[feyishola]

Summary

Adds regression coverage for the deployment security boundaries and for unknown-command/option UX. Writing these tests uncovered three defects, fixed here:

1. Secret reflection (SW-090): supervised subprocess output was printed verbatim, so secret keys, seed phrases or tokens emitted by the Stellar CLI reached the terminal. Lines are now redacted before printing, and partial lines are buffered so a secret split across output chunks is still caught.
2. Unknown commands (SW-094): stellarforge deplo reported too many arguments followed by a full help dump. It now reports unknown command 'deplo', suggests (Did you mean deploy?), and lists the registered commands.
3. Unknown subcommand options (SW-095): stellarforge deploy --bogus exited 1 instead of the validation code 2, because addCommand does not inherit the root's exitOverride. All subcommand usage errors now exit 2 with a one-line --help hint.

Related Issue

Closes #193
Closes #190
Closes #194
Closes #195
Also addresses #190, #194 and #195 (SW-093 depends on SW-090; SW-094/SW-095 share the root-command change).

Scope

• src/output/redaction.ts: redactSecretLikeText (Stellar S… secret strkeys, bearer tokens, and values after sensitive labels such as secret, seed phrase, mnemonic, password, token).
• src/dev/orchestrator.ts: buffered, redacting line writer; flushes on stream end, exit and error.
• src/commands/root.ts: root reports unknown commands via Commander's unknownCommand(); concise remediation on root and every subcommand.
• Tests:
  • deployment-security.test.ts: umbrella suite running the real deploy path with only node:child_process mocked. It covers the network, source, process and output boundaries, and after every test it asserts that any spawned invocation targets Testnet only.
  • deploy-output-secrets.test.ts, redaction.test.ts: secret non-reflection.
  • unknown-command.test.ts, unknown-option.test.ts: remediation copy, consistent exit codes, no post-v1 commands advertised.
  • Shared helpers: fake child process, synthetic secret fixtures, in-process root-command runner.
• Out of scope: --help, --version and no-argument behaviour are unchanged.

Testing

• Tests added/updated where applicable
• Existing relevant tests pass
• Lint/type/build checks pass where available

npm run typecheck, npm run lint, npm run format:check and npm test all pass (37 files, 249 tests). The new suites are deterministic and offline: no real subprocesses or network access. All secret fixtures are synthetic.

Two existing assertions in tests/executable.test.ts were updated: root usage errors now print a concise hint instead of the full help text.

Security Impact

• No security-sensitive behavior is changed
• Security-sensitive behavior is changed and explained below

Security notes: subprocess output (dev, test, deploy) is now redacted before reaching the terminal. Redaction is conservative: after a sensitive label, the rest of that line is withheld, because multi-word values like seed phrases can't be reliably bounded. Unterminated lines are buffered up to 64 KiB before being flushed. Mainnet deployment remains impossible, and the umbrella suite locks this in.

Release Impact

• No published/user-visible behavior change

• Patch

• Minor

• Breaking/pre-1.0 contract change

• Changeset included where required

• Changeset not required; reason explained below

Release notes: clearer unknown-command/option errors with consistent exit code 2; secret-like values are redacted from subprocess output.

Documentation

• Documentation updated where applicable
• No documentation change required

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1626a59b-0893-4aa2-b352-d462d884672b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}