fix(test): route proxy CA installer

scripts/proxy-install-ca.mjs

@@ -6,7 +6,8 @@ import { resolveSystemBin } from "../src/infra/resolve-system-bin.js";
 import { ensureDebugProxyCa } from "../src/proxy-capture/ca.js";
 import { resolveDebugProxySettings } from "../src/proxy-capture/env.js";
 
-const printOnly = process.argv.includes("--print-only");
+const parsedArgs = parseArgs(process.argv.slice(2));
+const printOnly = parsedArgs.printOnly;
 
 async function installCa() {
   const settings = resolveDebugProxySettings();
@@ -56,3 +57,27 @@ void installCa().catch(
     process.exit(1);
   },
 );
+
+function parseArgs(argv) {
+  let wantsPrintOnly = false;
+  for (const arg of argv) {
+    if (arg === "--help") {
+      printUsage(console.log);
+      process.exit(0);
+    }
+    if (arg === "--print-only") {
+      wantsPrintOnly = true;
+      continue;
+    }
+    console.error(`Unknown proxy install CA argument: ${arg}`);
+    printUsage(console.error);
+    process.exit(1);
+  }
+  return { printOnly: wantsPrintOnly };
+}
+
+function printUsage(writeLine) {
+  writeLine("Usage: node --import tsx scripts/proxy-install-ca.mjs [--print-only]");
+  writeLine("");
+  writeLine("  --print-only  create or reuse the debug proxy CA without changing system trust");
+}

scripts/test-projects.test-support.mjs

@@ -1246,6 +1246,7 @@ const TOOLING_SOURCE_TEST_TARGETS = new Map([
     "scripts/lib/plugin-package-dependencies.mjs",
     ["test/scripts/plugin-package-dependencies.test.ts"],
   ],
+  ["scripts/proxy-install-ca.mjs", ["test/scripts/proxy-install-ca.test.ts"]],
   ["scripts/release-preflight.mjs", ["test/scripts/release-preflight.test.ts"]],
   [
     "scripts/lib/plugin-npm-runtime-assets.mjs",

test/scripts/proxy-install-ca.test.ts

@@ -0,0 +1,53 @@
+// Proxy CA installer tests keep macOS trust changes behind explicit CLI args.
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { afterEach, describe, expect, it } from "vitest";
+import { cleanupTempDirs, makeTempDir } from "../helpers/temp-dir.js";
+
+const SCRIPT = "scripts/proxy-install-ca.mjs";
+const tempDirs = new Set<string>();
+
+afterEach(() => {
+  cleanupTempDirs(tempDirs);
+});
+
+function runProxyInstallCa(args: string[], certDir: string) {
+  return spawnSync(process.execPath, ["--import", "tsx", SCRIPT, ...args], {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      OPENCLAW_DEBUG_PROXY_CERT_DIR: certDir,
+    },
+  });
+}
+
+describe("scripts/proxy-install-ca.mjs", () => {
+  it("rejects unknown arguments before creating the debug proxy CA", () => {
+    const root = makeTempDir(tempDirs, "openclaw-proxy-install-ca-");
+    const certDir = join(root, "certs");
+    const result = runProxyInstallCa(["--print-onli"], certDir);
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("Unknown proxy install CA argument: --print-onli");
+    expect(result.stderr).toContain(
+      "Usage: node --import tsx scripts/proxy-install-ca.mjs [--print-only]",
+    );
+    expect(result.stdout).toBe("");
+    expect(existsSync(certDir)).toBe(false);
+  });
+
+  it("prints usage without creating the debug proxy CA", () => {
+    const root = makeTempDir(tempDirs, "openclaw-proxy-install-ca-");
+    const certDir = join(root, "certs");
+    const result = runProxyInstallCa(["--help"], certDir);
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain(
+      "Usage: node --import tsx scripts/proxy-install-ca.mjs [--print-only]",
+    );
+    expect(result.stderr).toBe("");
+    expect(existsSync(certDir)).toBe(false);
+  });
+});