fix: CLI gotcha audit + consolidate duplicated access/TTL logic

[rsdouglas]

Summary

• Fix 12+ CLI UX gotchas where commands silently succeed with conflicting options, report incorrect access, or create broken configurations
• Consolidate duplicated access evaluation logic (5 implementations → 1 shared canAccessCapability/resolveAccess in agent-scope.ts) and TTL logic (2 → 1 shared validateTTL/parseTTL in types.ts)
• Add color distinction in janee overview (cyan = agent-specific, green = globally open)

Gotcha fixes

Fix	Severity
whoami and doctor-bundle now respect per-capability access field	Critical
Error on contradictory flags (--allowed-agents + --clear-agents, --access + --clear-access, --clear-rules + --allow/--deny)	High
cap add --mode exec without --allow-commands now errors	High
janee add --timeout abc validates NaN/negative values	High
--access help text fixed (removed nonexistent "inherit" option)	Medium
cap edit with no options now errors instead of silent success	Medium
TTL format validated at save time	Medium
Warn when exec-mode options used on proxy caps (and vice versa)	Medium
--access warning only fires for pre-existing allowedAgents	Medium
revoke prefix match errors on ambiguous matches	Low
logs JSON error format normalized to { ok: false, error }	Low

Consolidation

• canAccessCapability() + resolveAccess() → src/core/agent-scope.ts (single source of truth, removed from mcp-server.ts, whoami.ts, doctor-bundle.ts, overview.ts, tool-handlers.ts, authority.ts)
• validateTTL() + parseTTL() → src/core/types.ts (removed from capability.ts, tool-handlers.ts)

Test plan

• All 541 existing tests pass
• janee overview renders correctly with color distinction
• Build clean (no TS errors)
• Verify conflicting option combos produce clear error messages
• Verify cap add --mode exec without --allow-commands errors
• Verify cap edit with no flags errors

Made with Cursor