# Plan A6, third of three: Claude Code pointed at Kimi.
#
# Same shape as `agent-glm` — same CLI, same pinned version, a different
# endpoint — for the same reason: an independent verifier is only independent if
# it runs somewhere else, and a third provider costs an env contract rather than
# a third agent harness.
#
# WHY CLAUDE CODE AND NOT `kimi`. Moonshot ship their own CLI
# (`@moonshot-ai/kimi-code`), and it would be the more native choice — but the
# whole mission harness is Claude-Code-shaped: `--agents` JSON roles, the
# `verifier` tool allowlist, the `Stop` hook that backs the completion gate, and
# the per-subagent transcripts we count as delegation evidence. `kimi` has none
# of those flags; its equivalents are TOML files and markdown agent dirs. Running
# it would mean a second executor with its own untested failure modes, so this
# image uses the Anthropic-compatible mode instead and the harness is unchanged.
#
# THE URL IS MEASURED, and the first answer was the wrong one. `api.moonshot.ai/
# anthropic/v1/messages` exists and speaks the protocol, but it belongs to the
# platform.moonshot.ai account namespace and rejects an `sk-kimi-` key. The Kimi
# CODE service is a different host: `POST https://api.kimi.com/coding/v1/messages`
# returns a real Anthropic Messages body — `msg_` id, `content` blocks, a
# `thinking` block with a signature.
#
# So the base URL is `https://api.kimi.com/coding` and NOT `.../coding/v1`:
# Claude Code appends `/v1/messages` itself, and the doubled `/v1/v1/messages`
# is a 404 that would look like a broken image rather than a bad URL.
#
# Two more things measured rather than assumed, because each would otherwise be
# a silent failure at the first turn:
#   - `Authorization: Bearer` is accepted (so ANTHROPIC_AUTH_TOKEN is the right
#     injection channel; `x-api-key` works too, but that is the API-key path a
#     microVM deliberately does not use).
#   - a `claude-*` model id is ACCEPTED and answered, so Kimi maps it onto its
#     own model exactly as z.ai does. No ANTHROPIC_MODEL override is needed.
FROM clawmates/agent-toolchain:dev

ARG CLAUDE_CODE_VERSION=2.1.223
RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
    && npm cache clean --force \
    && rm -rf /root/.npm \
    && claude --version

# The endpoint is baked in; the credential is injected per turn by
# `mission_runtime::microvm_provider_env` from the server's `KIMI_API_KEY`. A VM
# built from this image therefore cannot be handed an Anthropic subscription
# token or a z.ai key — the wrong credential has nowhere to go.
ENV HOME=/root \
    CLAWMATES_AGENT_CLI=claude \
    ANTHROPIC_BASE_URL=https://api.kimi.com/coding
RUN mkdir -p /root/.claude

# No ANTHROPIC_MODEL: measured above, the service maps the `claude-*` id Claude
# Code sends onto its own model (`kimi-for-coding`, K2.7 Coding, 262k context).