Dockerfile.worker

FROM node:22-slim AS builder
WORKDIR /app

# Install dependencies (including dev for build)
# Using --ignore-scripts to skip lefthook install (needs git repo)
COPY package*.json .npmrc ./
RUN npm ci --ignore-scripts

# Build
COPY tsconfig.json ./
COPY src ./src
RUN npm run build

# Production image
FROM node:22-bookworm AS production
WORKDIR /app

# Install pnpm and squint globally (some repos use pnpm, squint for codebase analysis)
RUN npm install -g pnpm @zbigniewsobiecki/squint@^1.10.2 --force

# Install system packages needed by agent runtime
RUN apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    ed \
    fd-find \
    git \
    gnupg \
    jq \
    lsof \
    postgresql-client \
    procps \
    psutils \
    redis-tools \
    ripgrep \
    ruby \
    sudo \
    tmux \
    unzip \
    && rm -rf /var/lib/apt/lists/* \
    && ln -s $(which fdfind) /usr/local/bin/fd

# Configure tmux to keep panes alive after command exits
# This allows capturing output and exit code from fast-exiting commands
RUN echo "set-option -g remain-on-exit on" > /root/.tmux.conf

# Install ast-grep
RUN ARCH=$(dpkg --print-architecture) && \
    if [ "$ARCH" = "amd64" ]; then AST_ARCH="x86_64"; else AST_ARCH="aarch64"; fi && \
    curl -L "https://github.com/ast-grep/ast-grep/releases/download/0.40.3/app-${AST_ARCH}-unknown-linux-gnu.zip" -o /tmp/ast-grep.zip && \
    unzip /tmp/ast-grep.zip -d /usr/local/bin && \
    rm /tmp/ast-grep.zip && \
    chmod +x /usr/local/bin/sg

# Install agent CLIs used by headless engines in worker jobs
RUN npm install -g @anthropic-ai/claude-code @openai/codex@0.114.0 opencode-ai

# Switch to non-root user for running workers.
# Claude Code CLI refuses --dangerously-skip-permissions when running as root.
# The node user (uid 1000) is pre-created by the Node.js base image and matches
# the default host user for volume mount compatibility.
# Passwordless sudo is needed for setup scripts that require root (e.g. apt-get).
RUN echo "node ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/node

# Create workspace directory owned by node user
RUN mkdir -p /workspace && chown node:node /workspace

# Configure tmux for node user
RUN cp /root/.tmux.conf /home/node/.tmux.conf && chown node:node /home/node/.tmux.conf

# Give node user ownership of the (empty) app directory before switching
RUN chown node:node /app

# Switch to node user before installing app files (avoids slow chown -R)
USER node

# Install production dependencies as node user
COPY --chown=node:node package*.json .npmrc ./
RUN npm ci --omit=dev --ignore-scripts

# Copy built code from builder
COPY --chown=node:node --from=builder /app/dist ./dist

# Copy cascade-tools CLI entry point and make it executable
COPY --chown=node:node bin ./bin
RUN chmod +x bin/cascade-tools.js
# Symlink needs root — use sudo
RUN sudo ln -sf /app/bin/cascade-tools.js /usr/local/bin/cascade-tools

# Copy Eta template files (not handled by TypeScript compiler)
COPY --chown=node:node src/agents/prompts/templates ./dist/agents/prompts/templates

# Copy config
COPY --chown=node:node config ./config

# Worker entry point - processes a single job and exits
CMD ["node", "--import", "./dist/instrument.js", "dist/worker-entry.js"]