Stop echoing a mistyped secret given where a contract id is expected

[fnando]

What

Commands sharing UnresolvedContract (--id/STELLAR_CONTRACT_ID) echoed the raw input in the contract not found (and, for a seed phrase, Invalid name) error, leaking a secret key or seed phrase pasted there. The error now conceals secret-shaped input (custom Debug too), while still naming a genuine alias typo so you can see which value was wrong. Same conditional naming extended to the address params from #2785.

The contract-id counterpart to #2763 and #2785, which didn't cover this path.

$ stellar contract fetch --id SBF5HLRREHMS36XZNTUSKZ6FTXDZGNXOHF4EXKUL5UCWZLPBX3NGJ4BX --network testnet
❌ error: contract not found

$ stellar contract fetch --id "illness spike retreat truth genius clock brain pass fit cave bargain xyzzy" --network testnet
❌ error: contract not found

$ stellar contract fetch --id nosuchalias --network testnet
❌ error: contract not found: nosuchalias

$ stellar token balance --id native --account SBF5HLRREHMS36XZNTUSKZ6FTXDZGNXOHF4EXKUL5UCWZLPBX3NGJ4BX
❌ error: invalid address or alias

$ stellar token balance --id native --account "illness spike retreat truth genius clock brain pass fit cave bargain xyzzy"
❌ error: invalid address or alias

$ stellar token balance --id native --account nosuchalias
❌ error: address alias 'nosuchalias' not found

Why

A secret is a bearer credential; a one-char typo still reveals effectively all of it. The new vector is STELLAR_CONTRACT_ID, echoed without ever being typed. Detection is shape-based because a mistyped secret no longer parses.

Known limitations

A 50+ char all-base32 alias starting with S, or a 12+ word alias, is treated as secret-shaped and not named.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical redaction and secret-detection issues, plus error handling that can hide unrelated failures.

Review effort: Lite
Findings: 3 · 1

Open (4)

• Derived Debug leaks raw ContractNotFound input · New
• Derived Debug leaks raw AccountAliasNotFound input · New
• Strict secret heuristic leaks near-secret inputs · New
• Overbroad locator error suppression hides configuration and I/O failures · New

What changed in this PR

This PR prevents secret-shaped contract IDs and addresses from being echoed in errors or debug output while preserving useful alias diagnostics.

Changes:

• Adds secret-shape detection and conditional redaction.
• Updates contract and address resolution errors.
• Adds unit and integration coverage.

File	Description
cmd/​soroban-cli/​src/​config/​secret.rs	Secret-shape detection and tests
cmd/​soroban-cli/​src/​config/​sc_address.rs	Conditional address error concealment
cmd/​soroban-cli/​src/​config/​locator.rs	Conditional contract error concealment
cmd/​soroban-cli/​src/​config/​alias.rs	Contract resolution and debug protection
cmd/​crates/​soroban-test/​tests/​it/​config.rs	CLI integration tests

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate redaction gaps remain in alias errors, debug formatting, prefix mutations, and Unicode typo detection.

Review effort: Lite
Findings: 3

Open (3)

• Conceal input-bearing lookup errors · New
• Redact malformed strkey prefix mutations · New
• Derived Debug leaks raw ContractNotFound input

Resolved since last review (3)

• Strict secret heuristic leaks near-secret inputs
• Derived Debug leaks raw AccountAliasNotFound input
• Overbroad locator error suppression hides configuration and I/O failures

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 1 · 1

Open (2)

• ContractNotFound still stores the raw input String. Even though Display now redacts… · New
• The comment says “12 or 24 words”, but the implementation treats any input with ≥ 12… · New

Resolved since last review (3)

• Redact malformed strkey prefix mutations
• Conceal input-bearing lookup errors
• Derived Debug leaks raw ContractNotFound input

[Copilot]

Copilot review overview

🟡 Changes recommended

A critical 11-token seed-phrase detection gap and a moderate terminal-escape injection issue remain unresolved.

Review effort: Lite
Findings: 1

Open (1)

• Recognize 11-token near-complete seed phrases · New

Resolved since last review (2)

• ContractNotFound still stores the raw input String. Even though Display now redacts…
• The comment says “12 or 24 words”, but the implementation treats any input with ≥ 12…

[Copilot]

Copilot review overview

🟡 Changes recommended

One critical and two moderate secret-redaction issues remain unresolved.

Review effort: Lite
Findings: 1

Open (1)

• Suppress ambiguity warnings for secret-shaped aliases · New

Resolved since last review (1)

• Recognize 11-token near-complete seed phrases

[Copilot]

Copilot review overview

🔵 Needs a closer look

Alias and debug output can still emit unescaped terminal control characters.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Suppress ambiguity warnings for secret-shaped aliases

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None