@controllerai/cli 0.2.13 → 0.2.15

package/dist/commands/run.js

@@ -1,4 +1,4 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { appBaseUrl, runUrl } from '../appLinks.js';
 import { requireContext } from '../context.js';
 import { CaiError, userError } from '../errors.js';
@@ -55,35 +55,93 @@ const adoptObservedOutputs = async (api, workflowId, targets) => {
     return results;
 };
 /**
- * Test-input file schema. The wire contract the backend wants is
+ * Test-input schema. The wire contract the backend wants is
  * a flat `{ [inputId]: value }` map, so both the flat form and the documented
  * `{nodeInputs:[{id,testValue}], flowInputs:[…]}` form are accepted and
- * normalised here.
+ * normalised here. The source may be inline JSON, a file path, or stdin.
  */
-export const readTestValues = (path) => {
-    const raw = path === '-' ? readFileSync(0, 'utf8') : readFileSync(path, 'utf8');
+export const readTestValues = (source) => {
+    let raw;
+    let sourceKind;
+    if (source === '-') {
+        sourceKind = 'stdin';
+        try {
+            raw = readFileSync(0, 'utf8');
+        }
+        catch (error) {
+            throw userError(`--inputs could not read stdin: ${error instanceof Error ? error.message : error}`, 'UNREADABLE_INPUTS');
+        }
+    }
+    else if (existsSync(source)) {
+        // Existing paths win even when their names look like JSON (for example a
+        // file literally named `{}`). This keeps path-vs-inline parsing deterministic.
+        sourceKind = 'file';
+        try {
+            raw = readFileSync(source, 'utf8');
+        }
+        catch (error) {
+            throw userError(`--inputs file "${source}" could not be read: ${error instanceof Error ? error.message : error}`, 'UNREADABLE_INPUTS');
+        }
+    }
+    else if (isBrokenSymlink(source)) {
+        throw userError(`--inputs path "${source}" exists but is not a readable file (broken symlink?).`, 'UNREADABLE_INPUTS');
+    }
+    else {
+        sourceKind = 'inline';
+        raw = source;
+    }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch (error) {
-        throw userError(`--inputs ${path} is not valid JSON: ${error instanceof Error ? error.message : error}`, 'BAD_INPUTS_JSON');
+        const detail = error instanceof Error ? error.message : String(error);
+        throw userError(sourceKind === 'inline'
+            ? `--inputs "${source}" is not an existing file, and not valid JSON: ${detail}`
+            : `--inputs ${sourceKind === 'stdin' ? 'from stdin' : `file "${source}"`} is not valid JSON: ${detail}`, 'BAD_INPUTS_JSON');
     }
     if (Array.isArray(parsed)) {
         throw userError('--inputs must be an object, not an array.', 'BAD_INPUTS_SHAPE');
     }
-    if (parsed.nodeInputs || parsed.flowInputs) {
+    if (!parsed || typeof parsed !== 'object') {
+        throw userError('--inputs must be a JSON object.', 'BAD_INPUTS_SHAPE');
+    }
+    const hasNodeInputs = Object.hasOwn(parsed, 'nodeInputs');
+    const hasFlowInputs = Object.hasOwn(parsed, 'flowInputs');
+    if (hasNodeInputs || hasFlowInputs) {
+        if (hasNodeInputs && !Array.isArray(parsed.nodeInputs)) {
+            throw userError('`nodeInputs` must be an array.', 'BAD_INPUTS_SHAPE');
+        }
+        if (hasFlowInputs && !Array.isArray(parsed.flowInputs)) {
+            throw userError('`flowInputs` must be an array.', 'BAD_INPUTS_SHAPE');
+        }
         const out = {};
         for (const entry of [...(parsed.nodeInputs ?? []), ...(parsed.flowInputs ?? [])]) {
             if (!entry?.id) {
                 throw userError('Each nodeInputs/flowInputs entry needs an `id`.', 'BAD_INPUTS_SHAPE');
             }
-            out[entry.id] = entry.testValue;
+            // Define an own data property so an opaque id such as "__proto__" cannot
+            // invoke Object.prototype's legacy setter and disappear from preflight.
+            Object.defineProperty(out, String(entry.id), {
+                value: entry.testValue,
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
         }
         return out;
     }
     return parsed;
 };
+/** `existsSync` follows symlinks, so retain a useful error for a dangling one. */
+const isBrokenSymlink = (source) => {
+    try {
+        return lstatSync(source).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+};
 /**
  * `run_node_test` / `run_flow_test` are ASYNC: they return
  * `{status:'started', workflowExecutionId}` and nothing else — no output, no
@@ -93,24 +151,41 @@ export const readTestValues = (path) => {
 /** Inline JSON, a file path, or `-` for stdin — shared by the probe options. */
 export const readJsonArg = (source, flag) => {
     let raw;
-    try {
-        raw =
-            source === '-'
-                ? readFileSync(0, 'utf8')
-                : /^[{[]/.test(source.trimStart())
-                    ? source
-                    : readFileSync(source, 'utf8');
+    let sourceKind;
+    if (source === '-') {
+        sourceKind = 'stdin';
+        try {
+            raw = readFileSync(0, 'utf8');
+        }
+        catch (error) {
+            throw userError(`${flag} could not read stdin: ${error instanceof Error ? error.message : error}`, 'UNREADABLE_JSON_ARG');
+        }
     }
-    catch (error) {
-        throw userError(`${flag} "${source}" is not a readable file and does not look like inline JSON ` +
-            `(inline JSON must start with "{" or "["): ${error instanceof Error ? error.message : error}`, 'UNREADABLE_JSON_ARG');
+    else if (existsSync(source)) {
+        sourceKind = 'file';
+        try {
+            raw = readFileSync(source, 'utf8');
+        }
+        catch (error) {
+            throw userError(`${flag} file "${source}" could not be read: ${error instanceof Error ? error.message : error}`, 'UNREADABLE_JSON_ARG');
+        }
+    }
+    else if (isBrokenSymlink(source)) {
+        throw userError(`${flag} path "${source}" exists but is not a readable file (broken symlink?).`, 'UNREADABLE_JSON_ARG');
+    }
+    else {
+        sourceKind = 'inline';
+        raw = source;
     }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch (error) {
-        throw userError(`${flag} is not valid JSON: ${error instanceof Error ? error.message : error}`, 'BAD_JSON_ARG');
+        const detail = error instanceof Error ? error.message : String(error);
+        throw userError(sourceKind === 'inline'
+            ? `${flag} "${source}" is not an existing file, and not valid JSON: ${detail}`
+            : `${flag} ${sourceKind === 'stdin' ? 'from stdin' : `file "${source}"`} is not valid JSON: ${detail}`, 'BAD_JSON_ARG');
     }
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         throw userError(`${flag} must be a JSON object.`, 'BAD_JSON_ARG_SHAPE');
@@ -127,6 +202,177 @@ export const testInputRows = (data) => {
     return [...(data?.nodeInputs ?? []), ...(data?.flowInputs ?? [])];
 };
 const ISOLATED_FLOW_CONTEXT_REQUIRED = 'ISOLATED_FLOW_CONTEXT_REQUIRED';
+/** Mirror the expression context's display-name-to-JS-binding transform. */
+const camelCaseBindingName = (value) => {
+    const cleaned = String(value ?? '')
+        .replace(/[^a-zA-Z0-9]+(.)/g, (_, char) => char.toUpperCase())
+        .replace(/[^a-zA-Z0-9]/g, '');
+    return cleaned ? cleaned[0].toLowerCase() + cleaned.slice(1) : 'x';
+};
+const exactInputAliasKey = (key) => `exact:${key}`;
+const displayInputAliasKey = (key) => `display:${key.trim().toLowerCase()}`;
+const flowInputDisplayName = (row) => String(row?.displayName || row?.name || '');
+/**
+ * Exact CLI port of `uniqueBindings` in
+ * controllerai-be/src/modules/workflowAgent/services/expressionJs/context.ts.
+ * The backend implementation is the source of truth; these repositories do
+ * not share this helper.
+ * Binding allocation is ordered and list-wide; never call this for one input
+ * at a time or collision suffixes will disagree with `cai expr context`.
+ */
+const allocateFlowInputBindings = (inputRows) => {
+    const used = new Set();
+    const nextSuffix = new Map();
+    return inputRows.map(row => {
+        const id = String(row.id);
+        const displayName = flowInputDisplayName(row);
+        const baseName = camelCaseBindingName(displayName);
+        let binding = baseName;
+        if (used.has(binding)) {
+            let suffix = nextSuffix.get(baseName) ?? 2;
+            while (used.has(`${baseName}${suffix}`))
+                suffix += 1;
+            binding = `${baseName}${suffix}`;
+            nextSuffix.set(baseName, suffix + 1);
+        }
+        used.add(binding);
+        return { id, displayName, row, binding };
+    });
+};
+const addFlowInputAlias = (index, key, source, matchedBy) => {
+    const candidates = index.get(key) ?? new Map();
+    const candidate = candidates.get(source.id) ?? { ...source, matchedBy: new Set() };
+    candidate.matchedBy.add(matchedBy);
+    candidates.set(source.id, candidate);
+    index.set(key, candidates);
+};
+const buildFlowInputAliasTable = (inputRows, includeNonOpaqueAliases) => {
+    const sources = allocateFlowInputBindings(inputRows);
+    const table = {
+        sources,
+        aliases: new Map(),
+    };
+    for (const source of sources) {
+        addFlowInputAlias(table.aliases, exactInputAliasKey(source.id), source, 'opaque id');
+        if (!includeNonOpaqueAliases)
+            continue;
+        const storedName = typeof source.row?.name === 'string' ? source.row.name : '';
+        if (storedName) {
+            addFlowInputAlias(table.aliases, exactInputAliasKey(storedName), source, 'stored name');
+            addFlowInputAlias(table.aliases, displayInputAliasKey(storedName), source, 'stored name');
+        }
+        if (source.displayName.trim()) {
+            addFlowInputAlias(table.aliases, displayInputAliasKey(source.displayName), source, 'display name');
+        }
+        addFlowInputAlias(table.aliases, exactInputAliasKey(source.binding), source, 'camelCase JS binding');
+    }
+    return table;
+};
+const mergeFlowInputCandidates = (merged, candidates) => {
+    for (const candidate of candidates?.values() ?? []) {
+        const existing = merged.get(candidate.id) ?? {
+            ...candidate,
+            matchedBy: new Set(),
+        };
+        for (const kind of candidate.matchedBy)
+            existing.matchedBy.add(kind);
+        merged.set(candidate.id, existing);
+    }
+};
+const FLOW_INPUT_ALIAS_KIND_ORDER = [
+    'opaque id',
+    'stored name',
+    'display name',
+    'camelCase JS binding',
+];
+const matchedByDescription = (candidate) => FLOW_INPUT_ALIAS_KIND_ORDER.filter(kind => candidate.matchedBy.has(kind)).join(' and ');
+const DEV_FLOW_INPUT_ALIAS_GUARD = 'Display-name and camelCase binding aliases are disabled for this entire dev input list ' +
+    'because get_flow_test_inputs returned an input with an empty displayName and omits stored ' +
+    "names, so the compiler's list-wide binding allocation cannot be reconstructed safely. " +
+    'Pass exact opaque input ids only.';
+const resolveFlowInputKeys = (inputRows, testValues, target) => {
+    // Current dev rows omit `name`; retaining the fallback here lets the backend
+    // contract fix restore safe aliases without changing binding allocation.
+    const devAliasesDisabled = target === 'dev' && inputRows.some(row => !row?.displayName && !row?.name);
+    const aliases = buildFlowInputAliasTable(inputRows, !devAliasesDisabled);
+    const knownIds = new Set(aliases.sources.map(source => source.id));
+    if (devAliasesDisabled)
+        warn(DEV_FLOW_INPUT_ALIAS_GUARD);
+    for (const key of Object.keys(testValues)) {
+        // Structured input JSON can represent an omitted testValue as an own
+        // property whose value is undefined. Node runs deliberately preserve that
+        // distinction for their isolated-context preflight; flow runs must reject
+        // it before JSON serialization drops the key and allows a server fallback.
+        if (testValues[key] === undefined) {
+            throw userError(`Input key "${key}" has no value. Flow inputs require a testValue; ` +
+                'explicit null, "", false, and 0 are valid.', 'BAD_INPUTS_SHAPE');
+        }
+        // The live server resolves opaque ids first. Mirror that precedence before
+        // considering any CLI alias namespace so an id can never become ambiguous.
+        if (knownIds.has(key))
+            continue;
+        // Stored names and bindings are exact. Stored names and display names also
+        // retain the CLI's trimmed, case-insensitive convenience form.
+        const candidatesById = new Map();
+        mergeFlowInputCandidates(candidatesById, aliases.aliases.get(exactInputAliasKey(key)));
+        mergeFlowInputCandidates(candidatesById, aliases.aliases.get(displayInputAliasKey(key)));
+        let candidates = [...candidatesById.values()];
+        if (candidates.length > 1 &&
+            !candidates.some(candidate => candidate.matchedBy.has('opaque id'))) {
+            // Flow mode returns every declared input, including unused inputs. When
+            // exactly one non-id alias collision is used by the flow, it is the only
+            // candidate whose value can affect this run.
+            const usedCandidates = candidates.filter(candidate => candidate.row?.used !== false);
+            if (usedCandidates.length === 1)
+                candidates = usedCandidates;
+        }
+        if (candidates.length > 1) {
+            const candidateList = candidates
+                .map(candidate => `${candidate.id} (${candidate.displayName || 'unnamed'}; ` +
+                `matched by ${matchedByDescription(candidate)})`)
+                .join(', ');
+            throw userError(`Ambiguous input key "${key}" matches multiple flow inputs across accepted aliases: ` +
+                `${candidateList}. Pass the exact opaque id for the intended input.`, 'UNKNOWN_INPUT_KEY');
+        }
+        if (candidates.length === 1) {
+            const resolved = candidates[0];
+            if (key === resolved.id)
+                continue;
+            if (Object.prototype.hasOwnProperty.call(testValues, resolved.id)) {
+                throw userError(`Input key "${key}" resolves to flow input ${resolved.id} ` +
+                    `(${resolved.displayName || 'unnamed'}), but that input was supplied more than once. ` +
+                    'Pass each input once using its opaque id.', 'UNKNOWN_INPUT_KEY');
+            }
+            // Opaque ids are normally generated, but imported legacy state can carry
+            // any string. Define an own property so "__proto__" cannot swallow a
+            // remapped value through Object.prototype's legacy setter.
+            Object.defineProperty(testValues, resolved.id, {
+                value: testValues[key],
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+            delete testValues[key];
+            warn(`Input key "${key}" matched flow input ${resolved.id} ` +
+                `(${resolved.displayName || 'unnamed'}) by ${matchedByDescription(resolved)} — using the id.`);
+        }
+    }
+    const unknown = Object.keys(testValues).filter(key => !knownIds.has(key));
+    if (unknown.length > 0) {
+        const known = aliases.sources
+            .map(source => devAliasesDisabled
+            ? source.id
+            : `${source.id} (${source.displayName || 'unnamed'}; binding ${source.binding})`)
+            .join(', ');
+        throw userError(`Unknown input key${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}. ` +
+            (devAliasesDisabled
+                ? `This flow's opaque input ids: ${known || '(none)'}. ${DEV_FLOW_INPUT_ALIAS_GUARD} `
+                : `This flow's inputs: ${known || '(none)'}. Pass an opaque id, stored name, an ` +
+                    'unambiguous display name, or its exact camelCase JS binding. ') +
+            `Without a match the run would ` +
+            `silently use the saved test values instead of yours.`, 'UNKNOWN_INPUT_KEY');
+    }
+};
 const missingNodeFlowInputs = (testInputs, testValues) => {
     const flowInputs = Array.isArray(testInputs?.flowInputs) ? testInputs.flowInputs : [];
     return flowInputs.flatMap((input) => {
@@ -209,6 +455,71 @@ const developmentWorkflowVersionId = async (api, workflowId) => {
         ? versionId
         : null;
 };
+const LIVE_INPUT_SCHEMA_UNAVAILABLE = 'LIVE_INPUT_SCHEMA_UNAVAILABLE';
+const isMissingLiveInputSchemaRoute = (error) => {
+    if (!(error instanceof CaiError))
+        return false;
+    if (error.code === 'ROUTE_NOT_FOUND')
+        return true;
+    if (error.httpStatus !== 404)
+        return false;
+    const routeMessage = error.message.replace(/^404\s+/, '');
+    return (/^(?:not found|cannot\s+[A-Z]+\b)/i.test(routeMessage) ||
+        /(?:route|endpoint).*not found|not found.*(?:route|endpoint)/i.test(error.message));
+};
+/**
+ * The live endpoint accepts exact input id/name/displayName keys, then
+ * normalizes them to the stored input name (controllerai-be
+ * workflow/services/flowInputValidation.ts). Read the published rail here so
+ * CLI-only JS binding aliases can be resolved to accepted opaque IDs without
+ * ever borrowing a newer development input list.
+ */
+const readLiveFlowInputRows = async (api, workflowId, flowId) => {
+    try {
+        const versions = (await api.rest(`/workflow/${workflowId}/versions`)) ?? [];
+        const liveVersion = versions.find(version => version?.isLiveVersion === true &&
+            typeof version.id === 'number' &&
+            Number.isSafeInteger(version.id) &&
+            version.id > 0);
+        if (!liveVersion?.id) {
+            throw userError('Cannot resolve --inputs for --target live because this workflow has no published live ' +
+                'version. Publish it first with `cai workflow publish`.', LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        const state = await api.rest(`/workflow-version/${liveVersion.id}/states/latest`);
+        if (typeof state?.json !== 'string') {
+            throw userError(`Cannot resolve --inputs for --target live because published version ${liveVersion.id} ` +
+                'returned no readable state document.', LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        let document;
+        try {
+            document = JSON.parse(state.json);
+        }
+        catch (error) {
+            throw userError(`Cannot resolve --inputs for --target live because published version ${liveVersion.id} ` +
+                `has invalid state JSON: ${error instanceof Error ? error.message : error}`, LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        const flow = (Array.isArray(document?.flows) ? document.flows : []).find((candidate) => candidate?.id === flowId);
+        if (!flow) {
+            throw userError(`Cannot resolve --inputs for --target live because flow "${flowId}" is not in ` +
+                `published version ${liveVersion.id}. Publish the flow before running it live.`, LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        if (!Array.isArray(flow.flowInputs)) {
+            throw userError(`Cannot resolve --inputs for --target live because flow "${flowId}" has no readable ` +
+                `published input list in version ${liveVersion.id}.`, LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        return flow.flowInputs;
+    }
+    catch (error) {
+        if (error instanceof CaiError && error.code === LIVE_INPUT_SCHEMA_UNAVAILABLE)
+            throw error;
+        if (isMissingLiveInputSchemaRoute(error)) {
+            throw userError(`Cannot safely resolve --inputs aliases for --target live from the published workflow: ` +
+                `${error.message}. The live endpoint accepts exact input ids, stored names, or display ` +
+                'names; this backend must be upgraded because the published-state read route is unavailable.', LIVE_INPUT_SCHEMA_UNAVAILABLE);
+        }
+        throw error;
+    }
+};
 const TERMINAL = new Set(['completed', 'completed_with_error', 'failed', 'cancelled']);
 export const isTerminal = (status) => typeof status === 'string' && TERMINAL.has(status.toLowerCase());
 /** Reject invalid polling budgets before an execution can be started. */
@@ -314,7 +625,7 @@ export const registerRun = (program) => {
     run
         .command('node')
         .argument('<nodeId>')
-        .option('--inputs <file|->', 'JSON test values; `-` reads stdin')
+        .option('--inputs <json|file|->', 'inline JSON or a JSON file; `-` reads stdin')
         .option('--timeout <ms>', 'how long to wait for the run to finish', '120000')
         .description('Run one node in isolation on the dev version (real external action); always surfaces resolvedConfigs')
         .action(async (nodeId, opts, command) => {
@@ -409,7 +720,7 @@ export const registerRun = (program) => {
     run
         .command('flow')
         .argument('<flowId>')
-        .option('--inputs <file|->', 'JSON test values; `-` reads stdin')
+        .option('--inputs <json|file|->', 'inline JSON or a JSON file; `-` reads stdin')
         .option('--target <dev|live>', 'DEV draft or LIVE published workflow', 'dev')
         .option('--confirm-live', 'acknowledge LIVE run side effects and usage', false)
         .option('--timeout <ms>', 'how long to wait for the run to finish', '300000')
@@ -423,6 +734,15 @@ export const registerRun = (program) => {
                 'Dev isolation covers the data store only.');
         }
         const testValues = opts.inputs ? readTestValues(opts.inputs) : {};
+        // Resolve every accepted key form through one combined alias table before
+        // dispatch. This catches collisions across opaque ids, display names, and
+        // compiler bindings instead of allowing one namespace to shadow another.
+        if (Object.keys(testValues).length > 0) {
+            const inputRows = target === 'live'
+                ? await readLiveFlowInputRows(api, workflowId, flowId)
+                : testInputRows(await api.tool(workflowId, 'get_flow_test_inputs', { flowId }));
+            resolveFlowInputKeys(inputRows, testValues, target);
+        }
         let started;
         if (target === 'live') {
             warn('LIVE run executes the published workflow: external actions fire and usage is spent.');
@@ -444,61 +764,6 @@ export const registerRun = (program) => {
             }
         }
         else {
-            // Fail on unknown input keys BEFORE running. A mistyped key (or a JS
-            // binding passed where the opaque input id belongs) used to fall
-            // through silently to the flow's saved test value — a real run against
-            // the wrong data that still looks green (dogfood round 3, S4).
-            if (Object.keys(testValues).length > 0) {
-                const inputRows = testInputRows(await api.tool(workflowId, 'get_flow_test_inputs', { flowId }));
-                const knownIds = new Set(inputRows.map(row => String(row.id)));
-                // Convenience remap: a key that misses every opaque id but exactly
-                // matches ONE input's display name is resolved to that id. Agents
-                // naturally write `name=Ada`; without this every first run fails and
-                // they retry-loop until they discover the opaque-id rule. Ambiguous
-                // labels still fall through to the fail-closed unknown-key error.
-                const idsByLabel = new Map();
-                for (const row of inputRows) {
-                    for (const label of [row.displayName, row.name]) {
-                        if (typeof label === 'string' && label.trim()) {
-                            const key = label.trim().toLowerCase();
-                            const ids = idsByLabel.get(key) ?? new Set();
-                            ids.add(String(row.id));
-                            idsByLabel.set(key, ids);
-                        }
-                    }
-                }
-                for (const key of Object.keys(testValues)) {
-                    if (knownIds.has(key))
-                        continue;
-                    let candidates = [...(idsByLabel.get(key.trim().toLowerCase()) ?? [])];
-                    if (candidates.length > 1) {
-                        // Flow mode now returns EVERY declared input, so a label can
-                        // collide across the used/unused boundary. Only used inputs feed
-                        // the run — when exactly one candidate is used, it wins.
-                        const usedIds = new Set(inputRows
-                            .filter(row => row.used !== false)
-                            .map(row => String(row.id)));
-                        const usedCandidates = candidates.filter(id => usedIds.has(id));
-                        if (usedCandidates.length === 1)
-                            candidates = usedCandidates;
-                    }
-                    if (candidates.length === 1 && !(candidates[0] in testValues)) {
-                        testValues[candidates[0]] = testValues[key];
-                        delete testValues[key];
-                        warn(`Input key "${key}" matched flow input ${candidates[0]} by display name — using the id.`);
-                    }
-                }
-                const unknown = Object.keys(testValues).filter(key => !knownIds.has(key));
-                if (unknown.length > 0) {
-                    const known = inputRows
-                        .map(row => `${row.id} (${row.displayName ?? row.name ?? 'unnamed'})`)
-                        .join(', ');
-                    throw userError(`Unknown input key${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}. ` +
-                        `This flow's input ids: ${known || '(none)'} — pass the opaque id, not the ` +
-                        `display name or JS binding. Without a match the run would silently use the ` +
-                        `saved test values instead of yours.`, 'UNKNOWN_INPUT_KEY');
-                }
-            }
             started = await api.tool(workflowId, 'run_flow_test', { flowId, testValues });
         }
         const workflowExecutionId = findWorkflowExecutionId(started);
@@ -582,7 +847,7 @@ export const registerRun = (program) => {
     run
         .command('discover')
         .requiredOption('--node <slug>', 'integration node slug')
-        .requiredOption('--key <componentKey>', 'component key from `cai node components`')
+        .requiredOption('--key <componentKey>', 'exact action key from `cai integration actions`')
         .requiredOption('--connection <id|none>', 'connection id, or "none" for a component that needs no auth')
         .option('--props <json|file|->', 'prop values, same per-prop shape as `node add`')
         .option('--enable <prop>', 'optional prop to enable first; repeatable', (value, previous = []) => [...previous, value])