@glubean/cli 0.2.5 → 0.3.0

package/dist/commands/run.js

@@ -2,13 +2,13 @@ import { bootstrap, evaluateThresholds, MetricCollector, ProjectRunner, buildRun
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { stat, readdir, readFile, writeFile, mkdir, rm } from "node:fs/promises";
 import { glob } from "node:fs/promises";
-import { loadConfig, mergeRunOptions, toSharedRunConfig } from "../lib/config.js";
+import { CONFIG_DEFAULTS, mergeRunOptions, toSharedRunConfig } from "../lib/config.js";
 import { loadProjectEnv } from "@glubean/runner";
 import { resolveEnvFileName } from "../lib/active_env.js";
 import { shouldSkipTest } from "../lib/skip.js";
 import { CLI_VERSION } from "../version.js";
 import { extractContractCases, extractFromSource } from "@glubean/scanner/static";
-import { extractContractFromFile, loadProjectOverlays } from "@glubean/scanner";
+import { extractContractFromFile, findTemplateMatch, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
 import { applyEnvTemplating } from "@glubean/runner";
 // ANSI color codes for pretty output
 const colors = {
@@ -49,6 +49,22 @@ async function findProjectConfig(startDir) {
     // No glubean project found — use the starting directory (scratch mode)
     return { rootDir: startDir };
 }
+// Config consolidation (docs/06): the package.json `glubean` field is no
+// longer a config source. Warn (don't error) when one lingers so users
+// migrate it into glubean.yaml instead of wondering why it stopped working.
+async function warnIfLegacyPackageJsonConfig(rootDir) {
+    try {
+        const pkg = JSON.parse(await readFile(resolve(rootDir, "package.json"), "utf-8"));
+        if (pkg.glubean && typeof pkg.glubean === "object") {
+            console.warn(`\x1b[33mWarning: the package.json \`glubean\` field is no longer read ` +
+                `(config consolidation — see docs/06). Move run/redaction/thresholds ` +
+                `settings into glubean.yaml; the field is currently inert.\x1b[0m`);
+        }
+    }
+    catch {
+        // No package.json or parse error — nothing to warn about.
+    }
+}
 const DEFAULT_SKIP_DIRS = ["node_modules", ".git", "dist", "build"];
 const DEFAULT_EXTENSIONS = ["ts"];
 function isGlob(target) {
@@ -86,7 +102,18 @@ async function walkTestFiles(dir, result) {
         }
     }
 }
-async function resolveTestFiles(target) {
+export function classifyGlubeanFile(filePath) {
+    if (filePath.endsWith(".test.ts"))
+        return "test";
+    if (filePath.endsWith(".contract.ts"))
+        return "contract";
+    if (filePath.endsWith(".flow.ts"))
+        return "flow";
+    if (filePath.endsWith(".bootstrap.ts"))
+        return "bootstrap";
+    return undefined;
+}
+async function resolveSingleTarget(target) {
     const abs = resolve(target);
     try {
         const s = await stat(abs);
@@ -117,6 +144,80 @@ async function resolveTestFiles(target) {
     }
     return [abs];
 }
+/**
+ * Resolve one or more targets (file / dir / glob) to a deduped list of
+ * test file paths. Phase 4 multi-suite execution passes a per-suite
+ * array here so the runner can sweep all suites in a single pass with
+ * unified discovery, filtering, and reporter output.
+ */
+async function resolveTestFiles(target) {
+    const targets = Array.isArray(target) ? target : [target];
+    const all = [];
+    for (const t of targets) {
+        const files = await resolveSingleTarget(t);
+        all.push(...files);
+    }
+    // Dedupe (suites may share a directory) while preserving the caller-
+    // supplied order. Multi-suite main.ts depends on this — sorting here
+    // would mix files across suites and break failFast/failAfter
+    // short-circuit ordering. resolveSingleTarget still sorts within a
+    // single directory walk for determinism inside one suite.
+    const seen = new Set();
+    const ordered = [];
+    for (const f of all) {
+        if (seen.has(f))
+            continue;
+        seen.add(f);
+        ordered.push(f);
+    }
+    return ordered;
+}
+/**
+ * Per-suite resolution helper exposed for main.ts. Resolves a suite's
+ * `target` (file / dir / glob), then keeps only files whose
+ * `classifyGlubeanFile` result is in `kinds` (.bootstrap.ts files are
+ * always kept regardless of kinds so overlay registration still fires
+ * across the project — they emit no runnable tests on their own).
+ *
+ * `kinds.length === 0` means "no kind filter" (all Glubean files).
+ *
+ * KNOWN LIMITATION (file-level only): the filter operates on the file
+ * EXTENSION, not on individual exports. A `.contract.ts` file CAN
+ * legitimately export a flow inline (and vice versa). For canonical
+ * `tests/` + `contracts/` directory layouts this doesn't matter — each
+ * file kind matches its declared suite kind. For mixed exports inside
+ * a single file (`kinds: [contract]` running a flow exported from the
+ * same .contract.ts), authors should split flows into `.flow.ts`. A
+ * proper export-level kind filter would require threading suite kinds
+ * through discoverTests and is left as a follow-up.
+ */
+export async function resolveTestFilesForSuite(target, kinds) {
+    const files = await resolveSingleTarget(target);
+    if (kinds.length === 0)
+        return files;
+    const kindSet = new Set(kinds);
+    // Strict per-kind file filter: `.test.ts` ↔ "test", `.contract.ts` ↔
+    // "contract", `.flow.ts` ↔ "flow". This keeps the "zero files for
+    // declared suite" error a reliable signal of misconfiguration.
+    //
+    // KNOWN LIMITATION: a `.contract.ts` file that exports ONLY a flow
+    // (uncommon — flows usually live in `.flow.ts`) won't match a
+    // `kinds: [flow]` suite at the file-level filter. To run such a flow
+    // from a strict flow-only suite, either move the export into a
+    // `.flow.ts` file (recommended canonical layout) or declare the
+    // suite as `kinds: [contract, flow]` so both candidate file types
+    // are scanned and the runnable-level filter sorts them out.
+    return files.filter((f) => {
+        const k = classifyGlubeanFile(f);
+        if (k === undefined)
+            return false;
+        // Bootstrap files: always retain so contract.bootstrap() side-effects
+        // fire on import (per attachment-model §7.4 eager loading).
+        if (k === "bootstrap")
+            return true;
+        return kindSet.has(k);
+    });
+}
 export async function discoverTests(filePath) {
     // `.bootstrap.ts` files register overlays as a side-effect of import; they
     // produce no runnable tests of their own. We don't even need to import here
@@ -135,16 +236,35 @@ export async function discoverTests(filePath) {
         const result = await extractContractFromFile(filePath);
         const results = [];
         for (const ec of result.contracts) {
+            const contractTags = ec.tags ?? [];
             for (const c of ec.cases) {
+                // Mirror SDK dispatchContract: finalTags = contract + case + runtime
+                // synthetic. Without this, pre-spawn excludeTags / --tag filtering
+                // skips contract cases entirely (Phase 1 filter reads meta.tags).
+                const caseTags = c.tags ?? [];
+                const requires = c.requires ?? "headless";
+                const defaultRun = c.defaultRun ?? (requires !== "headless" ? "opt-in" : "always");
+                const runtimeTags = [];
+                if (requires !== "headless")
+                    runtimeTags.push(`requires:${requires}`);
+                if (defaultRun === "opt-in")
+                    runtimeTags.push("default-run:opt-in");
+                const finalTags = [...contractTags, ...caseTags, ...runtimeTags];
                 results.push({
                     exportName: ec.exportName,
                     meta: {
                         id: `${ec.id}.${c.key}`,
+                        // Mirror SDK dispatchContract testName: `${contractId} — ${caseKey}`.
+                        // Phase 1 matchesFilter checks meta.name; without this, --filter
+                        // matches against testId only for contract cases (uneven with test()).
+                        name: `${ec.id} — ${c.key}`,
                         description: c.description,
+                        tags: finalTags.length > 0 ? finalTags : undefined,
                         requires: c.requires,
                         defaultRun: c.defaultRun,
                         deferred: c.deferredReason,
                         deprecated: c.deprecatedReason,
+                        kind: "contract",
                     },
                 });
             }
@@ -152,6 +272,8 @@ export async function discoverTests(filePath) {
         // Each flow has a single orchestrator Test (setup → steps → teardown).
         // Discover it as one runnable entry with the flow id. Post-Phase 2f
         // flows live as `kind: "flow"` entries inside `result.attachments`.
+        // SDK maps FlowMeta.skip → TestMeta.deferred (string reason); mirror
+        // that here so the runner's deferred-skip path applies uniformly.
         for (const att of result.attachments) {
             if (att.kind !== "flow")
                 continue;
@@ -160,32 +282,58 @@ export async function discoverTests(filePath) {
                 meta: {
                     id: att.flow.id,
                     description: att.flow.description,
+                    tags: att.flow.tags,
+                    only: att.flow.only,
+                    deferred: att.flow.skip,
+                    kind: "flow",
                 },
             });
         }
         if (results.length > 0)
             return results;
-        // Runtime failed — fall back to static regex (old syntax, contracts only)
+        // Runtime failed — fall back to static regex ONLY for files that
+        // contain ONLY contract.http(...). Stricter than MCP's gate: CLI
+        // emits flows as runnable tests via discoverTests, so silently
+        // dropping `contract.flow(...)` would hide an actual test. Any
+        // non-HTTP usage (including flow) → fail closed and surface the
+        // import error so the user knows discovery is degraded.
         if (result.errors.length > 0) {
-            const contracts = extractContractCases(content);
+            // Allow whitespace/newlines between `contract` and `.method` so the
+            // common fluent style `contract\n  .flow(...)` still trips the gate.
+            const hasHttp = /contract\s*\.\s*http\b/i.test(content);
+            const hasNonHttp = /contract\s*\.\s*(?!http\b)\w+\s*[.(]/i.test(content);
+            const contracts = hasHttp && !hasNonHttp ? extractContractCases(content) : [];
             if (contracts.length > 0) {
                 for (const c of contracts) {
                     for (const caseItem of c.cases) {
+                        const requires = caseItem.requires ?? "headless";
+                        const defaultRun = caseItem.defaultRun ??
+                            (requires !== "headless" ? "opt-in" : "always");
+                        const runtimeTags = [];
+                        if (requires !== "headless") {
+                            runtimeTags.push(`requires:${requires}`);
+                        }
+                        if (defaultRun === "opt-in")
+                            runtimeTags.push("default-run:opt-in");
                         results.push({
                             exportName: c.exportName,
                             meta: {
                                 id: `${c.contractId}.${caseItem.key}`,
+                                name: `${c.contractId} — ${caseItem.key}`,
                                 description: caseItem.description,
+                                tags: runtimeTags.length > 0 ? runtimeTags : undefined,
                                 requires: caseItem.requires,
                                 defaultRun: caseItem.defaultRun,
                                 deferred: caseItem.deferred,
+                                kind: "contract",
                             },
                         });
                     }
                 }
                 return results;
             }
-            // Both runtime and static failed — surface the import error
+            // Both runtime and static failed (or non-HTTP detected) — surface the
+            // import error so the user knows discovery is degraded.
             for (const err of result.errors) {
                 console.error(`\x1b[31m✗ Contract import failed: ${err.file}\x1b[0m`);
                 console.error(`\x1b[2m  ${err.error}\x1b[0m`);
@@ -194,28 +342,55 @@ export async function discoverTests(filePath) {
         return [];
     }
     const metas = extractFromSource(content);
-    return metas.map((m) => ({
-        exportName: m.exportName,
-        meta: {
-            id: m.id,
-            name: m.name,
-            tags: m.tags,
-            timeout: m.timeout,
-            skip: m.skip,
-            only: m.only,
-            groupId: m.groupId,
-            parallel: m.parallel,
-        },
-    }));
+    return metas.map((m) => {
+        // Mirror the contract-case path so .test.ts authors who declare
+        // `requires: "browser"` / `defaultRun: "opt-in"` see the same
+        // selection behavior (excludeTags via synthetic tag-names AND
+        // shouldSkipTest via meta.requires/defaultRun).
+        const userTags = m.tags ?? [];
+        const requires = m.requires ?? "headless";
+        // Mirror SDK dispatchContract: non-headless implicitly opt-in unless
+        // the author overrode defaultRun. Same default applied to test() so
+        // tag-based selection (e.g. `--exclude-tag default-run:opt-in`)
+        // treats equivalent test() and contract cases identically.
+        const defaultRun = m.defaultRun ?? (requires !== "headless" ? "opt-in" : "always");
+        const runtimeTags = [];
+        if (requires !== "headless")
+            runtimeTags.push(`requires:${requires}`);
+        if (defaultRun === "opt-in")
+            runtimeTags.push("default-run:opt-in");
+        const finalTags = [...userTags, ...runtimeTags];
+        return {
+            exportName: m.exportName,
+            meta: {
+                id: m.id,
+                name: m.name,
+                tags: finalTags.length > 0 ? finalTags : undefined,
+                timeout: m.timeout,
+                skip: m.skip,
+                only: m.only,
+                groupId: m.groupId ?? (m.variant === "pick" || m.parallel ? m.id : undefined),
+                parallel: m.parallel,
+                requires: m.requires,
+                defaultRun: m.defaultRun,
+                kind: "test",
+            },
+        };
+    });
 }
 function matchesFilter(testItem, filter) {
     const lowerFilter = filter.toLowerCase();
-    if (testItem.meta.id.toLowerCase().includes(lowerFilter))
+    if (matchesTemplateFilter(testItem.meta.id, lowerFilter))
         return true;
     if (testItem.meta.name?.toLowerCase().includes(lowerFilter))
         return true;
     return false;
 }
+// Exported for testing only. Internal helpers otherwise.
+export const __testing = {
+    matchesTags: (...args) => matchesTags(...args),
+    matchesExcludeTags: (...args) => matchesExcludeTags(...args),
+};
 function matchesTags(testItem, tags, mode = "or") {
     if (!testItem.meta.tags?.length)
         return false;
@@ -223,12 +398,29 @@ function matchesTags(testItem, tags, mode = "or") {
     const match = (t) => lowerTestTags.includes(t.toLowerCase());
     return mode === "and" ? tags.every(match) : tags.some(match);
 }
+/**
+ * Returns true if the test carries ANY tag in excludeTags (case-insensitive).
+ * Always OR-mode — independent of positive-side tagMode. A test with no
+ * tags is never excluded by this filter.
+ */
+function matchesExcludeTags(testItem, excludeTags) {
+    if (!excludeTags.length)
+        return false;
+    if (!testItem.meta.tags?.length)
+        return false;
+    const lowerTestTags = testItem.meta.tags.map((t) => t.toLowerCase());
+    return excludeTags.some((t) => lowerTestTags.includes(t.toLowerCase()));
+}
 function getLogFilePath(testFilePath) {
     const lastDot = testFilePath.lastIndexOf(".");
     if (lastDot === -1)
         return testFilePath + ".log";
     return testFilePath.slice(0, lastDot) + ".log";
 }
+function findFileTestByRuntimeId(tests, runtimeId) {
+    const match = findTemplateMatch(tests.map((ft) => ({ id: ft.test.meta.id, ft })), runtimeId);
+    return match?.ft;
+}
 function resolveOutputPath(userPath, cwd) {
     if (isAbsolute(userPath)) {
         return resolve(userPath);
@@ -243,7 +435,7 @@ function resolveOutputPath(userPath, cwd) {
 }
 async function writeEmptyResult(target, runAt) {
     const payload = {
-        target,
+        target: Array.isArray(target) ? target.join(", ") : target,
         files: [],
         runAt,
         summary: { total: 0, passed: 0, failed: 0, skipped: 0, durationMs: 0, stats: {} },
@@ -263,6 +455,10 @@ export async function runCommand(target, options = {}) {
     const runStartDate = new Date();
     const runStartTime = runStartDate.toISOString();
     const runStartLocal = localTimeString(runStartDate);
+    if (options.uploadReceiptJson && !options.upload) {
+        console.error(`${colors.red}Error: --upload-receipt-json requires --upload or an upload-enabled profile.${colors.reset}`);
+        process.exit(1);
+    }
     // ── Capability profile ──────────────────────────────────────────────────
     const isCiEnv = process.env.CI === "true" || process.env.GLUBEAN_CI === "true";
     // Hard fail: --include-browser/--include-out-of-band in CI
@@ -281,23 +477,36 @@ export async function runCommand(target, options = {}) {
     console.log(`\n${colors.bold}${colors.blue}🧪 Glubean Test Runner${colors.reset}\n`);
     const testFiles = await resolveTestFiles(target);
     const isMultiFile = testFiles.length > 1;
+    // Single string view of target for serialization / display paths
+    // (result.json, junit, traces). Multi-suite passes an array; join with
+    // ", " so downstream consumers still see a printable target field.
+    const targetDisplay = Array.isArray(target) ? target.join(", ") : target;
     if (testFiles.length === 0) {
-        console.error(`\n${colors.red}❌ No test files found for target: ${target}${colors.reset}`);
+        console.error(`\n${colors.red}❌ No test files found for target: ${Array.isArray(target) ? target.join(", ") : target}${colors.reset}`);
         console.error(`${colors.dim}Glubean looks for files matching *.test.ts, *.contract.ts, or *.flow.ts in the target directory.${colors.reset}`);
         console.error(`${colors.dim}Run "glubean run tests/" or "glubean run path/to/file.test.ts".${colors.reset}\n`);
         await writeEmptyResult(target, runStartLocal);
         process.exit(1);
     }
     if (isMultiFile) {
-        console.log(`${colors.dim}Target: ${resolve(target)}${colors.reset}`);
+        const targetDisplay = Array.isArray(target)
+            ? target.map((t) => resolve(t)).join(", ")
+            : resolve(target);
+        console.log(`${colors.dim}Target: ${targetDisplay}${colors.reset}`);
         console.log(`${colors.dim}Files:  ${testFiles.length} test file(s)${colors.reset}\n`);
     }
     else {
         console.log(`${colors.dim}File: ${testFiles[0]}${colors.reset}\n`);
     }
     const startDir = testFiles[0].substring(0, testFiles[0].lastIndexOf("/"));
-    const { rootDir, configPath } = await findProjectConfig(startDir);
-    const glubeanConfig = await loadConfig(rootDir, options.configFiles);
+    const { rootDir } = await findProjectConfig(startDir);
+    // Config consolidation (docs/06 P2): the legacy package.json `glubean`
+    // flat-shape is no longer read. Profile runs get run/redaction/thresholds
+    // from the resolved plan (threaded via `options`); non-profile target runs
+    // fall back to built-in defaults + CLI flags + env. Warn once if a stale
+    // `glubean` field lingers in package.json so users know it's inert now.
+    await warnIfLegacyPackageJsonConfig(rootDir);
+    const glubeanConfig = structuredClone(CONFIG_DEFAULTS);
     const effectiveRun = mergeRunOptions(glubeanConfig.run, {
         verbose: options.verbose,
         pretty: options.pretty,
@@ -308,6 +517,12 @@ export async function runCommand(target, options = {}) {
         envFile: options.envFile,
         failFast: options.failFast,
         failAfter: options.failAfter,
+        // Phase 1 sub-task E1: forward profile-driven execution settings.
+        // mergeRunOptions handles undefined as "no override" — so non-profile
+        // runs (where options.timeoutMs/concurrency are undefined) keep
+        // legacy GlubeanRunConfig defaults; profile runs get the resolved values.
+        timeoutMs: options.timeoutMs,
+        concurrency: options.concurrency,
     });
     if (effectiveRun.logFile && !isMultiFile) {
         const logPath = getLogFilePath(testFiles[0]);
@@ -424,10 +639,24 @@ export async function runCommand(target, options = {}) {
     for (const filePath of testFiles) {
         try {
             const tests = await discoverTests(filePath);
-            for (const test of tests) {
+            // Phase 4 multi-suite: enforce suite.kinds at the runnable level
+            // (not just file-level). A `.contract.ts` exporting an inline
+            // `contract.flow(...)` produces a flow runnable; if the contributing
+            // suite declared `kinds: [contract]`, drop the flow here.
+            const allowedKinds = options.allowedKindsPerFile?.get(filePath);
+            const filteredTests = allowedKinds
+                ? tests.filter((t) => {
+                    const k = t.meta.kind;
+                    // Treat missing kind as "always allowed" — legacy / static-
+                    // fallback paths populate kind, but the safety net keeps
+                    // unknown shapes runnable rather than silently dropped.
+                    return k === undefined || allowedKinds.has(k);
+                })
+                : tests;
+            for (const test of filteredTests) {
                 allFileTests.push({ filePath, exportName: test.exportName, test });
             }
-            totalDiscovered += tests.length;
+            totalDiscovered += filteredTests.length;
         }
         catch (error) {
             if (isMultiFile) {
@@ -461,6 +690,7 @@ export async function runCommand(target, options = {}) {
         console.log(`${colors.yellow}ℹ️  Running only tests marked with .only${colors.reset}`);
     }
     const hasTags = options.tags && options.tags.length > 0;
+    const hasExcludeTags = options.excludeTags && options.excludeTags.length > 0;
     const testsToRun = allFileTests.filter((ft) => {
         const tc = ft.test;
         if (tc.meta.skip)
@@ -471,6 +701,8 @@ export async function runCommand(target, options = {}) {
             return false;
         if (hasTags && !matchesTags(tc, options.tags, options.tagMode))
             return false;
+        if (hasExcludeTags && matchesExcludeTags(tc, options.excludeTags))
+            return false;
         return true;
     });
     if (testsToRun.length === 0) {
@@ -676,6 +908,7 @@ export async function runCommand(target, options = {}) {
     // "start" event inside file:event handlers.
     let currentGroupFilePath = "";
     let currentTestMap;
+    let currentTestItems;
     let testId = "";
     let testName = "";
     let testItem = null;
@@ -684,10 +917,17 @@ export async function runCommand(target, options = {}) {
     let assertions = [];
     let success = false;
     let errorMsg;
+    let errorStack;
+    let errorReason;
+    let errorMissingPath;
+    let errorSuggestions;
     let peakMemoryMB;
     let stepAssertionCount = 0;
     let stepTraceLines = [];
     let testStarted = false;
+    // Plan 1 AC5: dedupe warning messages per session so the same warning
+    // doesn't repeat across session setup + each file's run() call.
+    const emittedWarnings = new Set();
     const addLogEntry = (type, message, data) => {
         if (effectiveRun.logFile) {
             logEntries.push({
@@ -766,8 +1006,42 @@ export async function runCommand(target, options = {}) {
             }
         }
         if (errorMsg) {
-            console.log(`      ${colors.red}Error: ${errorMsg}${colors.reset}`);
+            if (errorReason === "test_file_missing" && errorMissingPath) {
+                console.log(`      ${colors.red}✗ Test file not found: ${errorMissingPath}${colors.reset}`);
+                if (errorSuggestions && errorSuggestions.length > 0) {
+                    console.log(`        ${colors.dim}Did you mean:${colors.reset}`);
+                    for (const s of errorSuggestions) {
+                        console.log(`          ${s}`);
+                    }
+                }
+            }
+            else {
+                console.log(`      ${colors.red}Error: ${errorMsg}${colors.reset}`);
+                if (errorStack) {
+                    const lines = errorStack.split("\n").slice(1);
+                    for (const line of lines) {
+                        const trimmed = line.trim();
+                        if (!trimmed)
+                            continue;
+                        const isFramework = trimmed.includes("/node_modules/") ||
+                            trimmed.includes("/@glubean/runner/") ||
+                            trimmed.includes("internal/modules/");
+                        console.log(`        ${isFramework ? colors.dim : colors.reset}${trimmed}${colors.reset}`);
+                    }
+                }
+            }
         }
+        // Clear error fields after rendering so file:complete's orphan branch
+        // (`!testStarted && errorMsg`) doesn't render this same failure again
+        // and double-count it. The orphan branch is only meant for failures
+        // that happened BEFORE any test started (e.g. harness died during
+        // userModule load) — once we've finalized a started test, the error
+        // belongs to that test alone.
+        errorMsg = undefined;
+        errorStack = undefined;
+        errorReason = undefined;
+        errorMissingPath = undefined;
+        errorSuggestions = undefined;
     };
     // Pre-filter tests by capability profile so file:start can emit the
     // ⊘ lines inline (preserves the pre-migration output layout where these
@@ -803,6 +1077,60 @@ export async function runCommand(target, options = {}) {
     // Files ProjectRunner actually started. Any fileGroups entry that never
     // gets file:start is a fail-fast skip — handled post run:complete.
     const startedFiles = new Set();
+    // Files that are 100% capability-skipped need ⊘ rows emitted manually
+    // because ProjectRunner never starts a file with zero runnable tests
+    // (file:start, which normally renders inline skip rows, won't fire).
+    // We do NOT emit them up-front because that would re-order them ahead of
+    // any earlier runnable files. Instead, we render them lazily — right
+    // before the next runnable file's `file:start` fires (and one final pass
+    // after run:complete for any trailing all-skipped files). This keeps the
+    // visible file order matching `fileGroups` insertion order even in
+    // multi-file fail-fast runs.
+    const fileOrder = Array.from(fileGroups.keys());
+    let nextFileIdx = 0;
+    const emitAllSkippedFilesUpTo = (stopFilePath) => {
+        while (nextFileIdx < fileOrder.length) {
+            const filePath = fileOrder[nextFileIdx];
+            if (filePath === stopFilePath)
+                return;
+            nextFileIdx++;
+            if (runnableByFile.has(filePath))
+                continue;
+            const skips = fileCapabilitySkips.get(filePath);
+            if (!skips || skips.length === 0)
+                continue;
+            if (isMultiFile) {
+                const relPath = relative(process.cwd(), filePath);
+                console.log(`${colors.bold}📁 ${relPath}${colors.reset}`);
+            }
+            for (const { ft, reason } of skips) {
+                skipped++;
+                const name = ft.test.meta.name || ft.test.meta.id;
+                console.log(`  ${colors.yellow}⊘${colors.reset} ${name} ${colors.dim}— skipped (${reason})${colors.reset}`);
+                collectedRuns.push({
+                    testId: ft.test.meta.id,
+                    testName: name,
+                    tags: ft.test.meta.tags,
+                    filePath,
+                    events: [{ type: "status", status: "skipped", reason }],
+                    success: true,
+                    durationMs: 0,
+                    groupId: ft.test.meta.groupId,
+                });
+            }
+            fileCapabilitySkips.delete(filePath);
+            startedFiles.add(filePath);
+        }
+    };
+    // If every selected test was capability-skipped, ProjectRunner has
+    // nothing to do. Running it anyway would still perform session setup,
+    // which on a broken session.ts would mask the skip output behind a
+    // session:setup:failed exit. Drain the skip rows now and short-circuit
+    // to the summary block.
+    const hasRunnable = runnableTests.length > 0;
+    if (!hasRunnable) {
+        emitAllSkippedFilesUpTo(null);
+    }
     const runner = new ProjectRunner({
         rootDir,
         sharedConfig: shared,
@@ -822,7 +1150,10 @@ export async function runCommand(target, options = {}) {
         ...(options.inspectBrk !== undefined && { inspectBrk: options.inspectBrk }),
         metricCollector,
     });
-    for await (const ev of runner.run()) {
+    // Only walk the runner stream when there are runnable tests. The empty
+    // case has already emitted all capability skips above and falls
+    // straight through to the summary.
+    for await (const ev of hasRunnable ? runner.run() : []) {
         switch (ev.type) {
             case "bootstrap:start":
             case "bootstrap:done":
@@ -854,6 +1185,18 @@ export async function runCommand(target, options = {}) {
                 else if (se.type === "log") {
                     console.log(`  ${colors.dim}[session] ${se.message}${colors.reset}`);
                 }
+                else if (se.type === "warning") {
+                    // Plan 1 AC5: render runner-fallback warnings emitted during
+                    // session setup. Only dedupe runner diagnostics (those carry a
+                    // `code` field — see ExecutionEvent.warning schema); user-emitted
+                    // ctx.warn(false, ...) warnings have no code and pass through.
+                    const isRunnerDiag = !!se.code;
+                    if (!isRunnerDiag || !emittedWarnings.has(se.message)) {
+                        if (isRunnerDiag)
+                            emittedWarnings.add(se.message);
+                        console.log(`  ${colors.yellow}⚠ ${se.message}${colors.reset}`);
+                    }
+                }
                 break;
             }
             case "session:setup:done": {
@@ -878,9 +1221,17 @@ export async function runCommand(target, options = {}) {
                 break;
             }
             case "file:start": {
+                // Flush any 100%-skipped files that come before this one in
+                // fileGroups order, so the user sees them in their natural place.
+                emitAllSkippedFilesUpTo(ev.filePath);
+                if (nextFileIdx < fileOrder.length &&
+                    fileOrder[nextFileIdx] === ev.filePath) {
+                    nextFileIdx++;
+                }
                 currentGroupFilePath = ev.filePath;
                 startedFiles.add(ev.filePath);
                 const runnable = runnableByFile.get(ev.filePath) ?? [];
+                currentTestItems = runnable;
                 currentTestMap = new Map(runnable.map((ft) => [ft.test.meta.id, ft]));
                 if (isMultiFile) {
                     const relPath = relative(process.cwd(), ev.filePath);
@@ -913,7 +1264,8 @@ export async function runCommand(target, options = {}) {
                 const event = ev.event;
                 switch (event.type) {
                     case "start": {
-                        const entry = currentTestMap?.get(event.id);
+                        const entry = currentTestMap?.get(event.id) ??
+                            (currentTestItems ? findFileTestByRuntimeId(currentTestItems, event.id) : undefined);
                         testId = event.id;
                         testName = entry?.test.meta.name || event.name || event.id;
                         testItem = entry?.test || null;
@@ -922,6 +1274,10 @@ export async function runCommand(target, options = {}) {
                         assertions = [];
                         success = false;
                         errorMsg = undefined;
+                        errorStack = undefined;
+                        errorReason = undefined;
+                        errorMissingPath = undefined;
+                        errorSuggestions = undefined;
                         peakMemoryMB = undefined;
                         stepAssertionCount = 0;
                         stepTraceLines = [];
@@ -939,6 +1295,10 @@ export async function runCommand(target, options = {}) {
                         success = event.status === "completed";
                         if (event.error) {
                             errorMsg = event.error;
+                            errorStack = event.stack;
+                            errorReason = event.reason;
+                            errorMissingPath = event.missingPath;
+                            errorSuggestions = event.suggestions;
                             addLogEntry("error", event.error);
                         }
                         if (event.peakMemoryMB)
@@ -947,8 +1307,13 @@ export async function runCommand(target, options = {}) {
                         break;
                     case "error":
                         success = false;
-                        if (!errorMsg)
+                        if (!errorMsg) {
                             errorMsg = event.message;
+                            errorStack = event.stack;
+                            errorReason = event.reason;
+                            errorMissingPath = event.missingPath;
+                            errorSuggestions = event.suggestions;
+                        }
                         addLogEntry("error", event.message);
                         break;
                     case "log":
@@ -1082,7 +1447,16 @@ export async function runCommand(target, options = {}) {
                         break;
                     case "warning": {
                         const warnIcon = event.condition ? `${colors.green}✓${colors.reset}` : `${colors.yellow}⚠${colors.reset}`;
-                        console.log(`      ${warnIcon} ${colors.yellow}${event.message}${colors.reset}`);
+                        // Plan 1 AC5: dedupe runner-fallback / protocol-min warnings
+                        // (carry a `code` field — see ExecutionEvent.warning schema).
+                        // User-emitted ctx.warn(false, ...) warnings have no code and
+                        // pass through every time so test authors can see them repeat.
+                        const isRunnerDiag = !!event.code;
+                        if (!isRunnerDiag || !emittedWarnings.has(event.message)) {
+                            if (isRunnerDiag)
+                                emittedWarnings.add(event.message);
+                            console.log(`      ${warnIcon} ${colors.yellow}${event.message}${colors.reset}`);
+                        }
                         break;
                     }
                     case "schema_validation":
@@ -1107,7 +1481,32 @@ export async function runCommand(target, options = {}) {
                 // mid-test or emitted no start event, promote the leftover state
                 // to a visible failure row.
                 if (!testStarted && errorMsg) {
-                    console.log(`  ${colors.red}✗ ${errorMsg}${colors.reset}`);
+                    // Plan 4: rich render for orphan-error case (no leading start event,
+                    // e.g. harness died during userModule import).
+                    if (errorReason === "test_file_missing" && errorMissingPath) {
+                        console.log(`  ${colors.red}✗ Test file not found: ${errorMissingPath}${colors.reset}`);
+                        if (errorSuggestions && errorSuggestions.length > 0) {
+                            console.log(`    ${colors.dim}Did you mean:${colors.reset}`);
+                            for (const s of errorSuggestions) {
+                                console.log(`      ${s}`);
+                            }
+                        }
+                    }
+                    else {
+                        console.log(`  ${colors.red}✗ ${errorMsg}${colors.reset}`);
+                        if (errorStack) {
+                            const lines = errorStack.split("\n").slice(1);
+                            for (const line of lines) {
+                                const trimmed = line.trim();
+                                if (!trimmed)
+                                    continue;
+                                const isFramework = trimmed.includes("/node_modules/") ||
+                                    trimmed.includes("/@glubean/runner/") ||
+                                    trimmed.includes("internal/modules/");
+                                console.log(`    ${isFramework ? colors.dim : colors.reset}${trimmed}${colors.reset}`);
+                            }
+                        }
+                    }
                     failed++;
                 }
                 if (testStarted) {
@@ -1117,6 +1516,13 @@ export async function runCommand(target, options = {}) {
                 }
                 break;
             case "run:complete":
+                // Flush any trailing 100%-skipped files (after the last runnable
+                // file). Under fail-fast, also flush only up to the file that
+                // actually started — files beyond the fail point still belong to
+                // the fail-fast pass below, not to the capability-skip pass.
+                if (failureLimit === undefined || ev.failedCount < failureLimit) {
+                    emitAllSkippedFilesUpTo(null);
+                }
                 // Fail-fast skip display: any file ProjectRunner never started
                 // (because the failure limit kicked in between file groups) gets
                 // the old "○ (skipped — fail-fast)" lines here, preserving the
@@ -1179,9 +1585,15 @@ export async function runCommand(target, options = {}) {
         console.log(`${colors.bold}Stats:${colors.reset}  ${colors.dim}${parts.join("  ·  ")}${colors.reset}`);
     }
     // ── Threshold evaluation ──────────────────────────────────────────────────
+    // Prefer the v1 plan's resolved thresholds when present (profile mode);
+    // fall back to the legacy package.json `thresholds` otherwise. (P2 removes
+    // the legacy source — see docs/06 config consolidation.)
+    const effectiveThresholds = options.thresholds && Object.keys(options.thresholds).length > 0
+        ? options.thresholds
+        : glubeanConfig.thresholds;
     let thresholdSummary;
-    if (glubeanConfig.thresholds && Object.keys(glubeanConfig.thresholds).length > 0) {
-        thresholdSummary = evaluateThresholds(glubeanConfig.thresholds, metricCollector);
+    if (effectiveThresholds && Object.keys(effectiveThresholds).length > 0) {
+        thresholdSummary = evaluateThresholds(effectiveThresholds, metricCollector);
         const { results: thresholdResults, pass: allPass } = thresholdSummary;
         if (thresholdResults.length > 0) {
             console.log(`${colors.bold}Thresholds:${colors.reset}`);
@@ -1208,7 +1620,11 @@ export async function runCommand(target, options = {}) {
         };
         const logContent = [
             `# Glubean Test Log`,
-            `# Target: ${isMultiFile ? resolve(target) : testFiles[0]}`,
+            `# Target: ${isMultiFile
+                ? Array.isArray(target)
+                    ? target.map((t) => resolve(t)).join(", ")
+                    : resolve(target)
+                : testFiles[0]}`,
             `# Run at: ${runStartTime}`,
             `# Tests: ${passed} passed, ${failed} failed`,
             ``,
@@ -1262,7 +1678,7 @@ export async function runCommand(target, options = {}) {
             const tracesPath = resolve(glubeanDir, "traces.json");
             const traceSummary = {
                 runAt: runStartTime,
-                target,
+                target: targetDisplay,
                 files: testFiles.map((f) => relative(process.cwd(), f)),
                 traces: traceCollector,
             };
@@ -1281,7 +1697,7 @@ export async function runCommand(target, options = {}) {
     };
     const resultPayload = {
         context: runContext,
-        target,
+        target: targetDisplay,
         files: testFiles.map((f) => relative(process.cwd(), f)),
         runAt: runStartLocal,
         summary: {
@@ -1337,7 +1753,7 @@ export async function runCommand(target, options = {}) {
             skipped,
             durationMs: totalDurationMs,
         };
-        const xml = toJunitXml(collectedRuns, target, summaryData);
+        const xml = toJunitXml(collectedRuns, targetDisplay, summaryData);
         await mkdir(dirname(junitPath), { recursive: true });
         await writeFile(junitPath, xml, "utf-8");
         console.log(`${colors.dim}JUnit XML written to: ${junitPath}${colors.reset}\n`);
@@ -1397,10 +1813,17 @@ export async function runCommand(target, options = {}) {
         }
         else {
             const { compileScopes, redactEvent, BUILTIN_SCOPES } = await import("@glubean/redaction");
+            // Prefer the v1 plan's full redaction config when supplied
+            // (Phase 4 init scaffolds `defaults.redaction` in glubean.yaml,
+            // including any custom globalRules / sensitiveKeys / customPatterns).
+            // The legacy loadConfig path doesn't read glubean.yaml — without
+            // this, custom rules would be silently ignored and matching
+            // secrets could be sent to Cloud.
+            const effectiveRedaction = options.redactionConfig ?? glubeanConfig.redaction;
             const compiledScopes = compileScopes({
                 builtinScopes: BUILTIN_SCOPES,
-                globalRules: glubeanConfig.redaction.globalRules,
-                replacementFormat: glubeanConfig.redaction.replacementFormat,
+                globalRules: effectiveRedaction.globalRules,
+                replacementFormat: effectiveRedaction.replacementFormat,
             });
             // Generate metadata for test registry
             let metadata;
@@ -1417,21 +1840,48 @@ export async function runCommand(target, options = {}) {
             catch {
                 // Non-critical: upload results without metadata
             }
+            // Phase 5 5a — attach run-plan provenance to the upload metadata
+            // bucket. Cloud server projects this to top-level RunEntity fields
+            // (see apps/server/src/tasks/helpers/extract-run-plan.ts). Nested
+            // under `metadata` to clear the server DTO's `forbidNonWhitelisted`
+            // top-level gate. Only emitted when:
+            //   1. The run used a profile (no profile → nothing to record).
+            //   2. The scan path produced metadata.
+            // Skipping runPlan in the degraded-scan path is intentional —
+            // synthesizing a runPlan-only shell with `files: {}` would make
+            // the server's upsertTests treat all active tests as "removed"
+            // (authoritative file map = empty). Better to lose runPlan
+            // provenance on degraded scans than to corrupt the test registry.
+            if (metadata && options.profile) {
+                const runPlan = {
+                    profile: options.profile,
+                };
+                if (options.suites && options.suites.length > 0) {
+                    runPlan.suites = options.suites;
+                }
+                metadata = { ...metadata, runPlan };
+            }
             const redactedPayload = {
                 ...resultPayload,
                 metadata,
                 tests: resultPayload.tests.map((t) => ({
                     ...t,
-                    events: t.events.map((e) => redactEvent(e, compiledScopes, glubeanConfig.redaction.replacementFormat)),
+                    events: t.events.map((e) => redactEvent(e, compiledScopes, effectiveRedaction.replacementFormat)),
                 })),
             };
-            await uploadToCloud(redactedPayload, {
+            const uploadReceipt = await uploadToCloud(redactedPayload, {
                 apiUrl,
                 token,
                 projectId,
                 envFile: effectiveRun.envFile,
                 rootDir,
             });
+            if (options.uploadReceiptJson) {
+                const receiptPath = resolveOutputPath(options.uploadReceiptJson, process.cwd());
+                await mkdir(dirname(receiptPath), { recursive: true });
+                await writeFile(receiptPath, JSON.stringify(uploadReceipt, null, 2) + "\n", "utf-8");
+                console.log(`${colors.dim}Upload receipt written to: ${receiptPath}${colors.reset}`);
+            }
         }
     }
     if (failed > 0 || (thresholdSummary && !thresholdSummary.pass)) {