# === Base image: Debian Bookworm Slim ===
FROM debian:bookworm-slim AS base

ARG DEV_USER=dev
ARG DEV_UID=1000
ARG DEV_GID=1000

ENV DEBIAN_FRONTEND=noninteractive

# === Pacchetti base essenziali ===
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    wget \
    git \
    openssh-client \
    jq \
    unzip \
    zip \
    sudo \
    gosu \
    procps \
    locales \
    build-essential \
    python3 \
    python3-pip \
    python3-venv \
    python3-yaml \
    zsh \
    bash \
    nano \
    vim \
    mc \
    && rm -rf /var/lib/apt/lists/* \
    && sed -i 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen \
    && sed -i 's/# it_IT.UTF-8 UTF-8/it_IT.UTF-8 UTF-8/' /etc/locale.gen \
    && locale-gen

ENV LANG=en_US.UTF-8
ENV LC_ALL=en_US.UTF-8

# === Gestione Certificati CA (es. Cato Networks o CA aziendali) ===
COPY cato-ca.pem* /usr/local/share/ca-certificates/
RUN if [ -f /usr/local/share/ca-certificates/cato-ca.pem ] && [ -s /usr/local/share/ca-certificates/cato-ca.pem ]; then \
        mv /usr/local/share/ca-certificates/cato-ca.pem /usr/local/share/ca-certificates/cato-ca.crt; \
    fi \
    && update-ca-certificates

# Variabili d'ambiente TLS/SSL per i vari runtime (Node, Python Requests/httpx, cURL)
ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

# === Node.js & npm (LTS v22 da immagine ufficiale multi-arch) ===
COPY --from=node:22-bookworm-slim /usr/local /usr/local

# === uv & uvx (Python package manager & tool runner) ===
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/

# === Claude Code CLI (@anthropic-ai/claude-code) ===
RUN npm install -g @anthropic-ai/claude-code

# === Antigravity CLI (agy / antigravity) ===
RUN curl -fsSL https://antigravity.google/cli/install.sh | bash -s -- --dir /usr/local/bin \
    && if [ -f /usr/local/bin/agy ] && [ ! -f /usr/local/bin/antigravity ]; then \
        ln -s /usr/local/bin/agy /usr/local/bin/antigravity; \
    fi

# === Kiro CLI (Amazon Q / Kiro per architettura corrente) ===
RUN ARCH=$(uname -m) \
    && curl --proto '=https' --tlsv1.2 -sSf "https://desktop-release.q.us-east-1.amazonaws.com/latest/kirocli-${ARCH}-linux-musl.zip" -o /tmp/kirocli.zip \
    && unzip -q /tmp/kirocli.zip -d /tmp \
    && install -m 755 /tmp/kirocli/bin/* /usr/local/bin/ \
    && if [ -f /usr/local/bin/kiro-cli ] && [ ! -f /usr/local/bin/kiro ]; then \
        ln -s /usr/local/bin/kiro-cli /usr/local/bin/kiro; \
    fi \
    && rm -rf /tmp/kirocli /tmp/kirocli.zip

# === OpenCode CLI (sstable/opencode) ===
# NB: lo script ufficiale ignora OPENCODE_INSTALL_DIR e installa sempre in $HOME/.opencode/bin
# (in build $HOME=/root). Spostiamo il binario in /usr/local/bin così è nel PATH di `dev`.
RUN curl -fsSL https://opencode.ai/install | bash \
    && mv /root/.opencode/bin/opencode /usr/local/bin/opencode \
    && chmod 755 /usr/local/bin/opencode \
    && rm -rf /root/.opencode

# === Tailscale CLI & Daemon ===
RUN curl -fsSL https://tailscale.com/install.sh | sh \
    && rm -rf /var/lib/apt/lists/*

# === Configurazione Utente non-root ===
RUN groupadd -g ${DEV_GID} ${DEV_USER} 2>/dev/null || true \
    && useradd -m -u ${DEV_UID} -g ${DEV_GID} -s /bin/zsh ${DEV_USER} 2>/dev/null || (usermod -s /bin/zsh ${DEV_USER} || true) \
    && echo "${DEV_USER} ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/${DEV_USER} \
    && chmod 0440 /etc/sudoers.d/${DEV_USER}

# === oh-my-zsh preconfigurato per `${DEV_USER}` (default, tema robbyrussell) ===
RUN RUNZSH=no CHSH=no sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended --skip-chsh --keep-zshrc \
        || RUNZSH=no CHSH=no sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended \
        || true \
    ; if [ -d /root/.oh-my-zsh ]; then mv /root/.oh-my-zsh /home/${DEV_USER}/.oh-my-zsh; fi \
    ; if [ -f /root/.zshrc ]; then mv /root/.zshrc /home/${DEV_USER}/.zshrc; fi \
    ; chown -R ${DEV_USER}:${DEV_USER} /home/${DEV_USER}/.oh-my-zsh /home/${DEV_USER}/.zshrc 2>/dev/null || true \
    ; if [ ! -f /home/${DEV_USER}/.zshrc ]; then printf '%s\n' 'export ZSH="$HOME/.oh-my-zsh"' 'ZSH_THEME="robbyrussell"' 'plugins=(git sudo docker npm node python pip uv)' 'source $ZSH/oh-my-zsh.sh' > /home/${DEV_USER}/.zshrc; fi \
    ; sed -i 's/^ZSH_THEME=.*/ZSH_THEME="robbyrussell"/' /home/${DEV_USER}/.zshrc 2>/dev/null || echo 'ZSH_THEME="robbyrussell"' >> /home/${DEV_USER}/.zshrc \
    ; grep -q '^plugins=' /home/${DEV_USER}/.zshrc 2>/dev/null || echo 'plugins=(git sudo docker npm node python pip uv)' >> /home/${DEV_USER}/.zshrc \
    ; chown ${DEV_USER}:${DEV_USER} /home/${DEV_USER}/.zshrc

# === Alias condivisi bash/zsh per `${DEV_USER}` ===
RUN cat >> /home/${DEV_USER}/.bashrc <<'EOF'

# --- Devcontainer aliases ---
alias claude-full='claude --dangerously-skip-permissions'
alias agy-full='agy --dangerously-skip-permissions'
alias kiro-full='kiro-cli chat --trust-all-tools --v3 --agent main'
alias opencode-full='opencode --yolo'
EOF
RUN cat >> /home/${DEV_USER}/.zshrc <<'EOF'

# --- Devcontainer aliases ---
alias claude-full='claude --dangerously-skip-permissions'
alias agy-full='agy --dangerously-skip-permissions'
alias kiro-full='kiro-cli chat --trust-all-tools --v3 --agent main'
alias opencode-full='opencode --yolo'

# --- Devcontainer prompt prefix ---
PROMPT="DEV $PROMPT"
EOF
RUN chown ${DEV_USER}:${DEV_USER} /home/${DEV_USER}/.bashrc /home/${DEV_USER}/.zshrc

# Pre-crea le directory standard dell'utente
RUN mkdir -p /home/${DEV_USER}/.local/bin /home/${DEV_USER}/.cache /home/${DEV_USER}/.config \
    && chown -R ${DEV_USER}:${DEV_USER} /home/${DEV_USER}

# Aggiunta percorsi locali dell'utente al PATH
ENV PATH="/home/${DEV_USER}/.local/bin:${PATH}"

# === Workspace & Entrypoint ===
WORKDIR /workspace

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]
CMD ["/bin/zsh"]
