But also like as a matter of principle it's annoying when you're working on a big codebase, and you have weird, hidden, silently explosive unwritten contracts between random components

Package managers is an especially bad example because github projects typically are github.com/author-name/words-separated-by-dashes

So you will probably have somebody along the way pester you about allowing dashes between words, to play nice with github

But who's to know if the guy making that change will think of disallowing dashes at the start of the words? Likely he'll just add \- to /[A-Z\-]+/

Suddenly the script you wrote starts getting passed positional arguments that have dashes in them, until some wise guy tries to create a package called `--verbose`, then notices unintended effects on your pages, goes ahead trying `--verbose -- react`, ...

So anyway -- if I'm making a heavily reusable piece of code like this I make it as general purpose as possible in a way that makes it impossible to mis-use it

You don't know what it's going to be used for when you get that prompt. Not handling arbitrary strings is a bug