fix(cli): read commander's camelCase keys for kebab-case flags

commander stores --code-file as opts.codeFile (kebab keys are never set),
so 'action update --code-file' silently no-opped (workflow.ts read
opts['code-file']) and 'auth token create --base-ids/--full-access'
never applied (auth.ts read the kebab keys). The 'action add' path was
unaffected because buildActionConfig's pick() checks both forms.

- workflow.ts action update: opts['code-file'] ?? opts.codeFile
- auth.ts token create: baseIds/fullAccess dual-form read
- verified live: action update --code-file now persists the new script
  (was silently keeping old code); commander dual-key behavior confirmed
  by direct parse (kebab keys absent, camelCase present, and this
  commander version drops the --base-ids VALUE entirely — the dual read
  covers both)

dist/commands/auth.js

@@ -95,16 +95,20 @@ function authCommand() {
         .option('--full-access', 'Grant full access')
         .option('--expires <date>', 'Expiry date YYYY-MM-DD (default 2099-12-31)', '2099-12-31')
         .action((0, ctx_1.run)(async (ctx, _args, o) => {
+        // commander stores --kebab-case flags camelCased (--base-ids ->
+        // opts.baseIds, --full-access -> opts.fullAccess); accept both.
         const opts = o;
         const scopes = opts.scopes.split(',').map((s) => s.trim()).filter(Boolean);
-        const baseIds = opts['base-ids']
+        const rawBaseIds = opts['base-ids'] ?? opts.baseIds;
-            ? opts['base-ids'].split(',').map((s) => s.trim())
+        const baseIds = rawBaseIds
+            ? rawBaseIds.split(',').map((s) => s.trim())
             : undefined;
+        const fullAccess = Boolean(opts['full-access'] ?? opts.fullAccess);
         const created = (await ctx.client.createAccessToken({
             name: opts.name,
             scopes,
             baseIds,
-            hasFullAccess: !!opts['full-access'],
+            hasFullAccess: fullAccess,
             expiredTime: opts.expires,
         }));
         if (ctx.json)

dist/commands/workflow.js

@@ -463,8 +463,11 @@ function actionCommand() {
         else {
             // Granular update: merge only the flags the user actually passed.
             config = { ...config };
-            if (opts.code !== undefined || opts['code-file'] !== undefined) {
+            // commander stores --kebab-case flags camelCased (--code-file ->
-                config.code = opts['code-file'] ? readFile(opts['code-file']) : opts.code;
+            // opts.codeFile); accept both forms like buildActionConfig's pick().
+            const codeFile = opts['code-file'] ?? opts.codeFile;
+            if (opts.code !== undefined || codeFile !== undefined) {
+                config.code = codeFile ? readFile(codeFile) : opts.code;
             }
             if (opts.timeout !== undefined)
                 config.timeout = Number(opts.timeout);

src/commands/auth.ts

@@ -107,16 +107,28 @@ export function authCommand(): Command {
     .option('--expires <date>', 'Expiry date YYYY-MM-DD (default 2099-12-31)', '2099-12-31')
     .action(
       run(async (ctx, _args, o) => {
-        const opts = o as { name: string; scopes: string; 'base-ids'?: string; 'full-access'?: boolean; expires: string };
+        // commander stores --kebab-case flags camelCased (--base-ids ->
+        // opts.baseIds, --full-access -> opts.fullAccess); accept both.
+        const opts = o as {
+          name: string;
+          scopes: string;
+          'base-ids'?: string;
+          baseIds?: string;
+          'full-access'?: boolean;
+          fullAccess?: boolean;
+          expires: string;
+        };
         const scopes = opts.scopes.split(',').map((s) => s.trim()).filter(Boolean);
-        const baseIds = opts['base-ids']
+        const rawBaseIds = opts['base-ids'] ?? opts.baseIds;
-          ? opts['base-ids'].split(',').map((s) => s.trim())
+        const baseIds = rawBaseIds
+          ? rawBaseIds.split(',').map((s) => s.trim())
           : undefined;
+        const fullAccess = Boolean(opts['full-access'] ?? opts.fullAccess);
         const created = (await ctx.client.createAccessToken({
           name: opts.name,
           scopes,
           baseIds,
-          hasFullAccess: !!opts['full-access'],
+          hasFullAccess: fullAccess,
           expiredTime: opts.expires,
         })) as { id: string; token: string };
         if (ctx.json) printJson(created);

src/commands/workflow.ts

@@ -523,8 +523,11 @@ export function actionCommand(): Command {
         else {
           // Granular update: merge only the flags the user actually passed.
           config = { ...config };
-          if (opts.code !== undefined || opts['code-file'] !== undefined) {
+          // commander stores --kebab-case flags camelCased (--code-file ->
-            config.code = opts['code-file'] ? readFile(opts['code-file']) : opts.code;
+          // opts.codeFile); accept both forms like buildActionConfig's pick().
+          const codeFile = opts['code-file'] ?? opts.codeFile;
+          if (opts.code !== undefined || codeFile !== undefined) {
+            config.code = codeFile ? readFile(codeFile) : opts.code;
           }
           if (opts.timeout !== undefined) config.timeout = Number(opts.timeout);
           if (opts.dependencies !== undefined) {