FROM ghcr.io/home-assistant/base-python:3.14-alpine3.24@sha256:51837e17a94b578cc00357c98482b61b53b27e37d910c97b86dd6448cfb11a6f

ARG TARGETARCH
ARG BUILD_ARCH=amd64

LABEL \
    io.hass.type="app" \
    io.hass.arch="${BUILD_ARCH}" \
    io.hass.version="1.13.28"

COPY requirements-runtime.txt /tmp/requirements-runtime.txt
COPY runtime-site-packages/ /tmp/runtime-site-packages/
COPY wheel/ /tmp/wheel/
COPY codex-release.json /tmp/codex-release.json
COPY assets/ /tmp/assets/
COPY rootfs/ /
COPY stdio-packages/ /opt/codex-stdio/packages/

RUN set -eux; \
    case "${BUILD_ARCH}:${TARGETARCH}" in amd64:amd64|aarch64:arm64) ;; *) exit 1 ;; esac; \
    # Scoped Git review requires the real Git executable in the App.
    apk add --no-cache git; \
    git --version >/dev/null; \
    /bin/bash -c 'source /usr/lib/bashio/bashio.sh; declare -F bashio::addon.ip_address >/dev/null'; \
    # Startup qualifies the explicitly enabled browser against this exact
    # Chromium package. ARM64 browser isolation is not yet qualified, so its
    # development image omits Chromium and cannot advertise browser tools.
    if [ "${BUILD_ARCH}" = "amd64" ]; then \
    wget -q -O /tmp/chromium-156.0.8078.79-r0.apk \
      https://dl-cdn.alpinelinux.org/alpine/v3.24/community/x86_64/chromium-156.0.8078.79-r0.apk; \
    echo "488b94cfc04e05b59ad6e9ca2799316f413da71964d462e6a5c4d3181af25daa  /tmp/chromium-156.0.8078.79-r0.apk" | sha256sum -c -; \
    wget -q -O /tmp/chromium-common-156.0.8078.79-r0.apk \
      https://dl-cdn.alpinelinux.org/alpine/v3.24/community/x86_64/chromium-common-156.0.8078.79-r0.apk; \
    echo "6813a751c9c4a61d81b6ac4a034414f657ee2549955670d31b04acac6869da72  /tmp/chromium-common-156.0.8078.79-r0.apk" | sha256sum -c -; \
    wget -q -O /tmp/chromium-angle-156.0.8078.79-r0.apk \
      https://dl-cdn.alpinelinux.org/alpine/v3.24/community/x86_64/chromium-angle-156.0.8078.79-r0.apk; \
    echo "d941ed04dc7a26f9e089d2a105a2e9dfc8056416562e647ab66a6f20f84e7c4a  /tmp/chromium-angle-156.0.8078.79-r0.apk" | sha256sum -c -; \
    apk add --no-cache /tmp/chromium-156.0.8078.79-r0.apk /tmp/chromium-common-156.0.8078.79-r0.apk /tmp/chromium-angle-156.0.8078.79-r0.apk; \
    rm /tmp/chromium-156.0.8078.79-r0.apk /tmp/chromium-common-156.0.8078.79-r0.apk /tmp/chromium-angle-156.0.8078.79-r0.apk; \
    test "$(/usr/bin/chromium-browser --product-version)" = "156.0.8078.79"; \
    fi; \
    addgroup -S codexbridge; \
    adduser -S -D -H -h /data -s /sbin/nologin -G codexbridge codexbridge; \
    # The runtime is staged for the base image's Python version. Install it
    # where this interpreter looks, rather than at a version-specific path.
    site_packages="$(python -I -c 'import sysconfig; print(sysconfig.get_path("purelib"))')"; \
    test -d "${site_packages}"; \
    cp -a /tmp/runtime-site-packages/. "${site_packages}/"; \
    python -m pip install --no-cache-dir --no-index --no-deps /tmp/wheel/codex_bridge_service-*.whl; \
    # Every Bridge module, and so every runtime dependency, must import with
    # the image's interpreter. main is excluded because importing it
    # constructs the application from runtime settings.
    python -I -B -c 'import importlib, pkgutil, codex_bridge_service as package; [importlib.import_module(module.name) for module in pkgutil.walk_packages(package.__path__, package.__name__ + ".") if module.name != package.__name__ + ".main"]'; \
    python /usr/local/libexec/codex-bridge/install_locked_assets.py \
      --arch "${BUILD_ARCH}" \
      --lock /tmp/codex-release.json \
      --lock-digest 0f72757675895b22e9461d0884ed542188021e911889bfe882f07f50b2fac710 \
      --assets-dir /tmp/assets \
      --destination /usr/local/bin; \
    install -d -o root -g root -m 0755 /opt/codex/bin; \
    test ! -e /opt/codex/bin/bwrap; \
    install -o root -g root -m 0755 \
      /usr/local/libexec/codex-bridge/bwrap-wrapper.py \
      /opt/codex/bin/bwrap; \
    install -d -o root -g root -m 0755 /opt/codex-browser/bin; \
    install -o root -g root -m 0755 /usr/local/bin/bwrap /opt/codex-browser/bin/bwrap; \
    install -d -o root -g root -m 0755 /opt/codex-stdio/bin; \
    install -o root -g root -m 0755 /usr/local/bin/bwrap /opt/codex-stdio/bin/bwrap; \
    chown -R root:root /opt/codex-stdio/packages; \
    find /opt/codex-stdio/packages -type d -exec chmod 0555 {} +; \
    find /opt/codex-stdio/packages -type f -exec chmod 0444 {} +; \
    rm -rf /tmp/wheel /tmp/assets /tmp/codex-release.json /tmp/requirements-runtime.txt /tmp/runtime-site-packages; \
    chmod 0755 /usr/local/bin/codex-app-entrypoint /usr/local/bin/codex-ha /usr/local/bin/sandbox-self-test \
      /usr/local/bin/bwrap /opt/codex/bin/bwrap; \
    chmod 0444 /usr/local/share/codex-bridge/sandbox-contract.json; \
    chmod 0755 /usr/local/libexec/codex-bridge/*.py; \
    chmod 0755 /usr/local/libexec/codex-bridge/*.sh; \
    chmod 0700 /usr/local/libexec/codex-bridge/publish_discovery.py; \
    find /etc/s6-overlay/s6-rc.d -type f \( -name up -o -name run \) -exec chmod 0755 {} +; \
    install -d -o codexbridge -g codexbridge -m 0700 /data/bridge /data/codex-home /config/workspaces

EXPOSE 8766

ENTRYPOINT ["/usr/local/bin/codex-app-entrypoint"]

ENV CODEX_BRIDGE_APP_VERSION="1.13.28" \
    CODEX_BRIDGE_VERSION="0.20.1" \
    CODEX_BRIDGE_CODEX_VERSION="0.167.1" \
    CODEX_BRIDGE_ARCH="${BUILD_ARCH}" \
    CODEX_BRIDGE_RELEASE_LOCK_DIGEST="0f72757675895b22e9461d0884ed542188021e911889bfe882f07f50b2fac710" \
    CODEX_BRIDGE_SANDBOX_CONTRACT_VERSION="2"