FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

ENV NODE_ENV=development

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=0cea59169ef0f3f83e4aa7fbedbff9d165646472
RUN git clone https://github.com/vadimdemedes/ink . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

# --ignore-scripts: prepare script runs tsc which fails on base code and
# would overwrite the pre-built build/ directory needed for baseline tests.
# tsc is invoked in test.sh when running new (solution) tests.
RUN npm install --ignore-scripts --include=dev

# v1.1 node-id scoring: AVA has no JUnit reporter, but its bundled --tap output
# carries one line per test; pin the tap-junit TAP->JUnit converter at build time
# (sandbox is offline at verify time). --no-save keeps package.json untouched and
# the repo's .npmrc sets package-lock=false, so no lockfile is created either —
# the git-status check enforces that model.patch baselines stay clean.
RUN npm install --no-save --no-audit --no-fund tap-junit@5.0.4 \
 && git status --porcelain | (! grep -q .) \
 && node -e "require.resolve('tap-junit')"

# v1.1 CTRF route: official ctrf-io JUnit->CTRF converter, pinned. Installed
# globally (out-of-tree) so /app stays porcelain-clean; network is build-time
# only — verify-time sandbox is offline. test.sh runs it with `-u false`, which
# drops tap-junit's constant suite name and reproduces the whitelisted node ids
# byte-for-byte.
RUN npm install -g --no-audit --no-fund junit-to-ctrf@0.0.14 \
 && command -v junit-to-ctrf \
 && git status --porcelain | (! grep -q .)

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
