feat: interactive gap-fill prompts for missing command input (Phase 1)

[vscheuber]

Summary

Implements Phase 1 of INTERACTIVE-COMMANDS-PLAN.md (analysis doc on the rockcarver workspace root): on an interactive session, missing mandatory options and connection arguments are now prompted for before the action body runs. Every non-interactive surface (CI, scripts, MCP, e2e) behaves byte-identically to before — same messages, same exit codes, enforced by a structural gate, not convention.

frodo idm schema object describe on a TTY, before → after:

before:  error: required option '-o, --managed-object <type>' not specified
after:   ? Choose a connection profile:      (saved profiles, single skips silently)
         ? Enter a value for -o, --managed-object <type>: alpha_user

What's in the box

• Prompt gate (PromptGateState.ts, unit-tested): prompts fire only when ALL of FRODO_NO_PROMPT unset, FRODO_TEST !== '1', stdin+stdout are TTYs, and setNeverPrompt() hasn't been called. Outside the gate the resolution pass degrades to exactly the old error behavior.
• Prompts (PromptGate.ts): promptInput/promptPassword hand-built on @inquirer/core, matching the established hand-built pattern (EscapableSelectPrompt, JourneyDebugPrompt): Escape/empty-Enter resolve '' so callers keep their existing missing-input error paths (packaged prompts throw ExitPromptError instead). readline-buffer based (paste-safe); the completed line is mirrored from the preceding keystroke because rl.line is already consumed when Enter's keypress fires (verified against @inquirer/core 12.0.3 in an isolated PTY harness).
• Resolution pass (ResolveInteractiveInputs.ts, wired via an async preAction hook — commander's hook chain awaits returned promises):
  • Host picker: saved connection profiles as an escapableSelect dropdown; single profile skipped silently (the runInteractivePreferredCredentialPicker convention); "Enter a host manually…" item; free-text when no profiles exist.
  • Username/password prompts only when nothing can answer: suppressed when a saved profile carries a usable credential (user+password, svcacct, or amster — frodo-lib falls back to it anyway); a credentials-less profile entry still prompts, prefilled with its saved username; --browser/--device suppress them (their flow IS the interactive part) but not the host prompt.
  • Deferred mandatory options: FrodoStubCommand.missingMandatoryOptionValue is reimplemented verbatim from commander (its typings omit the method) as the override point; FrodoCommand defers violations to the pass instead of throwing — which makes all 57 existing makeOptionMandatory() call sites prompt-capable with zero syntax change. Options with choices() get a dropdown.
• --no-prompt on every FrodoCommand (Runtime options group) plus the FRODO_NO_PROMPT env var; frodo mcp server start --transport stdio calls setNeverPrompt() as belt-and-braces (stdio IS the protocol channel).
• Dependency move: inquirer packages devDependencies → dependencies (production prompt surface now).

Two subtle bugs found and fixed during live PTY verification

1. rl.line is already consumed when Enter's keypress fires — the first cut read it there and silently discarded every answer as "(no input)". Fixed by mirroring the buffer into prompt state on every keystroke.
2. Positional injection must write both command.processedArgs (what commander's action wrapper slices positional parameters from) and command.args (what handleDefaultArgsAndOpts iterates to copy into frodo-lib state) — verified against commander's _processArguments (which never writes back) and this repo's shim.

Verification

All flows verified live in a real PTY (via the repo's generic test/utils/shell_pty_driver.py):

Flow	Result
Mandatory-option prompt → value reaches action + frodo-lib state	✅ (error progressed to real connection attempt)
Host dropdown, aliases, "Enter a host manually…", free text	✅
Single-profile silent skip	✅
Username prefill from profile; credentials-less profile still prompts	✅
Password masked echo	✅
Escape abort → commander's byte-identical error + exit 1	✅
--no-prompt / FRODO_NO_PROMPT on a TTY	✅
Enum dropdown from choices() (real resolver, standalone harness)	✅
Non-TTY: byte-identical error + exit code	✅
Bare frodo conn unchanged (no double-prompt with its own picker)	✅
Gate unit tests	✅ 4/4
Full suite (638 suites, replay mode)	✅ 8486 snapshots; 4 PTY-under-load flakes investigated: all pass in isolation/together, untouched by this diff (no shell/PTY code imports the new modules)

Notes / follow-ups

• @inquirer/select rode along to dependencies with the others but is still imported nowhere (pre-existing) — keep-vs-drop is a separate decision.
• Phases 1b (sub-command pickers), 2 (the 158-command one-of cohort), 3 (tenant-backed pickers) are specced in the plan doc, not started.

🤖 Generated with Claude Code