fix(test): clean dependency report cli errors

scripts/dependency-changes-report.mjs

@@ -345,7 +345,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.met
       process.exitCode = exitCode;
     },
     /** @param {unknown} error */ (error) => {
-      process.stderr.write(`${error.stack ?? error.message ?? String(error)}\n`);
+      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
       process.exitCode = 1;
     },
   );

scripts/dependency-vulnerability-gate.mjs

@@ -303,7 +303,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.met
       process.exitCode = exitCode;
     },
     /** @param {unknown} error */ (error) => {
-      process.stderr.write(`${error.stack ?? error.message ?? String(error)}\n`);
+      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
       process.exitCode = 1;
     },
   );

scripts/transitive-manifest-risk-report.mjs

@@ -656,7 +656,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.met
       process.exitCode = exitCode;
     },
     /** @param {unknown} error */ (error) => {
-      process.stderr.write(`${error.stack ?? error.message ?? String(error)}\n`);
+      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
       process.exitCode = 1;
     },
   );

test/scripts/dependency-changes-report.test.ts

@@ -1,4 +1,6 @@
 // Dependency Changes Report tests cover dependency changes report script behavior.
+import { spawnSync } from "node:child_process";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   createDependencyChangesReport,
@@ -7,6 +9,18 @@ import {
   parseArgs,
 } from "../../scripts/dependency-changes-report.mjs";
 
+function runCli(...args: string[]) {
+  return spawnSync(process.execPath, ["scripts/dependency-changes-report.mjs", ...args], {
+    cwd: path.resolve("."),
+    encoding: "utf8",
+  });
+}
+
+function expectNoNodeStack(stderr: string) {
+  expect(stderr).not.toContain("Node.js");
+  expect(stderr).not.toContain("\n    at ");
+}
+
 describe("dependency-changes-report", () => {
   it("reports added, removed, and changed packages", () => {
     const report = createDependencyChangesReport({
@@ -72,4 +86,20 @@ describe("dependency-changes-report", () => {
       expect(() => parseArgs([flag, "--json"])).toThrow(`${flag} requires a value`);
     }
   });
+
+  it("reports CLI argument errors without a Node stack trace", () => {
+    const missingBase = runCli();
+    expect(missingBase.status).toBe(1);
+    expect(missingBase.stdout).toBe("");
+    expect(missingBase.stderr.trim()).toBe(
+      "Expected --base-ref <git-ref> or --base-lockfile <path>.",
+    );
+    expectNoNodeStack(missingBase.stderr);
+
+    const unknownArg = runCli("--wat");
+    expect(unknownArg.status).toBe(1);
+    expect(unknownArg.stdout).toBe("");
+    expect(unknownArg.stderr.trim()).toBe("Unsupported argument: --wat");
+    expectNoNodeStack(unknownArg.stderr);
+  });
 });

test/scripts/dependency-vulnerability-gate.test.ts

@@ -1,4 +1,5 @@
 // Dependency Vulnerability Gate tests cover dependency vulnerability gate script behavior.
+import { spawnSync } from "node:child_process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -9,6 +10,18 @@ import {
   runDependencyVulnerabilityGate,
 } from "../../scripts/dependency-vulnerability-gate.mjs";
 
+function runCli(...args: string[]) {
+  return spawnSync(process.execPath, ["scripts/dependency-vulnerability-gate.mjs", ...args], {
+    cwd: path.resolve("."),
+    encoding: "utf8",
+  });
+}
+
+function expectNoNodeStack(stderr: string) {
+  expect(stderr).not.toContain("Node.js");
+  expect(stderr).not.toContain("\n    at ");
+}
+
 function advisory({
   id,
   severity,
@@ -53,6 +66,14 @@ snapshots:
 }
 
 describe("dependency-vulnerability-gate", () => {
+  it("reports CLI argument errors without a Node stack trace", () => {
+    const unknownArg = runCli("--wat");
+    expect(unknownArg.status).toBe(1);
+    expect(unknownArg.stdout).toBe("");
+    expect(unknownArg.stderr.trim()).toBe("Unsupported argument: --wat");
+    expectNoNodeStack(unknownArg.stderr);
+  });
+
   it("blocks critical advisories anywhere and high advisories in the production graph", () => {
     const result = classifyVulnerabilityFindings({
       allAdvisories: {

test/scripts/transitive-manifest-risk-report.test.ts

@@ -1,4 +1,6 @@
 // Transitive Manifest Risk Report tests cover transitive manifest risk report script behavior.
+import { spawnSync } from "node:child_process";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   createTransitiveManifestRiskReport,
@@ -7,7 +9,27 @@ import {
   renderTransitiveManifestRiskMarkdownReport,
 } from "../../scripts/transitive-manifest-risk-report.mjs";
 
+function runCli(...args: string[]) {
+  return spawnSync(process.execPath, ["scripts/transitive-manifest-risk-report.mjs", ...args], {
+    cwd: path.resolve("."),
+    encoding: "utf8",
+  });
+}
+
+function expectNoNodeStack(stderr: string) {
+  expect(stderr).not.toContain("Node.js");
+  expect(stderr).not.toContain("\n    at ");
+}
+
 describe("transitive-manifest-risk-report", () => {
+  it("reports CLI argument errors without a Node stack trace", () => {
+    const unknownArg = runCli("--wat");
+    expect(unknownArg.status).toBe(1);
+    expect(unknownArg.stdout).toBe("");
+    expect(unknownArg.stderr.trim()).toBe("Unsupported argument: --wat");
+    expectNoNodeStack(unknownArg.stderr);
+  });
+
   it("reports floating transitive specs, lifecycle scripts, exotic sources, and recently published versions", async () => {
     const report = await createTransitiveManifestRiskReport({
       packageVersions: [