FROM node:22-bookworm

ARG TARGETARCH
ARG GO_VERSION=1.25.0

ENV DEBIAN_FRONTEND=noninteractive \
    PATH=/usr/local/go/bin:/root/go/bin:/root/.bun/bin:/root/.local/bin:$PATH \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=off \
    PIP_DISABLE_PIP_VERSION_CHECK=on

# 换成清华 Debian 镜像（国内网络更稳）+ apt 重试策略
RUN sed -i 's|http://deb.debian.org|https://mirrors.tuna.tsinghua.edu.cn|g; s|http://security.debian.org|https://mirrors.tuna.tsinghua.edu.cn/debian-security|g' /etc/apt/sources.list.d/debian.sources \
 && echo 'Acquire::Retries "8";' > /etc/apt/apt.conf.d/80-retries \
 && echo 'Acquire::http::Timeout "60";' >> /etc/apt/apt.conf.d/80-retries \
 && echo 'Acquire::https::Timeout "60";' >> /etc/apt/apt.conf.d/80-retries

RUN apt-get update && apt-get install -y --no-install-recommends --fix-missing \
      git curl ca-certificates gnupg lsb-release \
      make build-essential \
      python3 python3-pip python3-venv python3-dev \
      postgresql-client redis-tools \
      jq ripgrep fd-find less vim-tiny tini \
    && ln -s /usr/bin/fdfind /usr/local/bin/fd \
    && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" \
    | tar -C /usr/local -xz

RUN curl -fsSL https://bun.sh/install | bash

RUN npm install -g pnpm@latest @anthropic-ai/claude-code

RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update && apt-get install -y --no-install-recommends gh \
    && rm -rf /var/lib/apt/lists/*

# Azure CLI（用于 azure-aca-expert agent 的只读查询）
RUN curl -sL https://packages.microsoft.com/keys/microsoft.asc \
      | gpg --dearmor | tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null \
    && AZ_REPO=$(lsb_release -cs) \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/trusted.gpg.d/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" \
      > /etc/apt/sources.list.d/azure-cli.list \
    && apt-get update && apt-get install -y --no-install-recommends azure-cli \
    && rm -rf /var/lib/apt/lists/*

# Chromium（从 bookworm-backports 拉；Debian 12 主源已移除 chromium，
# 且 agent-browser 在 Linux ARM64 上需要系统 chromium，不走 Chrome for Testing）
RUN echo 'deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm-backports main' \
      > /etc/apt/sources.list.d/backports.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends -t bookworm-backports \
         chromium chromium-sandbox \
         fonts-liberation fonts-noto-cjk fonts-noto-color-emoji \
    && rm -rf /var/lib/apt/lists/*

# agent-browser CLI（配合 ~/.claude/skills/agent-browser 使用）
RUN npm install -g agent-browser

# 让 agent-browser / Playwright / Puppeteer 统一用系统 chromium，不再尝试下载
ENV AGENT_BROWSER_CHROMIUM_PATH=/usr/bin/chromium \
    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
    PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium \
    PUPPETEER_SKIP_DOWNLOAD=1 \
    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium

RUN pip install --break-system-packages --no-cache-dir \
      uv ruff black pytest pytest-asyncio httpx \
      python-docx pypdf openpyxl python-pptx Pillow pandas markdown \
      pip-audit

# pandoc（通用文档转换）+ yq（YAML 查询）+ sqlite3（本地缓存用）
RUN apt-get update && apt-get install -y --no-install-recommends \
      pandoc sqlite3 \
    && curl -fsSL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${TARGETARCH} \
         -o /usr/local/bin/yq \
    && chmod +x /usr/local/bin/yq \
    && rm -rf /var/lib/apt/lists/*

# OpenAI Codex CLI（给 codex:codex-rescue agent 用）
RUN npm install -g @openai/codex || echo "codex 装失败（可能需要 auth，先略过）"

RUN git config --system --add safe.directory '*' \
    && git config --system pull.rebase false \
    && git config --system init.defaultBranch main

COPY scripts/container-entrypoint.sh /usr/local/bin/container-entrypoint.sh
RUN chmod +x /usr/local/bin/container-entrypoint.sh

WORKDIR /workspace

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/container-entrypoint.sh"]
CMD ["claude"]