Merge pull request #5 from codellm-devkit/patch/secret-hygiene-neo4j-credentials

fix(neo4j): read Neo4j connection options from env vars (secret hygiene)

Author: rahlk

README.md

@@ -147,10 +147,14 @@ Options:
   --app-name <name>              logical application name for the graph
                                  :Application anchor (default: input dir name)
   --neo4j-uri <uri>              push the graph to a live Neo4j over Bolt
-                                 (incremental); omit to write graph.cypher
-  --neo4j-user <user>            Neo4j username (default: "neo4j")
-  --neo4j-password <password>    Neo4j password (default: "neo4j")
-  --neo4j-database <db>          Neo4j database name (default: server default)
+                                 (incremental); omit to write graph.cypher (env:
+                                 NEO4J_URI)
+  --neo4j-user <user>            Neo4j username (default: "neo4j", env:
+                                 NEO4J_USERNAME)
+  --neo4j-password <password>    Neo4j password (prefer the env var; a flag is
+                                 visible in shell history / process list)
+                                 (default: "neo4j", env: NEO4J_PASSWORD)
+  --neo4j-database <db>          Neo4j database name (env: NEO4J_DATABASE)
   -a, --analysis-level <n>       analysis depth: 1 = symbol table + tsc resolver
                                  call graph + RTA (default); 2 = call graph
                                  (default: "1")
@@ -237,6 +241,17 @@ sites as relationships):
   content hash changed are rewritten, and on a full run modules whose source file vanished are
   pruned. Every graph carries a `schema_version` on its `:Application` node.
 
+The connection options also read the standard Neo4j environment variables — `NEO4J_URI`,
+`NEO4J_USERNAME`, `NEO4J_PASSWORD`, `NEO4J_DATABASE` — when the corresponding flag is omitted (an
+explicit flag wins). Prefer the env var for the password so it doesn't land in shell history or the
+process list:
+
+```sh
+export NEO4J_URI=bolt://localhost:7687
+export NEO4J_PASSWORD=secret
+cants --input ./my-ts-project --emit neo4j     # credentials picked up from the environment
+```
+
 ### Schema contract
 
 `--emit schema` writes the machine-readable, version-stamped Neo4j schema (`schema.json`: node

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeanalyzer-typescript",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "CLDK TypeScript analyzer — emits the canonical CLDK analysis.json (symbol table + resolver-based call graph) via ts-morph.",
   "type": "module",
   "module": "src/index.ts",

src/cli.ts

@@ -1,5 +1,5 @@
 import * as path from "node:path";
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import type { AnalysisOptions, CallGraphProviderName, EmitTarget } from "./options";
 
 /**
@@ -16,10 +16,25 @@ export function buildProgram(): Command {
     .option("-o, --output <dir>", "output directory (omit ⇒ compact output to stdout)")
     .option("--emit <target>", "output target: json (analysis.json, default) | neo4j (graph.cypher or live push) | schema (the Neo4j schema.json contract)", "json")
     .option("--app-name <name>", "logical application name for the graph :Application anchor (default: input dir name)")
-    .option("--neo4j-uri <uri>", "push the graph to a live Neo4j over Bolt (incremental); omit to write graph.cypher")
-    .option("--neo4j-user <user>", "Neo4j username", "neo4j")
-    .option("--neo4j-password <password>", "Neo4j password", "neo4j")
-    .option("--neo4j-database <db>", "Neo4j database name (default: server default)")
+    // The four Neo4j connection options also read the standard NEO4J_* environment variables when
+    // the flag is omitted (an explicit flag wins). Prefer NEO4J_PASSWORD over the flag — a flag
+    // value is visible in shell history / the process list. Commander renders the `(env: …)` hint.
+    .addOption(
+      new Option(
+        "--neo4j-uri <uri>",
+        "push the graph to a live Neo4j over Bolt (incremental); omit to write graph.cypher",
+      ).env("NEO4J_URI"),
+    )
+    .addOption(new Option("--neo4j-user <user>", "Neo4j username").env("NEO4J_USERNAME").default("neo4j"))
+    .addOption(
+      new Option(
+        "--neo4j-password <password>",
+        "Neo4j password (prefer the env var; a flag is visible in shell history / process list)",
+      )
+        .env("NEO4J_PASSWORD")
+        .default("neo4j"),
+    )
+    .addOption(new Option("--neo4j-database <db>", "Neo4j database name").env("NEO4J_DATABASE"))
     .option("-a, --analysis-level <n>", "analysis depth: 1 = symbol table + tsc resolver call graph + RTA (default); 2 = call graph", "1")
     .option("-t, --target-files <paths...>", "restrict analysis to specific files (incremental)")
     .option("--skip-tests", "skip test trees (default)")