Fix CLI token set command

internal/config/config_test.go

@@ -112,6 +112,50 @@ func TestFormatDurationSpelling(t *testing.T) {
 	}
 }
 
+// A word the parser does not expect has to be refused, not ignored: the flag
+// package stops at the first non-flag argument, so a command that accepted one
+// would silently drop every option after it - including the one naming the
+// file it writes.
+func TestParseRefusesStrayArguments(t *testing.T) {
+	newSet := func() (*Set, *string, *bool) {
+		var listen string
+		var flagged bool
+		s := NewSet("test", "UNCENSORED_SEND_TEST_")
+		s.String(&listen, "listen", "l", "default", "ADDR", "listen address")
+		s.Bool(&flagged, "vanity", "", false, "a boolean")
+		return s, &listen, &flagged
+	}
+
+	for _, args := range [][]string{
+		{"--vanity", "false"},               // the value a boolean never takes
+		{"stray"},                           // a word on its own
+		{"--vanity", "false", "-l", "here"}, // options after the stray word
+	} {
+		s, listen, _ := newSet()
+		err := s.Parse(args)
+		if err == nil {
+			t.Errorf("Parse(%q) was accepted; listen = %q", args, *listen)
+			continue
+		}
+		if !strings.Contains(err.Error(), "unexpected argument") {
+			t.Errorf("Parse(%q) failed with %v, which does not name the problem", args, err)
+		}
+	}
+
+	// The forms that are actually correct still parse.
+	for _, args := range [][]string{
+		{"--vanity=false"},
+		{"--vanity", "-l", "here"},
+		{"-l", "here"},
+		{},
+	} {
+		s, _, _ := newSet()
+		if err := s.Parse(args); err != nil {
+			t.Errorf("Parse(%q) = %v, want it accepted", args, err)
+		}
+	}
+}
+
 // The convention is: one hyphen for a letter, two for a word. It is enforced
 // here because the stdlib flag package treats both forms as the same.
 func TestHyphenConvention(t *testing.T) {