[dDevAhmed]

Summary

Maintainer-owned recovery PR for production TypeScript blockers, regression failures and cross-platform CI validation exposed after restoring workflow execution.

Production fixes

• Add a distinct timed-out command outcome based on Node's ETIMEDOUT error code and align Git, Docker and Rust diagnostic handling.
• Correct the Git timeout comparison and diagnostic spelling.
• Repair misspelled redaction constant references that caused runtime failures in secret-redaction/deployment tests.
• Correct the project generator types import in src/validate.ts.
• Improve Stellar CLI version parsing for prerelease plus build metadata.
• Restore the intended Node/npm remediation messages.

Test and CI repairs

• Fix strict TypeScript test errors and regression test fixtures.
• Make npm invocation and package dry-run tests work on Windows.
• Make Markdown fenced-JSON and workflow parsers CRLF-safe.
• Add the workflow audit module type declaration.
• Apply the repository's declared Prettier formatting baseline.
• Add pinned actionlint validation for GitHub Actions workflow syntax and expressions.
• Preserve the explicit least-privilege workflow permission audit.

Release

• Includes a patch changeset for @diginodes/stellarforge-cli.
• No publishing is performed.

Validation

All required checks passed on exact PR head 38b91fd00e300efc74ae20e210fdd42fc2c835d8: actionlint, workflow permission audit, typecheck, lint, formatting, full tests, build, E2E, Linux Node 22/24, macOS Node 22, Windows Node 22, CodeQL, Dependency Review and Contributor PR Guard.

CI run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43351345818
CodeQL run: https://github.com/DigiNodes/stellarforge-cli/actions/runs/43351345824

Separation / safeguards

• This PR does not include Smart Contract metadata coverage from SW-046 — Add Smart Contract Cargo metadata conformance #148.
• PR test(templates): validate generated Smart Contract Cargo metadata #289 has a maintainer request-changes review to remove overlapping production repairs and retain only SW-046 — Add Smart Contract Cargo metadata conformance #148 metadata coverage.
• No weakening of protected-surface controls or deployment policy.
• No npm publishing.
• No Drips activation, points, issue assignment, or Stellar Wave label changes.

Summary by CodeRabbit

• Bug Fixes
  • Improved diagnostics when commands time out, including clearer guidance for Node.js and npm setup issues.
  • Fixed secret redaction and normalized whitespace in diagnostic output.
  • Improved Stellar version parsing and corrected an error message for unrecognized versions.
  • Fixed generator type resolution and made CLI validation more reliable across platforms.
• Quality
  • Added automated checks for workflow files and permissions.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The pull request updates CLI timeout diagnostics, remediation text, Stellar version parsing, secret redaction, and a type import. It also changes CLI and test formatting, updates release-pack and cross-platform test checks, and adds workflow validation and permission-audit changes.

Changes: CLI recovery and validation

Layer / File(s)	Summary
Diagnostic outcomes and output handling src/diagnostics/*, src/commands/doctor.ts, src/output/redaction.ts, tests/docker-diagnostic.test.ts, tests/doctor-output-conformance.test.ts, .changeset/recovery-production-fixes.md	Timeout classification and Git handling now use the timed-out outcome. Runtime remediation text and Stellar version parsing are adjusted. The doctor command normalizes whitespace, and the redaction chain uses the intended identifiers.
CLI commands and generated-project validation src/commands/*, src/generator/*, src/validate.ts, tests/basic-app-package-metadata.test.ts, tests/config-*.test.ts, tests/configuration-reference-examples.test.ts, tests/quick-start-docs.test.ts, tests/deploy-*.test.ts, tests/deployment-docs-conformance.test.ts, tests/critical-path.test.ts, tests/generator-destination-containment.test.ts, tests/helpers/package-metadata.ts	CLI command formatting and the generator type import are updated. Related tests adjust formatting, accept CRLF JSON fences, and refine assertions for generated projects and deployment validation.
Process and release test coverage tests/dev-*.test.ts, tests/helpers/mock-child-process.ts, tests/test-orchestration-regression.test.ts, tests/npm-invocation-metacharacters.test.ts, tests/release-pack-snapshot.test.ts, tests/test-workflow-platform-and-exit.test.ts, tests/exit-code-reference.test.ts	Process fixtures and tests are updated. Platform-specific npm assertions are adjusted, and the release-pack helper checks spawn errors, nonzero exits, and empty package results.

Workflow validation and permissions

Layer / File(s)	Summary
Workflow permission audit and CI checks .github/workflows/ci.yml, .github/workflows/wave-stale-prs.yml, scripts/audit-workflow-permissions.*, tests/workflow-permissions.test.ts, tests/release-workflow.test.ts	The quality job runs actionlint. The stale-review job receives pull-requests: write, and the permission audit allowlist and indentation matching are updated. Workflow tests adjust predicate formatting and handle CRLF lines.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Possibly related issues

• Issue 290 concerns CI workflow validity, actionlint checks, and least-privilege stale-PR permissions. This pull request adds actionlint validation and updates stale-PR permissions; the issue’s maintainer approval and live-run requirements are not established here.

Suggested reviewers: codesailor4, suleimanjem-hash, kobbzy

Merge Risk: Minimal · up to 38b91

This change fixes timeout diagnostics, secret redaction, a type import and cross-platform test handling. No merge-blocking risk was found. A fresh full CI run should pass before merge, as the author notes.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "fix(recovery): restore production typecheck and regression baseline" matches the main thrust of the changeset. The diff fixes production TypeScript errors (for example, the validate.ts type…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix(recovery): restore production typecheck and regression baseline" matches the main thrust of the changeset. The diff fixes production TypeScript errors (for example, the validate.ts type import now resolves from ./generator/types.js), repairs test typing and fixtures, and restores a regression baseline across Git, Docker, Node/npm, and Stellar diagnostics. The title does not cover every detail, such as the actionlint CI step and the workflow permission change, but that is expected. The title is specific and conventional-commit formatted, so a teammate scanning history can identify the primary change.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f5d4701-ad7a-46cd-b05c-a770c103c170

Commits

Reviewing files that changed from the base of the PR and between c56832b and 38b91fd.

Files selected for processing: 43

• .changeset/recovery-production-fixes.md
• .github/workflows/ci.yml
• .github/workflows/wave-stale-prs.yml
• scripts/audit-workflow-permissions.d.mts
• scripts/audit-workflow-permissions.mjs
• src/commands/deploy.ts
• src/commands/dev.ts
• src/commands/doctor.ts
• src/commands/root.ts
• src/diagnostics/git.ts
• src/diagnostics/process.ts
• src/diagnostics/runtime.ts
• src/diagnostics/stellar.ts
• src/generator/template-generation.ts
• src/output/redaction.ts
• src/validate.ts
• tests/basic-app-package-metadata.test.ts
• tests/config-network-enum.test.ts
• tests/config-secret-field-name-variants.test.ts
• tests/configuration-reference-examples.test.ts
• tests/critical-path.test.ts
• tests/deploy-missing-config-remediation.test.ts
• tests/deploy-network-rejection.test.ts
• tests/deploy-source-rejection.test.ts
• tests/deploy-strkey-rejection-matrix.test.ts
• tests/deploy-testnet-e2e.test.ts
• tests/deployment-docs-conformance.test.ts
• tests/dev-orchestrator-signal-idempotency.test.ts
• tests/dev-orchestrator-startup-and-buffering.test.ts
• tests/dev-supervisor-cleanup.test.ts
• tests/docker-diagnostic.test.ts
• tests/doctor-output-conformance.test.ts
• tests/exit-code-reference.test.ts
• tests/generator-destination-containment.test.ts
• tests/helpers/mock-child-process.ts
• tests/helpers/package-metadata.ts
• tests/npm-invocation-metacharacters.test.ts
• tests/quick-start-docs.test.ts
• tests/release-pack-snapshot.test.ts
• tests/release-workflow.test.ts
• tests/test-orchestration-regression.test.ts
• tests/test-workflow-platform-and-exit.test.ts
• tests/workflow-permissions.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.