[akargi]

Summary

Adds the SW-076 and SW-077 configuration regression suites:

• malformed stellarforge.config.json handling: brace/quote/comma syntax errors, truncated JSON, non-JSON text, and empty content all produce the same stable, position-independent stellarforge.config.json is not valid JSON. error with no raw snippet or parser position echoed;
• valid JSON that is not an object (null, [], strings, numbers, booleans) is rejected with the schema guidance instead of a parse error;
• filesystem boundaries: only the exact project-root filename stellarforge.config.json is read, differently named files and nested files are ignored, a directory in place of the file is rejected, and symlinks (file, directory, and dangling) are handled without silently loading attacker-controlled content.

No production code paths are changed; the suites lock down existing, documented behavior.

Testing

• npm test (Vitest) — new suites live under tests/: config-malformed-json.test.ts and config-filesystem-boundaries.test.ts.
• Symlink cases are gated behind a runtime capability probe so they run wherever the platform permits and skip cleanly otherwise.
• npm run typecheck, npm run lint, and npm run format:check expectations are unchanged.

Security

• Parse failures are asserted never to reflect raw file content, so malformed secrets cannot be echoed back to the terminal.
• The loader is verified to read only the fixed project-root filename and to reject symlinked entries rather than following them to arbitrary targets.
• A dangling symlink is treated as a missing configuration rather than an implicit read.

Closes #176
Closes #177

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6358073c-efd8-47c5-a837-f881a4cb3429

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}