FROM node:22-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        ca-certificates \
        ripgrep \
        curl \
        less \
        unzip \
        build-essential \
        python3 \
        python3-pip \
        python3-venv \
    && rm -rf /var/lib/apt/lists/*

RUN npm install -g @anthropic-ai/claude-code

COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/

# Hydrates $HOME from /projected when the Apple backend stages projections
# there (Apple's `container` only allows directory-source bind mounts, so
# per-file projections can't be mounted in place). No-op on Linux, where
# the per-file mounts already land at their final paths.
COPY entrypoint.sh /usr/local/bin/trusted-agent-entrypoint
RUN chmod 0755 /usr/local/bin/trusted-agent-entrypoint

# node:22-slim already ships a `node` user at uid 1000, reuse it.
USER node
# Ensure the auth dir exists with the right ownership so `trusted-agent` can
# bind-mount a projected .credentials.json at /home/node/.claude/.
RUN mkdir -p /home/node/.claude
WORKDIR /workspace

ENTRYPOINT ["/usr/local/bin/trusted-agent-entrypoint"]
CMD ["claude"]
