healthcloud-cli 3.7.0__tar.gz → 3.7.2__tar.gz

{healthcloud_cli-3.7.0 → healthcloud_cli-3.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: healthcloud-cli
-Version: 3.7.0
+Version: 3.7.2
 Summary: Command-line interface for the HealthCloud MCP gateway, generated from the shared MCP tool manifest.
 Project-URL: Issues, https://github.com/healthcloudservices/healthcloud-services/issues
 Project-URL: Repository, https://github.com/healthcloudservices/healthcloud-services
@@ -316,6 +316,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -545,6 +566,16 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
 Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
 usage error, before login), an agent outside the explicit tenant, an already
 in-effect state, an unsupported `archived`/`draft` target (named as having no
@@ -615,6 +646,12 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
@@ -689,6 +726,13 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
 Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
 2 usage error before login or any request; an agent outside the explicit tenant,
 the tenant identity mismatch and a delete target that no longer exists are
@@ -751,10 +795,14 @@ uv run --frozen hc ams departments delete --environment dev --tenant-id TENANT_I
   reports a `validation` refusal that names the department, the tenant that
   received it, and tells you to run `hc ams departments get` — it never claims
   a landed write was a stopped no-op.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams departments get` before
-  retrying. It never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams departments get` before retrying. It never
+  re-sends the write and never re-reads on its own.
 
 Read-only team listing and inspection are also complete and unpaged. The bounded
 projection omits descriptions and creator identities; it includes evaluation-suite
@@ -797,10 +845,14 @@ uv run --frozen hc ams teams delete --environment dev --tenant-id TENANT_ID   --
   `validation` refusal that reports the landed write truthfully: it names the
   team and the tenant that actually received it and points to `hc ams teams
   get` — it never claims a landed write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams teams get` before retrying. It
-  never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams teams get` before retrying. It never re-sends
+  the write and never re-reads on its own.
 
 The organization hierarchy is the backend-built department/team/agent tree. The
 CLI preserves its order and nesting without issuing entity reads, joining records,
@@ -862,10 +914,14 @@ uv run --frozen hc ams skills delete --environment dev --tenant-id TENANT_ID --s
   landed write truthfully: it names the skill and the tenant that actually
   received it and points to `hc ams skills get` — it never claims a landed
   write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams skills get` before retrying. It
-  never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams skills get` before retrying. It never re-sends
+  the write and never re-reads on its own.
 
 Read-only policy catalog listing and inspection are complete and unpaged. The
 bounded projection includes only policy IDs, names, department IDs, guardrail
@@ -954,10 +1010,14 @@ uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID -
   landed write truthfully: it names the policy and the tenant that actually
   received it and points to `hc ams policies get` — it never claims a landed
   write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams policies get` before retrying.
-  It never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams policies get` before retrying. It never
+  re-sends the write and never re-reads on its own.
 
 Governed authoring sessions and their messages are first-class commands over the
 VibeCoder session routes. Creating a session and appending a message make no model
@@ -981,6 +1041,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1153,6 +1221,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1407,8 +1481,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.0 → healthcloud_cli-3.7.2}/README.md

@@ -298,6 +298,27 @@ otherwise it prompts (with hidden password input). It stores only the email,
 tenant/environment binding, access/refresh tokens and expiry in the strict
 owner-only `~/.healthcloud/cli/ams-session.json`; it never stores the password.
 
+By default (`pretty`) these three commands print readable lines — never a raw
+JSON blob and never a token:
+
+```text
+$ hc login --environment dev --tenant-id TENANT_ID
+saved session: dev / TENANT_ID
+email: admin@example.test
+expires_at: 2026-11-02T01:42:29Z
+$ hc logout
+saved session removed: true
+server session revoked: false
+```
+
+`hc login --status` prints the same three lines for the saved session, and a
+second `hc logout` reports `saved session removed: false`. `--output json` (and
+`--output raw`, which these commands treat as JSON) prints exactly the objects
+they have always printed: `{"schema_version": 1, "ok": true, "session":
+{"schema_version": 1, "environment", "tenant_id", "email", "expires_at"}}`
+for `login`/`--status`, and `{"schema_version": 1, "ok": true, "removed":
+true|false, "server_session_revoked": false}` for `logout`.
+
 For CI and agents, log in non-interactively: pass `--email` and pipe the password
 to `--password-stdin` (read as exactly one stdin line, never echoed, never a
 flag value — there is no `--password` option):
@@ -527,6 +548,16 @@ explicitly that
 fields — a disabled agent can still be selected by those paths — and that
 in-flight runs, WSS sessions and schedules are untouched by this route.
 
+Default `pretty` output prints those facts as labelled lines — `transition`,
+`requested`, `evidence` (`saved`, `side_effects`, `runtime`), `eligibility`,
+`mutation_replayed: false` — and closes with a `verification:` block, so a
+deactivate reads `transition: deactivate`, then
+`evidence: / saved: / status: confirmed`, then `verification: / saved_state:
+confirmed`, `side_effects: unverified`, `runtime: unverified`; it is never one
+raw JSON line. `--output json` prints the full envelope above, byte-identical to
+before. An unknown outcome still prints its one-line `error:` plus the
+reconciliation on stderr.
+
 Pre-checks refuse with exit 1 and **no write**: a missing `--confirm` (exit 2
 usage error, before login), an agent outside the explicit tenant, an already
 in-effect state, an unsupported `archived`/`draft` target (named as having no
@@ -597,6 +628,12 @@ server audit log records an `UPDATE` with the payload. Runtime enforcement of
 the new references is unobservable: no serving readback route exists, so this
 command never claims it.
 
+Default `pretty` output prints the same facts as labelled lines: `agent_id`,
+`changed` (each field with `before`/`after`/`added`/`removed`),
+`config_version: {before, after}`, `evidence` (`saved`, `side_effects`,
+`runtime`), `mutation_replayed: false`, and a closing `verification:` block.
+`--output json` prints the full envelope described here, unchanged.
+
 `tool_ids` and `data_source_ids` address **unscoped global catalogs** by design;
 the server checks tenant scope only for the department, team, skill, policy and
 guardrail references. This command does not imply otherwise, and it does not
@@ -671,6 +708,13 @@ of restore and has no `--force`, no `--dry-run`, no interactive prompt and no
 `--expected-config-version` — the route has no `If-Match` or version check, so a
 version flag would advertise protection the server does not offer.
 
+Default `pretty` output prints the result as labelled lines next to the stderr
+disclosure: `agent_id`, `deleted: true`, `target`, `disclosure`, `evidence`
+(`deleted`/`side_effects`/`runtime`), `mutation_replayed: false`, and a closing
+`verification:` block. `--output json` prints the full envelope, unchanged. The
+reviewed target and disclosure above are still printed to stderr in `pretty`
+mode only; `--output json`/`raw` keep stderr machine-parsable.
+
 Refusals claim nothing and send nothing extra: a missing `--confirm` is an exit
 2 usage error before login or any request; an agent outside the explicit tenant,
 the tenant identity mismatch and a delete target that no longer exists are
@@ -733,10 +777,14 @@ uv run --frozen hc ams departments delete --environment dev --tenant-id TENANT_I
   reports a `validation` refusal that names the department, the tenant that
   received it, and tells you to run `hc ams departments get` — it never claims
   a landed write was a stopped no-op.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams departments get` before
-  retrying. It never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams departments get` before retrying. It never
+  re-sends the write and never re-reads on its own.
 
 Read-only team listing and inspection are also complete and unpaged. The bounded
 projection omits descriptions and creator identities; it includes evaluation-suite
@@ -779,10 +827,14 @@ uv run --frozen hc ams teams delete --environment dev --tenant-id TENANT_ID   --
   `validation` refusal that reports the landed write truthfully: it names the
   team and the tenant that actually received it and points to `hc ams teams
   get` — it never claims a landed write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams teams get` before retrying. It
-  never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams teams get` before retrying. It never re-sends
+  the write and never re-reads on its own.
 
 The organization hierarchy is the backend-built department/team/agent tree. The
 CLI preserves its order and nesting without issuing entity reads, joining records,
@@ -844,10 +896,14 @@ uv run --frozen hc ams skills delete --environment dev --tenant-id TENANT_ID --s
   landed write truthfully: it names the skill and the tenant that actually
   received it and points to `hc ams skills get` — it never claims a landed
   write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams skills get` before retrying. It
-  never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams skills get` before retrying. It never re-sends
+  the write and never re-reads on its own.
 
 Read-only policy catalog listing and inspection are complete and unpaged. The
 bounded projection includes only policy IDs, names, department IDs, guardrail
@@ -936,10 +992,14 @@ uv run --frozen hc ams policies delete --environment dev --tenant-id TENANT_ID -
   landed write truthfully: it names the policy and the tenant that actually
   received it and points to `hc ams policies get` — it never claims a landed
   write was stopped.
-- If the transport times out or the connection drops mid-write, the write's
-  outcome is unknown: the CLI reports one `transport` error whose message says
-  the outcome is unknown and to check `hc ams policies get` before retrying.
-  It never re-sends the write on its own.
+- If the transport times out, the connection drops mid-write, or the server
+  answers an HTTP 5xx/408 before a readable result, the write's outcome is
+  unknown: the CLI exits 1 with an `unknown` envelope
+  (`verification.saved_state: unknown`, `verification.side_effects:
+  unverified`, `data.mutation_replayed: false`, and
+  `data.reconciliation.status: not_read`) whose message says the outcome is
+  unknown and to check `hc ams policies get` before retrying. It never
+  re-sends the write and never re-reads on its own.
 
 Governed authoring sessions and their messages are first-class commands over the
 VibeCoder session routes. Creating a session and appending a message make no model
@@ -963,6 +1023,14 @@ uv run --frozen hc ams sessions messages add --environment dev --tenant-id TENAN
   "continuation": null}`). `get` emits `operation: "sessions.get"` and
   `data.session`. The projections never include the session's protected
   `initial_prompt`, tenant or user identity, or arbitrary response fields.
+- Default `pretty` output prints `list` as a table with honest headers —
+  `ID`, `AGENT ID`, `OPERATION`, `STATUS`, `EXPIRES AT` for sessions and `ID`,
+  `ROLE`, `MODE`, `PLAN ID`, `CREATED AT` for messages — followed by an entry
+  count (`1 entry` / `N entries`), and `(no entries)` for an empty list. These
+  projections carry no `name`, so no `NAME` column is invented and the `id` is
+  always shown. `get`, `create` and `messages add` print `key: value` lines.
+  `--output json` prints the full envelope exactly as before; pretty output is
+  additive and never changes the envelope.
 - `create` and `messages add` require a saved `hc login` session (env-var
   credentials are not accepted for writes). Each write is sent exactly once and
   the envelope carries the server's authoritative readback:
@@ -1135,6 +1203,12 @@ uv run --frozen hc ams sessions plans reconcile --environment dev --tenant-id TE
   (create: reference counts by kind) and finding counts. No prompt,
   instructions, greeting, summary, message content or plan value is printed to
   stdout, stderr, a diagnostic or an error string.
+- Default `pretty` output renders `generate`, `get`, `apply`, `rollback` and
+  `reconcile` as labelled lines — `plan:` with the bounded metadata, then
+  `evidence:` (`saved`/`side_effects`/`runtime`) and `mutation_replayed: false`
+  where the command reports them, and a closing `verification:` block for the
+  writes. A write is never printed as a raw JSON blob in the default mode.
+  `--output json` prints the full envelope, unchanged.
 - The prompt is protected free text and never comes from argv: `--prompt-file`
   reads one owner-only regular text file (no symlinks, at most 20000
   characters) and sends it once. `--prompt-file` is optional — the server falls
@@ -1389,8 +1463,12 @@ and `hc ams organization hierarchy`) render in two modes (`--output` on the root
 `hc` command; `pretty` is the default):
 
 - **`pretty`** (default): a compact human view. Lists print an `ID`/`NAME`
-  table with an entry count; a single record prints `key: value` lines; the
-  organization hierarchy prints an indented tree. Each failed AMS command
+  table with an entry count; a collection whose rows have no `name` (sessions,
+  messages, attachments) prints a table of that command's own columns plus the
+  count, and `(no entries)` when empty. A single record prints `key: value`
+  lines, the organization hierarchy prints an indented tree, and write or
+  reconciliation evidence prints labelled `key: value` lines (the write's
+  `verification:` block included) instead of JSON. Each failed AMS command
   prints one stderr line, `error: <message> (<category>)` (flag/argument
   usage errors from Click print Click's standard usage message instead).
 - **`json`**: the stable result envelope (below) on stdout. When stdout is not

{healthcloud_cli-3.7.0 → healthcloud_cli-3.7.2}/healthcloud_cli/ams/departments/operations.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 from ..context import AmsDependencies
 from ..domain_errors import DomainReadRefused
-from ..results import succeeded
+from ..results import is_unknown_write_status, succeeded, unknown_write
 from ..target import TenantTarget
 from .projections import department_projection
 
@@ -27,6 +27,18 @@ UNKNOWN_OUTCOME = (
     "department's current server state before deciding whether to retry."
 )
 
+UNKNOWN_HTTP_OUTCOME = (
+    "The department write was sent once and its outcome is now unknown: the server answered with an "
+    "error status before a readable result, so the request may have been processed. Run "
+    "`hc ams departments get` to check the department's current server state before deciding whether "
+    "to retry."
+)
+
+UNKNOWN_RECONCILIATION = (
+    "This command did not re-read the department after the uncertain write; run "
+    "`hc ams departments list` before doing anything else."
+)
+
 
 def _department_id(value: str) -> str:
     if not isinstance(value, str) or not value.strip():
@@ -140,11 +152,26 @@ def create_department(
             )
         except HealthCloudNetworkError:
             # Sent once: the request may have landed; the outcome is unknown, never retried here.
-            raise DepartmentWriteRefused("transport", UNKNOWN_OUTCOME) from None
+            unknown_write(
+                "departments.create",
+                _target(target),
+                UNKNOWN_OUTCOME,
+                {"department": None},
+                reconciliation_detail=UNKNOWN_RECONCILIATION,
+            )
         except HealthCloudHTTPError as error:
             refusal = _create_not_found(error, parent_department_id)
             if refusal is not None:
                 raise refusal from error
+            if is_unknown_write_status(getattr(error, "status_code", None)):
+                # A 5xx/408 may have committed server-side: report it as unknown, never a retry shape.
+                unknown_write(
+                    "departments.create",
+                    _target(target),
+                    UNKNOWN_HTTP_OUTCOME,
+                    {"department": None},
+                    reconciliation_detail=UNKNOWN_RECONCILIATION,
+                )
             raise
     # The write has already landed server-side; a mismatching readback must never be
     # reported as a stopped no-op. Name the tenant that actually received it.
@@ -174,11 +201,25 @@ def update_department(
         try:
             department = resource.update(department_id, **fields)
         except HealthCloudNetworkError:
-            raise DepartmentWriteRefused("transport", UNKNOWN_OUTCOME) from None
+            unknown_write(
+                "departments.update",
+                _target(target, department_id),
+                UNKNOWN_OUTCOME,
+                {"department": None},
+                reconciliation_detail=UNKNOWN_RECONCILIATION,
+            )
         except HealthCloudHTTPError as error:
             refusal = _not_found(error, department_id)
             if refusal is not None:
                 raise refusal from error
+            if is_unknown_write_status(getattr(error, "status_code", None)):
+                unknown_write(
+                    "departments.update",
+                    _target(target, department_id),
+                    UNKNOWN_HTTP_OUTCOME,
+                    {"department": None},
+                    reconciliation_detail=UNKNOWN_RECONCILIATION,
+                )
             raise
     _identity(department, target, department_id)
     return _write_result("departments.update", target, department_id, {"department": department_projection(department)})
@@ -193,11 +234,25 @@ def _lifecycle(dependencies: AmsDependencies, target: TenantTarget, department_i
         try:
             department = getattr(resource, method)(department_id)
         except HealthCloudNetworkError:
-            raise DepartmentWriteRefused("transport", UNKNOWN_OUTCOME) from None
+            unknown_write(
+                f"departments.{method}",
+                _target(target, department_id),
+                UNKNOWN_OUTCOME,
+                {"department": None},
+                reconciliation_detail=UNKNOWN_RECONCILIATION,
+            )
         except HealthCloudHTTPError as error:
             refusal = _not_found(error, department_id)
             if refusal is not None:
                 raise refusal from error
+            if is_unknown_write_status(getattr(error, "status_code", None)):
+                unknown_write(
+                    f"departments.{method}",
+                    _target(target, department_id),
+                    UNKNOWN_HTTP_OUTCOME,
+                    {"department": None},
+                    reconciliation_detail=UNKNOWN_RECONCILIATION,
+                )
             raise
     _identity(department, target, department_id)
     return _write_result(
@@ -225,10 +280,24 @@ def delete_department(dependencies: AmsDependencies, target: TenantTarget, depar
         try:
             resource.delete(department_id)
         except HealthCloudNetworkError:
-            raise DepartmentWriteRefused("transport", UNKNOWN_OUTCOME) from None
+            unknown_write(
+                "departments.delete",
+                _target(target, department_id),
+                UNKNOWN_OUTCOME,
+                {"deleted": None},
+                reconciliation_detail=UNKNOWN_RECONCILIATION,
+            )
         except HealthCloudHTTPError as error:
             refusal = _not_found(error, department_id)
             if refusal is not None:
                 raise refusal from error
+            if is_unknown_write_status(getattr(error, "status_code", None)):
+                unknown_write(
+                    "departments.delete",
+                    _target(target, department_id),
+                    UNKNOWN_HTTP_OUTCOME,
+                    {"deleted": None},
+                    reconciliation_detail=UNKNOWN_RECONCILIATION,
+                )
             raise
     return _write_result("departments.delete", target, department_id, {"deleted": True})

{healthcloud_cli-3.7.0 → healthcloud_cli-3.7.2}/healthcloud_cli/ams/errors.py

@@ -10,7 +10,7 @@ from typing import Any
 import click
 from pydantic import ValidationError
 
-from ..context import CliConfig
+from ..output import output_mode
 from .domain_errors import DomainReadRefused
 from .pretty import error_line, success_text, unknown_details
 from .results import failed
@@ -135,19 +135,6 @@ def emit_compact_json(value: dict, *, err: bool = False) -> None:
     click.echo(json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True), err=err)
 
 
-def _output_mode() -> str:
-    """The root ``--output`` mode for the running command; pretty is the default.
-
-    Raw is refused for AMS before any read runs, but its refusals keep the
-    structured JSON error envelope, so raw renders like json.
-    """
-
-    ctx = click.get_current_context(silent=True)
-    cfg = ctx.find_object(CliConfig) if ctx is not None else None
-    mode = getattr(cfg, "output", None)
-    return "json" if mode in ("json", "raw") else "pretty"
-
-
 def _render_success(envelope: dict, mode: str) -> None:
     if mode != "json":
         click.echo(success_text(envelope))
@@ -190,7 +177,7 @@ def run_domain(operation: str, target: dict, callback: Callable[[], Any], *, rea
     ``verification`` block in the error envelope.
     """
 
-    mode = _output_mode()
+    mode = output_mode()
 
     def _fail(error: BaseException) -> None:
         """Classify ``error``, render the error envelope, and exit bounded."""