tasks.toml

# grouped tasks

["setup"]
depends = ["*:setup"]

["check"]
depends = ["*:check"]

["fix"]
depends = ["*:fix"]

["test"]
depends = ["*:test"]

# git hooks

["git-hooks:pre-commit"]
hide = true
depends = ["check"]

["git-hooks:commit-msg"]
hide = true
dir = "{{config_root}}"
usage = 'arg "<commit_msg_file>"'
run = '''
#!/usr/bin/env bash
set -euo pipefail

COMMIT_MSG_FILE="{{arg(name="commit_msg_file")}}"
TEMP_FILE=$(mktemp)
trap 'rm -f "$TEMP_FILE"' EXIT

HAS_AI_TRAILER=false
if grep -qi -E '^Co-authored-by:.*(Claude|Cursor|anthropic|cursor)' "$COMMIT_MSG_FILE"; then
  HAS_AI_TRAILER=true
fi

grep -viE -e '^Co-authored-by:.*(Claude|Cursor|anthropic|cursor)' -e '^Made-with:' "$COMMIT_MSG_FILE" > "$TEMP_FILE" || true

awk '/^[[:space:]]*$/{buf=buf $0 ORS; next} {if(buf) printf "%s",buf; buf=""; print}' "$TEMP_FILE" > "$COMMIT_MSG_FILE"

if [ "$HAS_AI_TRAILER" = true ]; then
  echo "" >> "$COMMIT_MSG_FILE"
  echo "Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>" >> "$COMMIT_MSG_FILE"
fi
'''

# common tasks

## setup

["common:setup"]
depends = ["common:setup:*"]

["common:setup:git-hooks"]
hide = true
dir = "{{config_root}}"
run = """
#!/bin/bash
test ! -d .git && exit 0
cat >.git/hooks/pre-commit <<'HOOK'
#!/bin/sh
mise run git-hooks:pre-commit
HOOK
chmod +x .git/hooks/pre-commit
cat >.git/hooks/commit-msg <<'HOOK'
#!/bin/sh
mise run git-hooks:commit-msg -- "$1"
HOOK
chmod +x .git/hooks/commit-msg
"""
sources = [".git/hooks/pre-commit", ".git/hooks/commit-msg"]

["common:setup:pnpm"]
hide = true
dir = "{{config_root}}"
run = "pnpm install"
sources = [
  "pnpm-lock.yaml",
  "pnpm-workspace.yaml",
  "apps/*/package.json",
  "docs/package.json",
  "agents/*/*/package.json",
]

## check

["common:check"]
depends = ["common:check:*"]

["common:check:license"]
dir = "{{config_root}}"
run = "addlicense -check -l apache -s=only -c '© IBM Corp.' $(fd '\\.(py|[jt]sx?|html|s?css)$')"

["common:check:version"]
dir = "{{config_root}}"
run = '''
#!/usr/bin/env bash
set -euo pipefail
version=$(
  {
    yq -r .version              helm/Chart.yaml
    yq -r .appVersion           helm/Chart.yaml
    yq -r .project.version      apps/adk-cli/pyproject.toml
    yq -r .project.version      apps/adk-py/pyproject.toml
    yq -r .version              apps/adk-ts/package.json
    yq -r .project.version      apps/adk-server/pyproject.toml
    yq -r .version              apps/adk-ui/package.json
  } | sort -u
)
if [[ $(wc -l <<<"$version") -ne 1 ]]; then echo "ERROR: Version mismatch detected: $(echo $version)" >&2; exit 1; fi
if ! [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$ ]]; then echo "ERROR: $version is not valid semver (X.Y.Z or X.Y.Z-rcN)" >&2; exit 1; fi
if [[ "${GITHUB_REF:-}" == refs/tags/* ]] && [[ $GITHUB_REF != "refs/tags/v$version" ]]; then echo "ERROR: GITHUB_REF '$GITHUB_REF' does not match 'refs/tags/v$version'" >&2; exit 1; fi
'''

## fix

["common:fix"]
depends = ["common:fix:*"]

["common:fix:license"]
dir = "{{config_root}}"
run = "addlicense -l apache -s=only -c '© IBM Corp.' $(fd '\\.(py|[jt]sx?|html|s?css)$')"

## test

["common:test"]
run = "true" # Empty tests in case there are no tests

# platform tasks

["adk:start"]
depends = [
  "adk-server:build",
  "agents:adk-support-agent:build",
  "microshift-vm:build",
]
raw = true
dir = "{{config_root}}"
run = """
#!/bin/bash
set -euxo pipefail

if [[ ! "$*" =~ 'ui.enabled=false' ]]; then
    {{ mise_bin }} run adk-ui:build
    UI_TAG="--set kagenti-adk:ui.image.tag=local"
fi

if [[ -f /etc/adk ]]; then
  PULL_MODE="skip"
elif [[ -n "${CI-}" ]]; then
  PULL_MODE="hybrid"
elif [[ -n "${SKIP_PULL-}" ]]; then
  PULL_MODE="skip"
else
  PULL_MODE="host"
fi

if [[ ! -f /etc/adk ]]; then
  ARCH=$(uname -m | sed -e 's/arm64/aarch64/' -e 's/amd64/x86_64/')
  LIMA_IMAGE_FLAG="--lima-image={{config_root}}/apps/microshift-vm/dist/$ARCH/microshift-vm-$ARCH.qcow2"
fi

{{ mise_bin }} run adk-cli:run -- platform start -v \
    ${LIMA_IMAGE_FLAG-} \
    --image-pull-mode="$PULL_MODE" \
    --set kagenti-adk:auth.nextauthDevUrl="http://localhost:3000" \
    --set kagenti-adk:server.image.tag=local \
    --set kagenti-adk:exampleAgent.image.tag=local \
    ${UI_TAG-} "$@"
"""

["adk:delete"]
run = "{{ mise_bin }} run adk-cli:run -- platform delete"

["adk:stop"]
run = "{{ mise_bin }} run adk-cli:run -- platform stop"

["adk:stop-all"]
usage = 'flag "--except <except>" default=""'
run = """
#!/bin/bash
# Stop all lima VMs

EXCEPT="${usage_except?}"

{% raw %}
TO_STOP="$(LIMA_HOME=~/.kagenti/adk/lima limactl list -f '{{.Name}};{{.Status}}' | grep -v "Stopped" | cut -d';' -f1 2>/dev/null | sed '/^[^a-z]*$/d' | sed "/^$EXCEPT$/d")"
{% endraw %}

{% raw %}
echo "$TO_STOP" | xargs -rn 1 -I"{}" mise run adk-cli:run -- platform stop --vm-name="{}"
{% endraw %}
"""

["adk:shell"]
raw = true
dir = "{{cwd}}"
usage = 'flag "--vm-name <vm_name>" default="kagenti-adk"'
run = """
cat <<EOF
deactivate () {
  export PS1="\\${__OLD_PS1:-}"

  # Restore LIMA_HOME to its original state (set or unset)
  [[ -n "\\${__OLD_LIMA_HOME:-}" ]] && export LIMA_HOME="\\$__OLD_LIMA_HOME" || unset LIMA_HOME
  [[ -n "\\${__OLD_KUBECONFIG:-}" ]] && export KUBECONFIG="\\$__OLD_KUBECONFIG" || unset KUBECONFIG
  [[ -n "\\${__OLD_ADMIN_PASSWORD:-}" ]] && export KAGENTI_ADK_ADMIN_PASSWORD="\\$__OLD_ADMIN_PASSWORD" || unset KAGENTI_ADK_ADMIN_PASSWORD

  # Clean up the backup values
  unset __OLD_PS1
  unset __OLD_LIMA_HOME
  unset __OLD_KUBECONFIG
  unset __OLD_ADMIN_PASSWORD
  unset -f deactivate
  echo "Environment for '${usage_vm_name?}' deactivated."
}

while [[ -n "\\${__OLD_PS1:-}" ]]; do
  deactivate;
done

echo "Activating environment for '${usage_vm_name?}'..."

export __OLD_PS1="\\${PS1:-}"
export __OLD_LIMA_HOME="\\${LIMA_HOME:-}"
export __OLD_KUBECONFIG="\\${KUBECONFIG:-}"

export KUBECONFIG="\\${KAGENTI_ADK_HOME:-\\${HOME}/.kagenti/adk}/lima/${usage_vm_name?}/copied-from-guest/kubeconfig.yaml"
export LIMA_HOME=\\${KAGENTI_ADK_HOME:-\\${HOME}/.kagenti/adk}/lima
export PS1="(${usage_vm_name?}) \\${__OLD_PS1}"
EOF
"""

# dev environment tasks

["dev:status"]
description = "Show development environment status"
dir = "{{config_root}}"
run = """
#!/bin/bash
set -uo pipefail

# Get dev shell env (sets KUBECONFIG, LIMA_HOME for kubectl/telepresence)
if eval "$({{ mise_bin }} run adk-server:dev:shell 2>/dev/null)" 2>/dev/null && \
   kubectl get nodes --no-headers --request-timeout=5s >/dev/null 2>&1; then
  echo "cluster:         running"
else
  echo "cluster:         not available (run 'mise run dev:ensure' to start)"
  echo "telepresence:    n/a"
  echo "server:          n/a"
  echo "port-forward:    n/a"
  echo "ui-dev-server:   n/a"
  exit 0
fi

# Telepresence status
if telepresence list --replacements 2>/dev/null | grep -q adk-server; then
  echo "telepresence:    connected (replacing adk-server)"
else
  echo "telepresence:    not connected"
fi

# Server healthcheck
if curl -sf localhost:18333/healthcheck >/dev/null 2>&1; then
  echo "server:          healthy (localhost:18333)"
else
  echo "server:          not responding"
fi

# Port forwards
PG_STATUS="not active"
REDIS_STATUS="not active"
if lsof -i :5432 -sTCP:LISTEN >/dev/null 2>&1; then PG_STATUS="ok"; fi
if lsof -i :6379 -sTCP:LISTEN >/dev/null 2>&1; then REDIS_STATUS="ok"; fi
echo "port-forward:    postgres:5432 $PG_STATUS  redis:6379 $REDIS_STATUS"

# UI dev server
if curl -sf localhost:3000 >/dev/null 2>&1; then
  echo "ui-dev-server:   running (localhost:3000)"
else
  echo "ui-dev-server:   not running"
fi
"""

["dev:ensure"]
description = """Ensure development environment is running (idempotent).
Starts platform with static UI (same as adk:start default).
Use --with-ui to also start a local dev server on :3000 with hot-reload for UI development."""
dir = "{{config_root}}"
raw = true
usage = '''
flag "--with-ui"
arg "[cli_args]..."
'''
run = """
#!/bin/bash
set -euo pipefail

LOG_DIR="${KAGENTI_ADK_HOME:-${HOME}/.kagenti/adk}/logs"
WITH_UI="${usage_with_ui:-false}"
eval "cli_args=(${usage_cli_args})"

log_ok()       { echo "[ok]       $1"; }
log_starting() { echo "[starting] $1"; }
log_error()    { echo "[error]    $1" >&2; exit 1; }

# ── Step 1: Platform + telepresence ──────────────────────────────────────────
# Set shell env if available (needed for telepresence check)
eval "$({{ mise_bin }} run adk-server:dev:shell 2>/dev/null)" 2>/dev/null || true

if telepresence list --replacements 2>/dev/null | grep -q adk-server; then
  log_ok "Platform and telepresence running"
else
  log_starting "Starting platform with telepresence (adk-server:dev:start)..."
  SKIP_PULL=true {{ mise_bin }} run adk-server:dev:start "${cli_args[@]}"
  # Re-source shell env after start
  eval "$({{ mise_bin }} run adk-server:dev:shell)"
  log_ok "Platform and telepresence started"
fi

# ── Step 2: Local server ────────────────────────────────────────────────────
if curl -sf localhost:18333/healthcheck >/dev/null 2>&1; then
  log_ok "Server healthy (localhost:18333)"
else
  log_starting "Starting adk-server in background..."
  mkdir -p "$LOG_DIR"
  nohup {{ mise_bin }} run adk-server:run >> "$LOG_DIR/adk-server.log" 2>&1 &

  TIMEOUT=60
  for i in $(seq 1 $TIMEOUT); do
    if curl -sf localhost:18333/healthcheck >/dev/null 2>&1; then
      log_ok "Server healthy (localhost:18333)"
      break
    fi
    if [[ $i -eq $TIMEOUT ]]; then
      log_error "Server failed to start within ${TIMEOUT}s. Check $LOG_DIR/adk-server.log"
    fi
    sleep 1
  done
fi

# ── Step 3: Local UI dev server with hot-reload (optional) ───────────────────
if [[ "$WITH_UI" == "true" ]]; then
  if curl -sf localhost:3000 >/dev/null 2>&1; then
    log_ok "UI dev server running (localhost:3000)"
  else
    log_starting "Starting UI dev server in background..."
    mkdir -p "$LOG_DIR"
    nohup {{ mise_bin }} run adk-ui:run:dev >> "$LOG_DIR/adk-ui.log" 2>&1 &

    TIMEOUT=60
    for i in $(seq 1 $TIMEOUT); do
      if curl -sf localhost:3000 >/dev/null 2>&1; then
        log_ok "UI dev server running (localhost:3000)"
        break
      fi
      if [[ $i -eq $TIMEOUT ]]; then
        log_error "UI dev server failed to start within ${TIMEOUT}s. Check $LOG_DIR/adk-ui.log"
      fi
      sleep 1
    done
  fi
fi

echo ""
echo "Dev environment ready."
"""

["dev:stop"]
description = "Stop dev environment (local processes + telepresence + VM)"
dir = "{{config_root}}"
run = """
#!/bin/bash
# Kill local background processes started by dev:ensure
for port in 18333 3000 5432 6379 4318; do
  lsof -ti :$port | xargs kill 2>/dev/null || true
done
# Delegate the rest (telepresence + VM) to adk-server:dev:stop
{{ mise_bin }} run adk-server:dev:stop 2>/dev/null || true
"""

# release tasks

["release:set-version"]
description = "Update version fields in the current branch in all the relevant places and commit"
usage = '''
arg "<version>" help="The new version to set (format: X.Y.Z or X.Y.Z-rcW)"
'''
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

if ! [[ "$usage_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-rc[0-9]+)?$ ]]; then
  echo "ERROR: Invalid version format: $usage_version"
  echo "Expected format: X.Y.Z or X.Y.Z-rcW (e.g., 1.2.3 or 1.2.3-rc1)"
  exit 1
fi

set -x
yq -i ".version = \"$usage_version\"" helm/Chart.yaml
yq -i ".appVersion = \"$usage_version\"" helm/Chart.yaml
for pyproject in apps/adk-py/pyproject.toml $(fd -t f -g pyproject.toml apps agents); do
  toml set project.version "$usage_version" --toml-path "$pyproject"
  (cd "$(dirname "$pyproject")" && uv lock)
done
for pkg in $(fd -t f -g package.json apps agents); do
  yq -i ".version = \"$usage_version\"" "$pkg"
done
git add .
git commit --signoff --no-verify -m "bump: v$usage_version"
set +x

echo -e "✅ Pending version in \x1b[36m$(git branch --show-current)\x1b[0m bumped to $usage_version"
'''

["release:new"]
description = "Open a new release by creating a release branch from current main"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

set -x
git checkout main
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
if ! [[ "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
  echo "ERROR: Invalid version format: $current_version. Expected format: X.Y.Z"
  exit 1
fi
next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((${BASH_REMATCH[3]} + 1))"
release_branch="release-v$current_version"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Nothing will be published yet."
echo -e "  - Tip of the \x1b[36mmain\x1b[0m branch will be prepared for release $current_version in \x1b[36m$release_branch\x1b[0m branch."
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m will be bumped to ${current_version}-rc1."
echo -e "  - Pending version in \x1b[36mmain\x1b[0m branch will be bumped to $next_version. (This can be bumped more if the next release needs to be minor/major.)"
echo -e "💡 Want to release a different version than $current_version? Cancel, run \x1b[36mmise release:set-version <version>\x1b[0m on the \x1b[36mmain\x1b[0m branch and then re-run this task."
gum confirm "Proceed?"

set -x
git checkout -B $release_branch origin/main
{{ mise_bin }} release:set-version "${current_version}-rc1"
git push --set-upstream origin $release_branch
set +x
echo -e "✅ \x1b[36m$release_branch\x1b[0m branch with pending version ${current_version}-rc1 created."

set -x
git checkout main
{{ mise_bin }} release:set-version "$next_version"
git push
set +x
echo -e "✅ \x1b[36mmain\x1b[0m pending version bumped to $next_version."

git checkout $release_branch

echo -e "💡 Now you can use \x1b[36mmise release:publish-rc\x1b[0m to publish a release candidate ${current_version}-rc1, or \x1b[36mmise release:publish-stable\x1b[0m to publish stable $current_version."
'''

["release:publish-rc"]
description = "Publish the current release branch as a release candidate"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

release_branch="$(git branch --show-current)"
if [[ "$release_branch" != "release-v"* ]]; then
  echo "ERROR: Not on a 'release-v*' branch"
  exit 1
fi

set -x
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
if ! [[ "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)-rc([0-9]+)$ ]]; then
  echo "ERROR: Current version must be an RC version (X.Y.Z-rcN)"
  echo "Current version: $current_version"
  exit 1
fi

next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.${BASH_REMATCH[3]}-rc$((${BASH_REMATCH[4]} + 1))"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Tip of the \x1b[36m$release_branch\x1b[0m branch will be tagged \x1b[36mv$current_version\x1b[0m and pushed to GitHub."
echo -e "  - GitHub Action triggered by the tag will publish a release candidate \x1b[36m$current_version\x1b[0m."
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m branch will be bumped to \x1b[36m$next_version\x1b[0m."
echo -e "  - \x1b[36minstall.sh\x1b[0m on the \x1b[36mmain\x1b[0m branch will be updated to install \x1b[36m$current_version\x1b[0m when set to prerelease mode."
gum confirm "Proceed?"

set -x
git tag "v$current_version"
git push --atomic origin $release_branch "v$current_version"
set +x
echo -e "✅ Pushed tag $current_version to \x1b[36morigin/$release_branch\x1b[0m"

{{ mise_bin }} release:set-version "$next_version"
git push

set -x
git checkout main
git pull
perl -pi -e "s/^(LATEST_KAGENTI_ADK_VERSION=).*/\${1}$current_version/" install.sh
git add install.sh
git commit --signoff --no-verify -m "chore: update install.sh prerelease version to v$current_version"
git push
set +x
echo -e "✅ Updated \x1b[36minstall.sh\x1b[0m on \x1b[36mmain\x1b[0m to install $current_version when set to prerelease mode"

git checkout $release_branch

echo -e "💡 Check the pipeline progress and result on: https://github.com/kagenti/adk/actions/workflows/release.yaml"
'''

["release:publish-stable"]
description = "Publish the current release branch as a stable release"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

if [[ -n "$(git status --porcelain)" ]]; then
  echo "ERROR: Working directory not clean"
  exit 1
fi

release_branch="$(git branch --show-current)"
if [[ "$release_branch" != "release-v"* ]]; then
  echo "ERROR: Not on a 'release-v*' branch"
  exit 1
fi

set -x
git pull
set +x

current_version=$(yq -r '.version' helm/Chart.yaml)
publish_version="${current_version%-rc*}"

echo ""
echo "⚠️  What will happen:"
echo -e "  - Pending version in \x1b[36m$release_branch\x1b[0m branch will be bumped to \x1b[36m$publish_version\x1b[0m."
echo -e "  - Tip of the \x1b[36m$release_branch\x1b[0m branch will be tagged \x1b[36mv$publish_version\x1b[0m and pushed to GitHub."
echo -e "  - GitHub Action triggered by the tag will publish a stable release \x1b[36m$publish_version\x1b[0m."
echo -e "  - \x1b[36mdocs/development\x1b[0m on the \x1b[36m$release_branch\x1b[0m branch will become \x1b[36mdocs/stable\x1b[0m on the \x1b[36mmain\x1b[0m branch."
echo -e "  - \x1b[36minstall.sh\x1b[0m on the \x1b[36mmain\x1b[0m branch will be updated to install \x1b[36m$publish_version\x1b[0m by default."
gum confirm "Proceed?"

{{ mise_bin }} release:set-version "$publish_version"

set -x
git tag "v$publish_version"
git push --atomic origin $release_branch "v$publish_version"
set +x
echo -e "✅ Pushed tag $publish_version to \x1b[36morigin/$release_branch\x1b[0m"

set -x
git checkout main
git pull
perl -pi -e "s/^(LATEST_KAGENTI_ADK_VERSION=).*/\${1}$publish_version/" install.sh
perl -pi -e "s/^(LATEST_STABLE_KAGENTI_ADK_VERSION=).*/\${1}$publish_version/" install.sh
git add install.sh
git commit --signoff --no-verify -m "chore: update install.sh version to v$publish_version"
git push
set +x
echo -e "✅ Updated \x1b[36minstall.sh\x1b[0m on \x1b[36mmain\x1b[0m to install \x1b[36m$publish_version\x1b[0m by default"

set -x
rm -rf docs/stable docs/development
git restore --source=$release_branch docs/development
mv docs/development docs/stable
git restore --source=main docs/development
find docs/stable -type f \( -name "*.md" -o -name "*.mdx" \) -exec perl -pi -e 's|/development/|/stable/|g' {} +
git show $release_branch:docs/docs.json | \
jq '
  (.navigation.versions[]
   | select(.version == "development")
   | .version = "stable"
   | .groups[] |= (
       if has("pages") then
         .pages |= map(
           if type == "string" then
             sub("^development/"; "stable/")
           elif type == "object" then
             if has("pages") then
               .pages |= map(sub("^development/"; "stable/"))
             else
               . |= with_entries(if .value | type == "string" then .value |= sub("^development/"; "stable/") else . end)
             end
           else
             .
           end
         )
       else
         . |= with_entries(if .value | type == "string" then .value |= sub("^development/"; "stable/") else . end)
       end
     )
  )
' > .new-stable.json
jq --slurpfile new_stable .new-stable.json \
  '.navigation.versions = $new_stable + (.navigation.versions | map(select(.version != "stable")))' \
  docs/docs.json > docs.json.tmp && mv docs.json.tmp docs/docs.json
rm .new-stable.json
git add docs/stable docs/docs.json
git commit --signoff --no-verify -m "docs: publish stable docs for v$publish_version"
git push origin main
set +x
echo -e "✅ Published \x1b[36mstable\x1b[0m docs for \x1b[36mv$publish_version\x1b[0m"

echo "💡 Check the pipeline progress and result on: https://github.com/kagenti/adk/actions/workflows/release.yaml"
'''

["release:checkout"]
description = "Checkout the latest release branch"
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

git fetch origin --tags --quiet

branch=$(git branch -r --sort=-version:refname --format "%(refname:short)" | grep 'origin/release-v' | head -n1 | sed 's|origin/||')

if git rev-parse "${branch/release//}" >/dev/null 2>&1; then
  echo "⚠️  Latest release v$branch already finalized!"
fi

git checkout "$branch"
'''

["release:status"]
description = "Show current release status and latest remote release information"
depends = ["common:check:version"]
dir = "{{config_root}}"
run = '''
#!/bin/bash
set -eu -o pipefail

git fetch origin --tags --quiet

echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Latest release branch:  $(git branch -r --sort=-version:refname --format "%(refname:short)" | grep 'origin/release-v' | head -n1 | sed 's|origin/||')"
echo "Latest released tag:    $(git ls-remote --tags origin 'v*' | grep -o 'refs/tags/v[0-9]*\.[0-9]*\.[0-9]*\(-rc[0-9]*\)\?$' | sed 's|refs/tags/||' | sort -V | tail -n 1)"
echo "CI status:              https://github.com/kagenti/adk/actions/workflows/release.yml"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
'''

["example:create"]
description = "Create a new example from template"
dir = "{{config_root}}"
usage = '''
arg "<path>" help="Path relative to examples/ (e.g., agent-integration/multi-turn/basic-history)"
arg "<description>" help="Short description of the example"
'''
run = "examples/create-example.sh {{arg(name=\"path\")}} {{arg(name=\"description\")}}"

# please

["please"]
dir = "{{config_root}}"
run = """
#!/bin/bash
set -eu -o pipefail
{{mise_bin}} uninstall --all
rm -rf **/.venv **/node_modules **/.next
MISE_STATE_DIR="${MISE_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/mise}"
for d in "task-sources" "task-auto-outputs"; do
  rm -rf "$MISE_STATE_DIR/$d" && mkdir -p "$MISE_STATE_DIR/$d"
done
brew upgrade mise || mise self-update || true
{{mise_bin}} install
{{mise_bin}} run --force setup ::: check
"""

# misc tasks

["yolobox"]
dir = "{{ config_root }}"
depends = ["microshift-vm:build"]
usage = 'arg "[name]"'
run = '''
#!/usr/bin/env bash
set -euxo pipefail
VM_NAME="yolobox${usage_name:+-$usage_name}"

cleanup() {
  limactl stop -f "$VM_NAME" || true
  git remote remove "$VM_NAME" 2>/dev/null || true
  perl -i -ne "print unless m|\QInclude ${LIMA_HOME:-$HOME/.lima}/$VM_NAME/ssh.config\E|" "$HOME/.ssh/config" || true
  rm -f "$LIMA_YAML"
}
trap cleanup EXIT

ARCH=$(uname -m | sed -e 's/arm64/aarch64/;s/amd64/x86_64/')
LIMA_YAML=$(mktemp)
cat >"$LIMA_YAML" <<YAML
images:
  - location: "{{config_root}}/apps/microshift-vm/dist/$ARCH/microshift-vm-$ARCH.qcow2"
    arch: "$ARCH"
memory: 8GiB
cpus: 4
plain: true
YAML

mkdir -p "$HOME/.ssh"
grep -qF "Include ${LIMA_HOME:-$HOME/.lima}/$VM_NAME/ssh.config" "$HOME/.ssh/config" 2>/dev/null \
  || printf "\nInclude ${LIMA_HOME:-$HOME/.lima}/$VM_NAME/ssh.config" >> "$HOME/.ssh/config"

if limactl create "$LIMA_YAML" --yes --name "$VM_NAME"; then
  limactl start "$VM_NAME"
  limactl shell "$VM_NAME" bash -c "
    set -euxo pipefail

    # Git
    sudo mkdir -p /git/adk
    sudo chown \$(id -u):\$(id -g) /git/adk
    cd /git/adk
    git init --initial-branch=\"$(git branch --show-current)\"
    git config receive.denyCurrentBranch updateInstead
    git config user.name \"$(git config user.name)\"
    git config user.email \"$(git config user.email)\"

    # Mise
    curl https://mise.run | sh
    eval \"\$(\$HOME/.local/bin/mise activate bash)\"
    echo 'eval \"\$(\$HOME/.local/bin/mise activate bash)\"' >> \$HOME/.bashrc
  "
else
  limactl start "$VM_NAME"
fi
git remote add "$VM_NAME" "ssh://lima-$VM_NAME:/git/adk" || true
git push "$VM_NAME" $(git branch --show-current):$(git branch --show-current) || true
limactl shell "$VM_NAME" bash -c "
  set -euxo pipefail
  export GITHUB_TOKEN="${GITHUB_TOKEN:-$(gh auth token || true)}"
  cd /git/adk
  mise trust
  mise install
"
code --new-window --wait --folder-uri "vscode-remote://ssh-remote+lima-$VM_NAME/git/adk"
'''

# security

["security:dependabot:alerts"]
dir = "{{config_root}}"
run = '''
#!/usr/bin/env bash
set -euo pipefail

gh api repos/kagenti/adk/dependabot/alerts --paginate 2>&1 | uv run python3 -c "
import json, sys
data = []
for line in sys.stdin:
    line = line.strip()
    if line:
        try:
            parsed = json.loads(line)
            if isinstance(parsed, list):
                data.extend(parsed)
            else:
                data.append(parsed)
        except Exception:
            pass

open_alerts = [a for a in data if a.get('state') == 'open']
open_alerts.sort(key=lambda x: x.get('security_advisory', {}).get('cvss', {}).get('score', 0), reverse=True)

print(f'Open Dependabot security alerts: {len(open_alerts)}')

for a in open_alerts:
    adv = a.get('security_advisory', {})
    vuln = a.get('security_vulnerability', {})
    dep = a.get('dependency', {})
    score = adv.get('cvss', {}).get('score', 'N/A')
    severity = adv.get('severity', 'N/A').upper()
    pkg = dep.get('package', {}).get('name', 'N/A')
    ecosystem = dep.get('package', {}).get('ecosystem', 'N/A')
    relationship = dep.get('relationship', 'N/A')
    manifest = dep.get('manifest_path', 'N/A')
    fix = vuln.get('first_patched_version', {})
    fix_ver = fix.get('identifier', 'none') if fix else 'none'
    vuln_range = vuln.get('vulnerable_version_range', 'N/A')
    cve = adv.get('cve_id', 'N/A')
    ghsa = adv.get('ghsa_id', 'N/A')
    cwes = adv.get('cwes', [])
    cwe_str = ', '.join(c['cwe_id'] + ' \u2014 ' + c['name'] for c in cwes)
    created = a.get('created_at', '')[:10]
    summary = adv.get('summary', '')
    description = adv.get('description', '').strip()

    print()
    print(f'---')
    print(f'Alert #{a[\"number\"]}: {pkg} \u2014 {summary}')
    print()
    print(f'- URL: {a[\"html_url\"]}')
    print(f'- Severity: {severity} (CVSS: {score})')
    print(f'- Package: {pkg} ({ecosystem}) \u2014 {relationship}, {manifest}')
    print(f'- Vulnerable Range: {vuln_range} \u2192 Fix: {fix_ver}')
    print(f'- CVE: {cve} | GHSA: {ghsa}')
    if cwe_str:
        print(f'- CWE: {cwe_str}')
    print(f'- Created: {created}')
    print()
    print('Description')
    print()
    print(description)
"
'''