Gate run CLI command to debug builds only

[Copilot]

run is a local/debug workflow and should not be surfaced in customer-facing builds. This PR aligns run with existing debug-only CLI behavior (--skip-integrity, --debug-pipeline) by compiling/exposing it only in debug builds.

• CLI surface hardening

  • Added #[cfg(debug_assertions)] gating for the Run subcommand variant in src/main.rs.
  • Gated all Run references in command-name resolution and command dispatch to keep release builds free of the run codepath.

• Build-mode contract coverage

  • Added focused CLI tests (tests/cli_tests.rs) to assert:
    • debug builds include run in --help
    • release builds do not expose run in --help

• Implementation shape

  #[cfg(debug_assertions)]
  mod run;
  
  #[derive(Subcommand, Debug)]
  enum Commands {
      #[cfg(debug_assertions)]
      Run { /* ... */ },
  }

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dev.azure.com
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/async_trait-f6d12dc65cce50cb.a/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/init_tests-49cb495e99e732cb.3608h8sipq36hxu94zkzu7duh.1nnph2s.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/async_trait-f6d12dc65cce50cb.a/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/init_tests-49cb495e99e732cb.3ar2kv94emcaau5up6629u0n2.1nnph2s.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/async_trait-f6d12dc65cce50cb.a/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/init_tests-49cb495e99e732cb.3eajnfm4bnpmtfrxbgscvtlpm.1nnph2s.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/async_trait-f6d12dc65cce50cb.a/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/init_tests-49cb495e99e732cb.3iilq4w8mhj2na1l3eehlyh7n.1nnph2s.rcgu.o /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/async_trait-f6d12dc65cce50cb.a/home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/init_tests-49cb495e99e732cb.3qmayg8wuxe9xp91j7yx6bko8.1nnph2s.rcgu.o d.0oo30tlv22o5mbt2bzyaecx62.0lj0v7y.rcgu.o d.0ppm7acpzj9pose041bmuqgpm.0lj0v7y.rcgu.o d.0tviedpuoz1b291l92tcn0dx4.0lj0v7y.rcgu.o d.0vm8jrl97m68uvl00ag7gz1p5.0lj0v7y.rcgu.o d.0ybq5glinpj9818of2ja1npyy.0lj0v7y.rcgu.o d.11ql65wk2qkw8dv87qp088o22.0lj0v7y.rcgu.o d.14722s5epvjae3nn3ylxkucko.0lj0v7y.rcgu.o d.148cy3pq04g1un12o6x1quzon.0lj0v7y.rcgu.o d.17tgrokgra7a7wujk7ooupq97.0lj0v7y.rcgu.o d.17vd3t69cj94hlwno3z871y8p.0lj0v7y.rcgu.o d.18wuz8jn1878w063h8qkflpn2.0lj0v7y.rcgu.o d.1ank73sfegqlunuub7fovwm0g.0lj0v7y.rcgu.o d.1cuken4jbrqqg32ejpkaakkhq.0lj0v7y.rcgu.o d.1j7uup3w3mvzupdpgrflqfbdd.0lj0v7y.rcgu.o (dns block)
  • Triggering command: /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/work/ado-aw/ado-aw/target/debug/deps/ado_aw-d5652daa30dfc52e /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.09.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.10.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.11.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.12.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.13.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.14.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.15.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.btn7eifwrohlu5m84q2ndctct.rcgu.o /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-u�� /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib/librustc_demangle-789fb9c0cb1c7158.rlib /home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/lib/libstd_detect-b16e5cb5eba3e0fd.rlib 64-u�� 64-REDACTED-linux-gnu/lib/libmemchr-48d5b0db80402653.rlib 64-REDACTED-linux-gnu/lib/libaddr2line-3367f26bd486b29d.rlib symbols.o tures-8f8411b111cc tures-8f8411b111-m64 tures-8f8411b111/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/rustcOsz6pr/symbols.o tures-8f8411b111/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/cli_tests-a1aa4c88e520fdee.c/home/REDACTED/work/ado-aw/ado-aw/target/release/deps/ado_aw-e912bdfcf87f58ea.ado_aw.ea80e37b87025bfc-cgu.03.rcgu.o (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[jamesadevine]

/rust-review

[github-actions]

✅ Rust PR Reviewer completed successfully!

[github-actions]

🔍 Rust PR Review

Summary: Looks good — minimal, correct, consistent with existing debug-gating patterns.

Findings

✅ What Looks Good

• Exhaustiveness is correct in both modes. Because Commands::Run itself doesn't exist in release builds, all three match blocks (command_name, match command dispatch) remain exhaustive without the arm — Rust correctly validates this at compile time.
• Test binary vs. target binary alignment is correct. CARGO_BIN_EXE_ado-aw resolves to the binary compiled with the same profile as the test binary, so the #[cfg(debug_assertions)] gate on each test correctly selects the right test for the right profile.
• Pattern is consistent with the existing --skip-integrity / --debug-pipeline debug-only flag pattern used elsewhere in main.rs.
• mod run; module gating prevents dead code from being compiled into release binaries entirely.

⚠️ Suggestions

• tests/cli_tests.rs:14-15 — The debug test checks stdout.contains("run") && stdout.contains("Run agent locally"). The first condition is redundant: if "Run agent locally" is present so is "run". Minor, but consider simplifying to just the more specific string check to reduce cognitive noise.

• #[cfg(debug_assertions)] bypass via Cargo.toml — debug_assertions can be forced on in release profiles via [profile.release] debug-assertions = true. This is an acknowledged limitation of the existing convention in this codebase (same mechanism gates --skip-integrity), so it's acceptable, but worth a note in a comment if this gate is meant as a security boundary rather than just a DX boundary.

No bugs, no security concerns. The two-line change to main.rs is surgical and the tests cover both build modes correctly.

Generated by Rust PR Reviewer for issue #283 · ● 460.6K · ◷

[jamesadevine]

@copilot implement suggestion in feedback above

[Copilot]

@copilot implement suggestion in feedback above

Implemented the reviewer suggestion in commit 05aa9d0: simplified the debug help assertion in tests/cli_tests.rs by removing the redundant stdout.contains("run") check and keeping the specific "Run agent locally" assertion. Targeted debug/release cli_tests both pass.