[kragent66-glitch]

Description

tools/wordlist-gen called fs.Parse directly, so the standard flag package stopped at the first non-flag argument: wordlist-gen acme.com -o out.txt silently ignored both acme.com and the -o after it, exited 0, and wrote ./wordlist.txt. An invalid -combine value and an empty -o also exited 1 instead of 2.

This change:

• gives wordlist-gen the same interspersed parsing main.go uses (parseInterspersed + endsWithTerminator), so flags written after a positional are still parsed;
• rejects a leftover positional with Error: unexpected argument "acme.com"; to take subdomains from a domain, pass -domain acme.com and exit 2;
• returns the usage code 2 for an invalid -combine value and an empty -o (was 1).

Runtime errors that are correctly 1 are unchanged: an existing file without -f, "no entries generated", and file create/write errors.

Note on the rest of #120

The other two items in the issue are already satisfied at HEAD de87d846 and documented in CHANGELOG.md (Unreleased → Fixed): an unreadable -r file exits 1 (loadPool, main.go:345-349) and argument errors are reported before the simulation banner (validateFlags, main.go:601-616). This PR covers the remaining wordlist-gen items.

Closes #120

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING document
• My code follows the code style of this project (gofmt clean)
• I have added/updated appropriate comments to the code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly (CHANGELOG.md bullet)

Verification

Run locally on this branch:

• go build ./... — OK
• go test -race ./... — all packages ok

End-to-end with the built tool:

command	before	after
wordlist-gen acme.com	exit 0, wrote ./wordlist.txt	exit 2, names -domain
wordlist-gen acme.com -o out.txt	exit 0, ignored -o	exit 2, no file written
wordlist-gen -combine 'bad!.x' -o c.txt	exit 1	exit 2
wordlist-gen -o ''	exit 1	exit 2
wordlist-gen -domain acme.com -o ok.txt	exit 0	exit 0 (unchanged)

Sabotage check: the new/updated tests fail on the pre-fix wordlist-gen.go (every case reported exit 1) and pass with the fix. TestRunGuards was updated to expect 2 for an invalid -combine.

Known issues

• parseInterspersed/endsWithTerminator are copied verbatim from main.go because the tools/ tool is a separate package main and cannot import the root package. Sharing them through a small internal package is a possible follow-up; I kept it a copy to hold the diff minimal.

Ethical Considerations

• This change maintains or improves the security controls in the tool
• This change follows the educational/legitimate security testing focus of the project
• I have considered potential misuse cases and taken appropriate steps to prevent them

[TMHSDigital]

Thanks for this, @kragent66-glitch — clean fix, and the before/after table and sabotage check made it easy to verify (all reproduced locally). Merged. One housekeeping note: v0.9.0 was cut while this was open, so the CHANGELOG line landed in the 0.9.0 section on merge; I moved it to Unreleased in a follow-up commit. Your note about sharing parseInterspersed with main.go through a small internal package is a good follow-up if you're interested.