@bybrave/arg2

Maintained, drop-in fork of arg — a simple, no-dependency CLI argument parser.

The original has had no release since 2022 (5.0.2) while still pulling ~440M downloads/month. This fork fixes negative-number parsing, adds optional flag values, closes a ReDoS report, and ships ESM plus bundled TypeScript types. The core API is unchanged.

npm install @bybrave/arg2

const arg = require('@bybrave/arg2');   // CommonJS
import arg from '@bybrave/arg2';         // ESM

const args = arg({
    '--port': Number,
    '--host': arg.optional(String),
    '-p': '--port',
});

What's fixed

| Issue | Problem | Fix | |---|---|---| | #52 | A negative number passed without = (--int -100) threw requires argument unless the handler was exactly Number/BigInt. parseInt, parseFloat, String, etc. all broke. | A value that looks like a number (including exponents and leading-dot decimals) is accepted as the option's value for any handler type. | | #70 | The number check ^-?\d*(\.(?=\d))?\d*$ was ReDoS-vulnerable (catastrophic backtracking). | Replaced with a linear, backtracking-free pattern. | | #61 | No way to have an option whose value is optional. | New arg.optional(type) — see below. | | #66 | No ESM entry. | Ships import/require via an exports map; bundled types. |

arg.optional(type)

Wrap a handler so the option's value is optional. With a value it parses normally; without one (at the end of argv, or followed by another option) it resolves to true, like a flag:

const args = arg({ '--host': arg.optional(String) });

arg({ '--host': arg.optional(String) }, { argv: ['--host', 'localhost'] }); // { _: [], '--host': 'localhost' }
arg({ '--host': arg.optional(String) }, { argv: ['--host'] });              // { _: [], '--host': true }
arg({ '--host': arg.optional(String) }, { argv: [] });                      // { _: [] }

Migration from arg

Replace the dependency and the import — everything behaves the same, plus the fixes above. The one intentional behavior change is #52: an option followed by a negative-number-looking token now consumes it as a value instead of throwing. An option followed by a real option (e.g. --foo --bar) still throws, as before.

Support

If this package saves you time, you can support maintenance:

Bitcoin (BTC): bc1q37557q5jpeaxqydzwvf3jgj7zhnfpn2td3q40q

Credits & license

MIT, same as the original — see LICENSE.md. Based on arg by Vercel, Inc.