Protect `argv._` / non-hyphenated options array

[inukshuk]

I ran into a bizarre error on macOS where an app would not start the first time after confirming the gatekeeper message; the app would halt unexpectedly (on subsequent starts, everything was fine). The reason, it turns out, was that gatekeeper seems to start the app with an extra command line parameter including underscores (e.g., -ps_0_12345). yargs interprets those underscores as boolean parameters and, when storing them, overwrites the non-hyphenated options array.

$ cat args.js 
#!/usr/bin/env node
console.dir(require('yargs').argv)

$ ./args.js
{ _: [], '$0': 'args.js' }
$ ./args.js -_
{ _: [ true ], '$0': 'args.js' }

[bcoe]

@inukshuk seems like a reasonable safety to not allow a user to set an argument named _ -- we'll need to make this change in a major version.

@nexdrew do you agree?

[DeeDeeG]

I personally support the argv._ array being totally protected, or making it an opt-in configuration to allow -_/--_ underscore flags.

Or more generally, having it not be possible for hyphenated arguments to end up in with the non-hyphenated arguments array.