# RFC-020 §13 — Layer B tool-deny e2e harness.
#
# Boots a minimal node container, installs the under-test agent-node
# package from the local tarball generated by `npm pack`, then runs a
# small node-runtime probe that walks the deny matrix.
#
# This is a STATIC probe — it does not connect to the real Feishu API
# or claude-agent-sdk binary; it asserts the bundled artifact contains
# the deny strings AND (when subpath import works) calls the predicate
# directly. The full happy-path text + image flow runs against the live
# `anet-feishu-local` container after PR merge via lightweight
# dist-replace (see PR body deploy plan).
#
# Usage:
#   cd agent-node && npm pack
#   mv sleep2agi-agent-node-*.tgz ../docker/feishu-deny-e2e/agent-node.tgz
#   cd ../docker/feishu-deny-e2e
#   docker build -t feishu-deny-e2e . && docker run --rm feishu-deny-e2e
#
# The tarball is .gitignored — it must be generated locally per run.
FROM node:24-bookworm-slim

WORKDIR /probe
COPY agent-node.tgz /probe/agent-node.tgz

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
RUN npm init -y --silent && npm install --silent /probe/agent-node.tgz

COPY probe.cjs /probe/probe.cjs

CMD ["node", "/probe/probe.cjs"]
