ref: Add cmdline.HideGlobalFlagsExcept() to clean up help.

Closes: veyron/release-issue#1905

---------- Example of new output ----------
$ vrpc
ERROR: vrpc: no command specified

Command vrpc sends and receives Vanadium remote procedure calls.

Usage:
vrpc <command>

The vrpc commands are:
signature   Describe the interfaces of a Vanadium server
call        Call a method of a Vanadium server
identify    Reveal blessings presented by a Vanadium server
help        Display help for commands or topics
Run "vrpc help [command]" for command usage.

Run "vrpc help -style=full" to show all global flags.
----------

This CL shortens the default cmdline usage output, so that you
have a chance at seeing the important parts before it scrolls off
the screen.  The main culprit for long output is our long list of
global flags.

By default, nothing has changed; all global flags are shown in
usage.  Calling cmdline.HideGlobalFlagsExcept() causes the
default behavior to hide global flags, except for the given
regexps.  This mechanism was chosen since it seems better to have
global flags shown if the developer doesn't do anything special,
but if they call the method it's easier to specify a whitelist
than a blacklist.

To show all global flags you use "help -style=full", or set the
envvar CMDLINE_STYLE=full for root commands with no subcommands.
When any global flags are hidden, the usage includes a line
desribing the exact command to run to get the full output.

The -style=godoc output always shows all global flags.

MultiPart: 3/3

Change-Id: Ib397adf220489b251bd0b03badd0199c24c7d4a0
diff --git a/cmd/gclogs/gclogs.go b/cmd/gclogs/gclogs.go
index 9160287..76cb946 100644
--- a/cmd/gclogs/gclogs.go
+++ b/cmd/gclogs/gclogs.go
@@ -44,6 +44,7 @@
 )
 
 func init() {
+	cmdline.HideGlobalFlagsExcept()
 	cmdGCLogs.Flags.DurationVar(&flagCutoff, "cutoff", 24*time.Hour, "The age cut-off for a log file to be considered for garbage collection.")
 	cmdGCLogs.Flags.StringVar(&flagProgname, "program", ".*", `A regular expression to apply to the program part of the log file name, e.g ".*test".`)
 	cmdGCLogs.Flags.BoolVar(&flagVerbose, "verbose", false, "If true, each deleted file is shown on stdout.")
diff --git a/cmd/mounttable/doc.go b/cmd/mounttable/doc.go
index 7d653ee..562e14d 100644
--- a/cmd/mounttable/doc.go
+++ b/cmd/mounttable/doc.go
@@ -17,9 +17,11 @@
    unmount     removes server <name> from the mount table
    resolvestep takes the next step in resolving a name.
    help        Display help for commands or topics
-Run "mounttable help [command]" for command usage.
 
 The global flags are:
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+
  -alsologtostderr=true
    log to standard error as well as files
  -log_backtrace_at=:0
@@ -38,8 +40,6 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
-   local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
    boundaries
@@ -59,7 +59,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Mounttable Glob
+Mounttable glob
 
 returns all matching entries in the mount table
 
@@ -70,7 +70,7 @@
 <pattern> is a glob pattern that is matched against all the entries below the
 specified mount name.
 
-Mounttable Mount
+Mounttable mount
 
 Mounts a server <name> onto a mount table
 
@@ -87,7 +87,7 @@
 [M|R] are mount options. M indicates that <name> is a mounttable. R indicates
 that existing entries should be removed.
 
-Mounttable Unmount
+Mounttable unmount
 
 removes server <name> from the mount table
 
@@ -97,7 +97,7 @@
 <mount name> is a mount name on a mount table. <name> is the rooted object name
 of the server.
 
-Mounttable Resolvestep
+Mounttable resolvestep
 
 takes the next step in resolving a name.
 
@@ -106,7 +106,7 @@
 
 <mount name> is a mount name on a mount table.
 
-Mounttable Help
+Mounttable help
 
 Help with no args displays the usage of the parent command.
 
@@ -114,11 +114,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    mounttable help [flags] [command/topic ...]
@@ -126,7 +125,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The mounttable help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/mounttable/impl.go b/cmd/mounttable/impl.go
index 6b851e0..8be675e 100644
--- a/cmd/mounttable/impl.go
+++ b/cmd/mounttable/impl.go
@@ -7,6 +7,7 @@
 import (
 	"errors"
 	"fmt"
+	"regexp"
 	"time"
 
 	"v.io/v23"
@@ -15,11 +16,14 @@
 	"v.io/v23/options"
 	"v.io/v23/rpc"
 	"v.io/v23/security"
-
 	"v.io/x/lib/cmdline"
 	"v.io/x/lib/vlog"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^v23\.namespace\.root$`))
+}
+
 var cmdGlob = &cmdline.Command{
 	Run:      runGlob,
 	Name:     "glob",
diff --git a/cmd/namespace/doc.go b/cmd/namespace/doc.go
index 9e25dbc..2f82af3 100644
--- a/cmd/namespace/doc.go
+++ b/cmd/namespace/doc.go
@@ -25,9 +25,11 @@
    permissions Manipulates permissions on an entry in the namespace
    delete      Deletes a name from the namespace
    help        Display help for commands or topics
-Run "namespace help [command]" for command usage.
 
 The global flags are:
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+
  -alsologtostderr=true
    log to standard error as well as files
  -log_backtrace_at=:0
@@ -46,8 +48,6 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
-   local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
    boundaries
@@ -67,7 +67,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Namespace Glob
+Namespace glob
 
 Returns all matching entries from the namespace.
 
@@ -81,7 +81,7 @@
  -l=false
    Long listing format.
 
-Namespace Mount
+Namespace mount
 
 Adds server <server> to the namespace with name <name>.
 
@@ -93,7 +93,7 @@
 followed by a unit suffix (s, m, h). A value of 0s represents an infinite
 duration.
 
-Namespace Unmount
+Namespace unmount
 
 Removes server <server> with name <name> from the namespace.
 
@@ -103,7 +103,7 @@
 <name> is the name to remove from the namespace. <server> is the object address
 of the server to remove.
 
-Namespace Resolve
+Namespace resolve
 
 Translates a object name to its object address(es).
 
@@ -117,7 +117,7 @@
    Insecure mode: May return results from untrusted servers and invoke Resolve
    on untrusted mounttables
 
-Namespace Resolvetomt
+Namespace resolvetomt
 
 Finds the address of the mounttable that holds an object name.
 
@@ -131,7 +131,7 @@
    Insecure mode: May return results from untrusted servers and invoke Resolve
    on untrusted mounttables
 
-Namespace Permissions
+Namespace permissions
 
 Commands to get and set the permissions on a name - controlling the blessing
 names required to resolve the name.
@@ -146,7 +146,7 @@
    get         Gets permissions on a mount name
    set         Sets permissions on a mount name
 
-Namespace Permissions Get
+Namespace permissions get
 
 Get retrieves the permissions on the usage of a name.
 
@@ -158,7 +158,7 @@
 
 <name> is a name in the namespace.
 
-Namespace Permissions Set
+Namespace permissions set
 
 Set replaces the permissions controlling usage of a mount name.
 
@@ -170,7 +170,7 @@
 <permissions> is the path to a file containing a JSON-encoded Permissions object
 (defined in v.io/v23/security/access/types.vdl), or "-" for STDIN.
 
-Namespace Delete
+Namespace delete
 
 Deletes a name from the namespace.
 
@@ -183,7 +183,7 @@
  -r=false
    Delete all children of the name in addition to the name itself.
 
-Namespace Help
+Namespace help
 
 Help with no args displays the usage of the parent command.
 
@@ -191,11 +191,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    namespace help [flags] [command/topic ...]
@@ -203,7 +202,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The namespace help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/namespace/impl.go b/cmd/namespace/impl.go
index 8f65e8e..9abaee2 100644
--- a/cmd/namespace/impl.go
+++ b/cmd/namespace/impl.go
@@ -8,6 +8,7 @@
 	"encoding/json"
 	"fmt"
 	"os"
+	"regexp"
 	"sort"
 	"time"
 
@@ -21,6 +22,10 @@
 	"v.io/x/lib/vlog"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^v23\.namespace\.root$`))
+}
+
 var (
 	flagLongGlob            bool
 	flagInsecureResolve     bool
diff --git a/cmd/principal/doc.go b/cmd/principal/doc.go
index 6ce390d..84f6ef4 100644
--- a/cmd/principal/doc.go
+++ b/cmd/principal/doc.go
@@ -29,7 +29,6 @@
    addtoroots    Add to the set of identity providers recognized by this
                  principal
    help          Display help for commands or topics
-Run "principal help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -76,7 +75,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Principal Create
+Principal create
 
 Creates a new principal with a single self-blessed blessing and writes it out to
 the provided directory. The same directory can then be used to set the
@@ -96,7 +95,7 @@
  -overwrite=false
    If true, any existing principal data in the directory will be overwritten
 
-Principal Fork
+Principal fork
 
 Creates a new principal with a blessing from the principal specified by the
 environment that this tool is running in, and writes it out to the provided
@@ -130,7 +129,7 @@
  -with=
    Path to file containing blessing to extend
 
-Principal Seekblessings
+Principal seekblessings
 
 Seeks blessings from a web-based Vanadium blesser which requires the caller to
 first authenticate with Google using OAuth. Simply run the command to see what
@@ -162,7 +161,7 @@
    If true, the blessings obtained will be set as the default blessing in the
    store
 
-Principal Recvblessings
+Principal recvblessings
 
 Allow another principal (likely a remote process) to bless this one.
 
@@ -213,7 +212,7 @@
    If true, the blessings received will be set as the default blessing in the
    store
 
-Principal Dump
+Principal dump
 
 Prints out information about the principal specified by the environment that
 this tool is running in.
@@ -225,7 +224,7 @@
  -s=false
    If true, show only the default blessing names
 
-Principal Dumpblessings
+Principal dumpblessings
 
 Prints out information about the blessings (typically obtained from this tool)
 encoded in the provided file.
@@ -236,7 +235,7 @@
 <file> is the path to a file containing blessings typically obtained from this
 tool. - is used for STDIN.
 
-Principal Blessself
+Principal blessself
 
 Returns a blessing with name <name> and self-signed by the principal specified
 by the environment that this tool is running in. Optionally, the blessing can be
@@ -256,7 +255,7 @@
  -for=0
    Duration of blessing validity (zero implies no expiration)
 
-Principal Bless
+Principal bless
 
 Bless another principal.
 
@@ -316,7 +315,7 @@
  -with=
    Path to file containing blessing to extend
 
-Principal Set
+Principal set
 
 Commands to mutate the blessings of the principal.
 
@@ -330,7 +329,7 @@
    default     Set provided blessings as default
    forpeer     Set provided blessings for peer
 
-Principal Set Default
+Principal set default
 
 Sets the provided blessings as default in the BlessingStore specified by the
 environment that this tool is running in.
@@ -349,7 +348,7 @@
    If true, the root certificate of the blessing will be added to the
    principal's set of recognized root certificates
 
-Principal Set Forpeer
+Principal set forpeer
 
 Marks the provided blessings to be shared with the provided peers on the
 BlessingStore specified by the environment that this tool is running in.
@@ -377,7 +376,7 @@
    If true, the root certificate of the blessing will be added to the
    principal's set of recognized root certificates
 
-Principal Get
+Principal get
 
 Commands to inspect the blessings of the principal.
 
@@ -394,7 +393,7 @@
    peermap         Shows the map from peer pattern to which blessing name to
                    present.
 
-Principal Get Default
+Principal get default
 
 Returns blessings that are marked as default in the BlessingStore specified by
 the environment that this tool is running in. Providing --names will print the
@@ -413,7 +412,7 @@
  -rootkey=
    Shows the value of the root key of the provided certificate chain name.
 
-Principal Get Forpeer
+Principal get forpeer
 
 Returns blessings that are marked for the provided peer in the BlessingStore
 specified by the environment that this tool is running in. Providing --names
@@ -438,7 +437,7 @@
  -rootkey=
    Shows the value of the root key of the provided certificate chain name.
 
-Principal Get Publickey
+Principal get publickey
 
 Prints out the public key of the principal specified by the environment that
 this tool is running in.
@@ -446,7 +445,7 @@
 Usage:
    principal get publickey
 
-Principal Get Recognizedroots
+Principal get recognizedroots
 
 Shows list of blessing names that the principal recognizes, and their associated
 public key. If the principal is operating as a client, contacted servers must
@@ -456,7 +455,7 @@
 Usage:
    principal get recognizedroots
 
-Principal Get Peermap
+Principal get peermap
 
 Shows the map from peer pattern to which blessing name to present. If the
 principal operates as a server, it presents its default blessing to all peers.
@@ -466,7 +465,7 @@
 Usage:
    principal get peermap
 
-Principal Addtoroots
+Principal addtoroots
 
 Adds an identity provider to the set of recognized roots public keys for this
 principal.
@@ -494,7 +493,7 @@
 
 <blessing pattern> is the blessing pattern for which <key> should be recognized.
 
-Principal Help
+Principal help
 
 Help with no args displays the usage of the parent command.
 
@@ -502,11 +501,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    principal help [flags] [command/topic ...]
@@ -514,7 +512,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The principal help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index 8cdc55a..5585be0 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -873,6 +873,7 @@
 }
 
 func main() {
+	cmdline.HideGlobalFlagsExcept()
 	cmdBlessSelf.Flags.Var(&flagBlessSelfCaveats, "caveat", flagBlessSelfCaveats.usage())
 	cmdBlessSelf.Flags.DurationVar(&flagBlessSelfFor, "for", 0, "Duration of blessing validity (zero implies no expiration)")
 
diff --git a/cmd/uniqueid/doc.go b/cmd/uniqueid/doc.go
index c494452..9ad2e59 100644
--- a/cmd/uniqueid/doc.go
+++ b/cmd/uniqueid/doc.go
@@ -16,7 +16,6 @@
    generate    Generates UniqueIds
    inject      Injects UniqueIds into existing files
    help        Display help for commands or topics
-Run "uniqueid help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -63,14 +62,14 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Uniqueid Generate
+Uniqueid generate
 
 Generates unique ids and outputs them to standard out.
 
 Usage:
    uniqueid generate
 
-Uniqueid Inject
+Uniqueid inject
 
 Injects UniqueIds into existing files. Strings of the form "$UNIQUEID$" will be
 replaced with generated ids.
@@ -80,7 +79,7 @@
 
 <filenames> List of files to inject unique ids into
 
-Uniqueid Help
+Uniqueid help
 
 Help with no args displays the usage of the parent command.
 
@@ -88,11 +87,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    uniqueid help [flags] [command/topic ...]
@@ -100,7 +98,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The uniqueid help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/uniqueid/main.go b/cmd/uniqueid/main.go
index ca89740..9cd2737 100644
--- a/cmd/uniqueid/main.go
+++ b/cmd/uniqueid/main.go
@@ -21,6 +21,7 @@
 )
 
 func main() {
+	cmdline.HideGlobalFlagsExcept()
 	os.Exit(cmdUniqueId.Main())
 }
 
diff --git a/cmd/vdl/doc.go b/cmd/vdl/doc.go
index 7d12ec5..f51b087 100644
--- a/cmd/vdl/doc.go
+++ b/cmd/vdl/doc.go
@@ -18,14 +18,12 @@
    audit       Check if any packages are stale and need generation
    list        List package and dependency info in transitive order
    help        Display help for commands or topics
-Run "vdl help [command]" for command usage.
 
 The vdl additional help topics are:
    packages    Description of package lists
    vdlpath     Description of VDLPATH environment variable
    vdlroot     Description of VDLROOT environment variable
    vdl.config  Description of vdl.config files
-Run "vdl help [topic]" for topic details.
 
 The vdl flags are:
  -exts=.vdl
@@ -39,7 +37,7 @@
  -vdl.config=vdl.config
    Basename of the optional per-package config file.
 
-Vdl Generate
+Vdl generate
 
 Generate compiles packages and their transitive dependencies, and generates code
 in the specified languages.
@@ -93,7 +91,7 @@
  -status=true
    Show package names as they are updated
 
-Vdl Compile
+Vdl compile
 
 Compile compiles packages and their transitive dependencies, but does not
 generate code.  This is useful to sanity-check that your VDL files are valid.
@@ -108,7 +106,7 @@
  -status=true
    Show package names while we compile
 
-Vdl Audit
+Vdl audit
 
 Audit runs the same logic as generate, but doesn't write out generated files.
 Returns a 0 exit code if all packages are up-to-date, otherwise returns a non-0
@@ -163,7 +161,7 @@
  -status=true
    Show package names as they are updated
 
-Vdl List
+Vdl list
 
 List returns information about packages and their transitive dependencies, in
 transitive order.  This is the same order the generate and compile commands use
@@ -182,7 +180,7 @@
 <packages> are a list of packages to process, similar to the standard go tool.
 For more information, run "vdl help packages".
 
-Vdl Help
+Vdl help
 
 Help with no args displays the usage of the parent command.
 
@@ -190,11 +188,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    vdl help [flags] [command/topic ...]
@@ -202,10 +199,14 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The vdl help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 
-Vdl Packages - help topic
+Vdl packages - help topic
 
 Most vdl commands apply to a list of packages:
 
@@ -233,7 +234,7 @@
  Run "vdl help vdlpath" to see docs on VDLPATH.
  Run "go help packages" to see the standard go package docs.
 
-Vdl Vdlpath - help topic
+Vdl vdlpath - help topic
 
 The VDLPATH environment variable is used to resolve import statements. It must
 be set to compile and generate vdl packages.
@@ -259,7 +260,7 @@
             baz/              (import "bar/baz" refers here)
                baz.vdl
 
-Vdl Vdlroot - help topic
+Vdl vdlroot - help topic
 
 The VDLROOT environment variable is similar to VDLPATH, but instead of pointing
 to multiple user source directories, it points at a single source directory
@@ -270,7 +271,7 @@
 If VDLROOT is empty, we try to construct it out of the V23_ROOT environment
 variable.  It is an error if both VDLROOT and V23_ROOT are empty.
 
-Vdl Vdl.Config - help topic
+Vdl vdl.config - help topic
 
 Each vdl source package P may contain an optional file "vdl.config" within the P
 directory.  This file specifies additional configuration for the vdl tool.
diff --git a/cmd/vom/doc.go b/cmd/vom/doc.go
index b25adef..4bdba37 100644
--- a/cmd/vom/doc.go
+++ b/cmd/vom/doc.go
@@ -15,7 +15,6 @@
    decode      Decode data encoded in the vom format
    dump        Dump data encoded in the vom format into formatted output
    help        Display help for commands or topics
-Run "vom help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -62,7 +61,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Vom Decode
+Vom decode
 
 Decode decodes data encoded in the vom format.  If no arguments are provided,
 decode reads the data from stdin, otherwise the argument is the data.
@@ -80,7 +79,7 @@
  -data=Hex
    Data representation, one of [Hex Binary]
 
-Vom Dump
+Vom dump
 
 Dump dumps data encoded in the vom format, generating formatted output
 describing each portion of the encoding.  If no arguments are provided, dump
@@ -110,7 +109,7 @@
  -data=Hex
    Data representation, one of [Hex Binary]
 
-Vom Help
+Vom help
 
 Help with no args displays the usage of the parent command.
 
@@ -118,11 +117,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    vom help [flags] [command/topic ...]
@@ -130,7 +128,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The vom help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/vom/vom.go b/cmd/vom/vom.go
index 16b5847..58d4fdc 100644
--- a/cmd/vom/vom.go
+++ b/cmd/vom/vom.go
@@ -25,6 +25,7 @@
 )
 
 func main() {
+	cmdline.HideGlobalFlagsExcept()
 	os.Exit(cmdVom.Main())
 }
 
diff --git a/cmd/vomtestgen/generate.go b/cmd/vomtestgen/generate.go
index cb53110..c4b67f9 100644
--- a/cmd/vomtestgen/generate.go
+++ b/cmd/vomtestgen/generate.go
@@ -62,6 +62,7 @@
 )
 
 func init() {
+	cmdline.HideGlobalFlagsExcept()
 	cmdGenerate.Flags.IntVar(&optGenMaxErrors, "max-errors", -1, "Stop processing after this many errors, or -1 for unlimited.")
 	cmdGenerate.Flags.StringVar(&optGenExts, "exts", ".vdl", "Comma-separated list of valid VDL file name extensions.")
 }
diff --git a/cmd/vrpc/doc.go b/cmd/vrpc/doc.go
index ff54449..aeaa638 100644
--- a/cmd/vrpc/doc.go
+++ b/cmd/vrpc/doc.go
@@ -17,9 +17,11 @@
    call        Call a method of a Vanadium server
    identify    Reveal blessings presented by a Vanadium server
    help        Display help for commands or topics
-Run "vrpc help [command]" for command usage.
 
 The global flags are:
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+
  -alsologtostderr=true
    log to standard error as well as files
  -log_backtrace_at=:0
@@ -38,8 +40,6 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
-   local namespace root; can be repeated to provided multiple roots
  -v23.proxy=
    object name of proxy service to use to export services across network
    boundaries
@@ -59,7 +59,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Vrpc Signature
+Vrpc signature
 
 Signature connects to the Vanadium server identified by <server>.
 
@@ -82,7 +82,7 @@
  -show-reserved=false
    if true, also show the signatures of reserved methods
 
-Vrpc Call
+Vrpc call
 
 Call connects to the Vanadium server identified by <server> and calls the
 <method> with the given positional [args...], returning results on stdout.
@@ -112,7 +112,7 @@
 
 [args...] are the positional input arguments, specified as VDL expressions.
 
-Vrpc Identify
+Vrpc identify
 
 Identify connects to the Vanadium server identified by <server> and dumps out
 the blessings presented by that server (and the subset of those that are
@@ -129,7 +129,7 @@
    If true, skip server authentication. This means that the client will reveal
    its blessings to servers that it may not recognize.
 
-Vrpc Help
+Vrpc help
 
 Help with no args displays the usage of the parent command.
 
@@ -137,11 +137,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    vrpc help [flags] [command/topic ...]
@@ -149,7 +148,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The vrpc help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/cmd/vrpc/vrpc.go b/cmd/vrpc/vrpc.go
index 590e02d..e540707 100644
--- a/cmd/vrpc/vrpc.go
+++ b/cmd/vrpc/vrpc.go
@@ -11,6 +11,7 @@
 	"fmt"
 	"io"
 	"os"
+	"regexp"
 	"strings"
 	"time"
 
@@ -37,6 +38,7 @@
 )
 
 func main() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^v23\.namespace\.root$`))
 	var shutdown v23.Shutdown
 	gctx, shutdown = v23.Init()
 	exitCode := cmdVRPC.Main()
diff --git a/cmd/vrun/vrun.go b/cmd/vrun/vrun.go
index cdfde06..92f707f 100644
--- a/cmd/vrun/vrun.go
+++ b/cmd/vrun/vrun.go
@@ -42,6 +42,7 @@
 }
 
 func main() {
+	cmdline.HideGlobalFlagsExcept()
 	syscall.CloseOnExec(3)
 	syscall.CloseOnExec(4)
 
diff --git a/profiles/internal/rpc/stress/mtstress/doc.go b/profiles/internal/rpc/stress/mtstress/doc.go
index 06d4714..f23772f 100644
--- a/profiles/internal/rpc/stress/mtstress/doc.go
+++ b/profiles/internal/rpc/stress/mtstress/doc.go
@@ -13,13 +13,18 @@
    mount       Measure latency of the Mount RPC at a fixed request rate
    resolve     Measure latency of the Resolve RPC at a fixed request rate
    help        Display help for commands or topics
-Run "mtstress help [command]" for command usage.
 
 The global flags are:
- -alsologtostderr=true
-   log to standard error as well as files
  -duration=10s
    Duration for sending test traffic and measuring latency
+ -rate=1
+   Rate, in RPCs per second, to send to the test server
+ -reauthenticate=false
+   If true, establish a new authenticated connection for each RPC, simulating
+   load from a distinct process
+
+ -alsologtostderr=true
+   log to standard error as well as files
  -log_backtrace_at=:0
    when logging hits line file:N, emit a stack trace
  -log_dir=
@@ -28,11 +33,6 @@
    log to standard error instead of files
  -max_stack_buf_size=4292608
    max size in bytes of the buffer to use for logging stack traces
- -rate=1
-   Rate, in RPCs per second, to send to the test server
- -reauthenticate=false
-   If true, establish a new authenticated connection for each RPC, simulating
-   load from a distinct process
  -stderrthreshold=2
    logs at or above this threshold go to stderr
  -v=0
@@ -62,7 +62,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Mtstress Mount
+Mtstress mount
 
 Repeatedly issues a Mount request (at --rate) and measures latency
 
@@ -74,7 +74,7 @@
 <ttl> specfies the time-to-live of the mount point. For example: 5s for 5
 seconds, 1m for 1 minute etc. Valid time units are "ms", "s", "m", "h".
 
-Mtstress Resolve
+Mtstress resolve
 
 Repeatedly issues a Resolve request (at --rate) to a name and measures latency
 
@@ -83,7 +83,7 @@
 
 <name> the object name to resolve
 
-Mtstress Help
+Mtstress help
 
 Help with no args displays the usage of the parent command.
 
@@ -91,11 +91,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    mtstress help [flags] [command/topic ...]
@@ -103,7 +102,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The mtstress help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/profiles/internal/rpc/stress/mtstress/main.go b/profiles/internal/rpc/stress/mtstress/main.go
index f067e93..5c0a8b9 100644
--- a/profiles/internal/rpc/stress/mtstress/main.go
+++ b/profiles/internal/rpc/stress/mtstress/main.go
@@ -11,6 +11,7 @@
 	"flag"
 	"net"
 	"os"
+	"regexp"
 	"time"
 
 	"v.io/v23"
@@ -18,11 +19,14 @@
 	"v.io/v23/naming"
 	"v.io/v23/options"
 	"v.io/v23/verror"
-
 	"v.io/x/lib/cmdline"
 	_ "v.io/x/ref/profiles"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^(rate)|(duration)|(reauthenticate)$`))
+}
+
 var (
 	gctx *context.T
 
diff --git a/services/application/application/doc.go b/services/application/application/doc.go
index 491f801..d0bca56 100644
--- a/services/application/application/doc.go
+++ b/services/application/application/doc.go
@@ -18,7 +18,6 @@
    remove      removes the application envelope for the given profile.
    edit        edits the application envelope for the given profile.
    help        Display help for commands or topics
-Run "application help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -60,7 +59,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Application Match
+Application match
 
 Shows the first matching envelope that matches the given profiles.
 
@@ -70,7 +69,7 @@
 <application> is the full name of the application. <profiles> is a
 comma-separated list of profiles.
 
-Application Put
+Application put
 
 Add the given envelope to the application for the given profiles.
 
@@ -82,7 +81,7 @@
 JSON-encoded envelope. If this file is not provided, the user will be prompted
 to enter the data manually.
 
-Application Remove
+Application remove
 
 removes the application envelope for the given profile.
 
@@ -91,7 +90,7 @@
 
 <application> is the full name of the application. <profile> is a profile.
 
-Application Edit
+Application edit
 
 edits the application envelope for the given profile.
 
@@ -100,7 +99,7 @@
 
 <application> is the full name of the application. <profile> is a profile.
 
-Application Help
+Application help
 
 Help with no args displays the usage of the parent command.
 
@@ -108,11 +107,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    application help [flags] [command/topic ...]
@@ -120,7 +118,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The application help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/application/application/impl.go b/services/application/application/impl.go
index de18364..448661e 100644
--- a/services/application/application/impl.go
+++ b/services/application/application/impl.go
@@ -21,6 +21,10 @@
 	"v.io/x/ref/services/repository"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept()
+}
+
 func getEnvelopeJSON(app repository.ApplicationClientMethods, profiles string) ([]byte, error) {
 	ctx, cancel := context.WithTimeout(gctx, time.Minute)
 	defer cancel()
diff --git a/services/binary/binary/doc.go b/services/binary/binary/doc.go
index be451bf..9714180 100644
--- a/services/binary/binary/doc.go
+++ b/services/binary/binary/doc.go
@@ -17,7 +17,6 @@
    upload      Upload a binary or directory archive
    url         Fetch a download URL
    help        Display help for commands or topics
-Run "binary help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -59,7 +58,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Binary Delete
+Binary delete
 
 Delete connects to the binary repository and deletes the specified binary
 
@@ -68,7 +67,7 @@
 
 <von> is the vanadium object name of the binary to delete
 
-Binary Download
+Binary download
 
 Download connects to the binary repository, downloads the specified binary, and
 writes it to a file.
@@ -79,7 +78,7 @@
 <von> is the vanadium object name of the binary to download <filename> is the
 name of the file where the binary will be written
 
-Binary Upload
+Binary upload
 
 Upload connects to the binary repository and uploads the binary of the specified
 file or archive of the specified directory. When successful, it writes the name
@@ -91,7 +90,7 @@
 <von> is the vanadium object name of the binary to upload <filename> is the name
 of the file or directory to upload
 
-Binary Url
+Binary url
 
 Connect to the binary repository and fetch the download URL for the given
 vanadium object name.
@@ -101,7 +100,7 @@
 
 <von> is the vanadium object name of the binary repository
 
-Binary Help
+Binary help
 
 Help with no args displays the usage of the parent command.
 
@@ -109,11 +108,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    binary help [flags] [command/topic ...]
@@ -121,7 +119,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The binary help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/binary/binary/impl.go b/services/binary/binary/impl.go
index 75e80b4..a86ede8 100644
--- a/services/binary/binary/impl.go
+++ b/services/binary/binary/impl.go
@@ -12,6 +12,10 @@
 	"v.io/x/ref/services/internal/binarylib"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept()
+}
+
 var cmdDelete = &cmdline.Command{
 	Run:      runDelete,
 	Name:     "delete",
diff --git a/services/build/build/doc.go b/services/build/build/doc.go
index 2952467..2fa4527 100644
--- a/services/build/build/doc.go
+++ b/services/build/build/doc.go
@@ -14,7 +14,6 @@
 The build commands are:
    build       Build vanadium Go packages
    help        Display help for commands or topics
-Run "build help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -56,7 +55,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Build Build
+Build build
 
 Build vanadium Go packages using a remote build server. The command collects all
 source code files that are not part of the Go standard library that the target
@@ -78,7 +77,7 @@
  -os=<runtime.GOOS>
    Target operating system.  The default is the value of runtime.GOOS.
 
-Build Help
+Build help
 
 Help with no args displays the usage of the parent command.
 
@@ -86,11 +85,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    build help [flags] [command/topic ...]
@@ -98,7 +96,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The build help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/build/build/impl.go b/services/build/build/impl.go
index 8f96f38..f9b6e7f 100644
--- a/services/build/build/impl.go
+++ b/services/build/build/impl.go
@@ -25,6 +25,7 @@
 )
 
 func init() {
+	cmdline.HideGlobalFlagsExcept()
 	cmdBuild.Flags.StringVar(&flagArch, "arch", runtime.GOARCH, "Target architecture.  The default is the value of runtime.GOARCH.")
 	cmdBuild.Flags.Lookup("arch").DefValue = "<runtime.GOARCH>"
 	cmdBuild.Flags.StringVar(&flagOS, "os", runtime.GOOS, "Target operating system.  The default is the value of runtime.GOOS.")
diff --git a/services/debug/debug/doc.go b/services/debug/debug/doc.go
index 7034069..42eaf67 100644
--- a/services/debug/debug/doc.go
+++ b/services/debug/debug/doc.go
@@ -18,7 +18,6 @@
    stats       Accesses stats
    pprof       Accesses profiling data
    help        Display help for commands or topics
-Run "debug help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -60,7 +59,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Debug Glob
+Debug glob
 
 Returns all matching entries from the namespace.
 
@@ -69,7 +68,7 @@
 
 <pattern> is a glob pattern to match.
 
-Debug Vtrace
+Debug vtrace
 
 Returns matching vtrace traces (or all stored traces if no ids are given).
 
@@ -78,7 +77,7 @@
 
 <name> is the name of a vtrace object. [id] is a vtrace trace id.
 
-Debug Logs
+Debug logs
 
 Accesses log files
 
@@ -89,7 +88,7 @@
    read        Reads the content of a log file object.
    size        Returns the size of a log file object.
 
-Debug Logs Read
+Debug logs read
 
 Reads the content of a log file object.
 
@@ -109,7 +108,7 @@
  -v=false
    When true, read will be more verbose.
 
-Debug Logs Size
+Debug logs size
 
 Returns the size of a log file object.
 
@@ -118,7 +117,7 @@
 
 <name> is the name of the log file object.
 
-Debug Stats
+Debug stats
 
 Accesses stats
 
@@ -130,7 +129,7 @@
    watch       Returns a stream of all matching entries and their values as they
                change.
 
-Debug Stats Read
+Debug stats read
 
 Returns the value of stats objects.
 
@@ -146,7 +145,7 @@
  -type=false
    When true, the type of the values will be displayed.
 
-Debug Stats Watch
+Debug stats watch
 
 Returns a stream of all matching entries and their values as they change.
 
@@ -161,7 +160,7 @@
  -type=false
    When true, the type of the values will be displayed.
 
-Debug Pprof
+Debug pprof
 
 Accesses profiling data
 
@@ -172,7 +171,7 @@
    run         Runs the pprof tool.
    proxy       Runs an http proxy to a pprof object.
 
-Debug Pprof Run
+Debug pprof run
 
 Runs the pprof tool.
 
@@ -190,7 +189,7 @@
  -pprofcmd=v23 go tool pprof
    The pprof command to use.
 
-Debug Pprof Proxy
+Debug pprof proxy
 
 Runs an http proxy to a pprof object.
 
@@ -199,7 +198,7 @@
 
 <name> is the name of the pprof object.
 
-Debug Help
+Debug help
 
 Help with no args displays the usage of the parent command.
 
@@ -207,11 +206,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    debug help [flags] [command/topic ...]
@@ -219,7 +217,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The debug help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/debug/debug/impl.go b/services/debug/debug/impl.go
index 14873ea..464faf9 100644
--- a/services/debug/debug/impl.go
+++ b/services/debug/debug/impl.go
@@ -42,6 +42,8 @@
 )
 
 func init() {
+	cmdline.HideGlobalFlagsExcept()
+
 	// logs read flags
 	cmdLogsRead.Flags.BoolVar(&follow, "f", false, "When true, read will wait for new log entries when it reaches the end of the file.")
 	cmdLogsRead.Flags.BoolVar(&verbose, "v", false, "When true, read will be more verbose.")
diff --git a/services/device/device/doc.go b/services/device/device/doc.go
index fd9111e..cd1ba14 100644
--- a/services/device/device/doc.go
+++ b/services/device/device/doc.go
@@ -31,9 +31,14 @@
    acl           Tool for setting device manager Permissions
    publish       Publish the given application(s).
    help          Display help for commands or topics
-Run "device help [command]" for command usage.
 
 The global flags are:
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+
  -alsologtostderr=true
    log to standard error as well as files
  -dryrun=false
@@ -68,16 +73,11 @@
    directory to use for storing security credentials
  -v23.i18n-catalogue=
    18n catalogue files to load, comma separated
- -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
-   local namespace root; can be repeated to provided multiple roots
  -v23.permissions.file=map[]
    specify a perms file as <name>:<permsfile>
  -v23.permissions.literal=
    explicitly specify the runtime perms as a JSON-encoded access.Permissions.
    Overrides all --v23.permissions.file flags.
- -v23.proxy=
-   object name of proxy service to use to export services across network
-   boundaries
  -v23.tcp.address=
    address to listen on
  -v23.tcp.protocol=wsh
@@ -96,7 +96,7 @@
  -workspace=
    Path to the application's workspace directory.
 
-Device Install
+Device install
 
 Install the given application and print the name of the new installation.
 
@@ -115,7 +115,7 @@
    JSON-encoded application.Packages object, of the form:
    '{"pkg1":{"File":"object name 1"},"pkg2":{"File":"object name 2"}}'
 
-Device Install-Local
+Device install-local
 
 Install the given application specified using a local path, and print the name
 of the new installation.
@@ -140,7 +140,7 @@
    JSON-encoded application.Packages object, of the form:
    '{"pkg1":{"File":"local file path1"},"pkg2":{"File":"local file path 2"}}'
 
-Device Uninstall
+Device uninstall
 
 Uninstall the given application installation.
 
@@ -150,7 +150,7 @@
 <installation> is the vanadium object name of the application installation to
 uninstall.
 
-Device Associate
+Device associate
 
 The associate tool facilitates managing blessing to system account associations.
 
@@ -162,7 +162,7 @@
    add         Add the listed blessings with the specified system account.
    remove      Removes system accounts associated with the listed blessings.
 
-Device Associate List
+Device associate list
 
 Lists all account associations.
 
@@ -171,7 +171,7 @@
 
 <devicemanager> is the name of the device manager to connect to.
 
-Device Associate Add
+Device associate add
 
 Add the listed blessings with the specified system account.
 
@@ -182,7 +182,7 @@
 the name of an account holder on the local system. <blessing>.. are the
 blessings to associate systemAccount with.
 
-Device Associate Remove
+Device associate remove
 
 Removes system accounts associated with the listed blessings.
 
@@ -192,7 +192,7 @@
 <devicemanager> is the name of the device manager to connect to. <blessing>...
 is a list of blessings.
 
-Device Describe
+Device describe
 
 Describe the device.
 
@@ -201,7 +201,7 @@
 
 <device> is the vanadium object name of the device manager's device service.
 
-Device Claim
+Device claim
 
 Claim the device.
 
@@ -219,7 +219,7 @@
 <device publickey> is the marshalled public key of the device manager we are
 claiming.
 
-Device Instantiate
+Device instantiate
 
 Create an instance of the given application, provide it with a blessing, and
 print the name of the new instance.
@@ -233,7 +233,7 @@
 <grant extension> is used to extend the default blessing of the current
 principal when blessing the app instance.
 
-Device Delete
+Device delete
 
 Delete the given application instance.
 
@@ -243,7 +243,7 @@
 <app instance> is the vanadium object name of the application instance to
 delete.
 
-Device Run
+Device run
 
 Run the given application instance.
 
@@ -252,7 +252,7 @@
 
 <app instance> is the vanadium object name of the application instance to run.
 
-Device Kill
+Device kill
 
 Kill the given application instance.
 
@@ -261,7 +261,7 @@
 
 <app instance> is the vanadium object name of the application instance to kill.
 
-Device Revert
+Device revert
 
 Revert the device manager or application to its previous version
 
@@ -271,7 +271,7 @@
 <object> is the vanadium object name of the device manager or application
 installation to revert.
 
-Device Update
+Device update
 
 Update the device manager or application
 
@@ -281,7 +281,7 @@
 <object> is the vanadium object name of the device manager or application
 installation or instance to update.
 
-Device Updateall
+Device updateall
 
 Given a name that can refer to an app instance or app installation or app or all
 apps on a device, updates all installations and instances under that name
@@ -301,7 +301,7 @@
 
 <devicename>/apps: updates all apps on the device
 
-Device Status
+Device status
 
 Get the status of an application installation or instance.
 
@@ -310,7 +310,7 @@
 
 <app name> is the vanadium object name of an app installation or instance.
 
-Device Debug
+Device debug
 
 Debug the device.
 
@@ -319,7 +319,7 @@
 
 <app name> is the vanadium object name of an app installation or instance.
 
-Device Acl
+Device acl
 
 The acl tool manages Permissions on the device manger, installations and
 instances.
@@ -331,7 +331,7 @@
    get         Get Permissions for the given target.
    set         Set Permissions for the given target.
 
-Device Acl Get
+Device acl get
 
 Get Permissions for the given target.
 
@@ -341,7 +341,7 @@
 <device manager name> can be a Vanadium name for a device manager, application
 installation or instance.
 
-Device Acl Set
+Device acl set
 
 Set Permissions for the given target
 
@@ -371,7 +371,7 @@
    Instead of making the AccessLists additive, do a complete replacement based
    on the specified settings.
 
-Device Publish
+Device publish
 
 Publishes the given application(s) to the binary and application servers. The
 binaries should be in $V23_ROOT/release/go/bin/[<GOOS>_<GOARCH>]. The binary is
@@ -395,7 +395,7 @@
    If non-empty, comma-separated blessing patterns to add to Read and Resolve
    AccessList.
 
-Device Help
+Device help
 
 Help with no args displays the usage of the parent command.
 
@@ -403,11 +403,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    device help [flags] [command/topic ...]
@@ -415,7 +414,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The device help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/device/device/main.go b/services/device/device/main.go
index 46c85c4..b523dbc 100644
--- a/services/device/device/main.go
+++ b/services/device/device/main.go
@@ -9,13 +9,15 @@
 
 import (
 	"os"
+	"regexp"
 
 	"v.io/v23"
-
+	"v.io/x/lib/cmdline"
 	_ "v.io/x/ref/profiles/static"
 )
 
 func main() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^(v23\.namespace\.root)|(v23\.proxy)$`))
 	gctx, shutdown := v23.Init()
 	SetGlobalContext(gctx)
 	exitCode := Root().Main()
diff --git a/services/device/deviced/doc.go b/services/device/deviced/doc.go
new file mode 100644
index 0000000..567ed5c
--- /dev/null
+++ b/services/device/deviced/doc.go
@@ -0,0 +1,200 @@
+// Copyright 2015 The Vanadium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// This file was auto-generated via go generate.
+// DO NOT UPDATE MANUALLY
+
+/*
+Command deviced is used to launch, configure and manage the deviced daemon,
+which implements the v.io/v23/services/device interfaces.
+
+Usage:
+   deviced <command>
+   deviced
+
+The deviced commands are:
+   install     Install the device manager.
+   uninstall   Uninstall the device manager.
+   start       Start the device manager.
+   stop        Stop the device manager.
+   profile     Dumps profile for the device manager.
+   help        Display help for commands or topics
+
+The global flags are:
+ -deviced-port=0
+   the port number of assign to the device manager service. The hostname/IP
+   address part of --v23.tcp.address is used along with this port. By default,
+   the port is assigned by the OS.
+ -name=
+   name to publish the device manager at
+ -neighborhood-name=
+   if provided, it will enable sharing with the local neighborhood with the
+   provided name. The address of the local mounttable will be published to the
+   neighboorhood and everything in the neighborhood will be visible on the local
+   mounttable.
+ -proxy-port=0
+   the port number to assign to the proxy service. 0 means no proxy service.
+ -restart-exit-code=0
+   exit code to return when device manager should be restarted
+ -use-pairing-token=false
+   generate a pairing token for the device manager that will need to be provided
+   when a device is claimed
+
+ -alsologtostderr=true
+   log to standard error as well as files
+ -dryrun=false
+   Elides root-requiring systemcalls.
+ -kill=false
+   Kill process ids given as command-line arguments.
+ -log_backtrace_at=:0
+   when logging hits line file:N, emit a stack trace
+ -log_dir=
+   if non-empty, write log files to this directory
+ -logdir=
+   Path to the log directory.
+ -logtostderr=false
+   log to standard error instead of files
+ -max_stack_buf_size=4292608
+   max size in bytes of the buffer to use for logging stack traces
+ -minuid=501
+   UIDs cannot be less than this number.
+ -progname=unnamed_app
+   Visible name of the application, used in argv[0]
+ -rm=false
+   Remove the file trees given as command-line arguments.
+ -run=
+   Path to the application to exec.
+ -stderrthreshold=2
+   logs at or above this threshold go to stderr
+ -username=
+   The UNIX user name used for the other functions of this tool.
+ -v=0
+   log level for V logs
+ -v23.credentials=
+   directory to use for storing security credentials
+ -v23.i18n-catalogue=
+   18n catalogue files to load, comma separated
+ -v23.namespace.root=[/(dev.v.io/role/vprod/service/mounttabled)@ns.dev.v.io:8101]
+   local namespace root; can be repeated to provided multiple roots
+ -v23.permissions.file=map[]
+   specify a perms file as <name>:<permsfile>
+ -v23.permissions.literal=
+   explicitly specify the runtime perms as a JSON-encoded access.Permissions.
+   Overrides all --v23.permissions.file flags.
+ -v23.proxy=
+   object name of proxy service to use to export services across network
+   boundaries
+ -v23.tcp.address=
+   address to listen on
+ -v23.tcp.protocol=wsh
+   protocol to listen with
+ -v23.vtrace.cache-size=1024
+   The number of vtrace traces to store in memory.
+ -v23.vtrace.collect-regexp=
+   Spans and annotations that match this regular expression will trigger trace
+   collection.
+ -v23.vtrace.dump-on-shutdown=true
+   If true, dump all stored traces on runtime shutdown.
+ -v23.vtrace.sample-rate=0
+   Rate (from 0.0 to 1.0) to sample vtrace traces.
+ -vmodule=
+   comma-separated list of pattern=N settings for file-filtered logging
+ -workspace=
+   Path to the application's workspace directory.
+
+Deviced install
+
+Performs installation of device manager into V23_DEVICE_DIR (if the env var
+set), or into the current dir otherwise
+
+Usage:
+   deviced install [flags] [-- <arguments for device manager>]
+
+Arguments to be passed to the installed device manager
+
+The deviced install flags are:
+ -agent=
+   path to security agent
+ -devuser=
+   if specified, device manager will run as this user. Provided by devicex but
+   ignored .
+ -from=
+   if specified, performs the installation from the provided application
+   envelope object name
+ -init_helper=
+   path to sysinit helper
+ -init_mode=false
+   if set, installs the device manager with the system init service manager
+ -origin=
+   if specified, self-updates will use this origin
+ -session_mode=false
+   if set, installs the device manager to run a single session. Otherwise, the
+   device manager is configured to get restarted upon exit
+ -single_user=false
+   if set, performs the installation assuming a single-user system
+ -suid_helper=
+   path to suid helper
+
+Deviced uninstall
+
+Removes the device manager installation from V23_DEVICE_DIR (if the env var
+set), or the current dir otherwise
+
+Usage:
+   deviced uninstall [flags]
+
+The deviced uninstall flags are:
+ -suid_helper=
+   path to suid helper
+
+Deviced start
+
+Starts the device manager installed under from V23_DEVICE_DIR (if the env var
+set), or the current dir otherwise
+
+Usage:
+   deviced start
+
+Deviced stop
+
+Stops the device manager installed under from V23_DEVICE_DIR (if the env var
+set), or the current dir otherwise
+
+Usage:
+   deviced stop
+
+Deviced profile
+
+Prints the internal profile description for the device manager.
+
+Usage:
+   deviced profile
+
+Deviced help
+
+Help with no args displays the usage of the parent command.
+
+Help with args displays the usage of the specified sub-command or help topic.
+
+"help ..." recursively displays help for all commands and topics.
+
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
+
+Usage:
+   deviced help [flags] [command/topic ...]
+
+[command/topic ...] optionally identifies a specific sub-command or help topic.
+
+The deviced help flags are:
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
+*/
+package main
diff --git a/services/device/deviced/main.go b/services/device/deviced/main.go
index 1e23e55..2e824b2 100644
--- a/services/device/deviced/main.go
+++ b/services/device/deviced/main.go
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// Daemon deviced implements the v.io/v23/services/device interfaces.
+// The following enables go generate to generate the doc.go file.
+//go:generate go run $V23_ROOT/release/go/src/v.io/x/lib/cmdline/testdata/gendoc.go .
+
 package main
 
 import (
@@ -21,9 +23,10 @@
 
 	rootCmd := cmdline.Command{
 		Name:  "deviced",
-		Short: "Vanadium device manager setup",
+		Short: "launch, configure and manage the deviced daemon",
 		Long: `
-deviced can be used to launch, configure, or manage the device manager.
+Command deviced is used to launch, configure and manage the deviced daemon,
+which implements the v.io/v23/services/device interfaces.
 `,
 		Children: []*cmdline.Command{cmdInstall, cmdUninstall, cmdStart, cmdStop, cmdProfile},
 		Run:      runServer,
diff --git a/services/device/deviced/server.go b/services/device/deviced/server.go
index 052e0fe..26e38d1 100644
--- a/services/device/deviced/server.go
+++ b/services/device/deviced/server.go
@@ -11,23 +11,22 @@
 	"net"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"time"
 
+	"v.io/v23"
+	"v.io/v23/context"
+	"v.io/v23/rpc"
+	"v.io/v23/verror"
 	"v.io/x/lib/cmdline"
-
+	"v.io/x/lib/vlog"
 	vexec "v.io/x/ref/lib/exec"
 	"v.io/x/ref/lib/mgmt"
 	"v.io/x/ref/lib/signals"
 	_ "v.io/x/ref/profiles/roaming"
 	"v.io/x/ref/services/device/internal/config"
 	"v.io/x/ref/services/device/internal/starter"
-
-	"v.io/v23"
-	"v.io/v23/context"
-	"v.io/v23/rpc"
-	"v.io/v23/verror"
-	"v.io/x/lib/vlog"
 )
 
 const pkgPath = "v.io/x/ref/services/device/deviced"
@@ -47,6 +46,10 @@
 	usePairingToken = flag.Bool("use-pairing-token", false, "generate a pairing token for the device manager that will need to be provided when a device is claimed")
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept(regexp.MustCompile(`^(name)|(restart-exit-code)|(neighborhood-name)|(deviced-port)|(proxy-port)|(use-pairing-token)$`))
+}
+
 func runServer(*cmdline.Command, []string) error {
 	ctx, shutdown := v23.Init()
 	defer shutdown()
diff --git a/services/profile/profile/doc.go b/services/profile/profile/doc.go
index 0b5995c..3fee387 100644
--- a/services/profile/profile/doc.go
+++ b/services/profile/profile/doc.go
@@ -18,7 +18,6 @@
    put           Sets a placeholder specification for the profile.
    remove        removes the profile specification for the profile.
    help          Display help for commands or topics
-Run "profile help [command]" for command usage.
 
 The global flags are:
  -alsologtostderr=true
@@ -60,7 +59,7 @@
  -vmodule=
    comma-separated list of pattern=N settings for file-filtered logging
 
-Profile Label
+Profile label
 
 Shows a human-readable profile key for the profile.
 
@@ -69,7 +68,7 @@
 
 <profile> is the full name of the profile.
 
-Profile Description
+Profile description
 
 Shows a human-readable profile description for the profile.
 
@@ -78,7 +77,7 @@
 
 <profile> is the full name of the profile.
 
-Profile Specification
+Profile specification
 
 Shows the specification of the profile.
 
@@ -87,7 +86,7 @@
 
 <profile> is the full name of the profile.
 
-Profile Put
+Profile put
 
 Sets a placeholder specification for the profile.
 
@@ -96,7 +95,7 @@
 
 <profile> is the full name of the profile.
 
-Profile Remove
+Profile remove
 
 removes the profile specification for the profile.
 
@@ -105,7 +104,7 @@
 
 <profile> is the full name of the profile.
 
-Profile Help
+Profile help
 
 Help with no args displays the usage of the parent command.
 
@@ -113,11 +112,10 @@
 
 "help ..." recursively displays help for all commands and topics.
 
-The output is formatted to a target width in runes.  The target width is
-determined by checking the environment variable CMDLINE_WIDTH, falling back on
-the terminal width from the OS, falling back on 80 chars.  By setting
-CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0 the width is unlimited, and
-if x == 0 or is unset one of the fallbacks is used.
+Output is formatted to a target width in runes, determined by checking the
+CMDLINE_WIDTH environment variable, falling back on the terminal width, falling
+back on 80 chars.  By setting CMDLINE_WIDTH=x, if x > 0 the width is x, if x < 0
+the width is unlimited, and if x == 0 or is unset one of the fallbacks is used.
 
 Usage:
    profile help [flags] [command/topic ...]
@@ -125,7 +123,11 @@
 [command/topic ...] optionally identifies a specific sub-command or help topic.
 
 The profile help flags are:
- -style=default
-   The formatting style for help output, either "default" or "godoc".
+ -style=compact
+   The formatting style for help output:
+      compact - Good for compact cmdline output.
+      full    - Good for cmdline output, shows all global flags.
+      godoc   - Good for godoc processing.
+   Override the default by setting the CMDLINE_STYLE environment variable.
 */
 package main
diff --git a/services/profile/profile/impl.go b/services/profile/profile/impl.go
index 1b6bbc0..1bed93e 100644
--- a/services/profile/profile/impl.go
+++ b/services/profile/profile/impl.go
@@ -10,12 +10,15 @@
 
 	"v.io/v23/context"
 	"v.io/v23/services/build"
-
 	"v.io/x/lib/cmdline"
 	"v.io/x/ref/services/profile"
 	"v.io/x/ref/services/repository"
 )
 
+func init() {
+	cmdline.HideGlobalFlagsExcept()
+}
+
 var cmdLabel = &cmdline.Command{
 	Run:      runLabel,
 	Name:     "label",