# syntax=docker/dockerfile:1.7
# thothii-core: Fastify (Node 22) + harness Python 3.12 (tht CLI) + runtime Pi.
# Singolo container, entrypoint logico "server" (default).
ARG PI_VERSION=0.80.2

# ---- Stage 1: backend TypeScript -> dist ----
FROM node:22-bookworm AS backend-build
WORKDIR /src/backend
COPY backend/package*.json ./
RUN npm ci
COPY backend/ ./
RUN npm run build

# ---- Stage 2: runtime (Python 3.12 nativo + Node 22 copiato, stesso glibc bookworm) ----
FROM python:3.12-slim-bookworm AS runtime
ARG PI_VERSION

# Runtime tools
RUN apt-get update && apt-get install -y --no-install-recommends \
        curl ca-certificates ripgrep fd-find tini \
    && rm -rf /var/lib/apt/lists/* \
    && ln -s /usr/bin/fdfind /usr/local/bin/fd

# Node 22 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
COPY --from=node:22-bookworm /usr/local/bin/node /usr/local/bin/node
COPY --from=node:22-bookworm /usr/local/lib/node_modules /usr/local/lib/node_modules
RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx

# Utente non-root
RUN useradd --create-home --uid 10001 --shell /bin/bash thoth

COPY harness/ /app/harness/
# Pi scrive lock/settings in .pi: ownership thoth per sopravvivere al rebuild
RUN chown -R thoth:thoth /app/harness/.pi

# Harness: venv nativo (python 3.12) + tht installato (non-editable).
# tht carica workflow.yaml module-relative (Path(__file__).parent.parent); con il package
# in site-packages quel path non contiene workflow.yaml -> lo copiamo dopo l'install.
# (pip install -e non funziona: pip non riconosce /app/harness come editable req.)
# psycopg2-binary è wheel → niente gcc/libpq-dev.
RUN python -m venv /opt/venv \
    && /opt/venv/bin/pip install --no-cache-dir --upgrade pip \
    && (cd /app/harness && /opt/venv/bin/pip install --no-cache-dir .) \
    && cp /app/harness/workflow.yaml /opt/venv/lib/python3.12/site-packages/workflow.yaml
# tht cerca config/tht.yaml relativo al CWD (ignora THT_CONFIG env). Symlink al workspace attivo.
RUN mkdir -p /app/harness/config && ln -sf /app/harness/workspaces/local.yaml /app/harness/config/tht.yaml
# PiProcessManager (backend) prepende harnessDir/.venv/bin al PATH del child Pi → symlink al venv reale
RUN ln -s /opt/venv /app/harness/.venv

# Backend: dist + node_modules (stesso Node major 22 + glibc bookworm → compatibili)
COPY --from=backend-build /src/backend/dist /app/backend/dist
COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules
COPY backend/package*.json /app/backend/

# Runtime Pi (pacchetto npm puro JS, dipendenze prebuilt). Installato come root, eseguibile da thoth.
RUN npm install -g @earendil-works/pi-coding-agent@${PI_VERSION}

ENV PATH="/opt/venv/bin:/usr/local/bin:$PATH" \
    HOST=0.0.0.0 PORT=8787 \
    THT_HARNESS_DIR=/app/harness \
    THT_BIN=/opt/venv/bin/tht \
    PI_BIN=pi \
    HOME=/home/thoth

COPY docker/core-entrypoint.sh docker/ensure-pi-trust.mjs /app/docker/
RUN chmod +x /app/docker/core-entrypoint.sh

WORKDIR /app/backend
USER thoth
EXPOSE 8787
HEALTHCHECK --interval=15s --timeout=3s --retries=5 --start-period=30s \
  CMD curl -fsS http://127.0.0.1:8787/health || exit 1
ENTRYPOINT ["/usr/bin/tini","--","/app/docker/core-entrypoint.sh"]
CMD ["server"]