FROM python:3.12-slim

# System dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        build-essential \
        curl \
    && rm -rf /var/lib/apt/lists/*

# Install uv
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && ln -s /root/.local/bin/uv /usr/local/bin/uv

# Install loom-agents (copy source for layer caching: deps first, then code)
COPY pyproject.toml README.md /opt/loom/
COPY loom/ /opt/loom/loom/
RUN pip install --no-cache-dir /opt/loom[openai]

# Verification tools — used by the post-build verification pipeline
RUN pip install --no-cache-dir pytest ruff mypy

# Create non-root user
RUN groupadd -g 1000 warp \
    && useradd -u 1000 -g warp -m -s /bin/bash warp

# Workspace directory (mounted as volume at runtime)
RUN mkdir -p /workspace && chown warp:warp /workspace

# Delivery directory (mounted as volume — build-mode output lands here)
RUN mkdir -p /delivery && chown warp:warp /delivery

# Set up git config for the warp agent
RUN git config --system user.name "Warp Agent" \
    && git config --system user.email "warp@loom.local"

# Install a global git pre-push hook template that blocks all pushes
RUN mkdir -p /etc/git-templates/hooks \
    && printf '#!/bin/sh\necho "ERROR: git push is blocked inside Weaver containers."\nexit 1\n' \
        > /etc/git-templates/hooks/pre-push \
    && chmod +x /etc/git-templates/hooks/pre-push \
    && git config --system init.templateDir /etc/git-templates

# Switch to non-root user
USER warp
WORKDIR /workspace

# Entrypoint runs the executor package (__main__.py)
ENTRYPOINT ["python", "-m", "loom.weaver"]
