Harden CLI lane filtering and diagnostics redaction

internal/cli/run.go

@@ -98,6 +98,11 @@ func runConfigValidate(args []string, stdout, stderr io.Writer, opts Options) in
 		fmt.Fprintln(stderr, "notarius: --only requires --pipeline")
 		return 2
 	}
+	only, err := parseOnly(*onlyRaw)
+	if err != nil {
+		fmt.Fprintf(stderr, "notarius: %v\n", err)
+		return 2
+	}
 
 	cfg, path, err := loadConfig(*configPath, opts)
 	if err != nil {
@@ -108,7 +113,7 @@ func runConfigValidate(args []string, stdout, stderr io.Writer, opts Options) in
 	if strings.TrimSpace(*pipelineID) != "" {
 		if _, err := cfg.Resolve(config.ResolveInput{
 			PipelineID: *pipelineID,
-			Only:       parseOnly(*onlyRaw),
+			Only:       only,
 			Catalog:    opts.Catalog,
 		}); err != nil {
 			fmt.Fprintf(stderr, "notarius: %v\n", err)
@@ -239,18 +244,20 @@ func requireConfigFile(path string) error {
 	return nil
 }
 
-func parseOnly(raw string) []string {
+func parseOnly(raw string) ([]string, error) {
 	if strings.TrimSpace(raw) == "" {
-		return nil
+		return nil, nil
 	}
 	parts := strings.Split(raw, ",")
 	result := make([]string, 0, len(parts))
 	for _, part := range parts {
-		if trimmed := strings.TrimSpace(part); trimmed != "" {
-			result = append(result, trimmed)
+		trimmed := strings.TrimSpace(part)
+		if trimmed == "" {
+			return nil, fmt.Errorf("--only must contain comma-separated non-empty artifact lane IDs")
 		}
+		result = append(result, trimmed)
 	}
-	return result
+	return result, nil
 }
 
 func sortedPipelineIDs(cfg config.Config) []string {

internal/cli/run_test.go

@@ -168,6 +168,32 @@ func TestRunConfigValidateOnlyWithoutPipelineFails(t *testing.T) {
 	}
 }
 
+func TestRunConfigValidateRejectsMalformedOnlyValues(t *testing.T) {
+	configPath := writeTestConfig(t, testConfigYAML("example", "events", "notes"))
+	tests := []string{",", "notes,", ",notes", "events, ,notes"}
+
+	for _, only := range tests {
+		t.Run(only, func(t *testing.T) {
+			var stdout bytes.Buffer
+			var stderr bytes.Buffer
+
+			code := RunWithOptions([]string{"config", "validate", "--config", configPath, "--pipeline", "example", "--only", only}, &stdout, &stderr, Options{
+				Catalog: fakeCatalog(t),
+			})
+
+			if code != 2 {
+				t.Fatalf("RunWithOptions() code = %d, want 2", code)
+			}
+			if stdout.Len() != 0 {
+				t.Fatalf("stdout = %q, want empty", stdout.String())
+			}
+			if !strings.Contains(stderr.String(), "--only") {
+				t.Fatalf("stderr = %q, want --only error", stderr.String())
+			}
+		})
+	}
+}
+
 func TestRunPipelinesListSortedTextOutput(t *testing.T) {
 	configPath := writeTestConfig(t, testConfigYAMLForPipelines(map[string][]string{
 		"zeta":  {"events"},