[fctl-sh]

Moves the image to Debian 13 and its pinned tools to their latest releases, so that sessions run with current tooling, and checks on every pull request that changes the image that fctl's own development works in it.

	Before	After
Debian	12 (bookworm)	13 (trixie)
Node.js	22	26
corepack	0.36.0, bundled with Node.js 22	0.36.0, from npm
uv	0.13.1	0.13.4
Rust	1.99.0	1.99.1

TypeScript 7.0.2, Bun 1.4.3 and Python 3.15.0 are already the newest that can be installed. Python 3.15.1 came out today, but uv has no build of it yet (python-build-standalone's newest, 20261020, has 3.15.0); it can follow once uv has one.

Debian 13. Debian 13 has been stable since August 2025 (13.7 now), and 12 is oldstable. Debian's tools in the image move with it: git 2.39 → 2.47, gcc 12 → 14.2, cmake 3.25 → 3.31, curl 7.88 → 8.14, jq 1.6 → 1.7.1, ripgrep 13 → 14.1, ShellCheck 0.9 → 0.10, sqlite 3.40 → 3.46, and Debian's Python, which NodeSource's Node.js depends on, 3.11 → 3.13. provision.sh needs no change for it and still works on Debian 12, which fctl's Lima driver provisions on hosts of fctl 0.14 and earlier and with Lima before 2.0; AGENTS.md and the change-the-image skill say so.

Node.js 26. Node.js 22 has been in maintenance since October 2025, and 24 since 2026-10-20. 26 becomes the active LTS on 2026-10-28 and is supported until April 2029 (schedule). NodeSource publishes it for amd64 and arm64, with npm 11.20 (22 has npm 10.9). Node.js stopped shipping corepack in 25, so provision.sh installs it from npm along with TypeScript, pinned to 0.36.0, the version Node.js 22 bundles now; npm links corepack and its yarn, yarnpkg, pnpm and pnpx shims in /usr/bin, the links corepack enable used to make. A project that still needs Node.js 22 can install it in an image of its own (Sandbox images).

uv 0.13.4 removes the emSign root certificate from the certificates it bundles (GHSA-hq85-5cpj-mr62, high). Rust 1.99.1 fixes regressions in 1.99.0 (announcement); it is the release fctl builds with, and hyperstructure/fctl#168 moves fctl's rust-toolchain.toml to it.

fctl's development in the image. Sessions that work on hyperstructure/fctl build, test and run it in this image, so a new Develop fctl workflow (.github/workflows/fctl.yml) builds a pull request's image for both architectures and runs check-fctl.sh in each, started as fctl hosts start sandboxes (--init, 4 CPUs, 8 GB). It does what such a session does:

• cargo xtask check, what fctl's CI checks: rustfmt, the generated types, Biome and TypeScript, Clippy for the workspace and for wasm32, cargo test, the web app's and the standalone server's tests, and the web app's production build;
• cargo xtask dev --smoke, a session through the local stack (wrangler, Vite, a host with fake-claude), which installs worker-build on the way;
• npm install, which must leave package-lock.json as it is, so that agents adding a package don't rewrite the rest of it;
• cargo xtask serve and a session through that standalone control plane;
• screenshots of the web app with Playwright and Chromium, installed with --with-deps as fctl's screenshots skill does, kept as the run's artifacts.

It checks hyperstructure/fctl's branch of the pull request's name when there is one (an fctl session that changes both repositories names their branches alike), else main. For this pull request, that is hyperstructure/fctl#168, which also refreshes fctl's lockfile: npm 11 rewrote it otherwise. The workflow runs on pull requests that change the image, the script or itself, takes 10 to 13 minutes, and isn't required to merge. The Lint workflow runs ShellCheck on the script too.

Size. Debian 13's base image is 3 to 4 MB larger than Debian 12's, the Debian packages the image installs about 28 MB (amd64), and NodeSource's Node.js 26 about 55 MB more than 22. The published image is 0.80 GB compressed and 2.19 GB unpacked on amd64 (0.75 and 2.08 GB on arm64), so this adds about 90 MB unpacked; the Image run's summary lists each architecture's size.

Verification

• The Image workflow builds both architectures on Debian 13 and check.sh passes in each (run), with Node.js 26.12.1, corepack 0.36.0, TypeScript 7.0.2, Bun 1.4.3, uv 0.13.4, Python 3.15.0 and Rust 1.99.1, the GitHub CLI 2.103.0, fctl 0.14.1 and Claude Code 2.1.306. Before the Debian 13 commit, the same provision.sh passed check.sh on Debian 12 too (run), as the Lima VMs of older hosts need.
• The Develop fctl workflow passes on both architectures with feat(host): prepare Lima sandboxes on Debian 13, like the sandbox image fctl#168's branch (run): cargo xtask check (all of it, the web app's 350 tests too), a session through cargo xtask dev, which installed worker-build, an unchanged lockfile after npm install, a session through cargo xtask serve, and screenshots of the signed-in home page in the light theme and the dark one at phone width, for which Playwright installed Chromium's libraries from Debian 13. The screenshots are the run's artifacts.
• In the session (arm64, Debian 12, without Docker), check-fctl.sh passes with Node.js 26.12.1 first on the PATH, in 8 minutes; its screenshot shows the signed-in home page. Node.js 26 with npm install -g corepack@0.36.0 typescript@7.0.2 links corepack, yarn, yarnpkg, pnpm, pnpx and tsc, and uv 0.13.4 installs Python 3.15.0 as provision.sh does.
• ShellCheck and actionlint pass.

Merge it before hyperstructure/fctl#168: that pull request's docs build an example on the 0.14 tag, which this one's merge rebuilds on Debian 13.

Made in fctl session https://app.fctl.sh/s/ses_01M5FGH6RENBJVF1MS02X2MB51

BREAKING CHANGE: images built FROM this one get Debian 13's packages and Node.js 26. Those that install a package named after a Debian 12 version need Debian 13's name (libicu76 for libicu72), and those that need Node.js 22 install it themselves.