FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

ENV NODE_ENV=development

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=6393b3ab32a2ace1fc24d4b0f5e0f13a179c874f
RUN git clone https://github.com/platers/obsidian-linter . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

RUN pnpm install

# The repo tracks package-lock.json (npm) but this image installs with pnpm, which
# emits an UNTRACKED pnpm-lock.yaml. Exclude it via .git/info/exclude (not a repo
# file) so `git status --porcelain` is empty and Step 0's `git add -A` model.patch
# capture never picks it up — even if the agent legitimately re-runs `pnpm install`.
RUN echo "pnpm-lock.yaml" >> .git/info/exclude \
 && git status --porcelain | (! grep -q .)

# v1.1 node-id scoring: official CTRF reporter for jest
# (github.com/ctrf-io/jest-ctrf-json-reporter). This repo's node_modules is
# pnpm-managed (symlinked .pnpm layout), so an in-repo `npm install --no-save`
# would re-resolve/clobber the pnpm tree. Install the reporter OUT OF TREE under
# /opt/jest-ctrf instead and load it by absolute path; /app stays byte-identical
# (package.json/pnpm-lock.yaml untouched, `git status --porcelain` empty) so the
# model.patch baseline stays clean and the manifest tripwire stays valid.
# jest-environment-node MUST be co-installed and pinned to the task's jest
# version (29.7.0 here): 0.0.11's index.js loads dist/environment.js which
# hard-requires jest-environment-node at module load.
RUN mkdir -p /opt/jest-ctrf \
 && cd /opt/jest-ctrf \
 && npm init -y >/dev/null 2>&1 \
 && npm install --no-audit --no-fund jest-ctrf-json-reporter@0.0.11 jest-environment-node@29.7.0 \
 && node -e "require('/opt/jest-ctrf/node_modules/jest-ctrf-json-reporter')" \
 && node -e "require.resolve('/opt/jest-ctrf/node_modules/jest-ctrf-json-reporter/dist/index.js')" \
 && cd /app && git status --porcelain | (! grep -q .)

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
