Makefile

SHELL := /bin/bash
ROOT := $(shell git rev-parse --show-toplevel 2>/dev/null || pwd)
DEVRIG_ENV := $(ROOT)/.devrig/devrig.env
MODE ?= mock
AGENT ?= codex
ROLE ?= seller
LOGION_DEVRIG_API_BASE_URL ?=

.PHONY: docs-generate check-docs lint dead-code dead-code-advisory test typecheck security audit secrets mock mock-stop install-hooks cross-repo-guardrails companion-verify companion-bundle companion-bundle-verify public-audit \
	ci-checks check-generated-lock check-deps-lock check-roadmap-mirror check-protocol-specs \
	check-logion-sh-urls check-skip-reasons check-forbidden-imports check-cli-http check-json-module check-canonical-host
	check-installer-security \
	update-generated-lock update-deps-lock update-json-module \
	agent-proving-ground-lint agent-proving-ground-typecheck agent-proving-ground-dead-code agent-proving-ground-test agent-proving-ground-verify \
	agent-proving-ground-smoke agent-proving-ground-release \
	release-manifest release-manifest-check version-bump-cli version-bump-client version-bump-companion build-check \
	npm-test npm-pack npm-build \
	install-sh-lint install-sh-test install-ps1-lint install-ps1-test install-test \
	scanners-lint scanners-test social-lint social-test \
	bootstrap dev-up dev-api doctor companion start-companion clean-companion \
	dev-logs devrig-lint devrig-test dev-rebuild dev-rebuild-cli dev-rebuild-companion dev-rebuild-npm \
	release-plan release release-dry-run release-store release-smoke-input \
	node-dev-up node-agent node-status node-dev-down node-dev-reset node-run-once node-doctor \
	runner-evidence runner-image

# scripts/ and tests/ are in scope too: the typing.Any ban is only
# real if every path the repo actually runs is checked.
lint:
	uv run ruff check packages/ scripts/ tests/
	uv run ruff format --check packages/ scripts/ tests/

dead-code:
	uv run vulture

dead-code-advisory:
	uv run vulture --min-confidence 60 || true

test:
	uv run pytest packages/ tests/ --no-header -q -m "not integration and not docker"

typecheck:
	uv run mypy packages/cli/cli/ packages/client/src/ packages/scanners/logion_scanners/ --ignore-missing-imports

audit:
	uv run pip-audit --skip-editable --ignore-vuln PYSEC-2026-2447

bandit:
	uv run bandit -c pyproject.toml -r packages

secrets:
	uv run detect-secrets scan --baseline .secrets.baseline

security: audit bandit secrets

install-hooks:
	git config core.hooksPath .githooks
	@echo "Configured Git hooks path to .githooks"

WORKSPACE_REPO ?= $(abspath $(ROOT)/../logion-workspace)
PRIVATE_REPO ?= $(abspath $(ROOT)/../logion-private)

cross-repo-guardrails:
	@test -d $(WORKSPACE_REPO)/packages/contract-audit || (echo "Missing canonical guardrails at $(WORKSPACE_REPO)" >&2; exit 1)
	@test -d $(PRIVATE_REPO)/packages/api || (echo "Missing backend candidate at $(PRIVATE_REPO)" >&2; exit 1)
	$(MAKE) -C $(WORKSPACE_REPO)/packages/contract-audit install
	@PUBLIC_REPO=$(ROOT) PRIVATE_REPO=$(PRIVATE_REPO) \
		$(WORKSPACE_REPO)/packages/contract-audit/.venv/bin/contract-audit \
		check --mode fast --strict --out $(ROOT)/.local/contract-audit || { \
		cat $(ROOT)/.local/contract-audit/report.md; exit 1; }

mock:
	@mkdir -p .devrig
	@if [ -f .prism.pid ] && kill -0 $$(cat .prism.pid) 2>/dev/null; then \
		echo "Prism mock already running on http://127.0.0.1:4010"; \
	else \
		npx @stoplight/prism-cli mock contracts/openapi/v1.json --port 4010 > .devrig/prism.log 2>&1 & echo $$! > .prism.pid; \
		echo "Started Prism mock on http://127.0.0.1:4010 (log: .devrig/prism.log)"; \
	fi

mock-stop:
	@if [ -f .prism.pid ]; then kill $$(cat .prism.pid) 2>/dev/null || true; rm -f .prism.pid; fi

public-audit:
	uv run python scripts/audit_public_safe.py

check-generated-lock:
	uv run python scripts/check_generated_lock.py


check-deps-lock:
	uv run python scripts/check_deps_lock.py


check-roadmap-mirror:
	uv run python scripts/check_roadmap_mirror.py

check-protocol-specs:
	uv run python scripts/check_protocol_specs.py

check-logion-sh-urls:
	uv run python scripts/check_logion_sh_urls.py

check-skip-reasons:
	uv run python scripts/check_pytest_skip_reasons.py

check-forbidden-imports:
	uv run python scripts/check_forbidden_imports.py

check-cli-http:
	uv run python scripts/check_cli_http.py

check-json-module:
	uv run python scripts/check_json_module_sync.py


check-installer-security:
	python3 scripts/check_installer_security.py

# Live network check, deliberately NOT in ci-checks: CI must not go red on a
# DNS blip. Every offline checker follows redirects and sees 200, so a
# canonical host that redirects away from itself is invisible to all of them —
# which is how the apex answering `308 -> www` went unnoticed while every page
# kept declaring the apex as canonical. Run after any DNS, domain or proxy
# change.
check-canonical-host:
	uv run python scripts/check_canonical_host.py

# Umbrella target: every static guardrail. Fast (<1s total). Runs in
# CI and as part of the pre-commit hook. Slower checks (test, mypy,
# ruff, security audit) stay separate so this stays cheap.
# check-root-files, and were removed: the
# software-factory rules L4.ROOT_FILES_ARE_DECLARED, L4.DOC_LINKS_RESOLVE and
# L1.NO_BLANKET_SUPPRESSION cover them, each proven equivalent on this
# repository and each with a mutation fixture the scripts never had.
ci-checks: public-audit check-generated-lock check-deps-lock check-roadmap-mirror check-protocol-specs \
	check-logion-sh-urls check-skip-reasons check-docs \
	check-forbidden-imports check-cli-http check-installer-security check-json-module \
	factory-check

# The documentation artifact rendered at logion.sh/docs. Generated from the
# OpenAPI contract, the CLI argparse tree and docs/marketplace/, because the
# landing deploys with packages/landing/ as its root and cannot read either
# source at runtime. check-docs is what makes "the docs are current" a fact:
# a contract sync or a new CLI flag turns the build red until it is rerun.
docs-generate:
	uv run python scripts/gen_docs.py

check-docs:
	uv run python scripts/gen_docs.py --check

# --allow-commands is required, not optional. L3.EVERY_ACTOR_HAS_A_GOAL
# runs a command, and without the flag `sf verify` scores it as fired on
# the "commands are not enabled" finding instead of on its mutation --
# a rule proven by its own refusal to run.
factory-check:
	sf verify --allow-commands
	sf check --allow-commands

update-generated-lock:
	uv run python scripts/check_generated_lock.py --update

update-deps-lock:
	uv run python scripts/check_deps_lock.py --update

update-json-module:
	uv run python scripts/check_json_module_sync.py --update

companion-verify:
	uv run make -C packages/agent-companion verify

release-manifest:
	uv run python scripts/release_manifest.py build --channel stable

release-manifest-check:
	uv run python scripts/release_manifest.py check --in releases/manifest-stable.json

npm-test:
	cd packages/npm-wrapper && npm test

npm-pack:
	cd packages/npm-wrapper && npm pack

npm-build:
	cd packages/npm-wrapper && npm ci --ignore-scripts && npm run build && node dist/scripts/version-from-manifest.js && npm pack --dry-run && git checkout package.json

version-bump-cli:
	uv run semantic-release -c packages/cli/pyproject.toml version

version-bump-client:
	uv run semantic-release -c packages/client/pyproject.toml version

version-bump-companion:
	uv run semantic-release -c packages/agent-companion/pyproject.toml version

build-check:
	rm -rf dist/
	uv run python packages/cli/scripts/sync_docs.py
	uv build --package logion-cli --wheel --sdist
	uv build --package logion-client --wheel --sdist
	uv run twine check dist/*
	@echo "✅ Build check passed"

install-sh-lint: check-installer-security
	shellcheck -s sh -x -e SC1091 scripts/install.sh scripts/install_lib.sh scripts/install_test/harness.sh

install-sh-test: install-sh-lint
	bats tests/install/test_install_sh.bats tests/install/test_install_lib.bats

install-ps1-lint:
	pwsh -NoLogo -NoProfile -Command '$$paths = @("scripts/install.ps1", "scripts/install_lib.ps1", "tests/install/test_install_ps1.Tests.ps1"); foreach ($$path in $$paths) { Invoke-ScriptAnalyzer -Path $$path -Severity Error -EnableExit; Invoke-ScriptAnalyzer -Path $$path -IncludeRule PSAvoidUsingInvokeExpression -EnableExit }'

install-ps1-test: install-ps1-lint
	pwsh -NoLogo -NoProfile -Command 'if (-not $$env:TEMP) { $$env:TEMP = if ($$env:TMPDIR) { $$env:TMPDIR } else { [System.IO.Path]::GetTempPath() } }; $$out = Join-Path $$env:TEMP "logion-pester-results.xml"; Invoke-Pester -Path tests/install/test_install_ps1.Tests.ps1 -EnableExit -OutputFile $$out -OutputFormat NUnitXml'

install-test: install-sh-test install-ps1-test

companion-bundle:
	uv run python packages/agent-companion/scripts/package_skill.py build --out dist/ --version $(shell python -c "import tomllib,pathlib; print(tomllib.loads(pathlib.Path('packages/agent-companion/pyproject.toml').read_text())['project']['version'])") --release

companion-bundle-verify:
	uv run python packages/agent-companion/scripts/verify_bundle.py dist/logion-marketplace-companion-$(shell python -c "import tomllib,pathlib; print(tomllib.loads(pathlib.Path('packages/agent-companion/pyproject.toml').read_text())['project']['version'])").tar.gz

# ── scanners package targets ──────────────────────────────────
scanners-lint:
	uv run ruff check packages/scanners/
	uv run ruff format --check packages/scanners/

scanners-test:
	uv run pytest packages/scanners/tests/ -q --no-header -m "not docker"

scanners-test-integration:
	uv run pytest packages/scanners/tests/ -q --no-header -m docker

# ── social-management package targets ─────────────────────────
social-lint:
	uv run ruff check packages/social-management/
	uv run ruff format --check packages/social-management/

social-typecheck:
	uv run mypy packages/social-management/ --ignore-missing-imports

social-test:
	uv run pytest packages/social-management/tests/ -q --no-header

social-arch:
	uv run pytest packages/social-management/tests/test_social_architecture.py -q --no-header

# ── agent-proving-ground package targets ───────────────────────
agent-proving-ground-lint:
	uv run ruff check packages/agent-proving-ground/
	uv run ruff format --check packages/agent-proving-ground/

agent-proving-ground-typecheck:
	uv run mypy --config-file packages/agent-proving-ground/pyproject.toml packages/agent-proving-ground/agent_proving_ground

agent-proving-ground-dead-code:
	uv run vulture packages/agent-proving-ground/agent_proving_ground packages/agent-proving-ground/tests --min-confidence 80

agent-proving-ground-test:
	uv run pytest packages/agent-proving-ground/tests/ -q --no-header

agent-proving-ground-verify: agent-proving-ground-lint agent-proving-ground-typecheck agent-proving-ground-dead-code agent-proving-ground-test

# Real-agent proving-ground runs. Preconditions:
#   make dev-up MODE=mock|prod ROLE=...   (writes .devrig/devrig.env)
#   make doctor AGENT=...
# Override the driver with LOGION_PROVING_GROUND_AGENT_DRIVER=opencode etc.
LOGION_PROVING_GROUND_AGENT_DRIVER ?= codex
# The release gate is the loop the release is about. It was
# marketplace_loop, which drives the Courses rails: those are Loop C,
# they target 0.3, and a green run there says nothing about whether the
# loop 0.2 ships works. Override to run the old one deliberately.
LOGION_PROVING_GROUND_SCENARIO ?= native_use_observation_and_feedback
LOGION_PROVING_GROUND_DEVRIG_ROOT ?= $(ROOT)

agent-proving-ground-smoke:
	env -u XDG_CONFIG_HOME -u GH_CONFIG_DIR uv run logion-agent-proving-ground run builtin:skill_report_contract \
		--api-adapter local-devrig \
		--devrig-root $(LOGION_PROVING_GROUND_DEVRIG_ROOT) \
		--agent-driver $(LOGION_PROVING_GROUND_AGENT_DRIVER) \
		--out .runs/proving-ground/smoke

agent-proving-ground-release:
	env -u XDG_CONFIG_HOME -u GH_CONFIG_DIR uv run logion-agent-proving-ground run builtin:$(LOGION_PROVING_GROUND_SCENARIO) \
		--api-adapter local-devrig \
		--devrig-root $(LOGION_PROVING_GROUND_DEVRIG_ROOT) \
		--agent-driver $(LOGION_PROVING_GROUND_AGENT_DRIVER) \
		--out .runs/proving-ground/release

bootstrap: install-hooks
	uv sync --all-packages --all-groups
	uv run python scripts/devrig.py bootstrap

dev-up:
	uv run python scripts/devrig.py env --mode $(MODE) --role $(ROLE) $(if $(LOGION_DEVRIG_API_BASE_URL),--api-base-url $(LOGION_DEVRIG_API_BASE_URL),) --write $(DEVRIG_ENV)
	@if [ "$(MODE)" = "mock" ]; then $(MAKE) mock; else echo "Using production API via personal Logion account"; fi

dev-api:
	@if [ "$(MODE)" = "prod" ]; then \
		uv run python scripts/devrig.py env --mode prod --role $(ROLE) $(if $(LOGION_DEVRIG_API_BASE_URL),--api-base-url $(LOGION_DEVRIG_API_BASE_URL),) --write $(DEVRIG_ENV); \
		echo "Production mode does not start a local API. Current base URL:"; \
		grep LOGION_BASE_URL $(DEVRIG_ENV); \
	else \
		npx @stoplight/prism-cli mock contracts/openapi/v1.json --port 4010; \
	fi

doctor:
	uv run python scripts/devrig.py doctor --env-file $(DEVRIG_ENV) --agent $(AGENT)

companion:
	uv run python scripts/devrig.py companion --env-file $(DEVRIG_ENV) --agent $(AGENT) --role $(ROLE)

start-companion:
	uv run python scripts/devrig.py launch --env-file $(DEVRIG_ENV) --agent $(AGENT) --role $(ROLE)

clean-companion:
	uv run python scripts/devrig.py clean

dev-logs:
	@if [ -f .devrig/prism.log ]; then tail -f .devrig/prism.log; else echo "No Prism log yet at .devrig/prism.log"; fi

devrig-lint: lint

devrig-test: test

dev-rebuild: bootstrap clean-companion companion

dev-rebuild-cli: bootstrap

dev-rebuild-companion: clean-companion companion

dev-rebuild-npm: npm-build

# ── release orchestration targets ───────────────────────────────
release-plan:
	uv run python scripts/release_orchestrator.py plan --version $(VERSION) $(if $(PUBLISH_STORE),--publish-store,)

release:
	uv run python scripts/release_orchestrator.py release --version $(VERSION) $(if $(PUBLISH_STORE),--publish-store,)

release-dry-run:
	uv run python scripts/release_orchestrator.py release --version $(VERSION) --dry-run $(if $(PUBLISH_STORE),--publish-store,)

release-store:
	uv run python scripts/release_store.py publish-companion --version $(VERSION) --course-id 5ddf32c6-e139-4056-ac94-c4a231bfd932

release-smoke-input:
	uv run python scripts/release_smoke.py workflow-input --version $(VERSION)

# ---------------------------------------------------------------------------
# Local multi-agent node foundation — operator-side targets only.
# Roles are Compose services in deploy/local-node/compose.yaml; the
# behavior contract lives in docs/node/local-macos.md.
# ---------------------------------------------------------------------------

NODE_DIR := $(ROOT)/deploy/local-node

node-dev-up:
	bash $(NODE_DIR)/node.sh up "$(ROLES)"

node-status:
	bash $(NODE_DIR)/node.sh status

node-agent:
	@test -n "$(ROLE)" || { echo "usage: make node-agent ROLE=consumer [ARGS='id']" >&2; exit 2; }
	bash $(NODE_DIR)/node.sh agent $(ROLE) $(ARGS)

node-dev-down:
	bash $(NODE_DIR)/node.sh down

node-dev-reset:
	@test -n "$(ROLE)" || { echo "usage: make node-dev-reset ROLE=consumer YES=1" >&2; exit 2; }
	bash $(NODE_DIR)/node.sh reset $(ROLE) "$(YES)"

node-run-once:
	bash $(NODE_DIR)/node.sh runner-once

node-doctor:
	bash $(NODE_DIR)/node.sh doctor

# Operator surface for the runner evidence fixture: one command the
# node operator (a customer persona with only the installed product)
# can run to enroll the node, execute the checker and the adversarial
# fixtures in the isolated sandbox, and retain the typed evidence.
# Builds the sandbox image the runner executes jobs inside and prints the
# content digest to pin. Nothing else may name a digest: a pin that no
# build produces is not a pin.
RUNNER_IMAGE_TAG ?= logion-runner-job:fixed
runner-image:
	docker build -f deploy/local-node/Dockerfile.runner -t $(RUNNER_IMAGE_TAG) .
	@echo "logion-runner-job@$$(docker inspect --format '{{.Id}}' $(RUNNER_IMAGE_TAG))"

runner-evidence:
	LOGION_PROVING_GROUND_ROLE_KEYS_FILE=$(LOGION_PROVING_GROUND_ROLE_KEYS_FILE) \
	LOGION_API_BASE_URL=$(LOGION_API_BASE_URL) \
	LOGION_PUBLIC_REPO_PATH=$(ROOT) \
	uv run python packages/agent-proving-ground/scripts/run_runner_evidence.py $(EVIDENCE_DIR)

eval-evidence:
	LOGION_PROVING_GROUND_ROLE_KEYS_FILE=$(LOGION_PROVING_GROUND_ROLE_KEYS_FILE) \
	LOGION_API_BASE_URL=$(LOGION_API_BASE_URL) \
	LOGION_PUBLIC_REPO_PATH=$(ROOT) \
	uv run python packages/agent-proving-ground/scripts/run_eval_evidence.py $(EVIDENCE_DIR)