Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/cloud/common.go`:
- Around line 109-119: The current listWithPagination routes to pagFn when
offset > 0 even if limit == 0, which can cause pagFn to be called with limit==0;
update listWithPagination (the function and its use of regularFn/pagFn and the
limit/offset parameters) to avoid invoking pagFn with a zero limit — either
require both limit > 0 && offset > 0 to choose the paginated path, or when
offset > 0 and limit == 0 set a sensible defaultLimit (e.g., 100) before calling
pagFn; ensure the chosen approach is applied where listWithPagination calls
pagFn so pagFn never receives limit == 0 unexpectedly.
- Around line 41-44: The current apiURL selection uses a magic string and
fragile equality check; change the logic in the apiURL assignment to follow
precedence CLI flag → config file → hardcoded default by: introduce a named
constant (e.g. DEFAULT_API_URL) instead of the literal "http://localhost:8080",
then set apiURL to o.APIURL if o.APIURL != "", else to cfg.APIURL if cfg.APIURL
!= "", else to DEFAULT_API_URL; update references around the apiURL variable and
remove the equality check against the magic string in cmd/cloud/common.go.
- Around line 76-97: printOutput currently only reads opts.Output (defaulting to
"table") and never respects the persisted cfg.Output, so saved preferences are
ignored; update command initialization to load the config and set opts.Output =
cfg.Output when the user did not pass an explicit --output flag (e.g., in a
PersistentPreRun hook or before command execution in main.go), ensuring the CLI
flag (opts.Output) remains authoritative if provided but otherwise falls back to
cfg.Output; reference the printOutput function, the opts.Output field, and the
cfg.Output config field when implementing this synchronization.

In `@cmd/cloud/config.go`:
- Around line 12-18: The cliConfig struct's JSON tags should include omitempty
for optional fields to avoid serializing zero values; update the struct
declaration for cliConfig so the tags for APIKey, APIURL, Output, Tenant, and
Debug each include `omitempty` (e.g., `json:"api_key,omitempty"`) so empty
strings and false are omitted during JSON marshaling.
- Around line 96-98: When handling the "output" key in the config set flow (see
the switch that assigns cfg.Output in cmd/cloud/config.go), validate that the
incoming value is one of the allowed values "table", "json", or "yaml" before
assigning and persisting it; if the value is invalid, return an error (or
surface a clear message) and do not set cfg.Output. Update the code path that
currently does cfg.Output = value to perform this whitelist check and reject
invalid values so subsequent commands won't be confused by an unsupported output
setting.
- Line 20: Replace the package-level configFile global with a helper function
configFilePath() that calls os.UserHomeDir() at runtime and constructs
filepath.Join(home, ".cloud", "config.json"), returning (string, error); remove
the var configFile declaration; then update loadConfigFile(), loadFullConfig(),
and saveConfigFile() to call configFilePath(), handle any error returned
(propagate or return it), and use the returned path instead of the former global
variable.

In `@cmd/cloud/instance.go`:
- Around line 52-58: The JSON output currently switches between printing a flat
array (printJSON(instances)) and a paginated envelope (printJSON(meta)) based on
whether meta is non-nil; change the behavior to produce a stable top-level shape
when the user explicitly requests pagination: if opts.JSON and the limit flag
was provided (e.g., check opts.Limit or a boolean like opts.LimitSet), always
print the meta envelope (printJSON(meta)) so callers get {"items":[...],
"totalCount":..., "hasMore":...}; apply the same fix in instance_type.go (lines
with printJSON(meta)/printJSON(instances)) and storage.go (the analogous block)
to ensure consistency across commands, and make sure meta is populated with
items when wrapping so downstream JSON consumers can rely on one schema.

In `@cmd/cloud/main.go`:
- Around line 86-87: List commands currently check opts.JSON directly while the
flag stores into opts.Output, so passing --output json/yaml is ignored; fix by
normalizing and using the central printer: in the root command PersistentPreRun
set opts.JSON = (opts.Output == "json") and (optionally) create a boolean or
enum for yaml handling so downstream checks work, then update each list command
(instance list, storage list, instance-type list, container list, function list,
ssh-key list) to stop rendering tables directly and instead call printOutput()
(or otherwise dispatch via printOutput()) so opts.Output values
("json","yaml","table") are honored consistently.

In `@cmd/cloud/rbac_cli_test.go`:
- Around line 53-67: The test wraps captureStdout and createRoleCmd.Run in an
IIFE with a recover that masks panics (the anonymous deferred recover block
around captureStdout), which hides the root cause; remove that recover wrapper
and instead fix the underlying panic either by ensuring test setup is complete
before invoking createRoleCmd.Run (initialize any required state/flags/args used
by createRoleCmd.Run and captureStdout) or by hardening createRoleCmd.Run and/or
captureStdout to guard against nil/uninitialized values (add proper nil checks
and safe error returns in createRoleCmd.Run and captureStdout rather than
allowing a panic).

In `@docs/cli-reference.md`:
- Around line 207-212: Add a blank line immediately before each markdown table
header row "`| Flag | Default | Description |`" in docs/cli-reference.md where
tables start (the occurrences near the sections referenced in the comment), so
the table is preceded by an empty line to satisfy markdownlint MD058; locate
each table header instance (e.g., the exact string `| Flag | Default |
Description |`) and insert one blank line above it at those spots.
- Around line 82-84: The fenced code block containing the example line "Showing
10 of 50 total (more available)" is missing a language tag and triggers
markdownlint MD040; update that fenced block in docs/cli-reference.md by adding
a language specifier (e.g., "text") immediately after the opening triple
backticks so it becomes ```text ... ``` to satisfy the lint rule.

In `@internal/core/services/cached_identity_unit_test.go`:
- Line 20: Remove the unconditional t.Skip in TestCachedIdentityService_Unit and
make the test deterministic by isolating setup/teardown per subtest: for each
subtest create a fresh miniredis instance and corresponding redis client, wait
for the server to be ready before creating the client, avoid shared global
state, and defer the server and client cleanup; ensure the test uses t.Run
subtests (optionally with t.Parallel where safe) so cache-hit/miss behavior is
validated independently and the nil redis client race is eliminated.

In `@pkg/sdk/client.go`:
- Around line 25-29: The JSON tag on ListResponse[T].TotalCount uses
`omitempty`, which causes zero to be omitted; remove `omitempty` from the
`TotalCount` tag so a zero total_count is serialized as 0 (leave `HasMore`'s
`omitempty` unchanged). Update the struct definition for ListResponse to use
`json:"total_count"` for TotalCount and keep `json:"has_more,omitempty"` for
HasMore so pagination consumers receive an explicit 0 when there are no items.
- Around line 36-42: The custom retry predicate passed to
client.AddRetryCondition currently returns false whenever err != nil, which
prevents Resty from retrying network/transport errors; update the predicate used
in the AddRetryCondition call (the anonymous func(r *resty.Response, err error)
bool) so it returns true when err != nil (or when the error is a transient
network error) and also returns true for status codes >= 500 or 429; in short,
change the logic in the AddRetryCondition closure to include "if err != nil {
return true }" before inspecting r.StatusCode() so SetRetryCount(3) will apply
to network failures as well.

---

Outside diff comments:
In `@cmd/cloud/container.go`:
- Around line 38-78: The listDeploymentsCmd currently always renders a table and
ignores opts.JSON/opts.Output; update listDeploymentsCmd (and mirror the same
fix in listFnCmd and newSSHKeyListCmd) to check opts.JSON or opts.Output and
branch to emit JSON or YAML when requested (e.g., serialize the deps slice using
encoding/json or yaml), or call the shared printOutput() helper if it supports
slices; keep the existing table rendering as the default, and ensure error
handling and meta output (meta.TotalCount/HasMore) are preserved or included in
the structured output as appropriate.

In `@cmd/cloud/rbac_cli_test.go`:
- Around line 23-68: Remove the temporary debug prints added to the
TestCreateRoleCmd test: delete all fmt.Fprintf(os.Stderr, "DEBUG: ...") calls
around the httptest server setup and the captureStdout/panic-recovery block
(they surround createRoleCmd.Run and captureStdout); after removing those debug
statements, also remove the now-unused fmt and os imports from the top of
cmd/cloud/rbac_cli_test.go so there are no leftover compile warnings or CI
noise.

In `@docs/cli-reference.md`:
- Around line 1165-1169: The "JSON Output" section references the deprecated
flags `--json` and `-j`; update the explanatory text and examples to recommend
the supported form `--output json` instead. Change the sentence "Use `--json`
(or `-j`) with any list/get command…" to mention `--output json` (and optionally
`-o json` if applicable), and replace the example `cloud instance list --json |
jq '.[].id'` with one using `cloud instance list --output json | jq '.[].id'` so
the doc is consistent with the deprecation notice.

---

Duplicate comments:
In `@cmd/cloud/config.go`:
- Around line 76-79: The config show command currently prints the full cliConfig
including the APIKey; before calling printOutput(cfg) in the Run handler, redact
cfg.APIKey by replacing non-empty values with a masked value (use maskSecret to
return "***" for non-empty and "" otherwise) so that loadFullConfig(), the
cliConfig struct's APIKey field, and the printOutput(cfg) call never output the
raw key; ensure the mask is applied on cfg.APIKey (and any other sensitive
fields on cliConfig if present) prior to serialization/rendering.

---

Nitpick comments:
In `@cmd/cloud/config.go`:
- Around line 68-151: The package-level cobra.Command vars (configCmd,
configShowCmd, configSetCmd, configUnsetCmd) should be replaced with constructor
functions (e.g., newConfigCmd(), newConfigShowCmd(), newConfigSetCmd(),
newConfigUnsetCmd()) that return *cobra.Command; move each Run closure and Args
logic into those constructors, keep calls to loadFullConfig and saveConfigFile
as-is, and remove the init() wiring—instead have the root command constructor
call newConfigCmd() and add its subcommands there to avoid global mutable state
and improve testability.

In `@cmd/cloud/container.go`:
- Around line 44-45: The code silently discards errors from cmd.Flags().GetInt
when reading the "limit" and "offset" flags; change the two calls to capture and
check the returned errors (e.g., limit, err := cmd.Flags().GetInt("limit") and
offset, err := cmd.Flags().GetInt("offset")), handle them by returning the error
from the command (or logging and exiting consistently with surrounding code) so
failures are not ignored, and update any surrounding control flow (e.g., the
command's Run or RunE) to propagate the error instead of using blank identifier
`_`.

In `@cmd/cloud/function.go`:
- Around line 57-69: This inline pagination block duplicates shared logic —
replace it by calling the common helper listWithPagination instead of
reimplementing the conditional; ensure you pass client.ListFunctions and
client.ListFunctionsWithPagination (or adapt them to the function signatures
expected by listWithPagination), capture its returned functions and meta values
into the existing variables (functions, meta) and propagate errors as before,
removing the duplicated if/else and keeping behavior identical to other files
that use listWithPagination.
- Around line 51-52: The current reads of command flags silently discard errors
(limit, _ := cmd.Flags().GetInt("limit"); offset, _ :=
cmd.Flags().GetInt("offset")), so change these to capture and handle the errors
from cmd.Flags().GetInt for both "limit" and "offset" (e.g., limit, err :=
cmd.Flags().GetInt("limit"); if err != nil { return fmt.Errorf("reading limit
flag: %w", err) } and similarly for offset) — ensure you import/use fmt or the
existing logger and return or exit with a clear error instead of ignoring the
err to avoid silent failures.

In `@cmd/cloud/instance_type.go`:
- Around line 22-23: The code calls cmd.Flags().GetInt for "limit" and "offset"
and ignores the returned errors (variables limit, offset), so update those calls
to capture the errors and handle them instead of discarding: replace limit, _ :=
cmd.Flags().GetInt("limit") and offset, _ := cmd.Flags().GetInt("offset") with
limit, err := cmd.Flags().GetInt("limit") / offset, err :=
cmd.Flags().GetInt("offset") (use distinct err vars or check sequentially),
check each err and either return a wrapped error from the command's Run/Execute
function or log and exit appropriately so invalid flag parsing is surfaced
(reference symbols: cmd.Flags().GetInt, limit, offset).

In `@cmd/cloud/instance.go`:
- Around line 39-40: The flag reads for limit and offset call cmd.Flags().GetInt
but ignore returned errors; update the code around the GetInt calls (the uses
that assign to limit and offset) to check and handle the error values instead of
discarding them — e.g., capture both return values, validate err != nil, and
propagate or report the error (return it from the enclosing command handler or
log via the command's error handling) so invalid or missing flag values are not
silently ignored; apply the same pattern to any other cmd.Flags().Get* usages in
the same function.

In `@cmd/cloud/main.go`:
- Line 87: The flag --json (registered via rootCmd.PersistentFlags().BoolVarP
and bound to opts.JSON) is only marked deprecated in help text but not to Cobra;
call rootCmd.PersistentFlags().MarkDeprecated("json", "use --output=json")
immediately after the BoolVarP registration (handle or ignore the returned
error) so Cobra emits the deprecation warning at runtime.

In `@cmd/cloud/ssh_key.go`:
- Around line 58-59: The flag reads for limit and offset currently ignore errors
(limit, _ := cmd.Flags().GetInt("limit") and offset, _ :=
cmd.Flags().GetInt("offset")); update the code to check the returned error from
cmd.Flags().GetInt for both "limit" and "offset" and handle it (e.g., return the
error from the enclosing command handler or log and exit) instead of discarding
it. Locate the flag reads in cmd/cloud/ssh_key.go and adjust the surrounding
function (the command handler) to propagate or handle the errors so invalid flag
state doesn't go unnoticed.

In `@cmd/cloud/storage.go`:
- Around line 59-64: The code currently discards errors from json.MarshalIndent
when printing meta and buckets (data, _ := json.MarshalIndent(...)); update
these locations to either call the existing shared printJSON(...) helper (used
in instance.go) passing meta and buckets, or capture the error (data, err :=
json.MarshalIndent(...)) and handle it (log or return the error) before printing
to avoid silent failures; ensure you reference the json.MarshalIndent calls and
replace them with printJSON(meta)/printJSON(buckets) or an explicit err check
and proper error handling.
- Around line 35-36: The flag reads for limit and offset call cmd.Flags().GetInt
and ignore the returned errors; update the code around the GetInt calls (the
lines assigning to limit and offset) to check each error result and handle it
(e.g., return the error from the surrounding function, call
cmd.PrintErrln()/log/processLogger with a clear message, or fall back to a safe
default), so you don't silently discard errors from cmd.Flags().GetInt for the
limit and offset flags.

In `@pkg/sdk/compute.go`:
- Around line 201-239: Add context-aware counterparts for the two paginated list
methods: implement ListInstanceTypesWithContextAndPagination(ctx
context.Context, limit, offset int) and ListSSHKeysWithContextAndPagination(ctx
context.Context, limit, offset int) following the same pattern as the existing
ListInstancesWithContextAndPagination/ListBucketsWithContextAndPagination
methods; each should accept a context.Context, call the SDK's context-aware
pagination helper (the same helper used by other *WithContextAndPagination
methods) to populate a Response[ListResponse[...]] and return the inner Data
slice, the ListResponse pointer, and error, mirroring the logic in
ListInstanceTypesWithPagination and ListSSHKeysWithPagination but with context
propagation.

In `@pkg/sdk/function.go`:
- Around line 88-98: Add a descriptive doc comment for the exported
ListFunctionsWithPagination function (same style as
ListFunctionsWithContextAndPagination) explaining its purpose, parameters
(limit, offset), return values, and that it paginates functions; place the
comment immediately above the func declaration for ListFunctionsWithPagination
so the public API docs are consistent with
ListFunctionsWithContextAndPagination.