@glubean/cli 0.5.0 → 0.8.0

package/dist/commands/run.js

@@ -7,8 +7,9 @@ import { loadProjectEnv } from "@glubean/runner";
 import { resolveEnvFileName } from "../lib/active_env.js";
 import { shouldSkipTest } from "../lib/skip.js";
 import { CLI_VERSION } from "../version.js";
+import { redactMetadataForUpload } from "../lib/redact-metadata.js";
 import { extractContractCases, extractFromSource } from "@glubean/scanner/static";
-import { extractContractFromFile, findTemplateMatch, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
+import { buildSuffixes, classifyByStem, extractContractFromFile, findTemplateMatch, GLUBEAN_KINDS, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
 import { applyEnvTemplating } from "@glubean/runner";
 // ANSI color codes for pretty output
 const colors = {
@@ -27,7 +28,7 @@ const CLOUD_MEMORY_LIMITS = {
     pro: 700,
 };
 const MEMORY_WARNING_THRESHOLD_MB = CLOUD_MEMORY_LIMITS.free * 0.67;
-async function findProjectConfig(startDir) {
+export async function findProjectConfig(startDir) {
     let dir = startDir;
     while (dir !== "/") {
         try {
@@ -49,29 +50,6 @@ async function findProjectConfig(startDir) {
     // No glubean project found — use the starting directory (scratch mode)
     return { rootDir: startDir };
 }
-/**
- * True if a flow's extracted step tree contains a branch (condition / switch) or
- * a poll (bounded poll-until). Recurses into branch cases/default so a poll
- * nested inside a branch body is caught too.
- *
- * Used to gate `--upload`: Glubean Cloud cannot render `kind:"branch"` or
- * `kind:"poll"` flows yet, and uploading would silently drop them (local run view
- * ≠ Cloud view), so we refuse rather than mislead. See contract-flow-condition.md
- * §12 / contract-flow-poll.md §8.
- */
-function flowStepsHaveBranchOrPoll(steps) {
-    if (!steps)
-        return false;
-    for (const s of steps) {
-        if (s.kind === "branch" || s.kind === "poll")
-            return true;
-        if (s.cases && s.cases.some((c) => flowStepsHaveBranchOrPoll(c.steps)))
-            return true;
-        if (s.default && flowStepsHaveBranchOrPoll(s.default))
-            return true;
-    }
-    return false;
-}
 // Config consolidation (docs/06): the package.json `glubean` field is no
 // longer a config source. Warn (don't error) when one lingers so users
 // migrate it into glubean.yaml instead of wondering why it stopped working.
@@ -99,15 +77,27 @@ function isGlob(target) {
 // calls execute and register overlays before discovery runs (attachment-
 // model §7.4). `discoverTests()` is responsible for distinguishing
 // bootstrap-only files from runnable-emitting ones.
-const TEST_FILE_SUFFIXES = [
-    ".test.ts",
-    ".contract.ts",
-    ".flow.ts",
-    ".bootstrap.ts",
-];
+// CLI target resolution for `glubean run` recognizes only `.ts` files across the
+// test-runner kinds (including bootstrap), derived from the canonical kind
+// registry (scanner/kinds.ts). `load` is EXCLUDED here: load plans run through
+// the dedicated `glubean load` command + the closed-model orchestrator, not the
+// per-test ProjectRunner, so `glubean run ./dir` must not sweep in `.load.ts`.
+const TEST_FILE_SUFFIXES = GLUBEAN_KINDS.filter((k) => k.kind !== "load").flatMap((k) => buildSuffixes(k.stems, [".ts"]));
 function isGlubeanTestFile(name) {
     return TEST_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
 }
+// Files that carry contract/workflow DECLARATIONS and are safe to
+// runtime-import for extraction. Matched by SUFFIX, not substring: a normal
+// test like `checkout.workflow.test.ts` ends in `.test.ts` and must stay on
+// the static test path — a `.workflow.` substring would mis-route it into
+// contract extraction (which ignores `test()` exports), silently dropping its
+// tests (codex 0.6 P2).
+// Contract/workflow/flow artifact files (NOT bootstrap), all extensions —
+// derived from the canonical kind registry (scanner/kinds.ts).
+const RUNTIME_ARTIFACT_SUFFIXES = GLUBEAN_KINDS.filter((k) => k.runtimeArtifact && k.kind !== "bootstrap").flatMap((k) => buildSuffixes(k.stems));
+function isRuntimeExtractableArtifact(name) {
+    return RUNTIME_ARTIFACT_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 function isBootstrapOnlyFile(name) {
     return name.endsWith(".bootstrap.ts");
 }
@@ -126,15 +116,8 @@ async function walkTestFiles(dir, result) {
     }
 }
 export function classifyGlubeanFile(filePath) {
-    if (filePath.endsWith(".test.ts"))
-        return "test";
-    if (filePath.endsWith(".contract.ts"))
-        return "contract";
-    if (filePath.endsWith(".flow.ts"))
-        return "flow";
-    if (filePath.endsWith(".bootstrap.ts"))
-        return "bootstrap";
-    return undefined;
+    // `.ts`-only classification, by stem, from the canonical kind registry.
+    return classifyByStem(filePath, [".ts"]);
 }
 async function resolveSingleTarget(target) {
     const abs = resolve(target);
@@ -230,6 +213,14 @@ export async function resolveTestFilesForSuite(target, kinds) {
     // `.flow.ts` file (recommended canonical layout) or declare the
     // suite as `kinds: [contract, flow]` so both candidate file types
     // are scanned and the runnable-level filter sorts them out.
+    //
+    // The same applies to a vNext workflow authored in a `.test.ts`
+    // (workflows ride the "flow" RUNNABLE kind, codex S2.6 R10/R11): a
+    // strict `kinds: [flow]` suite won't see the file. Move the workflow
+    // to a `.flow.ts` (recommended — it also gains the metadata
+    // projection, which `.test.ts` files never get) or declare
+    // `kinds: [test, flow]`; the runnable-level filter then keeps the
+    // workflow and drops the plain test() exports.
     return files.filter((f) => {
         const k = classifyGlubeanFile(f);
         if (k === undefined)
@@ -251,16 +242,21 @@ export async function discoverTests(filePath) {
         return [];
     }
     const content = await readFile(filePath, "utf-8");
-    if (filePath.includes(".contract.") || filePath.includes(".flow.")) {
+    if (isRuntimeExtractableArtifact(filePath)) {
         // Runtime extraction via shared function (supports .with() syntax).
-        // Returns BOTH contracts and flows; v0.2+ flow files often export only
-        // flows, so we must emit one DiscoveredTest per flow in addition to
-        // per contract case.
+        // Returns BOTH contracts and workflows; `.workflow.ts` / `.flow.ts` files
+        // often export only workflows, so we must emit one DiscoveredTest per
+        // workflow in addition to per contract case.
         const result = await extractContractFromFile(filePath);
         const results = [];
         for (const ec of result.contracts) {
             const contractTags = ec.tags ?? [];
             for (const c of ec.cases) {
+                // Non-runnable cases (direction: "inbound", design §9.5): the SDK
+                // registered no Test — advertising them here would schedule an id
+                // that can never resolve (codex I2 R1 P1).
+                if (c.runnable === false)
+                    continue;
                 // Mirror SDK dispatchContract: finalTags = contract + case + runtime
                 // synthetic. Without this, pre-spawn excludeTags / --tag filtering
                 // skips contract cases entirely (Phase 1 filter reads meta.tags).
@@ -292,22 +288,28 @@ export async function discoverTests(filePath) {
                 });
             }
         }
-        // Each flow has a single orchestrator Test (setup → steps → teardown).
-        // Discover it as one runnable entry with the flow id. Post-Phase 2f
-        // flows live as `kind: "flow"` entries inside `result.attachments`.
-        // SDK maps FlowMeta.skip → TestMeta.deferred (string reason); mirror
-        // that here so the runner's deferred-skip path applies uniformly.
-        for (const att of result.attachments) {
-            if (att.kind !== "flow")
-                continue;
+        // vNext workflows (S2.6): each BuiltWorkflow wraps the graph in ONE
+        // simple test — discover it like a flow orchestrator, so a file whose
+        // projection scan/upload advertises is also runnable (codex S2.6 R2 P2).
+        // During the migration window workflows ride the "flow" runnable kind:
+        // a workflow IS the vNext orchestrator replacing contract.flow(), and
+        // suites declaring `kinds: [flow]` mean "run the graph orchestrators in
+        // these files" — no new user-facing kinds enum until flow is deleted.
+        // WorkflowMeta.skip → deferred mirrors the SDK's own Test wrapping.
+        for (const wf of result.workflows) {
             results.push({
-                exportName: att.exportName,
+                exportName: wf.exportName,
                 meta: {
-                    id: att.flow.id,
-                    description: att.flow.description,
-                    tags: att.flow.tags,
-                    only: att.flow.only,
-                    deferred: att.flow.skip,
+                    id: wf.id,
+                    name: wf.name,
+                    description: wf.description,
+                    tags: wf.tags,
+                    only: wf.only,
+                    deferred: wf.skip,
+                    // data-driven members: grouping + concurrency ride the projection
+                    // (codex S2.12 R1 P2 — the registry alone never reaches the CLI).
+                    ...(wf.groupId ? { groupId: wf.groupId } : {}),
+                    ...(wf.parallel ? { parallel: true } : {}),
                     kind: "flow",
                 },
             });
@@ -318,17 +320,26 @@ export async function discoverTests(filePath) {
         // contain ONLY contract.http(...). Stricter than MCP's gate: CLI
         // emits flows as runnable tests via discoverTests, so silently
         // dropping `contract.flow(...)` would hide an actual test. Any
-        // non-HTTP usage (including flow) → fail closed and surface the
-        // import error so the user knows discovery is degraded.
+        // non-HTTP usage (including flow, and a vNext workflow(...) — codex
+        // S2.6 R6 P2) → fail closed and surface the import error so the user
+        // knows discovery is degraded.
         if (result.errors.length > 0) {
             // Allow whitespace/newlines between `contract` and `.method` so the
             // common fluent style `contract\n  .flow(...)` still trips the gate.
             const hasHttp = /contract\s*\.\s*http\b/i.test(content);
             const hasNonHttp = /contract\s*\.\s*(?!http\b)\w+\s*[.(]/i.test(content);
-            const contracts = hasHttp && !hasNonHttp ? extractContractCases(content) : [];
+            // Import-clause check catches aliased workflow imports too
+            // (`import { workflow as wf }` — codex S2.6 R8 P2).
+            const hasWorkflow = /\bworkflow\s*\(/.test(content) ||
+                /import\s[^;]*?\{[^}]*\bworkflow\b[^}]*\}/.test(content);
+            const contracts = hasHttp && !hasNonHttp && !hasWorkflow ? extractContractCases(content) : [];
             if (contracts.length > 0) {
                 for (const c of contracts) {
                     for (const caseItem of c.cases) {
+                        // Static-fallback mirror of the runnable filter above (the AST
+                        // extractor marks inboundCase()/direction literals).
+                        if (caseItem.direction === "inbound")
+                            continue;
                         const requires = caseItem.requires ?? "headless";
                         const defaultRun = caseItem.defaultRun ??
                             (requires !== "headless" ? "opt-in" : "always");
@@ -397,7 +408,16 @@ export async function discoverTests(filePath) {
                 parallel: m.parallel,
                 requires: m.requires,
                 defaultRun: m.defaultRun,
-                kind: "test",
+                // A vNext workflow is a graph orchestrator — it rides the "flow"
+                // RUNNABLE kind even when authored in a .test.ts, so the
+                // runnable-level suite filter and the --upload gate treat it like a
+                // flow (codex S2.6 R10 P2). NOTE: the FILE-level suite filter still
+                // maps .test.ts ↔ "test" (see resolveTestFilesForSuite's KNOWN
+                // LIMITATION) — a strict kinds:[flow] suite needs the workflow in a
+                // .flow.ts, or kinds:[test, flow].
+                kind: m.workflow ? "flow" : "test",
+                // WorkflowMeta.skip reason → deferred.
+                ...(m.deferred !== undefined ? { deferred: m.deferred } : {}),
             },
         };
     });
@@ -414,7 +434,7 @@ function matchesFilter(testItem, filter) {
 export const __testing = {
     matchesTags: (...args) => matchesTags(...args),
     matchesExcludeTags: (...args) => matchesExcludeTags(...args),
-    flowStepsHaveBranchOrPoll: (...args) => flowStepsHaveBranchOrPoll(...args),
+    isGlubeanTestFile: (name) => isGlubeanTestFile(name),
 };
 function matchesTags(testItem, tags, mode = "or") {
     if (!testItem.meta.tags?.length)
@@ -508,7 +528,7 @@ export async function runCommand(target, options = {}) {
     const targetDisplay = Array.isArray(target) ? target.join(", ") : target;
     if (testFiles.length === 0) {
         console.error(`\n${colors.red}❌ No test files found for target: ${Array.isArray(target) ? target.join(", ") : target}${colors.reset}`);
-        console.error(`${colors.dim}Glubean looks for files matching *.test.ts, *.contract.ts, or *.flow.ts in the target directory.${colors.reset}`);
+        console.error(`${colors.dim}Glubean looks for files matching *.test.ts, *.contract.ts, *.workflow.ts, or *.flow.ts in the target directory.${colors.reset}`);
         console.error(`${colors.dim}Run "glubean run tests/" or "glubean run path/to/file.test.ts".${colors.reset}\n`);
         await writeEmptyResult(target, runStartLocal);
         process.exit(1);
@@ -761,48 +781,13 @@ export async function runCommand(target, options = {}) {
         }
         console.log(`${colors.dim}${parts.join(" + ")} (${testsToRun.length}/${totalDiscovered} tests)${colors.reset}`);
     }
-    // ── Gate: Cloud cannot yet render branch (condition/switch) flows ──────
-    // Operate on the POST-FILTER selected runnables (`testsToRun`) so a branch
-    // flow that was filtered out (--filter / tags / .only / suite kinds) does not
-    // block an otherwise-branchless upload. Uploading a branch flow would
-    // silently drop its branches server-side (Cloud run view ≠ local), so refuse
-    // before running and name the offending flows. Bootstrap already ran, so
-    // plugin-backed files re-extract from Node's cache cleanly.
-    // (contract-flow-condition.md §12 / Spike 6.)
-    if (options.upload) {
-        // Exclude deferred (FlowMeta.skip → meta.deferred) flows: they don't
-        // execute — only a skipped row is uploaded — so their branches never reach
-        // Cloud and they must not block the upload.
-        const selectedFlows = testsToRun.filter((ft) => ft.test.meta.kind === "flow" && !ft.test.meta.deferred);
-        if (selectedFlows.length > 0) {
-            // Map each selected flow's source file → the set of its branch/poll flow ids.
-            const branchIdsByFile = new Map();
-            for (const filePath of new Set(selectedFlows.map((ft) => ft.filePath))) {
-                try {
-                    const extracted = await extractContractFromFile(filePath);
-                    const ids = new Set();
-                    for (const att of extracted.attachments ?? []) {
-                        if (att.kind === "flow" && flowStepsHaveBranchOrPoll(att.flow.steps))
-                            ids.add(att.flow.id);
-                    }
-                    branchIdsByFile.set(filePath, ids);
-                }
-                catch {
-                    // Real import/extraction errors are surfaced by discovery above.
-                }
-            }
-            const branchFlows = selectedFlows.filter((ft) => branchIdsByFile.get(ft.filePath)?.has(ft.test.meta.id));
-            if (branchFlows.length > 0) {
-                console.error(`${colors.red}Error: --upload does not yet support branch (condition/switch) or poll flows.${colors.reset}`);
-                console.error(`${colors.dim}Glubean Cloud can't render these flows yet, and uploading would silently drop their branches/polls:${colors.reset}`);
-                for (const ft of branchFlows) {
-                    console.error(`${colors.dim}  - ${ft.test.meta.id} (${ft.exportName}) [${relative(process.cwd(), ft.filePath)}]${colors.reset}`);
-                }
-                console.error(`${colors.dim}Run without --upload, or remove condition/switchOn/switchCond/poll from these flows, until Cloud support lands.${colors.reset}`);
-                process.exit(1);
-            }
-        }
-    }
+    // NOTE (0.6, owner): the run-view upload is UNCONDITIONAL — branch/poll
+    // workflows upload like any other. The earlier OPTION D gate refused them
+    // because Cloud "couldn't render" branch/poll run views, but refusing the
+    // upload is the wrong trade: uploading is always correct, and Cloud degrades
+    // gracefully (render raw + the projected `note`/`message` on opaque nodes)
+    // until a richer run view lands. The projection already uploads whole
+    // (branch/poll included), so the run view simply joins it.
     console.log(`\n${colors.bold}Running ${testsToRun.length} test(s)...${colors.reset}\n`);
     // ── Spike 3: runner input channels (attachment-model §8) ────────────────
     // `--input-json` / `--bootstrap-json` / `--force-standalone` apply to a
@@ -1949,6 +1934,12 @@ export async function runCommand(target, options = {}) {
                 const built = await buildMetadata(scanResult, {
                     generatedBy: `@glubean/cli@${CLI_VERSION}`,
                     projectId,
+                    // Upload path only: carry the lossless full CONTRACT projection for
+                    // the Cloud c/f metadata snapshot. Deep-redacted below before upload;
+                    // never written to the on-disk metadata.json (that path omits it).
+                    // `workflows` is always present (Design Y) and redacted in the same
+                    // pass below.
+                    includeProjection: true,
                 });
                 metadata = built;
             }
@@ -1976,6 +1967,20 @@ export async function runCommand(target, options = {}) {
                 }
                 metadata = { ...metadata, runPlan };
             }
+            // Deep-redact the FULL contract + workflow projection before upload. Test
+            // events are redacted below via scope-based `redactEvent`, but the
+            // projection is a free-form tree that can carry secrets anywhere
+            // (examples, default headers, gRPC metadata, `extensions`/`meta`, literal
+            // compare/switch values, assertion messages). `redactMetadataForUpload`
+            // redacts ONLY the projection buckets (contractsProjection + workflows) —
+            // never `files`/`rootHash` — so the server's test registry/dedup keeps
+            // its verbatim sha256 hashes. The projection is uploaded WHOLE (branch/
+            // poll included): it is the lossless source for the server snapshot, not
+            // a run view (see the buildMetadata R14 note); the branch/poll run-view
+            // gate is a separate layer, untouched here.
+            if (metadata) {
+                metadata = await redactMetadataForUpload(metadata, effectiveRedaction);
+            }
             const redactedPayload = {
                 ...resultPayload,
                 metadata,