docs(cli): the README states the global flags and the os plugin group that the built os registers (#21354)

Fixes #21310

Clause-②: no

## What changes

`packages/cli/README.md` now says what the built `os` does. Every claim
below was read off the built entry (`packages/cli/bin/run.js`,
`@oclif/core` 5.1.2), run from an empty cwd: `os --help`, `os plugin
--help`, every topic's `--help` and each documented command's `--help`.
The credential sources were also measured against a local echo server.

- **`### Global`** lists `--version` and `--help` only. It says there is
no short form: `os -h` and `os -v` exit 2. It also names the commands
where `-v` is the command's own flag.
- **`### Plugin Management`** drops "There is no `os plugin` command
group in v1". It lists the registered group instead: `os plugin build`,
`os plugin sign` and `os plugin publish`. It notes that the group has no
`install` (per ADR-0025's status line), and that `os plugin` is
unrelated to `os plugins`.
- **Two command-table rows were wrong:** `os init [name]` and `os dev
[package]`. Both are rewritten.
- **Cloud credentials and flags (patch round 1).** The Cloud section
said every cloud command reads `os cloud login`'s session, or `--token`
/ `OS_CLOUD_API_KEY` and `--server` / `OS_CLOUD_URL`. A new `####
Credentials and server URL` table states, per command, the server-URL
flag, the token flag and the stored session it uses. The typical publish
flow now says that its `os environments create` step does not read the
`os cloud login` session.
- **`os serve --ui` (patch round 1)** now uses the `--help` wording:
"Enable the bundled Console portal", in place of "Enable Studio UI".
- **`.changeset/21310-cli-readme-flags.md`** is a `patch` for
`@objectstack/cli`, because `README.md` is in the package's `files`. It
now counts five false claims.

No code, flag, environment variable, exit code or help page changes.
`packages/cli/package.json` is untouched.

## Short flags: the README route (docs follow the implementation)

Readings on the built entry from an empty cwd. "Before" is at
`1caa60373`, the branch point after #21167 landed. "After" is at
`9bdb092ca`, this head.

| argv | before | after |
|---|---|---|
| `os -h` | exit 2, `command -h not found` | exit 2, `command -h not
found` (unchanged by design) |
| `os -v` | exit 2, `command -v not found` | exit 2, `command -v not
found` (unchanged by design) |
| `os --help` | exit 0, 3712 bytes, md5
`1855676fe5a2bb87aa5871fc1bed196f` | byte-identical, same md5 |
| `os --version` | exit 0, `@objectstack/cli/17.6.0 linux-x64
node-v22.22.0` | same |

**The ruling's check.** The ruling: "show that no command already uses
`-h` / `-v` as its own flag. If one does, choose the README route and
say why."

Six commands already own `-v`. Found by `git grep` for `char: 'v'` in
`packages/cli/src`, then read back in each command's `--help`:

- `-v` is `--verbose` on `os dev` (`dev.ts:212`), `os serve`
(`serve.ts:1209`), `os start` (`start.ts:93`) and `os doctor`
(`doctor.ts:1905`).
- `-v` is `--version VALUE` on `os package publish`
(`package/publish.ts:315`) and `os package install`
(`package/install.ts:57`).

No command owns `-h`. So the ruling sends `-v` down the README route.
`-h` was eligible on its own, and it is dropped too, for the reasons in
the four axes below.

**What the alternative would have done.** These rows come from oclif's
own predicates, `versionAddition` and `helpAddition` in `@oclif/core`
5.1.2 `lib/main.js`. They were evaluated in memory on this package's
loaded `Config`, with `additionalVersionFlags: ["-v"]` and
`additionalHelpFlags: ["-h"]` set on it. No file was written.

| argv | today | with the two keys |
|---|---|---|
| `-v serve` | exit 2, `command -v not found` | version check true:
prints the version, exits 0, **and serve never runs** |
| `serve -v` | `--verbose` | `--verbose` (oclif checks only argv[0] for
a version flag) |
| `serve -h` | exit 2, `Nonexistent flag: -h` | help check true: prints
help |

**The four axes.**

- **实际业务需求.** There is no measured pull. `git grep` for `os -h`, `os -v`
and `objectstack -h|-v` over the whole tree (content/docs, skills,
examples, packages, scripts) finds no occurrence. This README's `###
Global` was the only text that named the short forms.
- **项目长远合理性.** `-v` already has two meanings inside this CLI: verbose on
four commands and a package version on two. Adding a third that applies
only at argv[0] (print the CLI version) makes the flag's meaning depend
on where it appears. Making the docs follow the implementation removes
the false claim with no runtime change.
- **防 AI 写代码犯错.** Today a mistaken `os -v serve` fails loudly with exit
2. With the key set, it would print a version line, exit 0 and start
nothing, so a loud failure would become a silent one. The README now
says the short forms do not exist, so an agent reading it uses `--help`
and `--version`, which work in every position.
- **创业阶段不扩散需求.** New flags would be a new capability with no measured
pull, and the default is to keep scope tight. Making only `-h` work
would also leave `### Global` asymmetric, with no measured user who
needs it.

## `os plugin` — the commands, verbatim

`os plugin --help` at `9bdb092ca`, exit 0. The output is byte-identical
at `1caa60373`.

```text
Compile a plugin into a signed-ready `.osplugin` artifact (ADR-0025 §3.4)

USAGE
  $ os plugin COMMAND

COMMANDS
  plugin build    Compile a plugin into a signed-ready `.osplugin` artifact
                  (ADR-0025 §3.4)
  plugin publish  Publish a signed .osplugin to ObjectStack Cloud (ADR-0025
                  §3.4)
  plugin sign     Sign a built .osplugin with a publisher Ed25519 key (ADR-0025
                  §3.4)
```

Usage lines: `os plugin build [DIR] [-e VALUE] [-o VALUE] [--minify]`,
`os plugin sign ARTIFACT -k VALUE [--key-id VALUE] [-o VALUE]` and `os
plugin publish [ARTIFACT] …`. There is no `install`, and that matches
ADR-0025's status line, which says the code-plugin install half is
unimplemented.


## Every README command-table row against `--help`

Placeholders are spelled in capitals here (TYPE, NAME, ID).

| Section | Row | Conclusion |
|---|---|---|
| Development | `os init [name]` | **Changed.** It said "in the current
directory". `os init --help` says: "When provided, a new directory with
this name is created; otherwise the current directory is used." The
Quick Start's own `os init my-app` was a counterexample. |
| Development | `os dev [package]` | **Changed.** It said "with hot
reload". `os dev --help` says: "watch sources, rebuild the artifact, and
restart the server on change". `dev.ts` records that the old "server
will auto-reload" line "advertised a hot reload the runtime only
partially performs". |
| Development | `os serve [config]` | **Already true.** For "plugin
auto-detection": `serve.ts:11` imports `isHostConfig` /
`shouldBootWithLibrary` from `utils/plugin-detection.ts`, which detect a
host config that carries instantiated plugins. The row leaves out the
artifact fallback that `--help` leads with, but that is an omission, not
a false claim. |
| Build & Validate | `os compile [config]` | **Already true.** `-o`
defaults to `dist/objectstack.json`. |
| Build & Validate | `os validate [config]` | **Already true.** `--help`
also mentions CEL expressions and widget bindings, which the row leaves
out. |
| Build & Validate | `os info [config]` | **Already true.**
`info.ts:117` prints agents. |
| Scaffolding | `os generate TYPE NAME` | **Left alone, per the ruling**
(these rows are #21167's, which landed as `bcd68a29f` before this
branch's base). It is also already true: `--help` marks NAME optional,
but `generate.ts` refuses a metadata type without a name ("Missing
required argument"). NAME is optional only for the `types`, `client` and
`migration` routes. |
| Scaffolding | `os create TYPE [name]` | **Already true.** `--help`
says "Create a new standalone kernel code plugin from a built-in
template", with TYPE = plugin. |
| Cloud | `os cloud login` | **Already true.** `-e/--email` and
`-p/--password` skip the browser flow, and credentials go to
`~/.objectstack/cloud.json`. |
| Cloud | `os cloud whoami` / `os cloud logout` | **Already true.** Both
are listed in `os cloud --help`. |
| Cloud | `os environments create --org ID --name N` | **Already true.**
Both flags are required in the usage line. There is no `projects` topic
in `os --help`. |
| Cloud | `os environments list` / `show ID` | **Already true.** |
| Cloud | `os package publish [artifact]` | **Already true.** ARTIFACT
defaults to `dist/objectstack.json`. |
| Plugin Management | (prose) | **Changed** (see above). |
| Quality | `os test [files]`, `os doctor`, `os lint [config]`, `os diff
[before] [after]` | **Already true.** The usage lines match. |
| Reference | `os explain [schema]` | **Already true.** |
| CLI Options | `### Global` | **Changed** (see above). |
| CLI Options | `os plugins` and `os help` (not commands) | **Already
true since #21306; not re-edited.** `os plugins` exits 2 with `command
plugins not found`, and `os help` exits 2 with `command help not found`.
`package.json` has no `oclif.plugins` and no `@oclif/plugin-*`
dependency. |
| Cloud | lead sentence: credentials from `os cloud login`, or `--token`
/ `OS_CLOUD_API_KEY` and `--server` / `OS_CLOUD_URL` | **Changed (patch
round 1).** This holds only for `os package publish` and `os plugin
publish`. The new per-command table is below. |
| Cloud | typical flow: `os cloud login`, then `os environments create`
| **Changed (patch round 1).** With only the `os cloud login` session
present, `os environments create` exits 1 with `Authentication required.
Please run os login or set OS_TOKEN environment variable.` The flow now
says so at that step and names what the step reads instead. |
| Cloud | "Set `OS_CLOUD_URL` (or `--server`)" | **Changed (patch round
1).** `os cloud login`, `os package publish` and `os environments` read
`OS_CLOUD_URL`. The flag is `--server` on `os package publish` and
`--url` on the other two. `os cloud whoami` / `logout` read neither. |
| CLI Options | `### os serve` `--ui` | **Changed (patch round 1).** It
said "Enable Studio UI". It now uses the `--help` wording: "Enable the
bundled Console portal at /_console/ when @object-ui/console is
installed (default: true)". |

## Cloud commands: flags, env vars and stored session, per command

Read off each command's `--help` at `9bdb092ca`. The "stored session"
column was measured, not taken from the help: `HOME` pointed at a temp
dir holding only a `cloud.json`, or only a `credentials.json`, whose URL
was a local echo server that logged each request's path and bearer.

| Command | Server URL flag (env) | Token flag (env) | Stored session it
authenticates with |
|---|---|---|---|
| `os cloud login` | `-u, --url` (`OS_CLOUD_URL`, default
`https://cloud.objectos.ai`) | none: `-e, --email` / `-p, --password`,
or the browser device flow | writes `~/.objectstack/cloud.json` |
| `os cloud whoami`, `os cloud logout` | none (`--json` only) | none |
read / delete `cloud.json` (`cloud/whoami.ts:26`,
`cloud/logout.ts:29,39`) |
| `os package publish` | `-s, --server` (`OS_CLOUD_URL`, default
`https://cloud.objectos.ai`; with neither set, the URL in `cloud.json`)
| `-t, --token` (`OS_CLOUD_API_KEY`, then `OS_TOKEN`) | `cloud.json`.
With only `credentials.json`: exit 1, "Not logged in to ObjectStack
Cloud. Run os cloud login first", and 0 requests. With only
`cloud.json`: the request goes to its URL with its bearer. With
`OS_CLOUD_API_KEY` or `OS_TOKEN`: the request carries that bearer. |
| `os plugin publish` | `-s, --server` (`OS_CLOUD_URL`) | `-t, --token`
(`OS_CLOUD_API_KEY`) | `cloud.json`, by the same precedence code as
package publish (`plugin/publish.ts:170-178`). Code-read only; not run,
because it needs a built `.osplugin`. |
| `os environments list` / `show` / `create` / `bind` / `switch` | `-u,
--url` (`OS_CLOUD_URL`); else the URL in `credentials.json`; else
`http://localhost:3000` | `-t, --token` (`OS_TOKEN`) |
`credentials.json`, the `os login` session. With only `cloud.json`, all
five exit 1 with `Authentication required`, before any request. With
only `credentials.json`, `list` sends `GET /api/v1/cloud/environments`
with its bearer. `OS_TOKEN` works, and `OS_CLOUD_API_KEY` alone does
not. |
| `os package install` (a runtime command, not a cloud one) | `-r,
--runtime` (`OS_RUNTIME_URL`, default `http://localhost:3000`) | none:
`--email` / `--password` (`OS_RUNTIME_EMAIL` / `OS_RUNTIME_PASSWORD`) |
none |
| Also read, not in the README's Cloud section: `os whoami`, `os data
*`, `os meta list/get/register/delete` | `-u, --url` (`OS_CLOUD_URL`) |
`-t, --token` (`OS_TOKEN`) | `credentials.json`, through the same
`createApiClient` (code-read) |
| Also read: `os datasource introspect/list-tables/validate` | `-u,
--url` (`OS_CLOUD_URL`, else `http://localhost:3000`) | `-t, --token`
(`OS_TOKEN`) | none. These use flags and env only
(`datasource/introspect.ts:10-13`, code-read). |
| Also measured: `os login` / `os register` | `-u, --url`
(`OS_RUNTIME_URL` for login, `OS_CLOUD_URL` for register; default
`http://localhost:3000`) | none (email/password, or the device flow for
login) | writes `credentials.json` |

## Acceptance notes

These are out of scope. The last one is filed as #21360; the others are
not filed.

- **Registered commands with no README row.** `build`, `start`,
`verify`, `login`, `logout`, `register`, `whoami`, `migrate`, `data`,
`datasource`, `db`, `i18n`, `meta`, `secret`, `storage`, `package
install` and `environments bind/switch` have no row. These are
omissions, not mismatches: the README does not claim to be complete, and
`content/docs/deployment/cli.mdx` is the full reference.
- **"Runtime plugins are bundled into the build artifact" is kept as
written.** I did not re-measure it. Only the false clause in front of it
was removed.
- **For the seat — the README is now true, but the flow it documents has
a gap.** After only `os cloud login`, `os environments create` refuses
and says to run `os login`. `os login --help` says "For the hosted
package registry, use `os cloud login` instead." This round changes no
code, so the README states the gap rather than closing it. The seat
filed it as #21360.

## Verification

- **Build.** `pnpm turbo run build --filter=!@objectstack/docs
--concurrency=2` at `9bdb092ca`: 72/72 tasks, verify-lock `VERDICT
command-exit 0`.
- **Derived gates.** `node scripts/pm/dispatch-gates.mjs --repo
objectstack-ai/objectstack --commands` at `9bdb092ca` gives 52 commands;
the merged `main` added `check-dts-emitted.mjs --self-test`. All 52
exited 0 at `9bdb092ca`, each exit code captured before any pipe. The
`--ran` reconciliation reads "52 derived, 52 run, 0 NOT-MEASURED, 0
UNRUN", and that zero is derived from recorded exit codes.
- **`main` moved again after the last merge.** That happened while the
gates ran: `96b12b589` (a pm-roster step in `lint.yml`) and `23365eaed`
(spec). Neither touches `packages/cli` or this changeset. The merge
queue rebuilds the PR on current `main`.
- **Runtime unchanged.** `os --help` is byte-identical at `9bdb092ca`
and at `1caa60373`: exit 0, 3712 bytes, md5
`1855676fe5a2bb87aa5871fc1bed196f`. `os -h` and `os -v` still exit 2.
- **CLI unit tier.** `pnpm --filter @objectstack/cli exec vitest run
--project unit --maxWorkers=2`: 244 files and 3461 tests passed,
`VERDICT command-exit 0`, at `4e7e91fd2`. Since then, `git diff
4e7e91f 9bdb092 -- packages/cli` touches only
`packages/cli/README.md`, and no CLI test reads that file. The tests
that mention a README read the README that `os create` emits. The
integration tier is left to CI.
- **CLI typecheck.** `pnpm --filter @objectstack/cli typecheck`: exit 0
at `4e7e91fd2`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_018gA1pE6eJtwHhqx72G8U9X)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/21310-cli-readme-flags.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/cli': patch
+---
+
+The published README now describes the `os` that ships. Five things it said were false.
+
+Clause-②: no
+
+- **Short flags.** The README listed `-v, --version` and `-h, --help` as global options. `os -v` and `os -h` exit 2 with `command -v not found` / `command -h not found`, because only `--version` and `--help` are registered. It now lists `--version` and `--help` alone and says there is no short form. `-v` already belongs to commands of their own: it is `--verbose` on `os dev`, `os serve`, `os start` and `os doctor`, and `--version` on `os package publish` and `os package install`.
+- **The `os plugin` group.** The README said there is no `os plugin` command group. `os plugin build`, `os plugin sign` and `os plugin publish` are registered, and the README now lists them. It also says the group has no `install`, and that `os plugin` is a different thing from `os plugins`, which is not a command.
+- **Two command rows.** `os init [name]` creates a new directory of that name when a name is given, so it no longer says "in the current directory" for every case. `os dev` restarts the server after each rebuild, so it no longer says "with hot reload".
+- **Cloud credentials and flags.** The README said every cloud command takes its credentials from `os cloud login` or from `--token` / `OS_CLOUD_API_KEY` and `--server` / `OS_CLOUD_URL`. That holds only for `os package publish` and `os plugin publish`. `os environments list`, `show`, `create`, `bind` and `switch` take `-u, --url` (env `OS_CLOUD_URL`) and `-t, --token` (env `OS_TOKEN`), and otherwise use the `os login` session in `~/.objectstack/credentials.json` — never the `os cloud login` session. With only `os cloud login` done they exit 1 with `Authentication required`. The README now has a per-command table, and its typical publish flow says so at the `os environments create` step.
+- **`os serve --ui`.** The README said it enables "Studio UI". It enables the bundled Console portal at `/_console/` when `@object-ui/console` is installed, which is what `os serve --help` says.
+
+**What changes for an operator.** Nothing at runtime. No command, flag, environment variable, exit code or help page changes.

packages/cli/README.md

@@ -39,8 +39,8 @@ os compile
 
 | Command | Description |
 |---------|-------------|
-| `os init [name]` | Initialize a new ObjectStack project in the current directory |
-| `os dev [package]` | Start development mode with hot reload |
+| `os init [name]` | Initialize a new ObjectStack project — in a new directory of that name when `name` is given, otherwise in the current directory |
+| `os dev [package]` | Start development mode — watch sources, rebuild the artifact, and restart the server on change |
 | `os serve [config]` | Start the ObjectStack server with plugin auto-detection |
 
 ### Build & Validate
@@ -81,9 +81,8 @@ and keep loading through their barrel `index.ts`.
 ### Cloud — publish & install
 
 Push a locally-built package to ObjectStack Cloud and (optionally) install it
-into one of your environments in a single command. Credentials and server URL
-come from `os cloud login` (stored in `~/.objectstack/cloud.json`) or the
-`--token` / `OS_CLOUD_API_KEY` and `--server` / `OS_CLOUD_URL` flags.
+into one of your environments in a single command. The commands below do not
+share one session or one flag spelling — see [Credentials and server URL](#credentials-and-server-url).
 
 | Command | Description |
 |---------|-------------|
@@ -97,22 +96,54 @@ Typical flow (build → publish → install into an environment, seeding sample
 
 ```bash
 os compile                                 # → dist/objectstack.json
-os cloud login                             # one-time, stores the cloud session
-os environments create --org "$ORG" --name "Dev" --activate
+os cloud login                             # one-time; the session os package publish reads
+os environments create --org "$ORG" --name "Dev" --activate   # does NOT read that session — see below
 os package publish --env <env-id> --install --seed-sample-data
 ```
 
+`os environments create` does not use the session `os cloud login` stored: give
+it `--url` and `--token` (or `OS_CLOUD_URL` / `OS_TOKEN`), or an `os login`
+session. Without either it exits 1 with `Authentication required`.
+
 `os package publish` registers a `sys_package` (keyed by a reverse-domain
 `--manifest-id`, derived from the artifact when omitted), snapshots the
 artifact as a new `--version`, and — with `--env <id> --install` — installs
 that version into the environment. Useful flags: `--visibility private|org|
 marketplace`, `--note`, and for marketplace listings `--submit` (request
-review) or `--auto-approve` (platform admins only). Set `OS_CLOUD_URL` (or
-`--server`) to target a non-default control plane, e.g. a staging cloud.
+review) or `--auto-approve` (platform admins only). Set `OS_CLOUD_URL` to
+target a non-default control plane, e.g. a staging cloud. `os cloud login`,
+`os package publish` and `os environments` read it; the flag is `--server` on
+`os package publish` and `--url` on the other two.
+
+#### Credentials and server URL
+
+Two stored sessions exist, and each command authenticates with one of them:
+
+| Command | Server URL | Token | Stored session |
+|---------|------------|-------|-------------------------|
+| `os cloud login` | `-u, --url` (env `OS_CLOUD_URL`, default `https://cloud.objectos.ai`) | none — `-e, --email` / `-p, --password`, or the browser device flow | writes `~/.objectstack/cloud.json` |
+| `os cloud whoami` / `os cloud logout` | — | — | reads / deletes `~/.objectstack/cloud.json` |
+| `os package publish`, `os plugin publish` | `-s, --server` (env `OS_CLOUD_URL`); else the URL in `cloud.json`; else `https://cloud.objectos.ai` | `-t, --token` (env `OS_CLOUD_API_KEY`, then `OS_TOKEN`) | `~/.objectstack/cloud.json` — the `os cloud login` session |
+| `os environments list` / `show` / `create` / `bind` / `switch` | `-u, --url` (env `OS_CLOUD_URL`); else the URL in `credentials.json`; else `http://localhost:3000` | `-t, --token` (env `OS_TOKEN`) | `~/.objectstack/credentials.json` — the `os login` session, **not** `os cloud login`'s |
+
+`os package install` is not a cloud command: it installs into a running runtime
+(`-r, --runtime`, env `OS_RUNTIME_URL`, default `http://localhost:3000`) and signs
+in there with `--email` / `--password` (env `OS_RUNTIME_EMAIL` /
+`OS_RUNTIME_PASSWORD`).
 
 ### Plugin Management
 
-Runtime plugins (declared in `objectstack.config.ts` `plugins`) are loaded automatically by `os serve` / `os dev`. There is no `os plugin` command group in v1; runtime plugins are bundled into the build artifact. To distribute a build, publish it as a package with `os package publish` (see [Cloud — publish & install](#cloud--publish--install)); the `os environments bind <id> --artifact dist/objectstack.json` path still binds an artifact directly into an environment without going through the package registry.
+Runtime plugins (declared in `objectstack.config.ts` `plugins`) are loaded automatically by `os serve` / `os dev`. Runtime plugins are bundled into the build artifact. To distribute a build, publish it as a package with `os package publish` (see [Cloud — publish & install](#cloud--publish--install)); the `os environments bind <id> --artifact dist/objectstack.json` path still binds an artifact directly into an environment without going through the package registry.
+
+A code-bearing plugin — a directory carrying an `objectstack.plugin.json` manifest — is packaged and shipped through the `os plugin` command group (ADR-0025 §3.4, build → sign → publish):
+
+| Command | Description |
+|---------|-------------|
+| `os plugin build [dir]` | Compile a plugin into a signed-ready `.osplugin` artifact (`--entry`, `--out`, `--minify`) |
+| `os plugin sign <artifact> --key <pem>` | Sign a built `.osplugin` with a publisher Ed25519 key, writing a detached `<artifact>.sig` |
+| `os plugin publish [artifact]` | Publish a signed `.osplugin` to ObjectStack Cloud |
+
+The group has no `install`: ADR-0025 records the code-plugin install half (download, verify, materialize, load) as not yet implemented. `os plugin` (singular) is unrelated to `os plugins` (plural), oclif's plugin manager, which this package does not ship — see [`os plugins` and `os help`](#os-plugins-and-os-help-not-commands).
 
 ### Quality
 
@@ -176,8 +207,13 @@ Common variables: `OS_DATABASE_URL`, `OS_DATABASE_DRIVER`,
 
 ### Global
 
-- `-v, --version` — Show version number
-- `-h, --help` — Show help
+- `--version` — Show version number
+- `--help` — Show help (`os --help`, or `os <command> --help` for one command)
+
+There are no short forms: `os -h` and `os -v` exit 2 with `command -h not found` /
+`command -v not found`. `-v` is a command's own flag instead — `--verbose` on `os dev`,
+`os serve`, `os start` and `os doctor`, `--version <semver>` on `os package publish` and
+`os package install`.
 
 ### `os init`
 
@@ -200,7 +236,7 @@ Common variables: `OS_DATABASE_URL`, `OS_DATABASE_DRIVER`,
 
 - `-p, --port <port>` — Server port. Resolution: `--port` › `$OS_PORT` › `$PORT` › `3000`. With `--dev` a busy port auto-hops to the next free one; in production mode it's a hard error (never silently drifts).
 - `--dev` — Run in development mode (load devPlugins, pretty logging)
-- `--ui` — Enable Studio UI
+- `--ui` — Enable the bundled Console portal at `/_console/` when `@object-ui/console` is installed (default: true)
 - `--no-server` — Skip starting HTTP server plugin
 
 ### `os generate`