Dockerfile

# --- Base: Python + uv + Node + system CLIs ---
FROM python:3.12-slim-bookworm AS base

# uv (fast, reproducible installs)
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# System deps: git, gh, Node 22, dumb-init, Claude Code CLI
RUN apt-get update && apt-get install -y --no-install-recommends \
      dumb-init git curl gpg ca-certificates && \
    # Node 22 (NodeSource)
    curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
    apt-get install -y --no-install-recommends nodejs && \
    # gh CLI
    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      | tee /usr/share/keyrings/githubcli-archive-keyring.gpg > /dev/null && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
      https://cli.github.com/packages stable main" \
      | tee /etc/apt/sources.list.d/github-cli.list && \
    apt-get update && apt-get install -y --no-install-recommends gh && \
    # Claude Code CLI — what claude-agent-sdk spawns
    npm install -g @anthropic-ai/claude-code && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

# --- Dependencies (cached layer) ---
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

# --- App ---
COPY app ./app
COPY README.md ./
RUN uv sync --frozen --no-dev

# Non-root user; workspace volume owned by it so clone/fetch/worktrees work
RUN useradd --create-home --uid 10001 appuser && \
    mkdir -p /workspace && chown -R appuser:appuser /workspace /app
USER appuser

ENV TZ=UTC \
    NODE_ENV=production \
    CLAUDE_CODE_API_PORT=3001 \
    WORKSPACE_DIR=/workspace \
    PATH="/app/.venv/bin:$PATH"
EXPOSE 3001

# gh auth setup-git makes git use GH_TOKEN for HTTPS clone/push.
# ANTHROPIC_API_KEY is read from the env by the spawned Claude Code CLI.
CMD ["dumb-init", "sh", "-c", "gh auth setup-git && exec auto-code"]