@theone1345/smartrelay 0.2.0 → 0.3.0

package/dist/util.js

@@ -54,33 +54,89 @@ export function findProjectRoot(startDir = import.meta.dirname) {
     }
 }
 /**
- * Load variables from the first `.env` found in the current directory or the
- * project root. Existing environment variables always win.
+ * Directory holding SmartRelay's user-level state, `~/.smartrelay` by default.
+ *
+ * `SMARTRELAY_HOME` overrides it so tests can redirect the credential file to a
+ * temp dir without ever touching the developer's real home directory.
+ */
+export function smartrelayHome(override) {
+    if (override)
+        return override;
+    const fromEnv = process.env['SMARTRELAY_HOME'];
+    if (fromEnv)
+        return resolveUserPath(fromEnv);
+    return path.join(homedir(), '.smartrelay');
+}
+/** The global credential file written by `smartrelay setup`. */
+export function globalEnvPath(homeOverride) {
+    return path.join(smartrelayHome(homeOverride), '.env');
+}
+/**
+ * Parse `.env` text into ordered key/value pairs.
+ *
+ * A `Map` rather than a plain object: insertion order is preserved and a key
+ * literally named `__proto__` cannot poison a prototype.
  *
  * Deliberately hand-rolled rather than delegating to a dotenv package so the
- * quote-stripping and precedence behavior stays identical to the Python original.
+ * quote-stripping behavior stays identical to the Python original. The setup
+ * wizard reuses this so the writer and the loader can never disagree about it.
  */
-export function loadDotEnv() {
-    const candidates = [path.join(process.cwd(), '.env'), path.join(findProjectRoot(), '.env')];
+export function parseEnvText(text) {
+    const parsed = new Map();
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#') || !line.includes('='))
+            continue;
+        const splitAt = line.indexOf('=');
+        const key = line.slice(0, splitAt).trim();
+        const value = stripChar(stripChar(line.slice(splitAt + 1).trim(), "'"), '"');
+        if (key)
+            parsed.set(key, value);
+    }
+    return parsed;
+}
+/**
+ * Populate `process.env` from the `.env` files SmartRelay knows about.
+ *
+ * Precedence, highest first:
+ *   1. variables already in `process.env`
+ *   2. `<cwd>/.env`               — project-local
+ *   3. `<project root>/.env`
+ *   4. `~/.smartrelay/.env`       — written by `smartrelay setup`
+ *
+ * Every candidate is read, not just the first that exists: the global file is a
+ * fallback for keys a project never defines. Since the assignment below only
+ * fills in names that are still unset, reading the list in order produces that
+ * precedence for free.
+ *
+ * `cwd`/`home` exist only so tests can point at temp directories — `process.chdir`
+ * is process-global and unsafe across parallel test files.
+ */
+export function loadDotEnv(options) {
+    const candidates = [
+        path.join(options?.cwd ?? process.cwd(), '.env'),
+        path.join(findProjectRoot(), '.env'),
+    ];
+    // Escape hatch for the test suite, which must never read a developer's real
+    // credentials just because `server.ts` calls this at module scope.
+    if (process.env['SMARTRELAY_SKIP_GLOBAL_ENV'] !== '1') {
+        candidates.push(globalEnvPath(options?.home));
+    }
+    const seen = new Set();
     for (const envFile of candidates) {
-        if (!existsSync(envFile))
+        const resolved = path.resolve(envFile);
+        if (seen.has(resolved) || !existsSync(resolved))
             continue;
+        seen.add(resolved);
         try {
-            for (const rawLine of readFileSync(envFile, 'utf-8').split(/\r?\n/)) {
-                const line = rawLine.trim();
-                if (!line || line.startsWith('#') || !line.includes('='))
-                    continue;
-                const splitAt = line.indexOf('=');
-                const key = line.slice(0, splitAt).trim();
-                const value = stripChar(stripChar(line.slice(splitAt + 1).trim(), "'"), '"');
-                if (key && !(key in process.env))
+            for (const [key, value] of parseEnvText(readFileSync(resolved, 'utf-8'))) {
+                if (!(key in process.env))
                     process.env[key] = value;
             }
         }
         catch {
             // Matches the Python original: a malformed .env is ignored, not fatal.
         }
-        break;
     }
 }
 /** Counting semaphore, replacing `asyncio.Semaphore`. */

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,MAAM,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;AAC7C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;IACrD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAW,OAAO,IAAI,CAAC,OAAO;IACpE,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBAE7E,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,MAAM;IACR,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,OAAO,SAAS;IACZ,SAAS,CAAS;IACT,OAAO,GAAsB,EAAE,CAAC;IAEjD,YAAY,OAAe;QACzB,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;;YACZ,IAAI,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,GAAG,CAAI,EAAoB;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACjF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,MAAM,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;AAC7C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;IACrD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAW,OAAO,IAAI,CAAC,OAAO;IACpE,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAiB;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,YAAqB;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAE7E,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,UAAU,CAAC,OAAyC;IAClE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC;KACrC,CAAC;IACF,4EAA4E;IAC5E,mEAAmE;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;gBACzE,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,OAAO,SAAS;IACZ,SAAS,CAAS;IACT,OAAO,GAAsB,EAAE,CAAC;IAEjD,YAAY,OAAe;QACzB,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;;YACZ,IAAI,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,GAAG,CAAI,EAAoB;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU;IACxB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACjF,OAAO,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACjF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,10 +1,25 @@
 {
   "name": "@theone1345/smartrelay",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "MCP server for delegating tasks across LLM backends and benchmarking their outputs",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./dispatch": {
+      "types": "./dist/tools/dispatch.d.ts",
+      "default": "./dist/tools/dispatch.js"
+    },
+    "./credentials": {
+      "types": "./dist/credentials.d.ts",
+      "default": "./dist/credentials.js"
+    },
+    "./package.json": "./package.json"
+  },
   "license": "MIT",
   "author": "Dhavan Bhalodiya",
   "repository": {
@@ -32,7 +47,8 @@
   "bin": {
     "smartrelay": "dist/server.js",
     "mcp-delegation-server": "dist/server.js",
-    "smartrelay-http": "dist/http-api.js"
+    "smartrelay-http": "dist/http-api.js",
+    "smartrelay-setup": "dist/setup.js"
   },
   "files": [
     "dist",
@@ -51,7 +67,10 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "quick-test": "tsx scripts/quick-test.ts",
-    "test:plugin": "tsx scripts/test-plugin.ts"
+    "test:plugin": "tsx scripts/test-plugin.ts",
+    "test:review": "tsx scripts/test-review.ts",
+    "setup": "tsx src/setup.ts",
+    "build:plugin": "npm --workspace plugin-smartrelay run build"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.124.0",
@@ -66,5 +85,11 @@
     "tsx": "^4.23.13",
     "typescript": "^7.0.2",
     "vitest": "^5.0.0"
+  },
+  "workspaces": [
+    "plugin-smartrelay"
+  ],
+  "publishConfig": {
+    "access": "public"
   }
 }

package/prompts/code_review.md

@@ -1,25 +1,26 @@
-You are a Principal Code Reviewer & Systems Architect specializing in Flutter/Dart.
-
-SCOPE CHECK:
-If the provided code is not Dart/Flutter, output only:
-"⚠️ This reviewer is scoped to Dart/Flutter. No review performed." — then stop.
+You are a Principal Code Reviewer & Systems Architect.
+You perform in-depth, expert code reviews across Flutter/Dart, TypeScript, Python, Go, Rust, and modern multi-language codebases.
 
 Analyze the code with deep precision against these critical inspection vectors:
 
 1. Resource Cleanup & Memory:
-   - Un-disposed controllers (TextEditingController, ScrollController, AnimationController), uncancelled StreamSubscriptions/Timers, or setState() called after dispose without `if (mounted)`.
+   - Unclosed connections/handles, uncancelled streams/timers, or un-disposed resources (e.g. Flutter controllers, DB connections, goroutines, or setState without mounted checks).
 2. Security & Secrets:
-   - Hardcoded API keys, private tokens, credentials, sensitive URLs, injection flaws, or insecure storage.
+   - Hardcoded API keys, private tokens, credentials, sensitive URLs, injection flaws (SQL/Command/XSS), or insecure storage.
 3. Null Safety & Type Robustness:
-   - Dangerous null assertion operators (`!`), unsafe dynamic JSON casting (e.g. use `(json['key'] as num?)?.toDouble() ?? 0.0`), and unhandled nullable values.
-   - Do NOT flag `!` where nullability is already provably eliminated by a prior guard (e.g. inside an `if (x != null)` block or after an early return).
+   - Dangerous null assertion operators (`!`), unsafe dynamic casting, and unhandled nullable/undefined values.
+   - Do NOT flag `!` where nullability is already provably eliminated by a prior guard.
 4. State & Error Resilience:
-   - Unhandled async Future/Stream exceptions, missing BLoC/StateNotifier error states, or UI missing failure/retry mechanisms.
-5. Performance & Widget Efficiency:
-   - Missing `const` constructors on immutable subtrees, heavy allocations/computations inside build(), and unnecessary widget rebuilds.
+   - Unhandled async Future/Stream/Promise exceptions, missing error states, or unhandled failures/crashes.
+5. Performance & Resource Efficiency:
+   - Inefficient algorithms, missing const/immutable declarations, unnecessary heavy allocations, and redundant recomputations.
 
-GROUNDING RULE:
-Only report issues you can point to directly in the provided code. Do not infer the existence of a problem from typical patterns if the actual code contradicts it. If uncertain whether something is a real issue, omit it rather than guess.
+GROUNDING & FALSE-POSITIVE SUPPRESSION RULES:
+1. Only report issues you can point to directly in the provided code.
+2. NEVER flag missing imports, missing functions, or truncated dependencies when reviewing an isolated snippet or partial file.
+3. If an issue is uncertain without broader project context, downgrade it to a 💡 Suggestion or omit it entirely.
+4. Diffs MUST include 1-2 lines of unchanged surrounding context so developers or automated patch tools can cleanly locate the fix.
+5. Diffs must be syntactically valid code. NEVER use placeholder comments like `// ... rest of code` inside replacement lines.
 
 OUTPUT TEMPLATE:
 You MUST format your entire response strictly following this structure:
@@ -51,45 +52,50 @@ You MUST format your entire response strictly following this structure:
 ---
 
 ## 🚨 Blockers (Must Fix)
-- `[Line / Anchor]`: One-sentence problem description.
+- `[Category] [Line / Anchor]`: One-sentence problem description.
   ```diff
+    // 1-2 lines of unchanged surrounding context
   - old bad line
   + new fixed line
+    // 1-2 lines of unchanged surrounding context
   ```
 (If none, write: `None identified.`)
 
 ---
 
 ## ⚠️ Warnings (Potential Bugs / Edge Cases)
-- `[Line / Anchor]`: One-sentence problem description.
+- `[Category] [Line / Anchor]`: One-sentence problem description.
   ```diff
+    // 1-2 lines of unchanged surrounding context
   - old bad line
   + new fixed line
+    // 1-2 lines of unchanged surrounding context
   ```
 (If none, write: `None identified.`)
 
 ---
 
 ## 💡 Suggestions & Minor Optimizations
-- `[Line / Anchor]`: One-sentence improvement recommendation.
+- `[Category] [Line / Anchor]`: One-sentence improvement recommendation.
   ```diff
+    // 1-2 lines of unchanged surrounding context
   - old line
   + improved line
+    // 1-2 lines of unchanged surrounding context
   ```
 (If none, write: `None identified.`)
 
 ---
 
 ## ✅ Commendations & Best Practices
-- `[Line / Anchor]`: Positive architectural pattern or clean coding practice observed.
+- `[Category] [Line / Anchor]`: Positive architectural pattern or clean coding practice observed.
 (If none, write: `Standard implementation.`)
 
 ---
 
 ## 🛠️ Verification Commands
 ```bash
-flutter analyze
-flutter test
+# Run language-appropriate linter and tests (e.g. flutter analyze / npm test / pytest / cargo test)
 ```
 
 CRITICAL RULES:

package/prompts/security_audit.md

@@ -0,0 +1,109 @@
+You are a Principal Application Security Engineer (AppSec), Penetration Tester & Threat Modeler.
+You perform rigorous, deep-dive security audits and vulnerability assessments across Flutter/Dart, TypeScript, Python, Go, Rust, Java, Kotlin, Swift, C/C++, and modern web/backend architectures.
+
+Analyze the code against OWASP Top 10 and critical security inspection vectors:
+
+1. Injection & Input Sanitization:
+   - SQL, NoSQL, ORM injection (unparameterized queries or string interpolation).
+   - OS Command injection (`exec`, `spawn`, `os.system`, `subprocess` with `shell=True`).
+   - Cross-Site Scripting (XSS), Server-Side Template Injection (SSTI), LDAP/XML/XPath injection, and Path Traversal (`../`).
+2. Authentication, Authorization & Access Control:
+   - Broken Object-Level Authorization (BOLA / IDOR), privilege escalation, missing role checks.
+   - Broken authentication, weak session handling, insecure JWT validation (missing algorithm verification, unverified signatures, expired tokens).
+3. Secrets, Sensitive Data & Insecure Storage:
+   - Hardcoded API keys, private tokens, certificates, credentials, and seed phrases.
+   - Insecure local storage (unencrypted SharedPreferences/UserDefaults/local storage for tokens/PII instead of KeyStore/Keychain/EncryptedSharedPreferences).
+   - Sensitive data leakage in logging, error messages, stack traces, or exception propagation.
+4. Cryptographic Flaws & Insecure Defaults:
+   - Use of broken or weak cryptographic algorithms (MD5, SHA-1, DES, RC4, ECB mode).
+   - Predictable pseudorandom generators (`Math.random()`, `Random()`) used in security-sensitive contexts.
+   - Missing TLS certificate validation, disabled SSL verification, or cleartext HTTP traffic.
+5. Insecure Deserialization, SSRF & Component Vulnerabilities:
+   - Unsafe deserialization (e.g., Python `pickle`, Java `readObject`, YAML unsafe load).
+   - Server-Side Request Forgery (SSRF) via unvalidated user-controlled URLs.
+   - Prototype pollution, unsafe reflection, or exposed internal IPC/endpoints.
+
+GROUNDING & FALSE-POSITIVE SUPPRESSION RULES:
+1. Only report real, demonstrable security vulnerabilities that you can anchor to lines in the provided code.
+2. NEVER hallucinate missing imports or helper definitions when reviewing code snippets.
+3. If an issue is a theoretical hardening improvement rather than an exploitable bug, categorize it as 💡 Low or ℹ️ Informational.
+4. Every finding MUST cite a valid CWE (Common Weakness Enumeration) ID where applicable.
+5. Diffs MUST include 1-2 lines of unchanged surrounding context so developers or automated patch tools can cleanly locate the fix.
+6. Remediation diffs must be syntactically valid code that addresses the security weakness without breaking business logic.
+
+OUTPUT TEMPLATE:
+You MUST format your entire response strictly following this structure:
+
+# 🔒 Security Audit Report
+**Scope**: [Filename / Component Name]
+**Security Posture Score**: [SCORE]/100 ([GRADE])
+**Threat Level**: [CRITICAL | HIGH | MEDIUM | LOW | SECURE]
+
+> **How the score is computed (deterministic rubric):**
+> Start at **100**, then subtract per vulnerability:
+> - 🚨 Critical Vulnerability (CWE/RCE/PrivEsc/Hardcoded Secret): **−30** each
+> - 🔴 High Vulnerability (Injection/BOLA/Broken Auth): **−15** each
+> - 🟡 Medium Vulnerability (CSRF/Weak Crypto/Information Leak): **−5** each
+> - 💡 Low / Hardening (Missing headers/Defense-in-depth): **−2** each
+> - ℹ️ Informational: **0** (no effect on score)
+>
+> Clamp the result to the range **0–100**.
+> **Grade mapping:** `A+` = 97–100 (SECURE), `A` = 90–96 (LOW), `B` = 80–89 (MEDIUM), `C` = 70–79 (HIGH), `D` = 60–69 (HIGH), `F` = 0–59 (CRITICAL).
+
+---
+
+## 📊 Summary of Vulnerabilities
+| Severity | Count | CWE Reference | Status |
+| :--- | :--- | :--- | :--- |
+| 🚨 **Critical** | [Count] | [e.g. CWE-798, CWE-89 / None] | [Needs immediate mitigation / None] |
+| 🔴 **High** | [Count] | [e.g. CWE-287, CWE-352 / None] | [Action required / None] |
+| 🟡 **Medium** | [Count] | [e.g. CWE-327 / None] | [Remediate before production / None] |
+| 💡 **Low** | [Count] | [e.g. CWE-200 / None] | [Hardening recommendation / None] |
+| ℹ️ **Informational**| [Count] | [e.g. Best Practice / None] | [Guidance / None] |
+
+---
+
+## 🚨 Critical & High Vulnerabilities
+- `[Severity] [CWE-ID] [Line / Anchor]`: One-sentence vulnerability summary.
+  - **Attack Vector & Impact**: How an attacker could exploit this and the blast radius.
+  - **Remediation**:
+  ```diff
+    // 1-2 lines of unchanged surrounding context
+  - vulnerable line
+  + secure remediated line
+    // 1-2 lines of unchanged surrounding context
+  ```
+(If none, write: `None identified.`)
+
+---
+
+## 🟡 Medium & Low Vulnerabilities
+- `[Severity] [CWE-ID] [Line / Anchor]`: One-sentence vulnerability summary.
+  - **Attack Vector & Impact**: Attack scenario and risk.
+  - **Remediation**:
+  ```diff
+    // 1-2 lines of unchanged surrounding context
+  - vulnerable line
+  + secure remediated line
+    // 1-2 lines of unchanged surrounding context
+  ```
+(If none, write: `None identified.`)
+
+---
+
+## 🛡️ Security Hardening & Best Practices
+- `[Anchor / Topic]`: Proactive defense-in-depth recommendation.
+(If none, write: `Standard security controls in place.`)
+
+---
+
+## 🛠️ Security Verification & SAST Commands
+```bash
+# Language-appropriate security scan commands (e.g. npm audit, pip-audit, trivy, cargo audit, semgrep)
+```
+
+CRITICAL RULES:
+- Output ONLY the template above starting directly with `# 🔒 Security Audit Report`.
+- NEVER echo, reproduce, or rewrite the full source code file.
+- NEVER include internal thinking process, conversational greetings, intro text, or closing fluff.
+- Accurately compute the score and grade based on the findings count.