SW-211 — Validate package names before using them as process-output labels #393

Summary

Both dev and test project resolvers take package.json name values and use them as child-process labels. These values are untrusted project metadata and are not currently bounded or restricted to a single line. Newlines and unusual formatting characters can forge misleading log prefixes or create excessively large labels. Validate or safely normalize labels before they reach output.

Workstream

• Workstream: WS-SECURITY
• Primary scope: src/dev/project.ts; src/testing/project.ts; tests/dev-project.test.ts; tests/test-project.test.ts
• Protected surface: No
• Priority: P1
• Difficulty: medium
• Proposed points: 150

Acceptance Criteria

• Package names used as labels are bounded to a documented maximum.
• CR/LF and terminal formatting controls cannot inject additional log lines.
• Empty or invalid names use a safe fallback or documented validation error.
• The package manifest itself is never echoed in diagnostics.
• Valid scoped package names remain readable.

Dependencies

None unless noted above.

Out of Scope

• Unrelated architecture or public command-contract changes.
• New runtime dependencies without maintainer approval.
• Mainnet deployment or remote template execution.

Definition of Done

• Acceptance criteria have deterministic regression coverage.
• Security and compatibility boundaries remain intact.
• Supported-platform CI passes.

Labels

• Stellar Wave (do not apply until activation is explicitly authorized)
• type: security
• area: security
• priority: P1
• difficulty: medium
• points: 150
• workstream: security

Sequencing and scope note

Sequencing: implement after SW-214 (#396) and SW-215 (#397). This concerns runtime labels from user project manifests, not generated-template package metadata in #372.