fix(cli): box the stale-pin notice, and tell agents to run init from --help

[theCodeDrift]

Two changes to what an agent sees while installing or updating Taskless.

The stale-pin notice is boxed. When init finds a package.json pin of @taskless/cli or @taskless/cli-nightly older than the CLI that just ran, it now prints the notice in the same orange box as the restart-your-agents banner, headed UPDATE PINNED TASKLESS VERSIONS. Before, it was plain lines that were easy to lose among the rest of the install output. The box drawing moves out of reload-notice.ts into src/install/notice-box.ts, and both notices render through it. Pins render as a bulleted list whose items wrap under their own text. A nightly version is never split across rows, so it stays copyable.

┌──────────────────────────────────────────────────────────────────┐
│  UPDATE PINNED TASKLESS VERSIONS                                 │
│                                                                  │
│  package.json pins a Taskless CLI older than                     │
│  0.12.0-20261006162512x92b3715, the version that just ran here:  │
│                                                                  │
│  - packages/some-long-workspace-name/package.json                │
│    devDependencies: @taskless/cli-nightly                        │
│    0.11.1-20260831132610x088fa7c (installed                      │
│    0.11.1-20260831132610x088fa7c) ->                             │
│    @taskless/cli-nightly@0.12.0-20261006162512x92b3715           │
│  ...                                                             │

describePin now returns the pin without its - bullet, because the box adds its own. info adds the bullet itself, so its output is unchanged.

Every --help opens with a line for agents:

If you're an agent looking to install or update Taskless, run <cli> init first. It may change how this help works, but it is how agents get a consistent Taskless experience.

<cli> comes from getCliPrefix(), the same function every error remedy uses. It names the launcher that was used and this exact build, so a pinned nightly points at itself: npx @taskless/cli-nightly@<that version> init. Floating to @latest would move someone onto a different nightly from the one they chose. The line goes on every --help, not just the top-level one, because an agent may start from a subcommand's help.

Verification

• pnpm typecheck, pnpm lint and pnpm test (2101/2101) pass.
• Rendered the help from both a release build and a build:next nightly build. The nightly names @taskless/cli-nightly@0.12.0-next-<sha>.
• New tests:
  • The pinned box keeps every row the same width with colour on, keeps a long nightly pin's versions whole, and carries the heading.
  • The help line comes first for both the top-level --help and auth login --help.
• Existing tests that match phrases inside the notice now join the box's rows back into one line first. Otherwise they would pass or fail depending on where the box happened to wrap.

[theCodeDrift]

@claude /review

[claude]

Claude finished @theCodeDrift's task in 10m 36s —— View job

---

Review mode: incremental — read 0 prior review thread(s) before reviewing.

.prior-review.json contained no review threads, reviews, or top-level comments other than the trigger comment itself, so this is the first substantive review of this PR. Nothing is being treated as already addressed.

• Read .prior-review.json
• Gather PR diff and changed files
• Review notice-box.ts (new)
• Review reload-notice.ts and pinned-cli.ts changes
• Review help.ts changes
• Review test changes
• Post final review

Assessment

[New] I found nothing new to flag. This is a clean, well-scoped refactor + feature:

• notice-box.ts correctly centralizes the box-drawing logic that previously lived only in reload-notice.ts. The width calculation is done on uncolored text before chalk wraps it (avoiding the classic "escape codes counted as characters" bug), and the wrap() helper never splits a token mid-word, so long nightly version strings stay copyable, matching the stated intent.
• The bullet-list rendering ({ items: [...] }) wraps each item at WRAP_COLUMNS - 2 and prefixes continuation lines with two spaces so wrapped bullets align under their own text, consistent with both the box's ~62-column cap for plain paragraph blocks.
• describePin's bullet was correctly removed from the function itself and pushed to each call site (info.ts adds - manually, the box adds its own - via { items }), so info's plain-text output is unchanged — verified by tracing both call sites.
• getAgentInstallLine() in help.ts uses getCliPrefix(), the same synchronous helper used by other remedies, so it's consistent with existing conventions, and it's correctly printed before showUsage in showResolvedUsage so it's always the first line of any --help output (confirmed against the new help-flag.test.ts assertions).
• Test changes are sound: boxedText/pinnedNotice helpers correctly join wrapped box rows back into single lines before asserting on phrases, which is exactly the right fix for assertions that would otherwise be sensitive to where the box happens to wrap. The ANSI-stripping test (pinned-cli.test.ts) correctly measures width on the colorized string to ensure escape codes don't throw off row alignment.
• Checked for regressions in existing snapshot-style assertions (toContain checks for "USAGE", "COMMANDS", etc.) — none break, since the new agent line is additive and existing assertions don't anchor on line position except the new tests, which do so correctly.
• Traced all call sites of getPinnedCliNotice (init.ts, wizard/index.ts) and describePin (info.ts) — no double-boxing or formatting mismatches.

No correctness, security, performance, or test-adequacy issues found. No inline comments posted.

[theCodeDrift]

Re: @claude — "Claude finished @theCodeDrift's task in 10m 36s…"
#470 (comment)

Thanks. The review found no issues and left no inline comments, so there are no changes to make.

— AI Coding Agent