---

This section details on the original issue you should resolve

<issue_title>Improve error messages: compact output and fix formatting bugs</issue_title>
<issue_description>Parent: #1534

Problem

When a validation error occurs, the CLI prints a one-line error message followed by the entire help text (40+ lines). For example:

not-an-ip is not a valid IP address

Description:
  Start Dev Proxy

Usage:
  devproxy [command] [options]

Options:
  [... 20+ lines of options ...]

Commands:
  [... 6+ lines of commands ...]

This creates two problems for agents:

1. The actual error is buried — an agent scanning output must find the needle in the haystack
2. Parsing the error requires distinguishing the error line from the help text that follows

Additionally, some error messages have formatting bugs. The JWT signing-key validator produces:

Requires option '----signing-key' to be at least 32 characters

Four dashes instead of two, because the code uses $"Requires option '--{jwtSigningKeyOption.Name}'" but .Name already includes the -- prefix.

Rationale

Agents self-correct from error messages. A good error message lets the agent fix its input and retry without re-reading help. Dumping 40 lines of help text defeats this — the agent has to parse all of it to find the one-line error. Malformed option names in error messages (like ----signing-key) prevent agents from mapping the error back to the correct flag.

Proposed solution

1. Compact error output

On validation errors, print only the error and a pointer to help:

Error: "not-an-ip" is not a valid IP address. Example: 127.0.0.1
Run 'devproxy --help' for usage information.

This may require customizing System.CommandLine's error handling behavior.

2. Actionable error messages

Where possible, include the invalid value AND valid alternatives:

• Error: Invalid log level "verbose". Allowed values: Trace, Debug, Information, Warning, Error, Critical, None
• Error: Invalid environment variable format "FOO". Expected format: name=value

The existing validators already include valid alternatives in some cases — this is about consistency across all validators.

3. Fix the four-dash bug

In JwtCommand.cs, the signing-key validator does:

input.AddError($"Requires option '--{jwtSigningKeyOption.Name}' to be at least 32 characters");

jwtSigningKeyOption.Name returns --signing-key (with dashes). Fix: use the name without the prefix, or reference the option differently.

Affected code

• DevProxy/Commands/DevProxyCommand.cs — all validators
• DevProxy/Commands/JwtCommand.cs — signing-key validator (four-dash bug)
• Potentially System.CommandLine middleware configuration
  </issue_description>

Comments on the Issue (you are @copilot in this section)