# The INTENT Engine — containerized MCP sidecar.
#
# The container is the TEAM distribution unit: one reproducible image every dev
# (and CI) drops in, instead of "works on my machine." The server itself is plain
# Node, so it also runs bare (`node dist/server.js`) or via npx for devs who don't
# want Docker — Docker is a packaging choice, not a requirement.
#
# AUTH: the engine never holds an API key. It runs sub-agents via the bundled
# `claude` CLI, which authenticates from CLAUDE_CODE_OAUTH_TOKEN (mint once with
# `claude setup-token` on your Max/Pro plan). Pass it at runtime, never bake it in.

# ---- build stage ----
FROM node:22-alpine AS build
WORKDIR /opt/intent-engine
COPY package.json package-lock.json* tsconfig.json ./
RUN npm ci
COPY src ./src
RUN npm run build

# ---- runtime stage ----
FROM node:22-alpine AS runtime
WORKDIR /opt/intent-engine

# git+bash so sub-agents can inspect repos and run the verify gate; tmux is there
# for terminal multi-agent views if a dev wires the engine into that workflow.
RUN apk add --no-cache bash git tmux ca-certificates

# Production deps only, then the compiled output.
COPY package.json package-lock.json* ./
RUN npm ci --omit=dev && npm cache clean --force
COPY --from=build /opt/intent-engine/dist ./dist

# The Claude Code CLI is the engine's runtime — sub-agents are `claude -p` calls.
# Pinned: the CLI version determines sub-agent behavior, so it's part of the
# reproducible image. Bump deliberately and re-test.
RUN npm install -g @anthropic-ai/claude-code@2.1.195

# Drop root. The engine runs untrusted repo tooling — the verify gate executes
# bash/git/npm against whatever is mounted at /work — so it must not run as uid 0.
# node:alpine already ships a `node` user (uid 1000).
RUN chown -R node:node /opt/intent-engine /usr/local/lib/node_modules
USER node

# Repos to review/verify get mounted here; pass cwd="/work/<repo>" to the tools.
# For the verify gate to WRITE (build artifacts), run with `--user "$(id -u):$(id -g)"`
# or make the mounted repo writable by uid 1000.
VOLUME ["/work"]
ENV NODE_ENV=production

# stdio MCP server — `docker run -i --rm` keeps stdin open for the JSON-RPC channel.
ENTRYPOINT ["node", "dist/server.js"]
