fix: honor --stream true for nullable request flags

[fallintoplace]

Problem

Ten streaming commands model the request field as requestflag.Flag[*bool] so they can represent unset, true, false, and null. The command branch used cli.Command.Bool, which only recognizes a concrete bool. As a result, passing --stream true still selected the non-streaming SDK method.

The two response retrieval commands use concrete boolean flags and are unaffected.

Fix

• add requestflag.FlagBool to read both bool and *bool values safely
• route all ten affected create, submit, edit, and generate handlers through it
• preserve nullable request serialization, including explicit null

Coverage

• unit coverage for concrete booleans, pointer booleans, nil, and unknown flags
• end-to-end SSE coverage for every affected command shape
• explicit --stream null coverage for the non-streaming path
• a held-open SSE response that verifies the rendered event arrives before the response completes

Validation

• ./scripts/test
• go test -race ./internal/requestflag ./pkg/cmd -run "^(TestFlagBool|TestNullableStreamFlags)$" -count=1
• go vet ./...
• ./scripts/lint

[markstuart-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T01:32:44.678723Z	ee56d7d	Manual request
🔒 Security Review	✅ Completed 2026-09-06T01:31:15.803431Z	ee56d7d	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: ee56d7d659

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee56d7d659

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Release the blocked handler before closing its server

If this subtest fails after the request reaches the channel receive—for example, due to the 15-second timeout or the JSON assertion—FailNow runs defers in LIFO order, so server.Close() executes before the earlier cleanup can close releaseResponse. Since httptest.Server.Close waits for active handlers and this handler remains blocked on <-releaseResponse, the test hangs until the outer CI timeout instead of reporting the failure. Arrange cleanup so the channel is closed before the server, or make the handler also select on the request context.

Useful? React with 👍 / 👎.