fix: address code-review findings

- validate: run config warnings against RAW (pre-resolution) config so a
  correctly-externalized \ is not flagged as hardcoded; this fixes
  'validate --strict' falsely failing CI when secrets are set in .env
- validate: silence loadConfig's per-var warnings (already reported in aggregate)
- validator: also detect hardcoded secrets in the env block, keyed precisely by
  the last key segment so benign keys like PASSWORD_RESET_URL don't false-positive
- compose: generic services no longer auto-inherit a DB-type healthcheck by
  coincidental type name; they only get healthchecks explicitly declared in health_checks
- logger: add getLevel(); tests for all of the above (225 passing)

Author: nazarli-shabnam

src/commands/validate.ts

@@ -2,8 +2,9 @@ import * as path from 'path';
 import * as yaml from 'js-yaml';
 import { findProjectRoot, loadConfig, loadEnvFile, findUnresolvedVars } from '../core/config/loader';
 import { checkConfigWarnings } from '../core/config/validator';
+import type { DevEnvConfig } from '../types/config';
 import { fileExists, readFile } from '../utils/file-ops';
-import { logger } from '../utils/logger';
+import { logger, LogLevel } from '../utils/logger';
 
 export interface ValidateOptions {
   /** When true, treat warnings and unresolved ${VAR} references as failures (non-zero exit). */
@@ -33,8 +34,16 @@ export async function runValidate(options: ValidateOptions = {}): Promise<void>
   const raw = yaml.load(await readFile(configPath), { schema: yaml.DEFAULT_SCHEMA });
   const unresolved = findUnresolvedVars(raw);
 
-  // Full schema validation (throws with readable issues on failure).
-  const config = await loadConfig(projectRoot);
+  // Full schema validation (throws with readable issues on failure). loadConfig
+  // resolves ${VAR} and would re-warn for each unset one, which we already report
+  // in aggregate below, so silence its per-occurrence warnings during this call.
+  const prevLevel = logger.getLevel();
+  logger.setLevel(LogLevel.ERROR);
+  try {
+    await loadConfig(projectRoot);
+  } finally {
+    logger.setLevel(prevLevel);
+  }
 
   if (unresolved.length > 0) {
     logger.warn(
@@ -44,7 +53,9 @@ export async function runValidate(options: ValidateOptions = {}): Promise<void>
   }
 
   // Surface non-fatal config warnings (hardcoded secrets, port conflicts, ...).
-  const warnings = checkConfigWarnings(config);
+  // Check the RAW config so correctly-externalized secrets (still `${VAR}` here)
+  // are not mistaken for hardcoded ones after resolution.
+  const warnings = checkConfigWarnings((raw ?? {}) as DevEnvConfig);
 
   if (options.strict && (unresolved.length > 0 || warnings.length > 0)) {
     throw new Error(

src/core/config/validator.ts

@@ -28,6 +28,16 @@ function isLiteralSecret(value: string | undefined): boolean {
   return !!value && !value.includes('${');
 }
 
+const SECRET_KEY_WORDS = ['password', 'secret', 'token', 'key', 'pass', 'auth', 'apikey'];
+
+// True only when the env key clearly NAMES a secret, judged by its last
+// underscore/hyphen segment — so DB_PASSWORD / API_KEY match, but benign keys
+// like PASSWORD_RESET_URL (ends in "url") do not.
+function isSecretEnvKey(key: string): boolean {
+  const last = key.split(/[_-]/).pop()?.toLowerCase() ?? '';
+  return SECRET_KEY_WORDS.includes(last);
+}
+
 /**
  * Check for common configuration issues. Each issue is logged as a warning and
  * also returned, so callers (e.g. `validate --strict`) can act on them.
@@ -39,11 +49,17 @@ export function checkConfigWarnings(config: DevEnvConfig): string[] {
     logger.warn(msg);
   };
 
-  // Check for hardcoded passwords in known secret locations (should be in .env).
-  // Only inspect real secret fields so keys like `password_reset_url` don't false-positive.
-  if (config.databases?.some((db) => isLiteralSecret(db.password))) {
+  // Check for hardcoded secrets in known secret locations (should be in .env).
+  // Only inspect real secret fields so keys like `password_reset_url` don't false-positive:
+  //   - database passwords
+  //   - env values whose KEY looks secret-bearing (password/secret/token/key/auth)
+  const hardcodedDbPassword = config.databases?.some((db) => isLiteralSecret(db.password));
+  const hardcodedEnvSecret = Object.entries(config.env ?? {}).some(
+    ([key, value]) => isSecretEnvKey(key) && isLiteralSecret(value)
+  );
+  if (hardcodedDbPassword || hardcodedEnvSecret) {
     warn(
-      'Warning: Passwords detected in configuration file.\n' +
+      'Warning: Hardcoded secrets detected in configuration file.\n' +
       'Consider using environment variables (${VAR_NAME}) and .env file for secrets.'
     );
   }

src/core/docker/compose-generator.ts

@@ -48,13 +48,19 @@ function renderHealthcheckFragment(test: string[], hc?: HealthCheck): string {
  * Resolution order:
  *   1. A matching `health_checks` entry that specifies a raw `test` command (any service, incl. generic ones).
  *   2. A matching entry whose `type` is a known database type.
- *   3. Built-in defaults for known database `serviceType`s.
- * Returns undefined when no healthcheck can be determined (e.g. an unknown generic service with no `test`).
+ *   3. (databases only) Built-in defaults for the known database `serviceType`.
+ *
+ * `allowTypeDefault` gates step 3: it is true for databases (a postgres container
+ * should get pg_isready automatically) but false for generic services, so a
+ * service that merely happens to be typed e.g. "redis" does not silently inherit
+ * a `redis-cli` healthcheck its image may not support. Generic services only get
+ * a healthcheck they explicitly declared via `health_checks`.
  */
 function buildHealthcheckForService(
   serviceName: string,
   serviceType: string,
-  healthChecks: HealthCheck[] | undefined
+  healthChecks: HealthCheck[] | undefined,
+  allowTypeDefault: boolean
 ): string | undefined {
   const matched = healthChecks?.find(
     (h) => h.name === serviceName || h.type === serviceType
@@ -68,6 +74,8 @@ function buildHealthcheckForService(
     return renderHealthcheckFragment(DB_HEALTHCHECK_TESTS[matched.type], matched);
   }
 
+  if (!allowTypeDefault) return undefined;
+
   const test = DB_HEALTHCHECK_TESTS[serviceType];
   if (!test) return undefined;
   return renderHealthcheckFragment(test, matched);
@@ -104,7 +112,7 @@ function databaseToComposeService(
     if (db.database) env.MONGO_INITDB_DATABASE = db.database;
   }
 
-  const healthcheck = buildHealthcheckForService(name, db.type, healthChecks);
+  const healthcheck = buildHealthcheckForService(name, db.type, healthChecks, true);
 
   return {
     name,
@@ -125,7 +133,7 @@ function serviceToComposeService(
   const ports: string[] = [];
   if (svc.port) ports.push(`${svc.port}:${svc.port}`);
   if (svc.management_port) ports.push(`${svc.management_port}:${svc.management_port}`);
-  const healthcheck = buildHealthcheckForService(name, svc.type, healthChecks);
+  const healthcheck = buildHealthcheckForService(name, svc.type, healthChecks, false);
   return {
     name,
     image: svc.type,

src/utils/logger.ts

@@ -23,6 +23,10 @@ class Logger {
     this.level = level;
   }
 
+  getLevel(): LogLevel {
+    return this.level;
+  }
+
   private formatMessage(level: string, message: string, ...args: any[]): string {
     const timestamp = new Date().toISOString();
     const formattedArgs = args.map(arg => 

tests/commands/validate.test.ts

@@ -63,6 +63,27 @@ describe('validate command', () => {
     await expect(runValidate({ strict: true })).rejects.toThrow(/--strict|unresolved/);
   });
 
+  it('does not flag a correctly-externalized secret as hardcoded under --strict', async () => {
+    // Regression: checkConfigWarnings must run on the raw config so that a
+    // ${DB_PASSWORD} resolved from .env is not mistaken for a hardcoded secret.
+    await fs.writeFile(
+      path.join(tempDir, '.dev-env.yml'),
+      [
+        'name: app',
+        'databases:',
+        '  - type: postgresql',
+        '    port: 5432',
+        '    user: ${DB_USER}',
+        '    password: ${DB_PASSWORD}',
+        '    database: app',
+      ].join('\n')
+    );
+    await fs.writeFile(path.join(tempDir, '.env'), 'DB_USER=u\nDB_PASSWORD=secret123\n');
+    process.chdir(tempDir);
+
+    await expect(runValidate({ strict: true })).resolves.toBeUndefined();
+  });
+
   it('resolves a variable defined in the config env block', async () => {
     await fs.writeFile(
       path.join(tempDir, '.dev-env.yml'),

tests/core/config/validator.test.ts

@@ -1,4 +1,4 @@
-import { validateConfig, checkConfigWarnings } from '../../../src/core/config/validator';
+import { validateConfig, checkConfigWarnings } from '../../../src/core/config/validator';
 import type { DevEnvConfig } from '../../../src/types/config';
 import { logger } from '../../../src/utils/logger';
 
@@ -87,7 +87,7 @@ describe('validator', () => {
       };
       checkConfigWarnings(config as DevEnvConfig);
       expect(warnSpy).toHaveBeenCalledWith(
-        expect.stringContaining('Passwords detected')
+        expect.stringContaining('secrets detected')
       );
     });
 
@@ -98,7 +98,7 @@ describe('validator', () => {
         env: { PASSWORD_RESET_URL: 'https://example.com/reset' },
       };
       checkConfigWarnings(config as unknown as DevEnvConfig);
-      expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('Passwords detected'));
+      expect(warnSpy).not.toHaveBeenCalledWith(expect.stringContaining('secrets detected'));
     });
 
     it('returns the list of warnings it emits', () => {
@@ -109,7 +109,27 @@ describe('validator', () => {
         ],
       };
       const warnings = checkConfigWarnings(config as DevEnvConfig);
-      expect(warnings.some((w) => w.includes('Passwords detected'))).toBe(true);
+      expect(warnings.some((w) => w.includes('secrets detected'))).toBe(true);
+    });
+
+    it('warns on a hardcoded secret in the env block (secret-like key)', () => {
+      const config = {
+        name: 'app',
+        databases: [{ type: 'redis' as const, port: 6379, host: 'localhost' }],
+        env: { API_KEY: 'sk-live-abc123' },
+      };
+      checkConfigWarnings(config as unknown as DevEnvConfig);
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('secrets detected'));
+    });
+
+    it('does not warn on an env placeholder secret value', () => {
+      const config = {
+        name: 'app',
+        databases: [{ type: 'redis' as const, port: 6379, host: 'localhost' }],
+        env: { API_KEY: '${API_KEY}' },
+      };
+      checkConfigWarnings(config as unknown as DevEnvConfig);
+      expect(warnSpy).not.toHaveBeenCalled();
     });
 
     it('warns when postgresql missing user or password', () => {

tests/core/docker/compose-generator.test.ts

@@ -95,6 +95,17 @@ describe('compose-generator', () => {
       expect(content).toContain('retries: 3');
     });
 
+    it('does not auto-apply a DB healthcheck to a generic service by coincidental type', () => {
+      const config = {
+        name: 'app',
+        services: [{ type: 'redis', port: 6379, host: 'localhost' }],
+        docker: {},
+      } as DevEnvConfig;
+      const content = generateComposeContent(config, templatesDir);
+      expect(content).toContain('redis_1:');
+      expect(content).not.toContain('healthcheck:');
+    });
+
     it('includes custom service with port and management_port', () => {
       const config = {
         name: 'app',