Invalid input handling

When a CLI silently ignores unknown flags (via .allowUnknownOption() or equivalent), user typos produce no error — --foramt json is swallowed, the command runs with the wrong output format, and the user thinks it succeeded. CWE-20 (Improper Input Validation) covers this precisely: inputs that fall outside the accepted set must be rejected, not ignored. The same principle applies to typed arguments: a --count abc that coerces to NaN and propagates through downstream logic produces silent corruption that can be harder to diagnose than a stack trace. Strict input rejection at the boundary turns typos into immediate feedback instead of silent misconfigurations.

Never set .allowUnknownOption() globally. Validate typed arguments at parse time and fail with a specific message naming the offending value:

program
  .command('resize <width>')
  .option('--format <type>', 'Output format', (val) => {
    const formats = ['png', 'jpg', 'webp']
    if (!formats.includes(val)) {
      throw new InvalidArgumentError(`Must be one of: ${formats.join(', ')}`)
    }
    return val
  })
  .action((width, opts) => {
    const w = parseInt(width, 10)
    if (isNaN(w) || w <= 0) {
      console.error(`Error: width must be a positive number, got '${width}'`)
      process.exit(2)
    }
  })

For enum values in click, use click.Choice to get automatic validation and "did you mean?" hints:

@cli.command()
@click.option('--format', type=click.Choice(['png', 'jpg', 'webp']), required=True)
def resize(format):
    pass  # click rejects invalid choices automatically