fix(scripts): reject short flag boundary values

scripts/lib/release-upgrade-baseline.mjs

@@ -61,7 +61,7 @@ export function resolveDefaultReleaseUpgradeBaseline(candidateVersion, published
   throw new Error(`no published OpenClaw baseline is <= candidate ${candidate.version}`);
 }
 
-function parseArgs(argv) {
+export function parseArgs(argv) {
   const args = new Map();
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
@@ -70,7 +70,7 @@ function parseArgs(argv) {
     }
     const key = arg.slice(2);
     const value = argv[index + 1];
-    if (value === undefined || value.startsWith("--")) {
+    if (value === undefined || value.startsWith("-")) {
       throw new Error(`missing value for --${key}`);
     }
     args.set(key, value);

scripts/run-additional-boundary-checks.mjs

@@ -558,7 +558,7 @@ export function parseCliArgs(args, env = process.env) {
     }
     if (arg === "--shard") {
       const value = args[index + 1];
-      if (!value || value.startsWith("--")) {
+      if (!value || value.startsWith("-")) {
         throw new Error("--shard requires a value");
       }
       shardSpec = value;

test/scripts/release-upgrade-baseline.test.ts

@@ -1,10 +1,18 @@
 import { describe, expect, it } from "vitest";
 import {
   compareOpenClawVersions,
+  parseArgs,
   resolveDefaultReleaseUpgradeBaseline,
 } from "../../scripts/lib/release-upgrade-baseline.mjs";
 
 describe("release upgrade baseline resolver", () => {
+  it("rejects short flag values before resolving baselines", () => {
+    expect(() => parseArgs(["--candidate-version", "-h"])).toThrow(
+      "missing value for --candidate-version",
+    );
+    expect(() => parseArgs(["--versions-json", "-h"])).toThrow("missing value for --versions-json");
+  });
+
   it("prefers the newest published baseline older than the candidate across channels", () => {
     expect(
       resolveDefaultReleaseUpgradeBaseline("2026.6.2", [

test/scripts/run-additional-boundary-checks.test.ts

@@ -185,6 +185,7 @@ describe("run-additional-boundary-checks", () => {
       shardSpec: "4/4",
     });
     expect(() => parseCliArgs(["--shard"], {})).toThrow("--shard requires a value");
+    expect(() => parseCliArgs(["--shard", "-h"], {})).toThrow("--shard requires a value");
     expect(() => parseCliArgs(["--wat"], {})).toThrow("Unknown argument: --wat");
   });
 
@@ -274,7 +275,7 @@ describe("run-additional-boundary-checks", () => {
     async () => {
       const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-boundary-timeout-"));
       const childPidPath = path.join(tempDir, "child.pid");
-      let childPid = 0;
+      let childPid: number | undefined;
       try {
         const childScript = [
           "process.on('SIGTERM', () => {});",
@@ -310,7 +311,7 @@ describe("run-additional-boundary-checks", () => {
         expect(result.timedOut).toBe(true);
         await waitForDead(childPid, 2000);
       } finally {
-        if (childPid && isProcessAlive(childPid)) {
+        if (childPid !== undefined && isProcessAlive(childPid)) {
           process.kill(childPid, "SIGKILL");
         }
         fs.rmSync(tempDir, { force: true, recursive: true });
@@ -324,7 +325,7 @@ describe("run-additional-boundary-checks", () => {
       const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-boundary-signal-"));
       const readyPath = path.join(tempDir, "ready");
       const childPidPath = path.join(tempDir, "child.pid");
-      let childPid = 0;
+      let childPid: number | undefined;
       let runner: ReturnType<typeof spawn> | undefined;
       try {
         const childScript = [
@@ -387,7 +388,7 @@ await runChecks(
         });
         await waitForNotRunning(childPid, 2000);
       } finally {
-        if (childPid && isProcessAlive(childPid)) {
+        if (childPid !== undefined && isProcessAlive(childPid)) {
           process.kill(childPid, "SIGKILL");
         }
         if (runner?.pid && isProcessAlive(runner.pid)) {