CLI commands for inspecting the configuration surface.
Bare config resolves each option against the app credential store (for
credentials), the live environment, and config.toml, reporting the effective
value and which source provided it. config get <key> reports the same for a
single option, and config get <section> — a dotted key prefix such as
credentials, matched case-insensitively — renders every option under that
prefix using the same grouped view as bare
config. Adding --verbose/--all to any of the three folds in each option's
description and where it can be set (the static catalog). config path prints
the on-disk config locations.
Secret-flagged options (API keys and other credentials) are never printed by
value — config/config get report only whether they are set and from which
source, so the output is safe to paste into a bug report.
Help rendering for config -h is served by ui.show_config_help. The heavy
manifest/runtime imports here are function-local, so help never pulls them onto
the startup path (parse_args imports this module to register the parsers, but
only its light top-level imports run then).
Write a JSON envelope to stdout and flush.
The envelope is a single-line JSON object with a stable schema:
{"schema_version": 1, "command": "...", "data": ...}