# ─── Stage 1: build the headroom-ai wheel in manylinux ─────────────────────
# Building from source inside `node:22-bookworm` produced a `_core.so` that
# referenced `__isoc23_strtoll` (a glibc 2.38+ symbol). The runtime in the
# same image couldn't resolve it at import time because something in the
# build chain — gcc version, libc6-dev backport, or cc-rs compiling
# transitive C deps against newer headers — emitted C23-era symbols that
# the runtime libc.so.6 doesn't have. Building inside the manylinux_2_28
# container (AlmaLinux 8, glibc 2.28 baseline) guarantees the wheel works
# on any glibc 2.28+ runtime, including bookworm.
FROM quay.io/pypa/manylinux_2_28_x86_64 AS builder

# No OpenSSL system deps required. As of the rustls-everywhere refactor,
# all HTTP+TLS in our Rust crates goes through `rustls`. fastembed's
# `hf-hub-rustls-tls` + `ort-download-binaries-rustls-tls` features
# replace the default native-tls path; `cargo tree -p headroom-py -i
# openssl-sys` returns "not found", confirming this Dockerfile no
# longer needs `openssl-devel`, `pkgconfig`, or any perl modules
# (Time::Piece, IPC::Cmd) for the openssl-src vendored Configure
# script. The historical `yum install openssl-devel pkgconfig
# perl-IPC-Cmd` line is intentionally absent.

# Install rust toolchain into the manylinux container. Match the
# rust-toolchain.toml at repo root (1.95.0 + rustfmt + clippy) so cargo
# doesn't try to mutate the toolchain on first invocation.
ENV CARGO_HOME=/usr/local/cargo \
    RUSTUP_HOME=/usr/local/rustup \
    PATH=/usr/local/cargo/bin:/opt/python/cp311-cp311/bin:${PATH}
COPY scripts/install-rustup.sh /tmp/install-rustup.sh
RUN sh /tmp/install-rustup.sh -y --no-modify-path --profile minimal -c rustfmt -c clippy --default-toolchain 1.95.0

WORKDIR /build

COPY pyproject.toml uv.lock README.md README-pypi.md ./
COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
COPY crates/ crates/
COPY headroom/ headroom/

# Build the wheel with maturin. PYO3_USE_ABI3_FORWARD_COMPATIBILITY allows
# building against Python 3.14+ until we bump pyo3 past 0.22.
ENV PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
# Build for Python 3.11 — aider-chat==0.86.2 requires Python <3.12, and
# trixie's default python3.13 is too new for aider. The manylinux image
# has python interpreters for every version at /opt/python/cpXY-cpXY/.
# Stage 2 uses `python:3.11-slim` (now trixie-based, glibc 2.41).
RUN /opt/python/cp311-cp311/bin/pip install 'maturin>=1.5,<2.0' && \
    /opt/python/cp311-cp311/bin/maturin build --release --out /dist --interpreter python3.11

# ─── Stage 2: python+node runtime ───────────────────────────────────────────
# Base on `python:3.11-slim` (now trixie, glibc 2.41) instead of
# `node:22-bookworm` (glibc 2.36): the wheel's `_core.so` references
# three glibc 2.38+ C23 wrappers (`__isoc23_strtol{,l,ul}`) that one of
# our transitive C/C++ deps emits during cc-rs compilation even when
# built inside manylinux_2_28 (probably libstdc++'s `<cstdlib>` resolving
# `std::strtoll` to the C23 variant when the toolchain has newer
# headers). Bookworm's libc.so.6 doesn't export these wrappers, so
# `import headroom._core` fails at runtime. Trixie's glibc 2.41 does.
#
# Node 24.22.2 from the official multi-platform image; no NodeSource setup script.
FROM node:24-bookworm-slim@sha256:01d566e8d94d8c619591d78652babfccd3c6992a3dffa9ed5ab39e11cf6c70e9 AS wrap-node

# We need Python 3.11 here (aider-chat==0.86.2 requires Python <3.12).
# Trixie's default `python3` is 3.13 — too new for aider. python:3.11-slim
# gives us Python 3.11 + trixie glibc + apt access for installing Node.
FROM python:3.11-slim

ENV DEBIAN_FRONTEND=noninteractive \
    AIDER_CHAT_VERSION=0.86.2 \
    OPENCODE_VERSION=1.17.8 \
    PATH="/opt/wrap-tools/node_modules/.bin:/opt/headroom-venv/bin:/opt/aider-venv/bin:${PATH}" \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

# OpenClaw 2026.10.10 requires Node >=24.16.0 <25 (or >=26.1.0). Install the
# Node 24 LTS line alongside Python 3.11. Also install git for packages
# that clone at install time.
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
      ca-certificates \
      curl \
      git \
        gnupg \
        libstdc++6 \
        libatomic1 && \
    rm -rf /var/lib/apt/lists/*

COPY --from=wrap-node /usr/local/bin/node /usr/local/bin/node
COPY --from=wrap-node /usr/local/lib/node_modules/ /usr/local/lib/node_modules/
RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
    ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
    ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack

# npm 10.9.8 crashes in Arborist's peer-set resolver when installing the local
# OpenClaw plugin (Cannot read properties of null, reading 'edgesOut'). Pin the
# tested npm version so both wrap-e2e callers use the same working installer.
RUN npm install -g --no-fund --no-audit npm@12.2.2

# Freeze transitive CLI dependencies as well as the top-level versions.
# Global npm install re-resolves ranges and can select partially published
# dependency releases; npm ci consumes the reviewed lockfile instead.
COPY e2e/wrap/tools/package.json e2e/wrap/tools/package-lock.json e2e/wrap/tools/.npmrc /opt/wrap-tools/
RUN npm ci --prefix /opt/wrap-tools --no-fund --no-audit --strict-allow-scripts

# Exercise the installed dependency fixes in both existing wrap-E2E CI callers.
# The exceptions file is copied too: one check asserts it holds no advisory for a
# bundled copy that now carries the fix.
COPY e2e/wrap/tools/dependency-regression.test.cjs e2e/wrap/tools/npm-audit-exceptions.json /opt/wrap-tools/
RUN npm test --prefix /opt/wrap-tools

WORKDIR /workspace

# Bring in the prebuilt manylinux wheel from stage 1.
COPY --from=builder /dist/*.whl /tmp/wheels/

# `sdk/typescript` and `plugins/openclaw` are wired into the wrap-e2e
# harness (e2e/wrap/run.py invokes `npx openclaw`). DO NOT copy
# `headroom/` or `pyproject.toml` from the workspace — they would shadow
# the installed wheel's `headroom/` package via cwd and Python would
# import the source-only `headroom/` (which has no `_core.so`),
# triggering the same `ModuleNotFoundError` the wheel install fixes.
COPY sdk/typescript ./sdk/typescript
COPY plugins/openclaw ./plugins/openclaw
COPY scripts/install-opencode.sh /tmp/install-opencode.sh

# Install the prebuilt manylinux wheel with [proxy] extras. Pip resolves
# extras from the wheel's metadata and pulls deps from public PyPI. The
# wheel's `_core.so` was compiled against glibc 2.28, so it loads cleanly
# against bookworm's glibc 2.36 at runtime.
RUN python -m venv /opt/headroom-venv && \
    /opt/headroom-venv/bin/python -m pip install --upgrade pip && \
    /opt/headroom-venv/bin/python -m pip install "$(ls /tmp/wheels/headroom_ai-*.whl)[proxy]" && \
    /opt/headroom-venv/bin/python -c "from headroom._core import DiffCompressor; print('headroom._core OK')" && \
    python -m venv /opt/aider-venv && \
    /opt/aider-venv/bin/python -m pip install --upgrade pip && \
    /opt/aider-venv/bin/python -m pip install "aider-chat==${AIDER_CHAT_VERSION}" && \
    sh /tmp/install-opencode.sh "${OPENCODE_VERSION}"

# Expose the installed binary to non-login shells (including CMD, docker run,
# and e2e shims spawned by subprocess). The e2e shim shadows
# opencode anyway, but this guarantees `which opencode` works for
# diagnostics.
ENV PATH="/root/.opencode/bin:${PATH}"

COPY e2e/wrap ./e2e/wrap

CMD ["python", "e2e/wrap/run.py"]
