codepolisher-cli 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ImPerial TeK. Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,250 @@
+<div align="center">
+
+<img src="https://capsule-render.vercel.app/api?type=waving&color=0:6366f1,100:a855f7&height=160&section=header&text=CodePolisher%20CLI&fontSize=48&fontColor=ffffff&fontAlignY=38&desc=AI-powered%20code%20review%20from%20your%20terminal&descAlignY=58&descSize=16" width="100%" />
+
+<br/>
+
+[![Node.js 18+](https://img.shields.io/badge/node.js-18+-6366f1?style=for-the-badge&logo=nodedotjs&logoColor=white)](https://nodejs.org/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-a855f7?style=for-the-badge)](LICENSE)
+[![Tests](https://img.shields.io/badge/tests-4%20passing-22c55e?style=for-the-badge&logo=githubactions&logoColor=white)](https://github.com/v1ral-ITS/codepolisher-cli/actions/workflows/test.yml)
+[![Providers](https://img.shields.io/badge/AI%20providers-8-f59e0b?style=for-the-badge)](#supported-providers)
+[![Version](https://img.shields.io/badge/version-1.1.0-3b82f6?style=for-the-badge)](package.json)
+
+<br/>
+
+> **Polish code. Catch issues. Ship with confidence.**
+> Review files or piped source with the AI provider you already use—without tying your workflow to a hosted backend.
+
+<br/>
+
+</div>
+
+---
+
+## Table of Contents
+
+- [How it works](#how-it-works)
+- [Supported Providers](#supported-providers)
+- [Install](#install)
+- [Usage](#usage)
+- [Configuration](#configuration)
+- [Architecture](#architecture)
+- [Security](#security)
+- [Development](#development)
+
+---
+
+## How it works
+
+CodePolisher reads a file or standard input, builds a focused review prompt, sends it directly to your selected provider, and renders structured findings for a human or CI pipeline.
+
+```
+  Source Code           Review Pipeline             Result
+ ┌──────────────┐     ┌────────────────────┐     ┌─────────────────┐
+ │ file.js      │────▶│ Detect language    │────▶│ Summary         │
+ │ script.py    │────▶│ Apply focus/rules  │────▶│ Inline findings │
+ │ stdin pipe   │────▶│ Call your provider │────▶│ JSON or terminal│
+ └──────────────┘     └────────────────────┘     └─────────────────┘
+```
+
+Your provider key stays under your control. CodePolisher CLI does not require Base44 and does not proxy reviews through the CodePolisher website.
+
+---
+
+## Supported Providers
+
+| Provider | Config name | Environment variable | Default model |
+|----------|-------------|----------------------|---------------|
+| OpenAI | `openai` | `OPENAI_API_KEY` | `gpt-4o-mini` |
+| Anthropic | `anthropic` | `ANTHROPIC_API_KEY` | `claude-3-5-haiku-20241022` |
+| Google Gemini | `gemini` | `GEMINI_API_KEY` | `gemini-1.5-flash` |
+| DeepSeek | `deepseek` | `DEEPSEEK_API_KEY` | `deepseek-chat` |
+| Venice.ai | `venice` | `VENICE_API_KEY` | `zai-org-glm-5-1` |
+| Groq | `groq` | `GROQ_API_KEY` | `openai/gpt-oss-20b` |
+| OpenRouter | `openrouter` | `OPENROUTER_API_KEY` | Account default |
+| Ollama | `ollama` | None required | `llama3.2` |
+
+Larger files automatically use the provider's configured large-file model unless you set an explicit model.
+
+---
+
+## Install
+
+### Directly from GitHub
+
+```bash
+npm install -g git+https://github.com/v1ral-ITS/codepolisher-cli.git
+```
+
+### From source
+
+```bash
+git clone https://github.com/v1ral-ITS/codepolisher-cli.git
+cd codepolisher-cli
+npm install
+npm link
+```
+
+> **Requires:** Node.js 18 or newer
+
+---
+
+## Usage
+
+```bash
+# Review a file
+codepolisher review src/index.js
+
+# Review piped code
+cat src/index.js | codepolisher review --language javascript
+
+# Focus the review
+codepolisher review app.py --focus security,performance
+
+# Run a security audit
+codepolisher review server.js --security
+
+# Apply project-specific rules
+codepolisher review api.ts --rules "Require error handling and input validation."
+
+# Emit machine-readable output for CI
+codepolisher review app.js --output json --fail-on-critical
+```
+
+### Review controls
+
+| Option | Purpose |
+|--------|---------|
+| `--language <lang>` | Supply a language hint |
+| `--focus <areas>` | Focus on security, performance, readability, error handling, best practices, or testing |
+| `--rules <text>` | Add custom review rules |
+| `--strict` | Flag every issue |
+| `--security` | Run a security-focused audit |
+| `--output json` | Produce JSON for scripts and CI |
+| `--fail-on-critical` | Exit with code 1 when critical issues are found |
+
+---
+
+## Configuration
+
+```bash
+# Choose a provider
+codepolisher config set provider openai
+
+# Save a provider-specific API key
+codepolisher config set api-key <your-key>
+
+# Optionally override the model
+codepolisher config set model gpt-4o
+
+# Inspect or clear configuration
+codepolisher config get
+codepolisher config clear
+```
+
+Environment variables work without a local configuration file, so CI can inject provider keys through repository secrets.
+
+For Ollama, no API key is required:
+
+```bash
+codepolisher config set provider ollama
+codepolisher config set model llama3.2
+codepolisher config set ollama-host http://localhost:11434
+```
+
+---
+
+## Architecture
+
+<details>
+<summary>View project structure</summary>
+
+```
+bin/
+└── codepolisher.js          # Executable entry point
+src/
+├── index.js                 # Commander program and commands
+├── api.js                   # Provider adapters and response parsing
+├── config.js                # Provider detection and secure local config
+├── prompt.js                # Review and security prompt builders
+├── display.js               # Human-readable terminal output
+└── commands/
+    ├── review.js            # File/stdin review workflow
+    └── config-cmd.js        # Configuration commands
+test/
+└── providers.test.js        # Provider endpoint and environment tests
+```
+
+</details>
+
+### Design principles
+
+- 🔌 **Provider-independent** — use a cloud provider, an aggregator, or local Ollama
+- 🔐 **Keys stay yours** — environment variables are first-class and saved keys are provider-specific
+- 🧰 **Terminal-native** — review files, pipes, and CI jobs without a browser
+- 🤖 **Automation-ready** — structured JSON and meaningful failure exit codes
+- 🧩 **Extensible** — provider adapters and prompts are isolated by responsibility
+
+---
+
+## Security
+
+Saved configuration lives in `~/.codepolisher/config.json`. CodePolisher applies restrictive permissions on macOS and Linux and a private current-user ACL on Windows. It fails instead of silently saving when those protections cannot be applied.
+
+For CI and shared machines, prefer provider environment variables and your platform's encrypted secret store.
+
+---
+
+## Development
+
+```bash
+# Install exact dependencies
+npm ci
+
+# Run the test suite
+npm test
+
+# Exercise the CLI locally
+node bin/codepolisher.js --help
+
+# Verify the package contents before publishing
+npm pack --dry-run
+```
+
+Tests run on Node.js 18, 20, and 22 through GitHub Actions.
+
+---
+
+## License
+
+[MIT](LICENSE) — use it however you want.
+
+---
+
+<div align="center">
+
+<br/>
+
+<img src="https://i.ibb.co/gFJwwVL4/ITSolutions-LOGO.jpg" alt="ImPerial TeK. Solutions" width="120" />
+
+<br/>
+
+**Bear Carrington**
+
+*Founder | ImPerial TeK. Solutions (ITSolutions)*
+
+📧 [ITSolutions_MGNT@proton.me](mailto:ITSolutions_MGNT@proton.me) &nbsp;·&nbsp; 🌐 [codepolisher.app](https://codepolisher.app)
+
+<br/>
+
+*Innovating technology with precision and integrity.*
+
+© ImPerial TeK. Solutions — All Rights Reserved
+
+<br/>
+
+*If CodePolisher CLI improved your workflow, consider giving it a star ⭐*
+
+<img src="https://capsule-render.vercel.app/api?type=waving&color=0:a855f7,100:6366f1&height=80&section=footer" width="100%" />
+
+</div>

package/bin/codepolisher.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import '../src/index.js';

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "codepolisher-cli",
+  "version": "1.1.0",
+  "description": "Provider-independent AI code review in your terminal",
+  "keywords": [
+    "ai",
+    "cli",
+    "code-review",
+    "developer-tools",
+    "openai",
+    "anthropic",
+    "gemini",
+    "ollama"
+  ],
+  "author": "Bear Carrington (ImPerial TeK. Solutions) <ITSolutions_MGNT@proton.me> (https://codepolisher.app)",
+  "homepage": "https://github.com/v1ral-ITS/codepolisher-cli#readme",
+  "bugs": {
+    "url": "https://github.com/v1ral-ITS/codepolisher-cli/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/v1ral-ITS/codepolisher-cli.git"
+  },
+  "type": "module",
+  "bin": {
+    "codepolisher": "bin/codepolisher.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "start": "node bin/codepolisher.js",
+    "prepublishOnly": "npm test"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "ora": "^8.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT"
+}

package/src/api.js

@@ -0,0 +1,149 @@
+import { DEFAULT_MODELS } from './config.js';
+
+// ---------------------------------------------------------------------------
+// JSON extraction helper — handles plain JSON or markdown-fenced JSON blocks
+// ---------------------------------------------------------------------------
+function extractJSON(text) {
+  // Try direct parse first
+  try { return JSON.parse(text); } catch { /**/ }
+  // Strip markdown code fence
+  const match = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (match) {
+    try { return JSON.parse(match[1].trim()); } catch { /**/ }
+  }
+  // Last resort: find first { ... } block
+  const start = text.indexOf('{');
+  const end   = text.lastIndexOf('}');
+  if (start !== -1 && end !== -1) {
+    try { return JSON.parse(text.slice(start, end + 1)); } catch { /**/ }
+  }
+  throw new Error('Could not parse JSON from model response.\n\nRaw response:\n' + text.slice(0, 500));
+}
+
+function pickModel(config, codeLines) {
+  if (config.model) return config.model;
+  const tier = codeLines > 400 ? 'large' : 'small';
+  return DEFAULT_MODELS[config.provider]?.[tier] || null;
+}
+
+const OPENAI_COMPATIBLE_PROVIDERS = {
+  openai: {
+    label: 'OpenAI',
+    url: 'https://api.openai.com/v1/chat/completions',
+  },
+  deepseek: {
+    label: 'DeepSeek',
+    url: 'https://api.deepseek.com/chat/completions',
+  },
+  venice: {
+    label: 'Venice',
+    url: 'https://api.venice.ai/api/v1/chat/completions',
+  },
+  groq: {
+    label: 'Groq',
+    url: 'https://api.groq.com/openai/v1/chat/completions',
+  },
+  openrouter: {
+    label: 'OpenRouter',
+    url: 'https://openrouter.ai/api/v1/chat/completions',
+    headers: {
+      'HTTP-Referer': 'https://codepolisher.app',
+      'X-OpenRouter-Title': 'CodePolisher CLI',
+    },
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Provider implementations
+// ---------------------------------------------------------------------------
+
+async function callOpenAICompatible(config, prompt, codeLines) {
+  const provider = OPENAI_COMPATIBLE_PROVIDERS[config.provider];
+  const model = pickModel(config, codeLines);
+  const res = await fetch(provider.url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${config.api_key}`,
+      ...(provider.headers || {}),
+    },
+    body: JSON.stringify({
+      ...(model ? { model } : {}),
+      response_format: { type: 'json_object' },
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+  if (!res.ok) throw new Error(`${provider.label} error ${res.status}: ${await res.text()}`);
+  const data = await res.json();
+  return extractJSON(data.choices[0].message.content);
+}
+
+async function callAnthropic(config, prompt, codeLines) {
+  const model = pickModel(config, codeLines) || 'claude-3-5-haiku-20241022';
+  const res = await fetch('https://api.anthropic.com/v1/messages', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'x-api-key': config.api_key,
+      'anthropic-version': '2023-06-01',
+    },
+    body: JSON.stringify({
+      model,
+      max_tokens: 4096,
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+  if (!res.ok) throw new Error(`Anthropic error ${res.status}: ${await res.text()}`);
+  const data = await res.json();
+  return extractJSON(data.content[0].text);
+}
+
+async function callGemini(config, prompt, codeLines) {
+  const model = pickModel(config, codeLines) || 'gemini-1.5-flash';
+  const url = `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${config.api_key}`;
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      contents: [{ parts: [{ text: prompt }] }],
+      generationConfig: { responseMimeType: 'application/json' },
+    }),
+  });
+  if (!res.ok) throw new Error(`Gemini error ${res.status}: ${await res.text()}`);
+  const data = await res.json();
+  return extractJSON(data.candidates[0].content.parts[0].text);
+}
+
+async function callOllama(config, prompt, codeLines) {
+  const model = pickModel(config, codeLines) || 'llama3.2';
+  const host = config.ollama_host || 'http://localhost:11434';
+  const res = await fetch(`${host}/api/chat`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      model,
+      format: 'json',
+      stream: false,
+      messages: [{ role: 'user', content: prompt }],
+    }),
+  });
+  if (!res.ok) throw new Error(`Ollama error ${res.status}: ${await res.text()}`);
+  const data = await res.json();
+  return extractJSON(data.message.content);
+}
+
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+export async function invokeLLM(config, { prompt, codeLines = 0 }) {
+  if (OPENAI_COMPATIBLE_PROVIDERS[config.provider]) {
+    return callOpenAICompatible(config, prompt, codeLines);
+  }
+  switch (config.provider) {
+    case 'anthropic': return callAnthropic(config, prompt, codeLines);
+    case 'gemini':    return callGemini(config, prompt, codeLines);
+    case 'ollama':    return callOllama(config, prompt, codeLines);
+    default:
+      throw new Error(`Unknown provider "${config.provider}". Run: codepolisher config set provider <name>`);
+  }
+}

package/src/commands/config-cmd.js

@@ -0,0 +1,71 @@
+import { loadConfig, saveConfig, saveProviderApiKey, PROVIDERS, PROVIDER_ENV_KEYS, DEFAULT_MODELS } from '../config.js';
+import chalk from 'chalk';
+
+const ALLOWED_KEYS = {
+  'provider':     'provider',
+  'api-key':      'api_key',
+  'model':        'model',
+  'ollama-host':  'ollama_host',
+};
+
+export function configCommand(program) {
+  const cmd = program
+    .command('config')
+    .description('Manage CodePolisher CLI configuration');
+
+  cmd
+    .command('set <key> <value>')
+    .description(`Set a config value. Keys: ${Object.keys(ALLOWED_KEYS).join(', ')}`)
+    .action((key, value) => {
+      if (!ALLOWED_KEYS[key]) {
+        console.error(chalk.red(`Unknown key "${key}".`));
+        console.error(chalk.dim(`Valid keys: ${Object.keys(ALLOWED_KEYS).join(', ')}`));
+        process.exit(1);
+      }
+      if (key === 'provider' && !PROVIDERS.includes(value)) {
+        console.error(chalk.red(`Unknown provider "${value}".`));
+        console.error(chalk.dim(`Valid providers: ${PROVIDERS.join(', ')}`));
+        process.exit(1);
+      }
+      if (key === 'api-key') {
+        saveProviderApiKey(loadConfig().provider, value);
+      } else {
+        saveConfig({ [ALLOWED_KEYS[key]]: value });
+      }
+      console.log(chalk.green(`✔ Saved ${key}`));
+    });
+
+  cmd
+    .command('get')
+    .description('Show current config')
+    .action(() => {
+      const config = loadConfig();
+      const envKey = PROVIDER_ENV_KEYS[config.provider];
+      const defaultModel = DEFAULT_MODELS[config.provider]?.small || '(provider default)';
+      console.log('');
+      console.log(`  ${chalk.dim('provider')}     ${chalk.cyan(config.provider)}`);
+      const keyStatus = config.api_key
+        ? config.api_key_source === envKey
+          ? chalk.green(`[set via ${envKey}]`)
+          : chalk.green('[set in config]')
+        : envKey
+          ? chalk.yellow(`(set ${envKey} or run config set api-key)`)
+          : chalk.dim('(not required)');
+      console.log(`  ${chalk.dim('api-key')}      ${keyStatus}`);
+      console.log(`  ${chalk.dim('model')}        ${config.model ? chalk.cyan(config.model) : chalk.dim(`(default: ${defaultModel})`)}`);
+      if (config.provider === 'ollama') {
+        console.log(`  ${chalk.dim('ollama-host')}  ${chalk.cyan(config.ollama_host)}`);
+      }
+      console.log('');
+      console.log(chalk.dim(`  Supported providers: ${PROVIDERS.join(', ')}`));
+      console.log('');
+    });
+
+  cmd
+    .command('clear')
+    .description('Remove all saved config')
+    .action(() => {
+      saveConfig({ provider: null, api_key: null, api_keys: null, model: null, ollama_host: null });
+      console.log(chalk.yellow('Config cleared.'));
+    });
+}

package/src/commands/review.js

@@ -0,0 +1,77 @@
+import { readFileSync } from 'fs';
+import { basename } from 'path';
+import ora from 'ora';
+import { requireConfig } from '../config.js';
+import { invokeLLM } from '../api.js';
+import { buildReviewPrompt, buildSecurityPrompt } from '../prompt.js';
+import { printHeader, printSummary, printComments, printFooter, printError } from '../display.js';
+
+export async function reviewCommand(filePath, options) {
+  const config = requireConfig();
+
+  // Read code
+  let code, filename;
+  if (filePath) {
+    try {
+      code = readFileSync(filePath, 'utf8');
+      filename = basename(filePath);
+    } catch {
+      printError(`Could not read file: ${filePath}`);
+      process.exit(1);
+    }
+  } else {
+    // Read from stdin
+    code = readFileSync(0, 'utf8');
+    filename = null;
+  }
+
+  if (!code.trim()) {
+    printError('No code to review.');
+    process.exit(1);
+  }
+
+  // Build settings from flags
+  const settings = {
+    focusAreas: options.focus ? options.focus.split(',').map(s => s.trim()) : [],
+    customRules: options.rules || '',
+    strictMode: !!options.strict,
+  };
+
+  const prompt = options.security
+    ? buildSecurityPrompt(code, options.language || 'auto', filename)
+    : buildReviewPrompt(code, options.language || 'auto', filename, settings);
+
+  const codeLines = code.split('\n').length;
+
+  const spinner = ora(`Reviewing with ${config.provider}…`).start();
+
+  let results;
+  try {
+    results = await invokeLLM(config, {
+      prompt,
+      codeLines,
+    });
+    spinner.stop();
+  } catch (err) {
+    spinner.stop();
+    printError(`Review failed: ${err.message || err}`);
+    process.exit(1);
+  }
+
+  // JSON output mode
+  if (options.output === 'json') {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+
+  printHeader(filename, results.detected_language);
+  printSummary(results);
+  printComments(results.comments);
+  printFooter();
+
+  // Exit with non-zero if critical issues found
+  const hasCritical = results.comments?.some(c => c.severity === 'critical' || c.severity === 'security');
+  if (hasCritical && options.failOnCritical) {
+    process.exit(1);
+  }
+}

package/src/config.js

@@ -0,0 +1,239 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync, unlinkSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { randomUUID } from 'crypto';
+import { homedir } from 'os';
+import { join } from 'path';
+
+const CONFIG_DIR = join(homedir(), '.codepolisher');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+
+function currentWindowsIdentity() {
+  const { USERDOMAIN, USERNAME } = process.env;
+  if (USERDOMAIN && USERNAME) return `${USERDOMAIN}\\${USERNAME}`;
+  return execFileSync('whoami', [], {
+    encoding: 'utf8',
+    windowsHide: true,
+  }).trim();
+}
+
+function windowsAclSids(path) {
+  const script = `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$acl = Get-Acl -LiteralPath $env:CODEPOLISHER_SECURE_PATH
+$currentSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+Write-Output $currentSid
+foreach ($entry in $acl.Access) {
+  try {
+    Write-Output $entry.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value
+  } catch {
+    Write-Output $entry.IdentityReference.Value
+  }
+}
+`;
+  const encodedCommand = Buffer.from(script, 'utf16le').toString('base64');
+  const output = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodedCommand], {
+    encoding: 'utf8',
+    windowsHide: true,
+    env: { ...process.env, CODEPOLISHER_SECURE_PATH: path },
+  });
+  const [currentSid, ...aclSids] = output.split(/\r?\n/).map(value => value.trim()).filter(Boolean);
+  return { currentSid, aclSids: [...new Set(aclSids)] };
+}
+
+function securePath(path, isDirectory = false) {
+  try {
+    if (process.platform === 'win32') {
+      const identity = currentWindowsIdentity();
+      const grant = isDirectory ? `${identity}:(OI)(CI)F` : `${identity}:(F)`;
+      execFileSync('icacls', [path, '/inheritance:r', '/grant:r', grant], {
+        stdio: 'ignore',
+        windowsHide: true,
+      });
+
+      const before = windowsAclSids(path);
+      for (const sid of before.aclSids) {
+        if (sid !== before.currentSid) {
+          const account = /^S-\d(?:-\d+)+$/.test(sid) ? `*${sid}` : sid;
+          execFileSync('icacls', [path, '/remove', account], {
+            stdio: 'ignore',
+            windowsHide: true,
+          });
+        }
+      }
+
+      const after = windowsAclSids(path);
+      if (after.aclSids.some(sid => sid !== after.currentSid)) {
+        throw new Error('Windows retained an access rule for another account');
+      }
+    } else {
+      chmodSync(path, isDirectory ? 0o700 : 0o600);
+    }
+  } catch (error) {
+    throw new Error(`Could not secure CodePolisher config permissions for ${path}: ${error.message}`);
+  }
+}
+
+// Supported providers
+export const PROVIDERS = [
+  'openai',
+  'anthropic',
+  'gemini',
+  'deepseek',
+  'venice',
+  'groq',
+  'openrouter',
+  'ollama',
+];
+
+export const PROVIDER_ENV_KEYS = {
+  openai:    'OPENAI_API_KEY',
+  anthropic: 'ANTHROPIC_API_KEY',
+  gemini:    'GEMINI_API_KEY',
+  deepseek:  'DEEPSEEK_API_KEY',
+  venice:    'VENICE_API_KEY',
+  groq:      'GROQ_API_KEY',
+  openrouter:'OPENROUTER_API_KEY',
+  ollama:    null, // local, no key needed
+};
+
+export const DEFAULT_MODELS = {
+  openai:    { small: 'gpt-4o-mini',                  large: 'gpt-4o' },
+  anthropic: { small: 'claude-3-5-haiku-20241022',    large: 'claude-sonnet-4-5' },
+  gemini:    { small: 'gemini-1.5-flash',             large: 'gemini-1.5-pro' },
+  deepseek:  { small: 'deepseek-chat',                large: 'deepseek-chat' },
+  venice:    { small: 'zai-org-glm-5-1',              large: 'zai-org-glm-5-1' },
+  groq:      { small: 'openai/gpt-oss-20b',           large: 'openai/gpt-oss-120b' },
+  openrouter:{ small: null,                            large: null },
+  ollama:    { small: 'llama3.2',                     large: 'llama3.2' },
+};
+
+export function loadConfig() {
+  let fromFile = {};
+  if (existsSync(CONFIG_FILE)) {
+    try {
+      fromFile = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+    } catch {
+      // ignore malformed config
+    }
+  }
+
+  // Determine provider (file > env fallback)
+  const savedProvider = PROVIDERS.includes(fromFile.provider) ? fromFile.provider : null;
+  const provider = savedProvider || _detectProviderFromEnv() || 'openai';
+
+  // API key: provider-specific file entry > legacy file entry > environment.
+  const envKey = PROVIDER_ENV_KEYS[provider];
+  const providerApiKey = fromFile.api_keys?.[provider] || null;
+  const api_key = providerApiKey || fromFile.api_key || (envKey ? process.env[envKey] : null) || null;
+  const api_key_source = providerApiKey
+    ? 'config'
+    : fromFile.api_key
+      ? 'legacy-config'
+      : envKey && process.env[envKey]
+        ? envKey
+        : null;
+
+  return {
+    provider,
+    api_key,
+    api_key_source,
+    model:       fromFile.model       || null,
+    ollama_host: fromFile.ollama_host || 'http://localhost:11434',
+  };
+}
+
+function _detectProviderFromEnv() {
+  if (process.env.OPENAI_API_KEY)    return 'openai';
+  if (process.env.ANTHROPIC_API_KEY) return 'anthropic';
+  if (process.env.GEMINI_API_KEY)    return 'gemini';
+  if (process.env.DEEPSEEK_API_KEY)  return 'deepseek';
+  if (process.env.VENICE_API_KEY)    return 'venice';
+  if (process.env.GROQ_API_KEY)      return 'groq';
+  if (process.env.OPENROUTER_API_KEY)return 'openrouter';
+  return null;
+}
+
+export function saveConfig(updates) {
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  }
+  securePath(CONFIG_DIR, true);
+  let existing = {};
+  if (existsSync(CONFIG_FILE)) {
+    try { existing = JSON.parse(readFileSync(CONFIG_FILE, 'utf8')); } catch { /**/ }
+  }
+  const next = { ...existing, ...updates };
+  const tempFile = join(CONFIG_DIR, `config.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(tempFile, JSON.stringify(next, null, 2), {
+      encoding: 'utf8',
+      mode: 0o600,
+      flag: 'wx',
+    });
+    securePath(tempFile);
+    try {
+      renameSync(tempFile, CONFIG_FILE);
+    } catch (error) {
+      if (process.platform !== 'win32' || !existsSync(CONFIG_FILE)) throw error;
+      unlinkSync(CONFIG_FILE);
+      renameSync(tempFile, CONFIG_FILE);
+    }
+    securePath(CONFIG_FILE);
+  } finally {
+    if (existsSync(tempFile)) unlinkSync(tempFile);
+  }
+  return next;
+}
+
+export function saveProviderApiKey(provider, apiKey) {
+  let existing = {};
+  if (existsSync(CONFIG_FILE)) {
+    try { existing = JSON.parse(readFileSync(CONFIG_FILE, 'utf8')); } catch { /**/ }
+  }
+  return saveConfig({
+    api_key: null,
+    api_keys: { ...(existing.api_keys || {}), [provider]: apiKey },
+  });
+}
+
+export function requireConfig() {
+  const config = loadConfig();
+  const { provider } = config;
+
+  // Check if the user has explicitly saved a provider in the config file
+  let savedConfig = {};
+  if (existsSync(CONFIG_FILE)) {
+    try { savedConfig = JSON.parse(readFileSync(CONFIG_FILE, 'utf8')); } catch { /**/ }
+  }
+  const providerExplicitlySet = PROVIDERS.includes(savedConfig.provider);
+
+  if (provider === 'ollama') {
+    // no key required
+  } else {
+    if (!config.api_key) {
+      // If no provider was explicitly chosen, show the full onboarding list
+      if (!providerExplicitlySet) {
+        console.error('\nNo AI provider configured. Choose one and get started:\n');
+        console.error('  Provider       Set API key via                          Config command');
+        console.error('  ─────────────────────────────────────────────────────────────────────────');
+        console.error('  openai         OPENAI_API_KEY env var                   codepolisher config set provider openai');
+        console.error('  anthropic      ANTHROPIC_API_KEY env var                codepolisher config set provider anthropic');
+        console.error('  gemini         GEMINI_API_KEY env var                   codepolisher config set provider gemini');
+        console.error('  deepseek       DEEPSEEK_API_KEY env var                 codepolisher config set provider deepseek');
+        console.error('  venice        VENICE_API_KEY env var                  codepolisher config set provider venice');
+        console.error('  groq           GROQ_API_KEY env var                     codepolisher config set provider groq');
+        console.error('  openrouter     OPENROUTER_API_KEY env var               codepolisher config set provider openrouter');
+        console.error('  ollama         (no key needed — runs locally)           codepolisher config set provider ollama');
+        console.error('\nThen set your key:  codepolisher config set api-key <your-key>');
+        console.error('Or just export the env var and run again.\n');
+      } else {
+        const envKey = PROVIDER_ENV_KEYS[provider];
+        console.error(`\nNo API key found for provider "${provider}".\nRun: codepolisher config set api-key <key>\nOr set the ${envKey} environment variable.\n`);
+      }
+      process.exit(1);
+    }
+  }
+
+  return config;
+}

package/src/display.js

@@ -0,0 +1,86 @@
+import chalk from 'chalk';
+
+const SEVERITY_COLOR = {
+  critical:    (s) => chalk.bgRed.white.bold(` ${s.toUpperCase()} `),
+  security:    (s) => chalk.bgMagenta.white.bold(` ${s.toUpperCase()} `),
+  warning:     (s) => chalk.bgYellow.black.bold(` ${s.toUpperCase()} `),
+  suggestion:  (s) => chalk.bgBlue.white(` ${s.toUpperCase()} `),
+  performance: (s) => chalk.bgCyan.black(` ${s.toUpperCase()} `),
+  good:        (s) => chalk.bgGreen.black(` ${s.toUpperCase()} `),
+};
+
+function badge(severity) {
+  const fn = SEVERITY_COLOR[severity] || ((s) => chalk.bgGray.white(` ${s.toUpperCase()} `));
+  return fn(severity);
+}
+
+export function printHeader(filename, language) {
+  const lang = language ? chalk.cyan(language) : '';
+  const file = chalk.bold(filename || 'stdin');
+  console.log('');
+  console.log(chalk.dim('─'.repeat(60)));
+  console.log(`  ${chalk.bold.white('CodePolisher')}  ${file}  ${lang}`);
+  console.log(chalk.dim('─'.repeat(60)));
+}
+
+export function printSummary(results) {
+  const { comments = [], summary } = results;
+
+  const counts = {
+    critical:    comments.filter(c => c.severity === 'critical').length,
+    security:    comments.filter(c => c.severity === 'security').length,
+    warning:     comments.filter(c => c.severity === 'warning').length,
+    suggestion:  comments.filter(c => c.severity === 'suggestion' || c.severity === 'performance').length,
+    good:        comments.filter(c => c.severity === 'good').length,
+  };
+
+  console.log('');
+  console.log(
+    `  ${chalk.red.bold(counts.critical)} critical  ` +
+    `${chalk.magenta.bold(counts.security)} security  ` +
+    `${chalk.yellow.bold(counts.warning)} warnings  ` +
+    `${chalk.blue.bold(counts.suggestion)} suggestions  ` +
+    `${chalk.green.bold(counts.good)} good`
+  );
+  console.log('');
+
+  if (summary) {
+    console.log(chalk.dim('  Summary'));
+    console.log(`  ${chalk.white(summary)}`);
+    console.log('');
+  }
+}
+
+export function printComments(comments = []) {
+  if (!comments.length) {
+    console.log(chalk.green('  No issues found.'));
+    return;
+  }
+
+  const order = ['critical', 'security', 'warning', 'performance', 'suggestion', 'good'];
+  const sorted = [...comments].sort((a, b) => {
+    return order.indexOf(a.severity) - order.indexOf(b.severity);
+  });
+
+  console.log(chalk.dim('  Issues'));
+  console.log('');
+
+  for (const c of sorted) {
+    const line = c.line ? chalk.dim(`line ${c.line}`) : chalk.dim('general');
+    console.log(`  ${badge(c.severity)}  ${line}`);
+    console.log(`  ${chalk.white(c.message)}`);
+    if (c.fix) {
+      console.log(`  ${chalk.dim('fix:')} ${chalk.cyan(c.fix)}`);
+    }
+    console.log('');
+  }
+}
+
+export function printFooter() {
+  console.log(chalk.dim('─'.repeat(60)));
+  console.log('');
+}
+
+export function printError(msg) {
+  console.error(`\n${chalk.red.bold('Error:')} ${msg}\n`);
+}

package/src/index.js

@@ -0,0 +1,28 @@
+import { Command } from 'commander';
+import { reviewCommand } from './commands/review.js';
+import { configCommand } from './commands/config-cmd.js';
+
+const program = new Command();
+
+program
+  .name('codepolisher')
+  .description('AI-powered code review in your terminal — by ImPerial TeK. Solutions')
+  .version('1.1.0');
+
+// review command
+program
+  .command('review [file]')
+  .description('Review a file (or pipe code via stdin)')
+  .option('-l, --language <lang>', 'Language hint (default: auto-detect)')
+  .option('-f, --focus <areas>', 'Comma-separated focus areas: security,performance,readability,error_handling,best_practices,testing')
+  .option('-r, --rules <text>', 'Custom review rules')
+  .option('--strict', 'Strict mode — flag every issue')
+  .option('--security', 'Run a full security audit')
+  .option('--output <format>', 'Output format: pretty (default) or json')
+  .option('--fail-on-critical', 'Exit code 1 if critical/security issues found')
+  .action(reviewCommand);
+
+// config command
+configCommand(program);
+
+program.parse(process.argv);

package/src/prompt.js

@@ -0,0 +1,88 @@
+export const REVIEW_SCHEMA = {
+  type: "object",
+  properties: {
+    detected_language: { type: "string" },
+    summary: { type: "string" },
+    comments: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          severity: { type: "string" },
+          line: { type: "number" },
+          message: { type: "string" },
+          fix: { type: "string" },
+        },
+      },
+    },
+    corrected_code: { type: "string" },
+  },
+};
+
+export const FOCUS_AREA_OPTIONS = [
+  { id: "security",       label: "Security",        description: "Prioritize vulnerabilities, injections, auth issues" },
+  { id: "performance",    label: "Performance",     description: "Focus on speed, memory, algorithm efficiency" },
+  { id: "readability",    label: "Readability",     description: "Emphasize naming, structure, documentation" },
+  { id: "error_handling", label: "Error Handling",  description: "Highlight missing try/catch, null checks, edge cases" },
+  { id: "best_practices", label: "Best Practices",  description: "Modern language features, patterns, standards" },
+  { id: "testing",        label: "Testability",     description: "Suggest how code can be made more testable" },
+];
+
+export function pickReviewModel(code) {
+  const lines = (code || "").split("\n").length;
+  if (lines > 400) return "claude_sonnet_4_6";
+  return undefined;
+}
+
+export function buildReviewPrompt(code, language = "auto", filename = null, settings = {}) {
+  const langLabel = language === "auto" ? "auto-detect the language" : language;
+  const focusAreas = settings.focusAreas || [];
+  const customRules = settings.customRules || "";
+  const strictMode = settings.strictMode || false;
+
+  const focusLines = focusAreas.length > 0
+    ? `\n\nPRIORITY FOCUS AREAS (give extra weight to these):\n${focusAreas.map(id => {
+        const opt = FOCUS_AREA_OPTIONS.find(o => o.id === id);
+        return opt ? `- ${opt.label}: ${opt.description}` : `- ${id}`;
+      }).join("\n")}`
+    : "";
+
+  const customLines = customRules.trim()
+    ? `\n\nCUSTOM REVIEW RULES (from user, follow strictly):\n${customRules.trim()}`
+    : "";
+
+  const strictLine = strictMode
+    ? "\n\nSTRICT MODE: Be thorough and unforgiving. Flag every issue, even minor style problems."
+    : "";
+
+  return `You are an expert code reviewer for ALL scripting and programming languages. Analyze the following script and provide a detailed review.
+
+Language: ${langLabel}${filename ? `\nFile: ${filename}` : ""}${focusLines}${customLines}${strictLine}
+
+Script:
+\`\`\`
+${code}
+\`\`\`
+
+Provide your review as a JSON object with this exact structure:
+- "detected_language": the language you detected (string)
+- "summary": a 2-3 sentence overall assessment of the code quality
+- "comments": an array of review comments, each with:
+  - "severity": one of "critical", "warning", "suggestion", "performance", "security", "good"
+  - "line": the line number (number or null if general)
+  - "message": a clear explanation of the issue or suggestion
+  - "fix": a short code fix or recommendation (string or null)
+- "corrected_code": the full corrected version of the script`;
+}
+
+export function buildSecurityPrompt(code, language = "auto", filename = null) {
+  return buildReviewPrompt(code, language, filename, {
+    focusAreas: ["security"],
+    customRules: `SECURITY AUDIT MODE: Focus exclusively on security vulnerabilities.
+Check for: command injection, SQL injection, XSS, hardcoded credentials/secrets/API keys,
+unsafe permissions (chmod 777 etc), path traversal, insecure deserialization,
+improper authentication/authorization, use of deprecated insecure functions,
+unvalidated input, sensitive data exposure, insecure dependencies, and privilege escalation risks.
+Rate every finding by CVSS severity. Be exhaustive — missing a vulnerability is worse than a false positive.`,
+  });
+}