[codex] add agent output mode

[techulus-agent]

Summary

Adds agent-oriented CLI output for Techulus Cloud:

• Adds global --agent and --json flags.
• Adds structured command metadata for --help --agent.
• Emits raw JSON data for --agent successes and { ok, data, summary } envelopes for --json successes.
• Emits structured JSON errors in machine-output mode while preserving non-zero exits.
• Keeps auth login and link human-only in machine mode.
• Adds explicit service target support for status and logs via --project, --environment, and --service.

Validation

• cd cli && go test ./...
• Smart review with Claude Code using --model fable verified the prior findings were fixed and reported no blocking issues.

Notes

--agent returns raw JSON on success and { "ok": false, "error": "..." } on failure. logs in machine mode is intentionally one-shot and rejects --follow=true so agents do not hang on streaming output.

[techulus-agent]

Review — agent output mode

Reviewed the full diff against the surrounding code in cli/internal/cli (resolveServiceTarget, runLogs, manifestIdentityQuery, printStatus, the help/flag wiring) and the new tests.

Overall: clean, well-scoped, and well-tested. The machine-output contract (--agent raw data + {ok,data,summary} for --json, structured error envelopes on stdout with preserved non-zero exits via handledError) is implemented consistently, and the one-shot logs guard against --follow=true is a good call. No correctness bugs found. The remaining points are minor.

Minor

1. parseAgentArgs produces a malformed arg name for completion — the one command that actually has a positional arg.
cli/internal/cli/app.go (parseAgentArgs)

completion has Use: "completion [bash|zsh|fish|powershell]". parseAgentArgs trims []<> but not the |, so tc completion --help --agent reports:

"args": [{ "name": "bash|zsh|fish|powershell", "required": false }]

Every other command has no positional args, so this is effectively the only place the new args metadata is exercised — and it emits a name an agent can't use. Consider representing the choices as an enum, or at least not surfacing the pipe-delimited blob as a single arg name.

2. shouldEmitAgentHelp re-derives the machine-mode flags instead of reusing isMachineOutput().
cli/internal/cli/app.go (shouldEmitAgentHelp)

By the time the help func runs, cobra has already populated a.flags.Agent/a.flags.JSON (they're bound via BoolVar), so the root.PersistentFlags().GetBool(...) lookups duplicate a.isMachineOutput(). Collapsing to return a.isMachineOutput() drops the nil-root handling and the two ignored errors. Pure cleanup.

3. --json --help emits raw agentHelpInfo, not the {ok,data} envelope.
cli/internal/cli/app.go (help func in rootCommand)

shouldEmitAgentHelp is true for both --agent and --json, and both paths call writeRaw(agentHelpForCommand(...)). For --json this is the one output that isn't wrapped in the documented ok/data envelope. The documented path is --help --agent, so this is defensible — flagging only so it's a conscious decision rather than an accident.

Nothing here is blocking.

[techulus-agent]

Follow-up review — fixes verified (commit dacd1fd4)

Re-reviewed against the earlier notes. All three points are resolved cleanly, each with test coverage:

1. completion arg metadata ✅
Use is now <bash|zsh|fish|powershell> (correctly reported as required: true), and the new parseAgentArgChoices/agentChoiceArgName split the pipe list into a proper choices array with arg name shell:

"args": [{ "name": "shell", "required": true, "choices": ["bash", "zsh", "fish", "powershell"] }]

Covered by TestAgentCompletionHelpOutputsChoiceArg.

2. shouldEmitAgentHelp redundancy ✅
Helper removed; the help func now branches on a.flags.Agent / a.flags.JSON directly. Equivalent behavior since cobra populates those bound flags before the help func runs.

3. --json --help envelope ✅
--json help now routes through writeData(agentHelpForCommand(cmd), "Help"), so it emits the documented {ok, data, summary: "Help"} envelope instead of raw metadata. Covered by TestJSONHelpOutputsEnvelope.

No regressions introduced by the fix commit. The agentChoiceArgName completion → shell mapping is a mild special-case, but it's a reasonable metadata nicety with a generic value fallback — no concern.

LGTM. 🚀