safetyvibe-connect 0.0.0-stage → 0.2.1

package/AGENTS.md

@@ -0,0 +1,94 @@
+# Instructions for cautious AI coding agents
+
+Reports dependency inventory and, if used, the Supabase project URL + public key to SafetyVibe. Requires Node >=18; no dependencies or package install scripts.
+
+## Run without installing
+
+Get a claim token from the dashboard, then run:
+
+```sh
+npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# pnpm
+pnpm dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# bun
+bunx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# yarn
+yarn dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+```
+
+Add `--url <published URL>` if known. Without a token, setup prints a claim link.
+On Replit/pnpm projects, `npm install` can fail with "Cannot read properties of null (reading 'isDescendantOf')".
+Use `pnpm add -D safetyvibe-connect`, or run without installing:
+`npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>`.
+Optional installation commands: `npm install -D safetyvibe-connect`, `pnpm add -D safetyvibe-connect`, `bun add -d safetyvibe-connect`, `yarn add -D safetyvibe-connect`.
+
+## Exactly what is sent
+
+For cautious AI coding agents: inspect the report before sending it:
+
+```sh
+npx -y safetyvibe-connect@0.2.1 setup --dry-run --url https://notes.example.com
+```
+
+stdout is exactly the JSON body; stderr lists destination and header names with values hidden, plus safety warnings (also under --quiet). Dry-run makes no requests and writes no files.
+Example (optional `truncated` appears only when the inventory exceeds 5000):
+
+```json
+{
+  "v": 1,
+  "name": "notes",
+  "url": "https://notes.example.com",
+  "platform": "Lovable",
+  "environment": "production",
+  "lockfile": "package-lock.json",
+  "packages": [{ "ecosystem": "npm", "name": "vite", "version": "6.0.0", "dev": true }],
+  "supabase": { "url": "https://example.supabase.co", "key": "sb_publishable_abc123def456", "kind": "publishable" }
+}
+```
+
+- `v`: report format version.
+- `name`: explicit name, package name, URL host or folder name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; otherwise empty.
+- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; otherwise empty.
+- `platform`: detected project builder/hosting label; otherwise empty.
+- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; otherwise empty.
+- `lockfile`: selected lockfile filename, `node_modules`, or `none`. Parent locks and node_modules are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
+- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded.
+- `truncated`: optional boolean; only the first 5000 packages are sent.
+- `supabase`: public project URL, strictly validated public key and kind (`publishable` or `anon`); otherwise null.
+
+Never sent: source code, file paths (except the folder-name fallback for the app name), full lockfiles, .env files, Supabase secret/service keys, URL credentials or query strings.
+The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server also refuses non-public Supabase keys and deletes stored non-public keys during cleanup.
+Public keys are found in supported environment variables/.env files or a Supabase client file. Local secret-key warnings name only the variable.
+
+Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 485 lines total). There are no dependencies and no install scripts in this package itself.
+By default reports go only to `https://dashboard.safetyvibe.eu/connect/api/v1/report`. The committed rc cannot change the destination.
+An explicit `SAFETYVIBE_API` environment override supports HTTPS, or HTTP on localhost/127.0.0.1/[::1] for local testing. Redirects are refused.
+
+## Files written and removal
+
+Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run, status and help never write. After a successful report:
+
+- `.safetyviberc.json`: app ID, normalized public URL, optional name and `hook: false`.
+- `.safetyviberc.local.json`: report key and optional fallback claim token; never commit this file. The token is removed once used or rejected as expired/used. Only stored credentials require the local file and ignore entry. The ignore entry is attempted first, then this file is written with mode 0600. An ignore failure warns and fails setup; scan still exits 0. Empty local credentials are removed.
+- `.gitignore`: adds the local config filename.
+- `package.json`: setup normally adds a postinstall report hook. `--no-hook` leaves package.json untouched and persists this preference. Existing unsafe shell scripts are left untouched with a manual instruction.
+
+The postinstall hook runs `safetyvibe-connect scan --quiet || exit 0`: it re-sends the current inventory and public Supabase details using the local report key, suppresses success chatter but keeps safety warnings on stderr, and never fails installation. Without a local key it skips reporting for a linked app unless SAFETYVIBE_KEY or a claim token is supplied.
+
+Without terminal access, first add `.safetyviberc.local.json` to `.gitignore`, then write `{"claimToken": "<TOKEN>"}` into `.safetyviberc.local.json` and configure the dependency and postinstall hook. Never put the token in the committed `.safetyviberc.json`.
+
+For manual reporting use `npx safetyvibe-connect scan` (pnpm: `pnpm dlx`, bun: `bunx`, yarn: `yarn dlx`).
+Remove the connector dependency if installed, its postinstall command, both rc files, and the local-config .gitignore entry. Keep other postinstall commands.
+
+## Commands
+
+| Command | Effect |
+|---|---|
+| `setup [--claim-token T] [--url URL] [--name NAME] [--no-hook]` | Send report, save config, optionally add hook |
+| `setup --dry-run` | Print exact report without network or writes |
+| `scan [--quiet]` | Re-report; always exits 0 for install hooks |
+| `status` | Show local link state |
+| `help`, `--help`, `-h`, no arguments | Usage only |
+| `--version`, `-v` | Package version only |
+
+Value flags accept `--flag=value` or `--flag value`, including values starting with a dash. In the space form, a known flag (also with `=...`) is treated as a missing value. Unknown commands/flags and missing values exit 2, except scan exits 0.

package/README.md

@@ -1,3 +1,94 @@
-# Temporary Holding Version
+# safetyvibe-connect
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Reports dependency inventory and, if used, the Supabase project URL + public key to SafetyVibe. Requires Node >=18; no dependencies or package install scripts.
+
+## Run without installing
+
+Get a claim token from the dashboard, then run:
+
+```sh
+npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# pnpm
+pnpm dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# bun
+bunx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+# yarn
+yarn dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+```
+
+Add `--url <published URL>` if known. Without a token, setup prints a claim link.
+On Replit/pnpm projects, `npm install` can fail with "Cannot read properties of null (reading 'isDescendantOf')".
+Use `pnpm add -D safetyvibe-connect`, or run without installing:
+`npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>`.
+Optional installation commands: `npm install -D safetyvibe-connect`, `pnpm add -D safetyvibe-connect`, `bun add -d safetyvibe-connect`, `yarn add -D safetyvibe-connect`.
+
+## Exactly what is sent
+
+For cautious AI coding agents: inspect the report before sending it:
+
+```sh
+npx -y safetyvibe-connect@0.2.1 setup --dry-run --url https://notes.example.com
+```
+
+stdout is exactly the JSON body; stderr lists destination and header names with values hidden, plus safety warnings (also under --quiet). Dry-run makes no requests and writes no files.
+Example (optional `truncated` appears only when the inventory exceeds 5000):
+
+```json
+{
+  "v": 1,
+  "name": "notes",
+  "url": "https://notes.example.com",
+  "platform": "Lovable",
+  "environment": "production",
+  "lockfile": "package-lock.json",
+  "packages": [{ "ecosystem": "npm", "name": "vite", "version": "6.0.0", "dev": true }],
+  "supabase": { "url": "https://example.supabase.co", "key": "sb_publishable_abc123def456", "kind": "publishable" }
+}
+```
+
+- `v`: report format version.
+- `name`: explicit name, package name, URL host or folder name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; otherwise empty.
+- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; otherwise empty.
+- `platform`: detected project builder/hosting label; otherwise empty.
+- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; otherwise empty.
+- `lockfile`: selected lockfile filename, `node_modules`, or `none`. Parent locks and node_modules are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
+- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded.
+- `truncated`: optional boolean; only the first 5000 packages are sent.
+- `supabase`: public project URL, strictly validated public key and kind (`publishable` or `anon`); otherwise null.
+
+Never sent: source code, file paths (except the folder-name fallback for the app name), full lockfiles, .env files, Supabase secret/service keys, URL credentials or query strings.
+The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server also refuses non-public Supabase keys and deletes stored non-public keys during cleanup.
+Public keys are found in supported environment variables/.env files or a Supabase client file. Local secret-key warnings name only the variable.
+
+Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 485 lines total). There are no dependencies and no install scripts in this package itself.
+By default reports go only to `https://dashboard.safetyvibe.eu/connect/api/v1/report`. The committed rc cannot change the destination.
+An explicit `SAFETYVIBE_API` environment override supports HTTPS, or HTTP on localhost/127.0.0.1/[::1] for local testing. Redirects are refused.
+
+## Files written and removal
+
+Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run, status and help never write. After a successful report:
+
+- `.safetyviberc.json`: app ID, normalized public URL, optional name and `hook: false`.
+- `.safetyviberc.local.json`: report key and optional fallback claim token; never commit this file. The token is removed once used or rejected as expired/used. Only stored credentials require the local file and ignore entry. The ignore entry is attempted first, then this file is written with mode 0600. An ignore failure warns and fails setup; scan still exits 0. Empty local credentials are removed.
+- `.gitignore`: adds the local config filename.
+- `package.json`: setup normally adds a postinstall report hook. `--no-hook` leaves package.json untouched and persists this preference. Existing unsafe shell scripts are left untouched with a manual instruction.
+
+The postinstall hook runs `safetyvibe-connect scan --quiet || exit 0`: it re-sends the current inventory and public Supabase details using the local report key, suppresses success chatter but keeps safety warnings on stderr, and never fails installation. Without a local key it skips reporting for a linked app unless SAFETYVIBE_KEY or a claim token is supplied.
+
+Without terminal access, first add `.safetyviberc.local.json` to `.gitignore`, then write `{"claimToken": "<TOKEN>"}` into `.safetyviberc.local.json` and configure the dependency and postinstall hook. Never put the token in the committed `.safetyviberc.json`.
+
+For manual reporting use `npx safetyvibe-connect scan` (pnpm: `pnpm dlx`, bun: `bunx`, yarn: `yarn dlx`).
+Remove the connector dependency if installed, its postinstall command, both rc files, and the local-config .gitignore entry. Keep other postinstall commands.
+
+## Commands
+
+| Command | Effect |
+|---|---|
+| `setup [--claim-token T] [--url URL] [--name NAME] [--no-hook]` | Send report, save config, optionally add hook |
+| `setup --dry-run` | Print exact report without network or writes |
+| `scan [--quiet]` | Re-report; always exits 0 for install hooks |
+| `status` | Show local link state |
+| `help`, `--help`, `-h`, no arguments | Usage only |
+| `--version`, `-v` | Package version only |
+
+Value flags accept `--flag=value` or `--flag value`, including values starting with a dash. In the space form, a known flag (also with `=...`) is treated as a missing value. Unknown commands/flags and missing values exit 2, except scan exits 0.

package/cli.mjs

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { buildReport, findSupabase, normPublicUrl, urlNeedsCleaning, withHook, HOOK, packageManager, readPackages } from './lib.mjs';
+
+const RC = '.safetyviberc.json';
+const LOCAL = '.safetyviberc.local.json';
+const DEFAULT_API = 'https://dashboard.safetyvibe.eu/connect/api/v1';
+const REPORT_KEY = /^svk_[A-Za-z0-9_-]{32}$/;
+const CLAIM_TOKEN = /^[A-Za-z0-9_-]{16,64}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const USAGE = 'Usage: safetyvibe-connect setup|scan|status|help [--claim-token TOKEN] [--url URL] [--name NAME] [--dry-run] [--quiet] [--no-hook] [--help/-h] [--version/-v]';
+const argv = process.argv.slice(2);
+const flags = {};
+let cmd = ''; let error = '';
+// Complete argument validation before reading even package.json.
+for (let i = 0; i < argv.length; i++) {
+  const arg = argv[i];
+  if (!arg.startsWith('-')) {
+    if (cmd || !['setup', 'scan', 'status', 'help'].includes(arg)) { error = 'Unknown command or argument.'; break; }
+    cmd = arg; continue;
+  }
+  const [raw, ...rest] = arg.split('=');
+  const name = ({ '-h': 'help', '-v': 'version' })[raw] || raw.replace(/^--/, '');
+  if (['claim-token', 'url', 'name'].includes(name)) {
+    const value = rest.length ? rest.join('=') : argv[++i];
+    if (!value || (!rest.length && /^(?:--(?:dry-run|quiet|no-hook|help|version|claim-token|url|name)|-h|-v)(?:=|$)/.test(value))) { error = 'Missing value for --' + name + '.'; break; }
+    flags[name] = value;
+  } else if (['dry-run', 'quiet', 'no-hook', 'help', 'version'].includes(name) && !rest.length) flags[name] = true;
+  else { error = 'Unknown flag.'; break; }
+}
+if (error) {
+  const scan = cmd === 'scan' || argv[0] === 'scan';
+  if (!(scan && argv.includes('--quiet'))) console.error(USAGE + '\n' + error);
+  process.exit(scan ? 0 : 2);
+}
+if (!argv.length || cmd === 'help' || flags.help) { console.log(USAGE); process.exit(0); }
+if (!cmd && !flags.version) { console.error(USAGE + '\nA command is required.'); process.exit(2); }
+const VERSION = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version;
+if (flags.version) { console.log(VERSION); process.exit(0); }
+const root = process.env.INIT_CWD || process.cwd();
+const say = (...args) => { if (!flags.quiet && !flags['dry-run']) console.log(...args); };
+const alert = (message) => console.error(message);
+const safeText = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '').slice(0, 300);
+const readJson = (file) => { try { return JSON.parse(readFileSync(join(root, file), 'utf8')) || {}; } catch { return {}; } };
+function readRc() {
+  const pub = readJson(RC); const local = readJson(LOCAL);
+  return { ...pub, ...Object.fromEntries(['key', 'claimToken'].filter(k => Object.hasOwn(local, k)).map(k => [k, local[k]])) };
+}
+function writeRc(rc) {
+  const { key, claimToken, api, ...pub } = rc;
+  pub.url = normPublicUrl(pub.url || '');
+  let ignored = true;
+  if (key || claimToken) try {
+    let ignore = ''; try { ignore = readFileSync(join(root, '.gitignore'), 'utf8'); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    if (!ignore.split(/\r?\n/).some(l => l.trim() === LOCAL)) writeFileSync(join(root, '.gitignore'), ignore + (ignore && !ignore.endsWith('\n') ? '\n' : '') + LOCAL + '\n');
+  } catch { ignored = false; }
+  try {
+    if (key || claimToken) {
+      writeFileSync(join(root, LOCAL), JSON.stringify({ ...(key ? { key } : {}), ...(claimToken ? { claimToken } : {}) }, null, 2) + '\n', { mode: 0o600 });
+      chmodSync(join(root, LOCAL), 0o600);
+    } else {
+      try { unlinkSync(join(root, LOCAL)); } catch (e) { if (e.code !== 'ENOENT') throw e; }
+    }
+    writeFileSync(join(root, RC), JSON.stringify(pub, null, 2) + '\n');
+  } catch { return false; }
+  if (!ignored) alert('saved the report key but could not add it to .gitignore - add .safetyviberc.local.json to .gitignore');
+  return ignored ? 'saved' : 'unignored';
+}
+
+function addHook() {
+  let pj; let original;
+  try { original = readFileSync(join(root, 'package.json'), 'utf8'); pj = JSON.parse(original); } catch { return 'skipped (no readable package.json)'; }
+  if (!pj || typeof pj !== 'object' || Array.isArray(pj)) return 'skipped (invalid package.json)';
+  if (Object.hasOwn(pj, 'scripts') && (!pj.scripts || typeof pj.scripts !== 'object' || Array.isArray(pj.scripts))) return 'skipped (invalid scripts)';
+  const result = pj.scripts && Object.hasOwn(pj.scripts, 'postinstall') && typeof pj.scripts.postinstall !== 'string'
+    ? { status: 'unsafe' } : withHook(pj.scripts?.postinstall || '');
+  if (result.status === 'unsafe') { alert('Could not safely chain postinstall. Add this line by hand: "postinstall": "' + HOOK + '"'); return 'skipped'; }
+  if (result.status === 'already there') return result.status;
+  pj.scripts = { ...pj.scripts, postinstall: result.script };
+  try { writeFileSync(join(root, 'package.json'), JSON.stringify(pj, null, /\n(\t| {4}| {2})\S/.exec(original)?.[1] || 2) + (/\r?\n$/.exec(original)?.[0] || '')); return 'added'; }
+  catch { return 'could not write package.json'; }
+}
+function apiEndpoint() {
+  const u = new URL(process.env.SAFETYVIBE_API || DEFAULT_API);
+  if (u.username || u.password || u.search || u.hash || !(u.protocol === 'https:' || (u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)))) throw new Error('Invalid SAFETYVIBE_API');
+  return u.href.replace(/\/+$/, '') + '/report';
+}
+async function report() {
+  const setup = cmd === 'setup';
+  let destination;
+  try { destination = apiEndpoint(); } catch { alert('Invalid SAFETYVIBE_API: use HTTPS or local HTTP.'); return 1; }
+  const rc = readRc();
+  const rawToken = flags['claim-token'] || rc.claimToken || process.env.SAFETYVIBE_CLAIM_TOKEN || '';
+  const token = typeof rawToken === 'string' && CLAIM_TOKEN.test(rawToken) ? rawToken : '';
+  if (rawToken && !token) alert('Invalid claim token in --claim-token, SAFETYVIBE_CLAIM_TOKEN or .safetyviberc.local.json/.safetyviberc.json.');
+  const givenUrl = flags.url || rc.url || process.env.SAFETYVIBE_URL || '';
+  const url = normPublicUrl(givenUrl);
+  if (urlNeedsCleaning(givenUrl)) alert('Removed credentials/query/fragment or unsafe path from URL; only the public URL is stored and sent');
+  const body = buildReport(root, { url, name: flags.name || rc.name });
+  const headers = { 'content-type': 'application/json', 'user-agent': 'safetyvibe-connect/' + VERSION };
+  const rawKey = rc.key || process.env.SAFETYVIBE_KEY || '';
+  const key = typeof rawKey === 'string' && REPORT_KEY.test(rawKey) ? rawKey : '';
+  if (rawKey && !key) alert('Invalid report key in SAFETYVIBE_KEY or .safetyviberc.local.json/.safetyviberc.json.');
+  if (rc.site) headers['x-safetyvibe-site'] = rc.site;
+  if (rc.site && key) headers['x-safetyvibe-key'] = key;
+  if (token) headers['x-safetyvibe-claim-token'] = token;
+  for (const variable of findSupabase(root).warnings) alert(`Warning: ${variable} holds a secret key. Variables starting with VITE_/NEXT_PUBLIC_/EXPO_PUBLIC_/PUBLIC_ are shipped to every visitor; rotate that key in Supabase.`);
+  if (flags['dry-run']) {
+    console.log(JSON.stringify(body, null, 2));
+    console.error(destination + ' headers: ' + Object.keys(headers).join(', ') + ' (values hidden)');
+    return 0;
+  }
+  let saveFailed = false;
+  const legacy = readJson(RC);
+  if (['key', 'claimToken', 'api'].some(k => Object.hasOwn(legacy, k)) || (legacy.url && legacy.url !== normPublicUrl(legacy.url))) {
+    const saved = writeRc(rc);
+    if (!saved) alert('Could not save .safetyviberc.json migration; remove credentials manually.');
+    saveFailed = saved !== 'saved';
+  }
+  const manager = packageManager(root);
+  const runner = { npm: 'npx', pnpm: 'pnpm dlx', yarn: 'yarn dlx', bun: 'bunx' }[manager];
+  if (rc.site && !key && !token) {
+    say('SafetyVibe: report key is not on this machine. Set SAFETYVIBE_KEY or get a new prompt and run ' + runner + ' safetyvibe-connect setup --claim-token <TOKEN>.');
+    return setup ? 1 : 0;
+  }
+  let response; let b;
+  const ctl = new AbortController(); const timer = setTimeout(() => ctl.abort(), 10000);
+  try {
+    response = await fetch(destination, { method: 'POST', headers, body: JSON.stringify(body), signal: ctl.signal, redirect: 'error' });
+    try { b = await response.json(); } catch {}
+  } catch { alert('SafetyVibe: could not reach ' + new URL(destination).host + '.'); return 1; }
+  finally { clearTimeout(timer); }
+  if (typeof b?.warning === 'string') alert('SafetyVibe: ' + safeText(b.warning));
+  if (!response.ok) {
+    if (['claim_expired', 'claim_used'].includes(b?.code)) {
+      if (rc.claimToken && token === rc.claimToken) {
+        delete rc.claimToken;
+        if (!writeRc(rc)) alert('Could not remove claimToken from .safetyviberc.local.json/.safetyviberc.json; remove it manually before retrying.');
+      }
+      alert('SafetyVibe: claim token expired or already used. Get a new prompt from your dashboard.');
+    }
+    alert('SafetyVibe: report rejected: ' + (typeof b?.error === 'string' ? safeText(b.error) : 'HTTP ' + response.status));
+    return 1;
+  }
+  if (!b || typeof b !== 'object' || Array.isArray(b) || typeof b.site !== 'string' || !UUID.test(b.site)) {
+    alert('SafetyVibe: unexpected response from ' + new URL(destination).host + ' (HTTP ' + response.status + ')'); return 1;
+  }
+  const next = { ...rc, site: b.site, url, ...(flags.name ? { name: body.name } : {}), ...(flags['no-hook'] ? { hook: false } : {}) };
+  if (typeof b.key === 'string' && REPORT_KEY.test(b.key)) next.key = b.key;
+  else if (b.key) alert('Invalid report key in server response.');
+  delete next.claimToken;
+  const saved = writeRc(next);
+  if (!saved) {
+    alert('SafetyVibe: report sent; app id ' + b.site + '; could not save .safetyviberc.json here, so future reports from this folder cannot reach the same app - set SAFETYVIBE_KEY or run setup in a writable checkout');
+    return 1;
+  }
+  const inventory = readPackages(root);
+  say(`SafetyVibe: reported ${body.packages.length} packages (${body.packages.filter(p => p.dev).length} dev-only).`);
+  if (body.truncated) alert(`Only the first 5000 of ${inventory.total} packages were reported.`);
+  if (setup && next.hook !== false) {
+    const hook = addHook();
+    if (hook === 'could not write package.json') { alert('SafetyVibe: report sent; app id ' + b.site + '; could not write package.json.'); return 1; }
+    say('SafetyVibe: postinstall hook ' + hook + '.');
+  } else if (setup) say('Re-report manually: ' + runner + ' safetyvibe-connect scan');
+  if (b.claimed) say('SafetyVibe: linked to your dashboard: https://dashboard.safetyvibe.eu');
+  else {
+    let claim = '';
+    try {
+      if (typeof b.claimUrl === 'string' && !/[\x00-\x1f\x7f-\x9f]/.test(b.claimUrl)) {
+        const u = new URL(b.claimUrl);
+        if (u.protocol === 'https:' && !u.username && !u.password && u.origin === new URL(destination).origin) claim = u.href;
+      }
+    } catch {}
+    say(claim ? 'SafetyVibe: open this link to add the app to your dashboard: ' + claim : 'SafetyVibe: open your SafetyVibe dashboard');
+  }
+  return saveFailed || saved === 'unignored' ? 1 : 0;
+}
+async function main() {
+  if (cmd === 'status') { const rc = readRc(); say(rc.site ? 'Linked to SafetyVibe app ' + rc.site + (normPublicUrl(rc.url) ? ' (' + normPublicUrl(rc.url) + ')' : '') + '.' : 'Not linked.'); return 0; }
+  return report();
+}
+main().then(code => process.exit(cmd === 'scan' ? 0 : code), () => { alert('SafetyVibe: could not complete report.'); process.exit(cmd === 'scan' ? 0 : 1); });

package/lib.mjs

@@ -0,0 +1,302 @@
+// safetyvibe-connect - pure helpers (no network, no writes). Tested in connect.test.mjs.
+// Egress = buildReport() body + headers x-safetyvibe-site / x-safetyvibe-key /
+// x-safetyvibe-claim-token, only to the default API or SAFETYVIBE_API
+// (https, or http on localhost); redirects refused. Never source code or secret Supabase keys.
+import { readFileSync, existsSync, readdirSync, statSync, lstatSync, realpathSync } from 'node:fs';
+import { join, basename, dirname, sep, relative } from 'node:path';
+
+const MAX_PACKAGES = 5000;
+const read = (f) => { try { return readFileSync(f, 'utf8'); } catch { return null; } };
+const readJson = (f) => { const t = read(f); if (t == null) return null; try { return JSON.parse(t); } catch { return null; } };
+
+// ---- lockfiles -------------------------------------------------------------
+// Each parser returns [{ name, version }] for every installed package (deduped later).
+
+export function fromPackageLock(json, { platform = process.platform, arch = process.arch } = {}) {
+  const out = [];
+  if (json && json.packages && typeof json.packages === 'object') {
+    for (const [path, v] of Object.entries(json.packages)) {
+      if (!path || !v || v.link || /^(workspace:|link:|file:)/.test(v.resolved || '') || typeof v.version !== 'string') continue;   // "" = the root project
+      const matches = (list, value) => !Array.isArray(list) || (!list.includes('!' + value) && (!list.some(x => !x.startsWith('!')) || list.includes(value) || list.includes('any')));
+      if (v.optional && (!matches(v.os, platform) || !matches(v.cpu, arch))) continue;
+      const i = path.lastIndexOf('node_modules/');
+      if (i === -1) continue;
+      out.push({ name: v.name || path.slice(i + 'node_modules/'.length), version: v.version, ...(v.dev === true ? { dev: true } : {}) });
+    }
+  } else if (json && json.dependencies) {                          // lockfileVersion 1
+    const walk = (deps) => { for (const [n, v] of Object.entries(deps || {})) { if (v && v.version && !v.link && !/^(workspace:|link:|file:)/.test(v.resolved || '')) out.push({ name: n, version: v.version, ...(v.dev === true ? { dev: true } : {}) }); walk(v && v.dependencies); } };
+    walk(json.dependencies);
+  }
+  return out;
+}
+
+// bun.lock (text, JSONC): "packages": { "<key>": ["name@version", registry, {...}, integrity], ... }
+export function fromBunLock(text) {
+  const clean = String(text).replace(/^\s*\/\/.*$/gm, '').replace(/,(\s*[}\]])/g, '$1');
+  const json = JSON.parse(clean);
+  const out = [];
+  for (const v of Object.values((json && json.packages) || {})) {
+    const spec = Array.isArray(v) ? v[0] : null;
+    if (typeof spec !== 'string') continue;
+    const at = spec.lastIndexOf('@');
+    if (at <= 0) continue;
+    const version = spec.slice(at + 1);
+    if (/^\d/.test(version)) out.push({ name: spec.slice(0, at), version });   // skip workspace:/git:/file:
+  }
+  return out;
+}
+
+// yarn.lock v1 ("name@range":\n  version "x") and berry ("name@npm:range":\n  version: x)
+export function fromYarnLock(text) {
+  const out = []; let names = null;
+  for (const line of String(text).split(/\r?\n/)) {
+    if (/^\S.*:\s*$/.test(line) && !line.startsWith('#') && !line.startsWith('__metadata')) {
+      names = /@(workspace:|link:|file:)/.test(line) ? null : line.replace(/:\s*$/, '').split(',').map((s) => s.trim().replace(/^"|"$/g, ''))
+        .map((s) => s.slice(0, s.lastIndexOf('@') > 0 ? s.lastIndexOf('@') : s.length));
+      continue;
+    }
+    const m = line.match(/^\s+version:?\s+"?([^"\s]+)"?\s*$/);
+    if (m && names) { for (const n of new Set(names)) if (n) out.push({ name: n, version: m[1] }); names = null; }
+  }
+  return out;
+}
+
+// pnpm-lock.yaml: package keys like "/name@1.2.3", "name@1.2.3", "/@scope/name@1.2.3(peer@x)"
+export function fromPnpmLock(text) {
+  const out = []; let inPackages = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    if (/^(packages|snapshots):\s*$/.test(line)) { inPackages = line.startsWith('packages'); continue; }
+    if (/^\S/.test(line)) { inPackages = false; continue; }
+    if (!inPackages) continue;
+    const m = line.match(/^ {2}'?\/?((?:@[^/@\s]+\/)?[^@\s/]+)@(\d[^('\s:]*)/);
+    if (m) out.push({ name: m[1], version: m[2] });
+    else if (/^ {4}dev: true\s*$/.test(line) && out.length) out[out.length - 1].dev = true;
+  }
+  return out;
+}
+
+// Fallback (bun.lockb is binary): what is actually installed in node_modules.
+export function fromNodeModules(root) {
+  const out = []; const nm = join(root, 'node_modules');
+  let entries = []; try { entries = readdirSync(nm); } catch { return out; }
+  const add = (dir) => { try { if (lstatSync(dir).isSymbolicLink() && !realpathSync(dir).startsWith(realpathSync(nm) + sep)) return; } catch { return; } const pj = readJson(join(dir, 'package.json')); if (pj && pj.name && pj.version) out.push({ name: pj.name, version: pj.version }); };
+  for (const e of entries) {
+    if (e.startsWith('.')) continue;
+    if (e.startsWith('@')) { let sub = []; try { sub = readdirSync(join(nm, e)); } catch {} for (const s of sub) add(join(nm, e, s)); }
+    else add(join(nm, e));
+  }
+  return out;
+}
+
+export function readPackages(root) {
+  let list = []; let source = 'none';
+  const tries = [
+    ['package-lock.json', (t) => fromPackageLock(JSON.parse(t))],
+    ['npm-shrinkwrap.json', (t) => fromPackageLock(JSON.parse(t))],
+    ['bun.lock', fromBunLock],
+    ['pnpm-lock.yaml', fromPnpmLock],
+    ['yarn.lock', fromYarnLock],
+  ];
+  let lockRoot = root;
+  let current = root;
+  for (let depth = 0; depth <= 6; depth++) {
+    const ws = readJson(join(current, 'package.json'))?.workspaces;
+    const yaml = read(join(current, 'pnpm-workspace.yaml')) || '';
+    const block = /^packages:\s*\r?\n((?:[ \t]+.*\r?\n?)*)/m.exec(yaml)?.[1] || '';
+    const globs = [...(Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : []),
+      ...[...block.matchAll(/^\s+-\s+['"]?([^'"\r\n]+?)['"]?\s*$/gm)].map(m => m[1])];
+    const segments = relative(current, root).split(sep);
+    const matchesGlob = g => {
+      const parts = g.replace(/^\.\//, '').replace(/\/$/, '').split('/');
+      const segmentMatches = (pattern, value) => new RegExp('^' + pattern.split('*').map(s => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('[^/]*') + '$').test(value);
+      const match = (i, j) => i === parts.length ? j === segments.length
+        : parts[i] === '**' ? match(i + 1, j) || (j < segments.length && match(i, j + 1))
+        : j < segments.length && segmentMatches(parts[i], segments[j]) && match(i + 1, j + 1);
+      return match(0, 0);
+    };
+    const workspace = globs.some(g => typeof g === 'string' && !g.startsWith('!') && matchesGlob(g))
+      && !globs.some(g => typeof g === 'string' && g.startsWith('!') && matchesGlob(g.slice(1)));
+    if (current === root || workspace) {
+      lockRoot = current;
+      if (workspace || tries.some(([f]) => existsSync(join(current, f))) || existsSync(join(current, 'bun.lockb'))) break;
+    }
+    if (existsSync(join(current, '.git')) || dirname(current) === current || depth === 6) break;
+    current = dirname(current);
+  }
+  const manager = (readJson(join(root, 'package.json'))?.packageManager || readJson(join(lockRoot, 'package.json'))?.packageManager || '').split('@')[0];
+  const preferred = { npm: ['package-lock.json', 'npm-shrinkwrap.json'], pnpm: ['pnpm-lock.yaml'], yarn: ['yarn.lock'], bun: ['bun.lock'] }[manager] || [];
+  const candidates = tries.filter(([f]) => existsSync(join(lockRoot, f))).sort(([a], [b]) => Number(preferred.includes(b)) - Number(preferred.includes(a)) || statSync(join(lockRoot, b)).mtimeMs - statSync(join(lockRoot, a)).mtimeMs);
+  for (const [file, parse] of candidates) {
+    const t = read(join(lockRoot, file)); if (t == null) continue;
+    let ok = true;
+    try { list = parse(t); } catch { list = []; ok = false; }
+    if (list.length) { source = file; break; }
+    // A JSON lockfile that parses and lists nothing really means "no dependencies". The line-based
+    // yarn/pnpm parsers can't tell empty from unsupported, so those stay "unknown".
+    if (ok && /\.json$|^bun\.lock$/.test(file)) { source = file; break; }
+  }
+  if (!list.length && source === 'none') { list = fromNodeModules(root); if (!list.length && lockRoot !== root) list = fromNodeModules(lockRoot); if (list.length) source = 'node_modules'; }
+  const seen = new Map(); const pkgs = [];
+  for (const p of list) {
+    const k = p.name + '@' + p.version;
+    // Registry versions only. git/file/link/http specs can carry tokens or local paths: never sent.
+    if ([p.name, p.version].some(v => /sb_secret_|svk_/i.test(String(v)) || keyKind(v) !== 'unknown')) continue;
+    if (!/^(@[\w.-]+\/)?[\w.-]+$/.test(p.name) || !/^\d+\.\d+\.\d+[\w.+-]{0,40}$/.test(String(p.version))) continue;
+    if (seen.has(k)) { if (p.dev !== true) delete seen.get(k).dev; continue; }
+    const row = { ecosystem: 'npm', name: p.name, version: p.version, ...(p.dev === true ? { dev: true } : {}) };
+    seen.set(k, row); pkgs.push(row);
+
+  }
+  return { packages: pkgs.slice(0, MAX_PACKAGES), source, ...(pkgs.length > MAX_PACKAGES ? { total: pkgs.length, truncated: true } : {}) };
+}
+
+// ---- Supabase (project URL + PUBLIC key only) ------------------------------
+function jwtPayload(value) {
+  if (typeof value !== 'string' || value.length > 2000 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) return null;
+  try { const p = JSON.parse(Buffer.from(value.split('.')[1], 'base64url').toString('utf8')); return p && typeof p === 'object' && !Array.isArray(p) ? p : null; } catch { return null; }
+}
+export function publicKeyKind(value) {
+  if (typeof value !== 'string' || /sb_secret_|[\s#'"`]/i.test(value)) return null;
+  if (/^sb_publishable_[A-Za-z0-9_-]{8,200}$/.test(value)) return 'publishable';
+  const payload = jwtPayload(value);
+  const claims = new Set(['iss', 'ref', 'role', 'iat', 'exp', 'nbf', 'aud', 'sub']);
+  return payload?.role === 'anon'
+    && (!Object.hasOwn(payload, 'iss') || ['supabase', 'supabase-demo'].includes(payload.iss))
+    && (!Object.hasOwn(payload, 'ref') || (typeof payload.ref === 'string' && /^[a-z0-9]{10,40}$/.test(payload.ref)))
+    && Object.entries(payload).every(([key, value]) => claims.has(key)
+      && (typeof value === 'number' || (typeof value === 'string' && value.length <= 100 && !/sb_secret_|svk_|eyJ/i.test(value)))) ? 'anon' : null;
+}
+export function keyKind(value) {
+  const kind = publicKeyKind(value);
+  if (kind) return kind;
+  const payload = jwtPayload(value);
+  return /sb_secret_/i.test(String(value || '')) || (payload && typeof payload.role === 'string' && payload.role !== 'anon') ? 'secret' : 'unknown';
+}
+export function parseEnv(text) {
+  const env = {};
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const m = line.match(/^\s*(?:export\s+)?([\w.-]+)\s*=\s*(.*)$/);
+    if (!m) continue;
+    const value = m[2]; const quote = value[0];
+    if (["'", '"', '`'].includes(quote)) {
+      let end = 1;
+      for (; end < value.length; end++) {
+        if (quote === '"' && value[end] === '\\') { end++; continue; }
+        if (value[end] === quote) break;
+      }
+      if (end === value.length) continue;
+      env[m[1]] = value.slice(1, end);
+    } else env[m[1]] = value.split('#')[0].trim();
+  }
+  return env;
+}
+
+const URL_VARS = ['VITE_SUPABASE_URL', 'NEXT_PUBLIC_SUPABASE_URL', 'PUBLIC_SUPABASE_URL', 'EXPO_PUBLIC_SUPABASE_URL', 'SUPABASE_URL'];
+const KEY_VARS = ['VITE_SUPABASE_PUBLISHABLE_KEY', 'VITE_SUPABASE_ANON_KEY', 'NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+  'PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'PUBLIC_SUPABASE_ANON_KEY', 'EXPO_PUBLIC_SUPABASE_ANON_KEY', 'SUPABASE_PUBLISHABLE_KEY', 'SUPABASE_ANON_KEY'];
+
+export function findSupabase(root, procEnv = process.env) {
+  const env = {};
+  for (const f of ['.env', '.env.local', '.env.production', '.env.production.local']) Object.assign(env, parseEnv(read(join(root, f))));
+  for (const k of [...URL_VARS, ...KEY_VARS]) if (procEnv[k]) env[k] = procEnv[k];
+  const warnings = KEY_VARS.filter(k => keyKind(env[k]) === 'secret');
+  let url = URL_VARS.map((k) => env[k]).find(Boolean) || '';
+  let key = KEY_VARS.map((k) => env[k]).find(value => publicKeyKind(value)) || '';
+  // Lovable hard-codes them in src/integrations/supabase/client.ts
+  if (!url || !key) {
+    for (const f of ['src/integrations/supabase/client.ts', 'src/integrations/supabase/client.js', 'src/lib/supabase.ts', 'src/lib/supabase.js', 'lib/supabase.ts', 'utils/supabase.ts']) {
+      const t = read(join(root, f)); if (!t) continue;
+      url = url || ((t.match(/["'`](https:\/\/[a-z0-9-]+\.supabase\.co)["'`]/i) || [])[1] || '');
+      for (const match of t.matchAll(/([\w]*(?:PUBLISHABLE|ANON)_KEY)\s*=\s*["'`]([^"'`]+)["'`]/gi)) {
+        if (keyKind(match[2]) === 'secret') warnings.push(match[1]);
+        if (!key && publicKeyKind(match[2])) key = match[2];
+      }
+      if (url && key) break;
+    }
+  }
+  if (!/^https:\/\/[a-z0-9-]+\.supabase\.(co|in)\/?$/i.test(url)) url = '';
+  const kind = key ? keyKind(key) : 'none';
+  // Never send anything that isn't provably a public key.
+  if (!publicKeyKind(key)) key = '';
+  return { url: url.replace(/\/$/, ''), key, kind, warnings };
+}
+
+// ---- app identity ------------------------------------------------------------
+const HOSTS = { 'lovable.app': 'Lovable', 'replit.app': 'Replit', 'repl.co': 'Replit', 'bolt.host': 'Bolt', 'base44.app': 'Base44', 'emergent.host': 'Emergent', 'emergentagent.com': 'Emergent', 'softgen.ai': 'Softgen', 'softgen.dev': 'Softgen', 'lp.dev': 'Leap', 'vercel.app': 'Vercel', 'netlify.app': 'Netlify', 'run.app': 'Google Cloud Run' };
+export function detectPlatform(root, procEnv = process.env, url = '') {
+  const pj = readJson(join(root, 'package.json')) || {};
+  const deps = { ...pj.dependencies, ...pj.devDependencies };
+  if (deps['lovable-tagger'] || existsSync(join(root, '.lovable'))) return 'Lovable';
+  if (existsSync(join(root, '.replit'))) return 'Replit';
+  for (const [marker, label] of Object.entries({ '.bolt': 'Bolt', '.emergent': 'Emergent', '.softgen': 'Softgen', '.leap': 'Leap', '.rocket': 'Rocket', '.v0': 'v0' })) if (existsSync(join(root, marker))) return label;
+  if (deps['@base44/sdk']) return 'Base44';
+  if (Object.hasOwn(readJson(join(root, 'metadata.json')) || {}, 'requestFramePermissions') || (pj.name === 'react-example' && deps['@google/genai']) || ['ts', 'js', 'mjs', 'mts'].some(ext => /process\.env\.GEMINI_API_KEY/.test(read(join(root, 'vite.config.' + ext)) || ''))) return 'Google AI Studio';
+  try { const host = new URL(url).hostname; for (const [suffix, label] of Object.entries(HOSTS)) if (host.endsWith('.' + suffix)) return label; } catch {}
+  if (procEnv.REPL_ID) return 'Replit';
+  if (procEnv.VERCEL) return 'Vercel';
+  if (procEnv.NETLIFY) return 'Netlify';
+  return '';
+}
+const TEMPLATES = new Set('workspace frontend backend client web app project src home repl code dev-server react-example vite-project vite-react-shadcn-ts tanstack-start-ts vite-react-typescript-starter rest-express my-app react-app nextjs next-app nextjs-app my-v0-project'.split(' '));
+// Real JWTs start with eyJ (base64 of {"); plain dotted names like notes.example.com stay allowed.
+const secretLike = value => keyKind(value) !== 'unknown' || /sb_secret_|svk_|eyJ/i.test(value);
+export function appName(root, explicit = '', url = '') {
+  let host = ''; try { host = new URL(url).hostname; if (Object.keys(HOSTS).some(s => host.endsWith('.' + s))) host = host.split('.')[0]; } catch {}
+  for (const candidate of [explicit, readJson(join(root, 'package.json'))?.name, host, basename(root)]) {
+    const raw = String(candidate || '').trim();
+    if (secretLike(raw)) continue;
+    const n = raw.replace(/[^A-Za-z0-9 @/._-]/g, '').trim();
+    if (n && !TEMPLATES.has(n.toLowerCase().replace(/_/g, '-')) && !secretLike(n) && !secretLike(n.slice(0, 80))) return n.slice(0, 80);
+  }
+  return '';
+}
+export function packageManager(root, env = process.env) {
+  const field = readJson(join(root, 'package.json'))?.packageManager?.split('@')[0];
+  if (['npm', 'pnpm', 'yarn', 'bun'].includes(field)) return field;
+  const source = readPackages(root).source;
+  if (source.startsWith('pnpm')) return 'pnpm';
+  if (source.startsWith('yarn')) return 'yarn';
+  if (source.startsWith('bun') || existsSync(join(root, 'bun.lockb'))) return 'bun';
+  if (source.endsWith('.json')) return 'npm';
+  return /^(pnpm|yarn|bun)\//.exec(env.npm_config_user_agent || '')?.[1] || 'npm';
+}
+export const HOOK = 'safetyvibe-connect scan --quiet || exit 0';
+export function withHook(current = '') {
+  const cur = String(current).trim();
+  const base = cur.replace(/\s*&&\s*\(?safetyvibe-connect scan(?: --quiet)?(?: \|\| exit 0)?\)?$/, '').replace(/^\(?safetyvibe-connect scan(?: --quiet)?(?: \|\| exit 0)?\)?$/, '').trim();
+  if (/^[&|;]|[&|;\\^]$|[\r\n`<>#;$%!]|\$\(|[()]/.test(base) || /(?<![&|])[&|](?![&|])/.test(base) || /['"]/.test(base)) return { script: current, status: 'unsafe' };
+  const script = base ? base + ' && (' + HOOK + ')' : HOOK;
+  return { script, status: script === cur ? 'already there' : 'added' };
+}
+
+function publicUrl(given) {
+  try {
+    const u = new URL(String(given));
+    if (!['http:', 'https:'].includes(u.protocol)) return { url: '', cleaning: false };
+    const keep = /^(\/[A-Za-z0-9._~-]{1,64}){0,8}\/?$/.test(u.pathname)
+      && u.pathname.split('/').every(segment => segment.length <= 40 && !/sb_|svk_|eyJ/i.test(segment));
+    return { url: u.origin + (keep && u.pathname !== '/' ? u.pathname : ''),
+      cleaning: Boolean(u.username || u.password || u.search || u.hash || !keep) };
+  } catch { return { url: '', cleaning: false }; }
+}
+export function normPublicUrl(given) { return publicUrl(given).url; }
+export function urlNeedsCleaning(given) { return publicUrl(given).cleaning; }
+
+export function buildReport(root, opts = {}, procEnv = process.env) {
+  const { packages, source, truncated } = readPackages(root);
+  const url = normPublicUrl(opts.url || procEnv.SAFETYVIBE_URL || '');
+  const sb = findSupabase(root, procEnv);
+  const rawEnvironment = String(opts.environment || procEnv.SAFETYVIBE_ENV || (procEnv.NODE_ENV === 'production' ? 'production' : ''));
+  const environment = rawEnvironment.replace(/[^A-Za-z0-9_-]/g, '');
+  return {
+    v: 1,
+    name: appName(root, opts.name, url),
+    url,
+    platform: detectPlatform(root, procEnv, url),
+    environment: [rawEnvironment, environment, environment.slice(0, 20)].some(secretLike) ? '' : environment.slice(0, 20),
+    lockfile: source,
+    packages,
+    ...(truncated ? { truncated: true } : {}),
+    supabase: sb.url && sb.key ? { url: sb.url, key: sb.key, kind: sb.kind } : null,
+  };
+}

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "safetyvibe-connect",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.1",
+  "description": "SafetyVibe security monitoring for AI-built apps (Lovable, Replit, Bolt, Claude Code\u2026). Reports the app's dependency list, public URL and, if used, its Supabase project URL + public anon key. Never source code or secrets.",
+  "type": "module",
+  "bin": {
+    "safetyvibe-connect": "cli.mjs"
+  },
+  "files": [
+    "cli.mjs",
+    "lib.mjs",
+    "README.md",
+    "AGENTS.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "UNLICENSED",
+  "homepage": "https://safetyvibe.eu",
+  "keywords": [
+    "security",
+    "vulnerabilities",
+    "lovable",
+    "replit",
+    "bolt",
+    "supabase",
+    "vibe-coding",
+    "safetyvibe"
+  ],
+  "author": "SafetyVibe <safetyvibe@advertis.ee>"
+}