coolhand-cli 0.5.2 → 0.7.0

package/dist/commands/mcp-call.js

@@ -1,20 +1,57 @@
 import { CliError } from '../errors.js';
-import { loadConfig, getClient } from '../config.js';
+import { loadConfig, resolveClient } from '../config.js';
 import { DEFAULT_BASE_URL } from '../types.js';
 export async function mcpCall(toolName, args, opts = {}) {
     const cfg = await loadConfig();
-    const client = getClient(cfg, opts.clientId);
-    if (opts.clientId && !client) {
-        throw new CliError('CLIENT_NOT_FOUND', `No client "${opts.clientId}" is configured.`);
+    const hasStoredClients = Object.keys(cfg.clients).length > 0;
+    const envPrivateKey = process.env.COOLHAND_PRIVATE_KEY;
+    // Resolve the client. The catch only handles resolveClient failures — the
+    // NO_PRIVATE_KEY check is intentionally outside this try so unrelated throws
+    // don't accidentally pass through the fallback guard.
+    let resolvedClient;
+    try {
+        resolvedClient = await resolveClient(cfg, opts.clientId);
+    }
+    catch (err) {
+        // Zero-config fallback: when there are no stored clients, fall back to
+        // COOLHAND_PRIVATE_KEY (raw env key). Guards:
+        //  - opts.clientId must be undefined: an explicit --client-id flag names a specific
+        //    account, so silently falling back would be confusing.
+        //  - COOLHAND_CLIENT_ID must not be set: if the user set the env var, that is an
+        //    intentional selection we should not silently override.
+        //  - !hasStoredClients: if clients ARE stored, resolution failure (e.g. no default,
+        //    non-TTY) should surface, not fall back to env key.
+        // With all three guards true (no explicit clientId, no COOLHAND_CLIENT_ID, no stored
+        // clients), the priority chain skips steps 1–3 and falls to step 4 (no clients), so
+        // resolveClient throws NOT_CONFIGURED. CLIENT_NOT_FOUND is not reachable here because
+        // that requires an explicit selection (step 1 or 2) which the guards above rule out.
+        if (err instanceof CliError &&
+            err.code === 'NOT_CONFIGURED' &&
+            opts.clientId === undefined &&
+            !process.env.COOLHAND_CLIENT_ID &&
+            !hasStoredClients &&
+            envPrivateKey) {
+            // resolvedClient stays undefined — handled in the branch below
+        }
+        else {
+            throw err;
+        }
     }
-    if (!client && !process.env.COOLHAND_PRIVATE_KEY) {
-        throw new CliError('NOT_CONFIGURED', 'Not logged in. Run `coolhand login --scope private` to authenticate.');
+    let privateKey;
+    let baseUrl;
+    if (resolvedClient !== undefined) {
+        if (!resolvedClient.private_key) {
+            throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+        }
+        privateKey = resolvedClient.private_key;
+        baseUrl = resolvedClient.base_url;
     }
-    const privateKey = opts.clientId ? client?.private_key : (client?.private_key ?? process.env.COOLHAND_PRIVATE_KEY);
-    if (!privateKey) {
-        throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+    else {
+        // Zero-config fallback path: envPrivateKey is guaranteed non-null here because
+        // the catch condition above requires it (the catch would have re-thrown otherwise).
+        privateKey = envPrivateKey;
+        baseUrl = DEFAULT_BASE_URL;
     }
-    const baseUrl = client?.base_url ?? DEFAULT_BASE_URL;
     let parsedBaseUrl;
     try {
         parsedBaseUrl = new URL(baseUrl);
@@ -61,6 +98,16 @@ export async function mcpCall(toolName, args, opts = {}) {
     if (json.error) {
         throw new CliError('MCP_ERROR', `MCP error: ${json.error.message ?? JSON.stringify(json.error)}`);
     }
+    // A tool call can also fail at the tool-execution level (e.g. a business-rule
+    // rejection like "Cannot rename system workloads") while the JSON-RPC envelope
+    // itself reports success. Every tool in this backend returns that case as a plain
+    // `{ error: "..." }` result hash rather than a top-level JSON-RPC `error`.
+    if (json.result !== null && typeof json.result === 'object' && !Array.isArray(json.result)) {
+        const result = json.result;
+        if (typeof result.error === 'string' && result.error.length > 0) {
+            throw new CliError('MCP_ERROR', result.error);
+        }
+    }
     return json.result;
 }
 //# sourceMappingURL=mcp-call.js.map

package/dist/commands/mcp-call.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-call.js","sourceRoot":"","sources":["../../src/commands/mcp-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAgB,EAChB,IAA6B,EAC7B,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,cAAc,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACjD,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACrD,IAAI,aAAkB,CAAC;IACvB,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,gCAAgC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,wCAAwC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,CAAC;QACL,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5C,CAAC;IAEF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,UAAU;aACxB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,uBAAuB,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,oCAAoC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC"}
+{"version":3,"file":"mcp-call.js","sourceRoot":"","sources":["../../src/commands/mcp-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAoB,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,QAAgB,EAChB,IAA6B,EAC7B,OAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAE/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAEvD,0EAA0E;IAC1E,6EAA6E;IAC7E,sDAAsD;IACtD,IAAI,cAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,8CAA8C;QAC9C,oFAAoF;QACpF,2DAA2D;QAC3D,iFAAiF;QACjF,4DAA4D;QAC5D,oFAAoF;QACpF,wDAAwD;QACxD,qFAAqF;QACrF,oFAAoF;QACpF,sFAAsF;QACtF,qFAAqF;QACrF,IACE,GAAG,YAAY,QAAQ;YACvB,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAC7B,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB;YAC/B,CAAC,gBAAgB;YACjB,aAAa,EACb,CAAC;YACD,+DAA+D;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAe,CAAC;IAEpB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,cAAc,CAAC,WAAW,CAAC;QACxC,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,+EAA+E;QAC/E,oFAAoF;QACpF,UAAU,GAAG,aAAuB,CAAC;QACrC,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;IACD,IAAI,aAAkB,CAAC;IACvB,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,gCAAgC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,wCAAwC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,CAAC;QACL,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5C,CAAC;IAEF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,UAAU;aACxB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,uBAAuB,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,oCAAoC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,kFAAkF;IAClF,2EAA2E;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6B,CAAC;QAClD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC"}

package/dist/commands/monitor.d.ts

@@ -0,0 +1,9 @@
+import type { MonitorOptions } from '../types.js';
+import { type WrapDeps } from '../proxy/wrap-runner.js';
+/**
+ * `coolhand monitor [--] <command> [args...]` — run an arbitrary CLI behind the
+ * Coolhand proxy with the stored API key filled in. Generalizes the `claude`
+ * command's proxy wiring to any child command.
+ */
+export declare function run(opts: MonitorOptions, deps?: WrapDeps): Promise<number>;
+//# sourceMappingURL=monitor.d.ts.map

package/dist/commands/monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.d.ts","sourceRoot":"","sources":["../../src/commands/monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF"}

package/dist/commands/monitor.js

@@ -0,0 +1,10 @@
+import { runWrapped } from '../proxy/wrap-runner.js';
+/**
+ * `coolhand monitor [--] <command> [args...]` — run an arbitrary CLI behind the
+ * Coolhand proxy with the stored API key filled in. Generalizes the `claude`
+ * command's proxy wiring to any child command.
+ */
+export async function run(opts, deps = {}) {
+    return runWrapped(opts.command, opts.args, opts.clientId, deps);
+}
+//# sourceMappingURL=monitor.js.map

package/dist/commands/monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.js","sourceRoot":"","sources":["../../src/commands/monitor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAiB,MAAM,yBAAyB,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAoB,EAAE,OAAiB,EAAE;IACjE,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/commands/status.js

@@ -6,7 +6,7 @@ export function buildStatusOutput(cfg) {
     const clients = Object.values(cfg.clients).map((entry) => ({
         client_id: entry.client_id,
         client_name: entry.client_name,
-        masked_token: maskToken(entry.api_key),
+        masked_token: entry.api_key ? maskToken(entry.api_key) : '(no public key)',
         base_url: entry.base_url,
     }));
     return {
@@ -24,7 +24,7 @@ export async function run(opts) {
         logger.json({ ...output, configured });
     }
     else if (configured && target) {
-        logger.info(`Configured: "${target.client_name}" (${target.client_id}) — ${maskToken(target.api_key)}`);
+        logger.info(`Configured: "${target.client_name}" (${target.client_id}) — ${target.api_key ? maskToken(target.api_key) : '(no public key)'}`);
     }
     else if (opts.clientId) {
         logger.info(`No token configured for client "${opts.clientId}".`);

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,MAAM,UAAU,iBAAiB,CAAC,GAA2C;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC9B,OAAO;QACP,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IAEvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,WAAW,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;AACxD,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,MAAM,UAAU,iBAAiB,CAAC,GAA2C;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB;QAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC9B,OAAO;QACP,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IAEvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,WAAW,MAAM,MAAM,CAAC,SAAS,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/I,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;AACxD,CAAC"}

package/dist/commands/update-workload.d.ts

@@ -0,0 +1,3 @@
+import type { UpdateWorkloadOptions } from '../types.js';
+export declare function run(opts: UpdateWorkloadOptions): Promise<number>;
+//# sourceMappingURL=update-workload.d.ts.map

package/dist/commands/update-workload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-workload.d.ts","sourceRoot":"","sources":["../../src/commands/update-workload.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,wBAAsB,GAAG,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BtE"}

package/dist/commands/update-workload.js

@@ -0,0 +1,35 @@
+import { CliError, ExitCode } from '../errors.js';
+import { logger, redact } from '../logger.js';
+import { mcpCall } from './mcp-call.js';
+export async function run(opts) {
+    try {
+        const args = { workload_id: opts.id };
+        if (opts.name !== undefined) {
+            args.name = opts.name;
+        }
+        if (opts.description !== undefined) {
+            args.description = opts.description;
+        }
+        const result = await mcpCall('update_workload', args, { clientId: opts.clientId });
+        if (opts.json) {
+            logger.json({ ok: true, result });
+        }
+        else {
+            logger.info(JSON.stringify(result, null, 2));
+        }
+        return ExitCode.OK;
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            if (opts.json) {
+                logger.json({ ok: false, error: err.code, message: redact(err.message) });
+            }
+            else {
+                logger.info(`Error: ${redact(err.message)} [${err.code}]`);
+            }
+            return err.exitCode;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=update-workload.js.map

package/dist/commands/update-workload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-workload.js","sourceRoot":"","sources":["../../src/commands/update-workload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAA2B;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAA4B,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/commands/whoami.js

@@ -14,7 +14,7 @@ export async function run(opts) {
         }
         return ExitCode.USER_ERROR;
     }
-    logger.info(`Logged in as "${entry.client_name}" (id: ${entry.client_id}) via ${entry.base_url} — ${maskToken(entry.api_key)}`);
+    logger.info(`Logged in as "${entry.client_name}" (id: ${entry.client_id}) via ${entry.base_url} — ${entry.api_key ? maskToken(entry.api_key) : '(no public key)'}`);
     return ExitCode.OK;
 }
 //# sourceMappingURL=whoami.js.map

package/dist/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,IAAI,CACT,iBAAiB,KAAK,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CACnH,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,QAAQ,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,IAAI,CACT,iBAAiB,KAAK,CAAC,WAAW,UAAU,KAAK,CAAC,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CACvJ,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC"}

package/dist/commands/wildcard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wildcard.d.ts","sourceRoot":"","sources":["../../src/commands/wildcard.ts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAoBzE;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CpE"}
+{"version":3,"file":"wildcard.d.ts","sourceRoot":"","sources":["../../src/commands/wildcard.ts"],"names":[],"mappings":"AAMA,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA6BzE;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsIpE"}

package/dist/commands/wildcard.js

@@ -1,8 +1,9 @@
 import { Coolhand } from 'coolhand-node';
-import { ExitCode } from '../errors.js';
+import { ExitCode, CliError } from '../errors.js';
 import { PACKAGE_IDENTIFIER } from '../version.js';
 import { logger, redact } from '../logger.js';
-import { loadConfig, getClient } from '../config.js';
+import { loadConfig, resolveClient } from '../config.js';
+import { savePendingRecord } from '../pending-store.js';
 import { DEFAULT_BASE_URL } from '../types.js';
 // Terminal guidance that breaks the agent out of its retry loop. The missing
 // capability is real regardless of whether we could reach the Coolhand server, so
@@ -10,11 +11,18 @@ import { DEFAULT_BASE_URL } from '../types.js';
 const STOP_GUIDANCE = 'Do not retry this action or attempt alternative ways to perform it; continue with the rest of your task.';
 // Printed when the blocker was successfully recorded server-side.
 const DELOOP_RECORDED = 'This capability is not available in this environment. Your feedback has been recorded. ' + STOP_GUIDANCE;
-// Printed when the blocker could NOT be recorded (e.g. not logged in, or the server
-// did not confirm). We still de-loop the agent, but stay honest: we never claim a
-// recording happened, and a warning is logged separately so the failure surfaces.
+// Printed when the blocker could NOT be recorded (e.g. the server did not confirm).
+// We still de-loop the agent, but stay honest: we never claim a recording happened,
+// and a warning is logged separately so the failure surfaces.
 const DELOOP_UNRECORDED = 'This capability is not available in this environment. Your feedback could not be recorded ' +
-    '(not logged in, or the server did not confirm — run `coolhand login` to enable reporting). ' +
+    '(the server did not confirm — run `coolhand login` to enable reporting). ' +
+    STOP_GUIDANCE;
+// Printed when the blocker was saved locally because the API key is unavailable
+// (not logged in, no default client set, or private-only login). The data is not
+// lost: it uploads when credentials are available. The specific reason is already
+// in the logger.warn() call above, so this message stays generic.
+const DELOOP_SAVED = 'This capability is not available in this environment. Your feedback was saved locally ' +
+    'and will be uploaded once a Coolhand account with a public API key is configured. ' +
     STOP_GUIDANCE;
 /**
  * Records an agent's free-form "I am blocked, this capability does not exist"
@@ -28,26 +36,84 @@ const DELOOP_UNRECORDED = 'This capability is not available in this environment.
  */
 export async function run(opts) {
     let recorded = false;
+    let savedPath;
+    // Set when client selection itself fails (prompt timeout / invalid input), so the de-loop
+    // message accurately reflects "selection not completed" rather than "server did not confirm".
+    let deloopFallback;
+    // The SDK resolves to null (it does not throw) when the write fails, so a truthy
+    // response is the only proof the blocker was actually recorded.
+    const feedback = {
+        explanation: opts.complaint,
+        creator_unique_id: opts.agentName,
+        creator_type: 'agent',
+        collector: `${PACKAGE_IDENTIFIER}/wildcard`,
+        ...(opts.thinking ? { original_output: opts.thinking } : {}),
+        ...(opts.logId !== undefined ? { llm_request_log_id: opts.logId } : {}),
+    };
     try {
         const cfg = await loadConfig();
-        const client = getClient(cfg, opts.clientId);
+        // resolveClient runs the full priority chain (env var, default, auto-pick, stale warning).
+        // wildcard works even without a client, so we catch NOT_CONFIGURED and proceed silently.
+        let client;
+        try {
+            client = await resolveClient(cfg, opts.clientId);
+        }
+        catch (err) {
+            // NOT_CONFIGURED is swallowed in both sub-cases:
+            //   (a) no clients stored at all → proceed unauthenticated (no accounts configured)
+            //   (b) clients stored but non-TTY with no default → also proceed, but the
+            //       warning block below (lines 96-109) distinguishes and warns accordingly.
+            // Any other error (CLIENT_NOT_FOUND for a bad --client-id, INVALID_ARGS for a
+            // prompt timeout, etc.) propagates to the outer catch, which logs a warning and
+            // still de-loops — the recording failure surfaces but the agent is freed.
+            if (!(err instanceof CliError) || err.code !== 'NOT_CONFIGURED') {
+                throw err;
+            }
+        }
+        // If COOLHAND_API_KEY is set in the environment it acts as a raw API key fallback for both
+        // sub-cases of NOT_CONFIGURED: (a) no clients stored at all — the intended zero-config agent
+        // path, and (b) clients stored but none auto-selected (non-TTY, no default). Sub-case (b)
+        // bypasses the three-way warning discriminator below and the "Client: ..." stderr label; this
+        // is intentional — wildcard is best-effort and using the env key is better than dropping the
+        // record. mcp-call explicitly does NOT allow this fallback (it surfaces the resolution error).
         const apiKey = client?.api_key ?? process.env.COOLHAND_API_KEY;
         const baseUrl = client?.base_url ?? DEFAULT_BASE_URL;
         if (!apiKey) {
-            logger.warn('Not logged in; blocker feedback was not recorded. Run `coolhand login` to enable reporting.');
+            // No usable API key: save the blocker locally so it isn't lost. Uploads on
+            // the next `coolhand login` (or when credentials are otherwise supplied).
+            savedPath = await savePendingRecord({
+                command: 'report-blocker',
+                kind: 'feedback',
+                payload: feedback,
+                // Prefer the resolved client_id (known even for private-only clients).
+                // Fall back to opts.clientId only when no client was resolved at all.
+                ...(client !== undefined
+                    ? { clientId: client.client_id }
+                    : opts.clientId !== undefined
+                        ? { clientId: opts.clientId }
+                        : {}),
+                savedAt: new Date().toISOString(),
+            });
+            if (client) {
+                // Client resolved but has no public API key (private-only login).
+                logger.warn(`No public API key configured for "${client.client_name}". ` +
+                    `Blocker feedback saved locally to ${savedPath}. ` +
+                    `Re-authenticate with 'coolhand login' to grant the public key.`);
+            }
+            else if (Object.keys(cfg.clients).length > 0) {
+                // Clients are stored but none could be auto-selected (non-TTY, no default set).
+                logger.warn(`No default client is set and auto-selection is unavailable in non-interactive mode. ` +
+                    `Blocker feedback saved locally to ${savedPath}. ` +
+                    `Pass --client-id or run 'coolhand clients use <id>' to enable direct posting.`);
+            }
+            else {
+                // No clients configured at all.
+                logger.warn(`Not logged in; blocker feedback saved locally to ${savedPath}. ` +
+                    'It will upload on your next `coolhand login`.');
+            }
         }
         else {
             const coolhand = new Coolhand({ apiKey, baseUrl, silent: true });
-            // The SDK resolves to null (it does not throw) when the write fails, so a
-            // truthy response is the only proof the blocker was actually recorded.
-            const feedback = {
-                explanation: opts.complaint,
-                creator_unique_id: opts.agentName,
-                creator_type: 'agent',
-                collector: `${PACKAGE_IDENTIFIER}/wildcard`,
-                ...(opts.thinking ? { original_output: opts.thinking } : {}),
-                ...(opts.logId !== undefined ? { llm_request_log_id: opts.logId } : {}),
-            };
             const result = await coolhand.createFeedback(feedback);
             recorded = result !== null && result !== undefined;
             if (!recorded) {
@@ -56,15 +122,47 @@ export async function run(opts) {
         }
     }
     catch (err) {
+        // Note: errors that reach here (CLIENT_NOT_FOUND for a bad --client-id, INVALID_ARGS for a
+        // prompt timeout, SDK network errors, etc.) bypass the !apiKey branch above, so neither the
+        // env-key fallback nor the local-save path is attempted. The feedback is not persisted.
+        // This is intentional for CLIENT_NOT_FOUND: if the user named an explicit --client-id that
+        // doesn't exist, silently falling back to COOLHAND_API_KEY would be surprising. The agent
+        // is still de-looped and the failure surfaces as a warning.
+        if (err instanceof CliError && err.code === 'CLIENT_NOT_FOUND') {
+            // Bad --client-id value — not a server or auth failure; give actionable guidance.
+            deloopFallback =
+                'This capability is not available in this environment. The specified client was not found ' +
+                    '(pass --client-id with a valid client ID, or run `coolhand clients` to list configured clients). ' +
+                    STOP_GUIDANCE;
+        }
+        else if (err instanceof CliError && err.code === 'INVALID_ARGS') {
+            // Client selection prompt timed out or received invalid input — not a server failure.
+            deloopFallback =
+                'This capability is not available in this environment. Client selection was not completed ' +
+                    '(prompt timed out or received invalid input — pass --client-id to select a client directly). ' +
+                    STOP_GUIDANCE;
+        }
         logger.warn(`Could not record blocker feedback: ${redact(err.message)}`);
     }
     // Always de-loop: the capability genuinely does not exist, so the agent must stop
     // whether or not we could notify the server. Stay honest about the recording status
     // (warnings above already surfaced any failure) rather than gating the stop-signal
     // on a confirmed write and leaving a logged-out agent stuck.
-    const message = recorded ? DELOOP_RECORDED : DELOOP_UNRECORDED;
+    let message;
+    if (recorded) {
+        message = DELOOP_RECORDED;
+    }
+    else if (savedPath) {
+        message = DELOOP_SAVED;
+    }
+    else if (deloopFallback) {
+        message = deloopFallback;
+    }
+    else {
+        message = DELOOP_UNRECORDED;
+    }
     if (opts.json === true) {
-        logger.json({ ok: true, recorded, message });
+        logger.json({ ok: true, recorded, saved: savedPath ?? null, message });
     }
     else {
         logger.info(message);

package/dist/commands/wildcard.js.map

@@ -1 +1 @@
-{"version":3,"file":"wildcard.js","sourceRoot":"","sources":["../../src/commands/wildcard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA8B,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,aAAa,CAAC;AAEzE,6EAA6E;AAC7E,kFAAkF;AAClF,iEAAiE;AACjE,MAAM,aAAa,GACjB,0GAA0G,CAAC;AAE7G,kEAAkE;AAClE,MAAM,eAAe,GACnB,yFAAyF,GAAG,aAAa,CAAC;AAE5G,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,iBAAiB,GACrB,4FAA4F;IAC5F,6FAA6F;IAC7F,aAAa,CAAC;AAEhB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAyB;IACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;QAErD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,QAAQ,GAA0B;gBACtC,WAAW,EAAE,IAAI,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,IAAI,CAAC,SAAS;gBACjC,YAAY,EAAE,OAAO;gBACrB,SAAS,EAAE,GAAG,kBAAkB,WAAW;gBAC3C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACvD,QAAQ,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,6DAA6D;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"wildcard.js","sourceRoot":"","sources":["../../src/commands/wildcard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA8B,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,aAAa,CAAC;AAEzE,6EAA6E;AAC7E,kFAAkF;AAClF,iEAAiE;AACjE,MAAM,aAAa,GACjB,0GAA0G,CAAC;AAE7G,kEAAkE;AAClE,MAAM,eAAe,GACnB,yFAAyF,GAAG,aAAa,CAAC;AAE5G,oFAAoF;AACpF,oFAAoF;AACpF,8DAA8D;AAC9D,MAAM,iBAAiB,GACrB,4FAA4F;IAC5F,2EAA2E;IAC3E,aAAa,CAAC;AAEhB,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,kEAAkE;AAClE,MAAM,YAAY,GAChB,wFAAwF;IACxF,oFAAoF;IACpF,aAAa,CAAC;AAEhB;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAyB;IACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAA6B,CAAC;IAClC,0FAA0F;IAC1F,8FAA8F;IAC9F,IAAI,cAAkC,CAAC;IAEvC,iFAAiF;IACjF,gEAAgE;IAChE,MAAM,QAAQ,GAA0B;QACtC,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,iBAAiB,EAAE,IAAI,CAAC,SAAS;QACjC,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,GAAG,kBAAkB,WAAW;QAC3C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iDAAiD;YACjD,oFAAoF;YACpF,2EAA2E;YAC3E,gFAAgF;YAChF,8EAA8E;YAC9E,gFAAgF;YAChF,0EAA0E;YAC1E,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAChE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;QAErD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,2EAA2E;YAC3E,0EAA0E;YAC1E,SAAS,GAAG,MAAM,iBAAiB,CAAC;gBAClC,OAAO,EAAE,gBAAgB;gBACzB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,QAAQ;gBACjB,uEAAuE;gBACvE,sEAAsE;gBACtE,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE;oBAChC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;wBAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;wBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,kEAAkE;gBAClE,MAAM,CAAC,IAAI,CACT,qCAAqC,MAAM,CAAC,WAAW,KAAK;oBAC1D,qCAAqC,SAAS,IAAI;oBAClD,gEAAgE,CACnE,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,gFAAgF;gBAChF,MAAM,CAAC,IAAI,CACT,sFAAsF;oBACpF,qCAAqC,SAAS,IAAI;oBAClD,+EAA+E,CAClF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,gCAAgC;gBAChC,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,IAAI;oBAC/D,+CAA+C,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACvD,QAAQ,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2FAA2F;QAC3F,4FAA4F;QAC5F,wFAAwF;QACxF,2FAA2F;QAC3F,0FAA0F;QAC1F,4DAA4D;QAC5D,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC/D,kFAAkF;YAClF,cAAc;gBACZ,2FAA2F;oBAC3F,mGAAmG;oBACnG,aAAa,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClE,sFAAsF;YACtF,cAAc;gBACZ,2FAA2F;oBAC3F,+FAA+F;oBAC/F,aAAa,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,6DAA6D;IAC7D,IAAI,OAAe,CAAC;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,GAAG,eAAe,CAAC;IAC5B,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,OAAO,GAAG,YAAY,CAAC;IACzB,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,GAAG,cAAc,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,iBAAiB,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC"}

package/dist/config.d.ts

@@ -2,10 +2,26 @@ import type { ClientEntry, ConfigFile } from './types.js';
 export declare function configDir(): string;
 export declare function configPath(): string;
 export declare function loadConfig(): Promise<ConfigFile>;
+/**
+ * Write a file atomically with restrictive permissions: write to a temp file in the
+ * same directory, then rename it into place (rename is atomic on POSIX), so a reader
+ * never sees a half-written file. The caller is responsible for ensuring the parent
+ * directory exists. Shared by `saveConfig` and the pending-record store.
+ */
+export declare function atomicWriteFile(filePath: string, data: string, mode?: number): Promise<void>;
 export declare function saveConfig(cfg: ConfigFile): Promise<void>;
 export declare function deleteConfig(): Promise<void>;
 export declare function getClient(cfg: ConfigFile, clientId?: string): ClientEntry | undefined;
 export declare function upsertClient(entry: ClientEntry, makeDefault?: boolean): Promise<ConfigFile>;
 export declare function removeClient(clientId: string): Promise<ConfigFile | null>;
 export declare function setDefault(clientId: string): Promise<ConfigFile>;
+/**
+ * Resolves which client to use for an API command. Priority:
+ *   explicit clientId arg > COOLHAND_CLIENT_ID env > default_client_id config >
+ *   auto-pick if only one client exists > interactive prompt (TTY) or error.
+ *
+ * Prints "Client: <name> (<id>)" to stderr after resolution so the user always
+ * knows which account's data they are looking at.
+ */
+export declare function resolveClient(cfg: ConfigFile, clientId?: string): Promise<ClientEntry>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM1D,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAMD,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAyBtD;AAWD,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB/D;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAMlD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAMrF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,UAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ9F;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgB/E;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQtE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM1D,wBAAgB,SAAS,IAAI,MAAM,CAMlC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAMD,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAyBtD;AAWD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAMlD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAMrF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,UAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ9F;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgB/E;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQtE;AA2CD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAyE5F"}