Taskfile.yml

version: "3"

vars:
  SERVER_BIN: server
  CLI_BIN: trajecta
  CONFIG: '{{default "config/config.yaml" .CONFIG}}'
  VERSION:
    sh: git describe --tags --always --dirty 2>/dev/null || echo dev
  COMMIT:
    sh: git rev-parse --short=12 HEAD 2>/dev/null || echo none
  BRANCH:
    sh: git branch --show-current 2>/dev/null || git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown
  BUILD_DATE:
    sh: date -u +%Y-%m-%dT%H:%M:%SZ
  LDFLAGS: >-
    -s -w
    -X main.Version={{.VERSION}}
    -X main.Commit={{.COMMIT}}
    -X main.Date={{.BUILD_DATE}}
    -X main.Branch={{.BRANCH}}

tasks:
  default:
    cmds:
      - task: build

  ui:build:
    desc: Build embedded Trace Monitor UI
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bun run build

  ui:typecheck:
    desc: Type-check the TypeScript modules of the Monitor UI
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bun run typecheck

  ui:test:
    desc: Run type-check, unit and browser smoke tests for the Monitor UI
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bun run typecheck
      - bun run test:unit
      - bun run test:ui

  ui:test:unit:
    desc: Run the Monitor UI unit tests
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bun run test:unit

  ui:test:real:
    desc: Run browser tests against the real Go Monitor server fixture
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bun run test:ui:real

  ui:screenshots:
    desc: Regenerate the README screenshots (images/ and images/en/) from the fixture server
    dir: web/monitor-ui
    cmds:
      - bun install --frozen-lockfile
      - bunx playwright test --config playwright.screenshots.config.js

  generate:ent:
    desc: Generate ent control-plane DAO code
    cmds:
      - go generate ./ent/...

  generate:secretmask:
    desc: Regenerate the Ragel credential DFA (pkg/secretmask/rules_ragel.go) from rules.rl; requires the ragel-go binary
    cmds:
      - go generate ./pkg/secretmask/...

  migrate:ent:sqlite:
    desc: Generate a SQLite ent migration, pass NAME=change_name
    cmds:
      - >-
        sh -c 'test -n "{{.NAME}}" ||
        { echo "NAME is required, for example: task migrate:ent:sqlite NAME=add_table"; exit 2; }'
      - go run -mod=mod ent/migrate/main.go --dialect sqlite --dir ent/migrations "{{.NAME}}"
      - go run -mod=mod ent/migrate/update_hash.go ent/migrations

  migrate:ent:postgres:
    desc: Generate a Postgres ent migration, pass NAME=change_name and DEV_URL=postgres://...
    cmds:
      - >-
        sh -c 'test -n "{{.NAME}}" ||
        { echo "NAME is required, for example: task migrate:ent:postgres NAME=add_table DEV_URL=postgres://..."; exit 2; }'
      - >-
        sh -c 'test -n "{{.DEV_URL}}" ||
        { echo "DEV_URL is required and must point to a temporary development Postgres database"; exit 2; }'
      - go run -mod=mod ent/migrate/main.go --dialect postgres --dir ent/postgres-migrations --dev-url "{{.DEV_URL}}" "{{.NAME}}"
      - go run -mod=mod ent/migrate/update_hash.go ent/postgres-migrations

  fmt:
    desc: Format Go code
    cmds:
      - gofmt -w ./cmd ./internal ./pkg ./unittest ./tests ./web/monitor-ui/test-fixtures

  fmt:check:
    desc: Check Go formatting without modifying files
    cmds:
      - >-
        sh -c 'files="$(gofmt -l ./cmd ./internal ./pkg ./unittest ./tests ./web/monitor-ui/test-fixtures)";
        test -z "$files" || { echo "$files"; exit 1; }'

  lint:
    desc: Run golangci-lint static checks
    cmds:
      - golangci-lint run ./...

  lint:vet:
    desc: Run go vet directly
    cmds:
      - go vet ./...

  test:
    desc: Run unit tests
    cmds:
      - go test ./...

  test:e2e:
    desc: Run local end-to-end tests without external network dependencies
    cmds:
      - go test ./internal/proxy ./internal/monitor ./cmd/server ./cmd/trajecta ./unittest

  atif:validate:
    desc: Validate ATIF-v1.8 JSONL with pinned Harbor models (install scripts/atif-requirements.txt first)
    cmds:
      - python3 scripts/validate_atif.py {{.CLI_ARGS}}

  test:atif:
    desc: Test ATIF export and the official-model validator offline
    cmds:
      - go test ./internal/trajectory ./internal/monitor
      # Precheck the Python dependency so a missing pydantic reports an
      # actionable message instead of an opaque unittest import ERROR.
      - >-
        sh -c 'python3 -c "import pydantic" 2>/dev/null ||
        { echo "SKIP atif validator: pydantic is not installed.";
        echo "  install it with: python3 -m pip install -r scripts/atif-requirements.txt";
        exit 0; }'
      - python3 -m unittest discover -s scripts/atif_tests

  test:codex-fixtures:
    desc: Run offline Codex Responses fixture runner tests
    cmds:
      - env -u GOROOT go test ./internal/responses/httpapi ./internal/responses/runtime -count=1

  test:short:
    desc: Run unit tests without the Postgres integration paths (go test -short)
    cmds:
      - go test -short ./...

  test:race:
    desc: Run unit tests with the Go race detector
    cmds:
      - go test -race ./...

  test:cover:
    desc: Run unit tests and write coverage.out
    cmds:
      - go test -coverprofile=coverage.out ./...

  bench:
    desc: Run all Go benchmarks with allocation stats
    cmds:
      - go test -bench=. -benchmem ./...

  bench:core:
    desc: Run benchmarks for core proxy, record/replay, router, store, secretmask, and LLM packages
    cmds:
      - go test -bench=. -benchmem ./internal/proxy ./internal/router ./internal/store ./pkg/llm ./pkg/recordfile ./pkg/replay ./pkg/secretmask

  bench:secretmask:
    desc: Run credential/PII detection, masking and restore benchmarks
    cmds:
      - go test -count=1 -run '^$' -bench=. -benchmem ./pkg/secretmask

  deps:verify:
    desc: Verify module dependencies without editing go.mod or go.sum
    cmds:
      - go mod verify
      - go list -mod=readonly ./...

  deps:tidy:
    desc: Tidy Go module files
    cmds:
      - go mod tidy

  build:go:
    desc: Build the server and CLI binaries without rebuilding the UI
    cmds:
      - go build -trimpath -ldflags="{{.LDFLAGS}}" -o {{.SERVER_BIN}} ./cmd/server
      - go build -trimpath -ldflags="{{.LDFLAGS}}" -o {{.CLI_BIN}} ./cmd/trajecta

  build:all:
    desc: Build embedded UI and server binary
    cmds:
      - task: ui:build
      - task: build:go

  build:
    desc: Build server binary and embedded UI
    cmds:
      - task: build:all

  migrate:
    desc: Rewrite legacy V2 cassettes to V3 and rebuild SQLite index
    cmds:
      - go run ./cmd/trajecta migrate -c {{.CONFIG}}

  migrate:db:up:
    desc: Apply application database migrations
    cmds:
      - go run ./cmd/trajecta db migrate up -c {{.CONFIG}}

  migrate:legacy:
    desc: Inspect a pre-rename deployment; pass ARGS="--apply" to write changes
    cmds:
      - go run ./cmd/trajecta upgrade -c {{.CONFIG}} {{default "" .ARGS}}

  auth:init-user:
    desc: Initialize an auth user, pass USER and PASSWORD
    cmds:
      - go run ./cmd/trajecta auth init-user -c {{.CONFIG}} --username "{{.USER}}" --password "{{.PASSWORD}}"

  auth:create-token:
    desc: Create an API token for a user, pass USER and NAME
    cmds:
      - go run ./cmd/trajecta auth create-token -c {{.CONFIG}} --username "{{.USER}}" --name "{{.NAME}}"

  run:
    desc: Start proxy and monitor with local config
    cmds:
      - go run ./cmd/server -c {{.CONFIG}}

  docker:build:
    desc: Build Docker image
    cmds:
      - >-
        eval "$(./scripts/docker-build-env.sh)" &&
        docker build
        --add-host host.docker.internal:host-gateway
        --build-arg GOPROXY="${DOCKER_BUILD_GOPROXY}"
        --build-arg GOSUMDB="${DOCKER_BUILD_GOSUMDB}"
        --build-arg HTTP_PROXY="${DOCKER_BUILD_HTTP_PROXY}"
        --build-arg HTTPS_PROXY="${DOCKER_BUILD_HTTPS_PROXY}"
        --build-arg NO_PROXY="${DOCKER_BUILD_NO_PROXY}"
        --build-arg http_proxy="${DOCKER_BUILD_http_proxy}"
        --build-arg https_proxy="${DOCKER_BUILD_https_proxy}"
        --build-arg no_proxy="${DOCKER_BUILD_no_proxy}"
        --build-arg VERSION="{{.VERSION}}"
        --build-arg COMMIT="{{.COMMIT}}"
        --build-arg BUILD_DATE="{{.BUILD_DATE}}"
        --build-arg BRANCH="{{.BRANCH}}"
        -t trajecta:local
        .

  docker:up:
    desc: Start trajecta with docker compose
    cmds:
      - >-
        eval "$(./scripts/docker-build-env.sh)" &&
        export DOCKER_BUILD_GOPROXY DOCKER_BUILD_GOSUMDB
        DOCKER_BUILD_HTTP_PROXY DOCKER_BUILD_HTTPS_PROXY DOCKER_BUILD_NO_PROXY
        DOCKER_BUILD_http_proxy DOCKER_BUILD_https_proxy DOCKER_BUILD_no_proxy &&
        docker compose -f docker-compose.yml -f docker-compose.dev.yml up --build -d

  check:
    desc: Run the default local quality gate
    cmds:
      - task: check:quick

  check:quick:
    desc: Run formatting check, lint, and short tests
    cmds:
      - task: fmt:check
      - task: lint
      - task: test:short

  check:full:
    desc: Run full validation including race tests and full build
    cmds:
      - task: check:quick
      - task: test
      - task: test:e2e
      - task: test:race
      - task: build:all

  clean:
    desc: Remove local build artifacts
    cmds:
      - rm -f {{.SERVER_BIN}} {{.CLI_BIN}}