Gate run CLI command to debug builds only

src/main.rs

@@ -11,6 +11,7 @@ mod logging;
 mod mcp;
 mod ndjson;
 pub mod runtimes;
+#[cfg(debug_assertions)]
 mod run;
 pub mod sanitize;
 mod safeoutputs;
@@ -130,6 +131,7 @@ enum Commands {
         definition_ids: Option<Vec<u64>>,
     },
     /// Run agent locally (local development mode)
+    #[cfg(debug_assertions)]
     Run {
         /// Path to the agent markdown file
         path: String,
@@ -180,6 +182,7 @@ async fn main() -> Result<()> {
         Some(Commands::McpHttp { .. }) => "mcp-http",
         Some(Commands::Init { .. }) => "init",
         Some(Commands::Configure { .. }) => "configure",
+        #[cfg(debug_assertions)]
         Some(Commands::Run { .. }) => "run",
         None => "ado-aw",
     };
@@ -387,6 +390,7 @@ async fn main() -> Result<()> {
                 )
                 .await?;
             }
+            #[cfg(debug_assertions)]
             Commands::Run {
                 path,
                 pat,

tests/cli_tests.rs

@@ -0,0 +1,35 @@
+use std::path::PathBuf;
+
+#[cfg(debug_assertions)]
+#[test]
+fn test_run_subcommand_exposed_in_debug_builds() {
+    let binary_path = PathBuf::from(env!("CARGO_BIN_EXE_ado-aw"));
+    let output = std::process::Command::new(&binary_path)
+        .arg("--help")
+        .output()
+        .expect("Failed to run ado-aw --help");
+
+    assert!(output.status.success(), "--help should succeed");
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(
+        stdout.contains("Run agent locally"),
+        "Debug build help output should include the run subcommand, got:\n{stdout}"
+    );
+}
+
+#[cfg(not(debug_assertions))]
+#[test]
+fn test_run_subcommand_not_exposed_in_release_builds() {
+    let binary_path = PathBuf::from(env!("CARGO_BIN_EXE_ado-aw"));
+    let output = std::process::Command::new(&binary_path)
+        .arg("--help")
+        .output()
+        .expect("Failed to run ado-aw --help");
+
+    assert!(output.status.success(), "--help should succeed");
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(
+        !stdout.contains("Run agent locally"),
+        "Release build help output should not include the run subcommand, got:\n{stdout}"
+    );
+}