# cortex-cli — thin client container
# bash + curl + jq client for cortex-api, with uv available only for
# last-resort L3 code-graph fallback paths. Zero direct DB access.
#
# better-code-review-graph pulls onnxruntime through qwen3-embed. Its arm64
# wheels are manylinux/glibc, not Alpine/musl, so this image shares the graph
# worker's pinned slim glibc base.

FROM python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de

RUN apt-get update && apt-get install -y --no-install-recommends \
    bash \
    curl \
    jq \
    git \
    coreutils \
    ca-certificates \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir uv==0.11.15
RUN uv tool install better-code-review-graph==3.8.0

# Graph helpers use `uv tool run`; keep them on the exact preinstalled tool.
ENV UV_OFFLINE=1

RUN printf '%s\n' 'export PATH="/app/scripts:$PATH"' > /etc/profile.d/cortex-path.sh

WORKDIR /app

# Scripts will be bind-mounted from host at runtime so iteration during
# Phase C.1 script-rewrite doesn't require image rebuilds. Compose mounts
# ../02-cust-portal/.agents/scripts -> /app/scripts read-only.
ENV PATH="/app/scripts:${PATH}"
ENV CORTEX_API_BASE="http://cortex-api:8501"

# BusyBox sleep ignores SIGTERM when it runs as PID 1. Keep the idle client alive
# behind a shell trap so Podman/Docker lifecycle stops complete without SIGKILL.
CMD ["sh", "-c", "trap 'exit 0' TERM INT; while :; do sleep 3600 & wait $!; done"]
