Scope, SSHOnly, read-only and pending refusals (internal/control/control.go:86-98) run before --json is stripped (:99-107), so a scripted caller gets plain text on stderr instead of an envelope exactly when it needs to parse the error.
Remedy: strip --json first.
closed by commit ffcb3af61a by cmc: control: strip --json before the dispatcher's refusals
2026-09-04 00:10 UTC