fix(mac): validate notarization wrapper args

scripts/notarize-mac-artifact.sh

@@ -12,11 +12,42 @@ set -euo pipefail
 #   NOTARYTOOL_KEY_ID    API key ID
 #   NOTARYTOOL_ISSUER    API issuer ID
 
-ARTIFACT="${1:-}"
+ARTIFACT=""
 STAPLE_APP_PATH="${STAPLE_APP_PATH:-}"
 
+usage() {
+  cat <<'HELP'
+Usage: scripts/notarize-mac-artifact.sh <artifact>
+
+Env:
+  STAPLE_APP_PATH=dist/OpenClaw.app
+  NOTARYTOOL_PROFILE=<keychain-profile>
+  NOTARYTOOL_KEY=<api-key.p8>
+  NOTARYTOOL_KEY_ID=<api-key-id>
+  NOTARYTOOL_ISSUER=<issuer-id>
+HELP
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+if [[ "${1:-}" == "--" ]]; then
+  shift
+fi
+if [[ "$#" -gt 0 ]]; then
+  case "$1" in
+    -*) echo "Error: unknown notarization option: $1" >&2; exit 1 ;;
+    *) ARTIFACT="$1"; shift ;;
+  esac
+fi
+if [[ "$#" -gt 0 ]]; then
+  echo "Error: unexpected notarization argument: $1" >&2
+  exit 1
+fi
+
 if [[ -z "$ARTIFACT" ]]; then
-  echo "Usage: $0 <artifact>" >&2
+  usage >&2
   exit 1
 fi
 if [[ ! -e "$ARTIFACT" ]]; then

test/scripts/notarize-mac-artifact.test.ts

@@ -21,6 +21,44 @@ afterEach(() => {
 });
 
 describe("notarize-mac-artifact input validation", () => {
+  it("prints help without checking artifact or notary tools", () => {
+    const result = spawnSync("bash", [scriptPath, "--help"], {
+      cwd: process.cwd(),
+      encoding: "utf8",
+    });
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain("Usage: scripts/notarize-mac-artifact.sh <artifact>");
+    expect(result.stdout).toContain("NOTARYTOOL_PROFILE");
+    expect(result.stderr).toBe("");
+  });
+
+  it("rejects unknown options before artifact validation", () => {
+    const result = spawnSync("bash", [scriptPath, "--wat"], {
+      cwd: process.cwd(),
+      encoding: "utf8",
+    });
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toBe("");
+    expect(result.stderr.trim()).toBe("Error: unknown notarization option: --wat");
+  });
+
+  it("rejects extra artifact arguments before notarization", () => {
+    const tempRoot = makeTempDir("openclaw-notary-extra-");
+    const artifact = path.join(tempRoot, "OpenClaw.zip");
+    writeFileSync(artifact, "placeholder", "utf8");
+
+    const result = spawnSync("bash", [scriptPath, artifact, "extra"], {
+      cwd: process.cwd(),
+      encoding: "utf8",
+    });
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toBe("");
+    expect(result.stderr.trim()).toBe("Error: unexpected notarization argument: extra");
+  });
+
   it("fails before notarization when an explicit staple app path is missing", () => {
     const tempRoot = makeTempDir("openclaw-notary-staple-");
     const artifact = path.join(tempRoot, "OpenClaw.zip");