apcore-cli 0.8.0 → 0.9.0

package/dist/bin/apcore-cli.js

@@ -35,6 +35,12 @@ function exitCodeForError(error) {
   if (error instanceof SchemaValidationError) {
     return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
   }
+  if (error instanceof MaxDepthExceededError || error instanceof CircularRefError) {
+    return EXIT_CODES.SCHEMA_CIRCULAR_REF;
+  }
+  if (error instanceof UnresolvableRefError) {
+    return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
+  }
   if (error instanceof ModuleNotFoundError) {
     return EXIT_CODES.MODULE_NOT_FOUND;
   }
@@ -74,7 +80,7 @@ function exitCodeForError(error) {
   }
   return EXIT_CODES.MODULE_EXECUTE_ERROR;
 }
-var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, ModuleNotFoundError, EXIT_CODES;
+var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, MaxDepthExceededError, CircularRefError, UnresolvableRefError, ModuleNotFoundError, EXIT_CODES;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -115,6 +121,24 @@ var init_errors = __esm({
         this.name = "SchemaValidationError";
       }
     };
+    MaxDepthExceededError = class extends Error {
+      constructor(message = "Schema $ref resolution depth exceeded") {
+        super(message);
+        this.name = "MaxDepthExceededError";
+      }
+    };
+    CircularRefError = class extends Error {
+      constructor(message = "Circular $ref detected in schema") {
+        super(message);
+        this.name = "CircularRefError";
+      }
+    };
+    UnresolvableRefError = class extends Error {
+      constructor(message = "Unresolvable $ref in schema") {
+        super(message);
+        this.name = "UnresolvableRefError";
+      }
+    };
     ModuleNotFoundError = class extends Error {
       constructor(message = "Module not found") {
         super(message);
@@ -155,8 +179,13 @@ var init_errors = __esm({
 var sandbox_exports = {};
 __export(sandbox_exports, {
   Sandbox: () => Sandbox,
+  _buildSandboxEnvForTesting: () => _buildSandboxEnvForTesting,
   runSandboxRunner: () => runSandboxRunner
 });
+import { spawn } from "child_process";
+import { mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join, resolve as resolvePath } from "path";
 async function runSandboxRunner(moduleId) {
   const extensionsRoot = process.env.APCORE_EXTENSIONS_ROOT ?? "./extensions";
   const apcore = await import("apcore-js").catch(() => {
@@ -191,10 +220,13 @@ async function runSandboxRunner(moduleId) {
     process.exit(1);
   }
 }
+function _buildSandboxEnvForTesting(tmpDir) {
+  return buildSandboxEnv(tmpDir);
+}
 function buildSandboxEnv(tmpDir) {
   const env = {};
   for (const key of SANDBOX_ALLOW_KEYS) {
-    if (process.env[key]) env[key] = process.env[key];
+    if (process.env[key] !== void 0) env[key] = process.env[key];
   }
   for (const [key, val] of Object.entries(process.env)) {
     if (key.startsWith(SANDBOX_ALLOW_PREFIX) && !key.startsWith(SANDBOX_DENY_PREFIX) && !SANDBOX_DENY_KEYS.includes(key)) {
@@ -260,13 +292,8 @@ var init_sandbox = __esm({
         return this._sandboxedExecute(moduleId, inputData);
       }
       async _sandboxedExecute(moduleId, inputData) {
-        const { spawn } = await import("child_process");
-        const { tmpdir } = await import("os");
-        const { join: join4 } = await import("path");
-        const { mkdtempSync, rmSync } = await import("fs");
-        const tmpDir = mkdtempSync(join4(tmpdir(), "apcore_sandbox_"));
+        const tmpDir = mkdtempSync(join(tmpdir(), "apcore_sandbox_"));
         const env = buildSandboxEnv(tmpDir);
-        const { resolve: resolvePath } = await import("path");
         if (this.extensionsRoot !== null) {
           env.APCORE_EXTENSIONS_ROOT = resolvePath(this.extensionsRoot);
         } else if (env.APCORE_EXTENSIONS_ROOT) {
@@ -304,11 +331,20 @@ var init_sandbox = __esm({
           }
           stderr += chunk.toString();
         });
+        child.stdin.on("error", () => {
+        });
         child.stdin.write(JSON.stringify(inputData));
         child.stdin.end();
         return new Promise((resolve2, reject) => {
+          const cleanup = () => {
+            try {
+              rmSync(tmpDir, { recursive: true, force: true });
+            } catch {
+            }
+          };
           const timer = setTimeout(() => {
             child.kill("SIGKILL");
+            cleanup();
             reject(
               new ModuleExecutionError(
                 `Sandbox module '${moduleId}' timed out after ${this.timeoutSeconds}s.`
@@ -317,10 +353,7 @@ var init_sandbox = __esm({
           }, this.timeoutSeconds * 1e3);
           child.on("close", (code) => {
             clearTimeout(timer);
-            try {
-              rmSync(tmpDir, { recursive: true, force: true });
-            } catch {
-            }
+            cleanup();
             if (sizeExceeded) {
               const limitMiB = Math.floor(outputCap / (1024 * 1024));
               reject(new ModuleExecutionError(
@@ -344,6 +377,7 @@ var init_sandbox = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
+            cleanup();
             reject(new ModuleExecutionError(`Failed to spawn sandbox process: ${err.message}`));
           });
         });
@@ -376,27 +410,21 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
   if ("$ref" in obj) {
     const refPath = obj.$ref;
     if (depth >= maxDepth) {
-      process.stderr.write(
-        `Error: $ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.
-`
+      throw new MaxDepthExceededError(
+        `$ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     if (visited.has(refPath)) {
-      process.stderr.write(
-        `Error: Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.
-`
+      throw new CircularRefError(
+        `Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     const parts = refPath.split("/");
     const key = parts[parts.length - 1];
     if (!(key in defs)) {
-      process.stderr.write(
-        `Error: Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.
-`
+      throw new UnresolvableRefError(
+        `Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
     }
     const newVisited = new Set(visited);
     newVisited.add(refPath);
@@ -497,17 +525,12 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
       return merged;
     }
   }
-  if ("properties" in obj && typeof obj.properties === "object" && obj.properties !== null) {
-    const props = obj.properties;
-    for (const [propName, propSchema] of Object.entries(props)) {
-      props[propName] = resolveNode(
-        propSchema,
-        defs,
-        visited,
-        depth,
-        maxDepth,
-        moduleId
-      );
+  for (const [k, v] of Object.entries(obj)) {
+    if (k === "allOf" || k === "anyOf" || k === "oneOf" || k === "$ref") {
+      continue;
+    }
+    if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+      obj[k] = resolveNode(v, defs, visited, depth, maxDepth, moduleId);
     }
   }
   return obj;
@@ -704,7 +727,7 @@ var init_schema_parser = __esm({
       "format",
       "fields",
       "sandbox",
-      "verbose",
+      "all_options",
       "dry_run",
       "trace",
       "stream",
@@ -817,6 +840,14 @@ var init_approval = __esm({
       }
       async requestApproval(request) {
         const moduleId = request.module_id ?? "unknown";
+        if (request.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
+        const moduleDef = request.module_def;
+        const annotationsForCheck = moduleDef?.annotations;
+        if (annotationsForCheck && annotationsForCheck.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
         if (this.autoApprove) {
           return { status: "approved", approved_by: "auto_approve" };
         }
@@ -853,6 +884,7 @@ var init_approval = __esm({
 
 // src/output.ts
 import yaml from "js-yaml";
+import { formatCsv, formatJsonl } from "apcore-toolkit";
 function descriptorToScanned(m) {
   const metadata = m.metadata ?? {};
   const display = metadata["display"] ?? null;
@@ -873,11 +905,6 @@ function descriptorToScanned(m) {
     warnings: []
   };
 }
-function csvCellString(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "object") return JSON.stringify(value);
-  return String(value);
-}
 function resolveFormat(explicitFormat) {
   if (explicitFormat !== void 0) {
     return explicitFormat;
@@ -1080,30 +1107,18 @@ function formatExecResult(result, format, fields) {
   }
   const effective = resolveFormat(format);
   if (effective === "csv") {
-    if (typeof effective_result === "object" && !Array.isArray(effective_result) && effective_result !== null) {
-      const obj = effective_result;
-      const keys = Object.keys(obj);
-      const header = keys.map(escapeCsvField).join(",");
-      const row = keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      process.stdout.write(header + "\n" + row + "\n");
-    } else if (Array.isArray(effective_result) && effective_result.length > 0 && typeof effective_result[0] === "object") {
-      const keys = Object.keys(effective_result[0]);
-      const header = keys.map(escapeCsvField).join(",");
-      const rows = effective_result.map((item) => {
-        const obj = item;
-        return keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      });
-      process.stdout.write(header + "\n" + rows.join("\n") + "\n");
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatCsv(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
   } else if (effective === "yaml") {
     process.stdout.write(yaml.dump(effective_result, { lineWidth: -1 }));
   } else if (effective === "jsonl") {
-    if (Array.isArray(effective_result)) {
-      for (const item of effective_result) {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatJsonl(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
@@ -1120,11 +1135,19 @@ function formatExecResult(result, format, fields) {
     process.stdout.write(String(effective_result) + "\n");
   }
 }
-function escapeCsvField(value) {
-  if (value.includes(",") || value.includes('"') || value.includes("\n") || value.includes("\r")) {
-    return '"' + value.replace(/"/g, '""') + '"';
+function toRowsForTabular(value) {
+  if (value === null || value === void 0) return null;
+  if (Array.isArray(value)) {
+    if (value.length === 0) return null;
+    if (!value.every((item) => typeof item === "object" && item !== null && !Array.isArray(item))) {
+      return null;
+    }
+    return value;
+  }
+  if (typeof value === "object") {
+    return [value];
   }
-  return value;
+  return null;
 }
 function formatPreflightResult(result, format) {
   const resolved = resolveFormat(format);
@@ -1205,7 +1228,7 @@ var init_output = __esm({
     "use strict";
     init_esm_shims();
     init_errors();
-    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.6";
+    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.7";
   }
 });
 
@@ -1236,7 +1259,7 @@ function renderTemplate(template, context) {
   return result;
 }
 function registerInitCommand(cli) {
-  const initGroup = cli.command("init").description("Scaffold new apcore modules.");
+  const initGroup = cli.command("init").description("Scaffold new modules.");
   initGroup.command("module <module-id>").description("Create a new module from a template.\n\nMODULE_ID is the module identifier (e.g., ops.deploy, user.create).").option(
     "--style <style>",
     "Module style: decorator (@module), convention (plain function), or binding (YAML).",
@@ -1812,7 +1835,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
   s.push(".SH ENVIRONMENT");
   s.push(".TP");
   s.push("\\fBAPCORE_EXTENSIONS_ROOT\\fR");
-  s.push("Path to the apcore extensions directory.");
+  s.push("Path to the extensions directory.");
   s.push(".TP");
   s.push("\\fBAPCORE_CLI_AUTO_APPROVE\\fR");
   s.push("Set to \\fB1\\fR to bypass approval prompts.");
@@ -1837,7 +1860,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
 ${meaning}`);
   }
   s.push(".SH SEE ALSO");
-  s.push(`\\fB${progName} \\-\\-help \\-\\-verbose\\fR for full option list.`);
+  s.push(`\\fB${progName} \\-\\-help \\-\\-all\\-options\\fR for full option list.`);
   if (docsUrl2) {
     s.push(`.PP
 Full documentation at \\fI${roffEscape(docsUrl2)}\\fR`);
@@ -2244,7 +2267,7 @@ var init_config_encryptor = __esm({
           _ConfigEncryptor.weakFallbackWarned = true;
         }
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const material = `${hostname2}:${username}`;
         return crypto2.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, "sha256");
       }
@@ -2276,7 +2299,7 @@ var init_config_encryptor = __esm({
         const tag = data.subarray(12, 28);
         const ct = data.subarray(28);
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
         const materials = passphrase ? [passphrase, `${hostname2}:${username}`] : [`${hostname2}:${username}`];
         for (const material of materials) {
@@ -2306,10 +2329,26 @@ var init_auth = __esm({
     init_config_encryptor();
     AuthProvider = class {
       config;
-      encryptor;
+      _encryptor;
       constructor(config, encryptor) {
         this.config = config;
-        this.encryptor = encryptor ?? new ConfigEncryptor();
+        this._encryptor = encryptor;
+      }
+      /**
+       * Resolve the active ConfigEncryptor instance.
+       *
+       * D11-005 (2026-05-12): three-tier fallback chain matching Python's
+       * `_get_encryptor` (auth.py:33): explicit constructor arg > peer attribute
+       * `config.encryptor` (set by embedders injecting forced-AES test fixtures
+       * or shared instances) > fresh `new ConfigEncryptor()`. Previously TS
+       * skipped the peer-attribute tier, silently giving embedders a different
+       * encryptor than the one they wired on the config.
+       */
+      getEncryptor() {
+        if (this._encryptor) return this._encryptor;
+        const fromConfig = this.config.encryptor;
+        if (fromConfig) return fromConfig;
+        return new ConfigEncryptor();
       }
       /**
        * Retrieve the API key from the configured sources.
@@ -2327,11 +2366,11 @@ var init_auth = __esm({
         const strResult = String(result);
         if (strResult.startsWith("keyring:") || strResult.startsWith("enc:")) {
           try {
-            return await this.encryptor.retrieve(strResult, "auth.api_key");
+            return await this.getEncryptor().retrieve(strResult, "auth.api_key");
           } catch (err) {
             if (err instanceof ConfigDecryptionError) {
               throw new AuthenticationError(
-                "Failed to decrypt stored API key. Re-configure with 'apcore-cli config set auth.api_key'."
+                "Failed to decrypt stored API key. Re-store with 'apcli config set auth.api_key'."
               );
             }
             throw err;
@@ -2360,7 +2399,7 @@ var init_auth = __esm({
         }
         if (/[\r\n]/.test(key)) {
           throw new AuthenticationError(
-            "Malformed API key: contains invalid characters (CR/LF). Re-configure with 'apcore-cli config set auth.api_key'."
+            "Malformed API key: contains invalid characters (CR/LF). Re-store with 'apcli config set auth.api_key'."
           );
         }
         headers.Authorization = `Bearer ${key.trim()}`;
@@ -2582,7 +2621,7 @@ function registerExecCommand(apcliGroup, registry, executor) {
         return;
       }
       let result;
-      if (opts.strategy && executor.callWithTrace) {
+      if ((opts.trace || opts.strategy) && executor.callWithTrace) {
         const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });
         result = res;
       } else {
@@ -3698,6 +3737,7 @@ __export(main_exports, {
   reconvertEnumValues: () => reconvertEnumValues,
   resolveIntOption: () => resolveIntOption,
   resolveStringOption: () => resolveStringOption,
+  setAllOptionsHelp: () => setAllOptionsHelp,
   setDocsUrl: () => setDocsUrl,
   setVerboseHelp: () => setVerboseHelp,
   validateModuleId: () => validateModuleId
@@ -3706,14 +3746,17 @@ import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import * as path5 from "path";
 import { Command as Command5, CommanderError, Option as Option4 } from "commander";
+function setAllOptionsHelp(allOptions) {
+  verboseHelp = allOptions;
+}
 function setVerboseHelp(verbose) {
-  verboseHelp = verbose;
+  setAllOptionsHelp(verbose);
 }
 function setDocsUrl(url) {
   docsUrl = url;
 }
 function hasVerboseFlag() {
-  return process.argv.includes("--verbose");
+  return process.argv.includes("--all-options");
 }
 function resolveIntOption(cliValue, envValue, defaultValue) {
   if (cliValue !== void 0 && Number.isFinite(cliValue) && cliValue > 0) {
@@ -3788,7 +3831,7 @@ function emitErrorTty(e, exitCode) {
   Exit code: ${exitCode}
 `);
 }
-function createCli(extensionsDirOrOpts, progName, verbose = false) {
+function createCli(extensionsDirOrOpts, progName, allOptions = false) {
   let extensionsDir;
   let registry;
   let executor;
@@ -3803,7 +3846,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   if (typeof extensionsDirOrOpts === "object" && extensionsDirOrOpts !== null) {
     extensionsDir = extensionsDirOrOpts.extensionsDir;
     progName = extensionsDirOrOpts.progName ?? progName;
-    verbose = extensionsDirOrOpts.verbose ?? verbose;
+    allOptions = extensionsDirOrOpts.allOptions ?? extensionsDirOrOpts.verbose ?? allOptions;
     app = extensionsDirOrOpts.app;
     registry = extensionsDirOrOpts.registry;
     executor = extensionsDirOrOpts.executor;
@@ -3817,7 +3860,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   } else {
     extensionsDir = extensionsDirOrOpts;
   }
-  verboseHelp = verbose;
+  verboseHelp = allOptions;
   registerConfigNamespace();
   try {
     const auditLogger = new AuditLogger();
@@ -3850,7 +3893,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
     }
   }
   const registryInjected = registry !== void 0;
-  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--verbose", "Show all options in help output (including built-in options)");
+  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--all-options", "Show all options in help output (including built-in options)");
   if (appVersion) {
     program.version(appVersion, "-V, --version", "Print version");
   }
@@ -3921,7 +3964,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter);
   program.addHelpText("after", [
     "",
-    "Use --help --verbose to show all options (including built-in options).",
+    "Use --help --all-options to show all options (including built-in options).",
     "Use --help --man to display a formatted man page."
   ].join("\n"));
   configureManHelp(program, resolvedProgName, appVersion ?? VERSION);
@@ -3958,7 +4001,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
 function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter) {
   const emitUnwiredError = () => {
     process.stderr.write(
-      "Error: no apcore-js registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
+      "Error: no module registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
     );
     process.exit(EXIT_CODES.CONFIG_INVALID);
   };
@@ -4072,9 +4115,9 @@ function main(progName) {
   verboseHelp = hasVerboseFlag();
   const program = createCli({
     progName,
-    verbose: verboseHelp,
+    allOptions: verboseHelp,
     version: VERSION,
-    description: `${progName ?? "apcore-cli"} \u2014 execute apcore modules from the command line`
+    description: `${progName ?? "apcore-cli"} \u2014 execute modules from the command line`
   });
   try {
     program.parse(process.argv);
@@ -4102,7 +4145,17 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   if (inputSchema && typeof inputSchema === "object" && inputSchema.properties) {
     try {
       resolvedSchema = resolveRefs(inputSchema, 32, moduleId);
-    } catch {
+    } catch (err) {
+      if (err instanceof MaxDepthExceededError || err instanceof CircularRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
+      }
+      if (err instanceof UnresolvableRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
+      }
       resolvedSchema = inputSchema;
     }
     schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);
@@ -4147,7 +4200,7 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   cmd.addOption(approvalTokenOpt);
   const footerParts = [];
   if (!verbose) {
-    footerParts.push("Use --verbose to show all options (including built-in apcore options).");
+    footerParts.push("Use --all-options to show all options (including built-in options).");
   }
   if (docsUrl) {
     footerParts.push(`Docs: ${docsUrl}/commands/${effectiveCmdName}`);
@@ -4156,7 +4209,15 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
     cmd.addHelpText("after", "\n" + footerParts.join("\n") + "\n");
   }
   for (const opt of schemaOptions) {
-    if (opt.parseArg) {
+    if (opt.isBooleanFlag) {
+      const flagBase = opt.name.replace(/_/g, "-");
+      cmd.addOption(
+        new Option4(`--${flagBase}`, opt.description).default(
+          opt.defaultValue
+        )
+      );
+      cmd.addOption(new Option4(`--no-${flagBase}`).hideHelp());
+    } else if (opt.parseArg) {
       cmd.option(opt.flags, opt.description, opt.parseArg, opt.defaultValue);
     } else {
       cmd.option(opt.flags, opt.description, opt.defaultValue);
@@ -4180,24 +4241,12 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
     );
     const approvalToken = options.approvalToken;
     const schemaKwargs = {};
-    const builtinKeys = /* @__PURE__ */ new Set([
-      "input",
-      "yes",
-      "largeInput",
-      "format",
-      "fields",
-      "sandbox",
-      "verbose",
-      "dryRun",
-      "trace",
-      "stream",
-      "strategy",
-      "approvalTimeout",
-      "approvalToken"
-    ]);
-    for (const [k, v] of Object.entries(options)) {
-      if (!builtinKeys.has(k)) {
-        schemaKwargs[k] = v;
+    for (const opt of schemaOptions) {
+      const commanderKey = opt.name.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+      if (commanderKey in options) {
+        schemaKwargs[opt.name] = options[commanderKey];
+      } else if (opt.name in options) {
+        schemaKwargs[opt.name] = options[opt.name];
       }
     }
     let merged = {};