launchprep 0.0.1 → 0.2.0

package/src/fs-scan.mjs

@@ -0,0 +1,211 @@
+// Cheap repo walk. Everything downstream reads from this one pass so we never
+// hit the disk twice for the same file.
+import { readdirSync, readFileSync, statSync, existsSync, lstatSync, realpathSync } from 'node:fs';
+import { join, relative, extname, resolve, sep, dirname, posix } from 'node:path';
+
+const SKIP = new Set([
+  'node_modules', '.git', '.next', 'dist', 'build', 'out', 'coverage',
+  '.venv', 'venv', '__pycache__', '.turbo', 'vendor', '.cache', 'target',
+  'site-packages', 'eggs', '.eggs', '.tox', '.bundle', 'storage', 'public',
+]);
+const TEXT = new Set([
+  '.js','.jsx','.ts','.tsx','.mjs','.cjs','.json','.sql','.py','.rb','.go',
+  '.yaml','.yml','.toml','.env','.example','.prisma','.md','.swift','.kt',
+  '.php','.erb','.haml','.slim','.html','.htm','.vue','.svelte','.cfg','.ini',
+  '.rake','.gemspec','.blade','.twig','.tf','.conf',
+  // mobile manifests and robots.txt - MOB-004 and UX-006 cannot see them otherwise
+  '.plist','.xml','.txt'
+]);
+// files that carry no extension but decide what a project is
+const NAMED = new Set([
+  'Gemfile','Rakefile','Procfile','Dockerfile','Makefile','Brewfile',
+  'Gemfile.lock','requirements.txt','Pipfile','manage.py','artisan',
+]);
+const MAX_BYTES = 512 * 1024;
+
+// A symlink named like a source file will otherwise be read straight through:
+// `config.ts -> /etc/passwd` lands its contents in the scan, and from there into
+// a finding. Anything resolving outside the repo is refused.
+function containedRealPath(root, full) {
+  try {
+    const real = realpathSync(full);
+    const base = realpathSync(root);
+    return (real === base || real.startsWith(base + sep)) ? real : null;
+  } catch { return null; }
+}
+
+
+// ---- the whole ignore chain, not just the file at the scan root ------------
+// .gitignore is resolved against the GIT repository root, which is often above
+// the directory being scanned. Reading only `<scanroot>/.gitignore` told us our
+// own api/.env was unprotected when the rule excluding it sits one level up, in
+// the repo root - a CRITICAL finding that was simply wrong. Same shape as every
+// other false positive we have had: it judged the file without the context that
+// decides it.
+//
+// Read-only, and it reads .git directly rather than shelling out to git, which
+// verify-readonly.mjs forbids.
+function gitRoot(from) {
+  let d = resolve(from);
+  for (let i = 0; i < 40; i++) {
+    if (existsSync(join(d, '.git'))) return d;
+    const up = dirname(d);
+    if (up === d) return null;
+    d = up;
+  }
+  return null;
+}
+
+// Enough of the gitignore syntax to answer "is this path excluded": globs,
+// anchoring, directory-only rules and negation. Not the whole spec - but the
+// alternative was a regex that guessed, and guessing is what produced the bug.
+function toRegExp(pattern) {
+  let p = pattern;
+  const anchored = p.startsWith('/') || p.slice(0, -1).includes('/');
+  if (p.startsWith('/')) p = p.slice(1);
+  if (p.endsWith('/')) p = p.slice(0, -1);
+  let re = '';
+  for (let i = 0; i < p.length; i++) {
+    const c = p[i];
+    if (c === '*') {
+      if (p[i + 1] === '*') { re += '.*'; i++; if (p[i + 1] === '/') i++; }
+      else re += '[^/]*';
+    }
+    else if (c === '?') re += '[^/]';
+    else re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp('^' + (anchored ? '' : '(?:.*/)?') + re + '(?:/.*)?$');
+}
+
+// Each rule is kept with the directory its .gitignore was written in, because
+// that is what its paths are relative to. Exported so the test shim builds its
+// matcher the same way rather than approximating it.
+export function buildIgnore(rootAbs, sources) {
+  const rules = [];
+  for (const { dir, text } of sources) {
+    for (const raw of String(text ?? '').split('\n')) {
+      const line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      const negate = line.startsWith('!');
+      const pattern = negate ? line.slice(1) : line;
+      if (!pattern) continue;
+      rules.push({ dir, re: toRegExp(pattern), negate });
+    }
+  }
+  // last matching rule wins, which is what git does
+  return (relPath) => {
+    const abs = resolve(rootAbs, relPath);
+    let ignored = false;
+    for (const r of rules) {
+      const rel = relative(r.dir, abs);
+      if (!rel || rel.startsWith('..')) continue;
+      if (r.re.test(rel.split(sep).join(posix.sep))) ignored = !r.negate;
+    }
+    return ignored;
+  };
+}
+
+// Every .gitignore from the git root down to the scan root, plus .git/info/exclude.
+export function ignoreChain(root) {
+  const rootAbs = resolve(root);
+  const gr = gitRoot(rootAbs);
+  const dirs = [];
+  if (gr) { let d = rootAbs; while (true) { dirs.unshift(d); if (d === gr) break; const up = dirname(d); if (up === d) break; d = up; } }
+  else dirs.push(rootAbs);
+
+  const sources = [];
+  const readAt = (dir, rel) => { try { return readFileSync(join(dir, rel), 'utf8'); } catch { return null; } };
+  for (const d of dirs) {
+    const t = readAt(d, '.gitignore');
+    if (t !== null) sources.push({ dir: d, text: t });
+  }
+  if (gr) {
+    const t = readAt(gr, join('.git', 'info', 'exclude'));
+    if (t !== null) sources.push({ dir: gr, text: t });
+  }
+  return buildIgnore(rootAbs, sources);
+}
+
+export function scanRepo(root, { maxFiles = 6000 } = {}) {
+  const files = [];
+  const rootAbs = resolve(root);
+  const walk = (dir) => {
+    if (files.length >= maxFiles) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (files.length >= maxFiles) return;
+      if (e.name.startsWith('.') && !e.name.startsWith('.env') && e.name !== '.github') continue;
+      const full = join(dir, e.name);
+
+      let isLink = false;
+      try { isLink = lstatSync(full).isSymbolicLink(); } catch { continue; }
+      if (isLink && !containedRealPath(rootAbs, full)) {
+        // points outside the repo - record that it exists, never read it
+        files.push({ path: relative(root, full), text: null, skipped: 'symlink-escapes-repo' });
+        continue;
+      }
+
+      if (e.isDirectory()) { if (!SKIP.has(e.name)) walk(full); continue; }
+      const ext = extname(e.name) || (e.name.startsWith('.env') ? '.env' : '');
+      if (!TEXT.has(ext) && !NAMED.has(e.name)) {
+        files.push({ path: relative(root, full), text: null }); continue;
+      }
+      let text = null;
+      try { if (statSync(full).size <= MAX_BYTES) text = readFileSync(full, 'utf8'); } catch {}
+      files.push({ path: relative(root, full), text });
+    }
+  };
+  walk(root);
+  return {
+    root,
+    files,
+    has: (re) => files.some(f => re.test(f.path)),
+    find: (re) => files.filter(f => re.test(f.path)),
+    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/) =>
+      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+    exists: (rel) => existsSync(join(root, rel)),
+    read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+    isIgnored: ignoreChain(root),
+  };
+}
+
+export function readPackageJson(repo) {
+  const raw = repo.read('package.json');
+  if (!raw) return null;
+  try { return JSON.parse(raw); } catch { return null; }
+}
+
+// Monorepos put nothing in the root manifest. Union every workspace package.json
+// or we conclude a pnpm/turbo repo has no dependencies at all.
+export function allManifests(repo) {
+  return repo.find(/(^|\/)package\.json$/)
+    .map(f => { try { return JSON.parse(f.text || ''); } catch { return null; } })
+    .filter(Boolean);
+}
+
+export function allDeps(pkgOrRepo) {
+  // accept either a single manifest (legacy) or a repo (monorepo-aware)
+  const manifests = pkgOrRepo && pkgOrRepo.files ? allManifests(pkgOrRepo)
+                  : pkgOrRepo ? [pkgOrRepo] : [];
+  const out = {};
+  for (const m of manifests)
+    Object.assign(out, m.dependencies||{}, m.devDependencies||{}, m.peerDependencies||{});
+  return out;
+}
+
+// Comments describe code; they are not evidence about it. Strip them before
+// matching, or a comment mentioning "diagnosis" classifies a CRM as health data.
+export function stripComments(text) {
+  return text
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/(^|[^:])\/\/.*$/gm, '$1')
+    .replace(/^\s*#(?!\[).*$/gm, '')
+    .replace(/^\s*--.*$/gm, '');
+}
+
+export function isWorkspaceRoot(repo) {
+  return repo.exists('pnpm-workspace.yaml') || repo.exists('turbo.json') ||
+         repo.exists('lerna.json') || repo.exists('nx.json') ||
+         !!readPackageJson(repo)?.workspaces;
+}

package/src/gate.mjs

@@ -0,0 +1,103 @@
+// The applicability gate. A rule is evaluated only if every `requires:`
+// predicate holds against the detected profile.
+//
+//   true  -> applies, run the check
+//   false -> skipped, shown with the reason, never counted against the score
+//   null  -> undeterminable, becomes a question, never a failure
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const RULES = require('./rules.json');
+
+export const allRules = () => RULES.rules;
+
+function get(profile, key) {
+  let cur = profile;
+  for (const part of key.split('.')) {
+    if (cur == null || typeof cur !== 'object' || !(part in cur)) return undefined;
+    cur = cur[part];
+  }
+  return cur;
+}
+
+const coerce = (v) => (v === 'true' ? true : v === 'false' ? false : v);
+
+export function evaluate(pred, profile) {
+  const p = String(pred).trim();
+
+  if (p.includes(' or ')) {
+    const parts = p.split(' or ').map(x => evaluate(x, profile));
+    if (parts.some(x => x === true)) return true;
+    return parts.some(x => x === null) ? null : false;
+  }
+
+  let m = p.match(/^([\w.]+)\s+includes any of\s+\[(.+)\]$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur == null) return null;
+    const vals = m[2].split(',').map(s => s.trim());
+    return vals.some(v => Array.isArray(cur) ? cur.includes(v) : cur === v);
+  }
+
+  m = p.match(/^([\w.]+)\s+in\s+\[(.+)\]$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur === undefined) return null;
+    return m[2].split(',').map(s => s.trim()).includes(cur);
+  }
+
+  m = p.match(/^([\w.]+)\s*(==|!=)\s*(.+)$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur === undefined) return null;
+    const val = coerce(m[3].trim());
+    return m[2] === '==' ? cur === val : cur !== val;
+  }
+
+  return null;
+}
+
+export function applies(rule, profile) {
+  const reqs = rule.requires || [];
+  if (!reqs.length) return true;
+  const res = reqs.map(r => evaluate(r, profile));
+  if (res.some(x => x === false)) return false;
+  if (res.some(x => x === null)) return null;
+  return true;
+}
+
+// Why a rule was skipped, in the user's terms rather than predicate syntax.
+export function skipReason(rule, profile) {
+  for (const r of rule.requires || []) {
+    if (evaluate(r, profile) !== false) continue;
+    const key = String(r).match(/^([\w.]+)/)?.[1];
+    const actual = get(profile, key);
+    return `${key} is ${JSON.stringify(actual)}`;
+  }
+  return 'precondition not met';
+}
+
+export function gate(profile) {
+  const evaluated = [], skipped = [], unknown = [];
+  for (const rule of RULES.rules) {
+    const a = applies(rule, profile);
+    if (a === true) evaluated.push(rule);
+    else if (a === false) skipped.push({ rule, reason: skipReason(rule, profile) });
+    else unknown.push(rule);
+  }
+  return { evaluated, skipped, unknown, total: RULES.rules.length };
+}
+
+// Facts that, if answered, would unlock the most currently-unknown rules.
+export function missingFacts(profile, unknown) {
+  const counts = new Map();
+  for (const rule of unknown) {
+    for (const req of rule.requires || []) {
+      for (const sub of String(req).split(' or ')) {
+        if (evaluate(sub, profile) !== null) continue;
+        const key = sub.trim().match(/^([\w.]+)/)?.[1];
+        if (key) counts.set(key, (counts.get(key) || 0) + 1);
+      }
+    }
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}

package/src/index.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { scanRepo } from './fs-scan.mjs';
+import { splitWorkspaces } from './workspace.mjs';
+import { detectProfile, toGateProfile } from './detect.mjs';
+import { gate, missingFacts } from './gate.mjs';
+import { runChecks, runRootChecks } from './checks.mjs';
+import { render } from './report.mjs';
+
+const target = process.argv[2] || process.cwd();
+const asJson = process.argv.includes('--json');
+
+const repo = scanRepo(target, { maxFiles: 12000 });
+const packages = splitWorkspaces(repo);
+
+// Profile and gate every app in the repo. Libraries are profiled too - they
+// simply match very few rules, which is the correct outcome, not a bug.
+const scanned = packages.map(w => {
+  const full = detectProfile(w.view, { root: repo });
+  const profile = toGateProfile(full);
+  const g = gate(profile);
+  const applicableIds = new Set(g.evaluated.map(r => r.id));
+  const findings = runChecks(w.view, profile, applicableIds)
+    .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
+  return { name: w.name, full, profile, gate: g, findings };
+});
+
+// The app most representative of this repo leads the report.
+const apps = scanned.filter(s => s.profile.surface !== 'library');
+const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
+
+// Root-scoped checks see the whole repo, once, regardless of how many
+// workspaces it contains. Gated by the lead app's profile.
+const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
+const rootFindings = runRootChecks(repo, lead.profile, rootIds);
+
+const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
+const seen = new Set();
+// Each workspace sorts its own findings, but concatenating several workspaces
+// and the root-scoped checks destroys that order - a monorepo would show a LOW
+// from apps/web above a CRITICAL from apps/api. Sort once, at the end.
+const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+const findings = allFindings
+  .filter(f => {
+    const k = `${f.id}:${f.file}:${f.line}`;
+    if (seen.has(k)) return false;
+    seen.add(k); return true;
+  })
+  .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+
+// Eleven tier-2 rules have a cheap static approximation that ships free. When
+// one of those finds nothing that is NOT a pass - a pattern cannot see an
+// ownership check that lives in middleware. Reporting it as clean would tell
+// someone they are safe when the check simply could not look. Say so instead.
+const firedIds = new Set(findings.map(f => f.id));
+const shallow = lead.gate.evaluated
+  .filter(r => r.has_static_approximation && !firedIds.has(r.id));
+
+const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
+
+if (asJson) {
+  console.log(JSON.stringify({
+    packages: scanned.map(s => ({
+      name: s.name, profile: s.profile,
+      evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
+    })),
+    findings, questions,
+    shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
+  }, null, 2));
+} else {
+  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
+}

package/src/report.mjs

@@ -0,0 +1,101 @@
+import { BRAND } from './brand.mjs';
+
+const C = { red:'\x1b[31m', yel:'\x1b[33m', blu:'\x1b[34m', gry:'\x1b[90m',
+            bold:'\x1b[1m', dim:'\x1b[2m', grn:'\x1b[32m', cyn:'\x1b[36m', off:'\x1b[0m' };
+const SEV = { critical:[C.red,'CRITICAL'], high:[C.yel,'HIGH'], medium:[C.blu,'MEDIUM'], low:[C.gry,'LOW'] };
+
+const QUESTION = {
+  business_model:  'Who is this for — consumers, businesses, a marketplace, or internal use?',
+  jurisdictions:   'Where are your users? (EU / UK / US / other — this decides which privacy rules apply)',
+  expected_scale:  'How many users do you expect — under 1k, under 100k, or more?',
+  serves_currency: 'Do you charge in more than one currency?',
+  audience_locale: 'Do you serve more than one language or region?',
+};
+
+export function render({ repo, scanned, lead, findings, questions, shallow = [] }) {
+  const L = [];
+  const p = (s = '') => L.push(s);
+  const pr = lead.profile;
+
+  p(`\n${C.bold}${BRAND.name.toUpperCase()}${C.off} ${C.dim}${repo}${C.off}\n`);
+
+  // ---------- what this app is ----------
+  p(`${C.bold}What we found${C.off}`);
+  const ev = (f) => lead.full[f]?.evidence?.[0];
+  const row = (k, v, why) =>
+    p(`  ${C.gry}${k.padEnd(10)}${C.off}${v}${why ? `  ${C.dim}(${why})${C.off}` : ''}`);
+
+  row('Type', pr.surface, ev('surface'));
+  row('Stack', [pr.stack.framework, pr.stack.database, pr.stack.host].filter(Boolean).join(' · ') || '—');
+  row('Accounts', pr.has_accounts ? 'yes' : 'no', ev('has_accounts'));
+  if (pr.tenancy !== 'none') row('Tenancy', pr.tenancy, ev('tenancy'));
+  if (pr.calls_llm) row('AI', (pr.llm_providers || []).join(', ') || 'yes', ev('calls_llm'));
+  if (pr.handles_payments !== 'none') row('Payments', pr.handles_payments);
+  if (pr.data_sensitivity !== 'none') row('Data', pr.data_sensitivity, ev('data_sensitivity'));
+  row('Stage', pr.stage, ev('stage'));
+
+  if (scanned.length > 1) {
+    const apps = scanned.filter(s => s.profile.surface !== 'library');
+    const libs = scanned.length - apps.length;
+    p(`\n  ${C.dim}Monorepo — ${apps.length} app${apps.length === 1 ? '' : 's'}` +
+      `${libs ? ` and ${libs} shared package${libs === 1 ? '' : 's'}` : ''}, each checked on its own:${C.off}`);
+    for (const s of apps.slice(0, 6))
+      p(`    ${C.dim}${s.name.padEnd(26)} ${s.profile.surface.padEnd(11)} ${s.gate.evaluated.length} checks${C.off}`);
+  }
+
+  // ---------- findings ----------
+  p(`\n${C.bold}Findings${C.off}`);
+  if (!findings.length) {
+    p(`  ${C.grn}Nothing found by the deterministic checks.${C.off}`);
+    p(`  ${C.dim}These are the fast, free checks — deeper ones need a review pass.${C.off}`);
+  } else {
+    const counts = findings.reduce((a, f) => (a[f.severity] = (a[f.severity] || 0) + 1, a), {});
+    // severity order, not whatever order they happened to arrive in
+    const summary = ['critical', 'high', 'medium', 'low']
+      .filter(k => counts[k]).map(k => `${counts[k]} ${k}`).join(' · ');
+    p(`  ${C.dim}${summary}${C.off}`);
+    for (const f of findings.slice(0, 25)) {
+      const [col, label] = SEV[f.severity];
+      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}`);
+      p(`  ${C.gry}${f.file}:${f.line}${C.off}`);
+      p(`      ${f.detail}`);
+      p(`      ${C.grn}Fix${C.off}  ${f.fix}`);
+    }
+    if (findings.length > 25) p(`\n  ${C.dim}… and ${findings.length - 25} more${C.off}`);
+  }
+
+  // ---------- checked, but only as far as a program can see ----------
+  if (shallow.length) {
+    p(`\n${C.bold}${shallow.length} check${shallow.length === 1 ? '' : 's'} went only as deep as a pattern can${C.off}`);
+    p(`  ${C.dim}These found nothing. That is not the same as being safe — a pattern`);
+    p(`  cannot tell whether an ownership check lives in middleware or a guard.${C.off}`);
+    for (const r of shallow.slice(0, 6))
+      p(`  ${C.cyn}~${C.off} ${C.gry}${r.id.padEnd(11)}${C.off}${r.title}`);
+    if (shallow.length > 6) p(`  ${C.dim}  … and ${shallow.length - 6} more${C.off}`);
+    p(`  ${C.dim}A deep scan reads the actual path these take through your code.${C.off}`);
+  }
+
+  // ---------- what we did not check, and why ----------
+  const g = lead.gate;
+  p(`\n${C.bold}Coverage${C.off}`);
+  p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  p(`  ${C.dim}${g.skipped.length} skipped — they don't fit what you built${C.off}`);
+
+  const bySkipFact = {};
+  for (const s of g.skipped) {
+    const k = s.reason.split(' is ')[0];
+    bySkipFact[k] = (bySkipFact[k] || 0) + 1;
+  }
+  for (const [f, n] of Object.entries(bySkipFact).sort((a, b) => b[1] - a[1]).slice(0, 4))
+    p(`      ${C.dim}${String(n).padStart(3)} because ${f} is ${JSON.stringify(lead.profile[f] ?? lead.profile.stack?.[f.split('.').pop()])}${C.off}`);
+
+  // ---------- the three questions ----------
+  if (questions.length) {
+    p(`\n${C.bold}${g.unknown.length} more checks need ${questions.length} answer${questions.length === 1 ? '' : 's'}${C.off}`);
+    for (const [factName, n] of questions)
+      p(`  ${C.cyn}?${C.off} ${QUESTION[factName] || factName}  ${C.dim}(unlocks ${n})${C.off}`);
+  }
+
+  p(`\n  ${C.dim}Anything above wrong? Correct it and the checks adjust.${C.off}\n`);
+  return L.join('\n');
+}