Harden CLI lane filtering and diagnostics redaction

internal/cli/run_test.go

@@ -168,6 +168,32 @@ func TestRunConfigValidateOnlyWithoutPipelineFails(t *testing.T) {
 	}
 }
 
+func TestRunConfigValidateRejectsMalformedOnlyValues(t *testing.T) {
+	configPath := writeTestConfig(t, testConfigYAML("example", "events", "notes"))
+	tests := []string{",", "notes,", ",notes", "events, ,notes"}
+
+	for _, only := range tests {
+		t.Run(only, func(t *testing.T) {
+			var stdout bytes.Buffer
+			var stderr bytes.Buffer
+
+			code := RunWithOptions([]string{"config", "validate", "--config", configPath, "--pipeline", "example", "--only", only}, &stdout, &stderr, Options{
+				Catalog: fakeCatalog(t),
+			})
+
+			if code != 2 {
+				t.Fatalf("RunWithOptions() code = %d, want 2", code)
+			}
+			if stdout.Len() != 0 {
+				t.Fatalf("stdout = %q, want empty", stdout.String())
+			}
+			if !strings.Contains(stderr.String(), "--only") {
+				t.Fatalf("stderr = %q, want --only error", stderr.String())
+			}
+		})
+	}
+}
+
 func TestRunPipelinesListSortedTextOutput(t *testing.T) {
 	configPath := writeTestConfig(t, testConfigYAMLForPipelines(map[string][]string{
 		"zeta":  {"events"},