fix(workflow): only surface gate detail in --json when the run is paused

Address review (github#2965): _gate_outcome() emitted a gate block whenever current_step_id pointed at a gate step. Since RunState.current_step_id is never cleared on completion, a completed/failed run whose last step was a gate leaked stale gate detail in run/resume/status --json. Guard on status == paused. Also assert CLI success in the _run_json test helper before JSON-parsing, and add direct coverage for the suppression guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: doquanghuy

src/specify_cli/__init__.py

@@ -2768,6 +2768,12 @@ def _gate_outcome(state: Any) -> dict[str, Any] | None:
     and (after an interactive choice) the decision lets orchestrators
     drive review gates without parsing the human-facing stream.
     """
+    # Only a run that is actually *paused* sits at a gate awaiting a
+    # decision. RunState.current_step_id is not cleared on completion, so
+    # without this guard a completed/failed run whose last executed step was
+    # a gate would surface stale gate details (in run/resume/status --json).
+    if getattr(state.status, "value", state.status) != "paused":
+        return None
     step = (getattr(state, "step_results", None) or {}).get(state.current_step_id)
     if not isinstance(step, dict) or step.get("type") != "gate":
         return None

tests/test_workflows.py

@@ -3984,6 +3984,9 @@ def _run_json(self, tmp_path, monkeypatch, content):
         monkeypatch.chdir(tmp_path)
         runner = CliRunner()
         result = runner.invoke(app, ["workflow", "run", str(path), "--json"])
+        # Assert the CLI succeeded before parsing so a real failure surfaces
+        # the actual output instead of an opaque JSON decode error.
+        assert result.exit_code == 0, result.stdout
         return _json.loads(result.stdout)
 
     def test_gate_pause_carries_gate_block(self, tmp_path, monkeypatch):
@@ -4001,3 +4004,27 @@ def test_completed_run_has_no_gate_block(self, tmp_path, monkeypatch):
         payload = self._run_json(tmp_path, monkeypatch, self._WF_PLAIN)
         assert payload["status"] == "completed"
         assert "gate" not in payload
+
+    def test_gate_block_suppressed_when_run_not_paused(self):
+        # RunState.current_step_id is not cleared on completion, so a
+        # completed/failed run whose last executed step was a gate still
+        # points current_step_id at that gate. The gate block must only be
+        # emitted while the run is actually paused at it.
+        from types import SimpleNamespace
+        from specify_cli import _gate_outcome
+
+        gate_step = {
+            "type": "gate",
+            "output": {"message": "m", "options": ["approve"], "choice": "approve"},
+        }
+
+        def _state(status):
+            return SimpleNamespace(
+                status=SimpleNamespace(value=status),
+                current_step_id="review",
+                step_results={"review": gate_step},
+            )
+
+        assert _gate_outcome(_state("completed")) is None
+        assert _gate_outcome(_state("failed")) is None
+        assert _gate_outcome(_state("paused")) is not None