Oh I found the code. https://github.com/lightsofapollo/b2g-scripts/blob/master/scripts/server.js#L39-L46
actually default value of --dirs is GAIA_DIR/apps and we only have test cases for apps/*, so it's relative safe without --dir argument.