apcore-cli 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to apcore-cli (TypeScript SDK) will be documented in this fi
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-05-13
+
+### Fixed (2026-05-13 — cross-SDK audit D10/D11/D1)
+
+- **`ConfigEncryptor` LOGNAME key-derivation chain** (D10-001) — PBKDF2 username fallback was `USER → USERNAME → "unknown"` (3-tier); now `USER → LOGNAME → USERNAME → "unknown"` (4-tier) matching the spec and Rust. `src/security/config-encryptor.ts:183, 219`.
+- **Sandbox stdin write lacks `'error'` listener** (D11-008) — `child.stdin.on('error', () => {})` added before `write()` so an EPIPE event from a child that exits early no longer surfaces as an uncaught exception. `src/security/sandbox.ts:153`.
+- **`buildSandboxEnv` drops explicitly-empty env values** (D11-009) — `if (process.env[key])` changed to `if (process.env[key] !== undefined)` so `PATH=""` is forwarded uniformly with Python and Rust. `src/security/sandbox.ts:264`.
+- **`exec --trace` flag ignored when used without `--strategy`** (D11-011) — condition `if (opts.strategy && executor.callWithTrace)` changed to `if ((opts.trace || opts.strategy) && executor.callWithTrace)`. `--trace` alone now routes through `callWithTrace` matching Python. `src/discovery.ts:345`.
+- **CLI brand string in auth error messages** (D11-006) — remediation strings now say `apcli config set auth.api_key` (canonical FE-13 name). `src/security/auth.ts:46`.
+- **`requestApproval` missing `requires_approval=false` short-circuit** (D11-014) — returns `approved/not_required` when the request explicitly carries `requires_approval: false`, matching Rust. `src/approval.ts:63`.
+- **`AuthProvider` missing `config.encryptor` peer-attribute fallback** (D11-005) — `getEncryptor()` now walks explicit constructor arg → `config.encryptor` peer attribute → fresh instance, matching Python's three-tier chain. `src/security/auth.ts:22`.
+- **`APCLI_SUBCOMMAND_NAMES` and `DEFAULT_BUILTIN_GROUP_NAME` not re-exported** (D1 re-audit) — both constants added to `src/index.ts:27` export block. Python and Rust already re-exported both.
+- **Standalone bin entrypoint used deprecated `verbose:` field internally** (D9 re-audit) — `src/main.ts:848` `createCli` call now passes canonical `allOptions: verboseHelp`.
+- **Stale `cli.ts` placeholder-type TODO** (D9-W2) — TODO comment updated to document the actual `apcore-js` Registry/ModuleDescriptor shape gap (method names diverge: `listModules`/`getModule` vs `list`/`getDefinition`/`moduleId`), replacing the generic "until available" wording.
+
+### Added
+
+- **`CreateCliOptions.allOptions` field** (D1-W5) — canonical successor to the deprecated `verbose` field. Embedders should migrate `createCli({ verbose: true })` → `createCli({ allOptions: true })`. `verbose` remains for backward compat through v0.9 and will be removed in v0.10. `src/main.ts:251`.
+- **`setLogLevel` / `getLogLevel` documented as intentionally TS-only** (D1-W4) — `src/index.ts:96-102` now carries a cross-SDK parity note explaining that Python and Rust delegate to their native logging channels.
+- **`getAuditLogger` documented as intentionally TS-only** (D1 re-audit) — `src/index.ts:106` now carries a note. Only the setter (`setAuditLogger`) is the canonical cross-SDK API.
+
+### Fixed
+
+- **CSV `--format csv` heterogeneous-keys data loss** — `formatExecResult` previously derived CSV headers from `Object.keys(rows[0])` only, silently dropping fields that first appeared in later rows. Surfaced via aisee-cli's `summarizeAction()` which emits optional `description` / `solution` fields. The header is now the **union of keys across all rows** in insertion-order. `src/output.ts:340-357`.
+- **CSV line terminator** — now `\r\n` per RFC 4180 (was `\n`). Existing Excel + downstream-parser compatibility improves significantly.
+- **CSV nested-value serialization** — now goes through the toolkit's canonical JSON encoder (compact, insertion-order, unicode-preserved). Behavior was already correct via `JSON.stringify`, but the contract is now enforced at the toolkit layer.
+
+### Changed
+
+- **User-visible help/man/completion/error text no longer leaks the `apcore` / `apcore-js` framework name** to end users of downstream CLIs built on apcore-cli. Affected strings: footer hint (`Use --verbose to show all options (including built-in apcore options)` → `… (including built-in options)`, `src/main.ts:947`), `init` group description (`Scaffold new apcore modules` → `Scaffold new modules`, `src/init-cmd.ts:82`), top-level CLI description (`… execute apcore modules from the command line` → `… execute modules from the command line`, `src/main.ts:835`), standalone unwired-registry error message (`Error: no apcore-js registry wired.` → `Error: no module registry wired.`, `src/main.ts:619`), and man-page `ENVIRONMENT` text (`Path to the apcore extensions directory.` → `Path to the extensions directory.`, `src/shell.ts:302`). README's `--verbose` row updated to match. Two `tests/main.test.ts` assertions (`:891`, `:916`) updated to the new error string. Logger names, source comments, type comments, and environment-variable identifiers (`APCORE_*`) are unchanged — only descriptive copy that appears in `--help`, shell completion, `man` output, or user-facing error messages. Cross-SDK parity with Python 0.8.1 and Rust 0.8.1.
+
+### Changed (breaking CLI surface)
+
+- **Global `--verbose` flag renamed to `--all-options`** — The help-display flag is now `--all-options`; use `apcore-cli module --help --all-options` to reveal hidden built-in options. `verbose` is removed from the reserved schema property names set — module schemas may now freely define `verbose: boolean` for runtime output control. Tracked in [apcore-cli#21](https://github.com/aiperceivable/apcore-cli/issues/21).
+
+### Changed (breaking peer-dep semantics)
+
+- **`apcore-toolkit` promoted from optional to REQUIRED peer dependency** (`>=0.7.0`). All `--format` operations now go through the toolkit's reference implementation for csv/jsonl/markdown/skill (was only markdown/skill). Consumers that did not install the optional peer must add it. `package.json` peer-dependency-meta `optional: true` removed.
+
+### Removed
+
+- `csvCellString` and `escapeCsvField` private helpers — replaced by `apcore_toolkit.formatCsv()` and the toolkit's RFC 4180 internals.
+
+### Why
+
+Per-SDK CSV reimplementations had accumulated divergence: Python emitted Python repr `{'k': 'v'}`, TS dropped heterogeneous keys, Rust used `\n` not CRLF. The spec MUST language couldn't enforce conformance on downstream consumers (e.g. aisee-cli) that reimplemented. See ADR-09 in `apcore-cli/docs/tech-design.md` for the byte-equivalent vs SDK-native tier split.
+
+### Migration
+
+Downstream consumers using only `json` / `table` formats are unaffected at runtime but need `apcore-toolkit@^0.7` installed alongside `apcore-cli@^0.9` (previously optional). aisee-cli and similar adapters get the CSV bug fix automatically on upgrade.
+
+
 ## [0.8.1] - 2026-05-09
 
 ### Fixed

package/README.md

@@ -8,7 +8,7 @@ Terminal adapter for apcore. Execute AI-Perceivable modules from the command lin
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-18%2B-blue.svg)](https://nodejs.org)
-[![Tests](https://img.shields.io/badge/tests-275%2B%20passed-brightgreen.svg)]()
+[![Tests](https://img.shields.io/badge/tests-passing-brightgreen.svg)]()
 
 | | |
 |---|---|
@@ -46,16 +46,15 @@ Terminal adapter for apcore. Execute AI-Perceivable modules from the command lin
 ## Installation
 
 ```bash
-pnpm add apcore-cli apcore-js
+pnpm add apcore-cli apcore-js apcore-toolkit
 ```
 
-Requires Node.js 18+ and `apcore-js >= 0.21.0`.
+Requires Node.js 18+, `apcore-js >= 0.21.0`, and `apcore-toolkit >= 0.7.0` (required peer dep as of v0.9.0).
 
-**Optional:** install `apcore-toolkit` (>=0.6.0) to enable display overlay and registry writer integration via `applyToolkitIntegration`, `DisplayResolver`, and `RegistryWriter`.
+**v0.9.0 breaking change:** `apcore-toolkit` is now a **required** peer dependency (previously optional). All `--format` operations route through the toolkit's byte-equivalent reference implementations for csv / jsonl / markdown / skill. See [tech-design ADR-09](https://github.com/aiperceivable/apcore-cli/blob/main/docs/tech-design.md) for the rationale and migration notes.
 
 ```bash
-pnpm add apcore-cli apcore-js
-pnpm add -D apcore-toolkit  # optional, for display overlay / registry writer
+pnpm add apcore-cli apcore-js apcore-toolkit
 ```
 
 ## Quick Start
@@ -151,7 +150,7 @@ your-project/
 No changes to your project. Just install and run:
 
 ```bash
-pnpm add apcore-cli apcore-js
+pnpm add apcore-cli apcore-js apcore-toolkit
 apcore-cli --extensions-dir ./extensions list
 apcore-cli --extensions-dir ./extensions math.add --a 5 --b 10
 ```
@@ -185,7 +184,7 @@ apcore-cli [OPTIONS] COMMAND [ARGS]
 | `--log-level` | `WARNING` | Logging: `DEBUG`, `INFO`, `WARNING`, `ERROR` |
 | `--version` | | Show version and exit |
 | `--help` | | Show help and exit |
-| `--verbose` | | Show all options in help (including built-in apcore options) |
+| `--all-options` | | Show all options in help (including built-in options) |
 | `--man` | | Output man page in roff format (use with `--help`) |
 
 ### Built-in Commands (the `apcli` group)
@@ -235,12 +234,17 @@ The canonical 13 `apcli` subcommands:
 | `apcli init module <id>` | Scaffold a new module (TS/JS/YAML binding) into the extensions or commands directory (see `registerInitCommand` in `src/init-cmd.ts`) |
 | `apcli validate` | Validate modules and configuration against JSON Schema (see `registerValidateCommand` in `src/discovery.ts`) |
 
-**Shell integration**
+**Shell integration** (under `apcli` group)
 
 | Command | Description |
 |---------|-------------|
 | `apcli completion <shell>` | Generate shell completion script for bash / zsh / fish (see `registerCompletionCommand` in `src/shell.ts`) |
-| `man [command]` (root) | Generate a man page in roff format for a single command or the whole program (see `configureManHelp` in `src/shell.ts`). Stays at the root (meta-command). |
+
+**Root meta-commands** (NOT under `apcli` — invoked directly on the host CLI)
+
+| Command | Description |
+|---------|-------------|
+| `<cli> --help --man [command]` | Generate a man page in roff format for a single command or the whole program (see `configureManHelp` in `src/shell.ts`). This is a root-level option, not an `apcli` subcommand. |
 
 #### Standalone vs. embedded surfaces
 
@@ -251,14 +255,14 @@ The canonical 13 `apcli` subcommands:
 
 ### Module Execution Options
 
-When executing a module (e.g. `apcore-cli math.add`), these built-in options are available (hidden by default; use `--verbose` to show in `--help`):
+When executing a module (e.g. `apcore-cli math.add`), these built-in options are available (hidden by default; use `--all-options` to show in `--help`):
 
 | Option | Description |
 |--------|-------------|
 | `--input -` | Read JSON input from STDIN |
 | `--yes` / `-y` | Bypass approval prompts |
 | `--large-input` | Allow STDIN input larger than 10MB |
-| `--format <fmt>` | Output format: `json`, `table`, `csv`, `yaml`, or `jsonl` |
+| `--format <fmt>` | Output format: `json`, `table`, `csv`, `yaml`, `jsonl`, `markdown`, `skill`. **v0.9.0:** `csv` / `jsonl` are byte-identical across SDKs via `apcore-toolkit.formatCsv` / `formatJsonl`. Fixes the prior heterogeneous-keys data-loss bug (header was derived from first row only). |
 | `--sandbox` | Run module in a subprocess sandbox (re-exec with stripped env; 64MiB stdout/stderr cap; 300s default timeout). Hidden by default — set `APCORE_CLI_SANDBOX=1` to enable globally. |
 | `--dry-run` | Run preflight checks (schema, ACL, approval) without executing (FE-11) |
 | `--trace` | Emit execution pipeline trace (strategy, hooks, middleware timings) |

package/dist/bin/apcore-cli.js

@@ -35,6 +35,12 @@ function exitCodeForError(error) {
   if (error instanceof SchemaValidationError) {
     return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
   }
+  if (error instanceof MaxDepthExceededError || error instanceof CircularRefError) {
+    return EXIT_CODES.SCHEMA_CIRCULAR_REF;
+  }
+  if (error instanceof UnresolvableRefError) {
+    return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
+  }
   if (error instanceof ModuleNotFoundError) {
     return EXIT_CODES.MODULE_NOT_FOUND;
   }
@@ -74,7 +80,7 @@ function exitCodeForError(error) {
   }
   return EXIT_CODES.MODULE_EXECUTE_ERROR;
 }
-var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, ModuleNotFoundError, EXIT_CODES;
+var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, MaxDepthExceededError, CircularRefError, UnresolvableRefError, ModuleNotFoundError, EXIT_CODES;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -115,6 +121,24 @@ var init_errors = __esm({
         this.name = "SchemaValidationError";
       }
     };
+    MaxDepthExceededError = class extends Error {
+      constructor(message = "Schema $ref resolution depth exceeded") {
+        super(message);
+        this.name = "MaxDepthExceededError";
+      }
+    };
+    CircularRefError = class extends Error {
+      constructor(message = "Circular $ref detected in schema") {
+        super(message);
+        this.name = "CircularRefError";
+      }
+    };
+    UnresolvableRefError = class extends Error {
+      constructor(message = "Unresolvable $ref in schema") {
+        super(message);
+        this.name = "UnresolvableRefError";
+      }
+    };
     ModuleNotFoundError = class extends Error {
       constructor(message = "Module not found") {
         super(message);
@@ -155,6 +179,7 @@ var init_errors = __esm({
 var sandbox_exports = {};
 __export(sandbox_exports, {
   Sandbox: () => Sandbox,
+  _buildSandboxEnvForTesting: () => _buildSandboxEnvForTesting,
   runSandboxRunner: () => runSandboxRunner
 });
 import { spawn } from "child_process";
@@ -195,10 +220,13 @@ async function runSandboxRunner(moduleId) {
     process.exit(1);
   }
 }
+function _buildSandboxEnvForTesting(tmpDir) {
+  return buildSandboxEnv(tmpDir);
+}
 function buildSandboxEnv(tmpDir) {
   const env = {};
   for (const key of SANDBOX_ALLOW_KEYS) {
-    if (process.env[key]) env[key] = process.env[key];
+    if (process.env[key] !== void 0) env[key] = process.env[key];
   }
   for (const [key, val] of Object.entries(process.env)) {
     if (key.startsWith(SANDBOX_ALLOW_PREFIX) && !key.startsWith(SANDBOX_DENY_PREFIX) && !SANDBOX_DENY_KEYS.includes(key)) {
@@ -303,11 +331,20 @@ var init_sandbox = __esm({
           }
           stderr += chunk.toString();
         });
+        child.stdin.on("error", () => {
+        });
         child.stdin.write(JSON.stringify(inputData));
         child.stdin.end();
         return new Promise((resolve2, reject) => {
+          const cleanup = () => {
+            try {
+              rmSync(tmpDir, { recursive: true, force: true });
+            } catch {
+            }
+          };
           const timer = setTimeout(() => {
             child.kill("SIGKILL");
+            cleanup();
             reject(
               new ModuleExecutionError(
                 `Sandbox module '${moduleId}' timed out after ${this.timeoutSeconds}s.`
@@ -316,10 +353,7 @@ var init_sandbox = __esm({
           }, this.timeoutSeconds * 1e3);
           child.on("close", (code) => {
             clearTimeout(timer);
-            try {
-              rmSync(tmpDir, { recursive: true, force: true });
-            } catch {
-            }
+            cleanup();
             if (sizeExceeded) {
               const limitMiB = Math.floor(outputCap / (1024 * 1024));
               reject(new ModuleExecutionError(
@@ -343,6 +377,7 @@ var init_sandbox = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
+            cleanup();
             reject(new ModuleExecutionError(`Failed to spawn sandbox process: ${err.message}`));
           });
         });
@@ -375,27 +410,21 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
   if ("$ref" in obj) {
     const refPath = obj.$ref;
     if (depth >= maxDepth) {
-      process.stderr.write(
-        `Error: $ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.
-`
+      throw new MaxDepthExceededError(
+        `$ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     if (visited.has(refPath)) {
-      process.stderr.write(
-        `Error: Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.
-`
+      throw new CircularRefError(
+        `Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     const parts = refPath.split("/");
     const key = parts[parts.length - 1];
     if (!(key in defs)) {
-      process.stderr.write(
-        `Error: Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.
-`
+      throw new UnresolvableRefError(
+        `Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
     }
     const newVisited = new Set(visited);
     newVisited.add(refPath);
@@ -496,17 +525,12 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
       return merged;
     }
   }
-  if ("properties" in obj && typeof obj.properties === "object" && obj.properties !== null) {
-    const props = obj.properties;
-    for (const [propName, propSchema] of Object.entries(props)) {
-      props[propName] = resolveNode(
-        propSchema,
-        defs,
-        visited,
-        depth,
-        maxDepth,
-        moduleId
-      );
+  for (const [k, v] of Object.entries(obj)) {
+    if (k === "allOf" || k === "anyOf" || k === "oneOf" || k === "$ref") {
+      continue;
+    }
+    if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+      obj[k] = resolveNode(v, defs, visited, depth, maxDepth, moduleId);
     }
   }
   return obj;
@@ -703,7 +727,7 @@ var init_schema_parser = __esm({
       "format",
       "fields",
       "sandbox",
-      "verbose",
+      "all_options",
       "dry_run",
       "trace",
       "stream",
@@ -816,6 +840,14 @@ var init_approval = __esm({
       }
       async requestApproval(request) {
         const moduleId = request.module_id ?? "unknown";
+        if (request.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
+        const moduleDef = request.module_def;
+        const annotationsForCheck = moduleDef?.annotations;
+        if (annotationsForCheck && annotationsForCheck.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
         if (this.autoApprove) {
           return { status: "approved", approved_by: "auto_approve" };
         }
@@ -852,6 +884,7 @@ var init_approval = __esm({
 
 // src/output.ts
 import yaml from "js-yaml";
+import { formatCsv, formatJsonl } from "apcore-toolkit";
 function descriptorToScanned(m) {
   const metadata = m.metadata ?? {};
   const display = metadata["display"] ?? null;
@@ -872,11 +905,6 @@ function descriptorToScanned(m) {
     warnings: []
   };
 }
-function csvCellString(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "object") return JSON.stringify(value);
-  return String(value);
-}
 function resolveFormat(explicitFormat) {
   if (explicitFormat !== void 0) {
     return explicitFormat;
@@ -1079,30 +1107,18 @@ function formatExecResult(result, format, fields) {
   }
   const effective = resolveFormat(format);
   if (effective === "csv") {
-    if (typeof effective_result === "object" && !Array.isArray(effective_result) && effective_result !== null) {
-      const obj = effective_result;
-      const keys = Object.keys(obj);
-      const header = keys.map(escapeCsvField).join(",");
-      const row = keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      process.stdout.write(header + "\n" + row + "\n");
-    } else if (Array.isArray(effective_result) && effective_result.length > 0 && typeof effective_result[0] === "object") {
-      const keys = Object.keys(effective_result[0]);
-      const header = keys.map(escapeCsvField).join(",");
-      const rows = effective_result.map((item) => {
-        const obj = item;
-        return keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      });
-      process.stdout.write(header + "\n" + rows.join("\n") + "\n");
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatCsv(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
   } else if (effective === "yaml") {
     process.stdout.write(yaml.dump(effective_result, { lineWidth: -1 }));
   } else if (effective === "jsonl") {
-    if (Array.isArray(effective_result)) {
-      for (const item of effective_result) {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatJsonl(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
@@ -1119,11 +1135,19 @@ function formatExecResult(result, format, fields) {
     process.stdout.write(String(effective_result) + "\n");
   }
 }
-function escapeCsvField(value) {
-  if (value.includes(",") || value.includes('"') || value.includes("\n") || value.includes("\r")) {
-    return '"' + value.replace(/"/g, '""') + '"';
+function toRowsForTabular(value) {
+  if (value === null || value === void 0) return null;
+  if (Array.isArray(value)) {
+    if (value.length === 0) return null;
+    if (!value.every((item) => typeof item === "object" && item !== null && !Array.isArray(item))) {
+      return null;
+    }
+    return value;
+  }
+  if (typeof value === "object") {
+    return [value];
   }
-  return value;
+  return null;
 }
 function formatPreflightResult(result, format) {
   const resolved = resolveFormat(format);
@@ -1204,7 +1228,7 @@ var init_output = __esm({
     "use strict";
     init_esm_shims();
     init_errors();
-    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.6";
+    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.7";
   }
 });
 
@@ -1235,7 +1259,7 @@ function renderTemplate(template, context) {
   return result;
 }
 function registerInitCommand(cli) {
-  const initGroup = cli.command("init").description("Scaffold new apcore modules.");
+  const initGroup = cli.command("init").description("Scaffold new modules.");
   initGroup.command("module <module-id>").description("Create a new module from a template.\n\nMODULE_ID is the module identifier (e.g., ops.deploy, user.create).").option(
     "--style <style>",
     "Module style: decorator (@module), convention (plain function), or binding (YAML).",
@@ -1811,7 +1835,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
   s.push(".SH ENVIRONMENT");
   s.push(".TP");
   s.push("\\fBAPCORE_EXTENSIONS_ROOT\\fR");
-  s.push("Path to the apcore extensions directory.");
+  s.push("Path to the extensions directory.");
   s.push(".TP");
   s.push("\\fBAPCORE_CLI_AUTO_APPROVE\\fR");
   s.push("Set to \\fB1\\fR to bypass approval prompts.");
@@ -1836,7 +1860,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
 ${meaning}`);
   }
   s.push(".SH SEE ALSO");
-  s.push(`\\fB${progName} \\-\\-help \\-\\-verbose\\fR for full option list.`);
+  s.push(`\\fB${progName} \\-\\-help \\-\\-all\\-options\\fR for full option list.`);
   if (docsUrl2) {
     s.push(`.PP
 Full documentation at \\fI${roffEscape(docsUrl2)}\\fR`);
@@ -2243,7 +2267,7 @@ var init_config_encryptor = __esm({
           _ConfigEncryptor.weakFallbackWarned = true;
         }
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const material = `${hostname2}:${username}`;
         return crypto2.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, "sha256");
       }
@@ -2275,7 +2299,7 @@ var init_config_encryptor = __esm({
         const tag = data.subarray(12, 28);
         const ct = data.subarray(28);
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
         const materials = passphrase ? [passphrase, `${hostname2}:${username}`] : [`${hostname2}:${username}`];
         for (const material of materials) {
@@ -2305,10 +2329,26 @@ var init_auth = __esm({
     init_config_encryptor();
     AuthProvider = class {
       config;
-      encryptor;
+      _encryptor;
       constructor(config, encryptor) {
         this.config = config;
-        this.encryptor = encryptor ?? new ConfigEncryptor();
+        this._encryptor = encryptor;
+      }
+      /**
+       * Resolve the active ConfigEncryptor instance.
+       *
+       * D11-005 (2026-05-12): three-tier fallback chain matching Python's
+       * `_get_encryptor` (auth.py:33): explicit constructor arg > peer attribute
+       * `config.encryptor` (set by embedders injecting forced-AES test fixtures
+       * or shared instances) > fresh `new ConfigEncryptor()`. Previously TS
+       * skipped the peer-attribute tier, silently giving embedders a different
+       * encryptor than the one they wired on the config.
+       */
+      getEncryptor() {
+        if (this._encryptor) return this._encryptor;
+        const fromConfig = this.config.encryptor;
+        if (fromConfig) return fromConfig;
+        return new ConfigEncryptor();
       }
       /**
        * Retrieve the API key from the configured sources.
@@ -2326,11 +2366,11 @@ var init_auth = __esm({
         const strResult = String(result);
         if (strResult.startsWith("keyring:") || strResult.startsWith("enc:")) {
           try {
-            return await this.encryptor.retrieve(strResult, "auth.api_key");
+            return await this.getEncryptor().retrieve(strResult, "auth.api_key");
           } catch (err) {
             if (err instanceof ConfigDecryptionError) {
               throw new AuthenticationError(
-                "Failed to decrypt stored API key. Re-configure with 'apcore-cli config set auth.api_key'."
+                "Failed to decrypt stored API key. Re-store with 'apcli config set auth.api_key'."
               );
             }
             throw err;
@@ -2359,7 +2399,7 @@ var init_auth = __esm({
         }
         if (/[\r\n]/.test(key)) {
           throw new AuthenticationError(
-            "Malformed API key: contains invalid characters (CR/LF). Re-configure with 'apcore-cli config set auth.api_key'."
+            "Malformed API key: contains invalid characters (CR/LF). Re-store with 'apcli config set auth.api_key'."
           );
         }
         headers.Authorization = `Bearer ${key.trim()}`;
@@ -2581,7 +2621,7 @@ function registerExecCommand(apcliGroup, registry, executor) {
         return;
       }
       let result;
-      if (opts.strategy && executor.callWithTrace) {
+      if ((opts.trace || opts.strategy) && executor.callWithTrace) {
         const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });
         result = res;
       } else {
@@ -3697,6 +3737,7 @@ __export(main_exports, {
   reconvertEnumValues: () => reconvertEnumValues,
   resolveIntOption: () => resolveIntOption,
   resolveStringOption: () => resolveStringOption,
+  setAllOptionsHelp: () => setAllOptionsHelp,
   setDocsUrl: () => setDocsUrl,
   setVerboseHelp: () => setVerboseHelp,
   validateModuleId: () => validateModuleId
@@ -3705,14 +3746,17 @@ import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import * as path5 from "path";
 import { Command as Command5, CommanderError, Option as Option4 } from "commander";
+function setAllOptionsHelp(allOptions) {
+  verboseHelp = allOptions;
+}
 function setVerboseHelp(verbose) {
-  verboseHelp = verbose;
+  setAllOptionsHelp(verbose);
 }
 function setDocsUrl(url) {
   docsUrl = url;
 }
 function hasVerboseFlag() {
-  return process.argv.includes("--verbose");
+  return process.argv.includes("--all-options");
 }
 function resolveIntOption(cliValue, envValue, defaultValue) {
   if (cliValue !== void 0 && Number.isFinite(cliValue) && cliValue > 0) {
@@ -3787,7 +3831,7 @@ function emitErrorTty(e, exitCode) {
   Exit code: ${exitCode}
 `);
 }
-function createCli(extensionsDirOrOpts, progName, verbose = false) {
+function createCli(extensionsDirOrOpts, progName, allOptions = false) {
   let extensionsDir;
   let registry;
   let executor;
@@ -3802,7 +3846,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   if (typeof extensionsDirOrOpts === "object" && extensionsDirOrOpts !== null) {
     extensionsDir = extensionsDirOrOpts.extensionsDir;
     progName = extensionsDirOrOpts.progName ?? progName;
-    verbose = extensionsDirOrOpts.verbose ?? verbose;
+    allOptions = extensionsDirOrOpts.allOptions ?? extensionsDirOrOpts.verbose ?? allOptions;
     app = extensionsDirOrOpts.app;
     registry = extensionsDirOrOpts.registry;
     executor = extensionsDirOrOpts.executor;
@@ -3816,7 +3860,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   } else {
     extensionsDir = extensionsDirOrOpts;
   }
-  verboseHelp = verbose;
+  verboseHelp = allOptions;
   registerConfigNamespace();
   try {
     const auditLogger = new AuditLogger();
@@ -3849,7 +3893,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
     }
   }
   const registryInjected = registry !== void 0;
-  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--verbose", "Show all options in help output (including built-in options)");
+  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--all-options", "Show all options in help output (including built-in options)");
   if (appVersion) {
     program.version(appVersion, "-V, --version", "Print version");
   }
@@ -3920,7 +3964,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter);
   program.addHelpText("after", [
     "",
-    "Use --help --verbose to show all options (including built-in options).",
+    "Use --help --all-options to show all options (including built-in options).",
     "Use --help --man to display a formatted man page."
   ].join("\n"));
   configureManHelp(program, resolvedProgName, appVersion ?? VERSION);
@@ -3957,7 +4001,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
 function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter) {
   const emitUnwiredError = () => {
     process.stderr.write(
-      "Error: no apcore-js registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
+      "Error: no module registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
     );
     process.exit(EXIT_CODES.CONFIG_INVALID);
   };
@@ -4071,9 +4115,9 @@ function main(progName) {
   verboseHelp = hasVerboseFlag();
   const program = createCli({
     progName,
-    verbose: verboseHelp,
+    allOptions: verboseHelp,
     version: VERSION,
-    description: `${progName ?? "apcore-cli"} \u2014 execute apcore modules from the command line`
+    description: `${progName ?? "apcore-cli"} \u2014 execute modules from the command line`
   });
   try {
     program.parse(process.argv);
@@ -4101,7 +4145,17 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   if (inputSchema && typeof inputSchema === "object" && inputSchema.properties) {
     try {
       resolvedSchema = resolveRefs(inputSchema, 32, moduleId);
-    } catch {
+    } catch (err) {
+      if (err instanceof MaxDepthExceededError || err instanceof CircularRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
+      }
+      if (err instanceof UnresolvableRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
+      }
       resolvedSchema = inputSchema;
     }
     schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);
@@ -4146,7 +4200,7 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   cmd.addOption(approvalTokenOpt);
   const footerParts = [];
   if (!verbose) {
-    footerParts.push("Use --verbose to show all options (including built-in apcore options).");
+    footerParts.push("Use --all-options to show all options (including built-in options).");
   }
   if (docsUrl) {
     footerParts.push(`Docs: ${docsUrl}/commands/${effectiveCmdName}`);