Add: description in help message

docs/COMMANDS.md

@@ -3,36 +3,36 @@
 This document lists CLI commands and supported flags. Output defaults to text; use `--json` for structured output.
 
 ## Global flags
-- `--json` / `--pretty`
-- `--no-color` / `--quiet`
-- `-v` / `-vv` / `--verbose`
-- `--log-level <error|warn|info|debug|trace>`
-- `--log-format <text|json>`
-- `--log-file <path>`
+- `--json` / `--pretty`: emit JSON output (pretty-print if requested)
+- `--no-color` / `--quiet`: disable ANSI colors / reduce stdout output
+- `-v` / `-vv` / `--verbose`: increase log verbosity
+- `--log-level <error|warn|info|debug|trace>`: set log level
+- `--log-format <text|json>`: set log format
+- `--log-file <path>`: write logs to file
 - `NETTOOL_LOG_FILTER` or `RUST_LOG` can override log filters (ex: `maxminddb::decoder=debug`)
 
 ## sys
-- `sys ifaces`
-- `sys ip` flags: `--all`, `--iface <name>`
-- `sys route` flags: `--ipv4`, `--ipv6`, `--to <ip>`
-- `sys dns`
+- `sys ifaces`: list network interfaces
+- `sys ip` flags: `--all` (include link-local), `--iface <name>` (filter by interface)
+- `sys route` flags: `--ipv4`, `--ipv6`, `--to <ip>` (filter by destination)
+- `sys dns`: show DNS configuration
 
 ## ports
-- `ports listen` flags: `--tcp`, `--udp`, `--port <n>`
-- `ports who <port>`
-- `ports conns` flags: `--top <n>`, `--by-process`
+- `ports listen` flags: `--tcp`, `--udp`, `--port <n>` (filter by port)
+- `ports who <port>`: find owning processes for a port
+- `ports conns` flags: `--top <n>`, `--by-process` (summaries)
 
 ## neigh
 - `neigh list` flags: `--ipv4`, `--ipv6`, `--iface <name>`
 
 ## cert
-- `cert roots`
-- `cert baseline <path>`
-- `cert diff <path>`
+- `cert roots`: list trusted root certificates
+- `cert baseline <path>`: write baseline JSON
+- `cert diff <path>`: diff against baseline JSON
 
 ## geoip
-- `geoip lookup <ip>`
-- `geoip status`
+- `geoip lookup <ip>`: lookup GeoIP
+- `geoip status`: show GeoIP database status
 
 ## probe
 - `probe ping <host>` flags: `--count <n>`, `--timeout-ms <n>`, `--interval-ms <n>`, `--no-geoip`
@@ -44,7 +44,7 @@ This document lists CLI commands and supported flags. Output defaults to text; u
 - `dns detect <domain>` flags: `--servers <csv>`, `--transport <udp|tcp|dot|doh>`, `--tls-name <name>`, `--socks5 <url>`, `--prefer-ipv4`, `--repeat <n>`, `--timeout-ms <n>`
 - `dns watch` flags: `--duration <Ns|Nms>`, `--iface <name>`, `--filter <pattern>`
 - `dns leak status` flags: `--profile <full-tunnel|proxy-stub|split>`, `--policy <path>`
-- `dns leak watch` flags: `--duration <Ns|Nms>`, `--iface <name>`, `--profile <full-tunnel|proxy-stub|split>`, `--policy <path>`, `--privacy <full|redacted|minimal>`, `--out <path>`, `--summary-only`, `--iface-diag`
+- `dns leak watch` flags: `--duration <Ns|Nms>`, `--iface <name>`, `--profile <full-tunnel|proxy-stub|split>`, `--policy <path>`, `--privacy <full|redacted|minimal>`, `--out <path>`, `--summary-only`, `--iface-diag` (list capture-capable interfaces)
 - `dns leak report` flags: `<path>`, `--privacy <full|redacted|minimal>`
 
 ## http