# opencode-inside image: opencode 1.18.23 + a small control gateway.
#
# m64 builds this file the first time the capsule is served (no network at run
# time, so everything is installed here, at build time, where there is network).
# `m64 check` refuses anything unpinned: FROM by digest, npm and pip by version.
# No GPU; it builds the same on aarch64 and x86_64. At run time the container's only
# way out is m64's gate (HTTP(S)_PROXY), which allows openrouter.ai:443 and adds the
# OpenRouter key to plain http://openrouter.ai requests.
#
# Base: node:22-bookworm-slim (Node 22.23.2), pinned by its multi-arch index digest.
FROM node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9

RUN apt-get update -qq && apt-get install -y --no-install-recommends \
      ca-certificates git ripgrep jq curl python3 python3-venv python3-pip \
      build-essential procps less file unzip \
    && rm -rf /var/lib/apt/lists/*

RUN npm install -g opencode-ai@1.18.23 && npm cache clean --force

# Gateway deps: fastapi 0.115 / uvicorn 0.32 / httpx 0.28, resolved once in this image
# (Python 3.11) and pinned with every transitive dependency.
RUN python3 -m venv /opt/gateway && /opt/gateway/bin/pip install --no-cache-dir \
      fastapi==0.115.14 uvicorn==0.32.1 httpx==0.28.1 \
      starlette==0.46.2 pydantic==2.14.1 pydantic_core==2.50.1 annotated-types==0.8.0 \
      typing_extensions==4.16.0 typing-inspection==0.4.4 anyio==4.15.1 idna==3.20 \
      certifi==2026.10.23 httpcore==1.0.9 h11==0.16.0 click==8.5.0

# Everything opencode would otherwise fetch at run time (models.dev catalogue, LSP servers,
# self-update) is disabled. The npm packages it installs on a project's first use are
# warmed here, where the build has network (warm_opencode.sh); start.sh copies them into
# the throwaway HOME. Without this, every run would log a blocked registry.npmjs.org.
ENV OPENCODE_DISABLE_AUTOUPDATE=1 \
    OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
    OPENCODE_DISABLE_MODELS_FETCH=1 \
    OPENCODE_DISABLE_SHARE=1
COPY opencode.json /etc/opencode/opencode.json
COPY warm_opencode.sh /tmp/warm_opencode.sh
RUN bash /tmp/warm_opencode.sh && rm /tmp/warm_opencode.sh

USER node
WORKDIR /scratch