Crate qli_ext 

Extension discovery, dispatch, and guardrails for the qli CLI.

discovery walks XDG + PATH and builds the group/extension table. dispatch::run wraps the child spawn in the guard sequence: banner → guard::check_requires_env → guard::run_confirm → secrets → audit start → spawn → audit finish/interrupted. Manifests (manifest) describe each group; secret resolution is pluggable via secrets::SecretsResolver.

Diagnostic policy (fail fast, fail loud)

Every error has one obvious surface — never silently swallowed. Four tiers, picked by user impact, not by code locality:

1. Process-fatal — bubbled up as anyhow::Error from main, printed error: {msg} (exit 1). For startup failures and unrecoverable binary conditions.
2. Dispatch-fatal — typed dispatch::DispatchError variants that abort one dispatched extension with full context. Surfaced through anyhow so the user sees error: failed to run X: Y.
3. Must-see warning — eprintln!("warning: ..."). Never goes through tracing (which -q can silence). Used when behavior visibly degrades: discovery skipped a group, a signal handler couldn’t install, an audit-finish write failed.
4. Trace — tracing info/debug/trace. Routine progress only; silenceable. Use it when a later operation will fail loudly with full context if this trace event mattered.

Rule of thumb: if you write .ok() on a Result whose failure changes user-visible behavior, you’ve picked the wrong tier — promote to 3 or 2. Validation belongs at the earliest boundary (parse-time over exec-time) so the error points at the source, not the symptom.

Re-exports

pub use defaults::materialize_to;

pub use defaults::MaterializeError;

pub use defaults::MaterializeStats;

pub use defaults::DEFAULTS;

pub use discovery::discover;

pub use discovery::Discovery;

pub use discovery::Extension;

pub use discovery::ExtensionOrigin;

pub use discovery::Group;

pub use dispatch::DispatchError;

pub use dispatch::DispatchOptions;

pub use dispatch::DispatchSignals;

pub use guard::tty_confirm;

pub use guard::ConfirmPrompt;

pub use guard::GuardError;

pub use guard::TtyConfirm;

pub use manifest::Manifest;

pub use manifest::ManifestError;

pub use manifest::SecretProvider;

pub use manifest::SecretSpec;

pub use manifest::CURRENT_SCHEMA_VERSION;

pub use secrets::ProductionResolver;

pub use secrets::ResolvedSecret;

pub use secrets::SecretsError;

pub use secrets::SecretsResolver;

pub use secrets::TestResolver;

Modules

audit

Audit log records for the dispatcher.

defaults

Embedded extension defaults.

discovery

Extension discovery: walk one or more on-disk extension roots and PATH, building the group/extension table the dispatcher uses to route subcommands.

dispatch

Extension dispatch with the Phase 1F guard sequence wrapped around the child spawn.

guard

Pre-spawn guards: banner, requires_env, confirm prompt.

manifest

Group _manifest.toml schema and parser.

secrets

Secret resolution trait used by the dispatcher.