FROM oven/bun:1.3.14 AS bun

FROM node:24-bookworm-slim AS build

COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
  ca-certificates \
  g++ \
  make \
  python3 \
  && rm -rf /var/lib/apt/lists/*

# pnpm-lock.yaml is authoritative; Bun would migrate it and reject frozen mode.
RUN npm install --global pnpm@11.17.0

COPY . .
RUN pnpm install --frozen-lockfile
RUN node packages/agents/node_modules/@flue/cli/bin/flue.mjs build --target node --root packages/agents

FROM node:24-bookworm-slim

ENV NODE_ENV=production
ENV PORT=3000

WORKDIR /app

COPY --from=build /app /app
COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun

# Attempt preparation occurs in the Flue handler: it clones repositories and
# installs their dependencies before the runner mounts the shared checkout.
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    git \
    openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --system --gid 10001 zopu \
    && useradd --system --uid 10001 --gid zopu --home-dir /nonexistent zopu \
    && mkdir -p /var/lib/zopu/workspaces \
    && chown -R zopu:zopu /app /var/lib/zopu
USER zopu

EXPOSE 3000

CMD ["node", "packages/agents/dist/server.mjs"]