apcore-cli 0.8.1 → 0.9.1

package/dist/bin/apcore-cli.js

@@ -35,6 +35,12 @@ function exitCodeForError(error) {
   if (error instanceof SchemaValidationError) {
     return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
   }
+  if (error instanceof MaxDepthExceededError || error instanceof CircularRefError) {
+    return EXIT_CODES.SCHEMA_CIRCULAR_REF;
+  }
+  if (error instanceof UnresolvableRefError) {
+    return EXIT_CODES.SCHEMA_VALIDATION_ERROR;
+  }
   if (error instanceof ModuleNotFoundError) {
     return EXIT_CODES.MODULE_NOT_FOUND;
   }
@@ -74,7 +80,7 @@ function exitCodeForError(error) {
   }
   return EXIT_CODES.MODULE_EXECUTE_ERROR;
 }
-var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, ModuleNotFoundError, EXIT_CODES;
+var ApprovalTimeoutError, AuthenticationError, ConfigDecryptionError, ModuleExecutionError, ApprovalDeniedError, SchemaValidationError, MaxDepthExceededError, CircularRefError, UnresolvableRefError, ModuleNotFoundError, EXIT_CODES;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -110,11 +116,30 @@ var init_errors = __esm({
       }
     };
     SchemaValidationError = class extends Error {
+      code = "SCHEMA_VALIDATION_ERROR";
       constructor(message = "Schema validation failed") {
         super(message);
         this.name = "SchemaValidationError";
       }
     };
+    MaxDepthExceededError = class extends Error {
+      constructor(message = "Schema $ref resolution depth exceeded") {
+        super(message);
+        this.name = "MaxDepthExceededError";
+      }
+    };
+    CircularRefError = class extends Error {
+      constructor(message = "Circular $ref detected in schema") {
+        super(message);
+        this.name = "CircularRefError";
+      }
+    };
+    UnresolvableRefError = class extends Error {
+      constructor(message = "Unresolvable $ref in schema") {
+        super(message);
+        this.name = "UnresolvableRefError";
+      }
+    };
     ModuleNotFoundError = class extends Error {
       constructor(message = "Module not found") {
         super(message);
@@ -155,6 +180,7 @@ var init_errors = __esm({
 var sandbox_exports = {};
 __export(sandbox_exports, {
   Sandbox: () => Sandbox,
+  _buildSandboxEnvForTesting: () => _buildSandboxEnvForTesting,
   runSandboxRunner: () => runSandboxRunner
 });
 import { spawn } from "child_process";
@@ -195,10 +221,13 @@ async function runSandboxRunner(moduleId) {
     process.exit(1);
   }
 }
+function _buildSandboxEnvForTesting(tmpDir) {
+  return buildSandboxEnv(tmpDir);
+}
 function buildSandboxEnv(tmpDir) {
   const env = {};
   for (const key of SANDBOX_ALLOW_KEYS) {
-    if (process.env[key]) env[key] = process.env[key];
+    if (process.env[key] !== void 0) env[key] = process.env[key];
   }
   for (const [key, val] of Object.entries(process.env)) {
     if (key.startsWith(SANDBOX_ALLOW_PREFIX) && !key.startsWith(SANDBOX_DENY_PREFIX) && !SANDBOX_DENY_KEYS.includes(key)) {
@@ -303,11 +332,20 @@ var init_sandbox = __esm({
           }
           stderr += chunk.toString();
         });
+        child.stdin.on("error", () => {
+        });
         child.stdin.write(JSON.stringify(inputData));
         child.stdin.end();
         return new Promise((resolve2, reject) => {
+          const cleanup = () => {
+            try {
+              rmSync(tmpDir, { recursive: true, force: true });
+            } catch {
+            }
+          };
           const timer = setTimeout(() => {
             child.kill("SIGKILL");
+            cleanup();
             reject(
               new ModuleExecutionError(
                 `Sandbox module '${moduleId}' timed out after ${this.timeoutSeconds}s.`
@@ -316,10 +354,7 @@ var init_sandbox = __esm({
           }, this.timeoutSeconds * 1e3);
           child.on("close", (code) => {
             clearTimeout(timer);
-            try {
-              rmSync(tmpDir, { recursive: true, force: true });
-            } catch {
-            }
+            cleanup();
             if (sizeExceeded) {
               const limitMiB = Math.floor(outputCap / (1024 * 1024));
               reject(new ModuleExecutionError(
@@ -343,6 +378,7 @@ var init_sandbox = __esm({
           });
           child.on("error", (err) => {
             clearTimeout(timer);
+            cleanup();
             reject(new ModuleExecutionError(`Failed to spawn sandbox process: ${err.message}`));
           });
         });
@@ -375,27 +411,21 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
   if ("$ref" in obj) {
     const refPath = obj.$ref;
     if (depth >= maxDepth) {
-      process.stderr.write(
-        `Error: $ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.
-`
+      throw new MaxDepthExceededError(
+        `$ref resolution depth exceeded maximum of ${maxDepth} for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     if (visited.has(refPath)) {
-      process.stderr.write(
-        `Error: Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.
-`
+      throw new CircularRefError(
+        `Circular $ref detected in schema for module '${moduleId}' at path '${refPath}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
     }
     const parts = refPath.split("/");
     const key = parts[parts.length - 1];
     if (!(key in defs)) {
-      process.stderr.write(
-        `Error: Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.
-`
+      throw new UnresolvableRefError(
+        `Unresolvable $ref '${refPath}' in schema for module '${moduleId}'.`
       );
-      process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
     }
     const newVisited = new Set(visited);
     newVisited.add(refPath);
@@ -496,17 +526,12 @@ function resolveNode(node, defs, visited, depth, maxDepth, moduleId) {
       return merged;
     }
   }
-  if ("properties" in obj && typeof obj.properties === "object" && obj.properties !== null) {
-    const props = obj.properties;
-    for (const [propName, propSchema] of Object.entries(props)) {
-      props[propName] = resolveNode(
-        propSchema,
-        defs,
-        visited,
-        depth,
-        maxDepth,
-        moduleId
-      );
+  for (const [k, v] of Object.entries(obj)) {
+    if (k === "allOf" || k === "anyOf" || k === "oneOf" || k === "$ref") {
+      continue;
+    }
+    if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+      obj[k] = resolveNode(v, defs, visited, depth, maxDepth, moduleId);
     }
   }
   return obj;
@@ -703,7 +728,7 @@ var init_schema_parser = __esm({
       "format",
       "fields",
       "sandbox",
-      "verbose",
+      "all_options",
       "dry_run",
       "trace",
       "stream",
@@ -816,6 +841,14 @@ var init_approval = __esm({
       }
       async requestApproval(request) {
         const moduleId = request.module_id ?? "unknown";
+        if (request.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
+        const moduleDef = request.module_def;
+        const annotationsForCheck = moduleDef?.annotations;
+        if (annotationsForCheck && annotationsForCheck.requires_approval === false) {
+          return { status: "approved", approved_by: "not_required" };
+        }
         if (this.autoApprove) {
           return { status: "approved", approved_by: "auto_approve" };
         }
@@ -852,6 +885,7 @@ var init_approval = __esm({
 
 // src/output.ts
 import yaml from "js-yaml";
+import { formatCsv, formatJsonl } from "apcore-toolkit";
 function descriptorToScanned(m) {
   const metadata = m.metadata ?? {};
   const display = metadata["display"] ?? null;
@@ -872,11 +906,6 @@ function descriptorToScanned(m) {
     warnings: []
   };
 }
-function csvCellString(value) {
-  if (value === null || value === void 0) return "";
-  if (typeof value === "object") return JSON.stringify(value);
-  return String(value);
-}
 function resolveFormat(explicitFormat) {
   if (explicitFormat !== void 0) {
     return explicitFormat;
@@ -1079,30 +1108,18 @@ function formatExecResult(result, format, fields) {
   }
   const effective = resolveFormat(format);
   if (effective === "csv") {
-    if (typeof effective_result === "object" && !Array.isArray(effective_result) && effective_result !== null) {
-      const obj = effective_result;
-      const keys = Object.keys(obj);
-      const header = keys.map(escapeCsvField).join(",");
-      const row = keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      process.stdout.write(header + "\n" + row + "\n");
-    } else if (Array.isArray(effective_result) && effective_result.length > 0 && typeof effective_result[0] === "object") {
-      const keys = Object.keys(effective_result[0]);
-      const header = keys.map(escapeCsvField).join(",");
-      const rows = effective_result.map((item) => {
-        const obj = item;
-        return keys.map((k) => escapeCsvField(csvCellString(obj[k]))).join(",");
-      });
-      process.stdout.write(header + "\n" + rows.join("\n") + "\n");
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatCsv(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
   } else if (effective === "yaml") {
     process.stdout.write(yaml.dump(effective_result, { lineWidth: -1 }));
   } else if (effective === "jsonl") {
-    if (Array.isArray(effective_result)) {
-      for (const item of effective_result) {
-        process.stdout.write(JSON.stringify(item) + "\n");
-      }
+    const rows = toRowsForTabular(effective_result);
+    if (rows !== null) {
+      process.stdout.write(formatJsonl(rows));
     } else {
       process.stdout.write(JSON.stringify(effective_result) + "\n");
     }
@@ -1119,11 +1136,19 @@ function formatExecResult(result, format, fields) {
     process.stdout.write(String(effective_result) + "\n");
   }
 }
-function escapeCsvField(value) {
-  if (value.includes(",") || value.includes('"') || value.includes("\n") || value.includes("\r")) {
-    return '"' + value.replace(/"/g, '""') + '"';
+function toRowsForTabular(value) {
+  if (value === null || value === void 0) return null;
+  if (Array.isArray(value)) {
+    if (value.length === 0) return null;
+    if (!value.every((item) => typeof item === "object" && item !== null && !Array.isArray(item))) {
+      return null;
+    }
+    return value;
+  }
+  if (typeof value === "object") {
+    return [value];
   }
-  return value;
+  return null;
 }
 function formatPreflightResult(result, format) {
   const resolved = resolveFormat(format);
@@ -1204,7 +1229,7 @@ var init_output = __esm({
     "use strict";
     init_esm_shims();
     init_errors();
-    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.6";
+    TOOLKIT_MISSING_HINT = "The 'markdown' and 'skill' output formats require the apcore-toolkit peer dependency. Install with: npm install apcore-toolkit@^0.7";
   }
 });
 
@@ -1235,7 +1260,7 @@ function renderTemplate(template, context) {
   return result;
 }
 function registerInitCommand(cli) {
-  const initGroup = cli.command("init").description("Scaffold new apcore modules.");
+  const initGroup = cli.command("init").description("Scaffold new modules.");
   initGroup.command("module <module-id>").description("Create a new module from a template.\n\nMODULE_ID is the module identifier (e.g., ops.deploy, user.create).").option(
     "--style <style>",
     "Module style: decorator (@module), convention (plain function), or binding (YAML).",
@@ -1811,7 +1836,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
   s.push(".SH ENVIRONMENT");
   s.push(".TP");
   s.push("\\fBAPCORE_EXTENSIONS_ROOT\\fR");
-  s.push("Path to the apcore extensions directory.");
+  s.push("Path to the extensions directory.");
   s.push(".TP");
   s.push("\\fBAPCORE_CLI_AUTO_APPROVE\\fR");
   s.push("Set to \\fB1\\fR to bypass approval prompts.");
@@ -1836,7 +1861,7 @@ function buildProgramManPage(program, progName, version, description, docsUrl2)
 ${meaning}`);
   }
   s.push(".SH SEE ALSO");
-  s.push(`\\fB${progName} \\-\\-help \\-\\-verbose\\fR for full option list.`);
+  s.push(`\\fB${progName} \\-\\-help \\-\\-all\\-options\\fR for full option list.`);
   if (docsUrl2) {
     s.push(`.PP
 Full documentation at \\fI${roffEscape(docsUrl2)}\\fR`);
@@ -2243,7 +2268,7 @@ var init_config_encryptor = __esm({
           _ConfigEncryptor.weakFallbackWarned = true;
         }
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const material = `${hostname2}:${username}`;
         return crypto2.pbkdf2Sync(material, salt, PBKDF2_ITERATIONS, 32, "sha256");
       }
@@ -2275,7 +2300,7 @@ var init_config_encryptor = __esm({
         const tag = data.subarray(12, 28);
         const ct = data.subarray(28);
         const hostname2 = os3.hostname();
-        const username = process.env.USER ?? process.env.USERNAME ?? "unknown";
+        const username = process.env.USER ?? process.env.LOGNAME ?? process.env.USERNAME ?? "unknown";
         const passphrase = process.env.APCORE_CLI_CONFIG_PASSPHRASE;
         const materials = passphrase ? [passphrase, `${hostname2}:${username}`] : [`${hostname2}:${username}`];
         for (const material of materials) {
@@ -2305,10 +2330,26 @@ var init_auth = __esm({
     init_config_encryptor();
     AuthProvider = class {
       config;
-      encryptor;
+      _encryptor;
       constructor(config, encryptor) {
         this.config = config;
-        this.encryptor = encryptor ?? new ConfigEncryptor();
+        this._encryptor = encryptor;
+      }
+      /**
+       * Resolve the active ConfigEncryptor instance.
+       *
+       * D11-005 (2026-05-12): three-tier fallback chain matching Python's
+       * `_get_encryptor` (auth.py:33): explicit constructor arg > peer attribute
+       * `config.encryptor` (set by embedders injecting forced-AES test fixtures
+       * or shared instances) > fresh `new ConfigEncryptor()`. Previously TS
+       * skipped the peer-attribute tier, silently giving embedders a different
+       * encryptor than the one they wired on the config.
+       */
+      getEncryptor() {
+        if (this._encryptor) return this._encryptor;
+        const fromConfig = this.config.encryptor;
+        if (fromConfig) return fromConfig;
+        return new ConfigEncryptor();
       }
       /**
        * Retrieve the API key from the configured sources.
@@ -2326,11 +2367,11 @@ var init_auth = __esm({
         const strResult = String(result);
         if (strResult.startsWith("keyring:") || strResult.startsWith("enc:")) {
           try {
-            return await this.encryptor.retrieve(strResult, "auth.api_key");
+            return await this.getEncryptor().retrieve(strResult, "auth.api_key");
           } catch (err) {
             if (err instanceof ConfigDecryptionError) {
               throw new AuthenticationError(
-                "Failed to decrypt stored API key. Re-configure with 'apcore-cli config set auth.api_key'."
+                "Failed to decrypt stored API key. Re-store with 'apcli config set auth.api_key'."
               );
             }
             throw err;
@@ -2359,7 +2400,7 @@ var init_auth = __esm({
         }
         if (/[\r\n]/.test(key)) {
           throw new AuthenticationError(
-            "Malformed API key: contains invalid characters (CR/LF). Re-configure with 'apcore-cli config set auth.api_key'."
+            "Malformed API key: contains invalid characters (CR/LF). Re-store with 'apcli config set auth.api_key'."
           );
         }
         headers.Authorization = `Bearer ${key.trim()}`;
@@ -2581,7 +2622,7 @@ function registerExecCommand(apcliGroup, registry, executor) {
         return;
       }
       let result;
-      if (opts.strategy && executor.callWithTrace) {
+      if ((opts.trace || opts.strategy) && executor.callWithTrace) {
         const [res] = await executor.callWithTrace(moduleId, merged, { strategy: opts.strategy });
         result = res;
       } else {
@@ -3697,6 +3738,7 @@ __export(main_exports, {
   reconvertEnumValues: () => reconvertEnumValues,
   resolveIntOption: () => resolveIntOption,
   resolveStringOption: () => resolveStringOption,
+  setAllOptionsHelp: () => setAllOptionsHelp,
   setDocsUrl: () => setDocsUrl,
   setVerboseHelp: () => setVerboseHelp,
   validateModuleId: () => validateModuleId
@@ -3705,14 +3747,17 @@ import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import * as path5 from "path";
 import { Command as Command5, CommanderError, Option as Option4 } from "commander";
+function setAllOptionsHelp(allOptions) {
+  verboseHelp = allOptions;
+}
 function setVerboseHelp(verbose) {
-  verboseHelp = verbose;
+  setAllOptionsHelp(verbose);
 }
 function setDocsUrl(url) {
   docsUrl = url;
 }
 function hasVerboseFlag() {
-  return process.argv.includes("--verbose");
+  return process.argv.includes("--all-options");
 }
 function resolveIntOption(cliValue, envValue, defaultValue) {
   if (cliValue !== void 0 && Number.isFinite(cliValue) && cliValue > 0) {
@@ -3739,6 +3784,37 @@ function resolveStringOption(cliValue, envValue) {
   }
   return void 0;
 }
+function validateInputSchema(schema, input) {
+  const required = schema.required;
+  if (required && Array.isArray(required)) {
+    for (const field of required) {
+      const val = input[field];
+      if (val === null || val === void 0) {
+        return `'${field}' is required`;
+      }
+    }
+  }
+  const properties = schema.properties;
+  if (properties) {
+    for (const [field, propSchema] of Object.entries(properties)) {
+      const val = input[field];
+      if (val === null || val === void 0) continue;
+      const expectedType = propSchema.type;
+      if (!expectedType) continue;
+      const actualType = typeof val;
+      if (expectedType === "string" && actualType !== "string") {
+        return `'${field}' must be a string, got ${actualType}`;
+      }
+      if ((expectedType === "integer" || expectedType === "number") && actualType !== "number") {
+        return `'${field}' must be a number, got ${actualType}`;
+      }
+      if (expectedType === "boolean" && actualType !== "boolean") {
+        return `'${field}' must be a boolean, got ${actualType}`;
+      }
+    }
+  }
+  return null;
+}
 function emitErrorJson(e, exitCode) {
   const err = e instanceof Error ? e : new Error(String(e));
   const errRecord = err;
@@ -3787,7 +3863,7 @@ function emitErrorTty(e, exitCode) {
   Exit code: ${exitCode}
 `);
 }
-function createCli(extensionsDirOrOpts, progName, verbose = false) {
+function createCli(extensionsDirOrOpts, progName, allOptions = false) {
   let extensionsDir;
   let registry;
   let executor;
@@ -3802,7 +3878,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   if (typeof extensionsDirOrOpts === "object" && extensionsDirOrOpts !== null) {
     extensionsDir = extensionsDirOrOpts.extensionsDir;
     progName = extensionsDirOrOpts.progName ?? progName;
-    verbose = extensionsDirOrOpts.verbose ?? verbose;
+    allOptions = extensionsDirOrOpts.allOptions ?? extensionsDirOrOpts.verbose ?? allOptions;
     app = extensionsDirOrOpts.app;
     registry = extensionsDirOrOpts.registry;
     executor = extensionsDirOrOpts.executor;
@@ -3816,7 +3892,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   } else {
     extensionsDir = extensionsDirOrOpts;
   }
-  verboseHelp = verbose;
+  verboseHelp = allOptions;
   registerConfigNamespace();
   try {
     const auditLogger = new AuditLogger();
@@ -3849,7 +3925,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
     }
   }
   const registryInjected = registry !== void 0;
-  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--verbose", "Show all options in help output (including built-in options)");
+  const program = new Command5(resolvedProgName).exitOverride().helpOption("-h, --help", "Print help").addHelpCommand("help [command]", "Print this message or the help of the given subcommand(s)").description(appDescription ?? `${resolvedProgName} CLI`).option("--log-level <level>", "Logging level (DEBUG|INFO|WARNING|ERROR)", "WARNING").option("--all-options", "Show all options in help output (including built-in options)");
   if (appVersion) {
     program.version(appVersion, "-V, --version", "Print version");
   }
@@ -3920,7 +3996,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
   _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter);
   program.addHelpText("after", [
     "",
-    "Use --help --verbose to show all options (including built-in options).",
+    "Use --help --all-options to show all options (including built-in options).",
     "Use --help --man to display a formatted man page."
   ].join("\n"));
   configureManHelp(program, resolvedProgName, appVersion ?? VERSION);
@@ -3957,7 +4033,7 @@ function createCli(extensionsDirOrOpts, progName, verbose = false) {
 function _registerApcliSubcommands(apcliGroup, apcliCfg, registry, executor, exposureFilter) {
   const emitUnwiredError = () => {
     process.stderr.write(
-      "Error: no apcore-js registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
+      "Error: no module registry wired. In standalone mode, pass --extensions-dir <path> to enable module discovery.\n"
     );
     process.exit(EXIT_CODES.CONFIG_INVALID);
   };
@@ -4071,9 +4147,9 @@ function main(progName) {
   verboseHelp = hasVerboseFlag();
   const program = createCli({
     progName,
-    verbose: verboseHelp,
+    allOptions: verboseHelp,
     version: VERSION,
-    description: `${progName ?? "apcore-cli"} \u2014 execute apcore modules from the command line`
+    description: `${progName ?? "apcore-cli"} \u2014 execute modules from the command line`
   });
   try {
     program.parse(process.argv);
@@ -4101,7 +4177,17 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   if (inputSchema && typeof inputSchema === "object" && inputSchema.properties) {
     try {
       resolvedSchema = resolveRefs(inputSchema, 32, moduleId);
-    } catch {
+    } catch (err) {
+      if (err instanceof MaxDepthExceededError || err instanceof CircularRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_CIRCULAR_REF);
+      }
+      if (err instanceof UnresolvableRefError) {
+        process.stderr.write(`Error: ${err.message}
+`);
+        process.exit(EXIT_CODES.SCHEMA_VALIDATION_ERROR);
+      }
       resolvedSchema = inputSchema;
     }
     schemaOptions = schemaToCliOptions(resolvedSchema, helpTextMaxLength);
@@ -4146,7 +4232,7 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
   cmd.addOption(approvalTokenOpt);
   const footerParts = [];
   if (!verbose) {
-    footerParts.push("Use --verbose to show all options (including built-in apcore options).");
+    footerParts.push("Use --all-options to show all options (including built-in options).");
   }
   if (docsUrl) {
     footerParts.push(`Docs: ${docsUrl}/commands/${effectiveCmdName}`);
@@ -4242,6 +4328,12 @@ function buildModuleCommand(moduleDef, executor, helpTextMaxLength = 1e3, cmdNam
         }
         process.exit(preflight.valid ? 0 : firstFailedExitCode(preflight));
       }
+      if (resolvedSchema.properties) {
+        const validationErr = validateInputSchema(resolvedSchema, merged);
+        if (validationErr) {
+          throw new SchemaValidationError(`Validation failed: ${validationErr}`);
+        }
+      }
       if (approvalToken) {
         merged._approval_token = approvalToken;
       }