Validate start URL flag values

Author: yummybomb

cmd/browser_pools.go

@@ -96,6 +96,9 @@ func (c BrowserPoolsCmd) Create(ctx context.Context, in BrowserPoolsCreateInput)
 	if in.Output != "" && in.Output != "json" {
 		return fmt.Errorf("unsupported --output value: use 'json'")
 	}
+	if err := validateStartURLFlag(in.StartURL); err != nil {
+		return err
+	}
 
 	params := kernel.BrowserPoolNewParams{
 		Size: in.Size,
@@ -234,6 +237,9 @@ func (c BrowserPoolsCmd) Update(ctx context.Context, in BrowserPoolsUpdateInput)
 	if in.Output != "" && in.Output != "json" {
 		return fmt.Errorf("unsupported --output value: use 'json'")
 	}
+	if err := validateStartURLFlag(in.StartURL); err != nil {
+		return err
+	}
 	if in.StartURL != "" && in.ClearStartURL {
 		return fmt.Errorf("cannot specify both --start-url and --clear-start-url")
 	}
@@ -692,6 +698,13 @@ func buildProfileParam(profileID, profileName string, saveChanges BoolFlag) (*ke
 	return &profile, nil
 }
 
+func validateStartURLFlag(startURL string) error {
+	if strings.HasPrefix(startURL, "-") {
+		return fmt.Errorf("--start-url requires a URL value")
+	}
+	return nil
+}
+
 func buildExtensionsParam(extensions []string) []kernel.BrowserExtensionParam {
 	if len(extensions) == 0 {
 		return nil

cmd/browser_pools_test.go

@@ -0,0 +1,19 @@
+package cmd
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBrowserPoolsUpdate_RejectsStartURLFlagToken(t *testing.T) {
+	err := BrowserPoolsCmd{}.Update(context.Background(), BrowserPoolsUpdateInput{
+		IDOrName: "pool123",
+		StartURL: "--discard-all-idle",
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--start-url requires a URL value")
+}

cmd/browsers.go

@@ -347,6 +347,9 @@ func (b BrowsersCmd) Create(ctx context.Context, in BrowsersCreateInput) error {
 	if in.Output != "" && in.Output != "json" {
 		return fmt.Errorf("unsupported --output value: use 'json'")
 	}
+	if err := validateStartURLFlag(in.StartURL); err != nil {
+		return err
+	}
 
 	if in.Output != "json" {
 		pterm.Info.Println("Creating browser session...")

cmd/browsers_test.go

@@ -1650,6 +1650,23 @@ func TestBrowsersCreate_WithStartURL(t *testing.T) {
 	assert.Equal(t, "https://example.com", captured.StartURL.Value)
 }
 
+func TestBrowsersCreate_RejectsStartURLFlagToken(t *testing.T) {
+	called := false
+	fake := &FakeBrowsersService{NewFunc: func(ctx context.Context, body kernel.BrowserNewParams, opts ...option.RequestOption) (*kernel.BrowserNewResponse, error) {
+		called = true
+		return &kernel.BrowserNewResponse{}, nil
+	}}
+	b := BrowsersCmd{browsers: fake}
+
+	err := b.Create(context.Background(), BrowsersCreateInput{
+		StartURL: "--headless",
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--start-url requires a URL value")
+	assert.False(t, called)
+}
+
 func TestBrowsersCreate_WithInvalidViewport(t *testing.T) {
 	setupStdoutCapture(t)
 	fake := &FakeBrowsersService{}