safetyvibe-connect 0.0.0-stage → 0.2.0

package/AGENTS.md

@@ -0,0 +1,8 @@
+# For AI coding agents
+
+This project uses `safetyvibe-connect` for security monitoring.
+
+- To link or relink it: `bunx safetyvibe-connect setup` (`npx` on npm projects). Pass `--claim-token <TOKEN>` if the user gave you one, and `--url <published URL>` if you know it.
+- Keep the postinstall hook: `"postinstall": "safetyvibe-connect scan --quiet || exit 0"`, or after an existing step: `"<existing> && (safetyvibe-connect scan --quiet || exit 0)"`. It re-reports dependencies after each install and never fails a build.
+- Don't edit `.safetyviberc.json` by hand, except to add `{"claimToken": "..."}` when you can't run commands. Never commit `.safetyviberc.local.json`; it holds the report key.
+- It sends only dependency names and versions, the app URL, and the public Supabase URL and anon key. Never put secrets into its config.

package/README.md

@@ -1,3 +1,46 @@
-# Temporary Holding Version
+# safetyvibe-connect
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Links an app to [SafetyVibe](https://dashboard.safetyvibe.eu) security monitoring.
+Made for AI builders (Lovable, Replit, Bolt, Claude Code…): paste one prompt, the builder's
+agent installs this package, and the app shows up on your SafetyVibe dashboard.
+
+## Install
+
+```sh
+bun add safetyvibe-connect && bunx safetyvibe-connect setup --claim-token <TOKEN>
+# npm
+npm install --save safetyvibe-connect && npx safetyvibe-connect setup --claim-token <TOKEN>
+```
+
+Get `<TOKEN>` from the dashboard (**Add app → Connect with one prompt**). Without a token,
+`setup` prints a link you open to add the app to your account.
+
+## What it sends — and what it never sends
+
+Sent (see it yourself with `safetyvibe-connect setup --dry-run`):
+- package names and versions from your lockfile (to check them against known vulnerabilities)
+- the app name, its public URL (if you pass `--url` or it is set) and a platform label
+- your Supabase project URL and its **public** anon/publishable key — the same values your
+  website already ships to every visitor. A `service_role` / `sb_secret_` key is refused, never sent.
+
+Never sent: source code, file paths, `.env` secrets, or any other key.
+
+## What it changes in your project
+
+- `.safetyviberc.json` (safe to commit) — this app's SafetyVibe id and public URL. No secrets.
+- `.safetyviberc.local.json` (added to `.gitignore`) — this app's report key. It can update this one
+  app's package list, link and Supabase details on SafetyVibe; it cannot read anything. Don't commit it.
+- `package.json` → `scripts.postinstall` gets `safetyvibe-connect scan --quiet || exit 0`, so the package
+  list is re-reported after each install. It never fails an install or build, even after you remove the
+  connector.
+- The one-prompt claim token links one app within 24 hours and is then useless; the CLI removes it.
+
+Remove it any time: delete the postinstall entry, `.safetyviberc.json`, `.safetyviberc.local.json`, and the dependency.
+
+## Commands
+
+| command | does |
+|---|---|
+| `setup [--claim-token T] [--url URL] [--dry-run]` | report + write `.safetyviberc.json` + add the postinstall hook |
+| `scan [--quiet]` | report again (used by the hook; always exits 0) |
+| `status` | show what is linked |

package/cli.mjs

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+// safetyvibe-connect — link this app to SafetyVibe security monitoring.
+//   setup [--claim-token T] [--url https://my-app.lovable.app] [--dry-run]
+//   scan  [--quiet]          re-report (runs from the postinstall hook; never fails a build)
+//   status                   show what is linked
+// Sends ONLY: package names+versions, app name, public URL, platform label, and the
+// Supabase project URL + its public anon/publishable key. Run with --dry-run to see it.
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildReport } from './lib.mjs';
+
+const RC = '.safetyviberc.json';              // committed: app id + URL (no secrets)
+const RC_LOCAL = '.safetyviberc.local.json';  // git-ignored: the app's report key
+const HOOK = 'safetyvibe-connect scan --quiet || exit 0';   // works in sh and cmd.exe; never fails an install
+const DEFAULT_API = 'https://dashboard.safetyvibe.eu/connect/api/v1';
+
+const argv = process.argv.slice(2);
+const cmd = argv[0] && !argv[0].startsWith('--') ? argv[0] : 'setup';
+const flag = (name) => { const i = argv.indexOf('--' + name); return i !== -1 ? (argv[i + 1] && !argv[i + 1].startsWith('--') ? argv[i + 1] : true) : undefined; };
+const quiet = !!flag('quiet');
+const root = process.env.INIT_CWD || process.cwd();
+const say = (...a) => { if (!quiet) console.log(...a); };
+
+const readJsonFile = (f) => { try { return JSON.parse(readFileSync(join(root, f), 'utf8')) || {}; } catch { return {}; } };
+function readRc() { return { ...readJsonFile(RC), ...readJsonFile(RC_LOCAL) }; }
+function writeRc(rc) {
+  const { key, ...pub } = rc;
+  try {
+    writeFileSync(join(root, RC), JSON.stringify(pub, null, 2) + '\n');
+    if (key) { writeFileSync(join(root, RC_LOCAL), JSON.stringify({ key }, null, 2) + '\n'); ignoreLocal(); }
+    return true;
+  } catch { return false; }   // read-only build sandboxes: nothing to persist
+}
+function ignoreLocal() {
+  const f = join(root, '.gitignore');
+  let t = ''; try { t = readFileSync(f, 'utf8'); } catch {}
+  if (t.split(/\r?\n/).some((l) => l.trim() === RC_LOCAL)) return;
+  try { writeFileSync(f, t + (t && !t.endsWith('\n') ? '\n' : '') + RC_LOCAL + '\n'); } catch {}
+}
+
+function addHook() {
+  const f = join(root, 'package.json');
+  let pj; try { pj = JSON.parse(readFileSync(f, 'utf8')); } catch { return 'no package.json'; }
+  pj.scripts = pj.scripts || {};
+  const cur = String(pj.scripts.postinstall || '');
+  // Only the connector's own failure is ignored: the user's existing postinstall keeps its exit code.
+  const ours = (s) => s.replace(/\s*&&\s*\(?\s*safetyvibe-connect scan[^&()]*\)?\s*$/, '').replace(/^\(?\s*safetyvibe-connect scan[^&()]*\)?\s*$/, '');
+  const base = ours(cur).trim();
+  const want = base ? base + ' && (' + HOOK + ')' : HOOK;
+  if (cur === want) return 'already there';
+  pj.scripts.postinstall = want;
+  try { writeFileSync(f, JSON.stringify(pj, null, 2) + '\n'); return 'added'; } catch { return 'could not write package.json'; }
+}
+
+async function post(api, body, headers) {
+  const ctl = new AbortController(); const t = setTimeout(() => ctl.abort(), 10000);
+  try {
+    const r = await fetch(api.replace(/\/+$/, '') + '/report', {
+      method: 'POST', signal: ctl.signal,
+      headers: { 'content-type': 'application/json', 'user-agent': 'safetyvibe-connect/0.2.0', ...headers },
+      body: JSON.stringify(body),
+    });
+    let j = {}; try { j = await r.json(); } catch {}
+    return { ok: r.ok, status: r.status, body: j };
+  } finally { clearTimeout(t); }
+}
+
+async function report({ setup }) {
+  const rc = readRc();
+  const claimToken = typeof flag('claim-token') === 'string' ? flag('claim-token') : (rc.claimToken || process.env.SAFETYVIBE_CLAIM_TOKEN || '');
+  const url = typeof flag('url') === 'string' ? flag('url') : (rc.url || '');
+  const api = process.env.SAFETYVIBE_API || rc.api || DEFAULT_API;
+  const body = buildReport(root, { url });
+
+  if (flag('dry-run')) { console.log(JSON.stringify(body, null, 2)); return 0; }
+
+  const key = rc.key || process.env.SAFETYVIBE_KEY || '';      // CI: provide the report key as a secret env var
+  // Linked app, but this machine has no key (fresh clone / CI): never create a stray new app.
+  if (rc.site && !key && !claimToken) {
+    say('SafetyVibe: this app is linked (' + rc.site + '), but its report key is not on this machine. ' +
+        'Set SAFETYVIBE_KEY, or run "safetyvibe-connect setup --claim-token <new prompt token>" to relink.');
+    return 0;
+  }
+  const headers = {};
+  if (rc.site) headers['x-safetyvibe-site'] = rc.site;
+  if (rc.site && key) headers['x-safetyvibe-key'] = key;
+  if (claimToken) headers['x-safetyvibe-claim-token'] = claimToken;    // with x-safetyvibe-site: relink that app
+
+  let res;
+  try { res = await post(api, body, headers); }
+  catch { say('SafetyVibe: could not reach ' + api + ' (will retry on the next install).'); return setup ? 1 : 0; }
+  if (!res.ok) { say('SafetyVibe: ' + (res.body.error || 'report rejected (HTTP ' + res.status + ')')); return setup ? 1 : 0; }
+
+  const b = res.body;
+  const next = { ...rc, site: b.site || rc.site, url: url || rc.url || undefined };
+  if (b.key) next.key = b.key;
+  delete next.claimToken;                      // one-shot: never keep a used claim token around
+  // Also rewrite when a key still sits in the committed file (older setups): move it to the local file.
+  const keyInCommitted = !!readJsonFile(RC).key;
+  if (keyInCommitted || JSON.stringify(next) !== JSON.stringify(rc)) writeRc(next);
+
+  const hook = setup ? addHook() : null;
+  const sb = body.supabase ? 'Supabase project ' + new URL(body.supabase.url).hostname : 'no Supabase project found';
+  say(`SafetyVibe: reported ${body.packages.length} packages (${body.lockfile}), ${sb}${body.url ? ', ' + body.url : ''}.`);
+  if (hook) say('SafetyVibe: postinstall hook ' + hook + ' (re-reports after every install).');
+  if (b.claimed) say('SafetyVibe: linked to your dashboard: ' + (b.appUrl || 'https://dashboard.safetyvibe.eu'));
+  else if (b.claimUrl) say('SafetyVibe: open this link to add the app to your dashboard: ' + b.claimUrl);
+  return 0;
+}
+
+async function main() {
+  if (cmd === 'status') {
+    const rc = readRc();
+    console.log(rc.site ? `Linked to SafetyVibe app ${rc.site}${rc.url ? ' (' + rc.url + ')' : ''}.` : (rc.claimToken ? 'Not reported yet (claim token present).' : 'Not linked. Run: safetyvibe-connect setup'));
+    return 0;
+  }
+  if (cmd === 'scan') { try { await report({ setup: false }); } catch {} return 0; }   // never fail an install/build
+  if (cmd === 'setup') return report({ setup: true });
+  console.log('Usage: safetyvibe-connect setup [--claim-token T] [--url URL] [--dry-run] | scan [--quiet] | status');
+  return 1;
+}
+
+main().then((code) => process.exit(code), () => process.exit(cmd === 'scan' ? 0 : 1));

package/lib.mjs

@@ -0,0 +1,211 @@
+// safetyvibe-connect — pure helpers (no network, no writes). Tested in connect.test.mjs.
+// What leaves the machine is exactly buildReport()'s return value: package names +
+// versions, app name, public URL, platform/environment labels, and the Supabase project
+// URL + its PUBLIC (anon/publishable) key. Never source code, file paths or secrets.
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { join, basename } from 'node:path';
+
+const MAX_PACKAGES = 5000;
+const read = (f) => { try { return readFileSync(f, 'utf8'); } catch { return null; } };
+const readJson = (f) => { const t = read(f); if (t == null) return null; try { return JSON.parse(t); } catch { return null; } };
+
+// ---- lockfiles -------------------------------------------------------------
+// Each parser returns [{ name, version }] for every installed package (deduped later).
+
+export function fromPackageLock(json) {
+  const out = [];
+  if (json && json.packages && typeof json.packages === 'object') {
+    for (const [path, v] of Object.entries(json.packages)) {
+      if (!path || !v || typeof v.version !== 'string') continue;   // "" = the root project
+      const i = path.lastIndexOf('node_modules/');
+      if (i === -1) continue;
+      out.push({ name: v.name || path.slice(i + 'node_modules/'.length), version: v.version });
+    }
+  } else if (json && json.dependencies) {                          // lockfileVersion 1
+    const walk = (deps) => { for (const [n, v] of Object.entries(deps || {})) { if (v && v.version) out.push({ name: n, version: v.version }); walk(v && v.dependencies); } };
+    walk(json.dependencies);
+  }
+  return out;
+}
+
+// bun.lock (text, JSONC): "packages": { "<key>": ["name@version", registry, {...}, integrity], ... }
+export function fromBunLock(text) {
+  const clean = String(text).replace(/^\s*\/\/.*$/gm, '').replace(/,(\s*[}\]])/g, '$1');
+  let json; try { json = JSON.parse(clean); } catch { return []; }
+  const out = [];
+  for (const v of Object.values((json && json.packages) || {})) {
+    const spec = Array.isArray(v) ? v[0] : null;
+    if (typeof spec !== 'string') continue;
+    const at = spec.lastIndexOf('@');
+    if (at <= 0) continue;
+    const version = spec.slice(at + 1);
+    if (/^\d/.test(version)) out.push({ name: spec.slice(0, at), version });   // skip workspace:/git:/file:
+  }
+  return out;
+}
+
+// yarn.lock v1 ("name@range":\n  version "x") and berry ("name@npm:range":\n  version: x)
+export function fromYarnLock(text) {
+  const out = []; let names = null;
+  for (const line of String(text).split(/\r?\n/)) {
+    if (/^\S.*:\s*$/.test(line) && !line.startsWith('#') && !line.startsWith('__metadata')) {
+      names = line.replace(/:\s*$/, '').split(',').map((s) => s.trim().replace(/^"|"$/g, ''))
+        .map((s) => s.slice(0, s.lastIndexOf('@') > 0 ? s.lastIndexOf('@') : s.length));
+      continue;
+    }
+    const m = line.match(/^\s+version:?\s+"?([^"\s]+)"?\s*$/);
+    if (m && names) { for (const n of new Set(names)) if (n) out.push({ name: n, version: m[1] }); names = null; }
+  }
+  return out;
+}
+
+// pnpm-lock.yaml: package keys like "/name@1.2.3", "name@1.2.3", "/@scope/name@1.2.3(peer@x)"
+export function fromPnpmLock(text) {
+  const out = []; let inPackages = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    if (/^(packages|snapshots):\s*$/.test(line)) { inPackages = line.startsWith('packages'); continue; }
+    if (/^\S/.test(line)) { inPackages = false; continue; }
+    if (!inPackages) continue;
+    const m = line.match(/^ {2}'?\/?((?:@[^/@\s]+\/)?[^@\s/]+)@(\d[^('\s:]*)/);
+    if (m) out.push({ name: m[1], version: m[2] });
+  }
+  return out;
+}
+
+// Fallback (bun.lockb is binary): what is actually installed in node_modules.
+export function fromNodeModules(root) {
+  const out = []; const nm = join(root, 'node_modules');
+  let entries = []; try { entries = readdirSync(nm); } catch { return out; }
+  const add = (dir) => { const pj = readJson(join(dir, 'package.json')); if (pj && pj.name && pj.version) out.push({ name: pj.name, version: pj.version }); };
+  for (const e of entries) {
+    if (e.startsWith('.')) continue;
+    if (e.startsWith('@')) { let sub = []; try { sub = readdirSync(join(nm, e)); } catch {} for (const s of sub) add(join(nm, e, s)); }
+    else add(join(nm, e));
+  }
+  return out;
+}
+
+export function readPackages(root) {
+  let list = []; let source = 'none';
+  const tries = [
+    ['package-lock.json', (t) => fromPackageLock(JSON.parse(t))],
+    ['npm-shrinkwrap.json', (t) => fromPackageLock(JSON.parse(t))],
+    ['bun.lock', fromBunLock],
+    ['pnpm-lock.yaml', fromPnpmLock],
+    ['yarn.lock', fromYarnLock],
+  ];
+  for (const [file, parse] of tries) {
+    const t = read(join(root, file)); if (t == null) continue;
+    let ok = true;
+    try { list = parse(t); } catch { list = []; ok = false; }
+    if (list.length) { source = file; break; }
+    // A JSON lockfile that parses and lists nothing really means "no dependencies". The line-based
+    // yarn/pnpm parsers can't tell empty from unsupported, so those stay "unknown".
+    if (ok && /\.json$|^bun\.lock$/.test(file)) { source = file; break; }
+  }
+  if (!list.length && source === 'none') { list = fromNodeModules(root); if (list.length) source = 'node_modules'; }
+  const seen = new Set(); const pkgs = [];
+  for (const p of list) {
+    const k = p.name + '@' + p.version;
+    // Registry versions only. git/file/link/http specs can carry tokens or local paths: never sent.
+    if (seen.has(k) || !/^(@[\w.-]+\/)?[\w.-]+$/.test(p.name) || !/^\d+\.\d+\.\d+[\w.+-]{0,40}$/.test(String(p.version))) continue;
+    seen.add(k); pkgs.push({ ecosystem: 'npm', name: p.name, version: p.version });
+    if (pkgs.length >= MAX_PACKAGES) break;
+  }
+  return { packages: pkgs, source };
+}
+
+// ---- Supabase (project URL + PUBLIC key only) ------------------------------
+export function keyKind(key) {
+  const k = String(key || '').trim();
+  if (/^sb_publishable_/.test(k)) return 'publishable';
+  if (/^sb_secret_/.test(k)) return 'secret';
+  const parts = k.split('.');
+  if (parts.length === 3) {
+    try {
+      const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'));
+      if (payload && payload.role === 'anon') return 'anon';
+      if (payload && payload.role) return 'secret';               // service_role or anything else privileged
+    } catch { /* not a JWT */ }
+  }
+  return 'unknown';
+}
+
+function parseEnv(text) {
+  const env = {};
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)\s*$/);
+    if (m) env[m[1]] = m[2].replace(/^['"]|['"]$/g, '');
+  }
+  return env;
+}
+
+const URL_VARS = ['VITE_SUPABASE_URL', 'NEXT_PUBLIC_SUPABASE_URL', 'PUBLIC_SUPABASE_URL', 'EXPO_PUBLIC_SUPABASE_URL', 'SUPABASE_URL'];
+const KEY_VARS = ['VITE_SUPABASE_PUBLISHABLE_KEY', 'VITE_SUPABASE_ANON_KEY', 'NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+  'PUBLIC_SUPABASE_ANON_KEY', 'EXPO_PUBLIC_SUPABASE_ANON_KEY', 'SUPABASE_PUBLISHABLE_KEY', 'SUPABASE_ANON_KEY'];
+
+export function findSupabase(root, procEnv = process.env) {
+  const env = {};
+  for (const f of ['.env', '.env.local', '.env.production', '.env.production.local']) Object.assign(env, parseEnv(read(join(root, f))));
+  for (const k of [...URL_VARS, ...KEY_VARS]) if (procEnv[k]) env[k] = procEnv[k];
+  let url = URL_VARS.map((k) => env[k]).find(Boolean) || '';
+  let key = KEY_VARS.map((k) => env[k]).find(Boolean) || '';
+  // Lovable hard-codes them in src/integrations/supabase/client.ts
+  if (!url || !key) {
+    for (const f of ['src/integrations/supabase/client.ts', 'src/integrations/supabase/client.js', 'src/lib/supabase.ts', 'src/lib/supabase.js', 'lib/supabase.ts', 'utils/supabase.ts']) {
+      const t = read(join(root, f)); if (!t) continue;
+      url = url || ((t.match(/["'`](https:\/\/[a-z0-9-]+\.supabase\.co)["'`]/i) || [])[1] || '');
+      key = key || ((t.match(/(?:PUBLISHABLE|ANON)_KEY\s*=\s*["'`]([^"'`]+)["'`]/i) || [])[1] || '');
+      if (url && key) break;
+    }
+  }
+  if (!/^https:\/\/[a-z0-9-]+\.supabase\.(co|in)\/?$/i.test(url)) url = '';
+  const kind = key ? keyKind(key) : 'none';
+  // Never send anything that isn't provably a public key.
+  if (kind !== 'anon' && kind !== 'publishable') key = '';
+  return { url: url.replace(/\/$/, ''), key, kind };
+}
+
+// ---- app identity ------------------------------------------------------------
+export function detectPlatform(root, procEnv = process.env) {
+  const pj = readJson(join(root, 'package.json')) || {};
+  const deps = { ...(pj.dependencies || {}), ...(pj.devDependencies || {}) };
+  if (deps['lovable-tagger'] || existsSync(join(root, '.lovable'))) return 'Lovable';
+  if (procEnv.REPL_ID || existsSync(join(root, '.replit'))) return 'Replit';
+  if (existsSync(join(root, '.bolt'))) return 'Bolt';
+  if (deps['@base44/sdk']) return 'Base44';
+  if (procEnv.VERCEL) return 'Vercel';
+  if (procEnv.NETLIFY) return 'Netlify';
+  return '';
+}
+
+export function appName(root) {
+  const pj = readJson(join(root, 'package.json')) || {};
+  const n = String(pj.name || '').trim();
+  // Builder templates ship a generic package name; send none so the dashboard can name it properly.
+  // Known builder template names only (a real name like "email-template-editor" is kept).
+  const generic = /^(vite[_-]react[_-]shadcn[_-]ts|tanstack[_-]start[_-]ts|vite[_-]react[_-]typescript[_-]starter|vite[_-]project|rest[_-]express|my[_-]app|app|react[_-]app|next[_-]?js[_-]app|next[_-]app|nextjs)$/i;
+  if (n && !generic.test(n)) return n.slice(0, 80);
+  const dir = basename(root);
+  return /^(app|project|workspace|src|home|repl|dev-server|code|\.)$/i.test(dir) ? '' : dir.slice(0, 80);
+}
+
+export function normPublicUrl(u) {
+  try { const x = new URL(String(u)); return x.protocol === 'https:' || x.protocol === 'http:' ? x.origin + (x.pathname === '/' ? '' : x.pathname) : ''; }
+  catch { return ''; }
+}
+
+export function buildReport(root, opts = {}, procEnv = process.env) {
+  const { packages, source } = readPackages(root);
+  const sb = findSupabase(root, procEnv);
+  return {
+    v: 1,
+    name: appName(root),
+    url: normPublicUrl(opts.url || procEnv.SAFETYVIBE_URL || ''),
+    platform: detectPlatform(root, procEnv),
+    environment: String(opts.environment || procEnv.SAFETYVIBE_ENV || (procEnv.NODE_ENV === 'production' ? 'production' : '')).slice(0, 20),
+    lockfile: source,
+    packages,
+    supabase: sb.url && sb.key ? { url: sb.url, key: sb.key, kind: sb.kind } : null,
+  };
+}

package/package.json

@@ -1,6 +1,31 @@
-{
-  "name": "safetyvibe-connect",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "safetyvibe-connect",
+  "version": "0.2.0",
+  "description": "SafetyVibe security monitoring for AI-built apps (Lovable, Replit, Bolt, Claude Code\u2026). Reports the app's dependency list, public URL and, if used, its Supabase project URL + public anon key. Never source code or secrets.",
+  "type": "module",
+  "bin": {
+    "safetyvibe-connect": "cli.mjs"
+  },
+  "files": [
+    "cli.mjs",
+    "lib.mjs",
+    "README.md",
+    "AGENTS.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "UNLICENSED",
+  "homepage": "https://safetyvibe.eu",
+  "keywords": [
+    "security",
+    "vulnerabilities",
+    "lovable",
+    "replit",
+    "bolt",
+    "supabase",
+    "vibe-coding",
+    "safetyvibe"
+  ],
+  "author": "SafetyVibe <safetyvibe@advertis.ee>"
+}