FROM docker.io/library/golang:1.27-bookworm AS lark-cli-builder

ARG LARK_CLI_VERSION=v1.0.88

RUN apt-get update && apt-get install -y --no-install-recommends python3 ca-certificates \
    && rm -rf /var/lib/apt/lists/*
# The Go module proxy verifies the pinned release through the checksum database.
RUN go mod download "github.com/larksuite/cli@${LARK_CLI_VERSION}" \
    && cp -a "$(go env GOMODCACHE)/github.com/larksuite/cli@${LARK_CLI_VERSION}" /src \
    && chmod -R u+w /src
WORKDIR /src
# A source archive contains an empty fallback registry. Embed the public API
# metadata at image build time so runtime schema/help needs no direct request.
RUN python3 scripts/fetch_meta.py \
    && CGO_ENABLED=0 go build -buildvcs=false -tags authsidecar -trimpath \
      -ldflags "-s -w -X github.com/larksuite/cli/internal/build.Version=${LARK_CLI_VERSION}" \
      -o /out/lark-cli .

FROM docker.io/library/golang:1.27-bookworm AS ticket-manager-cli-builder

WORKDIR /src/apps/cli/ticket-manager
COPY apps/cli/ticket-manager/ ./
COPY packages/sdk-go/contracts/ /src/packages/sdk-go/contracts/
COPY packages/sdk-go/infra/ /src/packages/sdk-go/infra/
RUN GOWORK=off CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /out/ticket-manager-cli .

FROM docker.io/library/node:24-bookworm-slim

ARG CODEX_VERSION=0.153.4

RUN apt-get update && apt-get install -y --no-install-recommends \
      bash \
      bubblewrap \
      ca-certificates \
      curl \
      file \
      git \
      jq \
      openssh-client \
      python3 \
      ripgrep \
      util-linux \
      unzip \
    && npm install --global "@openai/codex@${CODEX_VERSION}" \
    && npm cache clean --force \
    && rm -rf /var/lib/apt/lists/*

COPY --from=lark-cli-builder /out/lark-cli /usr/local/bin/lark-cli
COPY --from=ticket-manager-cli-builder /out/ticket-manager-cli /usr/local/bin/ticket-manager-cli

COPY infra/images/agent-codex/entrypoint.sh /usr/local/bin/agent-codex-entrypoint
COPY infra/images/agent-codex/seed-projects.sh /usr/local/bin/agent-codex-seed-projects
COPY --chown=node:node infra/images/agent-codex/project-seeds/ /opt/agent-codex/project-seeds/

RUN chmod 0755 /usr/local/bin/agent-codex-entrypoint /usr/local/bin/agent-codex-seed-projects

ENV HOME=/home/node \
    CODEX_HOME=/home/node/.codex \
    PROJECTS_ROOT_DIR=/data/projects \
    LARKSUITE_CLI_DEFAULT_AS=bot \
    LARKSUITE_CLI_STRICT_MODE=bot \
    LARKSUITE_CLI_REMOTE_META=off \
    LARKSUITE_CLI_NO_UPDATE_NOTIFIER=1 \
    LARKSUITE_CLI_NO_SKILLS_NOTIFIER=1

RUN mkdir -p "$CODEX_HOME" /workspace "$PROJECTS_ROOT_DIR" \
    && chown -R node:node /home/node /workspace "$PROJECTS_ROOT_DIR"

USER node

WORKDIR /workspace

EXPOSE 4500

ENTRYPOINT ["agent-codex-entrypoint"]
CMD ["--listen", "ws://0.0.0.0:4500", "--strict-config"]