fix(recovery): restore production typecheck and regression baseline

.changeset/recovery-production-fixes.md

@@ -0,0 +1,5 @@
+---
+"@diginodes/stellarforge-cli": patch
+---
+
+Restore reliable timeout diagnostics, secret redaction, generator type resolution, and cross-platform CLI validation.

.github/workflows/ci.yml

@@ -34,6 +34,9 @@ jobs:
       - name: Install from committed lockfile
         run: npm ci --ignore-scripts --no-audit --no-fund
 
+      - name: Validate GitHub Actions workflows with actionlint
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
+
       - name: Audit workflow least-privilege permissions
         run: npm run audit:workflow-permissions
 

.github/workflows/wave-stale-prs.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-      pull-requests: read
+      pull-requests: write
     steps:
       - name: Warn and escalate stale Wave PRs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9

scripts/audit-workflow-permissions.d.mts

@@ -0,0 +1,9 @@
+export interface WorkflowPermissionViolation {
+  readonly file: string;
+  readonly line: number;
+  readonly message: string;
+}
+
+export function auditWorkflowDirectory(
+  dir: string,
+): WorkflowPermissionViolation[];

scripts/audit-workflow-permissions.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* global process, console */
 /**
  * SW-105 — GitHub Actions least-privilege permissions conformance audit.
  * Static check only. Does not modify workflow permissions.
@@ -19,7 +20,7 @@ const JOB_PERMISSION_ALLOWLIST = {
     publish: new Set(['contents:write', 'id-token:write']),
   },
   'wave-stale-prs.yml': {
-    stale: new Set(['issues:write']),
+    stale: new Set(['issues:write', 'pull-requests:write']),
   },
   'codeql.yml': {
     analyze: new Set(['security-events:write']),
@@ -63,13 +64,13 @@ function extractPermissionBlocks(text) {
       continue;
     }
 
-    const jobMatch = line.match(/^  ([A-Za-z0-9_-]+):\s*$/);
+    const jobMatch = line.match(/^[ ]{2}([A-Za-z0-9_-]+):\s*$/);
     if (jobMatch && currentJob !== null || jobMatch && lines.slice(0, i).some((v) => /^jobs:\s*$/.test(v))) {
       currentJob = jobMatch[1];
     }
 
     const topPerm = line.match(/^permissions:\s*(.*)$/);
-    const jobPerm = line.match(/^    permissions:\s*(.*)$/);
+    const jobPerm = line.match(/^[ ]{4}permissions:\s*(.*)$/);
     const match = topPerm || jobPerm;
     if (!match) continue;
 
@@ -82,7 +83,7 @@ function extractPermissionBlocks(text) {
     } else if (rest.length === 0) {
       let j = i + 1;
       while (j < lines.length) {
-        const entry = lines[j].match(/^ {2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
+        const entry = lines[j].match(/^[ ]{2,6}([A-Za-z0-9_-]+):\s*(\S+)\s*$/);
         if (!entry) break;
         entries.push({ key: entry[1], value: entry[2] });
         j++;

src/commands/deploy.ts

@@ -1,4 +1,3 @@
-
 import { Command } from 'commander';
 import {
   resolveProjectConfig,
@@ -44,9 +43,7 @@ export function createDeployCommand(
   } = options;
 
   return new Command('deploy')
-    .description(
-      'Deploy a supported StellarForge project to Stellar Testnet.',
-    )
+    .description('Deploy a supported StellarForge project to Stellar Testnet.')
     .option(
       '--network <network>',
       'Deployment network. CLI value overrides stellarforge.config.json.',
@@ -59,12 +56,8 @@ export function createDeployCommand(
       const projectRoot = cwd();
 
       const overrides: ProjectConfigOverrides = {
-        ...(flags.network === undefined
-          ? {}
-          : { network: flags.network }),
-        ...(flags.source === undefined
-          ? {}
-          : { identity: flags.source }),
+        ...(flags.network === undefined ? {} : { network: flags.network }),
+        ...(flags.source === undefined ? {} : { identity: flags.source }),
       };
 
       const configuration = resolveConfig(projectRoot, overrides);

src/commands/dev.ts

@@ -1,23 +1,17 @@
-
 import { Command } from 'commander';
 import {
   superviseDevProcesses,
   type DevOrchestratorOptions,
 } from '../dev/orchestrator.js';
-import {
-  resolveDevProcessPlan,
-  type DevProcessSpec,
-} from '../dev/project.js';
+import { resolveDevProcessPlan, type DevProcessSpec } from '../dev/project.js';
 import { TerminalOutput } from '../output/terminal.js';
 
 export interface DevCommandOptions extends DevOrchestratorOptions {
   readonly cwd?: () => string;
   readonly resolvePlan?: (cwd: string) => readonly DevProcessSpec[];
 }
 
-export function createDevCommand(
-  options: DevCommandOptions = {},
-): Command {
+export function createDevCommand(options: DevCommandOptions = {}): Command {
   const {
     cwd = () => process.cwd(),
     resolvePlan = resolveDevProcessPlan,
@@ -30,12 +24,9 @@ export function createDevCommand(
       const workingDirectory = cwd();
       const plan = resolvePlan(workingDirectory);
       const processCount = plan.length;
-      const processLabel =
-        processCount === 1 ? 'process' : 'processes';
+      const processLabel = processCount === 1 ? 'process' : 'processes';
 
-      output.info(
-        `Starting ${processCount} development ${processLabel}.`,
-      );
+      output.info(`Starting ${processCount} development ${processLabel}.`);
 
       await superviseDevProcesses(plan, {
         ...options,

src/commands/doctor.ts

@@ -43,7 +43,10 @@ function sanitizeText(value: string, maxLength: number): string {
     return '';
   }
 
-  let sanitized = value.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+  let sanitized = value
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
 
   for (const pattern of SECRET_PATTERNS) {
     sanitized = sanitized.replace(pattern, '[REDACTED]');

src/commands/root.ts

@@ -1,4 +1,3 @@
-
 import { Command } from 'commander';
 import { resolveCliVersion } from '../version.js';
 import { createDeployCommand } from './deploy.js';
@@ -12,10 +11,7 @@ interface UnknownCommandReporter {
   unknownCommand(): never;
 }
 
-function applyUsageErrorHandling(
-  command: Command,
-  remediation: string,
-): void {
+function applyUsageErrorHandling(command: Command, remediation: string): void {
   command
     .exitOverride()
     .showHelpAfterError(remediation)
@@ -30,9 +26,7 @@ function reportUnknownCommand(command: Command): void {
   (command as unknown as UnknownCommandReporter).unknownCommand();
 }
 
-export function createRootCommand(
-  version = resolveCliVersion(),
-): Command {
+export function createRootCommand(version = resolveCliVersion()): Command {
   const program = new Command()
     .name('stellarforge')
     .description(
@@ -58,9 +52,7 @@ export function createRootCommand(
     program.addCommand(command);
   }
 
-  const commandNames = subcommands
-    .map((command) => command.name())
-    .join(', ');
+  const commandNames = subcommands.map((command) => command.name()).join(', ');
 
   applyUsageErrorHandling(
     program,

src/diagnostics/git.ts

@@ -20,7 +20,7 @@ export function createGitDiagnostic(
       const result = execute('git', ['--version']);
       const outcome = classifyCommandResult(result);
 
-      if (outcome === 'timeout') {
+      if (outcome === 'timed-out') {
         return {
           id: 'git',
           label: 'Git',
@@ -48,7 +48,7 @@ export function createGitDiagnostic(
           id: 'git',
           label: 'Git',
           status: 'fail',
-          message: 'Git returned an unecognized version.',
+          message: 'Git returned an unrecognized version.',
           remediation:
             'Verify `git --version` works and reinstall Git if necessary.',
         };

src/diagnostics/process.ts

@@ -29,7 +29,8 @@ export const runCommand: RunCommand = (executable, args) => {
   };
 };
 
-export type CommandOutcome = 'ok' | 'missing-executable' | 'failed';
+export type CommandOutcome =
+  'ok' | 'missing-executable' | 'timed-out' | 'failed';
 
 /**
  * Recognizes the platform-specific ways Node reports that an executable could
@@ -53,6 +54,13 @@ export function isExecutableNotFound(error: unknown): boolean {
  * diagnostic treats a missing executable consistently.
  */
 export function classifyCommandResult(result: CommandResult): CommandOutcome {
+  if (
+    result.error !== undefined &&
+    (result.error as NodeJS.ErrnoException).code === 'ETIMEDOUT'
+  ) {
+    return 'timed-out';
+  }
+
   if (result.error !== undefined && isExecutableNotFound(result.error)) {
     return 'missing-executable';
   }

src/diagnostics/runtime.ts

@@ -15,9 +15,12 @@ import {
 const MINIMUM_NODE: NumericVersion = { major: 22, minor: 13, patch: 0 };
 const MAXIMUM_NODE_MAJOR = 25;
 const MINIMUM_NPM: NumericVersion = { major: 10, minor: 9, patch: 0 };
-const NODE_REMEDIATION = 'Install Node.js >=22.13.0 and <25.';
-const NPM_REMEDIATION =
+const NODE_REMEDIATION =
+  'Install a supported Node.js release (>=22.13.0 and <25).';
+const NPM_UNAVAILABLE_REMEDIATION =
   'Install npm >=10.9.0 and ensure it is available on PATH.';
+const NPM_VERSION_REMEDIATION =
+  'Install npm >=10.9.0 and verify `npm --version` returns a numeric version.';
 
 function failure(
   id: string,
@@ -83,7 +86,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           'npm is unavailable or could not be executed.',
-          NPM_REMEDIATION,
+          NPM_UNAVAILABLE_REMEDIATION,
         );
       }
 
@@ -95,7 +98,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           'npm returned an unrecognized version.',
-          NPM_REMEDIATION,
+          NPM_VERSION_REMEDIATION,
         );
       }
 
@@ -104,7 +107,7 @@ export function createNpmDiagnostic(
           'npm',
           'npm',
           `Unsupported npm version ${version}.`,
-          NPM_REMEDIATION,
+          NPM_VERSION_REMEDIATION,
         );
       }
 

src/diagnostics/stellar.ts

@@ -15,7 +15,8 @@ const STELLAR_CLI_INSTALL_URL =
 
 function parseStellarVersion(output: string): string | null {
   const value = output.trim();
-  const match = /^v?(\d+\.\d+\.\d+)(?:[-+][0-9A-Za-z.-]+)?$/.exec(value);
+  const match =
+    /^v?(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
   return match?.[1] ?? null;
 }
 
@@ -36,8 +37,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: 'Stellar CLI is unavailable or could not be executed.',
-          remediation:
-            `Install or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}), then ensure \`stellar\` is on PATH and \`stellar version --only-version\` reports a version.`,
+          remediation: `Install or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}), then ensure \`stellar\` is on PATH and \`stellar version --only-version\` reports a version.`,
         };
       }
 
@@ -50,8 +50,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: 'Stellar CLI returned an unrecognized version.',
-          remediation:
-            `Run \`stellar version --only-version\`; if it does not report a semantic version, reinstall or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}).`,
+          remediation: `Run \`stellar version --only-version\`; if it does not report a semantic version, reinstall or update the official Stellar CLI (${STELLAR_CLI_INSTALL_URL}).`,
         };
       }
 
@@ -61,8 +60,7 @@ export function createStellarDiagnostic(
           label: 'Stellar CLI',
           status: 'fail',
           message: `Unsupported Stellar CLI version ${version}.`,
-          remediation:
-            `Update the official Stellar CLI to >=27.1.0 (${STELLAR_CLI_INSTALL_URL}), then verify \`stellar version --only-version\` reports a supported version.`,
+          remediation: `Update the official Stellar CLI to >=27.1.0 (${STELLAR_CLI_INSTALL_URL}), then verify \`stellar version --only-version\` reports a supported version.`,
         };
       }
 

src/generator/template-generation.ts

@@ -72,11 +72,13 @@ function copyTemplateTree(
   variables: Readonly<Record<string, string>>,
 ): void {
   const sourceDirectory = resolve(templateRoot, relativeDirectory);
-  const entries = readdirSync(sourceDirectory, { withFileTypes: true }).sort((a, b) => {
-    if (a.name < b.name) return -1;
-    if (a.name > b.name) return 1;
-    return 0;
-  });
+  const entries = readdirSync(sourceDirectory, { withFileTypes: true }).sort(
+    (a, b) => {
+      if (a.name < b.name) return -1;
+      if (a.name > b.name) return 1;
+      return 0;
+    },
+  );
 
   for (const entry of entries) {
     assertSafeEntryName(entry.name);

src/output/redaction.ts

@@ -4,7 +4,7 @@ const STELLAR_SECRET_STRKEY = /\bS[A-Z2-7]{55}\b/g;
 const MAX_REDACTION_INPUT_LENGTH = 8192;
 const SENSITIVE_ASSIGNMENT =
   /((?:secret(?:[ _-]?key)?|private[ _-]?key|seed(?:[ _-]?phrase)?|mnemonic|password|passphrase|(?:api|auth|access)?[_-]?token)["']?\s*[:=]\s*)\S.*$/gi;
-const BEARER_CREDENTIAL = /\b(Bearer\s+)[A-Za-z0-9._~+\/-]+=*/gi;
+const BEARER_CREDENTIAL = /\b(Bearer\s+)[A-Za-z0-9._~+/-]+=*/gi;
 
 /**
  * Replaces secret-like material in a single line of untrusted text.
@@ -20,6 +20,6 @@ export function redactSecretLikeText(line: string): string {
       : line;
   return bounded
     .replace(STELLAR_SECRET_STRKEY, REDACTED_PLACEHOLDER)
-    .replace(BEARER+_CREDENTIAL, `$1${REDACTED_PLACEHOLDER}`)
-    .replace(SENSITIVE_ASSOIGNMENT, `$1${REDACTED_PLACEHOLDER}`);
+    .replace(BEARER_CREDENTIAL, `$1${REDACTED_PLACEHOLDER}`)
+    .replace(SENSITIVE_ASSIGNMENT, `$1${REDACTED_PLACEHOLDER}`);
 }

src/validate.ts

@@ -2,7 +2,7 @@ import type {
   ProjectGenerationResult,
   ProjectGeneratorInput,
   ProjectGeneratorServices,
-} from './types.js';
+} from './generator/types.js';
 
 export function orchestrateProjectGeneration(
   input: ProjectGeneratorInput,