fix(cli): name hosted-only mode instead of sending artifact to a plugin hunt

[Agnik47]

Symptom

In local mode:

$ webcmd artifact download <url> --output ./a.bin
Site "artifact" is not installed.
Search: webcmd plugin search artifact
Install using the installSource returned by search.

There is no artifact plugin, so that search can only waste a turn — the exact failure mode command-suggest.ts was written to end ("telling the caller to search a plugin marketplace for a plugin that cannot exist").

Cause

artifact is a hosted-mode builtin (src/hosted/runner.ts:449, and in the builtinCommands set at :2134). It is never registered locally, so the token falls through unknownRootCommandMessage to missingPluginGuidance.

What points local users at it is docs/cli-reference.mdx: the Top-Level Commands table listed artifact beside doctor, daemon, and web with no mode marker, and the browser run section gives the literal webcmd artifact download <download-url> --output <local-path>.

Hosted mode already names the mirror-image case with LOCAL_ONLY_COMMAND_HELP. Local mode had no equivalent.

Fix

$ webcmd artifact
"artifact" is a hosted-mode command and this installation is in local mode.
Run `webcmd setup` and choose hosted mode to use hosted-only commands.

• HOSTED_ONLY_COMMAND_HELP mirrors the existing LOCAL_ONLY_COMMAND_HELP.
• isHostedOnlyRootCommand is derived — hosted root help minus WEBCMD_ROOT_COMMANDS — so a hosted command added later is covered without editing this file. Today that set is exactly {artifact}.
• setup is excluded explicitly. Both modes serve it; it sits outside the local registry only because main.ts:76 answers it before Commander parses argv, which would otherwise read as hosted-only.
• The check runs before the edit-distance suggestions: an exact hosted name is stronger evidence than a fuzzy guess.
• The reference table marks artifact "Hosted mode only.", the wording the flag table at --workspace already uses.

Unchanged: unknown sites, near misses (adapters → webcmd adapter), the CANONICAL_ROOT intent overrides, the installed-but-failed-to-load path, and the exit code — still 2, per the envelope contract from #424/#427.

Correction to an earlier revision of this description

An earlier version of this PR said shell completion advertises artifact in both modes. That is wrong, and the code comment repeating it has been fixed. HOSTED_CLIENT_ROOT_COMMANDS feeds only getHostedRootHelp, which is called from hosted/runner.ts; webcmd completion bash and webcmd completion zsh emit no artifact entry in local mode. Completion was already correct — the docs table was not.

Tests

src/command-suggest.test.ts:

• artifact names the mode boundary and mentions neither plugin search nor is not installed;
• the same answer regardless of typed case;
• isHostedOnlyRootCommand is false for every member of WEBCMD_ROOT_COMMANDS, and specifically for web, browser, and doctor — commands served in both surfaces, where a hosted-only claim would be a new lie;
• setup is not reported hosted-only;
• the existing "genuinely unknown token still reaches plugin search" test is untouched and passing.

Verified against a built CLI: webcmd artifact and webcmd artifact download both print the new message and exit 2; webcmd bogus still prints the plugin guidance.

npx vitest run --project unit — no new failures against main on this machine (25 pre-existing Windows symlink-EPERM failures on both). npm run typecheck and npm run check:typed-error-lint clean.

[github-actions]

🟢 No documentation gap found — medium confidence

The automated review found no documentation gap in the supplied changes.

This review is advisory and does not block merging.