fix(scripts): reject short flag values in helper CLIs

scripts/check-plugin-npm-runtime-builds.mjs

@@ -13,7 +13,7 @@ import {
 
 function readPackageArgValue(argv, index) {
   const value = argv[index + 1];
-  if (value === undefined || value === "" || value.startsWith("--")) {
+  if (value === undefined || value === "" || value.startsWith("-")) {
     throw new Error("missing value for --package");
   }
   return value;

scripts/label-open-issues.ts

@@ -223,7 +223,7 @@ function parseArgs(argv: string[]): ScriptOptions {
 
     if (arg === "--limit") {
       const next = argv[index + 1];
-      if (!next || next.startsWith("--") || !/^\d+$/u.test(next)) {
+      if (!next || next.startsWith("-") || !/^\d+$/u.test(next)) {
         throw new Error("Missing/invalid --limit value");
       }
       const parsed = Number(next);
@@ -237,7 +237,7 @@ function parseArgs(argv: string[]): ScriptOptions {
 
     if (arg === "--model") {
       const next = argv[index + 1];
-      if (!next || next.startsWith("--")) {
+      if (!next || next.startsWith("-")) {
         throw new Error("Missing --model value");
       }
       model = next;

scripts/lib/plugin-npm-runtime-build.mjs

@@ -307,7 +307,7 @@ function readPackageDirArg(argv) {
   if (packageDir === "--help" || packageDir === "-h") {
     return { help: true, packageDir: "" };
   }
-  if (!packageDir || packageDir.startsWith("--")) {
+  if (!packageDir || packageDir.startsWith("-")) {
     throw new Error(usage());
   }
   const extraArg = args[1];

scripts/resolve-upgrade-survivor-baselines.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
 import { normalizeUpgradeSurvivorBaselineSpec } from "./lib/docker-e2e-plan.mjs";
 import { compareReleaseVersions, parseReleaseVersion } from "./lib/npm-publish-plan.mjs";
 
-function parseArgs(argv) {
+export function parseArgs(argv) {
   const args = new Map();
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
@@ -14,7 +14,7 @@ function parseArgs(argv) {
     }
     const key = arg.slice(2);
     const value = argv[index + 1];
-    if (value === undefined || value.startsWith("--")) {
+    if (value === undefined || value.startsWith("-")) {
       throw new Error(`missing value for --${key}`);
     }
     args.set(key, value);

test/scripts/label-open-issues.test.ts

@@ -24,9 +24,11 @@ describe("label-open-issues helpers", () => {
     });
 
     expect(() => testing.parseArgs(["--model", "--dry-run"])).toThrow("Missing --model value");
+    expect(() => testing.parseArgs(["--model", "-h"])).toThrow("Missing --model value");
     expect(() => testing.parseArgs(["--limit", "--dry-run"])).toThrow(
       "Missing/invalid --limit value",
     );
+    expect(() => testing.parseArgs(["--limit", "-h"])).toThrow("Missing/invalid --limit value");
     expect(() => testing.parseArgs(["--wat"])).toThrow("Unknown argument: --wat");
   });
 

test/scripts/plugin-npm-runtime-build-args.test.ts

@@ -39,6 +39,7 @@ describe("plugin npm runtime build args", () => {
     expect(() => parseBulkBuildArgs(["--package", "--package", "extensions/slack"])).toThrow(
       "missing value for --package",
     );
+    expect(() => parseBulkBuildArgs(["--package", "-h"])).toThrow("missing value for --package");
     expect(() => parseSingleBuildArgs(["--package"])).toThrow(
       "usage: node scripts/lib/plugin-npm-runtime-build.mjs <package-dir>",
     );

test/scripts/upgrade-survivor-baselines.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { resolveBaselines } from "../../scripts/resolve-upgrade-survivor-baselines.mjs";
+import { parseArgs, resolveBaselines } from "../../scripts/resolve-upgrade-survivor-baselines.mjs";
 
 function withReleaseFixture<T>(releases: unknown[], fn: (file: string) => T): T {
   const dir = mkdtempSync(path.join(tmpdir(), "openclaw-upgrade-baselines-"));
@@ -28,6 +28,11 @@ function withJsonFixture<T>(name: string, contents: unknown, fn: (file: string)
 }
 
 describe("scripts/resolve-upgrade-survivor-baselines", () => {
+  it("rejects short flag values before resolving baselines", () => {
+    expect(() => parseArgs(["--fallback", "-h"])).toThrow("missing value for --fallback");
+    expect(() => parseArgs(["--github-output", "-h"])).toThrow("missing value for --github-output");
+  });
+
   it("keeps the single fallback baseline when no expanded request is provided", () => {
     expect(resolveBaselines(new Map([["fallback", "2026.4.23"]]))).toEqual(["openclaw@2026.4.23"]);
   });