docker-compose.yml

# =============================================================================
# Scoped - Local Development Docker Compose
# =============================================================================
#
# Usage:
#   docker compose up                                    # infra + api + judge
#   docker compose --profile claude-code up              # + Claude Code worker
#   docker compose --profile copilot up                  # + Copilot worker
#   docker compose --profile vscode-web up               # + VS Code Web worker
#   docker compose --profile claude-code --profile copilot up  # multiple workers
#   docker compose --profile report up                   # + Report Generator worker
#   docker compose up mongodb redis azurite              # infra only (run app services natively)
#
# Host-native debugging:
#   1. Start infra only: docker compose up mongodb redis azurite
#   2. Copy .env.example to .env and fill in API keys
#   3. Run any service natively: pnpm --filter api dev (uses localhost from .env)
#
# =============================================================================

# ---------------------------------------------------------------------------
# Shared environment blocks (YAML anchors)
# ---------------------------------------------------------------------------
x-common-env: &common-env
  MONGO_CONNECTION_STRING: ${MONGO_CONNECTION_STRING:-mongodb://mongodb:27017}
  MONGO_DATABASE: ${MONGO_DATABASE:-requests-db}
  MONGO_COLLECTION: requests
  REDIS_HOST: redis
  REDIS_PORT: "6379"
  REDIS_PASSWORD: ""
  AZURE_STORAGE_ACCOUNT_NAME: devstoreaccount1
  STORAGE_CONNECTION_STRING: "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://azurite:10001/devstoreaccount1;BlobEndpoint=http://azurite:10000/devstoreaccount1;"

x-worker-env: &worker-env
  <<: *common-env
  JUDGE_SERVICE_URL: http://judge:80
  SCOPE_MT_API_URL: http://api:80
  TOKEN_MANAGER_URL: http://token-manager:80

x-worker-deps: &worker-deps
  register-agents:
    condition: service_completed_successfully
  mongodb:
    condition: service_healthy
    required: false
  redis:
    condition: service_healthy
  azurite:
    condition: service_healthy
  judge:
    condition: service_started

# npm/pnpm registry for the image builds. Defaults to the public registry, so
# external contributors and CI need no configuration. scripts/dev-compose.sh
# auto-detects the host's registry (npm config get registry, which reads ~/.npmrc)
# and forwards it here, so engineers behind a private proxy (e.g. Microsoft's npm
# proxy) build with no setup. Export NPM_CONFIG_REGISTRY to override the detected value.
x-npm-build-args: &npm-build-args
  NPM_CONFIG_REGISTRY: ${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org/}

services:
  # ===========================================================================
  # Infrastructure services
  # ===========================================================================

  # MongoDB (compatible with CosmosDB MongoDB API)
  mongodb:
    image: mongo:7.0
    profiles: [mongodb]
    ports:
      - "${MONGODB_PORT:-27000}:27017"
    environment:
      MONGO_INITDB_DATABASE: requests-db
    volumes:
      - mongodb_data:/data/db
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
    command: mongod --quiet --logpath /dev/null
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Redis (pub/sub for real-time log streaming)
  redis:
    image: redis:7.4.2-alpine
    ports:
      - "${REDIS_PORT:-6300}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Lowkey Vault (Azure Key Vault emulator)
  # Persists vault state via export/import. On first start, seeds export.json
  # inline so remote Docker daemon setups don't depend on bind-mounted files.
  lowkey-vault:
    image: nagyesta/lowkey-vault:7.2.0-ubi10-minimal
    ports:
      - "${LOWKEY_VAULT_PORT:-8400}:8443"
    environment:
      LOWKEY_ARGS: >-
        --server.port=8443
        --spring.main.banner-mode=off
        --LOWKEY_DEBUG_REQUEST_LOG=false
        --LOWKEY_VAULT_NAMES=-
        --LOWKEY_IMPORT_LOCATION=/import/export.json
        --LOWKEY_EXPORT_LOCATION=/import/export.json
    volumes:
      - lowkey_vault_data:/import
    entrypoint:
      [
        "/bin/sh",
        "-c",
        "[ -f /import/export.json ] || printf '%s\n' '{\"vaults\":[{\"attributes\":{\"baseUri\":\"https://lowkey-vault:8443\",\"recoveryLevel\":\"Recoverable+Purgeable\",\"recoverableDays\":90,\"created\":0,\"deleted\":null},\"keys\":{},\"secrets\":{},\"certificates\":{}}]}' > /import/export.json; exec java -jar /lowkey-vault.jar $$LOWKEY_ARGS",
      ]
    healthcheck:
      test: ["CMD", "curl", "-fk", "https://localhost:8443/ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Azurite (Azure Storage emulator - queues + blobs)
  azurite:
    image: mcr.microsoft.com/azure-storage/azurite:3.29.0
    ports:
      - "${AZURITE_BLOB_PORT:-10100}:10000" # Blob
      - "${AZURITE_QUEUE_PORT:-10200}:10001" # Queue
      - "${AZURITE_TABLE_PORT:-10300}:10002" # Table
    command: azurite --loose --skipApiVersionCheck --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0 --silent --location /data
    environment:
      APPLICATIONINSIGHTS_CONNECTION_STRING: ""
    volumes:
      - azurite_data:/data
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "require('http').get('http://localhost:10001', (r) => process.exit(r.statusCode === 400 ? 0 : 1)).on('error', () => process.exit(1))",
        ]
      interval: 10s
      timeout: 5s
      retries: 5

  # Creates the 'har' blob container in Azurite for the gateway HAR plugin.
  azurite-init:
    image: mcr.microsoft.com/azure-cli:2.68.0
    restart: "no"
    depends_on:
      azurite:
        condition: service_healthy
    environment:
      AZURE_STORAGE_CONNECTION_STRING: "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/devstoreaccount1;"
    command: >
      sh -c "az storage container create --name har --connection-string \"$$AZURE_STORAGE_CONNECTION_STRING\" || true"

  # Entra Local — local, MSAL-compatible Microsoft Entra ID emulator used for
  # Portal authentication in local dev (docs/architecture/auth-rbac.md §1/§8).
  # Ships a deterministic seed directory (tenant 1111…, SPA app cccc…-0001,
  # users alice@/bob@entralocal.dev / Password1!). Dev-only, intentionally
  # insecure — never expose it beyond localhost. Pinned to the latest tag.
  #
  # entra-local — Microsoft Entra ID emulator for local auth development.
  # Opt-in via the `auth` profile (bundled into every `docker:dev:*` script).
  # Serves HTTPS using a locally-trusted mkcert certificate (provisioned by
  # scripts/ensure-dev-certs.sh and staged into a named volume by
  # entra-local-certs-init) so the browser trusts it with no manual cert step —
  # MSAL requires an https authority. See the auth docs.
  entra-local:
    image: ghcr.io/cmaneu/entra-local:0.1.1
    profiles: [auth]
    ports:
      - "${ENTRA_LOCAL_PORT:-8443}:8443"
    environment:
      # The cert covers localhost (browser) and entra-local (Compose clients).
      TLS_ENABLED: "true"
      TLS_CERT: /certs/entra-local.pem
      TLS_KEY: /certs/entra-local-key.pem
      NODE_EXTRA_CA_CERTS: /ca/rootCA.pem
      # The container binds 0.0.0.0:8443 internally; the host maps it to
      # ENTRA_LOCAL_PORT (offset per worktree). Pin PUBLIC_ORIGIN *and* ISSUER to
      # the host-facing origin so the discovery/JWKS/token endpoints and the
      # token `iss` all use the host+port the browser actually reaches — the
      # internal 8443 would otherwise leak into the OIDC metadata and break
      # MSAL's authority/issuer match when the host port is offset.
      PUBLIC_ORIGIN: "${ENTRA_LOCAL_PUBLIC_ORIGIN:-https://localhost:${ENTRA_LOCAL_PORT:-8443}}"
      ISSUER: "${ENTRA_LOCAL_ISSUER:-https://localhost:${ENTRA_LOCAL_PORT:-8443}/${AUTH_TENANT_ID:-11111111-1111-1111-1111-111111111111}/v2.0}"
    volumes:
      - entra_local_data:/app/data
      # Certs come from the named volume (owned by UID 1000), not a direct host
      # bind mount, so the emulator's `node` user can read the key on rootless /
      # UID-remapped engines. See entra-local-certs-init.
      - entra_local_certs:/certs:ro
      - entra_local_ca:/ca:ro
    depends_on:
      entra-local-certs-init:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "-e", "require('https').get({host:'localhost',port:8443,path:'/health'},(r)=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 5

  # entra-local-certs-init — one-shot: stage the host mkcert cert/key into a named
  # volume with ownership/permissions the emulator's UID 1000 `node` user can read.
  #
  # Why: mkcert writes the key `0600`, owned by the host user. A direct
  # `./.certs:/certs:ro` bind mount works on Docker Desktop (its VFS ignores host
  # ownership) but fails on rootless podman / colima / userns-remapped docker,
  # where the in-container `node` user does not own the host key and gets EACCES —
  # aborting the whole `up`. Copying into a named volume and chowning to 1000:1000
  # (the same ownership-fix pattern the devproxy services use) makes the key
  # readable to the container user on every engine, while the host key stays
  # `0600` and never gets loosened.
  entra-local-certs-init:
    image: busybox:1.37
    profiles: [auth]
    restart: "no"
    command:
      - sh
      - -c
      - |
        set -eu
        echo 'Staging entra-local certs for UID 1000...'
        cp /certs-src/entra-local.pem /certs/entra-local.pem
        cp /certs-src/entra-local-key.pem /certs/entra-local-key.pem
        cp /certs-src/rootCA.pem /ca/rootCA.pem
        chown -v 1000:1000 /certs /certs/entra-local.pem /certs/entra-local-key.pem
        chmod -v 0755 /certs /ca
        chmod -v 0644 /certs/entra-local.pem /ca/rootCA.pem
        chmod -v 0640 /certs/entra-local-key.pem
        echo 'Done'
    volumes:
      - ./.certs:/certs-src:ro
      - entra_local_certs:/certs
      # Clients receive only the public CA, never the emulator's private key.
      - entra_local_ca:/ca

  # entra-local-init — one-shot: registers the dev Portal origin as an SPA
  # redirect URI on the seeded "Sample SPA" app so sign-in works with no manual
  # portal step. Idempotent (tolerates an already-registered URI). Talks to the
  # emulator over the compose network (https://entra-local:8443/admin/api); the
  # shared CA and entra-local certificate SAN keep TLS verification enabled.
  entra-local-init:
    image: ghcr.io/cmaneu/entra-local:0.1.1
    profiles: [auth]
    restart: "no"
    entrypoint: ["node", "-e"]
    command:
      - |
        const appId = 'cccccccc-0000-0000-0000-000000000001';
        const uri = 'http://localhost:' + (process.env.PORTAL_PORT || '5100');
        const base = 'https://entra-local:8443/admin/api/apps/' + appId + '/redirectUris';
        const body = JSON.stringify({ uri, type: 'spa' });
        const post = () => new Promise((res, rej) => {
          const r = require('https').request(base, { method: 'POST', headers: { 'content-type': 'application/json' } }, (rsp) => {
            let d = ''; rsp.on('data', c => d += c); rsp.on('end', () => res({ status: rsp.statusCode, body: d }));
          });
          r.on('error', rej); r.write(body); r.end();
        });
        (async () => {
          for (let i = 0; i < 60; i++) {
            try {
              const { status, body } = await post();
              if (status === 201) { console.log('registered redirect URI', uri); return; }
              if (status === 409) { console.log('redirect URI already registered', uri); return; }
              console.log('attempt', i, 'status', status, body);
            } catch (e) { console.log('attempt', i, 'waiting for entra-local:', e.code || e.message); }
            await new Promise(r => setTimeout(r, 2000));
          }
          console.error('failed to register redirect URI after retries'); process.exit(1);
        })();
    environment:
      PORTAL_PORT: "${PORTAL_PORT:-5100}"
      NODE_EXTRA_CA_CERTS: /ca/rootCA.pem
    volumes:
      - entra_local_ca:/ca:ro
    depends_on:
      entra-local:
        condition: service_healthy

  # ===========================================================================
  # Application services
  # ===========================================================================

  # Database migrations — runs once before the API starts.
  # Reuses the API builder stage (has tsx + source + compiled output).
  db-migrate:
    # The builder image runs pnpm + tsx and needs development-tooling headroom.
    cpus: "0.5"
    mem_limit: 1g
    build:
      context: .
      dockerfile: apps/api/Dockerfile
      args:
        <<: *npm-build-args
      target: builder
    environment:
      MONGO_CONNECTION_STRING: ${MONGO_CONNECTION_STRING:-mongodb://mongodb:27017}
      MONGO_DATABASE: ${MONGO_DATABASE:-requests-db}
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
    restart: "no"
    working_dir: /app
    command: ["pnpm", "--filter", "db-migrations", "migrate:up"]

  # API - REST + SSE endpoint (always starts)
  api:
    # Resource limits mirror prod K8s
    cpus: "0.5"
    mem_limit: 512m
    mem_reservation: 256m
    build:
      context: .
      dockerfile: apps/api/Dockerfile
      args:
        <<: *npm-build-args
    restart: on-failure:5
    ports:
      - "${API_PORT:-3100}:80"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:80/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
      interval: 5s
      timeout: 3s
      retries: 12
      # Dev startup runs tsx and tsc concurrently under the API's CPU limit.
      start_period: 120s
    env_file:
      # .env.local holds developer-managed values that worktree-env must not
      # overwrite: AZURE_AI_INFERENCE_ENDPOINT, AZURE_AI_INFERENCE_API_KEY,
      # and LLM_MODEL. Optional — the API falls back to GitHub Models when
      # the Foundry vars aren't set, and uses gpt-4.1 when LLM_MODEL isn't.
      - path: .env.local
        required: false
    environment:
      <<: *common-env
      PORT: "80"
      TOKEN_MANAGER_URL: http://token-manager:80
      AZURE_STORAGE_QUEUE_REPORT: report-queue
      SCOPE_STRICT_AGENT_CAPABILITIES: ${SCOPE_STRICT_AGENT_CAPABILITIES:-false}
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      GITHUB_MODELS_API_KEY: ${GITHUB_MODELS_API_KEY:-${GITHUB_TOKEN}}
      GIT_COMMIT: ${GIT_COMMIT:-development}
      BUILD_TIME: ${BUILD_TIME:-}
      SCOPE_ENVIRONMENT: ${SCOPE_ENVIRONMENT:-}
      # Local Entra dev defaults: point the API at the same worktree-shifted
      # `entra-local` issuer/JWKS and the API app registration the emulator
      # exposes. This keeps auth enabled without requiring each developer to hand
      # edit `.env.local` for every offset worktree.
      AUTH_PROVIDER: "${AUTH_PROVIDER:-entra}"
      AUTH_AUTHORITY: "${AUTH_AUTHORITY:-https://localhost:${ENTRA_LOCAL_PORT:-8443}/${AUTH_TENANT_ID:-11111111-1111-1111-1111-111111111111}}"
      AUTH_ISSUER_TEMPLATE: "${AUTH_ISSUER_TEMPLATE:-https://localhost:${ENTRA_LOCAL_PORT:-8443}/{tenantid}/v2.0}"
      AUTH_JWKS_URI: "${AUTH_JWKS_URI:-https://entra-local:8443/${AUTH_TENANT_ID:-11111111-1111-1111-1111-111111111111}/discovery/v2.0/keys}"
      AUTH_API_CLIENT_ID: "${AUTH_API_CLIENT_ID:-cccccccc-0000-0000-0000-000000000005}"
      AUTH_PORTAL_CLIENT_ID: "${AUTH_PORTAL_CLIENT_ID:-cccccccc-0000-0000-0000-000000000001}"
      AUTH_SCOPES: "${AUTH_SCOPES:-api://cccccccc-0000-0000-0000-000000000005/access_as_user}"
      AUTH_BOOTSTRAP_ADMINS: "${AUTH_BOOTSTRAP_ADMINS:-entra:11111111-1111-1111-1111-111111111111/aaaaaaaa-0000-0000-0000-000000000001}"
      AUTH_BOOTSTRAP_TENANTS: "${AUTH_BOOTSTRAP_TENANTS:-11111111-1111-1111-1111-111111111111}"
      AUTH_USER_CACHE_TTL_SECONDS: "${AUTH_USER_CACHE_TTL_SECONDS:-300}"
      NODE_TLS_REJECT_UNAUTHORIZED: "1"
      NODE_EXTRA_CA_CERTS: "${NODE_EXTRA_CA_CERTS-/ca/rootCA.pem}"
    volumes:
      - entra_local_ca:/ca:ro
    depends_on:
      # Do not require local certificates when running without the auth profile.
      entra-local-certs-init:
        condition: service_completed_successfully
        required: false
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_healthy
      azurite:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
  register-agents:
    image: alpine:3.21
    depends_on:
      api:
        condition: service_healthy
    volumes:
      - ./apps/workers:/workers:ro
      - ./scripts/register-agent.sh:/register-agent.sh:ro
    environment:
      SCOPE_REGISTER_COPILOT_AGENT: ${SCOPE_REGISTER_COPILOT_AGENT:-false}
      SCOPE_REGISTER_CLAUDE_CODE_AGENT: ${SCOPE_REGISTER_CLAUDE_CODE_AGENT:-false}
    restart: "no"
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -eu
        apk add --no-cache curl yq > /dev/null 2>&1

        register_agent() {
          name="$$1"
          enabled="$$2"
          /register-agent.sh \
            http://api:80 \
            "/workers/$$name/agent.yaml" \
            --available "$$enabled" \
            "/workers/$$name/agent-version.dev.yaml"
        }

        register_agent coder-acp-copilot "$$SCOPE_REGISTER_COPILOT_AGENT"
        register_agent coder-acp-claude-code "$$SCOPE_REGISTER_CLAUDE_CODE_AGENT"

        echo ""
        echo "All agents and dev versions registered."

  # Model scanner: GitHub Copilot - scans available models and syncs to API
  model-scanner-copilot:
    # Resource limits mirror prod K8s
    cpus: "0.25"
    mem_limit: 256m
    build:
      context: .
      dockerfile: apps/model-scanners/copilot/Dockerfile
      args:
        <<: *npm-build-args
    profiles: [copilot]
    depends_on:
      api:
        condition: service_started
      register-agents:
        condition: service_completed_successfully
      token-manager:
        condition: service_started
    restart: "no"
    environment:
      API_URL: http://api:80
      TOKEN_MANAGER_URL: http://token-manager:80
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}

  # Model scanner: Anthropic - scans available models and syncs to API
  model-scanner-anthropic:
    # Resource limits mirror prod K8s
    cpus: "0.25"
    mem_limit: 256m
    build:
      context: .
      dockerfile: apps/model-scanners/anthropic/Dockerfile
      args:
        <<: *npm-build-args
    profiles: [claude-code]
    depends_on:
      api:
        condition: service_started
      register-agents:
        condition: service_completed_successfully
      token-manager:
        condition: service_started
    restart: "no"
    environment:
      API_URL: http://api:80
      TOKEN_MANAGER_URL: http://token-manager:80
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}

  # Judge - evaluation service (always starts)
  judge:
    # Resource limits mirror prod K8s
    cpus: "1"
    mem_limit: 1g
    mem_reservation: 512m
    build:
      context: .
      dockerfile: apps/judge/Dockerfile
      args:
        <<: *npm-build-args
    ports:
      - "${JUDGE_PORT:-3200}:80"
    environment:
      PORT: "80"
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      TOKEN_MANAGER_URL: http://token-manager:80
      AZURE_STORAGE_ACCOUNT_NAME: devstoreaccount1
      STORAGE_CONNECTION_STRING: "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://azurite:10001/devstoreaccount1;BlobEndpoint=http://azurite:10000/devstoreaccount1;"
      # Redis for real-time criterion progress streaming
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ""
      # Criteria system configuration
      # JUDGE_MODEL and FEEDBACK_MODEL both default to gpt-5.4-mini. Override
      # either locally via .env when the dev token lacks access to a given model.
      JUDGE_MODEL: ${JUDGE_MODEL:-gpt-5.4-mini}
      FEEDBACK_MODEL: ${FEEDBACK_MODEL:-gpt-5.4-mini}
      JUDGE_STRATEGY: ${JUDGE_STRATEGY:-bundled} # bundled or independent
      JUDGE_MAX_PARALLELISM: ${JUDGE_MAX_PARALLELISM:-3}
      FEEDBACK_MAX_CRITERIA: ${FEEDBACK_MAX_CRITERIA:-1}
      FEEDBACK_DESCENDANT_GUARD: ${FEEDBACK_DESCENDANT_GUARD:-true}
      # Criteria loaded from API (primary) with filesystem fallback
      CRITERIA_API_URL: http://api:80
      CRITERIA_DIR: /app/config/criteria
    depends_on:
      api:
        condition: service_started
      azurite:
        condition: service_healthy
      redis:
        condition: service_healthy

  # Token Manager - token lifecycle and KeyVault integration
  token-manager:
    # Resource limits mirror prod K8s
    cpus: "0.2"
    mem_limit: 256m
    mem_reservation: 128m
    build:
      context: .
      dockerfile: apps/token-manager/Dockerfile
      args:
        <<: *npm-build-args
    ports:
      - "${TOKEN_MANAGER_PORT:-3300}:80"
    environment:
      <<: *common-env
      PORT: "80"
      VALIDATION_INTERVAL_MS: "300000"
      AZURE_KEYVAULT_URI: https://lowkey-vault:8443
      NODE_TLS_REJECT_UNAUTHORIZED: "0"
      IDENTITY_ENDPOINT: http://lowkey-vault:8080/metadata/identity/oauth2/token
      IDENTITY_HEADER: header
      AZURE_POD_IDENTITY_AUTHORITY_HOST: http://lowkey-vault:8080
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      lowkey-vault:
        condition: service_healthy

  # Scheduler - polls MongoDB for pending requests and dispatches to queues
  scheduler:
    # Resource limits mirror prod K8s
    cpus: "0.2"
    mem_limit: 256m
    mem_reservation: 128m
    build:
      context: .
      dockerfile: apps/scheduler/Dockerfile
      args:
        <<: *npm-build-args
    restart: on-failure:5
    environment:
      <<: *common-env
      SCHEDULER_TARGET_QUEUE_DEPTH: "2"
      SCHEDULER_POLL_INTERVAL_MS: "2000"
      PORT: "8080"
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      azurite:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
      register-agents:
        condition: service_completed_successfully

  # ===========================================================================
  # Worker services (opt-in via profiles)
  # ===========================================================================

  # Portal - Web UI for run management
  portal:
    # Resource limits mirror prod K8s
    cpus: "0.2"
    mem_limit: 128m
    mem_reservation: 64m
    build:
      context: .
      dockerfile: apps/portal/Dockerfile
      args:
        <<: *npm-build-args
        # Vite embeds these public IdP settings into the production bundle.
        VITE_AUTH_CLIENT_ID: "${VITE_AUTH_CLIENT_ID:-cccccccc-0000-0000-0000-000000000001}"
        VITE_AUTH_AUTHORITY: "${VITE_AUTH_AUTHORITY:-https://localhost:${ENTRA_LOCAL_PORT:-8443}/${AUTH_TENANT_ID:-11111111-1111-1111-1111-111111111111}/v2.0}"
        VITE_AUTH_KNOWN_AUTHORITIES: "${VITE_AUTH_KNOWN_AUTHORITIES-localhost:${ENTRA_LOCAL_PORT:-8443}}"
        VITE_AUTH_SCOPES: "${VITE_AUTH_SCOPES:-api://cccccccc-0000-0000-0000-000000000005/access_as_user}"
        VITE_AUTH_PROTOCOL_MODE: "${VITE_AUTH_PROTOCOL_MODE:-OIDC}"
        VITE_AUTH_REDIRECT_URI: "${VITE_AUTH_REDIRECT_URI:-}"
        VITE_AUTH_POST_LOGOUT_REDIRECT_URI: "${VITE_AUTH_POST_LOGOUT_REDIRECT_URI:-}"
        VITE_AUTH_CACHE_LOCATION: "${VITE_AUTH_CACHE_LOCATION:-localStorage}"
    profiles: [portal]
    ports:
      - "${PORTAL_PORT:-5100}:80"
    environment:
      SCOPE_AUTH_ENABLED: "${SCOPE_AUTH_ENABLED:-true}"
    depends_on:
      api:
        condition: service_started

  # ===========================================================================
  # Gateway proxy (shared TLS-intercepting HTTP proxy — replaces per-worker DevProxy)
  # Enable with: PROXY_BACKEND=gateway
  # ===========================================================================
  gateway:
    # Resource limits mirror prod K8s
    cpus: "0.5"
    mem_limit: 512m
    mem_reservation: 128m
    build:
      context: ./apps/gateway
      dockerfile: Dockerfile
    profiles: [gateway, vscode-electron-driver-ext, copilot]
    environment:
      RUST_LOG: debug,gateway::internal=info,azure_core::policies::transport=info
      COPILOT_TOKEN_REFRESH_BUFFER_SECS: 120
      COPILOT_TOKEN_MINT_RETRIES: 3
      COPILOT_TOKEN_MINT_BACKOFF_MS: 500
      COPILOT_MAX_SESSION_DURATION_SECS: 3600
      AZURE_STORAGE_USE_EMULATOR: "true"
      AZURITE_BLOB_HOST: azurite
      AZURITE_BLOB_PORT: "10000"
      BLOB_STORAGE_URL: "http://azurite:10000/devstoreaccount1"
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ""
      TOKEN_MANAGER_URL: http://token-manager:80
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - gateway_cert:/certs
    ports:
      - "${GATEWAY_API_PORT:-18900}:18000"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:18000/health || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 120s
    depends_on:
      azurite-init:
        condition: service_completed_successfully
      redis:
        condition: service_healthy

  # Claude Code worker (via ACP)
  coder-acp-claude-code:
    # Resource limits mirror prod K8s main container
    cpus: "1"
    mem_limit: 1g
    mem_reservation: 512m
    build:
      context: .
      dockerfile: apps/workers/coder-acp-claude-code/Dockerfile
      args:
        <<: *npm-build-args
        CLAUDE_CODE_ACP_VERSION: ${CLAUDE_CODE_ACP_VERSION:-}
    profiles: [claude-code]
    group_add:
      - "${DOCKER_GID:-0}"  # Docker socket GID (0 for macOS/Docker Desktop, set DOCKER_GID for Linux)
    security_opt:
      # The right GID is necessary but not sufficient when the daemon host
      # enforces SELinux (a podman machine always does; RHEL/Fedora Docker Engine
      # can): container_t may not open a var_run_t socket, so the mounted socket
      # stays unusable and the agent cannot run containers at all. Ignored on
      # hosts without SELinux, such as Docker Desktop.
      # label=type:container_runtime_t also works and keeps confinement, but it
      # requires container-selinux to provide that type.
      - label=disable
    environment:
      <<: *worker-env
      WORKER_NAME: coder-acp-claude-code
      SCOPE_AGENT_VERSION: claude-agent-acp-dev-sdk-dev
      QUEUE_NAME: queue-coder-acp-claude-code
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      # DevProxy integration (enabled by default when using claude-code profile)
      DEV_PROXY_ENABLED: "${DEV_PROXY_ENABLED:-true}"
      DEV_PROXY_API_URL: http://devproxy-claude-code:18897
      DEV_PROXY_URL: http://devproxy-claude-code:18000
      DEV_PROXY_HAR_DIR: /har-output
      NODE_EXTRA_CA_CERTS: /tmp/dev-proxy-ca.crt
      MCP_GATEWAY_URL: http://mcp-gateway-claude-code:8080
      DOCKER_HOST: unix:///var/run/docker.sock
    volumes:
      - claude_har_output:/har-output
      - claude_workspace:/workspace
      - ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock
    depends_on:
      <<: *worker-deps
      devproxy-claude-code:
        condition: service_healthy
      devproxy-claude-code-init:
        condition: service_completed_successfully
      mcp-gateway-claude-code:
        condition: service_healthy

  # DevProxy sidecar for Claude Code worker (HAR capture)
  devproxy-claude-code:
    # Resource limits mirror prod K8s devproxy sidecar
    cpus: "0.5"
    mem_limit: 512m
    image: ghcr.io/dotnet/dev-proxy:2.1.0
    profiles: [claude-code]
    user: "1000:1000"
    working_dir: /har-output
    command: ["--config-file", "/config/devproxyrc.json", "--record"]
    volumes:
      - ./apps/workers/coder-acp-claude-code/devproxy-config.json:/config/devproxyrc.json:ro
      - claude_har_output:/har-output
      - claude_devproxy_cert:/home/devproxy/.config/dev-proxy/rootCert
    ports:
      - "${DEVPROXY_CLAUDE_API_PORT:-19000}:18897"
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:18897/proxy"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s
    depends_on:
      devproxy-claude-code-init:
        condition: service_completed_successfully

  # Init service: fix ownership on shared volumes so UID 1000 containers can
  # read/write. Equivalent of the K8s initContainer in coder-acp-claude-code.yaml.
  devproxy-claude-code-init:
    image: busybox:1.37
    profiles: [claude-code]
    command:
      [
        "sh",
        "-c",
        "echo 'Fixing volume ownership for UID 1000...' && chown -v 1000:1000 /har-output /certs && chmod -v 775 /har-output /certs && echo 'Done'",
      ]
    volumes:
      - claude_har_output:/har-output
      - claude_devproxy_cert:/certs

  # MCPJungle sidecar for Claude Code worker (stdio + remote HTTP MCP aggregation)
  mcp-gateway-claude-code:
    # Resource limits mirror prod K8s mcp-gateway sidecar
    cpus: "0.5"
    mem_limit: 512m
    image: ghcr.io/mcpjungle/mcpjungle:latest-stdio
    # Suppress the ASCII art banner (written to stderr by Cobra's cmd.Print)
    entrypoint: ["/bin/sh", "-c"]
    command: ["/mcpjungle start 2>&1 | grep --line-buffered -v '[█═╗╚║╔╝]' >&2"]
    profiles: [claude-code]
    environment:
      SESSION_IDLE_TIMEOUT_SEC: "0"
    volumes:
      - claude_workspace:/workspace
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
      interval: 60s
      timeout: 3s
      retries: 5
      start_period: 10s

  # GitHub Copilot worker (via ACP)
  coder-acp-copilot:
    # Resource limits mirror prod K8s main container.
    # mem_limit 2.3g intentionally matches the raised manifest limit in this PR so local
    # repros surface the same OOM ceiling that caused the "Worker presumed dead" failures.
    cpus: "1"
    mem_limit: 2.3g
    mem_reservation: 1g
    build:
      context: .
      dockerfile: apps/workers/coder-acp-copilot/Dockerfile
      args:
        <<: *npm-build-args
        COPILOT_CLI_VERSION: ${COPILOT_CLI_VERSION:-}
    profiles: [copilot]
    group_add:
      - "${DOCKER_GID:-0}"  # Docker socket GID (0 for macOS/Docker Desktop, set DOCKER_GID for Linux)
    security_opt:
      # The right GID is necessary but not sufficient when the daemon host
      # enforces SELinux (a podman machine always does; RHEL/Fedora Docker Engine
      # can): container_t may not open a var_run_t socket, so the mounted socket
      # stays unusable and the agent cannot run containers at all. Ignored on
      # hosts without SELinux, such as Docker Desktop.
      # label=type:container_runtime_t also works and keeps confinement, but it
      # requires container-selinux to provide that type.
      - label=disable
    environment:
      <<: *worker-env
      WORKER_NAME: coder-acp-copilot
      SCOPE_AGENT_VERSION: copilot-dev
      QUEUE_NAME: queue-coder-acp-copilot
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      # Gateway: replaces DevProxy — records HTTP + WebSocket (/responses) frames
      # into the HAR. Token plugin disabled (the Copilot CLI manages its own tokens).
      PROXY_BACKEND: gateway
      DEV_PROXY_ENABLED: "${DEV_PROXY_ENABLED:-true}"
      DEV_PROXY_API_URL: http://gateway:18000
      GATEWAY_TOKEN_PLUGIN_ENABLED: "false"
      MCP_GATEWAY_URL: http://mcp-gateway-copilot:8080
      DOCKER_HOST: unix:///var/run/docker.sock
    volumes:
      - copilot_workspace:/workspace
      - ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock
    depends_on:
      <<: *worker-deps
      mcp-gateway-copilot:
        condition: service_healthy
      gateway:
        condition: service_healthy

  # DevProxy sidecars for the Copilot worker were REPLACED by the shared `gateway`
  # service (records HTTP + WebSocket frames; HAR is retrieved via the gateway
  # session API, so no shared har-output/cert volumes are needed). See AI Gateway
  # Phase 3 (#723).

  # MCPJungle sidecar for Copilot worker (stdio + remote HTTP MCP aggregation)
  mcp-gateway-copilot:
    # Resource limits mirror prod K8s mcp-gateway sidecar
    cpus: "0.5"
    mem_limit: 512m
    image: ghcr.io/mcpjungle/mcpjungle:latest-stdio
    # Suppress the ASCII art banner (written to stderr by Cobra's cmd.Print)
    entrypoint: ["/bin/sh", "-c"]
    command: ["/mcpjungle start 2>&1 | grep --line-buffered -v '[█═╗╚║╔╝]' >&2"]
    profiles: [copilot]
    environment:
      SESSION_IDLE_TIMEOUT_SEC: "0"
    volumes:
      - copilot_workspace:/workspace
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
      interval: 60s
      timeout: 3s
      retries: 5
      start_period: 10s


  # Report Generator worker (LLM-powered run reports via Copilot SDK)
  report-generator:
    # Resource limits mirror prod K8s main container
    cpus: "1"
    mem_limit: 1g
    build:
      context: .
      dockerfile: apps/workers/report-generator/Dockerfile
      args:
        <<: *npm-build-args
    profiles: [report]
    environment:
      <<: *common-env
      AZURE_STORAGE_QUEUE_REPORT: report-queue
      REPORT_MODEL: ${REPORT_MODEL:-gpt-5.4-mini}
      SCOPE_MT_API_URL: http://api:80
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      TOKEN_MANAGER_URL: http://token-manager:80
      GIT_COMMIT: ${GIT_COMMIT:-development}
      SESSION_TIMEOUT_MS: ${SESSION_TIMEOUT_MS:-300000}
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_healthy
      azurite:
        condition: service_healthy
      api:
        condition: service_started

  register-version-post-processor:
    build:
      context: .
      dockerfile: apps/workers/post-processor/Dockerfile
      args:
        <<: *npm-build-args
    profiles: [post-processor]
    environment:
      <<: *common-env
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
    restart: "no"
    entrypoint: ["npx", "tsx", "apps/workers/post-processor/src/register-version.ts"]

  post-processor:
    # Resource limits mirror prod K8s main container
    cpus: "1"
    mem_limit: 1g
    build:
      context: .
      dockerfile: apps/workers/post-processor/Dockerfile
      args:
        <<: *npm-build-args
    profiles: [post-processor]
    environment:
      <<: *common-env
      AZURE_STORAGE_QUEUE_POSTPROCESSOR: post-processor-queue
      SCOPE_MT_API_URL: http://api:80
    depends_on:
      mongodb:
        condition: service_healthy
        required: false
      redis:
        condition: service_healthy
      azurite:
        condition: service_healthy
      api:
        condition: service_started
      register-version-post-processor:
        condition: service_completed_successfully

volumes:
  mongodb_data:
  azurite_data:
  lowkey_vault_data:
  entra_local_data:
  entra_local_certs:
  entra_local_ca:
  gateway_cert:
  copilot_workspace:
  claude_har_output:
  claude_devproxy_cert:
  claude_workspace:

networks:
  default:
    name: ${COMPOSE_PROJECT_NAME:-scope-mt-app}