fix(release): validate plugin npm verifier args

scripts/verify-plugin-npm-published-runtime.mjs

@@ -358,6 +358,28 @@ function readPackedPackageReadme(packageDir, files) {
   return fs.readFileSync(path.join(packageDir, readmePath), "utf8").trim();
 }
 
+export function usage() {
+  return "Usage: node scripts/verify-plugin-npm-published-runtime.mjs <package-spec>";
+}
+
+export function parseVerifyPublishedPluginRuntimeArgs(argv) {
+  const args = argv[0] === "--" ? argv.slice(1) : argv;
+  const first = args[0]?.trim();
+  if (first === "--help" || first === "-h") {
+    return { help: true, spec: "" };
+  }
+  if (!first) {
+    throw new Error(usage());
+  }
+  if (first.startsWith("-")) {
+    throw new Error(`Unknown plugin npm verifier option: ${first}`);
+  }
+  if (args.length > 1) {
+    throw new Error(`Unexpected plugin npm verifier argument: ${args[1]}`);
+  }
+  return { help: false, spec: first };
+}
+
 export async function verifyPublishedPluginRuntime(spec) {
   const workingDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-plugin-npm-runtime."));
   try {
@@ -396,11 +418,12 @@ export async function verifyPublishedPluginRuntime(spec) {
 }
 
 async function main(argv) {
-  const spec = argv[0]?.trim();
-  if (!spec) {
-    throw new Error("Usage: node scripts/verify-plugin-npm-published-runtime.mjs <package-spec>");
+  const args = parseVerifyPublishedPluginRuntimeArgs(argv);
+  if (args.help) {
+    console.log(usage());
+    return;
   }
-  const result = await verifyPublishedPluginRuntime(spec);
+  const result = await verifyPublishedPluginRuntime(args.spec);
   console.log(
     `plugin-npm-published-runtime-check: ${result.packageName}@${result.version} OK (${result.fileCount} files, ${result.readmeLength} readme chars)`,
   );

test/scripts/verify-plugin-npm-published-runtime.test.ts

@@ -3,13 +3,35 @@ import { describe, expect, it } from "vitest";
 import {
   collectPluginNpmPublishedRuntimeErrors,
   findPackedPackageReadmePath,
+  parseVerifyPublishedPluginRuntimeArgs,
   parseNpmReadmeMetadata,
   readPluginNpmCommandOptions,
   readPositiveIntEnv,
   resolveNpmPackFilename,
   runPluginNpmCommand,
+  usage,
 } from "../../scripts/verify-plugin-npm-published-runtime.mjs";
 
+describe("plugin npm publish verifier args", () => {
+  it("parses help and package specs before npm calls", () => {
+    expect(parseVerifyPublishedPluginRuntimeArgs(["--help"])).toEqual({ help: true, spec: "" });
+    expect(parseVerifyPublishedPluginRuntimeArgs(["--", "@openclaw/discord@2026.5.2"])).toEqual({
+      help: false,
+      spec: "@openclaw/discord@2026.5.2",
+    });
+  });
+
+  it("rejects unknown and extra args before npm calls", () => {
+    expect(() => parseVerifyPublishedPluginRuntimeArgs([])).toThrow(usage());
+    expect(() => parseVerifyPublishedPluginRuntimeArgs(["--wat"])).toThrow(
+      "Unknown plugin npm verifier option: --wat",
+    );
+    expect(() =>
+      parseVerifyPublishedPluginRuntimeArgs(["@openclaw/discord@2026.5.2", "extra"]),
+    ).toThrow("Unexpected plugin npm verifier argument: extra");
+  });
+});
+
 describe("plugin npm publish verifier retry limits", () => {
   it("rejects loose numeric retry env values instead of parsing prefixes", () => {
     expect(() =>