# lvmh worker image: headless pi with golang toolchain, git, ripgrep.
# Built by the daemon on first spawn if missing (LVMH_WORKER_DOCKERFILE),
# or manually via `make worker-image`.
FROM node:24-bookworm-slim

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    bash ca-certificates git ripgrep curl xz-utils make jq \
    golang-go \
    libglib2.0-0 libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 \
    libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \
    libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 libcairo2 libasound2 \
  && rm -rf /var/lib/apt/lists/*

RUN GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest || true

RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent

# npm shim: pi installs git: packages with `npm install`; postinstall
# scripts (husky etc.) crash headless installs. Route installs through
# --ignore-scripts so ALL dotfiles packages (pi-subagents, todo tooling,
# async agents, every extension) survive the bake.
# MCP servers available to pi agents (matches the host setup).
# cloakbrowser-mcp ships the browser automation MCP (bundled deps, no postinstall).
COPY docker/npm-real /usr/local/bin/npm-real
COPY docker/npm-shim /usr/local/bin/npm-ignore-scripts
# rm first: /usr/local/bin/npm is a symlink into npm's lib dir, and COPY
# would follow it and clobber npm-cli.js itself.
RUN rm -f /usr/local/bin/npm \
	&& mv /usr/local/bin/npm-ignore-scripts /usr/local/bin/npm \
	&& chmod +x /usr/local/bin/npm-real /usr/local/bin/npm

COPY docker/worker-models.json /root/.pi/agent/models.json.fallback
# User's pi config from dotfiles (settings, skills, agents, extensions,
# APPEND_SYSTEM.md) — synced by deploy.sh from ~/.dotfiles/pi/agent (filtered:
# no auth.json/sessions/cache/npm). If docker/pi-agent/ is absent this layer
# is skipped (mkdir keeps later COPY targets valid).
COPY docker/pi-agent/ /root/.pi/agent/

# lvmh overlays: dial-home plugin; models.json comes from dotfiles (baked
# by rsync-pi-agent.sh; the .fallback above covers a dotfiles-less bake).
COPY plugin/lvmh-agent.ts /root/.pi/agent/extensions/lvmh-agent.ts
COPY docker/bridge /bridge

# Per-session pi sessions persist here (volume lvmh-sessions); package cache
# shared across spawns via volume lvmh-pi-cache at /root/.pi/agent/cache.
# MCP tooling: cloakbrowser-mcp global (bundled deps), npx for playwright,
# and the standard MCP config the pi-mcp-adapter reads.
RUN npm-real install -g --ignore-scripts cloakbrowser-mcp@1.4.0 \
	&& mkdir -p /root/.config/mcp
COPY docker/mcp.json /root/.config/mcp/mcp.json

ENV PI_SESSION_DIR=/pi-sessions
WORKDIR /workspace
CMD ["node", "/bridge/index.mjs"]