[DevMuhdishaq]

Summary

Adds the SW-087, SW-088, SW-089, and SW-091 deploy verification suites:

• unsafe deploy source rejection (seed phrases, raw StrKeys, filesystem paths, command metacharacters, option-like values) asserted both at the plan boundary and before any subprocess starts;
• the exact stellar contract deploy executable and argument order, with the source alias and network kept as separate argv entries;
• the shell: false spawn boundary, verified by intercepting the process spawner and asserting an argument array is used instead of shell interpolation;
• documented subprocess-failure propagation (non-zero exit, signal termination, start failure with the original cause) and safe, typed exit-code behavior;
• mocked successful deploy output handling that surfaces the contract ID and keeps extra output from changing exit semantics.

Adds a small reusable tests/helpers/mock-child-process.ts fixture so deploy workflows can be exercised deterministically without a Stellar network, identity, or secret. No production code paths are changed.

Testing

• npm test (Vitest) — new suites live under tests/: deploy-source-rejection.test.ts, deploy-argument-order.test.ts, deploy-shell-boundary.test.ts, deploy-subprocess-propagation.test.ts, deploy-contract-id-output.test.ts.
• All child processes are mocked; no live Stellar network or CLI is invoked.
• npm run typecheck, npm run lint, and npm run format:check expectations are unchanged.

Security

• Rejected source values are asserted never to be echoed in validation messages.
• Streamed child output is sanitized (ANSI/control characters removed) before reaching the terminal.
• Subprocess failures render a typed message with exit category 3 and never include raw secret-bearing output.

Closes #187
Closes #188
Closes #189
Closes #191

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e3b6db9e-10a1-4c77-9931-a391ff7a3e30

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}