Address remaining review feedback from PR #8

Context

PR #8 ("Add comprehensive docs for newcomers") received two late-round automated reviews (from claude[bot]) after all inline threads were resolved. These items were deferred to a follow-up PR to keep #8 focused.

Source comments:

• https://github.com/shakacode/pack-config-diff/pull/8#issuecomment-4149911599
• https://github.com/shakacode/pack-config-diff/pull/8#issuecomment-4149916677

Must-fix

• Secrets exposure via dump without --clean (configCleaner.ts)
  Plugins like DefinePlugin and EnvironmentPlugin routinely contain API keys and auth tokens. Since --clean is opt-in, dump can inadvertently serialize secrets. At minimum add a visible docs warning; consider whether --clean should default to true or emit a [SENSITIVE] placeholder for known-sensitive plugin properties unconditionally.

• diff always evaluates function-exporting configs in production mode (cli.ts)
  Both --left and --right JS configs are resolved with argv = { mode: "production" }. A user running --left=webpack.dev.js --right=webpack.prod.js silently gets two production configs compared. Add a --mode flag (or --left-mode/--right-mode), or at minimum a runtime warning when a function export is detected.

• resolveRealPath suffix splicing bug (fileWriter.ts:70)
  target.slice(current.length) assumes current is a character-for-character prefix of target, which breaks on case-normalizing filesystems where realpathSync changes the byte-length. Use path.join(realpathSync(current), path.relative(current, target)) instead.

Should-fix

• YAML header injection via embedded newlines (yamlSerializer.ts:44-46)
  Metadata values with embedded \n can inject extra lines into the YAML comment header block, potentially adding content that looks like YAML directives.

• Absolute path bypass in build matrix (buildConfigFile.ts:125)
  Env-var expansion can yield absolute paths that skip the CWD-escape check. Not a vulnerability given the trusted-input contract, but worth guarding or documenting at the field level.

• resolveBuildEnvironmentLabel silent NODE_ENV fallback (cli.ts:631)
  Undocumented behavior where NODE_ENV is used as the output label. A user who sets NODE_ENV=development in the build's environment map will silently get "development" as the output directory name.

• applyEnvVariables missing key validation (cli.ts:527)
  Keys from --env are set directly on process.env without validation. Reuse isValidEnvVarName from buildConfigFile.ts to reject malformed keys early.

• Hand-rolled YAML serializer (yamlSerializer.ts)
  js-yaml's dump() already handles all the quoting edge-cases this custom serializer guards against. Replacing YamlSerializer with a thin yaml.dump() wrapper plus custom type definitions for Function and RegExp would eliminate ~300 lines of fragile serialization logic.

Code quality

• getConstructorName duplicated 3x (configCleaner.ts, configSerializer.ts, yamlSerializer.ts)
  Each has a near-identical implementation with subtly different return types. Extract to a shared utility to reduce drift.

• resolveRealPath edge case comment (fileWriter.ts)
  The fallback when walking to the FS root is correct but the safety guarantee is not obvious. Add a short comment explaining the logic.

• **console.log(\`)->console.log()** (cli.ts:639) Empty template literal is equivalent to console.log(""). Using console.log()` makes the intent (blank line separator) clearer.

Start with the two linked review comments from PR #8, then inspect the named locations in configCleaner.ts, cli.ts, fileWriter.ts, yamlSerializer.ts, and buildConfigFile.ts. Group the work by the Must-fix, Should-fix, and Code quality sections, confirming existing behavior before changing it. Done means the listed feedback is addressed or explicitly documented, including the security warnings and serialization, path, environment, and duplication concerns.