Dockerfile.jeeves

FROM nvidia/cuda:12.9.1-cudnn-devel-ubuntu24.04 AS base

# Set environment variables
ENV DEBIAN_FRONTEND=noninteractive
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1
# Vars for CUDA
ENV CUDA_HOME=/usr/local/cuda
ENV PATH=${CUDA_HOME}/bin:${PATH}
ENV LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/lib/x86_64-linux-gnu

# Install system dependencies and Python
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        software-properties-common \
        ca-certificates \
        curl \
        gnupg \
        gnupg2 \
        lsb-release \
        wget && \
    # Add Docker’s official GPG key + apt repo
    install -m 0755 -d /etc/apt/keyrings && \
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \
    chmod a+r /etc/apt/keyrings/docker.asc && \
    . /etc/os-release && \
    printf '%s\n' \
        "Types: deb" \
        "URIs: https://download.docker.com/linux/ubuntu" \
        "Suites: ${UBUNTU_CODENAME:-$VERSION_CODENAME}" \
        "Components: stable" \
        "Signed-By: /etc/apt/keyrings/docker.asc" \
        > /etc/apt/sources.list.d/docker.sources && \
    # Add Nvidia key + repo
    apt-key del 7fa2af80 && \
    sed -i '/developer\.download\.nvidia\.com\/compute\/cuda\/repos/d' /etc/apt/sources.list.d/* && \
    sed -i '/developer\.download\.nvidia\.com\/compute\/machine-learning\/repos/d' /etc/apt/sources.list.d/* && \
    wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb && \
    dpkg -i cuda-keyring_1.1-1_all.deb && \
    # Deadsnakes for alt python versions
    add-apt-repository ppa:deadsnakes/ppa && \
    # Needed for recent versions of yq that behave right from opensuse repo...
    VERSION=$(. /etc/os-release && echo $VERSION_ID) && \
    echo "deb http://download.opensuse.org/repositories/home:/alvistack/xUbuntu_${VERSION}/ /" > /etc/apt/sources.list.d/home:alvistack.list && \
    curl -fsSL https://download.opensuse.org/repositories/home:/alvistack/xUbuntu_${VERSION}/Release.key | gpg --dearmor > /etc/apt/trusted.gpg.d/home_alvistack.gpg && \
    apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        git \
        bash \
        vim \
        nano \
        less \
        zsh \
        jq \
        yq \
        sudo \
        tmux \
        xclip \
        xsel \
        python3 \
        python3-pip \
        python3-venv \
        python3-dev \
        openssl \
        libnss3 \
        libatk-bridge2.0-0 \
        libdrm2 \
        libxkbcommon0 \
        libxcomposite1 \
        libxdamage1 \
        libxrandr2 \
        libgbm1 \
        libxss1 \
        libasound2t64 \
        supervisor \
        # Docker
        docker-ce \
        docker-ce-cli \
        containerd.io \
        docker-buildx-plugin \
        docker-compose-plugin \
        # replace docker overlyfs for the in-container docker runtime to work
        fuse-overlayfs \
        # Nvidia container toolkit 
        nvidia-container-toolkit && \
    # Configure container runtime
    nvidia-ctk runtime configure --runtime=docker && \
    apt-get autoremove -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# ============================================================================
# Create Python venv and add to PATH
# ============================================================================
RUN python3 -m venv /opt/venv

# Update PATH to prioritize venv python instead of system python
ENV PATH="/opt/venv/bin:${PATH}"

# Upgrade pip and other utils in venv
RUN /opt/venv/bin/pip install --upgrade --force-reinstall --ignore-installed \
        pip \
        setuptools \
        wheel \
        ninja \
        meson \
        build

# Install latest Node.js LTS
RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
    apt-get install -y --no-install-recommends \
        nodejs && \
    npm install -g npm@latest pnpm && \
    npm cache clear --force && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

FROM base AS opencode-builder
# Manual versioning since we're building from source...
ENV OPENCODE_VERSION=0.0.0-jeeves
# Env var to toggle desktop app build inclusion
ARG BUILD_DESKTOP
ENV BUILD_DESKTOP=$BUILD_DESKTOP


# Opencode requires bun for building/development but not necessarily runtime, so install it on this layer only
# Opencode is a bit finnicky with bun versions, so you may need to do a test build and see which bun version
# it is expecting and pin it below for the build to work.
RUN npm install -g bun@1.3.13 && \
    npm cache clear --force

RUN git config --global http.postBuffer 524288000 \
    && git config --global http.version HTTP/1.1

# Clone repo
RUN git clone --depth=1 --recurse-submodules --shallow-submodules --remote-submodules https://github.com/anomalyco/opencode.git /app/opencode \
    && chmod -R 777 /app/opencode

WORKDIR /app/opencode

# Temp patches to resolve upstream issues before they are merged:
# - PR #11812: Fix `run --attach` agent validation crash --> Merged
#   https://github.com/anomalyco/opencode/pull/11812
# - PR #12623: Doom-loop guard for repeated reasoning/output
#   https://github.com/anomalyco/opencode/pull/12623
# - Issue #12938: Subagents can't use 'todowrite' tool (hotfix via sed)
#   https://github.com/anomalyco/opencode/issues/12938
#
#curl -L https://github.com/anomalyco/opencode/pull/11812.patch -o /tmp/11812.patch && \
    #curl -L https://github.com/anomalyco/opencode/pull/12623.patch -o /tmp/12623.patch \
    #&& git apply /tmp/11812.patch \
    #&& git apply /tmp/12623.patch \

RUN \
    sed -i "s/todoread: { \"*\": \"deny\" }/todoread: { \"*\": \"allow\" }/g" packages/opencode/src/tool/task.ts \
    && sed -i "s/todowrite: { \"*\": \"deny\" }/todowrite: { \"*\": \"allow\" }/g" packages/opencode/src/tool/task.ts \
    && sed -i 's/todowrite: false/todowrite: true/g' packages/opencode/src/tool/task.ts \
    && sed -i 's/todoread: false/todoread: true/g' packages/opencode/src/tool/task.ts


# Some branding overrides, just because...
#RUN sed -i 's/"productName": "OpenCode"/"productName": "OpenCode Jeeves"/g' /app/opencode/packages/desktop/src-tauri/tauri.prod.conf.json
#RUN sed -i 's/"identifier": "ai.opencode.desktop"/"identifier": "ai.opencode.desktop.jeeves"/g' /app/opencode/packages/desktop/src-tauri/tauri.prod.conf.json

# CLI/TUI/WebUI build
RUN  set -eux; bun install
RUN  set -eux; ./packages/opencode/script/build.ts

RUN \
    if [  "$BUILD_DESKTOP" = "true" ]; then \
        echo "BUILD_DESKTOP env variable is set. Running opencode desktop build step."; \
        # Install additional deps \
        apt update; \
        apt install -y  --no-install-recommends \
            libwebkit2gtk-4.1-dev \
            build-essential \
            curl \
            wget \
            file \
            libxdo-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            rustup \
            # For win desktop \
            lld \
            llvm \
            nsis \
            clang \
            pkg-config \
            libglib2.0-dev \
            libgtk-3-dev \
            libgdk-pixbuf-2.0-dev \
            unzip; \
        # apt clean up \
        apt-get clean; \
        rustup default stable; \
        # For win desktop builder \
        cargo install --locked cargo-xwin; \
        rustup target add x86_64-pc-windows-msvc; \
        # Stage opencode bin sidecar pre-compile \
        mkdir -p /app/opencode/packages/desktop/src-tauri/sidecars; \
        cp /app/opencode/packages/opencode/dist/opencode-linux-x64/bin/opencode \
           /app/opencode/packages/desktop/src-tauri/sidecars/opencode-cli-x86_64-unknown-linux-gnu; \
        cp /app/opencode/packages/opencode/dist/opencode-windows-x64/bin/opencode.exe \
           /app/opencode/packages/desktop/src-tauri/sidecars/opencode-cli-x86_64-pc-windows-msvc; \
        # Add .exe extension for Windows sidecar (required by Tauri) \
        cp /app/opencode/packages/opencode/dist/opencode-windows-x64/bin/opencode.exe \
           /app/opencode/packages/desktop/src-tauri/sidecars/opencode-cli-x86_64-pc-windows-msvc.exe; \
        # run desktop builder (Linux) \
        cd /app/opencode/packages/desktop; \
        bun run tauri build --config src-tauri/tauri.prod.conf.json; \
        # run desktop builder (Windows) \
        bash -c \
            'export PATH="$HOME/.bun/bin:$HOME/.cargo/bin:$PATH" && \
            # source "$HOME/.cargo/env" && \
            bun run tauri build --config src-tauri/tauri.prod.conf.json \
                --runner cargo-xwin \
                --target x86_64-pc-windows-msvc'; \
        # final temp cleanup \
        rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*; \
    else \
        echo "Environment variable is not set. Skipping opencode desktop build step."; \
        # Create empty folders so the COPY command in the runtime stage doesn't fail \
        mkdir -p \
            /app/opencode/packages/desktop/src-tauri/target/release/bundle/deb \
            /app/opencode/packages/desktop/src-tauri/target/release/bundle/rpm \
            /app/opencode/packages/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis; \
    fi

WORKDIR /app/opencode

FROM base AS runtime

# ============================================================================
# Create non-root user with support for UID:GID mapping
# ============================================================================
ARG UID=1000
ARG GID=1000

# Create group and user, handling existing UID/GID
RUN if getent group ${GID}; then \
        groupmod -n jeeves $(getent group ${GID} | cut -d: -f1); \
    else \
        groupadd -r -g ${GID} jeeves; \
    fi && \
    if id -u ${UID} >/dev/null 2>&1; then \
        existing_user=$(id -nu ${UID}); \
        usermod -l jeeves -d /home/jeeves -m "$existing_user" 2>/dev/null || true; \
        groupmod -n jeeves "$existing_user" 2>/dev/null || true; \
    else \
        useradd -r -u ${UID} -g jeeves -m -s /bin/bash -d /home/jeeves jeeves; \
    fi && \
    #useradd -m -s /usr/bin/zsh jeeves && \
    echo '# zshrc (container default)' > /home/jeeves/.zshrc && \
    chown jeeves:jeeves /home/jeeves/.zshrc && \
    usermod -aG sudo jeeves && \
    echo "jeeves ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/jeeves && \
    chmod 0440 /etc/sudoers.d/jeeves

# ============================================================================
# Configure environment
# ============================================================================
ENV WORKSPACE=/proj
ENV HOME=/home/jeeves
ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH="/opt/jeeves/crawl4ai:${PYTHONPATH}"

# Ensure venv is used for python/pip
ENV VIRTUAL_ENV=/opt/venv

# Install python packages
RUN /opt/venv/bin/pip install --upgrade --force-reinstall --ignore-installed \
        mcp-server-fetch \
        pyyaml

RUN /opt/venv/bin/pip install --no-cache-dir \
        git+https://github.com/BerriAI/litellm.git \
        git+https://github.com/unclecode/crawl4ai.git  \
        pydantic \
        httpx

RUN git clone --depth=1 https://github.com/sadiuysal/crawl4ai-mcp-server.git /tmp/crawl4ai-mcp-server && \
    mkdir -p /opt/jeeves/crawl4ai && \
    cp -r /tmp/crawl4ai-mcp-server/crawler_agent /opt/jeeves/crawl4ai/crawler_agent && \
    rm -rf /tmp/crawl4ai-mcp-server

# Install Playwright browser and dependencies
USER jeeves

ENV PLAYWRIGHT_MCP_NO_SANDBOX=1
ENV PLAYWRIGHT_SKIP_BROWSER_CLEANUP=1

RUN sudo npm install -g @playwright/test && \
    npx playwright-core install-deps chromium firefox webkit && \
    npx playwright-core install --no-shell chromium firefox webkit

USER root


# ============================================================================
# Create and stage helper scripts
# ============================================================================

# Helper for tmux shell session create/reattach
RUN cat << 'EOF' > /usr/local/bin/jeeves-shell
#!/usr/bin/env sh
set -e

SESSION_NAME=main

# If already inside tmux, just start a normal shell
if [ -n "$TMUX" ]; then
  exec "${SHELL:-/bin/bash}"
fi

# Attach to existing session or create it
# The welcome message will be displayed by the shell's rc file
exec tmux new-session -A -s "$SESSION_NAME"
EOF

RUN chmod +x /usr/local/bin/jeeves-shell && \
    sed -i 's/\r$//' /usr/local/bin/jeeves-shell

# Welcome message and tmux hook for bash
# Can disable tmux with DISABLE_TMUX=1 and message with DISABLE_WELCOME=1
RUN cat << 'EOF' >> /etc/bash.bashrc

# --- opencode welcome message ---
# Skip if:
# - not an interactive TTY
# - explicitly disabled
if [ -t 1 ] && [ -z "$DISABLE_WELCOME" ]; then
  echo -e "\033[1;34m=============================================\033[0m"
  echo -e "\033[1;32mWelcome to Project Jeeves!\033[0m"
  echo -e "\033[1;34m=============================================\033[0m"
  echo -e "\033[0;37mWorkspace: \033[1;36m/proj\033[0m"
  echo -e "\033[0;37mOpenCode:  \033[1;36mRun 'opencode' to start TUI\033[0m"
  echo -e "\033[0;37mWeb UI:    \033[1;36mhttp://localhost:3333 (auto-started)\033[0m"
  echo -e "\033[0;37mService:   \033[1;36mopencode-web {start|stop|restart|status|logs}\033[0m"
  if command -v claude >/dev/null 2>&1; then
    echo -e "\033[1;34m--------------------------------------------- \033[0m"
    if claude auth status >/dev/null 2>&1; then
      echo -e "\033[0;37mClaude Max: \033[1;32mauthenticated\033[0m"
    else
      echo -e "\033[0;37mClaude Max: \033[1;33mnot authenticated\033[0;37m — run \033[1;36mclaude login\033[0;37m once (or \033[1;36mclaude setup-token\033[0;37m for headless)\033[0m"
      echo -e "\033[0;37m            one auth covers both 'claude' (CLI) and 'opencode' (via Meridian)\033[0m"
    fi
    echo -e "\033[0;37m  • \033[1;36mclaude\033[0;37m     — direct Claude Code CLI session (uses your Max subscription)\033[0m"
    echo -e "\033[0;37m  • \033[1;36mopencode\033[0;37m   — OpenCode TUI/Web; routes Anthropic calls through Meridian → Claude Max\033[0m"
  fi
  echo -e "\033[1;34m--------------------------------------------- \033[0m"
  echo -e "\033[0;37mQuick Tips:\033[0m"
  echo -e "\033[0;37m  • Initialize workspace: \033[1;36minstall-mcp-servers.sh && install-agents.sh -a\033[0m"
  echo -e "\033[0;37m  • Ralph init (-f overwrites): \033[1;36mralph-init.sh -f\033[0m"
  echo -e "\033[0;37m  • Validate Ralph agents: \033[1;36mCheck .ralph/config/agents.yaml\033[0m"
  echo -e "\033[0;37m  • Sync Ralph agents: \033[1;36msync-agents.sh\033[0m"
  echo -e "\033[0;37m  • Opencode sync bug: TUI/WebUI sessions not real-time synced\033[0m"
  echo -e "\033[0;37m  • Restart container after adding agents/skills/MCP servers\033[0m"
  echo -e "\033[1;34m=============================================\033[0m"
  echo
fi
# --- end opencode welcome message ---

# --- opencode tmux auto-attach ---
# Skip if:
# - not an interactive TTY
# - already inside tmux
# - explicitly disabled
if [ -t 1 ] && [ -z "$TMUX" ] && [ -z "$DISABLE_TMUX" ]; then
  exec /usr/local/bin/jeeves-shell
fi
# --- end opencode tmux auto-attach ---

EOF

# Welcome message and tmux hook for zsh
# Can disable tmux with DISABLE_TMUX=1 and message with DISABLE_WELCOME=1
RUN cat << 'EOF' >> /etc/zsh/zshrc

# --- opencode welcome message ---
# Skip if:
# - not an interactive TTY
# - explicitly disabled
if [[ -t 1 && -z "$DISABLE_WELCOME" ]]; then
  echo -e "\033[1;34m=============================================\033[0m"
  echo -e "\033[1;32mWelcome to Project Jeeves!\033[0m"
  echo -e "\033[1;34m=============================================\033[0m"
  echo -e "\033[0;37mWorkspace: \033[1;36m/proj\033[0m"
  echo -e "\033[0;37mOpenCode:  \033[1;36mRun 'opencode' to start TUI\033[0m"
  echo -e "\033[0;37mWeb UI:    \033[1;36mhttp://localhost:3333 (auto-started)\033[0m"
  echo -e "\033[0;37mService:   \033[1;36mopencode-web {start|stop|restart|status|logs}\033[0m"
  if command -v claude >/dev/null 2>&1; then
    echo -e "\033[1;34m--------------------------------------------- \033[0m"
    if claude auth status >/dev/null 2>&1; then
      echo -e "\033[0;37mClaude Max: \033[1;32mauthenticated\033[0m"
    else
      echo -e "\033[0;37mClaude Max: \033[1;33mnot authenticated\033[0;37m — run \033[1;36mclaude login\033[0;37m once (or \033[1;36mclaude setup-token\033[0;37m for headless)\033[0m"
      echo -e "\033[0;37m            one auth covers both 'claude' (CLI) and 'opencode' (via Meridian)\033[0m"
    fi
    echo -e "\033[0;37m  • \033[1;36mclaude\033[0;37m     — direct Claude Code CLI session (uses your Max subscription)\033[0m"
    echo -e "\033[0;37m  • \033[1;36mopencode\033[0;37m   — OpenCode TUI/Web; routes Anthropic calls through Meridian → Claude Max\033[0m"
  fi
  echo -e "\033[1;34m--------------------------------------------- \033[0m"
  echo -e "\033[0;37mQuick Tips:\033[0m"
  echo -e "\033[0;37m  • Initialize workspace: \033[1;36minstall-mcp-servers.sh && install-agents.sh -a\033[0m"
  echo -e "\033[0;37m  • Ralph init (-f overwrites): \033[1;36mralph-init.sh -f\033[0m"
  echo -e "\033[0;37m  • Validate Ralph agents: \033[1;36mCheck .ralph/config/agents.yaml\033[0m"
  echo -e "\033[0;37m  • Sync Ralph agents: \033[1;36msync-agents.sh\033[0m"
  echo -e "\033[0;37m  • Opencode sync bug: TUI/WebUI sessions not real-time synced\033[0m"
  echo -e "\033[0;37m  • Restart container after adding agents/skills/MCP servers\033[0m"
  echo -e "\033[1;34m=============================================\033[0m"
  echo
fi
# --- end opencode welcome message ---

# --- opencode tmux auto-attach ---
# Skip if:
# - not an interactive TTY
# - already inside tmux
# - explicitly disabled
if [[ -t 1 && -z "$TMUX" && -z "$DISABLE_TMUX" ]]; then
  exec /usr/local/bin/jeeves-shell
fi
# --- end opencode tmux auto-attach ---

EOF

# And now for tmux config settings to make it behave like a proper terminal
# with history scrolling, copy-paste, etc.
RUN cat << 'EOF' >> /home/jeeves/.tmux.conf
# 1. Enable Mouse Support (enables scrolling terminal output)
set -g mouse on

# 2. Enable System Clipboard (OSC 52 support)
set -s set-clipboard on

# 3. Fix ESC Lag (lowers delay from 500ms to 10ms)
set -sg escape-time 10

# 4. Optional: Increase history for more scrollback
set -g history-limit 50000

# Fix colors
set -g default-terminal "screen-256color"
EOF

# Opencode pseudo-aliases to auto-attach the TUI to the auto-started web UI server
RUN echo 'opencode() { \
  if [[ $# -eq 0 ]]; then \
    command opencode attach http://localhost:3333; \
  else \
    command opencode "$@"; \
  fi \
}' >> /home/jeeves/.bashrc

RUN echo 'opencode() { \
  if [[ $# -eq 0 ]]; then \
    command opencode attach http://localhost:3333; \
  else \
    command opencode "$@"; \
  fi \
}' >> /home/jeeves/.zshrc

# ============================================================================
# Setup directories with proper permissions
# ============================================================================
RUN mkdir -p /proj && \
    chown -R jeeves:jeeves /proj && \
    chown -R jeeves:jeeves /home/jeeves && \
    chown -R jeeves:jeeves /opt/venv

# Switch to non-root user
USER jeeves

# env to hopefully push the `~/.claude.json` into the `~/.claude` folder for easier volume mapping
ENV CLAUDE_CONFIG_DIR="/home/jeeves/.claude"

# Build argument to control Claude Code installation
ARG INSTALL_CLAUDE_CODE
ENV INSTALL_CLAUDE_CODE=${INSTALL_CLAUDE_CODE:-false}

# Since claude has no build stage, run the installer script (conditional)
RUN if [ "$INSTALL_CLAUDE_CODE" = "true" ]; then \
        echo "Installing Claude Code..."; \
        curl -fsSL https://claude.ai/install.sh | bash -s -- latest; \
        # Add ~/.local/bin to path, since this is where claude installs and we can't change that, \
        # we'll manually symlink the bin ourselves to a more standard location... \
        sudo ln -sf "$HOME/.local/bin/claude" /usr/local/bin/claude; \
    else \
        echo "Claude Code installation skipped (INSTALL_CLAUDE_CODE is not 'true')"; \
    fi

#Linux CLI Binary, linked to path location as well since we will use it interactively
COPY --from=opencode-builder ["/app/opencode/packages/opencode/dist/opencode-linux-x64/bin/opencode", "/app/dist/opencode"]
RUN sudo ln -sf /app/dist/opencode /usr/local/bin/opencode
# Linux GUI (Debian/Ubuntu Package)
COPY --from=opencode-builder ["/app/opencode/packages/desktop/src-tauri/target/release/bundle/deb/OpenCode Jeeves*.deb", "/app/dist/"]
# Linux GUI (RPM/Fedora Package)
COPY --from=opencode-builder ["/app/opencode/packages/desktop/src-tauri/target/release/bundle/rpm/OpenCode Jeeves*.rpm", "/app/dist/"]
# Windows GUI (Standalone Executable)
COPY --from=opencode-builder ["/app/opencode/packages/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/OpenCode Jeeves*.exe", "/app/dist/"]

RUN sudo chmod 0755 /usr/local/bin/opencode

# ============================================================================
# Stage OOB configuration files before bind mounts would hide them
# ============================================================================
# Create OOB config staging directory
RUN sudo mkdir -p /opt/oob-config/.config/opencode /opt/oob-config/.claude

# Copy any existing config files generated by installations to OOB staging
RUN if [ -d "/home/jeeves/.config/opencode" ] && [ "$(ls -A /home/jeeves/.config/opencode 2>/dev/null)" ]; then \
        sudo cp -r /home/jeeves/.config/opencode/* /opt/oob-config/.config/opencode/; \
    fi

RUN if [ -d "/home/jeeves/.claude" ] && [ "$(ls -A /home/jeeves/.claude 2>/dev/null)" ]; then \
        sudo cp -r /home/jeeves/.claude/* /opt/oob-config/.claude/; \
    fi

# Make sure the OOB config directories have proper permissions
RUN sudo chown -R jeeves:jeeves /opt/oob-config

# ============================================================================
# Configure supervisord for service management
# ============================================================================

# Switch to root for supervisord configuration
USER root

# Create supervisord configuration directory structure
# /var/run/supervisor is a dedicated subdirectory owned by jeeves so the
# unix socket and pidfile can be created without requiring root at runtime
RUN mkdir -p /etc/supervisor/conf.d /var/log/supervisor /var/run/supervisor && \
    chown jeeves:jeeves /var/run/supervisor && \
    chmod 755 /var/run/supervisor

# Main supervisord configuration
RUN cat << 'EOF' > /etc/supervisor/supervisord.conf
[supervisord]
nodaemon=true
logfile=/var/log/supervisor/supervisord.log
pidfile=/var/run/supervisor/supervisord.pid

[unix_http_server]
file=/var/run/supervisor/supervisor.sock
chmod=0770
chown=jeeves:jeeves

[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///var/run/supervisor/supervisor.sock

[include]
files = /etc/supervisor/conf.d/*.conf
EOF

# Opencode web service configuration
RUN cat << 'EOF' > /etc/supervisor/conf.d/opencode-web.conf
[program:opencode-web]
command=/usr/local/bin/opencode web --hostname 0.0.0.0 --port 3333
directory=/proj
user=jeeves
autostart=false
autorestart=unexpected
startsecs=2
startretries=3
stopsignal=TERM
stopwaitsecs=30
stdout_logfile=/var/log/supervisor/opencode-web.log
stderr_logfile=/var/log/supervisor/opencode-web-error.log
environment=HOME="/home/jeeves",USER="jeeves",PATH="/opt/venv/bin:/usr/local/cuda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",BUN_CONFIG_NO_CLEAR_TERMINAL_ON_EXIT="1",UV_USE_IO_URING="0"
EOF

# Create opencode-web helper script for service management
RUN cat << 'EOF' > /usr/local/bin/opencode-web
#!/bin/bash

print_usage() {
    echo "Usage: opencode-web {start|stop|restart|status|logs}"
    echo ""
    echo "Commands:"
    echo "  start    Start the opencode web service"
    echo "  stop     Stop the opencode web service"
    echo "  restart  Restart the opencode web service"
    echo "  status   Check the service status"
    echo "  logs     View the service logs"
}

case "${1:-}" in
    start)
        echo "Starting opencode-web service..."
        supervisorctl start opencode-web
        ;;
    stop)
        echo "Stopping opencode-web service..."
        supervisorctl stop opencode-web
        ;;
    restart)
        echo "Restarting opencode-web service..."
        supervisorctl restart opencode-web
        ;;
    status)
        supervisorctl status opencode-web
        ;;
    logs)
        if [ -f /var/log/supervisor/opencode-web.log ]; then
            tail -f /var/log/supervisor/opencode-web.log
        else
            echo "Log file not found. Service may not have started yet."
            exit 1
        fi
        ;;
    *)
        print_usage
        exit 1
        ;;
esac
EOF

RUN chmod +x /usr/local/bin/opencode-web && \
    sed -i 's/\r$//' /usr/local/bin/opencode-web

# Ensure supervisor log directory is writable by jeeves user
RUN chown -R jeeves:jeeves /var/log/supervisor

# ============================================================================
# Install PRD Creator Toolkit
# ============================================================================

# Create directory for jeeves supplementary tools
RUN mkdir -p /opt/jeeves/

# Copy helper scripts
COPY jeeves/bin /usr/local/bin/

# Copy PRD Creator files
COPY jeeves/PRD /opt/jeeves/PRD/
# Copy Deepest Thinking files
COPY jeeves/Deepest-Thinking /opt/jeeves/Deepest-Thinking/
# Copy Ralph ref files
COPY jeeves/Ralph /opt/jeeves/Ralph/

# Set permissions
RUN chmod -R +x /usr/local/bin/ && \
    chown -R jeeves:jeeves /opt/jeeves && \
    find /usr/local/bin/ -type f | xargs sed -i 's/\r$//'

# ============================================================================
# Create embedded entrypoint script for config initialization
# ============================================================================

RUN sudo cat << 'EOF' > /usr/local/bin/entrypoint.sh
#!/bin/bash
set -euo pipefail

# Flag to track if Docker engine was started by this script
DOCKER_ENGINE_STARTED=false

# Function to check if ENABLE_DIND is a truthy value
is_dind_enabled() {
  local value="${ENABLE_DIND:-}"
  # Convert to lowercase for case-insensitive check
  value=$(echo "$value" | tr '[:upper:]' '[:lower:]')
  
  # Truthy values: true, 1, yes, on
  if [[ "$value" == "true" || "$value" == "1" || "$value" == "yes" || "$value" == "on" ]]; then
    return 0 # true
  fi
  
  return 1 # false
}

# Function to start docker engine and wait until it's fully running
start_docker_engine() {
  # Check if DIND is enabled
  if ! is_dind_enabled; then
    echo "Docker Engine (dockerd) startup skipped: ENABLE_DIND is not set to a truthy value"
    return 0
  fi

  # If it's already up, don't start a second daemon
  if docker info >/dev/null 2>&1; then
    echo "Docker Engine (dockerd) is already running"
    return 0
  fi

  echo "Starting Docker Engine (dockerd)..."

  # Clean up any stale pid/socket (common after unclean shutdown)
  sudo find /run /var/run -iname 'docker*.pid' -delete || true

  sudo mkdir -p /var/lib/docker /var/run /var/log /etc/docker

  # Custom daemon.json to use the nvidia runtime and fuse-overlayfs storage driver
  echo '{"storage-driver":"fuse-overlayfs","runtimes":{"nvidia":{"path":"nvidia-container-runtime","runtimeArgs":[]}}}' | sudo tee /etc/docker/daemon.json > /dev/null

  # Permissions reset on log folder - needed to permit the startup to execute
  sudo chmod -R 755 /var/log/

  # Start dockerd in the background (unix socket only)
  # --group jeeves makes /var/run/docker.sock accessible to the jeeves user
  sudo sh -c "dockerd \
    --host=unix:///var/run/docker.sock \
    --data-root=/var/lib/docker \
    --group=jeeves \
    ${DOCKERD_ARGS:-} \
    >/var/log/dockerd.log 2>&1" &

  DOCKERD_PID=$!
  DOCKER_ENGINE_STARTED=true

  # Permissions reset
  sudo chmod -R 755 /var/lib/docker /var/log/

  # Wait until the daemon is responsive
  echo "Waiting for dockerd to be ready..."
  for i in $(seq 1 60); do
    if docker info >/dev/null 2>&1; then
      echo "dockerd is up."
      return 0
    fi
    sleep 1
  done

  echo "ERROR: dockerd did not become ready in time." >&2
  sudo tail -n 200 /var/log/dockerd.log >&2 || true
  exit 1
}

# Function do to a clean docker shutdown on container halt signal
cleanup() {
  if [ "$DOCKER_ENGINE_STARTED" = true ] && [ -n "${DOCKERD_PID:-}" ] && sudo kill -0 "${DOCKERD_PID}" 2>/dev/null; then
    echo "Stopping dockerd..."
    sudo kill "${DOCKERD_PID}" || true
  fi
}

# Function to copy OOB config if directory is empty
copy_oob_if_empty() {
    local target_dir="$1"
    local oob_dir="$2"
    local config_name="$3"

    if [ -d "$target_dir" ]; then
        # Check if directory is empty (no files or subdirectories)
        if [ -z "$(ls -A "$target_dir" 2>/dev/null)" ]; then
            echo "Initializing $config_name configuration directory: $target_dir"
            if [ -d "$oob_dir" ] && [ "$(ls -A "$oob_dir" 2>/dev/null)" ]; then
                sudo cp -r "$oob_dir"/* "$target_dir"/
                sudo chown -R jeeves:jeeves "$target_dir"
                echo "Copied OOB $config_name configuration files"
            else
                echo "Warning: OOB $config_name configuration directory $oob_dir is empty or does not exist"
            fi
        else
            echo "$config_name configuration directory already contains files, skipping initialization"
        fi
    else
        echo "Warning: $config_name configuration directory $target_dir does not exist"
    fi
}

install_k8s_tools() {
  if ! is_dind_enabled; then
    return 0
  fi

  if command -v kubectl >/dev/null 2>&1 && command -v helm >/dev/null 2>&1 && command -v kind >/dev/null 2>&1; then
    echo "Kubernetes tools already installed"
    return 0
  fi

  echo "Installing Kubernetes tools (kubectl, helm, kind)..."

  local arch
  arch=$(dpkg --print-architecture 2>/dev/null || echo "amd64")

  if ! command -v kubectl >/dev/null 2>&1; then
    local kubectl_version
    kubectl_version=$(curl -fsSL https://dl.k8s.io/release/stable.txt)
    curl -fsSL "https://dl.k8s.io/release/${kubectl_version}/bin/linux/${arch}/kubectl" -o /tmp/kubectl
    sudo install -o root -g root -m 0755 /tmp/kubectl /usr/local/bin/kubectl
    rm -f /tmp/kubectl
    echo "kubectl ${kubectl_version} installed"
  fi

  if ! command -v helm >/dev/null 2>&1; then
    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
    echo "helm installed"
  fi

  if ! command -v kind >/dev/null 2>&1; then
    local kind_version
    kind_version=$(curl -fsSL https://api.github.com/repos/kubernetes-sigs/kind/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
    curl -fsSL "https://kind.sigs.k8s.io/dl/${kind_version}/kind-linux-${arch}" -o /tmp/kind
    sudo install -o root -g root -m 0755 /tmp/kind /usr/local/bin/kind
    rm -f /tmp/kind
    echo "kind ${kind_version} installed"
  fi

  echo "Kubernetes tools installation complete"
}

# Docker cleanup trap
trap cleanup EXIT

# Start Docker first
start_docker_engine

# Install k8s tools if DinD is enabled
install_k8s_tools

# Pre-stage custom todo plugin for opencode
sudo mkdir -p /home/jeeves/.config/opencode/plugins
sudo cp /opt/jeeves/Ralph/plugins/todo.ts /home/jeeves/.config/opencode/plugins/todo.ts

# Initialize configuration directories
copy_oob_if_empty "/home/jeeves/.config/opencode" "/opt/oob-config/.config/opencode" "OpenCode"
copy_oob_if_empty "/home/jeeves/.claude" "/opt/oob-config/.claude" "Claude"
sudo chown -R jeeves:jeeves /home/jeeves

# Auto-install some skills at the user level that should be useful
# See: https://github.com/kamalnrf/claude-plugins
#      https://www.reddit.com/r/opencodeCLI/comments/1pzni8k/45000_public_claude_skills_are_now/

echo "Installing skills-discovery for opencode and claude code..."
# https://claude-plugins.dev/skills/@Kamalnrf/claude-plugins/skills-discovery
npx skills-installer install @Kamalnrf/claude-plugins/skills-discovery --client opencode
npx skills-installer install @Kamalnrf/claude-plugins/skills-discovery --client claude-code

echo "Installing using-superpowers for opencode and claude code..."
# https://claude-plugins.dev/skills/@obra/superpowers/using-superpowers
npx skills-installer install @obra/superpowers/using-superpowers --client opencode
npx skills-installer install @obra/superpowers/using-superpowers --client claude-code

# --- DEPRECATED: legacy Claude Max bridge via @ex-machina/opencode-anthropic-auth ---
# Replaced by opencode-with-claude (which spawns Meridian per OpenCode instance).
# Kept commented out as a fallback in case the new path needs to be reverted.
# Repo: https://github.com/griffinmartin/opencode-claude-auth
#
# if [ "$INSTALL_CLAUDE_CODE" = "true" ]; then
#     echo "Installing opencode-claude-auth plugin..."
#     sudo npm install -g @ex-machina/opencode-anthropic-auth
#
#     OPENCODE_CONFIG="/home/jeeves/.config/opencode/opencode.jsonc"
#
#     if [ -f "$OPENCODE_CONFIG" ]; then
#         echo "Updating existing opencode configuration..."
#         temp_file=$(mktemp)
#         jq '
#           .plugin = (if has("plugin") then
#                       try (if (.plugin | type == "array") then .plugin else [] end) catch []
#                     else
#                       []
#                     end)
#           | if (.plugin | index("@ex-machina/opencode-anthropic-auth")) then
#               .
#             else
#               .plugin |= . + ["@ex-machina/opencode-anthropic-auth"]
#             end
#         ' "$OPENCODE_CONFIG" > "$temp_file" && mv "$temp_file" "$OPENCODE_CONFIG"
#         sudo chown jeeves:jeeves "$OPENCODE_CONFIG"
#         echo "opencode-claude-auth plugin added to configuration"
#     else
#         echo "Warning: opencode.jsonc not found at $OPENCODE_CONFIG"
#         echo "Plugin configuration will not be updated"
#     fi
# else
#     echo "opencode-claude-auth installation skipped (INSTALL_CLAUDE_CODE is not 'true')"
# fi
# --- end DEPRECATED block ---

# Install opencode-with-claude (Meridian-backed Claude Max provider for OpenCode).
# Replaces the deprecated @ex-machina/opencode-anthropic-auth path above.
# - opencode-with-claude runs Meridian (https://github.com/rynfar/meridian) in
#   the OpenCode plugin process per OpenCode instance and shuts it down on exit.
#   @rynfar/meridian and @anthropic-ai/claude-agent-sdk come along as transitive
#   npm dependencies; nothing else needs explicit installation here.
# - meridian-plugin-opencode-scrub strips OpenCode identifying fingerprints from
#   the system prompt before Meridian forwards to Claude. Idempotent and scoped
#   to the opencode adapter only.
# The official Claude Code CLI is installed earlier in the image (see the
# `claude.ai/install.sh` step gated by INSTALL_CLAUDE_CODE). Users still need to
# run `claude login` once inside the container to authenticate.
if [ "$INSTALL_CLAUDE_CODE" = "true" ]; then
    echo "Installing opencode-with-claude plugin..."
    sudo npm install -g opencode-with-claude

    # The Bun-bundled /app/dist/opencode resolves plugins from
    # ~/.config/opencode/node_modules, not the global npm prefix. Without this
    # local install the "opencode-with-claude" reference in opencode.jsonc fails
    # to resolve and Meridian never starts.
    OPENCODE_CONFIG_DIR="/home/jeeves/.config/opencode"
    sudo mkdir -p "$OPENCODE_CONFIG_DIR"
    if [ ! -f "$OPENCODE_CONFIG_DIR/package.json" ]; then
        (cd "$OPENCODE_CONFIG_DIR" && sudo npm init -y >/dev/null)
    fi
    (cd "$OPENCODE_CONFIG_DIR" && sudo npm install opencode-with-claude)
    sudo chown -R jeeves:jeeves "$OPENCODE_CONFIG_DIR"

    echo "Installing meridian-plugin-opencode-scrub..."
    MERIDIAN_DIR="/home/jeeves/.config/meridian"
    sudo mkdir -p "$MERIDIAN_DIR"
    if [ ! -f "$MERIDIAN_DIR/package.json" ]; then
        (cd "$MERIDIAN_DIR" && sudo npm init -y >/dev/null)
    fi
    (cd "$MERIDIAN_DIR" && sudo npm install @rynfar/meridian-plugin-opencode-scrub)

    SCRUB_PATH="$MERIDIAN_DIR/node_modules/@rynfar/meridian-plugin-opencode-scrub/dist/index.js"
    if [ -f "$SCRUB_PATH" ]; then
        sudo tee "$MERIDIAN_DIR/plugins.json" >/dev/null <<JSON
{
  "plugins": [
    { "path": "$SCRUB_PATH", "enabled": true }
  ]
}
JSON
        echo "meridian-plugin-opencode-scrub registered at $SCRUB_PATH"
    else
        echo "Warning: scrub plugin dist not found at $SCRUB_PATH; plugins.json not written"
    fi

    OPENCODE_CONFIG="/home/jeeves/.config/opencode/opencode.jsonc"
    if [ -f "$OPENCODE_CONFIG" ]; then
        echo "Updating existing opencode configuration for opencode-with-claude..."
        temp_file=$(mktemp)
        jq '
          .plugin = (if has("plugin") then
                      try (if (.plugin | type == "array") then .plugin else [] end) catch []
                    else
                      []
                    end)
          | .plugin |= map(select(. != "@ex-machina/opencode-anthropic-auth"))
          | if (.plugin | index("opencode-with-claude")) then
              .
            else
              .plugin |= . + ["opencode-with-claude"]
            end
          | .provider = (.provider // {})
          | .provider.anthropic = (.provider.anthropic // {})
          | .provider.anthropic.options = (.provider.anthropic.options // {})
          | .provider.anthropic.options.apiKey = (.provider.anthropic.options.apiKey // "dummy")
        ' "$OPENCODE_CONFIG" > "$temp_file" && mv "$temp_file" "$OPENCODE_CONFIG"
        sudo chown jeeves:jeeves "$OPENCODE_CONFIG"
        echo "opencode-with-claude plugin and Anthropic provider configured"
    else
        echo "Warning: opencode.jsonc not found at $OPENCODE_CONFIG"
        echo "Plugin configuration will not be updated"
    fi

    sudo chown -R jeeves:jeeves "$MERIDIAN_DIR"

    echo "NOTE: run 'claude login' once to authenticate against your Claude Max"
    echo "      subscription. The 'claude' CLI was installed at image build time"
    echo "      via Anthropic's native installer."
else
    echo "opencode-with-claude installation skipped (INSTALL_CLAUDE_CODE is not 'true')"
fi



echo "Attempting to resolve dependencies required be installed skills..."
echo "Any resolved dependencies will attempt to be installed automatically."
if [ -x /usr/local/bin/install-skill-deps.sh ]; then                                                                                                                                                            
     /usr/local/bin/install-skill-deps.sh --verbose                                                                                                                                                              
fi
echo "Dependency resolution and install complete."
echo "Note: This process works by attempting to parse out deps from skill MD files.  Since this isn't required or standardized, detection and/or installation may silently fail, requiring manual installation."

# Configure git user identity from host environment
if [ -n "$GIT_AUTHOR_NAME" ]; then
    echo "Setting git user.name to: $GIT_AUTHOR_NAME"
    git config --global user.name "$GIT_AUTHOR_NAME"
fi
if [ -n "$GIT_AUTHOR_EMAIL" ]; then
    echo "Setting git user.email to: $GIT_AUTHOR_EMAIL"
    git config --global user.email "$GIT_AUTHOR_EMAIL"
fi

# Set the mapped /proj as a git safe dir (needed to create commits)
echo "Setting /proj as git safe directory..."
git config --global --add safe.directory /proj

# If no arguments provided, start supervisord and the opencode-web service
if [ $# -eq 0 ]; then
    echo "Starting supervisord..."
    # Start supervisord as daemon (it will daemonize itself with nodaemon=false behavior via -n)
    # Actually with nodaemon=true it stays in foreground, so we run it in background
    sudo supervisord -c /etc/supervisor/supervisord.conf &
    SUPERVISORD_PID=$!
    
    # Wait for supervisord socket to exist
    echo "Waiting for supervisord to be ready..."
    for i in $(seq 1 30); do
        if [ -S /var/run/supervisor/supervisor.sock ]; then
            echo "Supervisord is ready."
            break
        fi
        sleep 1
    done
    
    if [ ! -S /var/run/supervisor/supervisor.sock ]; then
        echo "ERROR: supervisord did not start properly" >&2
        exit 1
    fi
    
    # Ensure we're in /proj directory
    cd /proj || exit 1
    
    # Start the opencode-web service
    echo "Starting opencode-web service..."
    supervisorctl start opencode-web
    
    # Wait for supervisord (keeps container running)
    wait $SUPERVISORD_PID
else
    # Execute the provided command
    exec "$@"
fi
EOF

RUN chmod +x /usr/local/bin/entrypoint.sh && \
    sed -i 's/\r$//' /usr/local/bin/entrypoint.sh

# Switch back to runtime user and re-fix home permissions
USER jeeves
RUN sudo chown -R jeeves:jeeves /home/jeeves

# Set working directory
WORKDIR /proj

EXPOSE 3333
# ============================================================================
# Entry point: Not used
# Start cmd: Initialize config directories if empty, 
#            then start docker and run the Web UI
# ============================================================================
ENTRYPOINT []
CMD ["/usr/local/bin/entrypoint.sh"]