fix(release): reject extra npm publish arguments

scripts/clawhub-cli-npm-publish.sh

@@ -5,6 +5,11 @@ set -euo pipefail
 mode="${1:-}"
 publish_target="${2:-}"
 
+if [[ "$#" -gt 2 ]]; then
+  echo "usage: bash scripts/clawhub-cli-npm-publish.sh --publish [package.tgz]" >&2
+  exit 2
+fi
+
 if [[ "${mode}" != "--publish" ]]; then
   echo "usage: bash scripts/clawhub-cli-npm-publish.sh --publish [package.tgz]" >&2
   exit 2

scripts/clawhub-cli-npm-publish.test.mjs

@@ -7,6 +7,39 @@ import { join, resolve } from "node:path";
 import { describe, expect, it } from "vitest";
 
 describe("clawhub CLI npm publish", () => {
+  it("rejects extra arguments before invoking npm", () => {
+    const root = mkdtempSync(join(tmpdir(), "clawhub-cli-npm-publish-"));
+
+    try {
+      const fakeBin = join(root, "bin");
+      const publishMarker = join(root, "published");
+      mkdirSync(fakeBin);
+      writeFileSync(
+        join(fakeBin, "npm"),
+        `#!/usr/bin/env bash\nprintf '%s\\n' "$*" > "${publishMarker}"\n`,
+      );
+      chmodSync(join(fakeBin, "npm"), 0o755);
+
+      const result = spawnSync(
+        "bash",
+        ["scripts/clawhub-cli-npm-publish.sh", "--publish", "package.tgz", "--tag", "next"],
+        {
+          cwd: resolve("."),
+          encoding: "utf8",
+          env: { ...process.env, PATH: `${fakeBin}:${process.env.PATH}` },
+        },
+      );
+
+      expect(result.status).toBe(2);
+      expect(result.stderr).toContain(
+        "usage: bash scripts/clawhub-cli-npm-publish.sh --publish [package.tgz]",
+      );
+      expect(() => readFileSync(publishMarker)).toThrow();
+    } finally {
+      rmSync(root, { force: true, recursive: true });
+    }
+  });
+
   it("rejects a tarball whose package version does not match the source package", () => {
     const root = mkdtempSync(join(tmpdir(), "clawhub-cli-npm-publish-"));