version: "3.9"

# ============================================================
# LambdaAgentPaaS — 开发模式 Compose（热重载）
#
# 用法:
#   docker compose -f docker-compose.dev.yml up
#
# 与 docker-compose.yml 的区别:
#   - 挂载完整源代码到容器 (热重载)
#   - 开启 debug 模式
#   - 同时暴露前端开发端口 5173
#   - 数据仍存到 ~/.agentpaas/data/ 保持隔离
# ============================================================

services:
  agentpaas-dev:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime      # 只构建 Python 阶段，不构建前端
    container_name: lambdagentpaas-dev
    ports:
      - "8000:8000"
    volumes:
      # 源代码热重载（跳过 node_modules 和 build 产物）
      - ./agentpaas:/app/agentpaas
      - ./lambdagent:/app/lambdagent
      - ./lambdagent_guard:/app/lambdagent_guard
      # 数据目录与 prod 共享（都指向 ~/.agentpaas/data）
      - "${AGENTPAAS_DATA_DIR}:/data"
    environment:
      AGENTPAAS_DATA_DIR: "/data"
      AGENTPAAS_DEBUG: "true"
      # audit #24 — was `${AGENTPAAS_MASTER_KEY:-dev_auto_generated}`,
      # a public static fallback letting anyone reading the repo decrypt
      # vault secrets on a default-config dev container. Fail-fast like
      # prod: install-native.sh / start.sh generate one via
      # `python -c "import secrets; print(secrets.token_hex(32))"` and
      # write it to .env. If that hasn't been done, this compose file
      # will refuse to start, which is the correct behavior.
      AGENTPAAS_MASTER_KEY: "${AGENTPAAS_MASTER_KEY:?AGENTPAAS_MASTER_KEY is required — generate via `python -c 'import secrets; print(secrets.token_hex(32))'` and add it to .env}"
      DASHSCOPE_API_KEY: "${DASHSCOPE_API_KEY:-}"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
    command: >
      python -m agentpaas serve
      --host 0.0.0.0
      --port 8000
      --dev
    restart: "no"