# syntax=docker/dockerfile:1.7

# Apple Silicon is the only V1 target. The manifest digest freezes the exact
# Node 24.18.1 base used by the customer-local Apple Container image build.
FROM node:24.18.1-bookworm-slim@sha256:c39335f45d6d5b2a5be95b0f1a63e57cca4e9e36cc69b313c1ad5472b13a1e3a AS debian-snapshot

# The timestamp is inherited from the pinned Node base image's own sources
# metadata. HTTP transport is acceptable here because apt verifies the signed
# InRelease metadata and every package hash from the immutable snapshot.
RUN printf '%s\n' \
      'Types: deb' \
      'URIs: http://snapshot.debian.org/archive/debian/20260713T000000Z' \
      'Suites: bookworm bookworm-updates' \
      'Components: main' \
      'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
      '' \
      'Types: deb' \
      'URIs: http://snapshot.debian.org/archive/debian-security/20260713T000000Z' \
      'Suites: bookworm-security' \
      'Components: main' \
      'Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg' \
      > /etc/apt/sources.list.d/debian.sources

FROM debian-snapshot AS app-dependencies

RUN apt-get -o Acquire::Check-Valid-Until=false update \
  && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    python3 make g++ \
  && rm -rf /var/lib/apt/lists/*
WORKDIR /build/app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
  && npm audit signatures \
  && node -e 'const p=require("./node_modules/node-pty/package.json"); if (p.version !== "1.1.0" || p.scripts?.install !== "node scripts/prebuild.js || node-gyp rebuild" || p.scripts?.postinstall !== "node scripts/post-install.js") process.exit(1)' \
  && npm rebuild node-pty --foreground-scripts \
  && mkdir -p /build/sbom \
  && npm sbom --omit=dev --sbom-format cyclonedx > /build/sbom/app.cdx.json \
  && npm cache clean --force

FROM node:24.18.1-bookworm-slim@sha256:c39335f45d6d5b2a5be95b0f1a63e57cca4e9e36cc69b313c1ad5472b13a1e3a AS tool-dependencies

WORKDIR /opt/beeem-code-tools
COPY desktop/Runtime/tools/package.json desktop/Runtime/tools/package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
  && npm audit signatures \
  && node -e 'const p=require("./node_modules/@openai/codex/package.json"); if (p.version !== "0.147.0" || p.bin?.codex !== "bin/codex.js") process.exit(1)' \
  && node -e 'const fs=require("node:fs"); const p="./node_modules/@openai/codex-linux-arm64/vendor/aarch64-unknown-linux-musl/codex-resources/bwrap"; const s=fs.statSync(p); if (!s.isFile() || (s.mode & 0o111) === 0) process.exit(1)' \
  && ./node_modules/@openai/codex-linux-arm64/vendor/aarch64-unknown-linux-musl/codex-resources/bwrap --help 2>&1 \
    | grep -F -- '--argv0' >/dev/null \
  && mkdir -p /build/sbom \
  && npm sbom --omit=dev --sbom-format cyclonedx > /build/sbom/tools.cdx.json \
  && npm cache clean --force

FROM debian-snapshot

RUN apt-get -o Acquire::Check-Valid-Until=false update \
  && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    ca-certificates chromium git \
  && mkdir -p /usr/share/beeem-code/sbom \
  && dpkg-query -W -f='${Package}\t${Version}\t${Architecture}\n' \
    | LC_ALL=C sort > /usr/share/beeem-code/sbom/debian-packages.tsv \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=app-dependencies /build/app/node_modules ./node_modules
COPY --from=tool-dependencies /opt/beeem-code-tools /opt/beeem-code-tools
COPY --from=app-dependencies /build/sbom/app.cdx.json /usr/share/beeem-code/sbom/app.cdx.json
COPY --from=tool-dependencies /build/sbom/tools.cdx.json /usr/share/beeem-code/sbom/tools.cdx.json
COPY ContainerRuntime.MANIFEST.sha256 /usr/share/beeem-code/sbom/ContainerRuntime.MANIFEST.sha256
COPY package.json package-lock.json ./
COPY THIRD_PARTY_NOTICES.md /usr/share/beeem-code/THIRD_PARTY_NOTICES.md
COPY --chmod=0444 desktop/Runtime/licenses/bubblewrap/COPYING /usr/share/beeem-code/licenses/bubblewrap/COPYING
COPY actual-conflicts.js codex-auth-api.js commercial-git.js companion-conversation.js conflict-assessment.js delivery-isolation.js durable-state.js ./
COPY execution-engine.js execution-prompts.js frontend-assets.js ./
COPY integration-finalizer.js integration-git.js integration-runner.js preview-proxy.js preview-service.js proof-engine.js proof-lifecycle.js ./
COPY pull-request-delivery.js repository-index-service.js repository-index.js repository-worktrees.js repository-index-worker.js run-processes.js runtime-auth.js runtime-provider.js runtime-secrets.js ./
COPY runtime-cli-auth.js secret-redaction.js server.js state-delivery.js state-http.js state-store.js state-writer-lock.js validation-cache.js ./
COPY public ./public
COPY scripts ./scripts
COPY desktop/Runtime/container-entrypoint.sh /usr/local/bin/beeem-code-runtime

RUN set -eu; \
  install -d -o root -g root -m 0755 /etc/codex; \
  printf '%s\n' \
    'forced_login_method = "chatgpt"' \
    'cli_auth_credentials_store = "file"' \
    'approval_policy = "never"' \
    'check_for_update_on_startup = false' \
    > /etc/codex/managed_config.toml; \
  printf '%s\n' \
    'allowed_login_methods = ["chatgpt"]' \
    'allowed_approval_policies = ["never"]' \
    'default_permissions = "divergence-commercial"' \
    'allowed_web_search_modes = ["disabled"]' \
    'allow_login_shell = false' \
    'allow_managed_hooks_only = true' \
    'allow_remote_control = false' \
    'allow_appshots = false' \
    '' \
    '[allowed_permission_profiles]' \
    'divergence-commercial = true' \
    '' \
    '[permissions.filesystem]' \
    'deny_read = ["/runtime/codex-home", "/runtime/state"]' \
    '' \
    '[permissions.divergence-commercial]' \
    'extends = ":workspace"' \
    'description = "Commercial workspace without auth or durable-state access"' \
    '' \
    '[permissions.divergence-commercial.network]' \
    'enabled = false' \
    '' \
    '[features]' \
    'code_mode_host = true' \
    'apps = false' \
    'browser_use = false' \
    'browser_use_external = false' \
    'browser_use_full_cdp_access = false' \
    '' \
    '[mcp_servers]' \
    '' \
    '[plugins]' \
    > /etc/codex/requirements.toml; \
  chown root:root /etc/codex/managed_config.toml /etc/codex/requirements.toml; \
  chmod 0444 /etc/codex/managed_config.toml /etc/codex/requirements.toml; \
  chmod 0555 /usr/local/bin/beeem-code-runtime; \
  ln -s /usr/local/bin/beeem-code-runtime /usr/local/bin/beeem-code-codex; \
  chmod -R a-w /app /opt/beeem-code-tools

ENV NODE_ENV=production \
    PATH=/opt/beeem-code-tools/node_modules/.bin:/usr/local/bin:/usr/bin:/bin \
    BEEEM_CODE_RUNTIME_STATE=/runtime/state

EXPOSE 4999 5000
ENTRYPOINT ["/usr/local/bin/beeem-code-runtime"]
