jev-affected 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.2.0
+
+- Read API credentials from the process environment only.
+- Reject literal API keys in YAML configuration.
+- Accept `TYPESAFEAI_API_KEY` as a compatibility fallback.
+
 ## 0.1.0
 
 - YAML semantic task conditions, deterministic globs and protected tasks.

package/EVALUATION.md

@@ -34,10 +34,10 @@ Run on 2026-09-21 with `jev-1.13.0` and `skipBelow: 0.10`:
 | False skips | 0 |
 | Invalid cases | 0 |
 | Cases with reduction | 6 |
-| Task reduction | 46.43% |
-| Unnecessary-run rate | 45.83% |
+| Task reduction | 42.86% |
+| Unnecessary-run rate | 50.00% |
 | API calls | 7 |
-| Total latency | 2,139 ms |
+| Total latency | 2,126 ms |
 | Input tokens | 2,882 |
 | Output tokens | 476 |
 
@@ -47,7 +47,7 @@ Selected tasks by fixture:
 | --- | ---: |
 | API field | 3 / 4 |
 | Authentication | 4 / 4 |
-| Comment | 1 / 4 |
+| Comment | 2 / 4 |
 | Database schema | 3 / 4 |
 | Documentation | 0 / 4 |
 | Logging | 1 / 4 |
@@ -65,8 +65,8 @@ pnpm eval:live
 
 `pnpm eval` uses deterministic synthetic answers and verifies evaluation and
 decision plumbing without making a network request. `pnpm eval:live` reads
-`TYPESAFE_API_KEY` from the process environment or a local `.env` file and sends
-the fixture inputs to Jev.
+`TYPESAFE_API_KEY` from the process environment and sends the fixture inputs to
+Jev. Dotenv files are not loaded.
 
 ## Limits
 

package/README.md

@@ -2,7 +2,7 @@
 
 <p align="center"><strong>Semantic task routing for software development.</strong></p>
 <p align="center">Run tasks based on what changed, not where it changed.</p>
-<p align="center">v0.1.0 Public Beta · Node.js 20+ · TypeScript · MIT · Jev-powered</p>
+<p align="center">v0.2.0 Public Beta · Node.js 20+ · TypeScript · MIT · Jev-powered</p>
 
 ![Illustrative offline fixture demo, not live Jev output](assets/demo.gif)
 
@@ -30,13 +30,7 @@ npm install -D jev-affected
 npx jev-affected init
 ```
 
-Create `.env` in the repository root. The CLI loads it automatically:
-
-```dotenv
-TYPESAFE_API_KEY=your_api_key_here
-```
-
-`.env` is ignored by this repository's generated `.gitignore`. Never put the key in `jev-affected.yml` or commit it. An existing process environment value takes precedence over `.env`. You can also set it for the current shell:
+Set the API key in the process environment. The CLI does not read dotenv files or accept API keys in `jev-affected.yml`.
 
 ```powershell
 $env:TYPESAFE_API_KEY = "your_api_key_here"
@@ -46,6 +40,8 @@ $env:TYPESAFE_API_KEY = "your_api_key_here"
 export TYPESAFE_API_KEY="your_api_key_here"
 ```
 
+For persistent local use, configure the variable in your shell profile or operating-system credential environment. Open a new terminal after changing persistent environment variables. `TYPESAFEAI_API_KEY` is accepted as a compatibility fallback.
+
 Configure your own trusted commands, commit your changes on a feature branch, then:
 
 ```sh
@@ -176,7 +172,7 @@ See [EVALUATION.md](EVALUATION.md) for the methodology, release gates, latest li
 
 ## Privacy
 
-No backend and no telemetry. Data is read locally; semantic inputs go directly to TypeSafe through its SDK. By default, `.env*`, PEM/key files, and names containing `credentials`, `secret` or `token` are withheld. Custom exclusions add to these defaults. Filename exclusions cannot find every secret embedded in arbitrary source files: inspect inputs and use appropriate repository practices. SDK logging is explicitly disabled.
+No backend and no telemetry. Data is read locally; semantic inputs go directly to TypeSafe through its SDK. API keys are read from the process environment only. By default, `.env*`, PEM/key files, and names containing `credentials`, `secret` or `token` are withheld. Custom exclusions add to these defaults. Filename exclusions cannot find every secret embedded in arbitrary source files: inspect inputs and use appropriate repository practices. SDK logging is explicitly disabled.
 
 `TYPESAFE_BASE_URL` is honored by the official SDK; inspect this environment setting before use. Review [TypeSafe's data-processing terms](https://typesafe.ai/legal/mca) for your organization.
 

package/SECURITY.md

@@ -10,7 +10,7 @@ Do not post secrets or exploit details in a public issue. Once the public reposi
 
 ## Secret handling
 
-Set TYPESAFE_API_KEY through your environment or CI secret store. The application disables SDK logging and does not emit provider error bodies. Exclusion globs are additive; they cannot detect every embedded secret. Inspect your inputs before enabling remote analysis.
+Set TYPESAFE_API_KEY through the process environment or CI secret store. The CLI does not load dotenv files and rejects literal API keys in its YAML configuration. The application disables SDK logging and does not emit provider error bodies. Exclusion globs are additive; they cannot detect every embedded secret. Inspect your inputs before enabling remote analysis.
 
 ## External API calls
 

package/dist/cli.js

@@ -4,13 +4,11 @@ import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { TypeSafeClient } from "@typesafe-ai/sdk";
-import { config as loadEnvFile } from "dotenv";
-import { ConfigError, loadConfig, template } from "./config.js";
+import { ConfigError, loadConfig, resolveApiKey, template } from "./config.js";
 import { evaluate } from "./eval.js";
 import { executePlan } from "./executor.js";
 import { collectChanges, matches } from "./git.js";
 import { createPlan } from "./planner.js";
-loadEnvFile({ quiet: true });
 function render(plan) {
     return [
         `jev-affected\n\nBase ${plan.base}\nHead ${plan.head}\nModel ${plan.model ?? "not analyzed"}`,
@@ -140,11 +138,12 @@ inspect never sends requests. plan never executes task commands.`);
         return;
     }
     if (command === "doctor") {
+        const apiKey = resolveApiKey();
         const checks = {
             node: Number(process.versions.node.split(".")[0]) >= 20,
             config: true,
             tasks: Object.keys(config.tasks).length.toString(),
-            apiKey: !!process.env.TYPESAFE_API_KEY?.trim(),
+            apiKey: !!apiKey,
         };
         try {
             await collectChanges(config, opts);
@@ -156,6 +155,7 @@ inspect never sends requests. plan never executes task commands.`);
         if (checks.apiKey) {
             try {
                 await new TypeSafeClient({
+                    apiKey,
                     logLevel: "off",
                     timeout: config.analysis.timeoutMs,
                     retry: { maxRetries: 0 },

package/dist/config.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 export declare class ConfigError extends Error {
 }
+export declare const API_KEY_VARS: readonly ["TYPESAFE_API_KEY", "TYPESAFEAI_API_KEY"];
 export declare const secretPatterns: string[];
 export declare const configSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -37,5 +38,6 @@ export declare const configSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type Config = z.infer<typeof configSchema>;
 export declare function parseConfig(value: unknown): Config;
+export declare function resolveApiKey(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function loadConfig(path?: string): Promise<Config>;
 export declare const template = "version: 1\nmodel: jev-latest\ndefaults:\n  skipBelow: 0.10\ntasks:\n  unit:\n    command: npm test\n    when: Could this change alter runtime application behavior?\n  typecheck:\n    command: npm run typecheck\n    always: true\n";

package/dist/config.js

@@ -3,6 +3,7 @@ import { parse } from "yaml";
 import { z } from "zod";
 export class ConfigError extends Error {
 }
+export const API_KEY_VARS = ["TYPESAFE_API_KEY", "TYPESAFEAI_API_KEY"];
 const probability = z.number().min(0).max(1);
 const limits = z
     .object({
@@ -68,11 +69,23 @@ export const configSchema = z
 })
     .strict();
 export function parseConfig(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        const source = value;
+        if (Object.hasOwn(source, "apiKey") || Object.hasOwn(source, "api_key"))
+            throw new ConfigError("API keys are not supported in jev-affected.yml. Set TYPESAFE_API_KEY in the process environment or CI secret store.");
+    }
     const r = configSchema.safeParse(value);
     if (!r.success)
         throw new ConfigError(r.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("\n"));
     return r.data;
 }
+export function resolveApiKey(env = process.env) {
+    for (const name of API_KEY_VARS) {
+        const value = env[name]?.trim();
+        if (value)
+            return value;
+    }
+}
 export async function loadConfig(path = "jev-affected.yml") {
     try {
         return parseConfig(parse(await readFile(path, "utf8")));

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { type Config, ConfigError, loadConfig, parseConfig } from "./config.js";
+export { API_KEY_VARS, type Config, ConfigError, loadConfig, parseConfig, resolveApiKey, } from "./config.js";
 export { executePlan } from "./executor.js";
 export { type ChangeState, collectChanges } from "./git.js";
 export { createPlan, type Plan, type TaskDecision } from "./planner.js";

package/dist/index.js

@@ -1,4 +1,4 @@
-export { ConfigError, loadConfig, parseConfig } from "./config.js";
+export { API_KEY_VARS, ConfigError, loadConfig, parseConfig, resolveApiKey, } from "./config.js";
 export { executePlan } from "./executor.js";
 export { collectChanges } from "./git.js";
 export { createPlan } from "./planner.js";

package/dist/planner.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { parseConfig, secretPatterns } from "./config.js";
+import { parseConfig, resolveApiKey, secretPatterns, } from "./config.js";
 import { collectChanges, git, matches } from "./git.js";
 import { JevProvider, } from "./provider.js";
 export async function createPlan(input) {
@@ -87,6 +87,7 @@ export async function createPlan(input) {
                     questions,
                     model: config.model,
                     timeoutMs: config.analysis.timeoutMs,
+                    apiKey: resolveApiKey(),
                 });
             }
             if (!result.model || !/^jev-\d+\.\d+\.\d+$/.test(result.model))

package/dist/provider.d.ts

@@ -4,6 +4,7 @@ export interface AnalysisInput {
     questions: Record<string, string>;
     model: string;
     timeoutMs: number;
+    apiKey?: string;
 }
 export interface AnalysisResult {
     model: string;

package/dist/provider.js

@@ -2,6 +2,7 @@ import { noul, TypeSafeClient } from "@typesafe-ai/sdk";
 export class JevProvider {
     async analyze(input) {
         const client = new TypeSafeClient({
+            apiKey: input.apiKey,
             logLevel: "off",
             timeout: input.timeoutMs,
             retry: { maxRetries: 0 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jev-affected",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Semantic task routing for software development, powered by Jev.",
   "type": "module",
   "license": "MIT",
@@ -46,7 +46,6 @@
     "SECURITY.md",
     "CODE_OF_CONDUCT.md",
     "EVALUATION.md",
-    ".env.example",
     "evals",
     "skills"
   ],
@@ -65,7 +64,6 @@
   },
   "dependencies": {
     "@typesafe-ai/sdk": "^0.6.0",
-    "dotenv": "^17.2.2",
     "picomatch": "^4.0.7",
     "yaml": "^2.9.1",
     "zod": "^4.6.5"

package/skills/jev-affected/SKILL.md

@@ -31,10 +31,9 @@ compute the merge base.
 
 ## Credentials and data
 
-Set `TYPESAFE_API_KEY` in the process environment or a repository-local `.env`
-file. Never print the value, commit `.env`, or store the key in
-`jev-affected.yml`. An existing process environment value takes precedence over
-`.env`.
+Set `TYPESAFE_API_KEY` in the process environment or CI secret store. Never
+print the value or store the key in `jev-affected.yml`. The CLI does not load
+dotenv files. `TYPESAFEAI_API_KEY` is accepted as a compatibility fallback.
 
 `inspect` stays local. `plan`, `why`, and `run` can send the sanitized committed
 diff and configured semantic questions to the provider. Review `inspect` output

package/.env.example

@@ -1,3 +0,0 @@
-# Copy this file to .env and replace the placeholder.
-# .env is ignored by Git. Never commit a real API key.
-TYPESAFE_API_KEY=replace_with_your_typesafe_api_key