[magqqgq]

Description

This PR addresses credential exposure in the test configuration and resolves optional dependency initialization failures within the packages/core directory.

Vulnerabilities & Security Defects Remediated:

• Credential Exposure in Test Configuration (packages/core/src/test_resources/constants.ts, packages/core/src/test_resources/createRuntime.ts): A Supabase project URL, a JWT-shaped anon key, and test-account credentials were previously embedded directly in the source code. These values have been scrubbed and are now read strictly from environment variables. Supabase integration mode will now fail with an explicit configuration error if the required values are missing.
• Optional-Dependency Initialization Failure (packages/core/src/localembeddingManager.ts): The fastembed package was previously imported at module load time, causing the embedding module to crash before reaching the remote fallback path if the optional local dependency was unavailable. The import is now lazy and strictly contained within the guarded initialization path.

---

Note

Medium Risk
Security-positive credential removal, but test auth still talks to real Supabase when env is set, and embedding init still loads a native optional dependency at runtime.

Overview
Removes hardcoded Supabase URL, anon JWT, and test-account credentials from test_resources so they come only from environment variables. Supabase test runtime now fails fast if URL, key, and test login values are missing, and it can use SUPABASE_ANON_KEY as well as the service key.

Lazily imports optional fastembed inside LocalEmbeddingModelManager.initializeModel instead of at module load, so missing local embedding deps no longer crash the module before remote fallback. Node fs/url imports are also switched to node: specifiers.

^{Reviewed by Cursor Bugbot for commit 8afdb11. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 8afdb11. Configure here.}

[cursor]

Incomplete service key env fallback

Medium Severity

Supabase key resolution accepts SUPABASE_SERVICE_API_KEY only from the env argument, while URL, anon key, email, and password can fall back to process.env via the new constants. With a partial env object and only the service key set in the environment, validation fails even though the error text lists that key as valid. The constants also snapshot process.env at import time, so later env setup never reaches those fallbacks.

Additional Locations (1)

• packages/core/src/test_resources/constants.ts#L3-L9

 

^{Reviewed by Cursor Bugbot for commit 8afdb11. Configure here.}