Taskfile.yml

version: "3"

# Auto-load .env at the project root so credential overrides
# (ZAI_API_KEY, ITERION_CLAUDE_CODE_MODEL, RESCUE_PROVIDER, …) are
# visible to every task without the operator having to `source .env`
# manually. .env stays gitignored — only the file at the repo root
# is read. When the file is absent task silently skips it; no error
# on fresh checkouts.
dotenv: [".env"]

vars:
  BINARY: iterion
  CMD: ./cmd/iterion
  VERSION:
    sh: node -p "require('./package.json').version" 2>/dev/null || echo "dev"
  COMMIT:
    sh: git rev-parse --short HEAD 2>/dev/null || echo ""
  LDFLAGS: -X github.com/SocialGouv/iterion/pkg/internal/appinfo.Version=v{{.VERSION}} -X github.com/SocialGouv/iterion/pkg/internal/appinfo.Commit={{.COMMIT}}

tasks:
  default:
    desc: List available tasks
    cmds:
      - task --list-all

  build:
    desc: Build the iterion binary
    deps: [studio:build, templates:dispatch-bots]
    env:
      CGO_ENABLED: "0"
    cmds:
      - go build -ldflags "{{.LDFLAGS}}" -o {{.BINARY}} {{.CMD}}
    sources:
      - "**/*.go"
      - go.mod
      - pkg/server/static/**
      - pkg/cli/templates/dispatch_bots/**
    generates:
      - "{{.BINARY}}"

  templates:dispatch-bots:
    desc: "Sync the embedded dispatcher bot catalogue (pkg/cli/templates/dispatch_bots/) from bots/ + the default fallback template. The output is gitignored: re-run after editing any bot in bots/ or pkg/cli/templates/dispatch_bots_default.bot. Required before `task build` / `task test` (declared as a dep)."
    cmds:
      # Wipe-and-resync — but preserve .gitkeep so the directory keeps
      # tracking even when no bot has been copied yet.
      - find pkg/cli/templates/dispatch_bots -mindepth 1 ! -name .gitkeep -exec rm -rf {} +
      - mkdir -p pkg/cli/templates/dispatch_bots/default
      - cp pkg/cli/templates/dispatch_bots_default.bot pkg/cli/templates/dispatch_bots/default/main.bot
      - cp -R bots/feature-dev pkg/cli/templates/dispatch_bots/feature-dev
      - cp -R bots/whole-improve-loop pkg/cli/templates/dispatch_bots/whole-improve-loop
      - cp -R bots/branch-improve-loop pkg/cli/templates/dispatch_bots/branch-improve-loop
      - cp -R bots/whats-next pkg/cli/templates/dispatch_bots/whats-next
      - cp -R bots/docs-refresh pkg/cli/templates/dispatch_bots/docs-refresh
      - cp -R bots/sec-audit-source pkg/cli/templates/dispatch_bots/sec-audit-source
      - cp -R bots/sec-audit-deps pkg/cli/templates/dispatch_bots/sec-audit-deps
      - cp -R bots/secured-renovacy pkg/cli/templates/dispatch_bots/secured-renovacy
      - cp -R bots/review-pr pkg/cli/templates/dispatch_bots/review-pr
    sources:
      - pkg/cli/templates/dispatch_bots_default.bot
      - bots/feature-dev/**
      - bots/whole-improve-loop/**
      - bots/branch-improve-loop/**
      - bots/whats-next/**
      - bots/docs-refresh/**
      - bots/sec-audit-source/**
      - bots/sec-audit-deps/**
      - bots/secured-renovacy/**
      - bots/review-pr/**
    generates:
      - pkg/cli/templates/dispatch_bots/**

  test:
    desc: Run all unit tests
    deps: [templates:dispatch-bots]
    cmds:
      - go test ./...

  test:verbose:
    desc: Run all unit tests with verbose output
    deps: [templates:dispatch-bots]
    cmds:
      - go test -v ./...

  test:race:
    desc: Run tests with race detector
    deps: [templates:dispatch-bots]
    cmds:
      - go test -race ./...

  test:e2e:
    desc: Run end-to-end tests
    deps: [templates:dispatch-bots]
    cmds:
      ## The budget bounds a HANG, not a slow machine. The ADR-058 v2 rollout
      ## added stub suites (docs-refresh's six scenarios, feature-dev's five)
      ## that grew the package to ~170s on a dev box; at the old 240s a loaded
      ## CI runner crossed it and produced a 4m panic dump naming whichever
      ## test was in flight — a flake that reads as a broken test. A hung test
      ## still trips 600s.
      - go test -v -timeout 600s ./e2e/...

  test:e2e:ui:
    desc: Run the studio UI end-to-end tests (Playwright against the real server; skips when chromium isn't installed)
    dir: studio
    deps: [build]
    cmds:
      - corepack pnpm install --prefer-offline
      ## The suite needs a Playwright browser build, which is a ~120 MB
      ## download nobody should pay for implicitly. Without it the target
      ## reports how to install it and succeeds, so `task check` stays
      ## usable on a bare machine.
      - |
        if ! node e2e/guard.mjs; then
          echo "task: [test:e2e:ui] skipped — no Playwright browser installed"
          exit 0
        fi
        ./node_modules/.bin/playwright test {{.CLI_ARGS}}

  test:e2e:ui:install:
    desc: Download the Playwright chromium build the studio UI e2e suite needs
    dir: studio
    cmds:
      - corepack pnpm install --prefer-offline
      - ./node_modules/.bin/playwright install chromium

  test:goldens:
    desc: Run bot golden replay tests (schema + invariant checks on recorded LLM fixtures; no API keys)
    cmds:
      - go test -count=1 -run 'TestGoldens' ./pkg/botreplay/...

  test:goldens:record:
    desc: Re-record bot golden fixtures against the real LLM (requires credentials; writes testdata/bot-goldens/). Run from the repo root.
    cmds:
      - go test -tags goldens_record -count=1 -run 'TestRecordGoldens' -timeout 30m ./pkg/botreplay/...

  test:live:quality:unit:
    desc: Run the live-e2e quality snapshot-engine unit tests (deterministic, no API keys, no cost). See docs/live-e2e-coverage.md.
    cmds:
      - go test -count=1 ./pkg/benchmark/quality/...

  test:live:compile:
    desc: Compile the live e2e test binary without running anything (build-gate the -tags live suite for free).
    cmds:
      - go test -tags live -count=1 -run '^$' ./e2e/...

  test:live:
    desc: Run all live e2e tests (requires claude CLI + ANTHROPIC_API_KEY + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_" -timeout 5h ./e2e/...

  test:live:review:
    desc: Run the session continuity review/fix live e2e test (requires claude CLI + ANTHROPIC_API_KEY + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_SessionContinuity_ReviewFix -timeout 3h ./e2e/...

  test:live:kanban:
    desc: Run the kanban board plan/implement/review live e2e test (requires claude CLI + ANTHROPIC_API_KEY + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_DualModel_PlanImplementReview -timeout 5h ./e2e/...

  test:live:full:
    desc: Run the exhaustive DSL coverage live e2e test (requires claude CLI + ANTHROPIC_API_KEY + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Full_ExhaustiveDSLCoverage -timeout 5h ./e2e/...

  test:live:coverage:
    desc: Run the claw broad-tool-coverage live e2e test (requires ANTHROPIC_API_KEY; ~$0.03/run on Haiku 4.5)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_ClawToolCoverage -timeout 15m ./e2e/...

  test:live:session-inherit:
    desc: Run the claude_code session-inherit validation live e2e test (requires claude CLI + ANTHROPIC_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_SessionInheritValidation -timeout 30m ./e2e/...

  test:live:claw:
    desc: Run the claw backend comprehensive coverage live e2e test (requires OPENAI_API_KEY + ANTHROPIC_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawComprehensive -timeout 30m ./e2e/...

  test:live:claw-builtin-tools:
    desc: Run the claw built-in filesystem/shell tools live e2e test (requires ANTHROPIC_API_KEY + go in PATH)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawBuiltinTools -timeout 15m ./e2e/...

  test:live:claw-reasoning:
    desc: Run the reasoning_effort propagation live e2e test (requires OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawReasoningEffort -timeout 10m ./e2e/...

  test:live:claw-mcp:
    desc: Run the MCP integration live e2e test (requires ANTHROPIC_API_KEY + go in PATH)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawMCP -timeout 10m ./e2e/...

  test:live:claw-long-context:
    desc: Run the long-context live e2e test (requires ANTHROPIC_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawLongContext -timeout 10m ./e2e/...

  test:live:claw-read-image:
    desc: Run the read_image (computer use) live e2e test (requires ANTHROPIC_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_Lite_ClawReadImage -timeout 5m ./e2e/...

  test:live:vision-attachments:
    desc: Run the attachments multimodal live e2e test (requires ANTHROPIC_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_VisionAttachments -timeout 5m ./e2e/...

  test:live:feature-dev:
    desc: Live e2e for feature_dev bot (requires claude CLI + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_FeatureDev -timeout 90m ./e2e/...

  test:live:whole-improve-loop:
    desc: Live e2e for whole_improve_loop bot (requires claude CLI + OPENAI_API_KEY)
    cmds:
      - go test -v -tags live -count=1 -run TestLive_VibeReviewAlternating -timeout 45m ./e2e/...

  test:live:secured-renovacy:
    desc: Live e2e for secured-renovacy bundle (requires claude CLI + docker + OPENAI_API_KEY; ~$10-50, up to 3h)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_SecuredRenovacy$" -timeout 3h ./e2e/...

  test:live:bots:
    desc: Run all three example-bot live tests in sequence (slow + costly)
    cmds:
      - task: test:live:whole-improve-loop
      - task: test:live:feature-dev
      - task: test:live:secured-renovacy

  test:live:feature-dev-real:
    desc: Live e2e for feature_dev against a real Go HTTP service fixture (20-60min, $5-15)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_FeatureDev_Real$" -timeout 2h ./e2e/...

  test:live:whole-improve-loop-real:
    desc: Live e2e for whole_improve_loop against a curated bug-mix fixture (30-90min, $10-30)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_VibeReviewAlternating_Real$" -timeout 3h ./e2e/...

  test:live:secured-renovacy-real:
    desc: Live e2e for secured-renovacy against polyglot CVE fixture incl. node-ipc malware (1-3h, $20-80)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_SecuredRenovacy_Real$" -timeout 4h ./e2e/...

  test:live:secured-renovacy-protestware:
    desc: Live e2e for secured-renovacy's anti-malware heuristic (single-package fixture, node-ipc@10.1.1, 5-15min, $2-5)
    cmds:
      - go test -v -tags live -count=1 -run "TestLive_SecuredRenovacy_Protestware$" -timeout 1h ./e2e/...

  test:live:bots-real:
    desc: Run all three real-scenario bot live tests in sequence (very slow + very costly)
    cmds:
      - task: test:live:whole-improve-loop-real
      - task: test:live:feature-dev-real
      - task: test:live:secured-renovacy-real

  # ---- Per-bot / per-feature live e2e targets (real LLM cost; see docs/live-e2e-coverage.md) ----

  test:live:bot:review-pr:
    desc: 'Live e2e for review-pr — read-only diff review (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_ReviewPR$' -timeout 45m ./e2e/...

  test:live:bot:whats-next:
    desc: 'Live e2e for whats-next — roadmap + board issues (auto-resumed, isolated store) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_WhatsNext$' -timeout 55m ./e2e/...

  test:live:bot:docs-refresh:
    desc: 'Live e2e for docs-refresh — doc/code drift fix loop (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_DocsRefresh$' -timeout 60m ./e2e/...

  test:live:bot:adr-cartograph:
    desc: 'Live e2e for adr-cartograph — author ADRs (isolated store) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_AdrCartograph$' -timeout 60m ./e2e/...

  test:live:bot:evolve:
    desc: 'Live e2e for evolve — vision + backlog (auto-resumed, isolated store) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_Evolve$' -timeout 60m ./e2e/...

  test:live:bot:revi-converse:
    desc: 'Live e2e for revi-converse — answer a question on a diff (no forge) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_ReviConverse$' -timeout 30m ./e2e/...

  test:live:bot:rgaa-audit:
    desc: 'Live e2e for rgaa-audit — RGAA a11y audit (board disabled) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_RgaaAudit$' -timeout 45m ./e2e/...

  test:live:bot:branch-improve-loop:
    desc: 'Live e2e for branch-improve-loop — fix a branch diff; docker+sandbox-full (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_BranchImproveLoop$' -timeout 100m ./e2e/...

  test:live:bot:feature-gap-fill:
    desc: 'Live e2e for feature-gap-fill — close a gap_spec; docker+sandbox-full (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_FeatureGapFill$' -timeout 100m ./e2e/...

  test:live:bot:test-coverage:
    desc: 'Live e2e for test-coverage — add tests; docker+sandbox-full (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_TestCoverage$' -timeout 100m ./e2e/...

  test:live:bot:bmady:
    desc: 'Live e2e for bmady — BMAD pipeline (auto-resumed gates) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_Bmady$' -timeout 75m ./e2e/...

  test:live:bot:devbox-setup:
    desc: 'Live e2e for devbox-setup — author devbox.json; docker+sandbox-sec (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_DevboxSetup$' -timeout 70m ./e2e/...

  test:live:bot:adr-rechallenge:
    desc: 'Live e2e for adr-rechallenge — re-challenge an ADR (auto-resumed) (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_AdrRechallenge$' -timeout 45m ./e2e/...

  test:live:bot:dep-update-guard:
    desc: 'Live e2e for dep-update-guard — vet a Dependabot bump; docker+sandbox-sec (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_DepUpdateGuard$' -timeout 70m ./e2e/...

  test:live:bot:sec-audit-source:
    desc: 'Live e2e for sec-audit-source — SAST; docker+sandbox-sec (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_SecAuditSource$' -timeout 75m ./e2e/...

  test:live:bot:sec-audit-deps:
    desc: 'Live e2e for sec-audit-deps — SCA; docker+sandbox-sec (real cost). See docs/live-e2e-coverage.md.'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_SecAuditDeps$' -timeout 70m ./e2e/...

  test:live:feat:cursors:
    desc: 'Live e2e for the cursor calibration dials feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Cursors$' -timeout 15m ./e2e/...

  test:live:feat:ultracode:
    desc: 'Live e2e for the reasoning_effort: ultracode on opus-4-8 feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Ultracode$' -timeout 30m ./e2e/...

  test:live:feat:supervisor:
    desc: 'Live e2e for the concurrent watchdog supervisor feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Supervisor$' -timeout 30m ./e2e/...

  test:live:feat:worktree:
    desc: 'Live e2e for the worktree:auto finalization (tool-only, no creds) feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Worktree$' -timeout 5m ./e2e/...

  test:live:feat:board-caps:
    desc: 'Live e2e for the agent board.* capabilities feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_BoardCaps$' -timeout 12m ./e2e/...

  test:live:feat:backend-autodetect:
    desc: 'Live e2e for the backend auto-detection feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_BackendAutodetect$' -timeout 8m ./e2e/...

  test:live:feat:budget:
    desc: 'Live e2e for the budget enforcement (tiny cap) feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Budget$' -timeout 8m ./e2e/...

  test:live:feat:permission:
    desc: 'Live e2e for the permission gate deny mode feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Permission_Deny$' -timeout 8m ./e2e/...

  test:live:feat:verified-action:
    desc: 'Live e2e for the Verified Action recovery ladder feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_VerifiedAction$' -timeout 12m ./e2e/...

  test:live:feat:router-llm:
    desc: 'Live e2e for the LLM router dispatch feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_RouterLLM$' -timeout 12m ./e2e/...

  test:live:feat:skills:
    desc: 'Live e2e for the bundle skill mirroring feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Skills$' -timeout 8m ./e2e/...

  test:live:feat:permission-ask:
    desc: 'Live e2e for the permission gate ask mode (pauses) feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Permission_Ask$' -timeout 6m ./e2e/...

  test:live:feat:rtk:
    desc: 'Live e2e for the rtk command-output compression (needs rtk binary) feature (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Compress$' -timeout 3m ./e2e/...

  test:live:feat:budget-resume:
    desc: 'Live e2e for budget exceeded → raise cap → resume recovery (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_BudgetResume$' -timeout 10m ./e2e/...

  test:live:feat:schedule:
    desc: 'Live e2e for the schedule trigger → bot run (isolated, real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Schedule$' -timeout 8m ./e2e/...

  test:live:feat:sandbox-net:
    desc: 'Live e2e for sandbox network allowlist egress policy (docker + iterion-sandbox-full).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Sandbox_Network$' -timeout 12m ./e2e/...

  test:live:feat:fork:
    desc: 'Live e2e for run forking (parent run → fork at a turn → child run).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_Fork$' -timeout 8m ./e2e/...

  test:live:bots:new:
    desc: 'Run ALL 16 new per-bot live e2e tests sequentially (very slow + very costly).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Bot_' -timeout 8h ./e2e/...

  test:live:feats:all:
    desc: 'Run all TestLive_Feat_* feature live e2e tests (real cost).'
    cmds:
      - go test -v -tags live -count=1 -run 'TestLive_Feat_' -timeout 2h ./e2e/...

  test:bundle:
    desc: Bundle pack/open/compile integration tests (no live)
    cmds:
      - go test -v -count=1 -run TestBundle_ -timeout 60s ./e2e/...

  test:repack-examples:
    desc: Verify shipped .botz bundles match their source dirs (drift detector)
    cmds:
      - go test -v -count=1 -run TestBundle_SecuredRenovacy_RepackMatchesShippedBotz -timeout 30s ./e2e/...

  fmt:
    desc: Format Go source files
    cmds:
      - go fmt ./...

  vet:
    desc: Run go vet
    cmds:
      - go vet ./...

  lint:
    desc: Run fmt, vet, and golangci-lint
    deps: [fmt, vet]
    cmds:
      - golangci-lint run

  run:
    desc: Build and run iterion (pass args after --)
    deps: [build]
    cmds:
      - ./{{.BINARY}} {{.CLI_ARGS}}

  install:
    desc: Build and install iterion to $GOPATH/bin
    deps: [studio:build]
    env:
      CGO_ENABLED: "0"
    cmds:
      - go install -ldflags "{{.LDFLAGS}}" {{.CMD}}

  clean:
    desc: Remove build artifacts
    cmds:
      - rm -f {{.BINARY}}

  validate:
    desc: Validate a .bot file (pass file after --)
    deps: [build]
    cmds:
      - ./{{.BINARY}} validate {{.CLI_ARGS}}

  diagram:
    desc: Generate Mermaid diagram from a .bot file (pass file after --)
    deps: [build]
    cmds:
      - ./{{.BINARY}} diagram {{.CLI_ARGS}}

  check:
    desc: Run all checks (lint + test + golden replay + studio + pi extension)
    cmds:
      - task: lint
      - task: test
      - task: test:goldens
      - task: studio:check
      - task: pi-ext:check

  pi-ext:typecheck:
    desc: Typecheck the iterion pi extension
    dir: pi-extension
    cmds:
      - corepack pnpm install --prefer-offline
      - ./node_modules/.bin/tsc --noEmit

  pi-ext:build:
    desc: Bundle the iterion pi extension into the embedded Go asset
    dir: pi-extension
    cmds:
      - corepack pnpm install --prefer-offline
      - ./node_modules/.bin/esbuild src/index.ts --bundle --format=esm --platform=node --target=node22 --external:@earendil-works/* --external:typebox --outfile=../pkg/backend/delegate/piext/asset/iterion-pi.js

  pi-ext:check:
    desc: Typecheck the pi extension and verify the embedded asset matches its source
    dir: pi-extension
    cmds:
      - task: pi-ext:typecheck
      # The asset is committed and compiled into the binary, so a stale one
      # means every pi run silently loads yesterday's extension.
      #
      # Rebuild to a TEMP file and compare, rather than rebuilding in place and
      # running `git diff`: the latter also fails on a legitimately uncommitted
      # edit, which makes the guard fire during ordinary development and trains
      # people to ignore it.
      - |
        set -e
        tmp="$(mktemp -t iterion-pi-XXXXXX.js)"
        trap 'rm -f "$tmp"' EXIT
        ./node_modules/.bin/esbuild src/index.ts --bundle --format=esm --platform=node --target=node22 \
          --external:@earendil-works/* --external:typebox --outfile="$tmp" >/dev/null
        if ! cmp -s "$tmp" ../pkg/backend/delegate/piext/asset/iterion-pi.js; then
          echo "pi extension asset is stale: pi-extension/src does not match the embedded bundle."
          echo "Run 'task pi-ext:build' and commit pkg/backend/delegate/piext/asset/iterion-pi.js."
          exit 1
        fi

  studio:build:
    desc: Build the studio frontend
    dir: studio
    method: checksum
    env:
      CI: "true"
    cmds:
      - corepack pnpm install --prefer-offline
      - corepack pnpm exec vite build
      - rm -rf ../pkg/server/static/assets ../pkg/server/static/index.html
      # `cp -r dist/. <dest>` is the POSIX-portable form — works in
      # bash, in zsh, AND in go-task's mvdan/sh interpreter (the
      # `dist/*` glob was failing on Windows runners with
      # "coreutils: target ... is not a directory" because mvdan/sh's
      # built-in cp on Windows rejects the trailing-slash-with-glob
      # combo even though the dir exists).
      - mkdir -p ../pkg/server/static
      - cp -R dist/. ../pkg/server/static
    sources:
      - src/**/*
      - public/**/*
      - index.html
      - package.json
      - pnpm-lock.yaml
      - vite.config.ts
      - tsconfig*.json
    generates:
      - ../pkg/server/static/index.html
      - ../pkg/server/static/assets/**

  studio:lint:
    desc: Lint the studio frontend (eslint)
    dir: studio
    cmds:
      - corepack pnpm install --prefer-offline
      - corepack pnpm exec eslint .

  studio:typecheck:
    desc: Typecheck the studio frontend (tsc -b)
    dir: studio
    cmds:
      - corepack pnpm install --prefer-offline
      - corepack pnpm exec tsc -b

  studio:test:
    desc: Run the studio frontend unit tests (vitest)
    dir: studio
    cmds:
      - corepack pnpm install --prefer-offline
      - corepack pnpm exec vitest run

  studio:check:
    desc: Lint + typecheck + test the studio frontend
    cmds:
      - task: studio:lint
      - task: studio:typecheck
      - task: studio:test

  openapi:gen:
    desc: Regenerate the OpenAPI spec (openapi.json) + studio TS types (schema.ts) from code
    cmds:
      # Offline spec from the in-code route table — the single source of truth.
      - go run -mod=vendor ./cmd/iterion openapi -o openapi.json
      # Typed client surface for the studio, derived from that spec.
      - corepack pnpm -C studio exec openapi-typescript ../openapi.json -o src/api/schema.ts

  openapi:check:
    desc: Fail if the committed OpenAPI spec / TS types drift from the code
    cmds:
      - task: openapi:gen
      - cmd: |
          if ! git diff --quiet -- openapi.json studio/src/api/schema.ts; then
            echo "::error::OpenAPI spec / client drift — run 'task openapi:gen' and commit the result."
            git --no-pager diff --stat -- openapi.json studio/src/api/schema.ts
            exit 1
          fi

  studio:dev:
    desc: Start studio in dev mode (Vite HMR + Go backend with auto-restart)
    deps: [studio:dev:backend, studio:dev:frontend]

  studio:dev:backend:
    desc: Run Go studio backend with auto-restart on changes
    # Build a STATIC iterion and run THAT (not `go run`) so the subprocesses
    # the studio delegates to — the __mcp-board MCP server, the sandboxed
    # __claw-runner, __mcp-ask-user — use this exact fresh binary instead of a
    # stale `/usr/bin/iterion`. Under `go run`, os.Executable() is a volatile
    # temp path, so proc.LocateIterionBinary / locateHostIterionBinary fall back
    # to whatever is installed → capability skew (e.g. board MCP missing
    # set_bot/list_labels). Running the built binary makes os.Executable() stable
    # (repo ./iterion) and ITERION_BIN pins it; CGO_ENABLED=0 keeps it static so
    # it execs inside sandbox containers (a dynamic nix-glibc build fails there).
    # Net effect: dev-mode delegated capabilities always match the running code,
    # with no `sudo cp ./iterion /usr/bin/iterion`.
    env:
      CGO_ENABLED: "0"
      ITERION_BIN: "{{.ROOT_DIR}}/iterion"
    cmds:
      # NB: pass the script as a single quoted arg, NOT `sh -c '...'`. watchexec
      # runs its command through a shell by default (`--shell` != none), so an
      # explicit `sh -c '<script>'` gets its parts re-joined and re-shelled —
      # the inner quoting is lost and only the bare word `go` survives as the
      # script (→ `go` prints help, exit 2, backend never starts). Letting
      # watchexec's own shell run the script keeps `&&`/`exec` working.
      - watchexec -r -e go -w cmd -w pkg -w vendor -- 'go build -o {{.ROOT_DIR}}/iterion {{.CMD}} && exec {{.ROOT_DIR}}/iterion studio --no-browser --port 4891'
    interactive: true

  studio:dev:frontend:
    desc: Run Vite dev server for studio frontend
    dir: studio
    cmds:
      - corepack pnpm install --prefer-offline 2>/dev/null; corepack pnpm exec vite --port 5173 --open
    interactive: true

  studio:
    desc: Build and run the studio (production mode)
    deps: [build, studio:build]
    cmds:
      - ./{{.BINARY}} studio {{.CLI_ARGS}}

  sdk:ts:install:
    desc: Install dependencies for the TypeScript SDK
    dir: sdks/typescript
    cmds:
      - corepack pnpm install --prefer-offline

  sdk:ts:build:
    desc: Build the TypeScript SDK (emits dist/)
    dir: sdks/typescript
    deps: [sdk:ts:install]
    cmds:
      - corepack pnpm run build

  sdk:ts:test:
    desc: Run the TypeScript SDK unit tests
    dir: sdks/typescript
    deps: [sdk:ts:install]
    cmds:
      - corepack pnpm exec vitest run

  sdk:ts:typecheck:
    desc: Typecheck the TypeScript SDK including tests
    dir: sdks/typescript
    deps: [sdk:ts:install]
    cmds:
      - corepack pnpm exec tsc -p tsconfig.test.json

  sdk:ts:check:
    desc: Build + typecheck + test the TypeScript SDK
    cmds:
      - task: sdk:ts:build
      - task: sdk:ts:typecheck
      - task: sdk:ts:test

  # ── Desktop (Wails v2) ────────────────────────────────────────────────
  # The desktop binary wraps the studio server in a native window.
  # Wails CLI is required for `desktop:dev` and `desktop:build`. Install
  # it once with `task desktop:install-tools`. The Go code lives under
  # cmd/iterion-desktop/ and is gated by `//go:build desktop` so the
  # default `go test ./...` does not require Wails to be installed.

  desktop:install-deps:linux:
    desc: Install the apt prerequisites + Wails CLI to build iterion-desktop on Debian/Ubuntu/Mint (idempotent)
    cmds:
      - ./scripts/desktop/install-linux-deps.sh
      - task: desktop:install-tools

  desktop:install-tools:
    desc: Install Wails CLI and tools needed for desktop builds
    cmds:
      - go install github.com/wailsapp/wails/v2/cmd/wails@latest

  desktop:package:linux:amd64:docker:
    desc: Package Linux amd64 AppImage inside an Ubuntu 22.04 container (portable across distros)
    cmds:
      - ./scripts/desktop/build-appimage-in-docker.sh amd64

  desktop:package:linux:arm64:docker:
    desc: Package Linux arm64 AppImage inside an Ubuntu 22.04 container (portable across distros)
    cmds:
      - ./scripts/desktop/build-appimage-in-docker.sh arm64

  desktop:dev:
    desc: Run Iterion Desktop in dev mode (Wails)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - |
        # In devbox: prepend /usr/bin so system gcc/ld + apt pkg-config
        # are picked over the Nix-wrapped variants (which don't see system
        # webkit2gtk-4.1 / gtk+-3.0). On CI runners DEVBOX_PROJECT_ROOT
        # is unset, so we keep setup-go's Go ahead of /usr/bin/go (the
        # runner's preinstalled Go is often older than go.mod's directive).
        if [ -n "$DEVBOX_PROJECT_ROOT" ]; then
          export PATH="/usr/bin:$PATH"
        fi
        export PKG_CONFIG="${PKG_CONFIG:-/usr/bin/pkg-config}"
        export PKG_CONFIG_PATH="/usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig"
        wails dev -tags desktop,webkit2_41 -skipbindings -s

  desktop:build:
    desc: Build Iterion Desktop for the current platform (unsigned)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - wails build -tags desktop,webkit2_41 -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}"

  desktop:build:darwin:arm64:
    desc: Build Iterion Desktop for macOS arm64 (must run on macOS)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - wails build -tags desktop -platform darwin/arm64 -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}" -o iterion-desktop-darwin-arm64

  desktop:build:darwin:amd64:
    desc: Build Iterion Desktop for macOS amd64 (must run on macOS)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - wails build -tags desktop -platform darwin/amd64 -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}" -o iterion-desktop-darwin-amd64

  desktop:build:darwin:universal:
    desc: Build Iterion Desktop for macOS (universal binary, runs on Intel + Apple Silicon)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      # `-platform darwin/universal` makes Wails build both arch slices
      # and lipo them into a single .app. The CI matrix prefers this
      # over two separate jobs to dodge the macos-13 runner-pool queue
      # (Intel hosted runners are scarce and frequently >20 min queued).
      - wails build -tags desktop -platform darwin/universal -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}" -o iterion-desktop-darwin-universal

  desktop:build:windows:amd64:
    desc: Build Iterion Desktop for Windows amd64 (must run on Windows)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - wails build -tags desktop -platform windows/amd64 -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}" -nsis -o iterion-desktop-windows-amd64.exe

  desktop:build:windows:arm64:
    desc: Build Iterion Desktop for Windows arm64 (must run on Windows)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - wails build -tags desktop -platform windows/arm64 -clean -trimpath -skipbindings -s -ldflags "{{.LDFLAGS}}" -nsis -o iterion-desktop-windows-arm64.exe

  desktop:build:linux:amd64:
    desc: Build Iterion Desktop for Linux amd64 (production with DevTools enabled)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - |
        # See desktop:dev for the devbox vs CI PATH split.
        if [ -n "$DEVBOX_PROJECT_ROOT" ]; then
          export PATH="/usr/bin:$PATH"
        fi
        export PKG_CONFIG="${PKG_CONFIG:-/usr/bin/pkg-config}"
        export PKG_CONFIG_PATH="/usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig"
        # -devtools keeps Inspect Element / Ctrl+Shift+I available in release
        # builds so users can debug WebView issues before native devtools
        # menus are wired up. Stripping it later is a one-line change.
        # -clean intentionally omitted: wails would wipe the entire
        # build/bin/ directory before producing its own binary, racing the
        # parallel cli:build:linux:amd64 task that lands its artefact in
        # the same dir. Since wails always overwrites its own output file
        # (-o iterion-desktop-linux-amd64) and the AppImage/deb scripts
        # tear down their own staging dirs, dropping -clean is safe and
        # lets the deb task fan out its sub-builds in parallel.
        wails build -tags desktop,webkit2_41 -platform linux/amd64 -trimpath -skipbindings -s -devtools -ldflags "{{.LDFLAGS}}" -o iterion-desktop-linux-amd64

  desktop:build:linux:arm64:
    desc: Build Iterion Desktop for Linux arm64 (production with DevTools enabled)
    deps: [studio:build]
    dir: cmd/iterion-desktop
    cmds:
      - |
        if [ -n "$DEVBOX_PROJECT_ROOT" ]; then
          export PATH="/usr/bin:$PATH"
        fi
        export PKG_CONFIG="${PKG_CONFIG:-/usr/bin/pkg-config}"
        export PKG_CONFIG_PATH="/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig"
        # See desktop:build:linux:amd64 for why -clean is intentionally absent.
        wails build -tags desktop,webkit2_41 -platform linux/arm64 -trimpath -skipbindings -s -devtools -ldflags "{{.LDFLAGS}}" -o iterion-desktop-linux-arm64

  desktop:package:linux:amd64:
    desc: Package Linux amd64 build as AppImage
    deps: [desktop:build:linux:amd64]
    cmds:
      - |
        # PATH override matters only when running inside devbox: linuxdeploy
        # invokes ldconfig/dpkg-query, which the Nix wrappers can't find.
        # On CI runners the default PATH already has /usr/bin first; the
        # prepend is a no-op there.
        export PATH="/usr/bin:$PATH"
        ./scripts/desktop/build-appimage.sh amd64

  desktop:package:linux:arm64:
    desc: Package Linux arm64 build as AppImage
    deps: [desktop:build:linux:arm64]
    cmds:
      - |
        export PATH="/usr/bin:$PATH"
        ./scripts/desktop/build-appimage.sh arm64

  cli:build:linux:amd64:
    desc: Build the iterion CLI for Linux amd64 (output build/bin/iterion-linux-amd64)
    # Intentionally no sources/generates: the up-to-date heuristic
    # mis-fires when the generated binary is removed out-of-band
    # (clean checkouts, manual rm, CI artifacts purge), causing
    # downstream `desktop:package:linux:*:deb` to fail with a
    # "iterion-linux-amd64 not found" before the dep had a chance to
    # rebuild it. A 10-second always-rebuild is the cheap fix.
    deps: [studio:build]
    env:
      CGO_ENABLED: "0"
      GOOS: linux
      GOARCH: amd64
    cmds:
      - go build -trimpath -ldflags "{{.LDFLAGS}}" -o build/bin/iterion-linux-amd64 {{.CMD}}

  cli:build:linux:arm64:
    desc: Build the iterion CLI for Linux arm64 (output build/bin/iterion-linux-arm64)
    deps: [studio:build]
    env:
      CGO_ENABLED: "0"
      GOOS: linux
      GOARCH: arm64
    cmds:
      - go build -trimpath -ldflags "{{.LDFLAGS}}" -o build/bin/iterion-linux-arm64 {{.CMD}}

  desktop:package:linux:amd64:deb:
    desc: Package Linux amd64 build as a Debian .deb (ships desktop + CLI; also produces AppImage)
    # Both prerequisites can run in parallel because the wails build no
    # longer passes -clean (see desktop:build:linux:amd64). cli:build and
    # desktop:build write distinct filenames into build/bin/ and the
    # AppImage / deb scripts manage their own staging dirs, so there is
    # no contention. studio:build is shared between both prerequisites
    # and Task dedupes it, so it runs once.
    deps: [desktop:package:linux:amd64, cli:build:linux:amd64]
    cmds:
      - |
        # dpkg-deb lives in /usr/bin and devbox's PATH may shadow it
        # (Nix wrappers don't ship dpkg). The prepend is harmless on CI
        # runners where /usr/bin already comes first.
        export PATH="/usr/bin:$PATH"
        ./scripts/desktop/build-deb.sh amd64

  desktop:package:linux:arm64:deb:
    desc: Package Linux arm64 build as a Debian .deb (ships desktop + CLI; also produces AppImage)
    deps: [desktop:package:linux:arm64, cli:build:linux:arm64]
    cmds:
      - |
        export PATH="/usr/bin:$PATH"
        ./scripts/desktop/build-deb.sh arm64

  # ── Fast .deb build (local dev only) ──────────────────────────────────
  # Mirrors the desktop:package:linux:amd64:deb chain but skips the
  # AppImage step (build-deb.sh consumes the raw binaries, not the
  # AppImage) and disables Vite minification. Total wall time drops
  # from ~90-150s to ~50-60s cold (~10-20s warm). The resulting .deb
  # is stamped <semver>+fast.<commit> so it cannot be confused with a
  # prod artifact via `dpkg -l`. See docs/desktop-build.md.

  studio:build:fast:
    desc: Build studio frontend WITHOUT minification — local dev only, do NOT ship
    dir: studio
    # `desktop:package:linux:amd64:deb:fast` deps on both
    # `desktop:build:linux:amd64:fast` and `cli:build:linux:amd64:fast`,
    # and both list `studio:build:fast` in their own `deps:`. Task v3
    # parallelises sibling deps by default, and the default `run:` mode
    # treats each invocation as independent — so without `run: once`
    # studio:build:fast fires TWICE in parallel and the two
    # `cp -R dist/. ../pkg/server/static` calls race on the same path,
    # producing `cp: cannot create regular file …: File exists` from
    # whichever cp lost. `run: once` collapses the two invocations into
    # one (Task waits for the first to finish, then the second
    # consumer reuses the result instead of re-running).
    run: once
    env:
      CI: "true"
    cmds:
      - corepack pnpm install --prefer-offline
      # Direct vite call (matches prod studio:build, which also bypasses
      # `pnpm run build` and so already skips tsc -b). --minify false
      # saves ~30-50s on cold builds; sourcemaps stay on (set in vite
      # config) for debuggability.
      - corepack pnpm exec vite build --minify false
      - rm -rf ../pkg/server/static/assets ../pkg/server/static/index.html
      - mkdir -p ../pkg/server/static
      - cp -R dist/. ../pkg/server/static
    # No method: checksum — Vite's incremental cache makes warm rebuild
    # ~3-5s, and avoiding shared-output collisions with prod studio:build
    # (same pkg/server/static dir) is worth more than 5s.

  desktop:build:linux:amd64:fast:
    desc: Build Iterion Desktop for Linux amd64 with the unminified SPA (local dev variant)
    deps: [studio:build:fast]
    dir: cmd/iterion-desktop
    cmds:
      - |
        if [ -n "$DEVBOX_PROJECT_ROOT" ]; then
          export PATH="/usr/bin:$PATH"
        fi
        export PKG_CONFIG="${PKG_CONFIG:-/usr/bin/pkg-config}"
        export PKG_CONFIG_PATH="/usr/lib/x86_64-linux-gnu/pkgconfig:/usr/share/pkgconfig"
        wails build -tags desktop,webkit2_41 -platform linux/amd64 -trimpath -skipbindings -s -devtools -ldflags "{{.LDFLAGS}}" -o iterion-desktop-linux-amd64

  cli:build:linux:amd64:fast:
    desc: Build the iterion CLI for Linux amd64 with the unminified SPA embedded (local dev variant)
    # Mirrors cli:build:linux:amd64 but deps on studio:build:fast so the
    # whole :fast subgraph hits studio:build:fast exactly once. Without
    # this, Task would invoke both studio:build and studio:build:fast
    # (different task names = no dedup) and they would race on
    # pkg/server/static/.
    deps: [studio:build:fast]
    env:
      CGO_ENABLED: "0"
      GOOS: linux
      GOARCH: amd64
    cmds:
      - go build -trimpath -ldflags "{{.LDFLAGS}}" -o build/bin/iterion-linux-amd64 {{.CMD}}

  desktop:package:linux:amd64:deb:fast:
    desc: Package Linux amd64 .deb without AppImage, unminified SPA, version-stamped +fast.<commit> (local dev only)
    deps: [desktop:build:linux:amd64:fast, cli:build:linux:amd64:fast]
    vars:
      DEB_VERSION:
        sh: 'echo "$(node -p "require(''./package.json'').version")+fast.{{.COMMIT}}"'
    env:
      VERSION: "{{.DEB_VERSION}}"
    cmds:
      - |
        export PATH="/usr/bin:$PATH"
        ./scripts/desktop/build-deb.sh amd64

  desktop:sign-release:
    desc: Sign all desktop release artefacts with Ed25519 (requires UPDATER_ED25519_PRIVATE)
    cmds:
      - ./scripts/desktop/sign-release.sh

  desktop:test:
    desc: Run desktop-only Go unit tests (build tag `desktop` excluded — just the platform-neutral subset)
    cmds:
      - go test ./cmd/iterion-desktop/...

  # --- Cloud-mode docker-compose (plan §F T-38, T-39) -------------
  cloud:up:
    desc: Bring up the cloud-mode local stack (Mongo + NATS + MinIO + iterion)
    cmds:
      - docker compose -f docker-compose.cloud.yml up -d --build

  cloud:down:
    desc: Tear down the cloud-mode stack including volumes
    cmds:
      - docker compose -f docker-compose.cloud.yml down -v

  cloud:logs:
    desc: Tail logs from every cloud-mode service
    cmds:
      - docker compose -f docker-compose.cloud.yml logs -f --tail=100

  cloud:up:deps:
    desc: Bring up only the backing services (Mongo + NATS + MinIO) without iterion
    cmds:
      - docker compose -f docker-compose.cloud.yml up -d mongo nats minio minio-init

  cloud:dev:
    desc: Hot-reload iterion in the cloud stack via watchexec rebuild + container restart
    deps: [cloud:up:deps]
    cmds:
      # Single quoted arg, not `sh -c '...'` — see studio:dev:backend note
      # (watchexec's default shell re-shells `sh -c`, losing the quoting).
      - watchexec -r -e go -w cmd -w pkg -- 'docker compose -f docker-compose.cloud.yml up -d --build iterion-server'

  # --- Helm chart targets (plan §F T-36, T-39) --------------------
  chart:sync-version:
    desc: Sync charts/iterion/Chart.yaml version + appVersion with package.json so `helm upgrade` picks up the right image tag
    cmds:
      - bash scripts/sync-chart-version.sh

  chart:check-version:
    desc: Fail if Chart.yaml version or appVersion drifts from package.json (CI gate)
    cmds:
      - |
        PKG=$(node -p "require('./package.json').version")
        CHART_VER=$(awk '/^version:/ {print $2; exit}' charts/iterion/Chart.yaml)
        CHART_APP=$(awk '/^appVersion:/ {gsub(/"/,""); print $2; exit}' charts/iterion/Chart.yaml)
        if [ "$PKG" != "$CHART_VER" ] || [ "$PKG" != "$CHART_APP" ]; then
          echo "Chart.yaml drift: version=$CHART_VER appVersion=$CHART_APP package.json=$PKG"
          echo "Run 'task chart:sync-version' to align them."
          exit 1
        fi

  chart:dep-update:
    desc: Fetch sub-chart archives declared in Chart.yaml dependencies (idempotent)
    cmds:
      - helm dependency update charts/iterion

  chart:lint:
    desc: helm lint the iterion chart against values-dev and values-prod
    deps: [chart:check-version, chart:dep-update]
    cmds:
      - helm lint charts/iterion -f charts/iterion/values-dev.yaml
      - helm lint charts/iterion -f charts/iterion/values-prod.yaml

  chart:template:
    desc: Render the chart templates with values-dev to stdout
    cmds:
      - helm template iterion charts/iterion -f charts/iterion/values-dev.yaml

  chart:package:
    desc: Package the chart into dist/ (mirrors what release.yml publishes to OCI)
    deps: [chart:check-version, chart:dep-update]
    cmds:
      - helm package charts/iterion --destination dist/

  chart:kind:
    desc: Smoke-test the chart on a kind cluster (helm install + helm test)
    deps: [chart:dep-update]
    cmds:
      - kind create cluster --name iterion-chart-test --wait 60s || true
      - helm upgrade --install iterion ./charts/iterion -f charts/iterion/values-dev.yaml --wait --timeout 5m
      - helm test iterion
      - kind delete cluster --name iterion-chart-test

  # --- Docker image plumbing (plan §F T-39) -----------------------
  docker:pin-llm-clis:
    desc: Refresh docker/llm-clis/package.json to the latest stable claude-code + codex versions
    cmds:
      - |
        CLAUDE_VERSION=$(npm view @anthropic-ai/claude-code version)
        CODEX_VERSION=$(npm view @openai/codex version)
        echo "claude=$CLAUDE_VERSION codex=$CODEX_VERSION"
        printf '{\n  "name": "iterion-llm-clis",\n  "private": true,\n  "description": "Pinned npm dependencies for the LLM CLIs baked into the iterion container image. Refresh via `task docker:pin-llm-clis` (T-39).",\n  "dependencies": {\n    "@anthropic-ai/claude-code": "%s",\n    "@openai/codex": "%s"\n  }\n}\n' "$CLAUDE_VERSION" "$CODEX_VERSION" > docker/llm-clis/package.json
        echo "Updated docker/llm-clis/package.json — review and commit."

  docker:build:
    desc: Build the iterion container image locally (tagged ghcr.io/socialgouv/iterion:dev)
    cmds:
      - docker build --build-arg VERSION={{.VERSION}} --build-arg COMMIT={{.COMMIT}} -t ghcr.io/socialgouv/iterion:dev .