# ©AngelaMos | 2026
# justfile

set shell := ["bash", "-uc"]

image := "ruby:4.0-slim"
vuln_image := "ruby:4.0.2-slim"
run := "docker run --rm --network none -v $PWD:/app -w /app " + image
run_ro := "docker run --rm --network none -v $PWD:/app:ro -w /app " + image

default:
    @just --list

test:
    {{run_ro}} ruby -Ilib -Itest test/marshal/parser_test.rb
    {{run_ro}} ruby -Ilib -Itest test/scanner_test.rb
    {{run_ro}} ruby -Ilib -Itest test/chains_test.rb
    {{run_ro}} ruby -Ilib -Itest test/marshal/boundary_detector_test.rb
    {{run_ro}} ruby -Ilib -Itest test/corpus_test.rb

corpus:
    {{run_ro}} ruby -Ilib -Itest -e 'require "rube"; require "support/adversarial_corpus"; Rube::AdversarialCorpus::CASES.each { |k| d = Rube::Marshal::BoundaryDetector.new(allowed_class_names: k[:allowed]); dec = d.inspect_stream(k[:bytes]); puts format("  %-38s %-6s %-10s %s", k[:name], dec.accepted? ? "accept" : "reject", k[:allowed].join(","), dec.reason.to_s[0, 52]) }'

scan namespace="":
    {{run_ro}} ruby -Ilib -e 'require "rube"; ns = "{{namespace}}"; r = Rube::Scanner.new(namespace: ns.empty? ? nil : ns).scan; puts "modules=#{r.scanned_modules} candidates=#{r.candidates.length} gated=#{r.gated.length} reachable=#{r.reachable.length}"; puts; r.reachable.each { |c| puts format("  %-10s %-46s %s", c.gate, c.to_s, c.source_location) }'

control:
    {{run_ro}} ruby -Ilib -Itest test/control_check.rb

lint:
    {{run}} sh -c "gem install --no-document rubocop rubocop-minitest rubocop-performance rubocop-rake >/dev/null 2>&1 && rubocop --force-exclusion"

check: test control

probe:
    {{run_ro}} ruby /app/test/support/matrix_probe.rb

matrix:
    @bash scripts/version-matrix.sh

exploit:
    @bash scripts/exploit-gate.sh

target:
    @bash scripts/target-gate.sh

detector:
    @bash scripts/detector-gate.sh

gate: check matrix exploit detector target

build:
    {{run}} sh -c "gem build --strict rube.gemspec"

manifest:
    {{run_ro}} ruby -e 'spec = Gem::Specification.load("rube.gemspec"); puts spec.files.sort; puts; puts "#{spec.files.length} files"'

shell:
    docker run --rm -it --network none -v $PWD:/app -w /app {{image}} bash

pull:
    docker pull {{image}}
    docker pull {{vuln_image}}

clean:
    rm -f *.gem