# Makefile for Agent-CLI / bridge-cli.
#
# `make build`          — production binary only (testkit-free).
# `make build-dev`      — production + bridge-cli-test.
# `make install`        — install production binary to ~/.local/bin/bridge-cli.
# `make install-dev`    — install production + testkit runner (as bridge-cli-uat).
# `make test`           — Go unit tests.
# `make uat`            — run every bundled UAT scenario via bridge-cli-test.
# `make verify-prod`    — fail-loud check that the production binary has
#                         no testkit symbols + no testkit imports.
# `make verify-install` — check ~/.local/bin install layout (see docs/TEST-RIG.md).
.PHONY: build build-dev install install-dev test uat clean verify-prod verify-install

build:
	go build -o bridge-cli ./cmd/bridge-cli
	codesign --sign - --force bridge-cli

build-dev: build
	go build -o bridge-cli-test ./cmd/bridge-cli-test
	codesign --sign - --force bridge-cli-test

install: build
	# `install -m 0755` (not cp) — macOS 26.1 gatekeeper kills binaries
	# whose ad-hoc codesignature was invalidated by a cp-style copy
	# (see 4d70ed6). `install` does an atomic rename + permission set
	# that preserves the codesign segment laid down by `codesign --sign -`
	# above. Same rule applies to install-dev.
	install -m 0755 bridge-cli ~/.local/bin/bridge-cli

install-dev: build-dev
	# Installs prod binary as bridge-cli and the testkit runner as
	# bridge-cli-uat. bridge-cli-test at ~/.local/bin is a shell wrapper
	# (wss://localhost:9766 + cli-test identity) — do NOT clobber it.
	# See docs/TEST-RIG.md for the canonical install layout.
	install -m 0755 bridge-cli ~/.local/bin/bridge-cli
	install -m 0755 bridge-cli-test ~/.local/bin/bridge-cli-uat

test:
	go test ./...

uat: build-dev
	./bridge-cli-test run --all

verify-prod: build
	@echo "checking production binary import graph for testkit..."
	@if go list -deps ./cmd/bridge-cli | grep -q testkit; then \
	  echo "FAIL: bridge-cli imports testkit"; exit 1; \
	fi
	@echo "checking production binary import graph for mcp/jsonrpc..."
	@# Iter 8c assertion: production binary must not pull in any MCP
	@# server or JSON-RPC code. internal/p2ptb/* is allowed (it's the
	@# real bridge protocol, not MCP).
	@bad=$$(go list -deps ./cmd/bridge-cli | grep -E "testkit|mcp|jsonrpc" | grep -v "internal/p2ptb" || true); \
	if [ -n "$$bad" ]; then \
	  echo "FAIL: bridge-cli imports testkit/mcp/jsonrpc:"; \
	  echo "$$bad"; \
	  exit 1; \
	fi
	@echo "checking production binary symbol table for testkit..."
	@if nm bridge-cli 2>/dev/null | grep -qi testkit; then \
	  echo "FAIL: bridge-cli has testkit symbols"; exit 1; \
	fi
	@echo "checking production binary symbol table for MCP SDK..."
	@if nm bridge-cli 2>/dev/null | grep -qi "modelcontextprotocol"; then \
	  echo "FAIL: bridge-cli has MCP SDK symbols"; exit 1; \
	fi
	@echo "ok — bridge-cli is testkit-free and mcp-free"

verify-install:
	@echo "checking install layout..."
	@if [ ! -f ~/.local/bin/bridge-cli ]; then \
	  echo "FAIL: ~/.local/bin/bridge-cli not found — run make install"; exit 1; \
	fi
	@if file ~/.local/bin/bridge-cli | grep -q "shell script"; then \
	  echo "FAIL: ~/.local/bin/bridge-cli is a shell script — should be a Go binary"; exit 1; \
	fi
	@if [ -f ~/.local/bin/bridge-cli-test ] && ! file ~/.local/bin/bridge-cli-test | grep -q "shell script"; then \
	  echo "FAIL: ~/.local/bin/bridge-cli-test is not the expected shell wrapper — it may have been clobbered by make install-dev; restore from git or rebuild"; exit 1; \
	fi
	@echo "ok — install layout is correct"

clean:
	rm -f bridge-cli bridge-cli-test
