FROM node:24-bookworm-slim

RUN apt-get update \
  && apt-get install -y --no-install-recommends bash ca-certificates git ripgrep python3 python-is-python3 tzdata \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --ignore-scripts
COPY tsconfig.json tsconfig.build.json ./
COPY src ./src
RUN npm run build && npm prune --omit=dev

# Playwright browser + OS dependencies for the MCP bridge. Included
# unconditionally so PLAYWRIGHT_ENABLED=true works out of the box.
# Adds ~300 MB to the image. Only Chromium — other browsers pull extra deps.
RUN npx -y playwright install --with-deps chromium

# Fortress stealth-browser MCP (FORTRESS_ENABLED=true). Isolated venv because
# Debian's system Python is externally managed (PEP 668). "mcp<2": tilion 0.1.14
# imports mcp.server.fastmcp, which mcp 2.x removed, and it doesn't pin mcp itself.
# The engine bundle (~300 MB) is fetched at build time into FORTRESS_BROWSERS_PATH
# so the first run doesn't download it; tilion_fortress skips the download when the
# launcher is already there. Channel "latest" matches the FORTRESS_CHANNEL default
# the bridge sets (the "stable" bundle doesn't launch, see src/agent/fortress-mcp.ts).
# _download is private API: if it disappears, drop that line and the engine
# downloads on first use instead.
ENV FORTRESS_BROWSERS_PATH=/opt/fortress-browsers
RUN apt-get update && apt-get install -y --no-install-recommends python3-venv \
  && rm -rf /var/lib/apt/lists/* \
  && python3 -m venv /opt/tilion \
  && /opt/tilion/bin/pip install --no-cache-dir "tilion[mcp]" "mcp<2" \
  && /opt/tilion/bin/python -c "import tilion_fortress as t; tag = t._CHANNELS['latest']['tag']; t._download('linux-x64', t._host(tag), tag)"

# Claude Code CLI must be on PATH: pi-claude-code-provider shells out to `claude`.
RUN npm install -g @anthropic-ai/claude-code

COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod +x /usr/local/bin/docker-entrypoint.sh

# Expose `pi` (and any other project-local bin) on PATH so `docker exec` finds it.
# PLAYWRIGHT_BROWSER=chromium matches the browser installed above — Playwright MCP
# otherwise defaults to Chrome (the branded Google build), which isn't in the image.
ENV PATH="/app/node_modules/.bin:/opt/tilion/bin:${PATH}" \
    NODE_ENV=production \
    WORKSPACE_DIR=/workspace \
    PI_CODING_AGENT_DIR=/pi-agent \
    PLAYWRIGHT_BROWSER=chromium
VOLUME ["/workspace", "/pi-agent"]

# The node base image already sets ENTRYPOINT ["docker-entrypoint.sh"], and we replaced that
# script above at /usr/local/bin/docker-entrypoint.sh — so ours runs on every container start.
# Keep CMD as the app command so compose overrides (command: ["sleep","infinity"], ...) work.
CMD ["node", "dist/main.js"]