# stack-node-pnpm — the container image a `runners.<role>.sandbox: container`
# role runs in when the project composes this pack and sets no
# runners.<role>.sandbox_image (STORY-348 T-PB-348b, AC-2). lib/sandbox.sh
# builds it on first use as `harness-stack-node-pnpm:<content hash>`; editing
# this file changes the tag, so a stale image is never reused.
#
# What it carries: Node 22 (TypeScript type stripping) with corepack-pinned
# pnpm, the GNU userland the engine's gates and scenarios assume (bash, git,
# coreutils, gawk, flock, jq), and the agent client (`claude`, by basename —
# runners.<role>.bin). The repository is mounted at /workspace at run time;
# nothing of it is baked in.
#
# HOME is a world-writable /home/agent: on Linux hosts the container runs as
# the operator's uid (so files the agent writes are theirs), which has no
# passwd entry here. AGENT_CLIENT_NPM='' builds without a client (CI scenarios
# use the fake runner); another npm package swaps the client.
ARG NODE_VERSION=22
FROM node:${NODE_VERSION}-alpine

ARG PNPM_VERSION=10
ARG AGENT_CLIENT_NPM=@anthropic-ai/claude-code

ENV HOME=/home/agent \
    COREPACK_HOME=/opt/corepack \
    COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
    USE_BUILTIN_RIPGREP=0

RUN apk add --no-cache bash git jq ca-certificates coreutils findutils grep sed gawk \
      diffutils util-linux tar libgcc libstdc++ ripgrep \
 && corepack enable \
 && corepack prepare "pnpm@${PNPM_VERSION}" --activate \
 && chmod -R a+rX "$COREPACK_HOME" \
 && if [ -n "$AGENT_CLIENT_NPM" ]; then npm install -g --no-fund --no-audit $AGENT_CLIENT_NPM; fi \
 && npm cache clean --force \
 && rm -rf "$HOME" && mkdir -p "$HOME" && chmod 1777 "$HOME"

WORKDIR /workspace
CMD ["bash"]
