[piekstra]

Summary

Commands that act on a past run need its id, which means copying it from the run's output. They now also take --flow <id>, meaning that flow's newest run:

$ lest cleanup --flow sign-up --dry-run
$ lest bundle --flow sign-up -o evidence.zip
$ lest runs get --flow sign-up -o report.json
$ lest explain --flow sign-up

• Applies to runs get, cleanup, bundle, explain and context through one RunRef argument group: exactly one of a run id or --flow (clap enforces it).
• No runs of the flow exits 4 (not found), like an unknown run id.
• A flag rather than accepting a flow id in the run position, so a flow id can never be read as a run-id prefix.
• Docs: flow-format (cleanup replay), ci.md (bundle), and the agent guide.

Verification

• Parser test a_run_is_named_by_id_or_by_flow (by id, by flow, neither, both).
• scripts/e2e.sh now runs lest runs get --flow wrong-password and checks it returns the failed run, and lest bundle --flow plants-api. The script passes locally.
• make lint and make build pass.

[piekstra]

Review pass on the diff (self-review):

• Fixed: help said 'newest run', but a run writes report.json only when it finishes, so --flow picks the newest finished run. An in-progress run is never chosen, which is the safe behavior for cleanup. Help and agent guide now say so.
• Kept as a flag rather than accepting a flow id in the run position, so a flow id can never be misread as a run-id prefix.
• One RunRef group covers runs get, cleanup, bundle, explain and context; clap enforces exactly one of a run id or --flow.