FROM public.ecr.aws/x8v8d7g8/mars-base:latest
WORKDIR /app
ENV DENO_DIR=/deno-cache

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=132a437c40cffbdfbe474ca808c8debde59e2633
RUN git clone https://github.com/c4spar/cliffy . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

RUN curl -fsSL -o /tmp/deno.zip https://github.com/denoland/deno/releases/download/v2.0.0/deno-x86_64-unknown-linux-gnu.zip && \
    unzip -o /tmp/deno.zip -d /usr/local/bin && \
    chmod +x /usr/local/bin/deno && \
    rm /tmp/deno.zip
RUN deno cache --allow-import command/mod.ts flags/mod.ts && \
    deno cache --allow-import jsr:@std/assert jsr:@std/path jsr:@std/fs jsr:@std/encoding jsr:@std/fmt/colors && \
    deno cache --allow-import jsr:@std/testing/mock jsr:@std/testing/bdd jsr:@std/testing/snapshot && \
    deno cache --allow-import npm:sinon npm:@types/node && \
    for f in command/test/command/*.ts command/test/option/*.ts command/test/type/*.ts flags/test/*.ts; do deno cache --allow-import "$f" 2>/dev/null || true; done

# v1.1 node-id scoring (CTRF route): deno 2.0.0's built-in `--junit-path`
# JUnit reporter + the official ctrf-io converter junit-to-ctrf@0.0.14
# (build-time network only; npm -g installs out-of-tree, never under /app).
RUN npm install -g junit-to-ctrf@0.0.14 && command -v junit-to-ctrf
# The repo worktree must stay pristine:
RUN test -z "$(git status --porcelain)" || (git status --porcelain && false)

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
