.PHONY: check syntax lint test check-hermes-pin tx9 go-check dist # tests/regressions-*.sh is globbed so new split-out regression files don't# require touching this Makefile.SHELL_FILES := guest/hb guest/hb-workload guest/lib-mcp.sh guest/profile.sh guest/agent-bash-profile.sh provision/provision.sh docker/entrypoint.sh docker/executor-entrypoint.sh tests/lib.sh tests/static.sh tests/hermes-state.sh $(wildcard tests/regressions-*.sh) syntax:	bash -n $(SHELL_FILES)	sh -n scripts/install.sh	python3 -c 'compile(open("guest/hermes-state", encoding="utf-8").read(), "guest/hermes-state", "exec")' lint:	command -v shellcheck >/dev/null || { echo "shellcheck is required for make check" >&2; exit 1; }	shellcheck -x -s bash $(SHELL_FILES)	# scripts/install.sh is a #!/bin/sh installer (must run under plain	# POSIX sh via `curl | sh`), so it's linted against the sh dialect	# separately rather than folded into SHELL_FILES/-s bash above.	shellcheck -x -s sh scripts/install.sh test:	command -v python3 >/dev/null || { echo "python3 is required for local regression tests" >&2; exit 1; }	command -v jq >/dev/null || { echo "jq is required for local regression tests" >&2; exit 1; }	./tests/static.sh	./tests/hermes-state.sh	for f in tests/regressions-*.sh; do ./"$$f" || exit 1; done check: syntax lint test go-check # Not part of `check` — needs network access, so `make check` stays hermetic.# Run this on its own to catch Hermes installer drift before it surfaces as a# `box new` failure for a real user.check-hermes-pin:	@command -v curl >/dev/null || { echo "curl is required for check-hermes-pin" >&2; exit 1; }	@if command -v sha256sum >/dev/null; then hasher="sha256sum"; \	elif command -v shasum >/dev/null; then hasher="shasum -a 256"; \	else echo "sha256sum or shasum (macOS) is required for check-hermes-pin" >&2; exit 1; fi; \	pinned=$$(grep '^HERMES_INSTALLER_SHA256=' box.env | sed -E 's/^[A-Z0-9_]+="([^"]*)"/\1/'); \	tmp=$$(mktemp); \	trap 'rm -f "$$tmp"' EXIT; \	if ! curl -fsSL --connect-timeout 10 --max-time 30 https://hermes-agent.nousresearch.com/install.sh -o "$$tmp"; then \		echo "failed to fetch live Hermes installer" >&2; exit 1; \	fi; \	live=$$($$hasher "$$tmp" | awk '{print $$1}'); \	if [ "$$pinned" = "$$live" ]; then \		echo "HERMES_INSTALLER_SHA256 matches upstream ($$live)"; \	else \		echo "HERMES_INSTALLER_SHA256 in box.env ($$pinned) does NOT match upstream ($$live)" >&2; \		echo "review the new installer before re-pinning, then update box.env" >&2; \		exit 1; \	fi VERSION ?= dev # -buildvcs=false: this worktree's .git is a linked-worktree gitlink file, not# a directory, and `go build`'s VCS-root walk doesn't recognize it — it walks# past the real repo and can land on an unrelated .git elsewhere up the tree,# failing with "error obtaining VCS status: exit status 128". The CLI's# version comes from -ldflags, not VCS stamping, so this is a no-op for us.tx9:	go build -buildvcs=false -ldflags "-X github.com/davis7dotsh/tx9/internal/version.Version=$(VERSION)" -o bin/tx9 . go-check:	@test -z "$$(gofmt -l .)" || { echo "gofmt: unformatted files:" >&2; gofmt -l . >&2; exit 1; }	go vet -buildvcs=false ./...	go build -buildvcs=false ./...	go test -buildvcs=false ./... # Cross-compiles the release binaries + checksums.txt into dist/. Asset# naming here MUST match internal/selfupdate.AssetName and# .github/workflows/release.yml: plain, uncompressed executables named# tx9_<GOOS>_<GOARCH>, plus a checksums.txt in `sha256sum` output format.DIST_PLATFORMS := linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 dist:	rm -rf dist	mkdir -p dist	for platform in $(DIST_PLATFORMS); do \		goos=$${platform%/*}; goarch=$${platform#*/}; \		out="dist/tx9_$${goos}_$${goarch}"; \		echo "building $$out"; \		GOOS=$$goos GOARCH=$$goarch go build -buildvcs=false -ldflags "-X github.com/davis7dotsh/tx9/internal/version.Version=$(VERSION)" -o "$$out" . || exit 1; \	done	cd dist && { command -v sha256sum >/dev/null 2>&1 && sha256sum tx9_* > checksums.txt || shasum -a 256 tx9_* > checksums.txt; }	@echo "dist/ ready (VERSION=$(VERSION))"