@wilm-ai/wilma-cli 1.6.1 → 2.0.0

package/dist/index.js

@@ -1,62 +1,356 @@
 #!/usr/bin/env node
 import { emitKeypressEvents } from "node:readline";
 import { select, input, password } from "@inquirer/prompts";
-import { createHmac } from "node:crypto";
-import { readFile, writeFile, mkdir, open, rm } from "node:fs/promises";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
-import { WilmaClient, MfaRequiredError, NetworkError, listTenants, } from "@wilm-ai/wilma-client";
-import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig, } from "./config.js";
+import { fileURLToPath } from "node:url";
+import { APIError, AuthenticationError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
+import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig } from "./config.js";
+import { WilmaAccess, WilmaAiError, adoptSession, flushSessions, useSessionStore, } from "./agent-data.js";
+import { createAccess } from "./access.js";
+import { parseCliArgs } from "./cli-args.js";
+import { commandHelp, generalHelp } from "./cli-help.js";
+import { compactText, formatText, messageLine, newsLine } from "./cli-output.js";
+import { ENV_VARS, isMfaFailure, mfaCallbackFor, resolveAccounts, saveLogin, verifyLoginSession } from "./credentials.js";
+import { createUniqueDownloadFile } from "./downloads.js";
+import { openBrowser, startLoginServer } from "./login-server.js";
+import { runMcpServer } from "./mcp.js";
+import { toAgentJson } from "./output-json.js";
+import { clearSessions, fileSessionStore } from "./session-store.js";
+import { normalizeTenantUrl, resolveTenant, searchTenants } from "./tenant-search.js";
+import { generateTOTP, parseTotpSecret } from "./totp.js";
 // Enable keypress events for escape key detection
 if (process.stdin.isTTY) {
     emitKeypressEvents(process.stdin);
 }
+function outputMode(argv) {
+    const json = argv.includes("--json") || (!argv.includes("--text") && !process.stdout.isTTY);
+    return { json, pretty: json && Boolean(process.stdout.isTTY) };
+}
+function makeOutput(argv, fallbackText) {
+    const mode = outputMode(argv);
+    return {
+        ...mode,
+        data(result, text) {
+            if (mode.json)
+                console.log(toAgentJson(result, mode.pretty));
+            else
+                console.log((text ?? (() => (fallbackText ? fallbackText(result) : toAgentJson(result, true))))());
+        },
+    };
+}
 const ACTIONS = [
     { value: "summary", name: "Daily summary" },
     { value: "schedule-today", name: "Today's schedule" },
-    { value: "schedule-tomorrow", name: "Tomorrow's schedule" },
+    { value: "schedule-tomorrow", name: "Next school day's schedule" },
     { value: "homework", name: "Recent homework" },
     { value: "exams", name: "Upcoming exams" },
     { value: "grades", name: "Exam grades" },
+    { value: "notes", name: "Lesson notes (last 14 days)" },
+    { value: "gradebook", name: "Gradebook" },
     { value: "news", name: "List news" },
     { value: "messages", name: "List messages" },
     { value: "exit", name: "Exit" },
 ];
 async function main() {
-    const args = process.argv.slice(2);
-    // Fire version check early (non-blocking)
-    const updateCheck = checkForUpdate();
-    if (args.includes("--help") || args.includes("-h")) {
-        printUsage();
-        await showUpdateNotice(updateCheck);
+    const argv = process.argv.slice(2);
+    // MCP mode speaks JSON-RPC on stdout: no update checks or notices.
+    if (argv[0] === "mcp") {
+        await runMcpServer(await readPackageVersion().catch(() => "unknown"));
         return;
     }
-    if (args.includes("--version") || args.includes("-v")) {
-        const version = await readPackageVersion();
-        console.log(version);
-        await showUpdateNotice(updateCheck);
+    // School data is printed in many places; filter every printed line so a
+    // message can't smuggle terminal escape sequences. JSON keeps the data and
+    // only escapes it. Prompts write to the terminal directly (and keep their
+    // colours); their choices go through compactText.
+    const clean = outputMode(argv).json ? jsonSafe : terminalSafe;
+    for (const method of ["log", "error"]) {
+        const print = console[method].bind(console);
+        console[method] = (...parts) => print(...parts.map((part) => (typeof part === "string" ? clean(part) : part)));
+    }
+    // Commands continue the last Wilma session instead of logging in each time.
+    useSessionStore(fileSessionStore);
+    // Update notices are for people; agents and scripts skip the check.
+    const updateCheck = process.stderr.isTTY ? startUpdateCheck() : null;
+    try {
+        await runCommand(argv);
+        if (updateCheck)
+            await showUpdateNotice(updateCheck);
+    }
+    finally {
+        updateCheck?.cancel();
+    }
+}
+async function runCommand(argv) {
+    const parsed = parseCliArgs(argv);
+    const { command, action, args, flags } = parsed;
+    const out = makeOutput(argv, (result) => formatText(command ?? "", action, result));
+    if (flags.version && !command) {
+        console.log(await readPackageVersion());
         return;
     }
-    if (args[0] === "update") {
-        await handleUpdate();
+    if (command === "help" || flags.help) {
+        const topic = command === "help" ? args[0] : command;
+        const text = topic ? commandHelp(topic) : generalHelp();
+        if (!text)
+            throw new WilmaAiError("unknown_command", `No help for "${topic}". See wilma --help.`);
+        console.log(text);
         return;
     }
-    if (args[0] === "config" && args[1] === "clear") {
-        await clearConfig();
-        console.log(`Cleared config at ${getConfigPath()}`);
+    switch (command) {
+        case null: {
+            // The interactive menu needs a person at a terminal; programs get the help.
+            if (!process.stdin.isTTY || !process.stdout.isTTY) {
+                console.log(generalHelp());
+                return;
+            }
+            await runInteractive(await loadConfig());
+            return;
+        }
+        case "login":
+            await handleLogin(parsed.raw, out);
+            return;
+        case "accounts":
+            await handleAccounts(action, args, out);
+            return;
+        case "find-school":
+            await handleFindSchool(args.join(" "), out);
+            return;
+        case "update":
+            await handleUpdate();
+            return;
+        case "config":
+            await clearConfig();
+            await clearSessions();
+            out.data({ status: "cleared", configPath: getConfigPath() }, () => `Cleared saved logins and sessions (${getConfigPath()}).`);
+            return;
+        default:
+            try {
+                await runDataCommand(parsed, out);
+            }
+            finally {
+                // Also after an error: the session is still good for the next command.
+                await flushSessions();
+            }
+    }
+}
+/** Data commands: every child by default, the same results as the MCP tools. */
+async function runDataCommand(parsed, out) {
+    const { command, action, args, flags } = parsed;
+    const accounts = await resolveAccounts(await loadConfig());
+    if (!accounts.length) {
+        throw new WilmaAiError("not_logged_in", `No saved Wilma login. Run \`wilma login\`, or set ${ENV_VARS.tenant}, ${ENV_VARS.username} and ${ENV_VARS.password}.`);
+    }
+    const access = createAccess(accounts, { debug: flags.debug, totpSecret: flags.totpSecret });
+    const student = flags.student;
+    switch (command) {
+        case "summary":
+            return out.data(await access.summary({ student, days: flags.days, since: flags.since }));
+        case "schedule":
+            return out.data(await access.schedule({ student, when: flags.when, date: flags.date, weekday: flags.weekday }));
+        case "homework":
+            return out.data(await access.homework({ student, limit: flags.limit }));
+        case "exams":
+            return out.data(await access.upcomingExams({ student, limit: flags.limit }));
+        case "grades":
+            return out.data(await access.grades({ student, limit: flags.limit }));
+        case "gradebook":
+            return out.data(await access.gradebook({ student }));
+        case "notes":
+            if (action === "summary")
+                return out.data(await access.lessonNotesSummary({ student, from: flags.from, to: flags.to }));
+            return out.data(await access.lessonNotes({ student, date: flags.date, days: flags.days, from: flags.from, to: flags.to }));
+        case "messages":
+            if (action === "read")
+                return out.data(await access.message({ id: Number(args[0]), student }));
+            return out.data(await access.messages({ student, folder: flags.folder, limit: flags.limit }));
+        case "news":
+            if (action === "read")
+                return out.data(await access.newsItem({ id: Number(args[0]), student }));
+            if (action === "download") {
+                const fetched = await access.newsAttachment({ newsId: Number(args[0]), resourceId: args[1], student });
+                return printDownload(fetched, flags.output, out);
+            }
+            return out.data(await access.news({ student, limit: flags.limit, includeOlder: flags.older }));
+        case "printouts":
+            if (action === "download")
+                return printDownload(await access.printout({ id: args[0], student }), flags.output, out);
+            return out.data(await access.printouts({ student }));
+        case "students":
+            return out.data({ students: await access.studentList() });
+        default:
+            throw new WilmaAiError("unknown_command", `Unknown command "${command}". See wilma --help.`);
+    }
+}
+/** Save a fetched file in the output folder (default: the current one), never overwriting. */
+async function saveDownload(fetched, outputOption) {
+    // "~/Downloads" typed at the interactive prompt (no shell to expand it).
+    const output = outputOption?.replace(/^~(?=$|[\\/])/, homedir());
+    const directory = resolve(output ?? process.cwd());
+    await mkdir(directory, { recursive: true });
+    const { path, handle } = await createUniqueDownloadFile(directory, fetched.fileName);
+    try {
+        await handle.writeFile(fetched.data);
+    }
+    finally {
+        await handle.close();
+    }
+    return path;
+}
+async function printDownload(fetched, outputOption, out) {
+    const printoutId = "printoutId" in fetched ? fetched.printoutId : undefined;
+    const source = printoutId ? { printoutId } : { newsId: fetched.newsId, resourceId: fetched.resource.id };
+    if (fetched.status === "not_a_file") {
+        out.data({ status: "not_a_file", student: fetched.student, ...source, label: fetched.resource.label, url: fetched.resource.url, message: fetched.message }, () => [fetched.resource.label, fetched.message, fetched.resource.url].join("\n"));
         return;
     }
-    const config = await loadConfig();
-    if (args.length) {
-        await handleCommand(args, config);
-        await showUpdateNotice(updateCheck);
+    const path = await saveDownload(fetched, outputOption);
+    out.data({ status: "downloaded", student: fetched.student, ...source, label: fetched.resource.label, path, contentType: fetched.contentType, sizeBytes: fetched.data.byteLength }, () => `Downloaded ${fetched.resource.label} to ${path}`);
+}
+async function handleFindSchool(query, out) {
+    const wilmas = (await searchTenants(query, 15)).map((t) => ({ url: t.url, name: t.name }));
+    const hint = wilmas.length ? undefined : `No Wilma found for "${query}". Many schools use their city's Wilma: try the city or municipality the school is in.`;
+    out.data({ wilmas, ...(hint ? { hint } : {}) }, () => (hint ? hint : wilmas.map((t) => `${t.url}  ${t.name}`).join("\n")));
+}
+async function runInteractive(config) {
+    const mfa = createInteractiveMfa(() => saveConfig(config));
+    while (true) {
+        const profile = await chooseProfile(config, mfa);
+        if (!profile) {
+            return;
+        }
+        const access = new WilmaAccess({ profile: { ...profile, studentNumber: null }, mfa: mfa.callback });
+        const student = profile.studentNumber ?? undefined;
+        const show = (command, result, action = null) => {
+            console.clear();
+            console.log(formatText(command, action, result));
+        };
+        let nextAction = await selectOrCancel({
+            message: "What do you want to view?",
+            pageSize: 15,
+            choices: [
+                ...ACTIONS.filter((a) => a.value !== "exit"),
+                { value: "back", name: "Back to students" },
+                { value: "exit", name: "Exit" },
+            ],
+        });
+        if (nextAction === null) {
+            // Esc from main menu -> back to student picker
+            continue;
+        }
+        while (nextAction !== "exit" && nextAction !== "back") {
+            if (nextAction === "summary")
+                show("summary", await access.summary({ student }));
+            if (nextAction === "schedule-today")
+                show("schedule", await access.schedule({ student, when: "today" }));
+            if (nextAction === "schedule-tomorrow")
+                show("schedule", await access.schedule({ student, when: "tomorrow" }));
+            if (nextAction === "homework")
+                show("homework", await access.homework({ student }));
+            if (nextAction === "exams")
+                show("exams", await access.upcomingExams({ student }));
+            if (nextAction === "grades")
+                show("grades", await access.grades({ student }));
+            if (nextAction === "notes")
+                show("notes", await access.lessonNotes({ student, days: 14 }));
+            if (nextAction === "gradebook")
+                show("gradebook", await access.gradebook({ student }));
+            if (nextAction === "news")
+                await selectNewsToRead(access, student);
+            if (nextAction === "messages") {
+                const folder = await selectOrCancel({
+                    message: "Select folder",
+                    choices: [
+                        { value: "inbox", name: "Inbox" },
+                        { value: "archive", name: "Archive" },
+                        { value: "outbox", name: "Outbox" },
+                        { value: "drafts", name: "Drafts" },
+                        { value: "appointments", name: "Appointments" },
+                    ],
+                });
+                if (folder !== null) {
+                    await selectMessageToRead(access, student, folder);
+                }
+            }
+            const followUp = await selectOrCancel({
+                message: "What next?",
+                pageSize: 15,
+                choices: [
+                    ...ACTIONS.filter((a) => a.value !== "exit"),
+                    { value: "back", name: "Back to students" },
+                    { value: "exit", name: "Exit" },
+                ],
+            }, false);
+            nextAction = followUp ?? "back";
+        }
+        await flushSessions();
+        if (nextAction === "exit") {
+            return;
+        }
+    }
+}
+async function selectNewsToRead(access, student) {
+    const news = (await access.news({ student, limit: 30 })).students[0]?.news ?? [];
+    if (!news.length)
+        return;
+    const choices = [
+        { value: "back", name: "Back" },
+        ...news.map((item) => ({ value: String(item.wilmaId), name: newsLine(item) })),
+    ];
+    const selected = await selectOrCancel({ message: "Read which bulletin?", choices });
+    if (!selected || selected === "back")
+        return;
+    const read = await access.newsItem({ id: Number(selected), student });
+    console.clear();
+    console.log(formatText("news", "read", read));
+    for (;;) {
+        const resources = read.news.resources ?? [];
+        if (!resources.length)
+            return;
+        const pick = await selectOrCancel({
+            message: "Links",
+            choices: [
+                { value: "back", name: "Continue" },
+                ...resources.map((resource) => ({ value: resource.id, name: `Download "${compactText(resource.label)}"` })),
+            ],
+        }, false);
+        if (!pick || pick === "back")
+            return;
+        const directory = await inputOrCancel({ message: "Save to directory", default: resolve(homedir(), "Downloads") });
+        if (directory === null)
+            continue;
+        try {
+            const fetched = await access.newsAttachment({ newsId: read.news.wilmaId, resourceId: pick, student });
+            if (fetched.status === "not_a_file")
+                console.log(`${fetched.message}\n${fetched.resource.url}`);
+            else
+                console.log(`Downloaded ${fetched.resource.label} to ${await saveDownload(fetched, directory)}`);
+        }
+        catch (error) {
+            console.error("Download failed:", error instanceof Error ? error.message : error);
+        }
+    }
+}
+async function selectMessageToRead(access, student, folder) {
+    const messages = (await access.messages({ student, folder, limit: 30 })).students[0]?.messages ?? [];
+    if (!messages.length) {
+        console.log(`\nNo messages in ${folder}.`);
         return;
     }
-    await runInteractive(config);
-    await showUpdateNotice(updateCheck);
+    const choices = [
+        { value: "back", name: "Back" },
+        ...messages.map((msg) => ({ value: String(msg.wilmaId), name: messageLine(msg) })),
+    ];
+    const selected = await selectOrCancel({ message: "Read which message?", choices });
+    if (!selected || selected === "back")
+        return;
+    console.clear();
+    console.log(formatText("messages", "read", await access.message({ id: Number(selected), student })));
 }
-async function chooseProfile(config, onMfa, onStoredProfileResolved) {
+async function chooseProfile(config, mfa) {
+    const onMfa = mfa.callback;
     if (config.profiles.length) {
         const choices = config.profiles.map((p) => ({
             value: p.id,
@@ -75,7 +369,8 @@ async function chooseProfile(config, onMfa, onStoredProfileResolved) {
             if (!stored) {
                 throw new Error("Stored profile not found");
             }
-            onStoredProfileResolved?.(stored);
+            mfa.profile = stored;
+            mfa.typedSecret = null;
             const secret = revealSecret(stored.passwordObfuscated);
             if (!secret) {
                 throw new Error("Stored password could not be decoded");
@@ -110,119 +405,36 @@ async function chooseProfile(config, onMfa, onStoredProfileResolved) {
     const passwordValue = await passwordOrCancel({ message: "Wilma password" });
     if (passwordValue === null)
         return null;
-    const profileBase = {
-        baseUrl: tenant.url,
-        username,
-        password: passwordValue,
-    };
-    const students = await WilmaClient.listStudents(profileBase, onMfa);
+    // Codes for a new login can't come from another saved login's key.
+    mfa.profile = undefined;
+    mfa.typedSecret = null;
+    const newProfile = { baseUrl: tenant.url, username, password: passwordValue };
+    const verified = await WilmaClient.login(newProfile, onMfa);
+    const students = await verified.students();
+    // The commands that follow continue this session instead of logging in again.
+    adoptSession(newProfile, verified);
     const student = await chooseStudent(students);
     if (!student)
         return null;
-    const finalProfile = {
-        ...profileBase,
-        studentNumber: student?.studentNumber ?? undefined,
-    };
-    const stored = {
-        id: `${tenant.url}|${username}`,
+    // Same rules as `wilma login`: one entry per account, whatever the username's case.
+    const stored = await saveLogin(config, {
         tenantUrl: tenant.url,
         tenantName: tenant.name,
         username,
-        passwordObfuscated: obfuscateSecret(passwordValue),
-        students: students.map((s) => ({ studentNumber: s.studentNumber, name: s.name })),
-        lastStudentNumber: student?.studentNumber ?? null,
-        lastStudentName: student?.name ?? null,
-        lastUsedAt: new Date().toISOString(),
-    };
-    config.profiles = config.profiles.filter((p) => p.id !== stored.id).concat(stored);
-    config.lastProfileId = stored.id;
-    onStoredProfileResolved?.(stored);
+        password: passwordValue,
+        totpSecret: mfa.typedSecret,
+        students,
+    });
+    stored.lastStudentNumber = student.studentNumber;
+    stored.lastStudentName = student.name;
     await saveConfig(config);
-    return finalProfile;
-}
-async function runInteractive(config) {
-    const mfaState = { storedProfile: undefined };
-    const interactiveMfa = createInteractiveMfaCallback(() => mfaState.storedProfile, () => saveConfig(config));
-    while (true) {
-        const profile = await chooseProfile(config, interactiveMfa, (sp) => { mfaState.storedProfile = sp; });
-        if (!profile) {
-            return;
-        }
-        const client = await WilmaClient.login(profile, interactiveMfa);
-        let nextAction = await selectOrCancel({
-            message: "What do you want to view?",
-            pageSize: 15,
-            choices: [
-                ...ACTIONS.filter((a) => a.value !== "exit"),
-                { value: "back", name: "Back to students" },
-                { value: "exit", name: "Exit" },
-            ],
-        });
-        if (nextAction === null) {
-            // Esc from main menu -> back to student picker
-            continue;
-        }
-        while (nextAction !== "exit" && nextAction !== "back") {
-            if (nextAction === "summary") {
-                console.clear();
-                await outputSummary(client, { days: 7, json: false });
-            }
-            if (nextAction === "schedule-today") {
-                console.clear();
-                await outputSchedule(client, { when: "today", json: false });
-            }
-            if (nextAction === "schedule-tomorrow") {
-                console.clear();
-                await outputSchedule(client, { when: "tomorrow", json: false });
-            }
-            if (nextAction === "homework") {
-                console.clear();
-                await outputHomework(client, { limit: 10, json: false });
-            }
-            if (nextAction === "exams") {
-                console.clear();
-                await outputUpcomingExams(client, { limit: 20, json: false });
-            }
-            if (nextAction === "grades") {
-                console.clear();
-                await outputGrades(client, { limit: 20, json: false });
-            }
-            if (nextAction === "news") {
-                await selectNewsToRead(client);
-            }
-            if (nextAction === "messages") {
-                const folder = await selectOrCancel({
-                    message: "Select folder",
-                    choices: [
-                        { value: "inbox", name: "Inbox" },
-                        { value: "archive", name: "Archive" },
-                        { value: "outbox", name: "Outbox" },
-                        { value: "drafts", name: "Drafts" },
-                        { value: "appointments", name: "Appointments" },
-                    ],
-                });
-                if (folder !== null) {
-                    await selectMessageToRead(client, folder);
-                }
-            }
-            nextAction = await selectOrCancel({
-                message: "What next?",
-                pageSize: 15,
-                choices: [
-                    ...ACTIONS.filter((a) => a.value !== "exit"),
-                    { value: "back", name: "Back to students" },
-                    { value: "exit", name: "Exit" },
-                ],
-            }, false); // Don't clear screen - preserve content output
-            if (nextAction === null) {
-                // Esc from action menu -> back to student picker
-                nextAction = "back";
-            }
-        }
-        if (nextAction === "exit") {
-            return;
-        }
-    }
+    mfa.profile = stored;
+    return {
+        baseUrl: stored.tenantUrl,
+        username,
+        password: passwordValue,
+        studentNumber: student.studentNumber,
+    };
 }
 async function selectTenant() {
     const tenants = await listTenants();
@@ -240,11 +452,7 @@ async function selectTenant() {
                 municipalities: [],
             };
         }
-        let filtered = tenants;
-        if (query.trim()) {
-            const search = query.trim().toLowerCase();
-            filtered = tenants.filter((t) => tenantMatches(search, t));
-        }
+        const filtered = query.trim() ? await searchTenants(query, 20) : tenants;
         const choices = filtered.slice(0, 20).map((t) => ({
             value: t.url,
             name: `${t.name ?? t.url} (${t.url})`,
@@ -281,42 +489,6 @@ async function selectTenant() {
         return tenant;
     }
 }
-function tenantMatches(search, tenant) {
-    const needle = (search ?? "").toLowerCase();
-    if (fuzzyIncludes(tenant.name ?? "", needle)) {
-        return true;
-    }
-    if (fuzzyIncludes(tenant.url ?? "", needle)) {
-        return true;
-    }
-    const municipalities = Array.isArray(tenant.municipalities) ? tenant.municipalities : [];
-    for (const m of municipalities) {
-        if (!m)
-            continue;
-        if (fuzzyIncludes(m.nameFi ?? "", needle))
-            return true;
-        if (fuzzyIncludes(m.nameSv ?? "", needle))
-            return true;
-    }
-    return false;
-}
-function fuzzyIncludes(target, needle) {
-    const hay = (target ?? "").toLowerCase();
-    const search = (needle ?? "").toLowerCase();
-    if (!search)
-        return true;
-    if (hay.includes(search))
-        return true;
-    let i = 0;
-    for (const ch of hay) {
-        if (ch === search[i]) {
-            i += 1;
-            if (i >= search.length)
-                return true;
-        }
-    }
-    return false;
-}
 async function chooseStudent(students) {
     if (!students.length) {
         const manual = await inputOrCancel({ message: "Student number (not found automatically)" });
@@ -331,7 +503,7 @@ async function chooseStudent(students) {
         message: "Select student",
         choices: students.map((s) => ({
             value: s.studentNumber,
-            name: `${s.name} (${s.studentNumber})`,
+            name: `${compactText(s.name)} (${s.studentNumber})`,
         })),
     });
     if (selected === null)
@@ -340,7 +512,11 @@ async function chooseStudent(students) {
 }
 async function chooseStudentFromProfile(stored, baseProfile, onMfa) {
     let students = [];
-    const fresh = await WilmaClient.listStudents(baseProfile, onMfa);
+    const fresh = await new WilmaAccess({ profile: baseProfile, mfa: onMfa }).students().catch((err) => {
+        if (stored.students?.length)
+            return [];
+        throw err;
+    });
     if (fresh.length) {
         students = fresh;
         stored.students = fresh.map((s) => ({ studentNumber: s.studentNumber, name: s.name }));
@@ -366,548 +542,212 @@ async function chooseStudentFromProfile(stored, baseProfile, onMfa) {
         default: defaultStudent?.studentNumber,
         choices: students.map((s) => ({
             value: s.studentNumber,
-            name: `${s.name} (${s.studentNumber})`,
+            name: `${compactText(s.name)} (${s.studentNumber})`,
         })),
     });
     if (selected === null)
         return null;
     return students.find((s) => s.studentNumber === selected) ?? null;
 }
-async function handleCommand(args, config) {
-    const { command, subcommand, resourceAction, flags } = parseArgs(args);
-    if (command === "config" && subcommand === "clear") {
-        await clearConfig();
-        console.log(`Cleared config at ${getConfigPath()}`);
-        return;
-    }
-    const profile = await getProfileForCommandNonInteractive(config, flags);
-    if (!profile)
-        return;
-    // Use --totp-secret flag, or fall back to stored TOTP secret from config
-    let totpSecret = flags.totpSecret;
-    if (!totpSecret) {
-        const stored = config.profiles.find((p) => p.id === config.lastProfileId);
-        if (stored?.totpSecretObfuscated) {
-            totpSecret = revealSecret(stored.totpSecretObfuscated) ?? undefined;
+async function handleLogin(args, out) {
+    const flags = { browser: true };
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--tenant")
+            flags.tenant = args[++i];
+        else if (arg === "--username")
+            flags.username = args[++i];
+        else if (arg === "--password-stdin")
+            flags.passwordStdin = true;
+        else if (arg === "--totp-secret")
+            flags.totpSecret = args[++i];
+        else if (arg === "--no-browser")
+            flags.browser = false;
+        else if (arg === "--json" || arg === "--text")
+            continue;
+        else if (arg === "--password") {
+            throw new WilmaAiError("invalid_argument", `Passing the password as a flag would leave it in shell history. Use ${ENV_VARS.password} or --password-stdin.`);
         }
+        else
+            throw new WilmaAiError("invalid_argument", `Unknown login option "${arg}". See wilma help login.`);
     }
-    const mfaCallback = createNonInteractiveMfaCallback(totpSecret);
-    const client = await WilmaClient.login(profile, mfaCallback);
-    if (command === "kids") {
-        const students = await getStudentsForCommand(profile, config);
-        if (flags.json) {
-            console.log(JSON.stringify(students, null, 2));
+    const report = (stored) => {
+        const students = (stored.students ?? []).map((s) => s.name);
+        if (out.json) {
+            out.data({ status: "ok", wilma: stored.tenantName ?? stored.tenantUrl, username: stored.username, students, configPath: getConfigPath() });
             return;
         }
-        console.log("\nKids");
-        students.forEach((s) => {
-            console.log(`- ${s.studentNumber} ${s.name}`);
+        console.log(`Logged in to ${stored.tenantName ?? stored.tenantUrl} as ${stored.username}.`);
+        if (students.length)
+            console.log(`Children: ${students.join(", ")}`);
+        console.log(`Saved to ${getConfigPath()}`);
+    };
+    // Non-interactive: flags (with env fallback) — for agents and scripts.
+    if (flags.tenant || flags.username || flags.passwordStdin) {
+        const tenantQuery = flags.tenant ?? process.env[ENV_VARS.tenant];
+        const username = flags.username ?? process.env[ENV_VARS.username];
+        if (!tenantQuery || !username) {
+            throw new WilmaAiError("invalid_argument", "Non-interactive login needs --tenant and --username (or WILMA_TENANT / WILMA_USERNAME).");
+        }
+        const password = flags.passwordStdin ? (await readStdin()).replace(/\r?\n$/, "") : process.env[ENV_VARS.password];
+        if (!password) {
+            throw new WilmaAiError("invalid_argument", `No password given. Pipe it with --password-stdin or set ${ENV_VARS.password}.`);
+        }
+        const tenant = await resolveTenant(tenantQuery);
+        const totpSecret = flags.totpSecret ?? process.env[ENV_VARS.totpSecret] ?? null;
+        const { client, students } = await verifyLoginSession({ tenantUrl: tenant.url, username, password, totpSecret });
+        // The next commands continue this session: no second login (or code).
+        adoptSession({ baseUrl: normalizeTenantUrl(tenant.url), username, password }, client);
+        const stored = await saveLogin(await loadConfig(), {
+            tenantUrl: tenant.url,
+            tenantName: tenant.name,
+            username,
+            password,
+            totpSecret,
+            students,
         });
+        report(stored);
+        await flushSessions();
         return;
     }
-    if (command === "news") {
-        if (subcommand === "resource") {
-            if (resourceAction !== "download") {
-                throw new Error('Expected "wilma news resource download <news-id> <resource-id>"');
-            }
-            const newsId = parseReadId(flags.id, "news");
-            const resourceId = normalizeResourceId(flags.resourceId);
-            if (!resourceId) {
-                throw new Error("Missing news resource id (for example, resource-1 or just 1)");
-            }
-            if (!flags.student) {
-                const students = await getStudentsForCommand(profile, config);
-                if (students.length > 1) {
-                    console.error("Multiple students found. Use --student <id> to specify which one:");
-                    students.forEach((s) => console.error(`  ${s.studentNumber}  ${s.name}`));
-                    process.exit(1);
-                }
-            }
-            const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-            if (!studentInfo && !profile.studentNumber) {
-                await printStudentSelectionHelp(profile, config);
-                return;
-            }
-            const perStudentClient = await WilmaClient.login({
-                ...profile,
-                studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            }, mfaCallback);
-            await outputNewsResourceDownload(perStudentClient, newsId, resourceId, {
-                output: flags.output,
-                json: flags.json,
-            });
-            return;
-        }
-        if (subcommand === "read" && flags.id) {
-            const newsId = parseReadId(flags.id, "news");
-            if (!flags.student) {
-                const students = await getStudentsForCommand(profile, config);
-                if (students.length > 1) {
-                    console.error("Multiple students found. Use --student <id> to specify which one:");
-                    students.forEach((s) => console.error(`  ${s.studentNumber}  ${s.name}`));
-                    process.exit(1);
-                }
-            }
-            const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-            if (!studentInfo && !profile.studentNumber) {
-                await printStudentSelectionHelp(profile, config);
-                return;
-            }
-            const perStudentClient = await WilmaClient.login({
-                ...profile,
-                studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            }, mfaCallback);
-            await outputNewsItem(perStudentClient, newsId, flags.json, {
-                studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            });
-            return;
-        }
-        if (flags.allStudents) {
-            await outputAllNews(profile, config, flags.limit ?? 20, flags.json, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputNews(perStudentClient, {
-            limit: flags.limit ?? 20,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
-        return;
+    // Browser: a one-time page on 127.0.0.1 where the parent logs in.
+    if (flags.browser && openBrowser("about:blank", { dryRun: true }) === "headless") {
+        // A cloud computer: the parent can't reach a page served here.
+        throw new WilmaAiError("no_browser", HEADLESS_LOGIN_HELP);
     }
-    if (command === "messages") {
-        if (subcommand === "read" && flags.id) {
-            const messageId = parseReadId(flags.id, "message");
-            if (!flags.student) {
-                const students = await getStudentsForCommand(profile, config);
-                if (students.length > 1) {
-                    console.error("Multiple students found. Use --student <id> to specify which one:");
-                    students.forEach((s) => console.error(`  ${s.studentNumber}  ${s.name}`));
-                    process.exit(1);
-                }
-            }
-            const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-            if (!studentInfo && !profile.studentNumber) {
-                await printStudentSelectionHelp(profile, config);
+    const server = await startLoginServer({
+        onSaved: (stored) => {
+            if (out.json)
                 return;
-            }
-            const perStudentClient = await WilmaClient.login({
-                ...profile,
-                studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            }, mfaCallback);
-            await outputMessageItem(perStudentClient, messageId, flags.json);
-            return;
-        }
-        if (flags.allStudents) {
-            await outputAllMessages(profile, config, {
-                folder: flags.folder ?? "inbox",
-                limit: flags.limit ?? 20,
-                json: flags.json,
-            }, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputMessages(perStudentClient, {
-            folder: flags.folder ?? "inbox",
-            limit: flags.limit ?? 20,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
-        return;
+            const students = (stored.students ?? []).map((s) => s.name);
+            console.log(`\nLogged in to ${stored.tenantName ?? stored.tenantUrl} as ${stored.username}.`);
+            if (students.length)
+                console.log(`Children: ${students.join(", ")}`);
+            console.log("Add another Wilma in the browser if a child is on a different one, or press Done there (or Enter here) to finish.");
+        },
+    });
+    const opened = flags.browser && openBrowser(server.url) === "opened";
+    if (!out.json) {
+        console.log(opened ? "Opening your browser to log in to Wilma…" : "Open this link in a browser on this computer to log in to Wilma:");
+        console.log(`  ${server.url}`);
+        console.log("Waiting for login (Ctrl+C to cancel)…");
     }
-    if (command === "attendance") {
-        if (flags.allStudents) {
-            await outputAllAttendance(profile, config, { date: flags.date, json: flags.json }, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputAttendance(perStudentClient, {
-            date: flags.date,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
+    else {
+        console.error(JSON.stringify({ status: "waiting", url: server.url }));
+    }
+    // Enter in the terminal finishes too, in case the browser tab was closed without pressing Done.
+    const finishOnEnter = () => server.close();
+    if (process.stdin.isTTY) {
+        process.stdin.resume();
+        process.stdin.once("data", finishOnEnter);
+    }
+    const logins = await server.closed;
+    if (process.stdin.isTTY) {
+        process.stdin.off("data", finishOnEnter);
+        process.stdin.pause();
+    }
+    if (!logins.length) {
+        throw new WilmaAiError("login_cancelled", "Login page closed before logging in. Run `wilma login` again.");
+    }
+    await flushSessions();
+    if (out.json) {
+        out.data({
+            status: "ok",
+            logins: logins.map((stored) => ({
+                wilma: stored.tenantName ?? stored.tenantUrl,
+                username: stored.username,
+                students: (stored.students ?? []).map((s) => s.name),
+            })),
+            configPath: getConfigPath(),
         });
         return;
     }
-    if (command === "exams") {
-        if (flags.allStudents) {
-            await outputAllExams(profile, config, flags.limit ?? 20, flags.json, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputUpcomingExams(perStudentClient, {
-            limit: flags.limit ?? 20,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
+    console.log(`\nSaved to ${getConfigPath()}`);
+}
+const HEADLESS_LOGIN_HELP = [
+    "This computer has no browser, so the login page can't be shown here.",
+    "If you are an agent on a cloud computer, set up the login with the user instead:",
+    "  1. Ask the user which city their children's school is in (or the school's name),",
+    "     run `wilma tenants <city>` and let them pick their Wilma from the list.",
+    `  2. Ask them to store their Wilma username and password in your secret settings as`,
+    `     ${ENV_VARS.username} and ${ENV_VARS.password} (plus ${ENV_VARS.totpSecret} for two-step verification),`,
+    `     and set ${ENV_VARS.tenant} to the address they picked. Commands then work without \`wilma login\`.`,
+    "  Never ask the user to type their Wilma password into the chat.",
+].join("\n");
+/** List saved Wilma logins, or remove one: `wilma accounts remove <number|Wilma name|username>`. */
+async function handleAccounts(action, args, out) {
+    const config = await loadConfig();
+    if (action === "remove") {
+        const target = args.join(" ").trim().toLowerCase();
+        if (!target)
+            throw new WilmaAiError("invalid_argument", "Which login? Use the number from `wilma accounts`, the Wilma name or the username.");
+        const byNumber = /^\d+$/.test(target) ? config.profiles[Number(target) - 1] : undefined;
+        const matches = byNumber
+            ? [byNumber]
+            : config.profiles.filter((p) => [p.tenantName ?? "", p.tenantUrl, p.username].some((v) => v.toLowerCase() === target));
+        if (matches.length !== 1) {
+            throw new WilmaAiError(matches.length ? "ambiguous_account" : "unknown_account", matches.length ? `"${target}" matches several logins; use its number.` : `No saved login matches "${target}".`);
+        }
+        const removed = matches[0];
+        config.profiles = config.profiles.filter((p) => p.id !== removed.id);
+        if (config.lastProfileId === removed.id)
+            config.lastProfileId = config.profiles[0]?.id ?? null;
+        await saveConfig(config);
+        await clearSessions();
+        const result = { status: "removed", wilma: removed.tenantName ?? removed.tenantUrl, username: removed.username };
+        out.data(result, () => `Removed ${removed.username} @ ${result.wilma}.`);
         return;
     }
-    if (command === "schedule") {
-        if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "schedule", flags, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputSchedule(perStudentClient, {
-            when: flags.when ?? "week",
-            date: flags.date,
-            weekday: flags.weekday,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
+    const accounts = config.profiles.map((p, i) => ({
+        number: i + 1,
+        wilma: p.tenantName ?? p.tenantUrl,
+        url: p.tenantUrl,
+        username: p.username,
+        children: (p.students ?? []).map((st) => st.name),
+    }));
+    out.data({ accounts }, () => accounts.length
+        ? [
+            ...accounts.map((a) => `${a.number}. ${a.wilma} — ${a.username}${a.children.length ? ` (${a.children.join(", ")})` : ""}`),
+            "",
+            "Add another with `wilma login`; remove one with `wilma accounts remove <number>`.",
+        ].join("\n")
+        : "No saved Wilma logins. Run `wilma login`.");
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf-8");
+}
+async function readPackageVersion() {
+    // fileURLToPath: install paths can have spaces, non-ASCII letters or a Windows drive.
+    const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+    const raw = await readFile(pkgPath, "utf-8");
+    const data = JSON.parse(raw);
+    return data.version ?? "unknown";
+}
+async function handleUpdate() {
+    const currentVersion = await readPackageVersion();
+    console.log(`Current version: ${currentVersion}`);
+    console.log("Updating @wilm-ai/wilma-cli...\n");
+    // npm is npm.cmd on Windows, which only runs through a shell. The command is a
+    // fixed string, so the shell sees no user input.
+    const command = "npm install -g @wilm-ai/wilma-cli@latest";
+    const child = process.platform === "win32"
+        ? spawn(command, { stdio: "inherit", shell: true })
+        : spawn("npm", command.split(" ").slice(1), { stdio: "inherit" });
+    const code = await new Promise((resolve, reject) => {
+        child.on("error", (err) => {
+            reject(err.code === "ENOENT"
+                ? new Error("npm wasn't found. Install Node.js (it includes npm) from https://nodejs.org and run `wilma update` again.")
+                : err);
         });
-        return;
+        child.on("close", resolve);
+    });
+    if (code !== 0) {
+        throw new Error(`npm couldn't update WilmAI (exit code ${code}); see npm's message above.`);
     }
-    if (command === "homework") {
-        if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "homework", flags, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputHomework(perStudentClient, {
-            limit: flags.limit ?? 10,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
-        return;
-    }
-    if (command === "grades") {
-        if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "grades", flags, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputGrades(perStudentClient, {
-            limit: flags.limit ?? 20,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
-        return;
-    }
-    if (command === "summary") {
-        if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "summary", flags, mfaCallback);
-            return;
-        }
-        const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
-        if (!studentInfo && !profile.studentNumber) {
-            await printStudentSelectionHelp(profile, config);
-            return;
-        }
-        const perStudentClient = await WilmaClient.login({
-            ...profile,
-            studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        }, mfaCallback);
-        await outputSummary(perStudentClient, {
-            days: flags.days ?? 7,
-            json: flags.json,
-            label: studentInfo?.name ?? undefined,
-        });
-        return;
-    }
-    printUsage();
-}
-function printUsage() {
-    console.log("Usage:");
-    console.log("  wilma summary [--days 7] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma schedule list [--when today|tomorrow|week] [--date YYYY-MM-DD] [--weekday mon|tue|wed|thu|fri|sat|sun] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma homework list [--limit 10] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma exams list [--limit 20] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma grades list [--limit 20] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma kids list [--json]");
-    console.log("  wilma news list [--limit 20] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma news read <id> [--student <id|name>] [--json]");
-    console.log("  wilma news resource download <news-id> <resource-id> [--student <id|name>] [--output <directory>] [--json]");
-    console.log("  wilma messages list [--folder inbox] [--limit 20] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma messages read <id> [--student <id|name>] [--json]");
-    console.log("  wilma attendance list [--date YYYY-MM-DD] [--student <id|name>] [--all-students] [--json]");
-    console.log("  wilma update");
-    console.log("  wilma config clear");
-    console.log("  wilma --help | -h");
-    console.log("  wilma --version | -v");
-    console.log("");
-    console.log("MFA: --totp-secret <base32-key|otpauth://...>");
-}
-async function getProfileForCommandNonInteractive(config, flags) {
-    if (!config.lastProfileId) {
-        console.error("No saved profile found. Run the interactive CLI first.");
-        return null;
-    }
-    const stored = config.profiles.find((p) => p.id === config.lastProfileId);
-    if (!stored) {
-        console.error("Saved profile not found. Run the interactive CLI first.");
-        return null;
-    }
-    const secret = revealSecret(stored.passwordObfuscated);
-    if (!secret) {
-        console.error("Stored password could not be decoded. Re-login interactively.");
-        return null;
-    }
-    return {
-        baseUrl: stored.tenantUrl,
-        username: stored.username,
-        password: secret,
-        studentNumber: stored.lastStudentNumber ?? undefined,
-        debug: Boolean(flags.debug),
-    };
-}
-function parseArgs(args) {
-    const [command, rawSubcommand, ...rawRest] = args;
-    // If "subcommand" is actually a flag, push it back into rest
-    const subcommand = rawSubcommand?.startsWith("--") ? undefined : rawSubcommand;
-    const rest = rawSubcommand?.startsWith("--") ? [rawSubcommand, ...rawRest] : rawRest;
-    const flags = {};
-    const positionals = [];
-    let i = 0;
-    while (i < rest.length) {
-        const arg = rest[i];
-        if (arg === "--json") {
-            flags.json = true;
-            i += 1;
-            continue;
-        }
-        if (arg === "--all-students" || arg === "--all") {
-            flags.allStudents = true;
-            i += 1;
-            continue;
-        }
-        if (arg === "--debug") {
-            flags.debug = true;
-            i += 1;
-            continue;
-        }
-        if (arg === "--limit") {
-            const value = Number(rest[i + 1]);
-            if (!Number.isNaN(value)) {
-                flags.limit = value;
-            }
-            i += 2;
-            continue;
-        }
-        if (arg === "--student") {
-            flags.student = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--folder") {
-            flags.folder = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--when") {
-            flags.when = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--days") {
-            const value = Number(rest[i + 1]);
-            if (!Number.isNaN(value)) {
-                flags.days = value;
-            }
-            i += 2;
-            continue;
-        }
-        if (arg === "--date") {
-            flags.date = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--weekday") {
-            flags.weekday = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--totp-secret") {
-            flags.totpSecret = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (arg === "--output") {
-            flags.output = rest[i + 1];
-            i += 2;
-            continue;
-        }
-        if (!arg.startsWith("--")) {
-            positionals.push(arg);
-        }
-        i += 1;
-    }
-    const resourceAction = command === "news" && subcommand === "resource"
-        ? positionals[0]
-        : undefined;
-    if (resourceAction) {
-        flags.id = positionals[1];
-        flags.resourceId = positionals[2];
-    }
-    else {
-        flags.id = positionals[0];
-    }
-    return { command, subcommand, resourceAction, flags };
-}
-function parseReadId(raw, entity) {
-    if (!raw) {
-        console.error(`Missing ${entity} id.`);
-        process.exit(1);
-    }
-    const id = Number(raw);
-    if (!Number.isInteger(id) || id <= 0) {
-        console.error(`Invalid ${entity} id "${raw}". Expected a positive integer.`);
-        process.exit(1);
-    }
-    return id;
-}
-function parseIsoDateOrExit(raw) {
-    const value = (raw ?? "").trim();
-    // Accept YYYY-MM-DD only.
-    if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
-        console.error(`Invalid date "${raw}". Expected YYYY-MM-DD.`);
-        process.exit(1);
-    }
-    // Validate date is real.
-    const d = new Date(value + "T12:00:00Z");
-    if (Number.isNaN(d.getTime())) {
-        console.error(`Invalid date "${raw}". Expected a real calendar date.`);
-        process.exit(1);
-    }
-    const iso = d.toISOString().slice(0, 10);
-    if (iso !== value) {
-        console.error(`Invalid date "${raw}". Expected a real calendar date.`);
-        process.exit(1);
-    }
-    return value;
-}
-function normalizeWeekdayOrExit(raw) {
-    const v = (raw ?? "").trim().toLowerCase();
-    const map = {
-        sun: 0,
-        su: 0,
-        sunday: 0,
-        mon: 1,
-        ma: 1,
-        monday: 1,
-        tue: 2,
-        ti: 2,
-        tuesday: 2,
-        wed: 3,
-        ke: 3,
-        wednesday: 3,
-        thu: 4,
-        to: 4,
-        thursday: 4,
-        fri: 5,
-        pe: 5,
-        friday: 5,
-        sat: 6,
-        la: 6,
-        saturday: 6,
-    };
-    const day = map[v];
-    if (day === undefined) {
-        console.error(`Invalid weekday "${raw}". Use mon|tue|wed|thu|fri|sat|sun (also accepts fi: ma|ti|ke|to|pe|la|su).`);
-        process.exit(1);
-    }
-    return day;
-}
-function nextDateForWeekday(rawWeekday) {
-    const target = normalizeWeekdayOrExit(rawWeekday);
-    const now = new Date();
-    // Use local time.
-    const today = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 12, 0, 0);
-    const current = today.getDay();
-    let delta = (target - current + 7) % 7;
-    // If you ask for e.g. "thu" on a Saturday, you'll get next Thursday.
-    // If you ask for today's weekday, you'll get today.
-    const d = new Date(today);
-    d.setDate(d.getDate() + delta);
-    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-}
-async function readPackageVersion() {
-    const pkgPath = resolve(dirname(new URL(import.meta.url).pathname), "..", "package.json");
-    const raw = await readFile(pkgPath, "utf-8");
-    const data = JSON.parse(raw);
-    return data.version ?? "unknown";
-}
-async function handleUpdate() {
-    const currentVersion = await readPackageVersion();
-    console.log(`Current version: ${currentVersion}`);
-    console.log("Updating @wilm-ai/wilma-cli...\n");
-    return new Promise((resolve, reject) => {
-        const child = spawn("npm", ["install", "-g", "@wilm-ai/wilma-cli@latest"], {
-            stdio: "inherit",
-        });
-        child.on("error", (err) => {
-            if (err.code === "ENOENT") {
-                console.error("Error: npm not found. Please install npm and try again.");
-            }
-            else {
-                console.error("Update failed:", err.message);
-            }
-            reject(err);
-        });
-        child.on("close", (code) => {
-            if (code === 0) {
-                console.log("\nUpdate complete.");
-                resolve();
-            }
-            else {
-                console.error(`\nnpm exited with code ${code}`);
-                reject(new Error(`npm exited with code ${code}`));
-            }
-        });
-    });
+    console.log("\nUpdate complete.");
 }
 // --- Version check / update notification ---
 const VERSION_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
@@ -925,37 +765,47 @@ async function readVersionCache() {
 }
 async function writeVersionCache(cache) {
     const cachePath = getVersionCachePath();
-    await mkdir(dirname(cachePath), { recursive: true });
-    await writeFile(cachePath, JSON.stringify(cache), "utf-8");
-}
-async function checkForUpdate() {
-    try {
+    await mkdir(dirname(cachePath), { recursive: true, mode: 0o700 });
+    await writeFile(cachePath, JSON.stringify(cache), { encoding: "utf-8", mode: 0o600 });
+}
+/**
+ * Ask npm for the latest version at most once a day. A failed check counts as
+ * a check too: agents in sandboxes without internet access shouldn't pay for
+ * a timeout on every command.
+ */
+function startUpdateCheck() {
+    const controller = new AbortController();
+    let cancelled = false;
+    const result = (async () => {
         const cache = await readVersionCache();
         if (cache && Date.now() - cache.checkedAt < VERSION_CHECK_INTERVAL_MS) {
             return cache.latestVersion;
         }
-        const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3000);
         try {
             const response = await fetch("https://registry.npmjs.org/@wilm-ai/wilma-cli/latest", { signal: controller.signal });
-            clearTimeout(timeout);
-            if (!response.ok)
-                return cache?.latestVersion ?? null;
-            const data = (await response.json());
-            const latestVersion = data.version ?? null;
-            if (latestVersion) {
-                await writeVersionCache({ latestVersion, checkedAt: Date.now() });
-            }
+            const data = response.ok ? (await response.json()) : {};
+            const latestVersion = data.version ?? cache?.latestVersion ?? null;
+            await writeVersionCache({ latestVersion, checkedAt: Date.now() });
             return latestVersion;
         }
         catch {
-            clearTimeout(timeout);
+            // Cancelled because the command finished: try again next time.
+            if (!cancelled)
+                await writeVersionCache({ latestVersion: cache?.latestVersion ?? null, checkedAt: Date.now() }).catch(() => { });
             return cache?.latestVersion ?? null;
         }
-    }
-    catch {
-        return null;
-    }
+        finally {
+            clearTimeout(timeout);
+        }
+    })().catch(() => null);
+    return {
+        result,
+        cancel() {
+            cancelled = true;
+            controller.abort();
+        },
+    };
 }
 function isNewerVersion(latest, current) {
     const latestParts = latest.split(".").map(Number);
@@ -970,11 +820,14 @@ function isNewerVersion(latest, current) {
     }
     return false;
 }
-async function showUpdateNotice(versionCheckPromise) {
+async function showUpdateNotice(check) {
+    let timer;
     try {
         const latestVersion = await Promise.race([
-            versionCheckPromise,
-            new Promise((resolve) => setTimeout(() => resolve(null), 1000)),
+            check.result,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(null), 1000);
+            }),
         ]);
         if (!latestVersion)
             return;
@@ -987,589 +840,9 @@ async function showUpdateNotice(versionCheckPromise) {
     catch {
         // Silently ignore any errors
     }
-}
-async function outputNews(client, opts) {
-    const news = await client.news.list();
-    const slice = news.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    console.log(`\nNews (${news.length})`);
-    slice.forEach((item) => {
-        const date = item.published ? item.published.toISOString().slice(0, 10) : "";
-        const prefix = opts.label ? `[${opts.label}] ` : "";
-        console.log(`- ${prefix}${date} ${compactText(item.title)} (id:${item.wilmaId})`.trim());
-    });
-}
-async function outputNewsItem(client, id, json, opts) {
-    const item = await client.news.get(id);
-    if (json) {
-        console.log(JSON.stringify(item, null, 2));
-        return item;
-    }
-    console.log(`\n${item.title}`);
-    if (item.subtitle)
-        console.log(item.subtitle);
-    if (item.published)
-        console.log(item.published.toISOString());
-    if (item.content)
-        console.log(`\n${formatContent(item.content)}`);
-    if (item.resources?.length) {
-        console.log(`\nResources (${item.resources.length})`);
-        for (const resource of item.resources) {
-            const origin = resource.authContext === "wilma" ? "Wilma" : new URL(resource.url).host;
-            console.log(`\n[${resource.id}] ${resource.label} (${origin})`);
-            console.log(`    ${resource.url}`);
-        }
-        if (!opts?.suppressDownloadHint) {
-            const student = opts?.studentNumber ?? "<id|name>";
-            console.log(`\nDownload any resource with:\n  wilma news resource download ${item.wilmaId} <resource-id> --student ${student} --output <directory>`);
-        }
-    }
-    return item;
-}
-const MAX_NEWS_RESOURCE_BYTES = 50 * 1024 * 1024;
-async function outputNewsResourceDownload(client, newsId, resourceId, opts) {
-    const item = await client.news.get(newsId);
-    const resource = item.resources?.find((candidate) => candidate.id === resourceId);
-    if (!resource) {
-        const known = (item.resources ?? []).map((r) => r.id).join(", ") || "none";
-        throw new Error(`News resource "${resourceId}" not found in news item ${newsId} (available: ${known})`);
-    }
-    const fetched = await client.news.fetchResource(newsId, resourceId, { item });
-    if (fetched.status === "not_a_file" || !fetched.response) {
-        const result = {
-            status: "not_a_file",
-            newsId,
-            resource,
-            availableActions: ["open_in_browser"],
-            message: "The link answered with a web page instead of a file. It may require signing in — open the URL in a browser instead.",
-        };
-        if (opts.json) {
-            console.log(JSON.stringify(result, null, 2));
-        }
-        else {
-            console.log(`\n${resource.label}`);
-            console.log(result.message);
-            console.log(resource.url);
-        }
-        return result;
-    }
-    const { response } = fetched;
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new Error(`News resource download failed with HTTP ${response.status}`);
-    }
-    const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim() || null;
-    const declaredLength = Number(response.headers.get("content-length") ?? "0");
-    if (Number.isFinite(declaredLength) && declaredLength > MAX_NEWS_RESOURCE_BYTES) {
-        await response.body?.cancel();
-        throw new Error("News resource exceeds the 50 MB download limit");
-    }
-    const outputDirectory = resolve(opts.output ?? process.cwd());
-    await mkdir(outputDirectory, { recursive: true });
-    const preferredName = fileNameFromResponse(resource, response.headers.get("content-disposition"), contentType);
-    const { path, handle } = await createUniqueDownloadFile(outputDirectory, preferredName);
-    let sizeBytes = 0;
-    try {
-        if (!response.body) {
-            throw new Error("News resource response had no body");
-        }
-        const reader = response.body.getReader();
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            sizeBytes += value.byteLength;
-            if (sizeBytes > MAX_NEWS_RESOURCE_BYTES) {
-                await reader.cancel();
-                throw new Error("News resource exceeds the 50 MB download limit");
-            }
-            let offset = 0;
-            while (offset < value.byteLength) {
-                const { bytesWritten } = await handle.write(value, offset, value.byteLength - offset);
-                if (bytesWritten === 0) {
-                    throw new Error("Could not write news resource to disk");
-                }
-                offset += bytesWritten;
-            }
-        }
-        await handle.close();
-    }
-    catch (error) {
-        await handle.close().catch(() => undefined);
-        await rm(path, { force: true });
-        throw error;
-    }
-    const result = {
-        status: "downloaded",
-        newsId,
-        resourceId,
-        path,
-        contentType,
-        sizeBytes,
-    };
-    if (opts.json) {
-        console.log(JSON.stringify(result, null, 2));
-    }
-    else {
-        console.log(`Downloaded ${resource.label} to ${path}`);
-    }
-    return result;
-}
-function normalizeResourceId(raw) {
-    if (!raw)
-        return undefined;
-    return /^\d+$/.test(raw) ? `resource-${raw}` : raw;
-}
-function fileNameFromResponse(resource, contentDisposition, contentType) {
-    const encoded = /filename\*=UTF-8''([^;]+)/i.exec(contentDisposition ?? "")?.[1];
-    const quoted = /filename="([^"]+)"/i.exec(contentDisposition ?? "")?.[1];
-    const plain = /filename=([^;]+)/i.exec(contentDisposition ?? "")?.[1]?.trim();
-    let name = encoded ? decodeURIComponentSafely(encoded) : quoted ?? plain ?? resource.fileName ?? resource.label;
-    name = sanitizeFileName(name);
-    if (!/\.[A-Za-z0-9]{1,8}$/.test(name)) {
-        const extension = extensionForContentType(contentType);
-        if (extension)
-            name += extension;
-    }
-    return name || "wilma-resource";
-}
-function sanitizeFileName(value) {
-    return value
-        .replace(/[\\/:*?"<>|\u0000-\u001f]/g, "_")
-        .replace(/^\.+|\.+$/g, "")
-        .trim()
-        .slice(0, 180);
-}
-function extensionForContentType(contentType) {
-    const extensions = {
-        "application/pdf": ".pdf",
-        "application/zip": ".zip",
-        "image/jpeg": ".jpg",
-        "image/png": ".png",
-        "text/plain": ".txt",
-        "text/csv": ".csv",
-    };
-    return contentType ? extensions[contentType] ?? "" : "";
-}
-function decodeURIComponentSafely(value) {
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value;
-    }
-}
-async function createUniqueDownloadFile(directory, preferredName) {
-    const dot = preferredName.lastIndexOf(".");
-    const hasExtension = dot > 0;
-    const stem = hasExtension ? preferredName.slice(0, dot) : preferredName;
-    const extension = hasExtension ? preferredName.slice(dot) : "";
-    for (let index = 0; index < 1000; index += 1) {
-        const candidate = index === 0 ? preferredName : `${stem}-${index}${extension}`;
-        const path = resolve(directory, candidate);
-        try {
-            const handle = await open(path, "wx", 0o600);
-            return { path, handle };
-        }
-        catch (error) {
-            if (error.code !== "EEXIST") {
-                throw error;
-            }
-        }
-    }
-    throw new Error("Could not choose a unique output filename");
-}
-async function outputExams(client, opts) {
-    const exams = await client.exams.list();
-    const slice = exams.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    console.log(`\nExams (${exams.length})`);
-    slice.forEach((exam) => {
-        const date = exam.examDate.toISOString().slice(0, 10);
-        const prefix = opts.label ? `[${opts.label}] ` : "";
-        console.log(`- ${prefix}${date} ${compactText(exam.subject)}`);
-    });
-}
-/* ------------------------------------------------------------------ */
-/*  Overview-powered output functions                                  */
-/* ------------------------------------------------------------------ */
-function todayString() {
-    const d = new Date();
-    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-}
-function nextSchoolDay(from) {
-    const d = from ? new Date(from + "T12:00:00") : new Date();
-    d.setDate(d.getDate() + 1);
-    // Skip Saturday (6) and Sunday (0)
-    while (d.getDay() === 0 || d.getDay() === 6) {
-        d.setDate(d.getDate() + 1);
-    }
-    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-}
-function currentWeekBounds() {
-    const now = new Date();
-    const dayOfWeek = now.getDay(); // 0=Sun, 1=Mon, ...
-    const diffToMonday = dayOfWeek === 0 ? -6 : 1 - dayOfWeek;
-    const monday = new Date(now);
-    monday.setDate(now.getDate() + diffToMonday);
-    const friday = new Date(monday);
-    friday.setDate(monday.getDate() + 4);
-    const fmt = (d) => `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-    return [fmt(monday), fmt(friday)];
-}
-const DAY_NAMES = ["Su", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
-function resolveScheduleDateSelection(opts) {
-    const when = opts.when || "week";
-    if (opts.date && opts.weekday) {
-        console.error("Use either --date or --weekday, not both.");
-        process.exit(1);
-    }
-    if (opts.date) {
-        const parsed = parseIsoDateOrExit(opts.date);
-        return {
-            when,
-            startDate: parsed,
-            endDate: parsed,
-            queryDate: parsed,
-            outputWhen: "date",
-        };
-    }
-    if (opts.weekday) {
-        const parsed = nextDateForWeekday(opts.weekday);
-        return {
-            when,
-            startDate: parsed,
-            endDate: parsed,
-            queryDate: parsed,
-            outputWhen: "weekday",
-        };
-    }
-    if (when === "today") {
-        const date = todayString();
-        return { when, startDate: date, endDate: date, outputWhen: when };
-    }
-    if (when === "tomorrow") {
-        const date = nextSchoolDay();
-        return { when, startDate: date, endDate: date, outputWhen: when };
-    }
-    const [startDate, endDate] = currentWeekBounds();
-    return { when, startDate, endDate, outputWhen: when };
-}
-async function outputSchedule(client, opts) {
-    const selection = resolveScheduleDateSelection(opts);
-    const { when, startDate, endDate } = selection;
-    const schedule = await client.schedule.list(selection.queryDate ? { date: selection.queryDate } : undefined);
-    const lessons = schedule.filter((l) => l.date >= startDate && l.date <= endDate);
-    if (opts.json) {
-        const result = !opts.date && !opts.weekday && when === "week"
-            ? { when, weekStart: startDate, weekEnd: endDate, lessons }
-            : { when: selection.outputWhen, date: startDate, lessons };
-        console.log(JSON.stringify(result, null, 2));
-        return;
-    }
-    const prefix = opts.label ? `[${opts.label}] ` : "";
-    if (opts.date || opts.weekday) {
-        console.log(`\n${prefix}Schedule for ${startDate}`);
-    }
-    else if (when === "today") {
-        console.log(`\n${prefix}Schedule for today (${startDate})`);
-    }
-    else if (when === "tomorrow") {
-        console.log(`\n${prefix}Schedule for tomorrow (${startDate})`);
-    }
-    else {
-        console.log(`\n${prefix}Schedule for ${startDate} – ${endDate}`);
-    }
-    if (!lessons.length) {
-        console.log("  No lessons found.");
-        return;
-    }
-    let currentDate = "";
-    for (const l of lessons) {
-        if (l.date !== currentDate) {
-            currentDate = l.date;
-            const d = new Date(l.date + "T12:00:00");
-            console.log(`  ${DAY_NAMES[d.getDay()]} ${l.date}`);
-        }
-        const teacher = l.teacherCode ? ` - ${l.teacher}` : "";
-        console.log(`    ${l.start}-${l.end}  ${l.subject}${teacher}`);
-    }
-}
-async function outputHomework(client, opts) {
-    const overview = await client.overview.get();
-    const slice = overview.homework.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    const prefix = opts.label ? `[${opts.label}] ` : "";
-    console.log(`\n${prefix}Homework (${overview.homework.length})`);
-    slice.forEach((hw) => {
-        const text = compactText(hw.homework);
-        console.log(`- ${hw.date}  ${hw.subject}: ${text}`);
-    });
-}
-async function outputUpcomingExams(client, opts) {
-    const overview = await client.overview.get();
-    const slice = overview.upcomingExams.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    const prefix = opts.label ? `[${opts.label}] ` : "";
-    console.log(`\n${prefix}Upcoming exams (${overview.upcomingExams.length})`);
-    slice.forEach((exam) => {
-        const topic = exam.topic ? ` — ${compactText(exam.topic)}` : "";
-        console.log(`- ${exam.date}  ${exam.subject}: ${exam.name}${topic}`);
-    });
-}
-async function outputAttendance(client, opts) {
-    const notes = await client.attendance.list({ date: opts.date });
-    if (opts.json) {
-        console.log(JSON.stringify(notes, null, 2));
-        return;
-    }
-    const date = opts.date ?? new Date().toISOString().slice(0, 10);
-    const prefix = opts.label ? `[${opts.label}] ` : "";
-    console.log(`\n${prefix}Lesson notes for ${date} (${notes.length})`);
-    if (!notes.length) {
-        console.log("  No lesson notes found.");
-        return;
-    }
-    notes.forEach((note) => {
-        const time = note.start && note.end ? ` (${note.start}-${note.end})` : "";
-        const type = note.typeLabel ? ` [${note.typeLabel}]` : "";
-        const teacher = note.teacher ? ` ${note.teacher}` : "";
-        const subject = note.subject ? ` [${note.subject}]` : "";
-        console.log(`-${time}${type}${teacher}${subject}`);
-    });
-}
-async function outputGrades(client, opts) {
-    const overview = await client.overview.get();
-    const slice = overview.grades.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    const prefix = opts.label ? `[${opts.label}] ` : "";
-    console.log(`\n${prefix}Grades (${overview.grades.length})`);
-    slice.forEach((g) => {
-        console.log(`- ${g.date}  ${g.subject}: ${g.name} — ${g.grade}`);
-    });
-}
-async function outputSummary(client, opts) {
-    const [overview, news, messages] = await Promise.all([
-        client.overview.get(),
-        client.news.list(),
-        client.messages.list("inbox"),
-    ]);
-    const summary = buildSummaryData(overview, news, messages, opts.days, opts.label);
-    if (opts.json) {
-        console.log(JSON.stringify(summary, null, 2));
-        return;
-    }
-    const label = summary.student ? ` for ${summary.student}` : "";
-    console.log(`\nSummary${label} (${summary.today})`);
-    console.log(`\nTODAY (${summary.today})`);
-    if (summary.todaySchedule.length) {
-        summary.todaySchedule.forEach((l) => {
-            console.log(`  ${l.start}-${l.end}  ${l.subject} (${l.subjectCode})`);
-        });
-    }
-    else {
-        console.log("  No lessons today.");
-    }
-    console.log(`\nTOMORROW (${summary.tomorrow})`);
-    if (summary.tomorrowSchedule.length) {
-        summary.tomorrowSchedule.forEach((l) => {
-            console.log(`  ${l.start}-${l.end}  ${l.subject} (${l.subjectCode})`);
-        });
-    }
-    else {
-        console.log("  No lessons tomorrow.");
-    }
-    if (summary.upcomingExams.length) {
-        console.log("\nUPCOMING EXAMS");
-        summary.upcomingExams.forEach((exam) => {
-            const topic = exam.topic ? ` — ${compactText(exam.topic)}` : "";
-            console.log(`  ${exam.date}  ${exam.subject}: ${exam.name}${topic}`);
-        });
-    }
-    if (summary.recentHomework.length) {
-        console.log("\nRECENT HOMEWORK");
-        summary.recentHomework.forEach((hw) => {
-            console.log(`  ${hw.date}  ${hw.subject}: ${compactText(hw.homework)}`);
-        });
-    }
-    if (summary.recentNews.length) {
-        console.log(`\nNEWS (last ${opts.days} days)`);
-        summary.recentNews.forEach((n) => {
-            const date = n.published ? n.published.slice(0, 10) : "";
-            console.log(`  ${date}  ${compactText(n.title)} (id:${n.wilmaId})`);
-        });
-    }
-    if (summary.recentMessages.length) {
-        console.log(`\nMESSAGES (last ${opts.days} days)`);
-        summary.recentMessages.forEach((m) => {
-            const date = m.sentAt.slice(0, 10);
-            console.log(`  ${date}  ${compactText(m.subject)} (id:${m.wilmaId})`);
-        });
-    }
-}
-function buildSummaryData(overview, news, messages, days, studentLabel) {
-    const today = todayString();
-    const tomorrow = nextSchoolDay();
-    const cutoffDate = (() => {
-        const d = new Date();
-        d.setDate(d.getDate() - days);
-        return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-    })();
-    const homeworkCutoff = (() => {
-        const d = new Date();
-        d.setDate(d.getDate() - 3);
-        return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-    })();
-    const todaySchedule = overview.schedule.filter((l) => l.date === today);
-    const tomorrowSchedule = overview.schedule.filter((l) => l.date === tomorrow);
-    const upcomingExams = overview.upcomingExams;
-    const recentHomework = overview.homework.filter((h) => h.date >= homeworkCutoff);
-    const recentNews = news
-        .filter((n) => n.published && n.published.toISOString().slice(0, 10) >= cutoffDate)
-        .slice(0, 5)
-        .map((n) => ({
-        wilmaId: n.wilmaId,
-        title: n.title,
-        published: n.published?.toISOString() ?? null,
-    }));
-    const recentMessages = messages
-        .filter((m) => m.sentAt.toISOString().slice(0, 10) >= cutoffDate)
-        .slice(0, 5)
-        .map((m) => ({
-        wilmaId: m.wilmaId,
-        subject: m.subject,
-        sentAt: m.sentAt.toISOString(),
-        senderName: m.senderName ?? null,
-    }));
-    return {
-        generatedAt: new Date().toISOString(),
-        student: studentLabel ?? null,
-        today,
-        tomorrow,
-        todaySchedule,
-        tomorrowSchedule,
-        upcomingExams,
-        recentHomework,
-        recentNews,
-        recentMessages,
-    };
-}
-async function outputMessages(client, opts) {
-    const messages = await client.messages.list(opts.folder);
-    const slice = messages.slice(0, opts.limit);
-    if (opts.json) {
-        console.log(JSON.stringify(slice, null, 2));
-        return;
-    }
-    console.log(`\nMessages (${messages.length})`);
-    slice.forEach((msg) => {
-        const date = msg.sentAt.toISOString().slice(0, 10);
-        const prefix = opts.label ? `[${opts.label}] ` : "";
-        console.log(`- ${prefix}${date} ${compactText(msg.subject)} (id:${msg.wilmaId})`);
-    });
-}
-async function outputMessageItem(client, id, json) {
-    const msg = await client.messages.get(id);
-    if (json) {
-        console.log(JSON.stringify(msg, null, 2));
-        return;
-    }
-    console.log(`\n${msg.subject}`);
-    if (msg.senderName)
-        console.log(`From: ${msg.senderName}`);
-    console.log(`Sent: ${msg.sentAt.toISOString()}`);
-    if (msg.content)
-        console.log(`\n${formatContent(msg.content)}`);
-}
-async function selectNewsToRead(client) {
-    const news = await client.news.list();
-    if (!news.length)
-        return;
-    const choices = news.slice(0, 30).map((item) => {
-        const date = item.published ? item.published.toISOString().slice(0, 10) : "";
-        return {
-            value: String(item.wilmaId),
-            name: `${date} ${compactText(item.title)}`.trim(),
-        };
-    });
-    choices.unshift({ value: "back", name: "Back" });
-    const selected = await selectOrCancel({
-        message: "Read which news item?",
-        choices,
-    });
-    if (!selected || selected === "back")
-        return;
-    const item = await outputNewsItem(client, Number(selected), false, { suppressDownloadHint: true });
-    if (item?.resources?.length) {
-        await offerResourceDownloads(client, item);
-    }
-}
-async function offerResourceDownloads(client, item) {
-    while (true) {
-        const resources = item.resources ?? [];
-        const choices = [
-            { value: "back", name: "Continue" },
-            ...resources.map((resource) => ({
-                value: resource.id,
-                name: `Download "${compactText(resource.label)}"`,
-            })),
-        ];
-        const selected = await selectOrCancel({ message: "Resources", choices }, false);
-        if (!selected || selected === "back")
-            return;
-        const outputDirectory = await inputOrCancel({
-            message: "Save to directory",
-            default: resolve(homedir(), "Downloads"),
-        });
-        if (outputDirectory === null)
-            continue;
-        try {
-            await outputNewsResourceDownload(client, item.wilmaId, selected, {
-                output: outputDirectory,
-                json: false,
-            });
-        }
-        catch (error) {
-            console.error("Download failed:", error instanceof Error ? error.message : error);
-        }
-    }
-}
-async function selectMessageToRead(client, folder) {
-    const messages = await client.messages.list(folder);
-    if (!messages.length) {
-        console.log(`\nNo messages found in ${folder}.`);
-        return;
+    finally {
+        clearTimeout(timer);
     }
-    const choices = messages.slice(0, 30).map((msg) => {
-        const date = msg.sentAt.toISOString().slice(0, 10);
-        return {
-            value: String(msg.wilmaId),
-            name: `${date} ${compactText(msg.subject)}`.trim(),
-        };
-    });
-    choices.unshift({ value: "back", name: "Back" });
-    const selected = await selectOrCancel({
-        message: "Read which message?",
-        choices,
-    });
-    if (!selected || selected === "back")
-        return;
-    await outputMessageItem(client, Number(selected), false);
 }
 async function selectOrCancel(opts, clearScreen = true) {
     if (clearScreen) {
@@ -1596,110 +869,76 @@ async function selectOrCancel(opts, clearScreen = true) {
         process.stdin.removeListener("keypress", onKeypress);
     }
 }
-function createInteractiveMfaCallback(getStoredProfile, saveProfile) {
+function createInteractiveMfa(saveProfile) {
     let lastCode = null;
     let lastCodeTime = 0;
-    return async (_formkey) => {
-        // TOTP codes are valid for 30s; reuse if within the same window
-        const now = Math.floor(Date.now() / 30000);
-        if (lastCode && now === lastCodeTime) {
-            return lastCode;
-        }
-        // If a TOTP secret is stored, auto-generate
-        const stored = getStoredProfile?.();
-        if (stored?.totpSecretObfuscated) {
-            const secret = revealSecret(stored.totpSecretObfuscated);
+    let lastCodeFor;
+    let lastFormkey = null;
+    // One code generator per key: switching logins must not reuse another login's key.
+    const generators = new Map();
+    const state = {
+        profile: undefined,
+        typedSecret: null,
+        callback: async (formkey) => {
+            // Asked again for the same challenge means Wilma rejected the code.
+            const retry = formkey === lastFormkey;
+            lastFormkey = formkey;
+            // A saved or just-typed key generates codes (a retry waits for the next one).
+            const secret = state.profile?.totpSecretObfuscated
+                ? revealSecret(state.profile.totpSecretObfuscated)
+                : state.typedSecret;
             if (secret) {
-                const code = generateTOTP(parseTotpSecret(secret));
+                if (!generators.has(secret))
+                    generators.set(secret, mfaCallbackFor(secret));
+                return generators.get(secret)(formkey);
+            }
+            // TOTP codes are valid for 30s: a second login in the same window reuses the typed code.
+            const now = Math.floor(Date.now() / 30000);
+            if (!retry && lastCode && now === lastCodeTime && lastCodeFor === state.profile) {
+                return lastCode;
+            }
+            if (retry) {
+                console.log("That code wasn't accepted. Wait for the next code in your authenticator app.");
+            }
+            const choice = await select({
+                message: "MFA required. Choose how to authenticate:",
+                choices: [
+                    { value: "code", name: "Enter one-time code from authenticator app" },
+                    { value: "secret", name: "Save TOTP secret for automatic login" },
+                ],
+            });
+            if (choice === "secret") {
+                const secretInput = (await input({
+                    message: "Paste TOTP secret (base32 key or otpauth:// URI)",
+                })).trim();
+                if (!secretInput)
+                    throw new Error("MFA cancelled");
+                const parsed = parseTotpSecret(secretInput);
+                if (state.profile) {
+                    state.profile.totpSecretObfuscated = obfuscateSecret(secretInput);
+                    await saveProfile();
+                }
+                else {
+                    // A new login: saved together with the login once it succeeds.
+                    state.typedSecret = secretInput;
+                }
+                generators.set(secretInput, mfaCallbackFor(secretInput));
+                const code = generateTOTP(parsed);
                 lastCode = code;
                 lastCodeTime = now;
+                lastCodeFor = state.profile;
                 return code;
             }
-        }
-        const choice = await select({
-            message: "MFA required. Choose how to authenticate:",
-            choices: [
-                { value: "code", name: "Enter one-time code from authenticator app" },
-                { value: "secret", name: "Save TOTP secret for automatic login" },
-            ],
-        });
-        if (choice === "secret") {
-            const secretInput = await input({
-                message: "Paste TOTP secret (base32 key or otpauth:// URI)",
-            });
-            if (!secretInput)
+            const code = await input({ message: "Enter MFA code from authenticator app" });
+            if (!code)
                 throw new Error("MFA cancelled");
-            const secret = parseTotpSecret(secretInput.trim());
-            // Save to config
-            if (stored && saveProfile) {
-                stored.totpSecretObfuscated = obfuscateSecret(secretInput.trim());
-                await saveProfile();
-            }
-            const code = generateTOTP(secret);
-            lastCode = code;
+            lastCode = code.trim();
             lastCodeTime = now;
-            return code;
-        }
-        const code = await input({ message: "Enter MFA code from authenticator app" });
-        if (!code)
-            throw new Error("MFA cancelled");
-        lastCode = code.trim();
-        lastCodeTime = now;
-        return lastCode;
-    };
-}
-function createNonInteractiveMfaCallback(totpSecret) {
-    if (!totpSecret)
-        return undefined;
-    const secret = parseTotpSecret(totpSecret);
-    return async (_formkey) => {
-        const code = generateTOTP(secret);
-        return code;
+            lastCodeFor = state.profile;
+            return lastCode;
+        },
     };
-}
-function parseTotpSecret(raw) {
-    // Accept either a bare base32 key or an otpauth:// URI
-    if (raw.startsWith("otpauth://")) {
-        const url = new URL(raw);
-        const secret = url.searchParams.get("secret");
-        if (!secret) {
-            console.error("No 'secret' parameter found in otpauth:// URI.");
-            process.exit(1);
-        }
-        return secret;
-    }
-    return raw.replace(/[\s-]/g, "");
-}
-function generateTOTP(secret) {
-    // TOTP: RFC 6238 — HMAC-SHA1 based, 6-digit, 30-second period
-    const base32Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-    // Decode base32 secret
-    const cleanSecret = secret.replace(/[\s=-]+/g, "").toUpperCase();
-    let bits = "";
-    for (const c of cleanSecret) {
-        const val = base32Chars.indexOf(c);
-        if (val === -1)
-            throw new Error(`Invalid base32 character: ${c}`);
-        bits += val.toString(2).padStart(5, "0");
-    }
-    const bytes = new Uint8Array(Math.floor(bits.length / 8));
-    for (let i = 0; i < bytes.length; i++) {
-        bytes[i] = parseInt(bits.slice(i * 8, i * 8 + 8), 2);
-    }
-    const epoch = Math.floor(Date.now() / 1000);
-    const counter = Math.floor(epoch / 30);
-    const counterBuf = Buffer.alloc(8);
-    counterBuf.writeUInt32BE(Math.floor(counter / 0x100000000), 0);
-    counterBuf.writeUInt32BE(counter >>> 0, 4);
-    const hmac = createHmac("sha1", Buffer.from(bytes));
-    hmac.update(counterBuf);
-    const hash = hmac.digest();
-    const offset = hash[hash.length - 1] & 0x0f;
-    const code = ((hash[offset] & 0x7f) << 24) |
-        ((hash[offset + 1] & 0xff) << 16) |
-        ((hash[offset + 2] & 0xff) << 8) |
-        (hash[offset + 3] & 0xff);
-    return (code % 1000000).toString().padStart(6, "0");
+    return state;
 }
 async function inputOrCancel(opts) {
     console.clear();
@@ -1759,270 +998,79 @@ function isPromptCancel(err) {
         message.toLowerCase().includes("cancel") ||
         message.toLowerCase().includes("aborted"));
 }
-function compactText(value) {
-    return (value ?? "").replace(/\s+/g, " ").trim();
-}
-function formatContent(value) {
-    const lines = value
-        .replace(/\r/g, "")
-        .split("\n")
-        .map((line) => line.trim())
-        .filter((line, index, arr) => {
-        if (line !== "")
-            return true;
-        // Keep a single blank line between blocks
-        return arr[index - 1] !== "";
-    });
-    return lines.join("\n").replace(/\n{3,}/g, "\n\n").trim();
-}
-async function getStudentsForCommand(profile, config) {
-    const stored = config.profiles.find((p) => p.id === config.lastProfileId);
-    const fresh = await WilmaClient.listStudents(profile);
-    if (stored) {
-        stored.students = fresh.map((s) => ({ studentNumber: s.studentNumber, name: s.name }));
-        await saveConfig(config);
-    }
-    return fresh;
-}
-async function resolveStudentForFlags(profile, config, student) {
-    if (student) {
-        const students = await getStudentsForCommand(profile, config);
-        const exact = students.find((s) => s.studentNumber === student);
-        if (exact)
-            return exact;
-        const needle = student.toLowerCase();
-        const substring = students.find((s) => s.name.toLowerCase().includes(needle));
-        if (substring)
-            return substring;
-        const match = students.find((s) => fuzzyIncludes(s.name, student));
-        if (match)
-            return match;
-        // No match found - show available students and exit
-        console.error(`Error: No student matching "${student}" found.`);
-        if (students.length > 0) {
-            console.error("Available students:");
-            students.forEach((s) => console.error(`  ${s.studentNumber}  ${s.name}`));
-        }
-        process.exit(1);
+/**
+ * Remove terminal escape sequences and control characters (keeping newlines
+ * and tabs), so text from Wilma or a bulletin link can't retitle the window,
+ * clear the screen, write the clipboard or overwrite a line.
+ */
+function terminalSafe(value) {
+    return value
+        .replace(/\u001b(\[[0-?]*[ -/]*[@-~]|\][^\u0007\u001b]*(\u0007|\u001b\\)?|[@-Z\\-_])/g, "")
+        .replace(/\r\n?/g, "\n")
+        .replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
+}
+/**
+ * JSON output keeps every character: JSON.stringify already escapes control
+ * characters except DEL and the C1 range, which some terminals act on, so
+ * escape those too (inside JSON they can only occur in strings).
+ */
+function jsonSafe(value) {
+    return value.replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/** An error as agents and scripts get it: a stable code, a message, and the exit code. */
+function describeError(err) {
+    if (err instanceof WilmaAiError) {
+        const exitCode = err.code === "invalid_argument" || err.code === "unknown_command" ? 2 : err.code === "not_logged_in" ? 3 : 1;
+        return { code: err.code, message: err.message, details: err.details, exitCode };
     }
-    const stored = config.profiles.find((p) => p.id === config.lastProfileId);
-    if (stored?.lastStudentNumber) {
+    if (err instanceof MfaRequiredError) {
         return {
-            studentNumber: stored.lastStudentNumber,
-            name: stored.lastStudentName ?? stored.lastStudentNumber,
-            href: `/!${stored.lastStudentNumber}/`,
+            code: "mfa_required",
+            message: "Two-step verification is on for this Wilma account.",
+            hint: `Run \`wilma login\` and give the authenticator setup key on the login page, or set ${ENV_VARS.totpSecret} to the key (base32 or otpauth:// URI).`,
+            exitCode: 1,
         };
     }
-    const students = await getStudentsForCommand(profile, config);
-    return students[0] ?? null;
-}
-async function outputAllNews(profile, config, limit, json, onMfa) {
-    const students = await getStudentsForCommand(profile, config);
-    const results = [];
-    for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-        const news = await client.news.list();
-        results.push({ student, items: news.slice(0, limit) });
-    }
-    if (json) {
-        console.log(JSON.stringify({ students: results }, null, 2));
-        return;
-    }
-    results.forEach((entry) => {
-        console.log(`\n[${entry.student.name}]`);
-        entry.items.forEach((item) => {
-            const date = item.published ? item.published.toISOString().slice(0, 10) : "";
-            console.log(`- ${date} ${item.title} (id:${item.wilmaId})`.trim());
-        });
-    });
-}
-async function outputAllMessages(profile, config, opts, onMfa) {
-    const students = await getStudentsForCommand(profile, config);
-    const results = [];
-    for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-        const messages = await client.messages.list(opts.folder);
-        results.push({ student, items: messages.slice(0, opts.limit) });
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({ students: results }, null, 2));
-        return;
-    }
-    results.forEach((entry) => {
-        console.log(`\n[${entry.student.name}]`);
-        entry.items.forEach((msg) => {
-            const date = msg.sentAt.toISOString().slice(0, 10);
-            console.log(`- ${date} ${msg.subject} (id:${msg.wilmaId})`);
-        });
-    });
-}
-async function outputAllExams(profile, config, limit, json, onMfa) {
-    const students = await getStudentsForCommand(profile, config);
-    const results = [];
-    for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-        const overview = await client.overview.get();
-        results.push({ student, items: overview.upcomingExams.slice(0, limit) });
-    }
-    if (json) {
-        console.log(JSON.stringify({ students: results }, null, 2));
-        return;
-    }
-    results.forEach((entry) => {
-        console.log(`\n[${entry.student.name}]`);
-        entry.items.forEach((exam) => {
-            const topic = exam.topic ? ` — ${compactText(exam.topic)}` : "";
-            console.log(`- ${exam.date} ${exam.subject}: ${exam.name}${topic}`);
-        });
-    });
-}
-async function outputAllAttendance(profile, config, opts, onMfa) {
-    const students = await getStudentsForCommand(profile, config);
-    const results = [];
-    for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-        const notes = await client.attendance.list({ date: opts.date });
-        results.push({ student, notes });
-    }
-    if (opts.json) {
-        console.log(JSON.stringify({ students: results.map((r) => ({ student: r.student, items: r.notes })) }, null, 2));
-        return;
-    }
-    for (const r of results) {
-        if (!r.notes.length) {
-            console.log(`\n[${r.student.name}]  No lesson notes found.`);
-            continue;
-        }
-        console.log(`\n[${r.student.name}]`);
-        r.notes.forEach((note) => {
-            const time = note.start && note.end ? ` (${note.start}-${note.end})` : "";
-            const type = note.typeLabel ? ` [${note.typeLabel}]` : "";
-            const teacher = note.teacher ? ` ${note.teacher}` : "";
-            const subject = note.subject ? ` [${note.subject}]` : "";
-            console.log(`-${time}${type}${teacher}${subject}`);
-        });
-    }
-}
-async function outputAllOverviewCommand(profile, config, command, flags, onMfa) {
-    const students = await getStudentsForCommand(profile, config);
-    if (command === "summary") {
-        if (flags.json) {
-            const summaries = [];
-            for (const student of students) {
-                const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-                const [overview, news, messages] = await Promise.all([
-                    client.overview.get(),
-                    client.news.list(),
-                    client.messages.list("inbox"),
-                ]);
-                summaries.push({
-                    student,
-                    summary: buildSummaryData(overview, news, messages, flags.days ?? 7, student.name),
-                });
-            }
-            console.log(JSON.stringify({
-                generatedAt: new Date().toISOString(),
-                students: summaries,
-            }, null, 2));
-            return;
-        }
-        // Human-readable summary output per student
-        for (const student of students) {
-            const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-            await outputSummary(client, {
-                days: flags.days ?? 7,
-                json: false,
-                label: student.name,
-            });
-        }
-        return;
+    if (isMfaFailure(err)) {
+        return {
+            code: "mfa_failed",
+            message: "Wilma didn't accept the two-step verification code.",
+            hint: "The saved authenticator setup key may be wrong or changed: run `wilma login` again.",
+            exitCode: 1,
+        };
     }
-    const scheduleSelection = command === "schedule"
-        ? resolveScheduleDateSelection(flags)
-        : null;
-    const results = [];
-    for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
-        if (command === "schedule" && scheduleSelection) {
-            const schedule = await client.schedule.list(scheduleSelection.queryDate ? { date: scheduleSelection.queryDate } : undefined);
-            results.push({
-                student,
-                data: schedule.filter((l) => l.date >= scheduleSelection.startDate && l.date <= scheduleSelection.endDate),
-            });
-        }
-        else if (command === "homework") {
-            const overview = await client.overview.get();
-            results.push({ student, data: overview.homework.slice(0, flags.limit ?? 10) });
-        }
-        else if (command === "grades") {
-            const overview = await client.overview.get();
-            results.push({ student, data: overview.grades.slice(0, flags.limit ?? 20) });
-        }
+    if (err instanceof AuthenticationError) {
+        return {
+            code: "login_failed",
+            message: "Wilma didn't accept the saved login (has the password changed?).",
+            hint: "Run `wilma login` again.",
+            exitCode: 1,
+        };
     }
-    if (flags.json) {
-        console.log(JSON.stringify({ students: results.map((r) => ({ student: r.student, items: r.data })) }, null, 2));
-        return;
+    if (err instanceof NetworkError) {
+        return { code: "network", message: err.message, ...(err.code ? { cause: err.code } : {}), ...(err.hint ? { hint: err.hint } : {}), exitCode: 1 };
     }
-    for (const r of results) {
-        console.log(`\n[${r.student.name}]`);
-        const items = r.data;
-        if (!items.length) {
-            console.log("  (none)");
-            continue;
-        }
-        if (command === "schedule") {
-            for (const l of items) {
-                console.log(`  ${l.date} ${l.start}-${l.end}  ${l.subject} - ${l.teacher}`);
-            }
-        }
-        else if (command === "homework") {
-            for (const hw of items) {
-                console.log(`  ${hw.date}  ${hw.subject}: ${compactText(hw.homework)}`);
-            }
-        }
-        else if (command === "grades") {
-            for (const g of items) {
-                console.log(`  ${g.date}  ${g.subject}: ${g.name} — ${g.grade}`);
-            }
-        }
+    if (err instanceof APIError) {
+        return { code: err.status === 404 ? "not_found" : "wilma_error", message: err.message, exitCode: 1 };
     }
-}
-async function printStudentSelectionHelp(profile, config) {
-    const students = await getStudentsForCommand(profile, config);
-    console.error("Multiple students found. Use --student <id|name> or --all-students.");
-    students.forEach((s) => {
-        console.error(`- ${s.studentNumber} ${s.name}`);
-    });
+    const message = err instanceof Error ? err.message : String(err);
+    if (/isn't valid JSON/.test(message))
+        return { code: "config_invalid", message, exitCode: 1 };
+    return { code: "error", message, exitCode: 1 };
 }
 main().catch((err) => {
     if (isPromptCancel(err)) {
         process.exit(0);
     }
-    if (err instanceof MfaRequiredError) {
-        console.error("MFA is enabled on this Wilma account.");
-        console.error("For non-interactive use, provide your TOTP secret:");
-        console.error("  --totp-secret <base32-key>");
-        console.error("  --totp-secret 'otpauth://totp/...'");
-        console.error("Tip: export the key from your authenticator app (base32 string or otpauth:// URI).");
-        console.error("For interactive use, run 'wilma' without arguments.");
-        process.exit(1);
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    const isNetwork = err instanceof NetworkError;
-    if (process.argv.includes("--json")) {
-        console.log(JSON.stringify({
-            status: "error",
-            message,
-            ...(isNetwork && err.code ? { code: err.code } : {}),
-            ...(isNetwork && err.hint ? { hint: err.hint } : {}),
-        }, null, 2));
+    const { exitCode, details, ...failure } = describeError(err);
+    const mode = outputMode(process.argv.slice(2));
+    if (mode.json) {
+        console.log(toAgentJson({ status: "error", ...failure, ...(details ?? {}) }, mode.pretty));
     }
     else {
-        console.error("CLI error:", message);
-        if (isNetwork && err.hint) {
-            console.error("");
-            console.error(err.hint);
-        }
+        console.error(`Error: ${failure.message}`);
+        if (failure.hint)
+            console.error(failure.hint);
     }
-    process.exit(1);
+    process.exit(exitCode);
 });