[sre-helmcode]

What

Agent contexts C2 (devops AGENT-CONTEXT.md §6 and §8 row C2), against the cloud-api B4 API (#406 runs, #407 automations).

• nan run --context NAME: repeatable, at most 5, order kept, sent as contexts on POST /v1/runs. Works for workspace and ephemeral runs.
• nan run --ephemeral without --repo is allowed only with --context: no github_repo is sent, and the agent works in an empty folder. --github-token-secret without --repo is refused.
• nan automations create|edit --context NAME (repeatable, at most 5) and --checkout none (an ephemeral automation without a repository, which needs at least one context). edit takes the flags without -f. On edit, --checkout none also sends github_repo: null unless the file sets it. A field given both in the file and as a flag is refused.
• Local checks, all exit 64 before any request: a sixth context, the same context twice (ids compared case-insensitively), a value that is neither a context name nor an id, an empty value, a file contexts: that is not a list, checkout: none with a repository, on a workspace automation, or with no context.
• Server refusals with clear messages (exit 64): 404 context_not_found names the context from contexts[i], 422 context_skill_conflict, 413 context_too_large, and 400 on contexts[...]. On automations edit, a 404 context_not_found no longer reads as "automation not found".
• api.Run now carries the pinned contexts (omitempty), so nan run --json shows them. The run announcement lists the contexts.
• Help for nan run, nan automations create and edit, the README (flags table, ephemeral runs, the agent contexts section, exit codes).

Base and deviations

• This branch is cut from feat/ephemeral-e2-cli with origin/main merged in (commit 804751f) so the nan context code from C1 is there. The one conflict was in cmd/json_output_test.go: I kept both the ephemeral fixture route and the contexts fake. Because of that merge, the diff against feat/ephemeral-e2-cli also shows main's commits (feat(auth): two-factor sign-in for nan auth login and the panel (0.1.35) #60, build: go 1.26.10 for GO-2026-6809 #61, feat(context): nan context ls|show|create|push|pull|edit|rm (agent contexts C1) #62). The C2 change on its own is commit 82f8620: git diff 804751f 82f8620.
• Outside the two files named in §8: cmd/ephemeral.go (the repo-or-context rule in checkEphemeralFlags, and checkout: none in checkAutomationExecutor) and internal/api/runs.go (CreateRunRequest.Contexts, Run.Contexts). Both are needed for this change.
• --checkout takes workspace, fresh or none. It sets the file's checkout field, so the other two values come for free.
• No VERSION/version constant change, no release.

Tests (spec first)

• cmd/run_contexts_test.go: order and body, no contexts without the flag, request goldens (cmd/testdata/contexts/run_request_*.json), a repo-less ephemeral run, a table of usage errors with no request sent, ids in any case, the flag run through cobra (repeat, a sixth one, a comma is not a separator), refusal mapping, Run.Contexts decoding, help.
• cmd/automations_contexts_test.go: create/edit body goldens (automation_*.json), the file as written when no flags are given, edit without -f, a table of usage errors with zero requests, refusal mapping on create, on edit and from a file's contexts, help.
• TestCheckAutomationExecutor: 13 new rows for checkout: none and contexts.

go build ./... && go vet ./... && go test ./...        ok
go test -race -shuffle=on ./...                         ok (cmd run 3 times with shuffle)
gofmt -l .                                              clean
GOOS=windows go build .                                 ok

🤖 Generated with Claude Code