ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
FROM ${HERMES_IMAGE}

USER root

ARG INSTALLER_PACKAGE=@sellable/install@0.1.702
ARG MCP_PACKAGE=@sellable/mcp@0.1.905
ARG INSTALLER_INTEGRITY
ARG MCP_INTEGRITY=sha512-WBx3m+OWplwYpR3/Kk/fbc3xe33kdP/sarB6aiX426qmyYAL6KvnhIfmA4+pCNkvsfcx9IihC0quFrsaUimUhw==

RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.702" \
    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.905" \
    && test -n "${INSTALLER_INTEGRITY}" \
    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
    && apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      bubblewrap \
      ca-certificates \
      nftables \
      sudo \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.702' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.905') throw new Error('package identity rejected');" \
    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.702', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.905', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
    && npm cache clean --force

COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
RUN test -x /usr/local/bin/node \
    && test ! -e /usr/bin/node \
    && ln -s /usr/local/bin/node /usr/bin/node \
    && test "$(readlink -f /usr/bin/node)" = "/usr/local/bin/node" \
    && chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint

HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1

ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]