From 9dd23331dc11b3993e5a2fa211a429a303a19bce Mon Sep 17 00:00:00 2001
From: polisher <hivemoot-polisher@users.noreply.github.com>
Date: Fri, 27 Mar 2026 07:36:13 +0000
Subject: [PATCH] polish: harden bot write access CLI

Reject unknown arguments in check-bot-write-access and report parse failures cleanly. Add tests for --help and invalid argv handling so the CLI matches the newer script ergonomics used elsewhere in the repo.
---
 .../__tests__/check-bot-write-access.test.ts  | 32 ++++++++++++++++++-
 web/scripts/check-bot-write-access.ts         | 10 +++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/web/scripts/__tests__/check-bot-write-access.test.ts b/web/scripts/__tests__/check-bot-write-access.test.ts
index db8eb4a2..d24828d2 100644
--- a/web/scripts/__tests__/check-bot-write-access.test.ts
+++ b/web/scripts/__tests__/check-bot-write-access.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import {
   findInstallation,
   formatTextResult,
@@ -26,6 +26,36 @@ describe('parseArgs', () => {
       json: true,
     });
   });
+
+  it('prints help and exits 0 for --help', () => {
+    const log = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const exit = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('process.exit');
+    });
+
+    try {
+      expect(() => parseArgs(['--help'])).toThrow('process.exit');
+      expect(log).toHaveBeenCalledWith(
+        expect.stringContaining('Usage: npm run check-bot-write-access')
+      );
+      expect(exit).toHaveBeenCalledWith(0);
+    } finally {
+      log.mockRestore();
+      exit.mockRestore();
+    }
+  });
+
+  it('rejects unknown flags', () => {
+    expect(() => parseArgs(['--verbose'])).toThrow(
+      'Unknown argument: --verbose'
+    );
+  });
+
+  it('rejects positional arguments', () => {
+    expect(() => parseArgs(['example-org'])).toThrow(
+      'Unknown argument: example-org'
+    );
+  });
 });
 
 describe('findInstallation', () => {
diff --git a/web/scripts/check-bot-write-access.ts b/web/scripts/check-bot-write-access.ts
index 74d8b67c..cb5f98a8 100644
--- a/web/scripts/check-bot-write-access.ts
+++ b/web/scripts/check-bot-write-access.ts
@@ -65,6 +65,8 @@ export function parseArgs(argv: string[]): CliOptions {
       printHelp();
       process.exit(0);
     }
+
+    throw new Error(`Unknown argument: ${arg}`);
   }
 
   return options;
@@ -249,5 +251,11 @@ const isMainModule =
   process.argv[1] === fileURLToPath(import.meta.url);
 
 if (isMainModule) {
-  main();
+  try {
+    main();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    process.exit(1);
+  }
 }