# syntax=docker/dockerfile:1
FROM node:22-bookworm-slim AS frontend
WORKDIR /build/frontend
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci
COPY frontend/ ./
RUN npm run build

FROM python:3.12-slim-bookworm AS runtime
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    LANG=C.UTF-8 \
    TZ=Asia/Shanghai \
    DEEP_AGENT_ENV_PRIORITY=process \
    HOST=0.0.0.0 \
    PORT=8080 \
    LOG_LEVEL=INFO \
    LOG_FORMAT=json \
    LOG_FILE=/app/logs/ventagent.jsonl \
    TIKTOKEN_CACHE_DIR=/usr/local/share/tiktoken \
    MAIN_FAN_REPORT_MODE=crawler \
    MAIN_FAN_REPORT_API_URL=http://10.244.3.155:19010 \
    MAIN_FAN_REPORT_SOURCE_DIR=/data/source_data \
    RESULT_PLATFORM_ENABLED=False \
    MAIN_FAN_WORKFLOW_PUBLISH_ENABLED=False
# 工作流默认本地核验；未来上报须同时开启总开关与 MAIN_FAN_WORKFLOW_PUBLISH_ENABLED。
# URL、token、模型配置在运行时通过 --env-file 注入，不写入镜像。
WORKDIR /app
RUN apt-get update \
    && apt-get install -y --no-install-recommends bubblewrap ca-certificates tzdata \
       fonts-noto-cjk fontconfig libglib2.0-0 libgomp1 \
    && rm -rf /var/lib/apt/lists/*
COPY release/requirements.lock /tmp/requirements.lock
RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.lock \
    && rm /tmp/requirements.lock
# 联网构建时保存分词词表；离线运行时无需首次下载。
RUN python -c "import tiktoken; [tiktoken.get_encoding(name) for name in ('cl100k_base', 'o200k_base')]"
RUN groupadd --gid 10001 ventagent \
    && useradd --uid 10001 --gid ventagent --create-home ventagent
COPY --chown=ventagent:ventagent . /app
COPY --from=frontend --chown=ventagent:ventagent /build/static/ /app/static/
RUN mkdir -p /app/data /app/outputs /app/logs \
    && chown -R ventagent:ventagent /app/data /app/outputs /app/logs
ENV BILLING_ENABLED=False \
    DEEPAGENT_THINKING=highest \
    OPENAI_TOOL_CALL_STREAMING=False
USER ventagent
EXPOSE 8080
STOPSIGNAL SIGTERM
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD python -c "import json,os,urllib.request; r=json.load(urllib.request.urlopen('http://127.0.0.1:'+os.getenv('PORT','8080')+'/health',timeout=3)); raise SystemExit(r.get('status') != 'ok')"
CMD ["python", "main.py"]