Separator-only inputs like --event-codes ',' passed pre-transform Required checks, then BuildArgs omitted the key and ConfirmFirst write paths could still call MCP. Enforce non-empty transform results for Required flags and add CrossPlatformCoverage regression coverage. Co-authored-by: Cursor <cursoragent@cursor.com>