FROM public.ecr.aws/x8v8d7g8/mars-base:latest

WORKDIR /app

# Git time-travel: clone, then make the repo's default branch point AT the base
# commit with no future history — a real branch checkout (not a detached HEAD),
# future commits/tags gc'd away so the reference solution can't leak from history.
ARG BASE_SHA=06a1adb7a70e85e7322d8cfae3181508785de95d
RUN git clone https://github.com/testem/testem . \
 && DEFAULT="$(git remote show origin | sed -n 's/.*HEAD branch: //p')" \
 && git checkout -B "$DEFAULT" "$BASE_SHA" \
 && git remote remove origin \
 && for b in $(git for-each-ref --format='%(refname:short)' refs/heads | grep -vx "$DEFAULT"); do git branch -D "$b" || true; done \
 && for t in $(git tag); do git merge-base --is-ancestor "$t" HEAD 2>/dev/null || git tag -d "$t"; done \
 && git reflog expire --expire=now --all \
 && git gc --prune=now \
 && (git submodule update --init --recursive || true)

RUN npm install --include=dev

# npm install materializes a package-lock.json that is not tracked at the base
# commit. Hide it from git (via .git/info/exclude, NOT .gitignore — the worktree
# must stay pristine) so Step 0's `git add -A` model.patch capture stays clean
# and the anti-cheat lockfile tripwire never false-fires.
RUN git status --porcelain | awk '$1=="??" {print $2}' >> .git/info/exclude \
 && git checkout -- . \
 && test -z "$(git status --porcelain)"

# v1.1 CTRF scoring: OFFICIAL ctrf-io mocha reporter, installed OUTSIDE the repo so /app's
# package.json / lockfile / node_modules stay pristine (anti-cheat tripwire paths).
RUN npm install --prefix /opt/ctrf mocha-ctrf-json-reporter@0.0.11 \
 && test -f /opt/ctrf/node_modules/mocha-ctrf-json-reporter/dist/index.js \
 && test -z "$(git status --porcelain)"

ENV PATH="/app/node_modules/.bin:${PATH}"

# Disable git commit hooks (husky etc.): dev-workflow tooling, not task content.
# Broken hook environments otherwise block the agent's (and oracle's) commits.
RUN cd /app && git config core.hooksPath /dev/null

CMD ["/bin/bash"]
