@sensigo/realm-cli 0.39.0 → 0.41.0

package/dist/commands/register.js

@@ -4,18 +4,40 @@
 // against the resolved adapters' config_schema (two-pass) BEFORE anything is persisted.
 import { Command } from 'commander';
 import { join } from 'node:path';
-import { loadWorkflowFromFileWithDiagnostics, JsonWorkflowStore, resolveSeverity, } from '@sensigo/realm';
+import { loadWorkflowFromFileWithDiagnostics, renderLoaderWarning, JsonWorkflowStore, WorkflowError, } from '@sensigo/realm';
 import { loadProjectExtensions, } from '../extensions/load-project-extensions.js';
 import { ManifestSecretsError } from '../extensions/manifest-secrets.js';
-import { printLoaderWarnings, rejectOnErrorSeverity, failsStrict } from '../lib/loader-warnings.js';
-/** Wraps loadProjectExtensions' sentinel-credential warnings as LoaderWarning (issue #169). */
-function wrapSentinelWarnings(sentinelWarnings) {
-    return (sentinelWarnings ?? []).map((message) => ({
-        code: 'EXTENSION_SENTINEL',
-        severity: resolveSeverity('EXTENSION_SENTINEL'),
-        scope: 'workflow',
-        message: `⚠  ${message}`,
-    }));
+import { printLoaderWarnings, rejectOnErrorSeverity, failsStrict, renderLoadFailure, renderEscalationLine, wrapSentinelWarnings, } from '../lib/loader-warnings.js';
+/**
+ * Tags a failure thrown by the extensions load inside `loadWorkflowForRegistration` so the
+ * callers' catches can say `Error loading extensions:` — the sentence run and validate already
+ * print for this class (issue #451) — without guessing from the message. The message is the
+ * original's, byte for byte (register-extensions.test.ts's broken-module cell matches on it
+ * THROUGH this wrapper), and the original rides along as `cause`.
+ *
+ * Minted at exactly the two throw paths out of the extensions block: the real-mode load's
+ * non-secrets failure, and the sentinel retry. The retry can never throw ManifestSecretsError
+ * itself (sentinel mode resolves every name without reading a source), so nothing is wrapped
+ * twice. A WorkflowError from the two-pass re-validation is thrown OUTSIDE the block and keeps
+ * the family split.
+ *
+ * Carries the workflow's own pass-1 loader warnings (issue #463 — the #424 carry shape on this
+ * vehicle) so the catch that renders the sentence can print them FIRST, instead of the author
+ * fixing the module, re-running, and only then learning about the typo. ABSENT, never `[]`: a
+ * construction that passes no warnings, or an empty list, leaves the field unset.
+ *
+ * @internal Exported for watch.ts and for tests.
+ */
+export class ExtensionLoadError extends Error {
+    warnings;
+    constructor(original, warnings) {
+        super(original instanceof Error ? original.message : String(original), { cause: original });
+        this.name = 'ExtensionLoadError';
+        // The if-guard form on purpose: a ternary to `undefined` is a TS2412 under the repo's
+        // exactOptionalPropertyTypes (lane-executed, #463).
+        if (warnings !== undefined && warnings.length > 0)
+            this.warnings = [...warnings];
+    }
 }
 /**
  * Loads and validates a workflow for registration. Extension-declaring workflows get the
@@ -25,6 +47,7 @@ function wrapSentinelWarnings(sentinelWarnings) {
  * both callers (register's action, watch's registerFile) decide how to surface/act on warnings
  * (register supports `--strict` + the dormant #170 reject; watch just prints and continues).
  * @throws on any validation or extension-load failure — nothing is persisted on throw.
+ *         Extension-load failures are tagged `ExtensionLoadError` (issue #451).
  */
 export async function loadWorkflowForRegistration(filePath) {
     const { definition, warnings: pass1Warnings } = loadWorkflowFromFileWithDiagnostics(filePath);
@@ -37,11 +60,20 @@ export async function loadWorkflowForRegistration(filePath) {
         loaded = await loadProjectExtensions(definition);
     }
     catch (err) {
+        // The guard is the degradation itself: only a secrets failure degrades, everything else is an
+        // extension-load failure and leaves tagged (issue #451). Dropping the conditional kills
+        // degradation — register-extensions.test.ts's sentinel control is the cell in this command's
+        // own home that sees it (the manifest E2E in extensions/ does too, one substring deep).
         if (!(err instanceof ManifestSecretsError))
-            throw err;
-        console.warn(`⚠  ${err.message}`);
-        console.warn('⚠  Registering with SENTINEL credentials — execution paths still require real secret resolution.');
-        loaded = await loadProjectExtensions(definition, { secretMode: 'sentinel' });
+            throw new ExtensionLoadError(err, pass1Warnings);
+        console.warn(`⚠ ${err.message}`);
+        console.warn('⚠ Registering with SENTINEL credentials — execution paths still require real secret resolution.');
+        try {
+            loaded = await loadProjectExtensions(definition, { secretMode: 'sentinel' });
+        }
+        catch (err) {
+            throw new ExtensionLoadError(err, pass1Warnings);
+        }
     }
     // Two-pass: re-validate with the resolved registry so step config is checked against
     // each adapter's config_schema before the definition is persisted. Its warnings are proven
@@ -63,16 +95,20 @@ export const registerCommand = new Command('register')
         : join(inputPath, 'workflow.yaml');
     try {
         const { definition, warnings } = await loadWorkflowForRegistration(filePath);
-        // Dormant issue #170 boundary-reject: inert today (DEFAULT_POLICY has no 'error' entries).
+        // The issue #170 boundary-reject, LIVE since the flip — checked before --strict, so an
+        // unknown key is refused with or without the flag. Store-registered definitions already in
+        // the registry are never re-parsed and are unaffected.
         if (rejectOnErrorSeverity(warnings)) {
             printLoaderWarnings(warnings);
-            console.error(`Error: '${definition.id}' has a warning escalated to an error by policy — refusing to register.`);
+            // One grammar with validate (issue #451): the line names WHICH warning escalated. The id
+            // the old line carried is not missed — the operator just typed the path.
+            console.error(renderEscalationLine(warnings));
             process.exit(1);
             return;
         }
         if (opts.strict && failsStrict(warnings)) {
             printLoaderWarnings(warnings);
-            console.error(`Error: '${definition.id}' v${definition.version} has ${warnings.length} warning(s); refusing to register due to --strict`);
+            console.error(`Error: '${definition.id}' v${definition.version} has ${warnings.length} ${warnings.length === 1 ? 'warning' : 'warnings'}; refusing to register due to --strict`);
             process.exit(1);
             return;
         }
@@ -81,16 +117,50 @@ export const registerCommand = new Command('register')
         printLoaderWarnings(warnings);
         const contextWarnings = lintWorkflowContext(definition);
         for (const warning of contextWarnings) {
-            console.warn(`⚠  ${warning}`);
+            console.warn(`⚠ ${warning}`);
         }
-        console.log(`Registered: ${definition.id} v${definition.version} (${Object.keys(definition.steps).length} steps)`);
+        const stepCount = Object.keys(definition.steps).length;
+        console.log(`Registered: ${definition.id} v${definition.version} (${stepCount} ${stepCount === 1 ? 'step' : 'steps'})`);
         if (definition.description !== undefined) {
             console.log(`  ${definition.description}`);
         }
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        console.error(`Error: ${message}`);
+        // issue #424 — see the comment at validate.ts's extension-free catch. This is the ONLY
+        // render site for a loader failure here: the ManifestSecretsError catch above rethrows
+        // into this one, so rendering there too would double-print.
+        if (err instanceof WorkflowError && err.warnings !== undefined) {
+            printLoaderWarnings(err.warnings);
+        }
+        // issue #451 — an extensions-load failure gets the sentence run and validate print for it.
+        // First arm by placement only: an ExtensionLoadError is never a WorkflowError, so the
+        // order against the family split below is immaterial.
+        if (err instanceof ExtensionLoadError) {
+            // issue #463 — the workflow's own warnings first, then the sentence (the #424 catch-render
+            // shape). The PLAIN render, not printLoaderWarnings: that helper rewrites `— ignored` to
+            // `— REFUSED below` for the codes this boundary refuses, and on this path the escalation
+            // gate never ran — the refusal below is the extensions error, so "REFUSED below" would name
+            // the wrong cause. `— ignored` is the core's statement about the PARSE, true here as on
+            // every surface, and the composition then reads exactly as `realm run` prints it
+            // (test.ts's render comment — #450's reasoning, generalized).
+            if (err.warnings !== undefined) {
+                for (const w of err.warnings)
+                    console.warn(renderLoaderWarning(w));
+            }
+            console.error(`Error loading extensions: ${err.message}`);
+        }
+        // issue #425 — THE FAMILY SPLIT. An `Invalid workflow:` message announces itself, so it
+        // renders verbatim through the shared helper (which also lists a multi-error throw one per
+        // line). Everything else this catch can see — a store failure, an unreadable path —
+        // announces nothing on its own, so it keeps the prefix that earns its place (#417). The
+        // predicate carries the colon, byte-matching the helper's own check.
+        else if (err instanceof WorkflowError && err.message.startsWith('Invalid workflow:')) {
+            console.error(renderLoadFailure(err));
+        }
+        else {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Error: ${message}`);
+        }
         process.exit(1);
     }
 });

package/dist/commands/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,iBAAiB,EACjB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,GAEtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAEpG,+FAA+F;AAC/F,SAAS,oBAAoB,CAAC,gBAAsC;IAClE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,oBAA6B;QACnC,QAAQ,EAAE,eAAe,CAAC,oBAAoB,CAAC;QAC/C,KAAK,EAAE,UAAmB;QAC1B,OAAO,EAAE,MAAM,OAAO,EAAE;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB;IAEhB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9F,sFAAsF;IACtF,wFAAwF;IACxF,uFAAuF;IACvF,iDAAiD;IACjD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;YAAE,MAAM,GAAG,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CACV,kGAAkG,CACnG,CAAC;QACF,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,4DAA4D;IAC5D,mCAAmC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/D,OAAO;QACL,UAAU;QACV,QAAQ,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,MAAM,CACL,UAAU,EACV,oFAAoF,CACrF;KACA,WAAW,CAAC,gCAAgC,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,IAA0B,EAAE,EAAE;IAC9D,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAE7E,2FAA2F;QAC3F,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,CAAC,KAAK,CACX,WAAW,UAAU,CAAC,EAAE,yEAAyE,CAClG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,CAAC,KAAK,CACX,WAAW,UAAU,CAAC,EAAE,MAAM,UAAU,CAAC,OAAO,QAAQ,QAAQ,CAAC,MAAM,mDAAmD,CAC3H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CACtG,CAAC;QACF,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2CAA2C;AAC3C,MAAM,UAAU,mBAAmB,CAAC,UAA8B;IAChE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,sFAAsF;IACtF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC/D,CAAC;IACF,yEAAyE;IACzE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,MAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1C,CAAC,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,oBAAoB,IAAI,qBAAqB,QAAQ,OAAO,oBAAoB,CAAC,MAAM,GAAG;gBACxF,iFAAiF;gBACjF,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,0FAA0F;AAC1F,4FAA4F;AAC5F,wFAAwF;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,GACd,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,GAEtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,QAAQ,CAA4B;IAE7C,YAAY,QAAiB,EAAE,QAAmC;QAChE,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,sFAAsF;QACtF,oDAAoD;QACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACnF,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB;IAEhB,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9F,sFAAsF;IACtF,wFAAwF;IACxF,uFAAuF;IACvF,iDAAiD;IACjD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8FAA8F;QAC9F,wFAAwF;QACxF,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,4DAA4D;IAC5D,mCAAmC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/D,OAAO;QACL,UAAU;QACV,QAAQ,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC;KACnD,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;KACtE,MAAM,CACL,UAAU,EACV,oFAAoF,CACrF;KACA,WAAW,CAAC,gCAAgC,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,IAA0B,EAAE,EAAE;IAC9D,MAAM,QAAQ,GACZ,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAE7E,uFAAuF;QACvF,2FAA2F;QAC3F,uDAAuD;QACvD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC9B,yFAAyF;YACzF,yEAAyE;YACzE,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,CAAC,KAAK,CACX,WAAW,UAAU,CAAC,EAAE,MAAM,UAAU,CAAC,OAAO,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,wCAAwC,CAClK,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,CAAC,GAAG,CACT,eAAe,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAC3G,CAAC;QACF,IAAI,UAAU,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,uFAAuF;QACvF,4DAA4D;QAC5D,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/D,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,2FAA2F;QAC3F,sFAAsF;QACtF,sDAAsD;QACtD,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,2FAA2F;YAC3F,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,wFAAwF;YACxF,iFAAiF;YACjF,8DAA8D;YAC9D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,oFAAoF;QACpF,wFAAwF;QACxF,qEAAqE;aAChE,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2CAA2C;AAC3C,MAAM,UAAU,mBAAmB,CAAC,UAA8B;IAChE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,sFAAsF;IACtF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAC/D,CAAC;IACF,yEAAyE;IACzE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,MAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1C,CAAC,MAAM,CAAC;QACT,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,oBAAoB,IAAI,qBAAqB,QAAQ,OAAO,oBAAoB,CAAC,MAAM,GAAG;gBACxF,iFAAiF;gBACjF,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/commands/respond.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,EACtF,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,iBAAiB,EAChC,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC/C;AAED,eAAO,MAAM,cAAc,SA6BxB,CAAC"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/commands/respond.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAIxD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,EACtF,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,iBAAiB,EAChC,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC/C;AAED,eAAO,MAAM,cAAc,SAwDxB,CAAC"}

package/dist/commands/respond.js

@@ -17,6 +17,8 @@ export async function respondToGate(runId, options, runStore, workflowStore, reg
     // which COMPLETES the run fires its finalizers with project handlers — consistent with
     // `realm run`. Same options/cwd handling as run.ts; reuses loadProjectExtensions so the
     // orphan-manifest topology guard is honoured (no hand-rolled registry).
+    // Production always passes `registry` now (issue #466's action hoist) — this fallback is the
+    // test/direct-caller seam, kept for callers that resolve their own (none in production today).
     const effectiveRegistry = registry ??
         (await loadProjectExtensions(workflow, {
             ...(options.extensionsModule !== undefined
@@ -53,7 +55,27 @@ export const respondCommand = new Command('respond')
     const runStore = new JsonFileStore();
     const workflowStore = new JsonWorkflowStore();
     try {
-        const { choice, newState } = await respondToGate(runId, opts, runStore, workflowStore);
+        // issue #466 — the run/workflow fetches stay OUTSIDE the sentence-try: a bad run-id is
+        // respond's most common operator error, and it must never wear the extensions sentence
+        // (the naked catch below is its home, #477). Only the extension resolution itself is
+        // wrapped, in place, mirroring run.ts's exact arm.
+        const run = await runStore.get(runId);
+        const workflow = await workflowStore.get(run.workflow_id);
+        let registry;
+        try {
+            ({ registry } = await loadProjectExtensions(workflow, {
+                ...(opts.extensionsModule !== undefined
+                    ? { overrideModule: opts.extensionsModule }
+                    : {}),
+                projectDir: opts.project ?? process.cwd(),
+            }));
+        }
+        catch (err) {
+            console.error(`Error loading extensions: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+            return;
+        }
+        const { choice, newState } = await respondToGate(runId, opts, runStore, workflowStore, registry);
         console.log(`Responded: ${runId} | choice '${choice}' | new state '${newState}'`);
     }
     catch (err) {

package/dist/commands/respond.js.map

@@ -1 +1 @@
-{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/commands/respond.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,OAAsF,EACtF,QAAkB,EAClB,aAAgC,EAChC,QAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,uFAAuF;IACvF,wFAAwF;IACxF,wEAAwE;IACxE,MAAM,iBAAiB,GACrB,QAAQ;QACR,CACE,MAAM,qBAAqB,CAAC,QAAQ,EAAE;YACpC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;SAC7C,CAAC,CACH,CAAC,QAAQ,CAAC;IAEb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE;QAC3D,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sBAAsB,EAAE;YAClE,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACjD,WAAW,CAAC,4DAA4D,CAAC;KACzE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;KACvD,cAAc,CAAC,kBAAkB,EAAE,4CAA4C,CAAC;KAChF,cAAc,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;KAClF,MAAM,CACL,iBAAiB,EACjB,iIAAiI,CAClI;KACA,MAAM,CACL,4BAA4B,EAC5B,gGAAgG,CACjG;KACA,MAAM,CACL,KAAK,EACH,KAAa,EACb,IAAmF,EACnF,EAAE;IACF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,cAAc,MAAM,kBAAkB,QAAQ,GAAG,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/commands/respond.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,OAAsF,EACtF,QAAkB,EAClB,aAAgC,EAChC,QAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,uFAAuF;IACvF,wFAAwF;IACxF,wEAAwE;IACxE,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,iBAAiB,GACrB,QAAQ;QACR,CACE,MAAM,qBAAqB,CAAC,QAAQ,EAAE;YACpC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;SAC7C,CAAC,CACH,CAAC,QAAQ,CAAC;IAEb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE;QAC3D,KAAK;QACL,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sBAAsB,EAAE;YAClE,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KACjD,WAAW,CAAC,4DAA4D,CAAC;KACzE,QAAQ,CAAC,UAAU,EAAE,iCAAiC,CAAC;KACvD,cAAc,CAAC,kBAAkB,EAAE,4CAA4C,CAAC;KAChF,cAAc,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;KAClF,MAAM,CACL,iBAAiB,EACjB,iIAAiI,CAClI;KACA,MAAM,CACL,4BAA4B,EAC5B,gGAAgG,CACjG;KACA,MAAM,CACL,KAAK,EACH,KAAa,EACb,IAAmF,EACnF,EAAE;IACF,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,uFAAuF;QACvF,uFAAuF;QACvF,qFAAqF;QACrF,mDAAmD;QACnD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE;gBACpD,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAC9C,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,QAAQ,CACT,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,cAAc,MAAM,kBAAkB,QAAQ,GAAG,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/commands/run.d.ts

@@ -1,3 +1,37 @@
 import { Command } from 'commander';
+import type { RunRecord } from '@sensigo/realm';
+/**
+ * The detach map (issue #447): what to do next, for THIS run's state.
+ *
+ * Cancelling a dev-run prompt used to dump a raw Node stack over an unhandled AbortError, which
+ * reads like a crash. The run was always saved — every settled step persists before the next
+ * prompt — so the exit should say so, and then hand over the exact commands that work from here.
+ *
+ * The fork is on the RECORD, not on a guess, because two of the three states REFUSE most of the
+ * remedies and printing a command that will be rejected is worse than printing nothing:
+ *
+ *  - TERMINAL — reachable for real: an external `realm run respond`, or a gate-expiry enactment,
+ *    can terminalize this run while this process sits blocked on the prompt (the #291 race the
+ *    fresh get below exists to catch). Inspect ONLY, because both other remedies refuse a
+ *    terminal run, by two DIFFERENT mechanisms: `realm run abandon` throws STATE_RUN_TERMINAL
+ *    (abandon-run.ts), while `realm agent --run-id` refuses through a separate uncoded check in
+ *    resolveRunAttach (run-attach.ts) — a plain Error, not that code.
+ *  - PENDING GATE — respond and inspect, and deliberately NO Discard line: `realm run abandon`
+ *    REFUSES a run with a pending gate (STATE_TRANSITION_DENIED, abandon-run.ts) and tells you to
+ *    resolve the gate first. The gate_id and choices come from the FROZEN record, the same source
+ *    `respond` validates against, so what is printed is what will be accepted.
+ *  - OTHERWISE — drive, inspect, or discard, all three of which apply.
+ *
+ * The choices are joined with `|` deliberately: this is a usage template showing alternation, not
+ * a list. (inspect renders them `', '` and the prompt `'/'`; three renderings, three purposes.)
+ * An authored-empty `choices: []` renders an empty alternation — that run is already
+ * human-unresolvable, which is issue #433's to make unmintable at the loader; not special-cased
+ * here.
+ *
+ * @internal Exported for testing only.
+ */
+export declare function renderDetachMap(record: RunRecord, promptStep: string | undefined, opts?: {
+    headline?: string;
+}): string;
 export declare const runCommand: Command;
 //# sourceMappingURL=run.d.ts.map

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2BpC,eAAO,MAAM,UAAU,SAoNpB,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,OAAO,KAAK,EAIV,SAAS,EACV,MAAM,gBAAgB,CAAC;AAexB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,MAAM,CAgCR;AAmCD,eAAO,MAAM,UAAU,SAmVpB,CAAC"}

package/dist/commands/run.js

@@ -2,7 +2,8 @@
 import { Command } from 'commander';
 import { createInterface } from 'node:readline/promises';
 import { join } from 'node:path';
-import { loadWorkflowFromFile, JsonFileStore, findEligibleSteps, executeChain, submitHumanResponse, unmetCapabilities, capabilityWarning, } from '@sensigo/realm';
+import { loadWorkflowFromFile, JsonFileStore, findEligibleSteps, executeChain, submitHumanResponse, unmetCapabilities, capabilityWarning, WorkflowError, deriveRunPhase, } from '@sensigo/realm';
+import { renderLoadFailure } from '../lib/loader-warnings.js';
 import { loadProjectExtensions } from '../extensions/load-project-extensions.js';
 import { scheduleGateExpiryTimer } from '../agent/gate/gate-expiry-timer.js';
 /**
@@ -14,6 +15,94 @@ function isWriterNonceRequired() {
     const v = process.env['REALM_REQUIRE_WRITER_NONCE'];
     return v !== undefined && v !== '' && v !== '0' && v !== 'false';
 }
+/**
+ * The detach map (issue #447): what to do next, for THIS run's state.
+ *
+ * Cancelling a dev-run prompt used to dump a raw Node stack over an unhandled AbortError, which
+ * reads like a crash. The run was always saved — every settled step persists before the next
+ * prompt — so the exit should say so, and then hand over the exact commands that work from here.
+ *
+ * The fork is on the RECORD, not on a guess, because two of the three states REFUSE most of the
+ * remedies and printing a command that will be rejected is worse than printing nothing:
+ *
+ *  - TERMINAL — reachable for real: an external `realm run respond`, or a gate-expiry enactment,
+ *    can terminalize this run while this process sits blocked on the prompt (the #291 race the
+ *    fresh get below exists to catch). Inspect ONLY, because both other remedies refuse a
+ *    terminal run, by two DIFFERENT mechanisms: `realm run abandon` throws STATE_RUN_TERMINAL
+ *    (abandon-run.ts), while `realm agent --run-id` refuses through a separate uncoded check in
+ *    resolveRunAttach (run-attach.ts) — a plain Error, not that code.
+ *  - PENDING GATE — respond and inspect, and deliberately NO Discard line: `realm run abandon`
+ *    REFUSES a run with a pending gate (STATE_TRANSITION_DENIED, abandon-run.ts) and tells you to
+ *    resolve the gate first. The gate_id and choices come from the FROZEN record, the same source
+ *    `respond` validates against, so what is printed is what will be accepted.
+ *  - OTHERWISE — drive, inspect, or discard, all three of which apply.
+ *
+ * The choices are joined with `|` deliberately: this is a usage template showing alternation, not
+ * a list. (inspect renders them `', '` and the prompt `'/'`; three renderings, three purposes.)
+ * An authored-empty `choices: []` renders an empty alternation — that run is already
+ * human-unresolvable, which is issue #433's to make unmintable at the loader; not special-cased
+ * here.
+ *
+ * @internal Exported for testing only.
+ */
+export function renderDetachMap(record, promptStep, opts) {
+    // DERIVED, never the persisted field: a record can carry a stale `run_phase` that disagrees
+    // with what its own seal says (issue #432's class), and a map that names the wrong phase sends
+    // an operator to the wrong remedy.
+    const phase = deriveRunPhase(record);
+    const step = promptStep ?? record.pending_gate?.step_name ?? '(step unknown)';
+    // issue #468 — the default is the #447 cancel route's own claim, byte-identical. The stall
+    // route (below, in the loop) passes 'Workflow stalled': no prompt was ever cancelled there, and
+    // the hardcoded word would be a false statement about what just happened.
+    const headline = opts?.headline ?? 'Prompt cancelled';
+    const lines = [
+        `${headline} — detached from run '${record.id}' at step '${step}' (phase: ${phase}). The run is saved.`,
+    ];
+    if (record.terminal_state) {
+        lines.push(`  Inspect:   realm run inspect ${record.id}`);
+        return lines.join('\n');
+    }
+    const gate = record.pending_gate;
+    if (gate !== undefined) {
+        lines.push(`  Respond:   realm run respond ${record.id} --gate ${gate.gate_id} --choice ${gate.choices.join('|')}`);
+        lines.push(`  Inspect:   realm run inspect ${record.id}`);
+        return lines.join('\n');
+    }
+    lines.push(`  Drive it:  realm agent --run-id ${record.id}`);
+    lines.push(`  Inspect:   realm run inspect ${record.id}`);
+    lines.push(`  Discard:   realm run abandon ${record.id}`);
+    return lines.join('\n');
+}
+/**
+ * Asks until the answer is usable: empty ⇒ {}, invalid JSON or a non-object ⇒ says why
+ * and re-asks (issue #459 — operator input gets a re-prompt, never the #123 rethrow;
+ * `42`/`null`/`[1]` are valid JSON that would lie through the object cast, MA-executed).
+ * Cancellation is untouched BY CONSTRUCTION: `rl.question` sits OUTSIDE the try, so an
+ * ABORT_ERR rejection propagates straight to the #447 catch and its detach map.
+ */
+async function askJsonObject(rl, prompt) {
+    for (;;) {
+        const raw = await rl.question(prompt);
+        const trimmed = raw.trim();
+        if (trimmed === '')
+            return {};
+        let parsed;
+        try {
+            parsed = JSON.parse(trimmed);
+        }
+        catch (err) {
+            if (!(err instanceof SyntaxError))
+                throw err; // belt — only JSON.parse is in the try
+            console.error(`  Not valid JSON: ${err.message} — try again (Enter for {}).`);
+            continue;
+        }
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            console.error('  Not a JSON object — the step\'s output must be an object like {"key": "value"}. Try again (Enter for {}).');
+            continue;
+        }
+        return parsed;
+    }
+}
 export const runCommand = new Command('run')
     .argument('<path>', 'Path to workflow directory or workflow.yaml file')
     .option('--params <json>', 'Initial run parameters as JSON string', '{}')
@@ -34,7 +123,15 @@ export const runCommand = new Command('run')
         definition = loadWorkflowFromFile(filePath);
     }
     catch (err) {
-        console.error(`Error loading workflow: ${err instanceof Error ? err.message : String(err)}`);
+        // issue #425 — this catch wraps loadWorkflowFromFile ALONE, so everything it can see is
+        // a loader failure and the family split needs no else-arm here. A structural refusal
+        // renders verbatim; an unreadable file rides the helper's `Invalid: ` fallback, which
+        // replaces today's `Error loading workflow: ` prefix — a deliberate text change, so that
+        // one voice reaches an author from every command.
+        //
+        // No `err.warnings` render here: surfacing the lenient path's warnings on run/agent/
+        // listen stays out of scope (#424's stated non-goal).
+        console.error(renderLoadFailure(err instanceof WorkflowError ? err : String(err)));
         process.exit(1);
     }
     // 1b. Load project extensions BEFORE run creation (fail-before-create).
@@ -60,6 +157,26 @@ export const runCommand = new Command('run')
         console.error('Error: --params is not valid JSON');
         process.exit(1);
     }
+    // issue #426 — dev mode is interactive BY DESIGN: every step kind and every gate prompts
+    // on stdin (agent output, auto mock output, gate choices), so a non-TTY stdin can only
+    // ever EOF into ERR_USE_AFTER_CLOSE — and it did so AFTER the run was minted and its id
+    // printed, leaving a wedged `running` record behind on every scripted invocation.
+    //
+    // Refused BEFORE any store work, joining the "1b … BEFORE run creation" doctrine one
+    // member up. The placement is load → extensions → params → HERE, and each boundary is
+    // pinned: earlier than the load and the loader-voice cells lose their messages; earlier
+    // than extensions and the spawned orphan-manifest case loses its refusal; earlier than
+    // params and `--params '{'` reports the wrong problem.
+    //
+    // `!== true` rather than a truthiness test: isTTY is `undefined` on a pipe, never false.
+    if (process.stdin.isTTY !== true) {
+        console.error('Error: dev-mode run is interactive — it prompts on stdin for every step and gate, ' +
+            'and stdin here is not a terminal. No run was created. ' +
+            "Scripted flows: 'realm workflow test' drives fixtures; " +
+            "'realm listen' / 'realm agent' are the production drives. " +
+            'To run this workflow by hand, use a real terminal.');
+        process.exit(1);
+    }
     // 3. Create store and initial run record
     const store = new JsonFileStore();
     // issue #207 PR-2 (D3 §5, mixed-wiring gap): construct a JsonTraceBufferStore beside the
@@ -85,6 +202,10 @@ export const runCommand = new Command('run')
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     // 5. Execution loop
     let run = await store.get(runId);
+    // issue #447: which step the operator was answering for, assigned immediately before each
+    // question. The block-scoped names below are not visible from the catch, and the catch is
+    // where this is needed.
+    let promptStep;
     try {
         while (!run.terminal_state) {
             // Handle open gate
@@ -105,6 +226,7 @@ export const runCommand = new Command('run')
                     definition,
                     registry,
                 });
+                promptStep = g.step_name;
                 const raw = await rl.question(`  Choice [${g.choices.join('/')}]: `).finally(() => {
                     clearExpiryTimer();
                 });
@@ -123,14 +245,28 @@ export const runCommand = new Command('run')
                 }
                 else {
                     console.error(`  ✗ ${respondResult.errors.join(', ')}\n`);
-                    break;
+                    // issue #468 — a FRESH read, not a break: most of this arm's members are a live
+                    // gate re-asking (a typo, a stale choice) — rl.question blocks, no hot spin. The
+                    // members that are NOT retryable (the gate/run moved or terminalized elsewhere) are
+                    // exactly what this read converges: the next iteration sees the real state and
+                    // either re-prompts honestly or reaches the stall/tail. Mirrors the ok arm above.
+                    run = await store.get(runId);
                 }
                 continue;
             }
             const eligibleSteps = findEligibleSteps(definition, run);
             if (eligibleSteps.length === 0) {
                 console.error(`\nNo eligible steps in phase '${run.run_phase}'. Workflow stalled.`);
-                break;
+                // issue #468 — hands the run back with a truthful map instead of silently exiting 0.
+                // A fresh read: the loop's own snapshot is already current here (nothing awaited
+                // since the last read reached this branch in the same iteration), but the fresh read
+                // is the doctrine this file already keeps for every detach point (#447) — kept for
+                // consistency, not because a staleness gap is constructible in this spot.
+                const record = await store.get(runId);
+                console.error(renderDetachMap(record, promptStep, { headline: 'Workflow stalled' }));
+                // process.exit SKIPS the finally (the catch's own rule, below), so close explicitly.
+                rl.close();
+                process.exit(1);
             }
             // Take the first eligible step (linear workflow for dev mode)
             const stepName = eligibleSteps[0];
@@ -139,8 +275,8 @@ export const runCommand = new Command('run')
             // Build dispatcher output based on execution type
             let userOutput;
             if (stepDef.execution === 'agent') {
-                const raw = await rl.question('  Agent output JSON (Enter for {}): ');
-                userOutput = raw.trim() === '' ? {} : JSON.parse(raw);
+                promptStep = stepName;
+                userOutput = await askJsonObject(rl, '  Agent output JSON (Enter for {}): ');
             }
             else {
                 // auto step
@@ -149,8 +285,8 @@ export const runCommand = new Command('run')
                     : stepDef.uses_service !== undefined
                         ? `service: ${stepDef.uses_service}`
                         : 'auto';
-                const raw = await rl.question(`  Mock output (${hint}) — JSON (Enter for {}): `);
-                userOutput = raw.trim() === '' ? {} : JSON.parse(raw);
+                promptStep = stepName;
+                userOutput = await askJsonObject(rl, `  Mock output (${hint}) — JSON (Enter for {}): `);
             }
             const dispatcher = async () => userOutput;
             const result = await executeChain(store, definition, {
@@ -178,15 +314,93 @@ export const runCommand = new Command('run')
             }
             else {
                 console.error(`  ✗ ${result.status}: ${result.errors.join(', ')}\n`);
-                break;
+                // issue #468 — a FRESH read, not a break: below the validation-exhaustion threshold
+                // the step is still eligible and this re-prompts it honestly; AT the threshold the
+                // run just terminalized in the store, and only a fresh read lets the while condition
+                // see that and exit to the tail — a bare continue would re-ask a dead run forever
+                // (verified: the mock chain exhausts and the answer never lands anywhere real).
+                run = await store.get(runId);
             }
         }
-        if (run.terminal_state) {
-            console.log(`Run complete. Phase: ${run.run_phase}`);
+        // Loop-head invariant (issue #468): exactly two exits from here — the while condition
+        // (terminal) and the stall (mapped + exit 1). Every ✗ arm above re-reads then
+        // continues; no `break` remains in this loop.
+    }
+    catch (err) {
+        // issue #447 — the operator cancelled the prompt. Ctrl-D at a pending `rl.question`
+        // rejects with an AbortError carrying `code: 'ABORT_ERR'`. Nothing awaits
+        // `program.parse()`, so today that surfaces as an unhandled-rejection stack: a saved run
+        // that looks like a crash.
+        //
+        // BOTH Ctrl-D and Ctrl-C land here on a real terminal — measured on this build: ^C at a
+        // live prompt printed the full map and exited 1. What decides it is the WIRING, not the
+        // key: readline enables raw mode only in terminal mode, which requires `output.isTTY`.
+        // With stdout PIPED, readline never takes the terminal path and ^C takes the
+        // signal/inert route instead (measured: the process died at 130) — out of this catch's
+        // reach, and outside anything the map claims.
+        //
+        // One timing caveat, worth recording because it produced a confident wrong answer during
+        // this work: the pty is COOKED until readline switches it, so a ^C delivered before that
+        // switch takes the cooked ISIG path and kills the process before any JS runs. A scripted
+        // `printf '\x03' | …` hits that window; the same harness with the byte delayed a second
+        // rejects ABORT_ERR-coded as expected. Cooked-mode ^D persists in the stream as EOF and
+        // still ends up ABORT_ERR-coded, which is exactly why it looked like a valid control and
+        // was not. No claim here about anyone typing that fast.
+        //
+        // Keyed on the CODE alone, never the message, which names the trigger and varies.
+        //
+        // The classification is precise TODAY and the precision is not free: a handler that
+        // out-throws is re-coded ENGINE_HANDLER_FAILED (execution-loop.ts), every engine throw
+        // is WorkflowError-coded and none uses ABORT_ERR, and the gate-expiry timer contains
+        // its own errors. So ABORT_ERR reaching here means the prompt, and only the prompt.
+        // ADDING ANY AbortSignal-CONSUMING AWAIT TO THIS LOOP REQUIRES RE-ESTABLISHING THAT.
+        if (err?.code === 'ABORT_ERR') {
+            // A FRESH read, not the loop's `run`: while this process sat blocked on the prompt,
+            // another terminal's `realm run respond` or an expiry enactment may have moved it —
+            // the #291 race. The map is only as good as the state it forks on.
+            let record;
+            try {
+                record = await store.get(runId);
+            }
+            catch (getErr) {
+                // The same concurrent-writer reality that makes the fresh read necessary can also
+                // make it FAIL — a record purged from another terminal mid-prompt. Without this arm
+                // the new cancel path would crash with exactly the stack this feature exists to
+                // remove. `inspect` still earns its line: it is the only read surface, and its own
+                // answer for a missing record is a clean not-found rather than a stack.
+                const message = getErr instanceof Error ? getErr.message : String(getErr);
+                console.error(`Prompt cancelled — detached from run '${runId}'. Its record could not be re-read: ${message}. Inspect: realm run inspect ${runId}`);
+                rl.close();
+                process.exit(1);
+            }
+            console.error(renderDetachMap(record, promptStep));
+            // process.exit SKIPS the finally, so close explicitly. (rl.close is idempotent, so
+            // the double-close on any path that reaches both is harmless — probed.)
+            rl.close();
+            // Exit 1, not 130: readline consumed the keypress and the process was never signalled,
+            // so 130 would claim a death that did not happen.
+            process.exit(1);
         }
+        throw err;
     }
     finally {
         rl.close();
     }
+    // issue #468 — the exit code tells the truth. `run` is declared outside the try, so by the
+    // time control reaches here the finally above has already closed `rl` on every path that
+    // gets this far (the catch's ABORT_ERR arm exits directly and never falls through to here).
+    // Only the while condition being false gets here — the stall exits from inside the try
+    // above — so `run.terminal_state` is always true at this point.
+    if (deriveRunPhase(run) === 'completed') {
+        console.log(`Run complete. Phase: ${run.run_phase}`);
+        // NATURAL RETURN — never process.exit(0): three declared controls (run-detach.test.ts's
+        // R1/R2/R3) pin the completed path as an unwrapped, un-exited resolution.
+        // completed-with-failed-steps (the #302 world) exits 0 too, here — outcome-keyed,
+        // consistent with the engine's own seal ruling; #304's run-health finding +
+        // terminal_reason are the disclosure channel, not this exit code.
+        return;
+    }
+    console.log(`Run complete. Phase: ${run.run_phase}`);
+    process.exit(1);
 });
 //# sourceMappingURL=run.js.map