test(dev): cover supervisor startup order and partial-line buffering

[nafsonig]

Summary

Two dev-supervisor behaviours had no coverage at all. The existing
dev-orchestrator.test.ts writes only whole lines (child.stdout.write('ready\n'))
and never asserts the order in which children are spawned, so both of these
regressions could land without a single test turning red.

#158 — startup order is a real contract

superviseDevProcesses walks specs in order and spawns each child before
registering the next one's listeners. That ordering is load-bearing: a later
workflow may depend on an earlier one already being up. If the loop were ever
reordered or parallelised, nothing would fail.

Locked down here:

• children spawn in declared order (database → api → worker);
• a mid-loop spawn failure is reported against the spec that actually failed,
  and the workflow before it was started in order first;
• argv is forwarded as an array, so the spawner can keep shell: false.

#159 — partial-line buffering is a security property

createPrefixedLineWriter buffers a trailing partial line for one specific reason,
stated in the source:

Child output is untrusted: buffer partial lines so secret-like values split
across chunks are still redacted as a whole before reaching the terminal.

Eagerly emitting chunks would leak the tail of a split credential straight to the
terminal — the exact failure the buffering exists to prevent. Four cases cover it:

• a partial line is held until its newline arrives;
• a credential split mid-label (api_tok + en=sk_live_…) is reassembled and
  redacted as one value, so the raw secret never appears;
• stdout and stderr buffer independently, so halves of two lines cannot interleave;
• a trailing partial line is flushed on stream end.

Issue references

Closes #157

Closes #158

Closes #159

Closes #160

What this PR actually changes

Implemented in full — #158 and #159.

Not implemented here:

• SW-055 — Add cross-template package-file allowlist test #157 (SW-055, cross-template package-file allowlist) belongs to the template
  generator, a different subsystem from the dev supervisor.
• SW-059 — Add dev stderr prefix regression tests #160 (SW-059, stderr prefix regression) is already covered: the existing
  suite asserts captured.stderrText()).toContain('[api] warning') and that
  stdout and stderr stay on separate paths, which is the property that issue asks
  for. This file adds buffering coverage on top of it rather than repeating it.

Note

The existing suite's "terminates children and removes signal handlers after
SIGINT/SIGTERM" emits each signal once, so the shuttingDown idempotency guard
is untouched by this PR and is covered separately. The tests here deliberately do
not overlap that path.

Not run

node_modules was not installed and the suite was not executed, per your
constraint. Worth one local run to confirm — particularly the redaction case,
which asserts against redactSecretLikeText's real behaviour for an
api_token= assignment.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 500f6c26-c037-4723-93eb-925e0ba8b872

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}