@zq-silk/yui 1.1.0 → 2.0.0

package/dist/cli.js

@@ -20,7 +20,7 @@ import { allowsInteractiveSelection, resolveInteractiveArguments } from "./cli/i
 import { routeInvocation } from "./cli/invocationRouter.js";
 import { operatorOfflineCommand, taskDiagnosticTarget } from "./cli/managedDiagnostics.js";
 import { assertConfigurationAuthority, assertTaskInvocationScope } from "./cli/invocationAuthority.js";
-import { requireManagedGlobalCaller } from "./runtime/managedCaller.js";
+import { requireManagedGlobalCaller, ManagedRuntimeDriftError } from "./runtime/managedCaller.js";
 import { resolveOperatorWizardArguments } from "./cli/operatorWizard.js";
 import { resolveGlobalRoleAgentConfigurationArguments, resolveRoleWizardArguments } from "./cli/roleWizard.js";
 import { runUpdateCommand } from "./cli/updateCommand.js";
@@ -41,7 +41,7 @@ import { runProjectCommand } from "./commands/projectCommands.js";
 import { renderReleaseActivateResult, renderReleaseInstallResult, renderReleaseList, resolveReleaseActivationDriver, runReleaseActivate, runReleaseInstall, runReleaseList } from "./commands/releaseCommands.js";
 import { runResourcesCommand } from "./commands/resourcesCommands.js";
 import { parseSessionReconcileOptions, parseSessionStopOptions, runSessionReconcileCommand, runSessionStopCommand } from "./commands/sessionCommands.js";
-import { assertTaskDeliveryAuthority, taskLocalActor } from "./task/taskAuthority.js";
+import { assertTaskDeliveryAuthority, taskLocalActor, resolveJobCaller } from "./task/taskAuthority.js";
 import { runTaskBaseStatusCommand } from "./commands/taskBaseCommands.js";
 import { runTaskChangeSetCommand } from "./commands/taskChangeSetCommands.js";
 import { assertWorkItemDependenciesCompletedForCommand, dispatchPreparedReviewRound, failPendingReviewRound, parseTaskArchiveArguments, parseTaskCompletionRequest, planReplicatedWorkItemLanes, preflightTaskCompletion, preserveReviewRoundWorkspace, previewTaskRoleAgentConfigurationMutation, requireWorkItemAssignee, runTaskCommand, validateTaskArchiveRequest } from "./commands/taskCommands.js";
@@ -58,7 +58,7 @@ import { runWorkflowCommandAsync } from "./commands/workflowCommands.js";
 import { FileCompletionManager } from "./completion/fileCompletionManager.js";
 import { CONFIG_DOMAINS } from "./config/configCatalog.js";
 import { resolveTmuxBin, resolveTmuxHistoryLimit } from "./config/yuiConfig.js";
-import { readSessionBootstrapManifest, refreshManagedSessionCliWrappers } from "./context/sessionBootstrapManifest.js";
+import { readSessionBootstrapManifest } from "./context/sessionBootstrapManifest.js";
 import { assertFileTaskControllerStorageCompatible, ensureFileTaskController, FileTaskWorkflowRuntime, refreshRunningFileTaskControllerConfiguration, refreshRunningFileTaskControllerEnvironment, restartFileTaskController, stopFileTaskController } from "./controller/clientRuntime.js";
 import { FileSchedulerStoreAdapter } from "./controller/fileSchedulerStoreAdapter.js";
 import { createControllerIntegrationJobPort } from "./controller/jobClient.js";
@@ -70,6 +70,7 @@ import { SessionOwnerReconciliation } from "./controller/sessionOwnerReconciliat
 import { callController, ControllerClientError } from "./core/controllerClient.js";
 import { buildDoctorReport, renderDoctor, runDoctorCommand } from "./doctor/doctor.js";
 import { agentNotFound, CliError, runtimeError, usageError } from "./errors/cliError.js";
+import { describeCliFailure, renderCliFailure, sanitizeFailureText, sanitizeFailureDetails } from "./errors/cliFailure.js";
 import { AgentConfigurationCatalogService, validateAgentLaunchConfiguration } from "./executor/agentConfigurationCatalog.js";
 import { FileRoleLaunchPlanner } from "./executor/fileRoleLaunchPlanner.js";
 import { createGitHubCliPublicationVerifier } from "./external/githubPublicationVerifier.js";
@@ -82,7 +83,7 @@ import { parseTaskAgentCapabilityQuery } from "./commands/taskAgentCapabilities.
 import { capabilityReaderIdentity } from "./controller/agentCapabilities.js";
 import { formatTimestamp } from "./output/timePresentation.js";
 import { resolveAgentProfileView } from "./profile/agentProfileRuntime.js";
-import { assertCliHomeReleaseFence, describeCliHomeInvocation } from "./release/cliHomeReleaseFence.js";
+import { assertCliHomeReleaseFence } from "./release/cliHomeReleaseFence.js";
 import { createReleaseWorkflowPorts } from "./release/releaseWorkflowPorts.js";
 import { acquireHandoverLock, readRuntimeIdentity } from "./release/runtimeRelease.js";
 import { NodeGitWorkspace } from "./repository/gitWorkspace.js";
@@ -102,7 +103,6 @@ import { requireManagedTaskCaller, resolveManagedTaskReader } from "./runtime/ma
 import { assertRuntimeCoherence } from "./runtime/runtimeCoherence.js";
 import { runSetupCommand, validateSetupInvocation } from "./setup/setupCommand.js";
 import { openCurrentTaskStore, validateCurrentTaskStore } from "./storage/currentTaskStore.js";
-import { SqliteSchemaError } from "./storage/sqliteSchema.js";
 import { inspectStorageSchema } from "./storage/storageSchema.js";
 import { resolveYuiHome } from "./storage/taskStore.js";
 import { renderArchiveDiagnostics, taskArchiveDiagnostics } from "./task/archiveDiagnostics.js";
@@ -123,47 +123,37 @@ const taskFinalReviewInvocation = extractTaskFinalReviewRequest(process.argv.sli
 const rawArgs = [...taskFinalReviewInvocation.args];
 const jsonOutput = rawArgs.includes("--json");
 const args = normalizeAliases(jsonOutput ? rawArgs.filter((argument) => argument !== "--json") : rawArgs);
+let invocationHome;
 void main().catch((error) => {
     if (error instanceof CleanupInspectionError) {
         error = cleanupCliError(error, error.checks[0]?.resource ?? "workspace");
     }
-    if (error instanceof CliError) {
-        const rendered = jsonOutput
-            ? JSON.stringify({ ok: false, code: error.code, message: error.message, details: error.details })
-            : `${error.code}: ${error.message}${error.helpText === undefined ? "" : `\n\n${error.helpText.trimEnd()}`}`;
-        process.stderr.write(`${rendered}\n`);
-        process.exitCode = error.exitCode;
-        return;
-    }
-    const message = runtimeFailureMessage(error);
-    process.stderr.write(`${jsonOutput
-        ? JSON.stringify({ ok: false, code: "RUNTIME_ERROR", message, details: {} })
-        : `RUNTIME_ERROR: ${message}`}\n`);
-    process.exitCode = 5;
+    const failure = describeCliFailure(error, failureContext());
+    process.stderr.write(`${renderCliFailure(failure, jsonOutput)}\n`);
+    process.exitCode = failure.exitCode;
 });
-function runtimeFailureMessage(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (error instanceof ControllerClientError
-        && ["CONTROLLER_NOT_RUNNING", "CONTROLLER_UNAVAILABLE", "CONTROLLER_DISCOVERY_INVALID"].includes(error.code)) {
-        return `${message} Run \`yui doctor\` with this Session's YUI_HOME and CLI; `
-            + "if the Controller is stopped, run `yui start`; if its process is present but unreachable, "
-            + "inspect it before `yui controller restart`. The Operator or user can perform recovery.";
-    }
-    if (!(error instanceof SqliteSchemaError))
-        return message;
-    try {
-        return `${message}\n${describeCliHomeInvocation({
-            home: resolveYuiHome(process.env),
-            packageRoot: fileURLToPath(new URL("../", import.meta.url)),
-            entryPath: fileURLToPath(import.meta.url)
-        })}`;
-    }
-    catch {
-        return message;
-    }
+function failureContext() {
+    const route = routeInvocation(args);
+    const node = "node" in route ? route.node : route.helpNode;
+    const operands = args.slice(node.path.length - 1);
+    const publicValues = new Set([
+        ...Object.values(node.argumentValues).flat(),
+        ...Object.values(node.optionValues).flat()
+    ]);
+    const recordId = /^(?:task|project|message|run|work|wake|operation|review|input|job|integration|publication)-\d+(?:\/(?:message|run|work|wake|review|input|job|integration|publication)-\d+)?$/;
+    return {
+        operation: node.path.join(" "),
+        targets: operands.filter(value => recordId.test(value)),
+        // Do not replay argv: operands include Message bodies, config values and credentials.
+        privateValues: operands.filter(value => !/^--[a-z][a-z-]*$/.test(value) && !recordId.test(value) && !publicValues.has(value)),
+        home: invocationHome ?? process.env.YUI_HOME ?? "(default Home unresolved)",
+        cli: fileURLToPath(import.meta.url),
+        environment: process.env
+    };
 }
 export async function main() {
     const home = resolveYuiHome(process.env);
+    invocationHome = home;
     const routedForFence = args.length === 0 ? undefined : routeInvocation(args);
     const managedInvocation = process.env.YUI_SESSION_SCOPE === "task"
         || process.env.YUI_SESSION_SCOPE === "global";
@@ -188,7 +178,7 @@ export async function main() {
             stdio: "inherit"
         });
         if (delegated.error !== undefined) {
-            throw runtimeError(`Target release activation driver could not start: ${delegated.error.message}`);
+            throw runtimeError("Target release activation driver could not start.", { cause: delegated.error });
         }
         if (delegated.signal !== null) {
             throw runtimeError(`Target release activation driver stopped by signal ${delegated.signal}.`);
@@ -240,7 +230,10 @@ export async function main() {
         const subcommand = args[1];
         if (subcommand === "install" && args.length === 3) {
             const result = runReleaseInstall(home, args[2]);
-            emit(renderReleaseInstallResult(result), false, result);
+            if (result.outcome === "aborted")
+                emitFailureResult(renderReleaseInstallResult(result), result);
+            else
+                emit(renderReleaseInstallResult(result), false, result);
             if (result.outcome === "aborted")
                 process.exitCode = 5;
             return;
@@ -259,7 +252,11 @@ export async function main() {
                     + "(or activate the active release when exactly one is installed).");
             }
             const result = await runReleaseActivate(home, releaseId);
-            emit(renderReleaseActivateResult(result), false, result);
+            if (result.outcome === "aborted" || result.outcome === "dual-owner") {
+                emitFailureResult(renderReleaseActivateResult(result), result);
+            }
+            else
+                emit(renderReleaseActivateResult(result), false, result);
             if (result.outcome === "aborted" || result.outcome === "dual-owner") {
                 process.exitCode = 5;
             }
@@ -356,7 +353,7 @@ export async function main() {
                 codex = await prepareLocalCodexStartup(startupStore, home, process.env);
             }
             catch (error) {
-                throw runtimeError(`Controller is ready, but Codex shared startup failed: ${error instanceof Error ? error.message : String(error)}`);
+                throw runtimeError("Controller is ready, but Codex shared startup failed.", { cause: error });
             }
             const lines = ["Yui Controller is ready."];
             if (codex.daemons.length === 0)
@@ -398,20 +395,13 @@ export async function main() {
     if (args[0] === "upgrade") {
         const result = await runUpgradeCommand(args.slice(1), home);
         process.exitCode = result.exitCode;
-        emit(result.output, false, result.data);
+        if (result.exitCode !== 0)
+            emitFailureResult(result.output, result.data);
+        else
+            emit(result.output, false, result.data);
         return;
     }
     if (args[0] === "internal") {
-        if (args[1] === "session-cli-refresh" && args.length === 2) {
-            if (process.env.YUI_SESSION_SCOPE === "task"
-                || (process.env.YUI_SESSION_SCOPE === "global" && process.env.YUI_ROLE !== "operator")) {
-                throw usageError("Managed Session CLI refresh may be run only by the user or global Operator.");
-            }
-            const result = refreshManagedSessionCliWrappers(home, currentInvocationEntryPoint());
-            emit(`Refreshed ${result.refreshed} managed Session CLI wrapper(s); `
-                + `${result.current} already current, ${result.skipped} skipped.`, false, result);
-            return;
-        }
         if (args[1] === "agent-host" && args.length === 3) {
             process.exitCode = await runAgentHost({
                 home,
@@ -483,17 +473,7 @@ export async function main() {
             catch (error) {
                 if (!(error instanceof ControllerClientError))
                     throw error;
-                if (jsonOutput) {
-                    process.stderr.write(`${JSON.stringify({
-                        ok: false,
-                        code: error.code,
-                        message: error.message,
-                        details: {}
-                    })}\n`);
-                }
-                else {
-                    process.stderr.write(`RUNTIME_ERROR: ${error.message}\n`);
-                }
+                process.stderr.write(`${renderCliFailure(describeCliFailure(error, failureContext()), jsonOutput, error.code)}\n`);
                 process.exitCode = 5;
             }
             return;
@@ -517,17 +497,7 @@ export async function main() {
                 // unknown-active block.
                 if (!(error instanceof ControllerClientError))
                     throw error;
-                if (jsonOutput) {
-                    process.stderr.write(`${JSON.stringify({
-                        ok: false,
-                        code: error.code,
-                        message: error.message,
-                        details: {}
-                    })}\n`);
-                }
-                else {
-                    process.stderr.write(`RUNTIME_ERROR: ${error.message}\n`);
-                }
+                process.stderr.write(`${renderCliFailure(describeCliFailure(error, failureContext()), jsonOutput, error.code)}\n`);
                 process.exitCode = 5;
             }
             return;
@@ -674,7 +644,7 @@ export async function main() {
         yuiHome: home,
         historyLimit: resolveTmuxHistoryLimit(store.getConfig().tmuxHistoryLimit),
         terminalInput: process.stdin,
-        onWarning: (message) => process.stderr.write(`Warning: ${message}\n`)
+        onWarning: (message) => writeCliWarning(message)
     });
     const telemetry = openSchedulerTelemetry(home, store.getConfig());
     try {
@@ -684,8 +654,11 @@ export async function main() {
         const runtime = new FileTaskWorkflowRuntime(home, store, schedulerStore, planner, tmux, workspacePreparer, {
             environment: process.env,
             onError: (error) => {
-                const message = error instanceof Error ? error.message : String(error);
-                process.stderr.write(`Controller runtime error: ${message}\n`);
+                // Advisory async failure: preserve the foreground command's exit status.
+                const failure = describeCliFailure(error, failureContext());
+                process.stderr.write(`${renderCliFailure({
+                    ...failure, details: { ...failure.details, advisory: true }
+                }, jsonOutput)}\n`);
             }
         });
         const workspaceCoordinator = new TaskWorkspaceCoordinator(store, workspacePreparer, runtime);
@@ -845,6 +818,10 @@ export async function main() {
                 ? [resolved[1], ...resolved.slice(2)]
                 : ["session", resolved[1] ?? "", ...resolved.slice(2)];
             const result = runGlobalRoleCommand(sessionArgs, store, roleOptions);
+            if (typeof result !== "string" && result.kind === "output") {
+                emit(result.output, false, result.data);
+                return;
+            }
             if (typeof result === "string") {
                 emit(result);
                 return;
@@ -893,6 +870,14 @@ export async function main() {
                 emit(result);
                 return;
             }
+            if (result.kind === "output") {
+                if (globalInputFailure !== undefined) {
+                    emitControlFailure(globalInputFailure.detail, globalInputFailure.code, globalInputFailure.data);
+                }
+                else
+                    emit(result.output, false, result.data);
+                return;
+            }
             if (result.kind === "input-steer") {
                 // Core already persisted the durable Global Message and proved target +
                 // capability + writer fence from the Global Role's own Session set. This
@@ -1101,8 +1086,7 @@ export async function main() {
                         finalizeStoppedTaskExecution(result.taskId, store);
                     }
                     catch (error) {
-                        const message = error instanceof Error ? error.message : String(error);
-                        throw runtimeError(`Task execution is stopped and durable progress is preserved, but physical runtime cleanup failed: ${message}`);
+                        throw runtimeError("Task execution is stopped and durable progress is preserved, but physical runtime cleanup failed.", { cause: error });
                     }
                     emit(result.output, false, result);
                     return;
@@ -1317,6 +1301,19 @@ export async function main() {
             let archiveRemoteDeliveryProof;
             let archiveTaskReviewCandidate;
             if (resolved[1] === "archive") {
+                const request = parseTaskArchiveArguments(resolved.slice(2));
+                if (request.sourceMessage !== undefined) {
+                    if (request.force || request.disposition !== "integrated") {
+                        throw usageError("Leader ordinary archive does not authorize --force or --abandon.");
+                    }
+                    const result = await callController(home, "capability.call", {
+                        taskId: request.taskId, caller: resolveJobCaller(process.env, request.taskId),
+                        request: { name: "task.archive", requestId: request.requestId,
+                            input: { taskId: request.taskId, sourceMessage: request.sourceMessage, purpose: request.purpose } }
+                    });
+                    emit("Controller archive result; inspect task events if this Session ends before the receipt.\n", false, result);
+                    return;
+                }
                 const { taskId, disposition, force } = validateTaskArchiveRequest(resolved.slice(2), store, {
                     runtime,
                     environment: process.env,
@@ -1497,7 +1494,7 @@ export async function main() {
                             })
                     });
                     for (const warning of completionWarnings) {
-                        process.stderr.write(`Warning: ${warning}\n`);
+                        writeCliWarning(warning);
                     }
                     // Refresh observes remote objects only. Choosing and executing an
                     // upstream Integration belongs to its explicit command, never completion.
@@ -2035,7 +2032,7 @@ async function preflightManagedGlobalControlPlane() {
     const expectedRoleKind = process.env.YUI_ROLE === "operator" ? "operator" : "global";
     if (manifest.owner.scope !== "global"
         || manifest.roleKind !== expectedRoleKind) {
-        throw new Error("Managed global invocation does not match its Session Manifest.");
+        throw new ManagedRuntimeDriftError("Managed global invocation does not match its Session Manifest.");
     }
     if (expectedRoleKind === "operator" && ["doctor", "upgrade", "update"].includes(args[0] ?? "")) {
         // These commands inspect/adopt the storage contract themselves. Requiring
@@ -2059,28 +2056,24 @@ async function preflightManagedGlobalControlPlane() {
     }
     return { contract: undefined, verifiedStore };
 }
-/**
- * The entry point the current invocation resolves to. Only its executable and
- * CLI path are used, to retarget managed Session wrappers at this installation.
- */
-function currentInvocationEntryPoint() {
-    return {
-        executable: process.execPath,
-        cliEntry: fileURLToPath(import.meta.url)
-    };
-}
 function assertManagedSessionManifest(home, scope) {
     const manifestPath = process.env.YUI_SESSION_MANIFEST;
     if (manifestPath === undefined) {
-        throw new Error("Managed control-plane invocation requires its Session Manifest.");
+        throw new ManagedRuntimeDriftError("Managed control-plane invocation requires its Session Manifest.");
+    }
+    let manifest;
+    try {
+        manifest = readSessionBootstrapManifest(manifestPath);
+    }
+    catch (error) {
+        throw new ManagedRuntimeDriftError("Managed Session Manifest could not be verified.", { cause: error });
     }
-    const manifest = readSessionBootstrapManifest(manifestPath);
     if (manifest.owner.scope !== scope) {
-        throw new Error("Managed invocation scope does not match its Session Manifest.");
+        throw new ManagedRuntimeDriftError("Managed invocation scope does not match its Session Manifest.");
     }
     if (scope === "task" && (manifest.owner.scope !== "task"
         || manifest.owner.taskId !== process.env.YUI_TASK_ID)) {
-        throw new Error("Managed Task invocation does not match its Session Manifest owner.");
+        throw new ManagedRuntimeDriftError("Managed Task invocation does not match its Session Manifest owner.");
     }
     const expectedPath = resolve(home, "runtime", "session-manifests", `${manifest.digest}.json`);
     // YUI_HOME is canonicalized (its macOS /var -> /private/var prefix is a
@@ -2093,7 +2086,7 @@ function assertManagedSessionManifest(home, scope) {
         canonicalManifestPath = resolve(manifestPath);
     }
     if (canonicalManifestPath !== expectedPath) {
-        throw new Error("Managed Session Manifest path is outside this YUI_HOME.");
+        throw new ManagedRuntimeDriftError("Managed Session Manifest path is outside this YUI_HOME.");
     }
     return manifest;
 }
@@ -2104,7 +2097,7 @@ function cleanupCliError(error, fallbackResource) {
     if (error instanceof WorkspaceCleanupBlockedError) {
         return usageError(error.message, undefined, cleanupBlockedDetails(error.reason, error.resource, error.retryable));
     }
-    return new CliError("RUNTIME_ERROR", error instanceof Error ? error.message : String(error), undefined, cleanupBlockedDetails("cleanup-failed", fallbackResource, true));
+    return new CliError("RUNTIME_ERROR", error instanceof Error ? error.message : String(error), undefined, cleanupBlockedDetails("cleanup-failed", fallbackResource, true), { cause: error });
 }
 function cleanupBlockedDetails(reason, resource, retryable, checks) {
     return {
@@ -2540,7 +2533,7 @@ async function prepareCodexForCurrentRoles(store, home, targetAgentId) {
         }
     }
     catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
+        const detail = describeCliFailure(error, failureContext()).message;
         const permissionDenied = isCodexInspectionPermissionError(error);
         codexAppNotice(`${permissionDenied
             ? "Codex sharing could not be prepared or verified from this process"
@@ -2559,7 +2552,7 @@ function assertHomeStartupAuthority(store) {
     requireManagedGlobalCaller(store, process.env);
 }
 function codexAppNotice(message, notification) {
-    process.stderr.write(`\nYui: ${message}\n`);
+    writeCliWarning(message);
     if (process.platform !== "darwin")
         return;
     // The native TUI clears terminal output on attach, so keep the actionable
@@ -2569,6 +2562,12 @@ function codexAppNotice(message, notification) {
         `display notification "${notification}" with title "Yui"`
     ], { stdio: "ignore", timeout: 3_000 });
 }
+function writeCliWarning(message) {
+    const safe = sanitizeFailureText(message, failureContext());
+    process.stderr.write(`${jsonOutput
+        ? JSON.stringify({ ok: false, code: "RUNTIME_ERROR", message: safe, details: { advisory: true } })
+        : `Warning: ${safe}`}\n`);
+}
 function renderControllerResult(method, value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return JSON.stringify(value);
@@ -2771,13 +2770,12 @@ async function warmConfigurationMutationCatalog(commandArgs, store, catalogs) {
 async function liveHostObservationsForTaskCommand(args, store, home) {
     if (args[0] !== "task" || args[1] !== "role")
         return undefined;
-    const inspect = args[2] === "session" && args[3] === "inspect" && args.length === 6;
-    const status = args[2] === "status" && args.length === 5;
-    const list = args[2] === "list" && args.length === 4;
-    if (!inspect && !status && !list)
+    const inspect = args[2] === "session" && args[3] === "inspect" && args.length >= 6;
+    const status = args[2] === "status" && args.length >= 5;
+    if (!inspect && !status)
         return undefined;
     const taskId = args[inspect ? 4 : 3];
-    const roles = list ? store.listRoles(taskId).map(role => role.name) : [args[inspect ? 5 : 4]];
+    const roles = [args[inspect ? 5 : 4]];
     const entries = await Promise.all(roles.map(async (roleName) => [
         roleName, await readLiveHostObservation(store, home, taskId, roleName)
     ]));
@@ -2954,9 +2952,17 @@ function emit(output, literal = false, data) {
 }
 function emitControlFailure(message, code, details) {
     process.exitCode = 2;
+    const context = failureContext();
+    const safeMessage = sanitizeFailureText(message.trim(), context);
+    const safeDetails = sanitizeFailureDetails({ value: details }, context).value;
     process.stdout.write(`${jsonOutput
-        ? JSON.stringify({ ok: false, code, message: message.trim(), details })
-        : message.trim()}\n`);
+        ? JSON.stringify({ ok: false, code, message: safeMessage, details: safeDetails })
+        : safeMessage}\n`);
+}
+/** Domain-owned failure reports retain their output envelope and effect receipts. */
+function emitFailureResult(output, data) {
+    const context = failureContext();
+    emit(sanitizeFailureText(output, context), false, sanitizeFailureDetails({ value: data }, context).value);
 }
 /**
  * The human line for a live steer, corrected to the *actual* live acceptance

package/dist/commands/controllerCommands.js

@@ -1,4 +1,5 @@
 import { usageError } from "../errors/cliError.js";
+import { describeCliFailure } from "../errors/cliFailure.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
 import { DEFAULT_RECONCILIATION_INTERVAL_SECONDS } from "../config/yuiConfig.js";
 import { evaluateStorageHealth, UNSUPPORTED } from "../observability/runtimeIdentity.js";
@@ -280,7 +281,7 @@ export async function runInteractiveControllerCleanup(input) {
         catch (error) {
             failed.push({
                 id: resource.id,
-                message: error instanceof Error ? error.message : String(error)
+                message: describeCliFailure(error).message
             });
         }
     }