Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/agent/remote_agent.go`:
- Around line 166-177: The current handler collapses all resolver.GetByName
errors into "Unknown context" whenever resolver.ListRemoteContexts succeeds,
losing real configuration errors; change the logic in the GetByName error branch
so that you only return the "Unknown context %q. Available contexts: ..."
toolError when the original error actually means "not found" (e.g., compare with
a sentinel like resolver.ErrNotFound or use errors.Is/As on the error returned
by resolver.GetByName); for any other error from resolver.GetByName, return the
original failure via toolError("Failed to resolve context %q: %v", args.Context,
err) so configuration/permission errors are preserved (update the branch that
calls resolver.ListRemoteContexts and returns toolError accordingly, keeping
symbols resolver.GetByName, resolver.ListRemoteContexts, args.Context,
ctx.Context, and toolError).

In `@internal/clicontext/store.go`:
- Around line 211-214: In the List method loop, skipping entries on
read/decrypt/unmarshal failure (using s.readContext(filepath.Join(s.baseDir,
entry.Name())) and simply continue) causes List() to return a silently partial
result; change the behavior to record and return an error when any entry fails:
capture the filename (entry.Name()) and the underlying error from readContext,
aggregate failures (or return the first encountered error) and ensure List()
returns a non-nil error alongside any partial results so callers (CLI) can
detect corrupt store or wrong key rather than seeing a silently missing context.
- Around line 107-120: ValidateContext currently trims Name and ServerURL only
for validation, but Create/Update still persist the original struct; update the
code so the normalized values are saved. Either have ValidateContext mutate the
passed-in context (trimmed Name, trimmed ServerURL, and similarly trimmed APIKey
if you want) or add a small helper normalizeContext(ctx *Context) called from
Create, Update, and ValidateContext to set ctx.Name =
strings.TrimSpace(ctx.Name), ctx.ServerURL = strings.TrimSpace(ctx.ServerURL),
and ctx.APIKey = strings.TrimSpace(ctx.APIKey) before deriving filenames or
JSON; ensure Create and Update use the normalized ctx when computing filenames
and writing the file so trailing whitespace cannot be persisted (refer to
functions ValidateContext, Create, Update and the Context struct).
- Around line 111-115: ValidateContext currently only rejects LocalContextName
("local") and only checks os.PathSeparator; update it to also reserve "current"
(so names "local" and "current" are rejected) and to reject both forward and
backward slashes by checking for '/' and '\\' (e.g. via strings.ContainsAny) so
names like "prod/east" fail on all platforms; mention the reserved names in the
error message and keep List()'s skip of "current.json" and contextPath
concatenation behavior consistent with this validation (refer to
LocalContextName, the ValidateContext function, List, and contextPath in
store.go).

In `@internal/cmd/context.go`:
- Around line 160-163: NewContext currently inspects the leaf cobra command name
(via cmd.Name()) so it sees "list"/"add"/"use" instead of the "context" family;
change the detection to walk the parent chain (using cmd.Parent() repeatedly)
and check ancestor.Name() == "context" (or otherwise derive the command family
from the ancestor chain) before calling newCLIContextStore or scopeForCommand;
update the same parent-chain check in the other similar blocks mentioned (the
other NewContext usages and any checks that dereference ContextStore in
context_command.go) so newCLIContextStore is only invoked when the command is
actually in the "context" family and ContextStore cannot be nil.

In `@internal/cmd/flags.go`:
- Around line 52-55: The package-level variable contextFlag (type
commandLineFlag) is unused and triggering golangci-lint; either remove this dead
variable or wire it up by registering a persistent --context flag using the
shared contextFlag descriptor. If you choose to wire it, hook into your
global/root flag setup (e.g., in the root command init or the function that
registers global flags) and use contextFlag.name and contextFlag.usage to create
the persistent flag (matching how other commandLineFlag descriptors are
registered), ensuring the flag value is stored where the CLI reads it; otherwise
delete the contextFlag definition to satisfy the linter.

In `@internal/cmd/history.go`:
- Around line 81-82: The remote path returns a truncated exec.DAGRunStatus to
the shared renderer so fields emitted by renderHistoryJSON (Tags, WorkerID,
Error) are missing for remote contexts; update the remote adapter
(remoteRunHistory and the code that prepares the DAGRunStatus in
remote_commands.go) to populate Tags, WorkerID and Error on the
exec.DAGRunStatus objects it constructs before calling the shared renderer (the
same structure renderHistoryJSON expects) so that remote `history --format json`
output matches local output.

In `@internal/cmd/remote_client.go`:
- Around line 69-74: The http.Client creation currently builds a new
http.Transport which drops defaults like ProxyFromEnvironment; instead clone the
default transport by type-asserting http.DefaultTransport to *http.Transport,
make a shallow copy, set the TLSClientConfig.InsecureSkipVerify to
ctx.SkipTLSVerify, and use that copy as the Transport for the client (refer to
the client instantiation, http.Client and TLSClientConfig usage in
remote_client.go). Ensure you preserve other default fields (Proxy, DialContext,
IdleConnTimeout, etc.) by copying the default transport rather than creating a
fresh one.

In `@internal/cmd/remote_commands_test.go`:
- Around line 27-29: The test currently uses invalid new() calls for string
pointers; update the Params and WorkerId fields (which are *string) to provide
proper *string values — e.g., create a small helper (like stringPtr) or temp
variables and assign pointers to them—so replace new("P1=foo") and
new("worker-a") with stringPtr("P1=foo") and stringPtr("worker-a") (or &v-style
temps) where Params and WorkerId are set in the test in
internal/cmd/remote_commands_test.go.

In `@internal/cmd/remote_commands.go`:
- Around line 483-489: The code around reading limitStr via ctx.StringParam and
parsing into limit currently ignores fmt.Sscanf errors and accepts partial
parses (e.g., "10foo"); change parsing to use strconv.Atoi (or strconv.ParseInt)
and check the error and that the value is >0, and if parsing fails or value <=0
return a flag parsing error to the caller instead of silently defaulting to 100;
update the import to include strconv and modify the handling where limit is used
so malformed --limit values produce an explicit error rather than falling back.
- Around line 514-526: The waitForRemoteStop function currently uses a fixed 30s
deadline and time.Sleep, so update it to honor the selected CLI context timeout
and respond to cancellation: derive the overall deadline from ctx.Context’s
deadline (fallback to 30s if none) and replace time.Sleep with a select that
listens on ctx.Context.Done() and a time.After(250*time.Millisecond) timer; keep
using ctx.Remote.getDAGRunDetails and core.Status(detail.Status) != core.Running
as the stop condition, and return ctx.Context.Err() if the context is cancelled
before the run stops.

In `@internal/cmd/retry.go`:
- Around line 57-59: Before delegating to remoteRunRetry in the ctx.IsRemote()
branch inside retry.go, add a validation that rejects any local-only retry flags
(--root, --default-working-dir, --worker-id, --attempt-id) when running with
--context/remote; detect these flags from the parsed args or command flag state
and return an error if any are present so they don't silently become no-ops.
Implement this guard immediately before the existing if ctx.IsRemote() return
remoteRunRetry(ctx, args) line (e.g., validateNoLocalOnlyRetryFlags(args) or
check FlagChanged for the named flags) so only permitted flags (--run-id,
--step) are forwarded to remoteRunRetry.

In `@internal/cmn/config/loader.go`:
- Line 392: envBindings is missing a binding for paths.contexts_dir so the
DAGU_CONTEXTS_DIR env var is ignored; add an entry that binds
cfg.Paths.ContextsDir to the environment layer (the same way other path entries
are bound) by adding a binding for "paths.contexts_dir" that references
&cfg.Paths.ContextsDir (and uses the same default reference
def.Paths.ContextsDir pattern) alongside the other envBindings items so
DAGU_CONTEXTS_DIR takes effect.

---

Nitpick comments:
In `@internal/agent/api.go`:
- Around line 573-596: The repeated inline construction of SessionManagerConfig
in newManagedSession (and the other SessionManagerConfig call sites) risks
divergence when new fields like RemoteContextResolver are added; create a single
helper function (e.g., buildSessionManagerConfig or
NewSessionManagerConfigFromRuntime) that accepts the common inputs (ctx, id,
user, cfg, now, and receiver *API) and returns a fully populated
SessionManagerConfig, then replace direct SessionManagerConfig literals in
newManagedSession and the other SessionManagerConfig call sites with calls to
this helper and pass its result into NewSessionManager to ensure all fields stay
centralized and in sync.

In `@internal/clicontext/store_test.go`:
- Around line 69-109: Add test cases to the tests slice in store_test.go to
cover the reserved name "current" and inputs with leading/trailing whitespace so
Store's reserved-marker logic and normalization can't regress unnoticed;
specifically add a case where Context{Name: "current", ServerURL:
"https://example.com", APIKey: "dagu_test"} expects the same reserved-name error
as LocalContextName, and cases with whitespace-padded fields (e.g., Name: " prod
", ServerURL: " https://example.com ", APIKey: " dagu_test ") expecting
validation to trim/normalize and either pass or produce the same validation
errors (e.g., invalid URL or api key prefix) so the behavior in Store/Context
validation is fully covered.