.mod
 COPY internal/sandbox/defaults/go/go.sum.tmpl /tmp/preinstall/go.sum
@@ -59,7 +62,8 @@ RUN cd /tmp/preinstall && \
 # renovate: datasource=python-version depName=python
 ARG PYTHON_VERSION=3.13.12
 ENV PATH="/mise/installs/python/${PYTHON_VERSION}/bin:$PATH"
-RUN mise use -g python@${PYTHON_VERSION}
+RUN mise use -g python@${PYTHON_VERSION} && \
+    ln -s /mise/installs/python/${PYTHON_VERSION} /mise/installs/python/current
 
 # Rust
 # renovate: datasource=github-tags depName=rust packageName=rust-lang/rust

docs/superpowers/specs/2026-03-17-version-agnostic-runtime-paths-design.md

@@ -0,0 +1,37 @@
+# Version-Agnostic Runtime Paths
+
+## Problem
+
+Runtime versions are defined as Dockerfile ARGs (e.g., `GO_VERSION=1.26.1`) and hardcoded in `internal/sandbox/runtime.go` as literal paths (e.g., `/mise/installs/go/1.26.0/bin/go`). When Renovate updates Dockerfile ARGs, runtime.go is not updated, causing a mismatch.
+
+This affects: Node.js, Ruby, Go, Python (4 runtimes). Rust is unaffected because its paths (`/mise/cargo`, `/mise/rustup`) don't contain version numbers.
+
+## Solution
+
+Use version-agnostic symlinks created during Docker build.
+
+### Dockerfile Changes
+
+After each `mise use` command, create a `current` symlink:
+
+```
+/mise/installs/node/current -> /mise/installs/node/${NODE_VERSION}
+/mise/installs/ruby/current -> /mise/installs/ruby/${RUBY_VERSION}
+/mise/installs/go/current   -> /mise/installs/go/${GO_VERSION}
+/mise/installs/python/current -> /mise/installs/python/${PYTHON_VERSION}
+```
+
+### runtime.go Changes
+
+Replace all version-specific paths with `current`:
+
+- `/mise/installs/node/24.14.0` -> `/mise/installs/node/current`
+- `/mise/installs/ruby/3.4.8` -> `/mise/installs/ruby/current`
+- `/mise/installs/go/1.26.0` -> `/mise/installs/go/current`
+- `/mise/installs/python/3.13.12` -> `/mise/installs/python/current`
+
+### Out of Scope
+
+- Rust `RUSTUP_TOOLCHAIN=1.94.0` env var (no version in filesystem paths)
+- Builder stage `golang:1.26.1-bookworm` (build toolchain, not sandbox runtime)
+- `go.mod` Go version

internal/sandbox/runtime.go

@@ -42,7 +42,7 @@ type Runtime interface {
 	BindMounts() []BindMount
 
 	// Env returns environment variables for the sandbox in "KEY=VALUE" format
-	// (e.g. "PATH=/mise/installs/node/24.14.0/bin:/usr/bin").
+	// (e.g. "PATH=/mise/installs/node/current/bin:/usr/bin").
 	Env() []string
 
 	// Limits returns the nsjail resource limits for the run step.
@@ -176,15 +176,15 @@ type nodeRuntime struct{}
 func (nodeRuntime) Name() RuntimeName { return RuntimeNode }
 
 func (nodeRuntime) Command(entryFile string) []string {
-	return []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", entryFile}
+	return []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", entryFile}
 }
 
 func (nodeRuntime) BindMounts() []BindMount {
-	return []BindMount{{Src: "/mise/installs/node/24.14.0", Dst: "/mise/installs/node/24.14.0"}}
+	return []BindMount{{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"}}
 }
 
 func (nodeRuntime) Env() []string {
-	return []string{"PATH=/mise/installs/node/24.14.0/bin:/usr/bin:/bin"}
+	return []string{"PATH=/mise/installs/node/current/bin:/usr/bin:/bin"}
 }
 
 // Limits returns resource limits for Node.js execution.
@@ -225,15 +225,15 @@ type rubyRuntime struct{}
 func (rubyRuntime) Name() RuntimeName { return RuntimeRuby }
 
 func (rubyRuntime) Command(entryFile string) []string {
-	return []string{"/mise/installs/ruby/3.4.8/bin/ruby", entryFile}
+	return []string{"/mise/installs/ruby/current/bin/ruby", entryFile}
 }
 
 func (rubyRuntime) BindMounts() []BindMount {
-	return []BindMount{{Src: "/mise/installs/ruby/3.4.8", Dst: "/mise/installs/ruby/3.4.8"}}
+	return []BindMount{{Src: "/mise/installs/ruby/current", Dst: "/mise/installs/ruby/current"}}
 }
 
 func (rubyRuntime) Env() []string {
-	return []string{"PATH=/mise/installs/ruby/3.4.8/bin:/usr/bin:/bin"}
+	return []string{"PATH=/mise/installs/ruby/current/bin:/usr/bin:/bin"}
 }
 
 // Limits returns resource limits for Ruby execution.
@@ -274,15 +274,15 @@ type pythonRuntime struct{}
 func (pythonRuntime) Name() RuntimeName { return RuntimePython }
 
 func (pythonRuntime) Command(entryFile string) []string {
-	return []string{"/mise/installs/python/3.13.12/bin/python3", entryFile}
+	return []string{"/mise/installs/python/current/bin/python3", entryFile}
 }
 
 func (pythonRuntime) BindMounts() []BindMount {
-	return []BindMount{{Src: "/mise/installs/python/3.13.12", Dst: "/mise/installs/python/3.13.12"}}
+	return []BindMount{{Src: "/mise/installs/python/current", Dst: "/mise/installs/python/current"}}
 }
 
 func (pythonRuntime) Env() []string {
-	return []string{"PATH=/mise/installs/python/3.13.12/bin:/usr/bin:/bin"}
+	return []string{"PATH=/mise/installs/python/current/bin:/usr/bin:/bin"}
 }
 
 // Limits returns resource limits for Python execution.
@@ -339,12 +339,12 @@ func (goRuntime) Env() []string {
 }
 
 func (goRuntime) CompileCommand() []string {
-	return []string{"/mise/installs/go/1.26.0/bin/go", "build", "-o", "/sandbox/main", "."}
+	return []string{"/mise/installs/go/current/bin/go", "build", "-o", "/sandbox/main", "."}
 }
 
 func (goRuntime) CompileBindMounts() []BindMount {
 	return []BindMount{
-		{Src: "/mise/installs/go/1.26.0", Dst: "/mise/installs/go/1.26.0"},
+		{Src: "/mise/installs/go/current", Dst: "/mise/installs/go/current"},
 		{Src: "/mise/go-cache", Dst: "/mise/go-cache"},                         // pre-built Go stdlib cache (read-only)
 		{Src: "/mise/go-modcache", Dst: "/mise/go-modcache"},                   // pre-downloaded module cache (read-only)
 		{Src: "/usr/local/bin/gocacheprog", Dst: "/usr/local/bin/gocacheprog"}, // cache helper binary; /usr/local/bin is not mounted by the base config
@@ -353,8 +353,8 @@ func (goRuntime) CompileBindMounts() []BindMount {
 
 func (goRuntime) CompileEnv() []string {
 	return []string{
-		"PATH=/mise/installs/go/1.26.0/bin:/usr/bin:/bin",
-		"GOROOT=/mise/installs/go/1.26.0",
+		"PATH=/mise/installs/go/current/bin:/usr/bin:/bin",
+		"GOROOT=/mise/installs/go/current",
 		"GOPATH=/tmp/gopath",                                    // writable location for module metadata and build artifacts
 		"GOMODCACHE=/mise/go-modcache",                          // read-only pre-downloaded module cache from Docker image
 		"GOCACHEPROG=/usr/local/bin/gocacheprog /mise/go-cache", // read-only cache backed by pre-built stdlib cache from Docker image
@@ -546,30 +546,30 @@ func (nodeTypeScriptRuntime) Name() RuntimeName { return RuntimeNodeTypeScript }
 
 func (nodeTypeScriptRuntime) Command(entryFile string) []string {
 	jsFile := strings.TrimSuffix(entryFile, path.Ext(entryFile)) + ".js"
-	return []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", jsFile}
+	return []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", jsFile}
 }
 
 func (nodeTypeScriptRuntime) BindMounts() []BindMount {
-	return []BindMount{{Src: "/mise/installs/node/24.14.0", Dst: "/mise/installs/node/24.14.0"}}
+	return []BindMount{{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"}}
 }
 
 func (nodeTypeScriptRuntime) Env() []string {
-	return []string{"PATH=/mise/installs/node/24.14.0/bin:/usr/bin:/bin"}
+	return []string{"PATH=/mise/installs/node/current/bin:/usr/bin:/bin"}
 }
 
 func (nodeTypeScriptRuntime) CompileCommand() []string {
-	return []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", "/sandbox/node_modules/typescript/bin/tsc"}
+	return []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", "/sandbox/node_modules/typescript/bin/tsc"}
 }
 
 func (nodeTypeScriptRuntime) CompileBindMounts() []BindMount {
 	return []BindMount{
-		{Src: "/mise/installs/node/24.14.0", Dst: "/mise/installs/node/24.14.0"},
+		{Src: "/mise/installs/node/current", Dst: "/mise/installs/node/current"},
 		{Src: "/mise/ts-node-modules/node_modules", Dst: "/sandbox/node_modules"}, // pre-installed typescript and @types/node (read-only)
 	}
 }
 
 func (nodeTypeScriptRuntime) CompileEnv() []string {
-	return []string{"PATH=/mise/installs/node/24.14.0/bin:/usr/bin:/bin"}
+	return []string{"PATH=/mise/installs/node/current/bin:/usr/bin:/bin"}
 }
 
 // CompileLimits returns resource limits for the TypeScript compilation step.

internal/sandbox/sandbox_test.go

@@ -187,19 +187,19 @@ func TestNodeTypeScriptRuntime_Command(t *testing.T) {
 	t.Run("converts .ts to .js", func(t *testing.T) {
 		t.Parallel()
 		got := rt.Command("/sandbox/index.ts")
-		assert.Equal(t, []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", "/sandbox/index.js"}, got)
+		assert.Equal(t, []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", "/sandbox/index.js"}, got)
 	})
 
 	t.Run("converts .tsx to .js", func(t *testing.T) {
 		t.Parallel()
 		got := rt.Command("/sandbox/app.tsx")
-		assert.Equal(t, []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", "/sandbox/app.js"}, got)
+		assert.Equal(t, []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", "/sandbox/app.js"}, got)
 	})
 
 	t.Run("appends .js when no extension", func(t *testing.T) {
 		t.Parallel()
 		got := rt.Command("/sandbox/noext")
-		assert.Equal(t, []string{"/mise/installs/node/24.14.0/bin/node", "--disable-wasm-trap-handler", "/sandbox/noext.js"}, got)
+		assert.Equal(t, []string{"/mise/installs/node/current/bin/node", "--disable-wasm-trap-handler", "/sandbox/noext.js"}, got)
 	})
 }