launchprep 0.2.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,31 @@
+Launchprep Licence
+
+Copyright (c) 2026 Bc. Bektur Aibekov, IČO 29522471, Prague, Czech Republic.
+All rights reserved.
+
+You may:
+
+  1. Install and run this software to scan source code that you own or are
+     authorised to scan.
+  2. Make copies as reasonably necessary for that use (for example, inside a
+     CI pipeline or a container image you operate).
+
+You may not:
+
+  3. Copy, redistribute, sublicense, sell, or publish this software or any
+     part of it, including the rule and check definitions it contains.
+  4. Extract, reproduce, or adapt the rule and check definitions for use in
+     any other product or service, commercial or not.
+  5. Remove or alter this notice.
+
+Versions 0.1.0 and 0.2.0 of the "launchprep" npm package were published under
+the MIT licence; that grant stands for those versions. This licence applies to
+this version and all later ones.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE. Findings are produced
+by automated analysis and may be incomplete or wrong; they are information,
+not a guarantee of security or fitness for launch.
+
+Questions and permissions: hello@launchprep.dev

package/README.md

@@ -13,7 +13,7 @@ No signup. No dashboard. Nothing added to your repo.
 
 ## What it does
 
-288 checks — but it works out what you built **before** running any of them, so
+289 checks — but it works out what you built **before** running any of them, so
 you are not told about problems you cannot have. A static site is asked 48
 questions; a multi-tenant SaaS with payments and AI is asked 158.
 
@@ -69,6 +69,19 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## In CI
+
+```bash
+npx launchprep . --fail-on critical         # exit 1 if a critical is found
+npx launchprep deep . --yes --fail-on high  # the paid scan as a gate
+```
+
+Without `--fail-on` the exit code stays 0 — a report, not a verdict. With it,
+findings at or above the threshold (`critical`, `high`, `medium`, `low`, `any`)
+fail the build. On a deep scan, checks that did not complete fail it too — a
+check that could not run has not passed. A path that does not exist always
+exits 2: a scan of nothing must never look like a clean scan of something.
+
 ## Free and paid
 
 Everything above is free, unlimited, forever — every check a program can make on
@@ -81,4 +94,6 @@ delete. See <https://launchprep.dev>.
 
 ## Licence
 
-MIT
+Proprietary — see the LICENSE file. Run it on anything you are authorised to
+scan; the rules and checks may not be copied into other products. Versions
+0.1.0 and 0.2.0 were published under MIT and remain so.

package/net/commands.mjs

@@ -99,6 +99,12 @@ async function deep(args) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
   }
+  if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
+    console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
+    console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
+    console.error(`  wrong on our side rather than yours — mail ${BRAND.email} and we will sort it out.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402) {
     console.error(`\n  ${C.red}No deep scans left${C.off} ${C.d}(${r.data?.used}/${r.data?.limit} used)${C.off}\n`);
     process.exit(1);
@@ -127,12 +133,47 @@ async function deep(args) {
     console.log(`      ${f.detail}`);
     console.log(`      ${C.grn}Fix${C.off}  ${f.fix}\n`);
   }
+  // Printed BEFORE the report link, and before the scans-left line, because a
+  // reader who stops at the findings must still have seen this. A check that
+  // did not run is a hole in the answer, not a footnote to it.
+  const missed = r.data.incomplete || [];
+  if (missed.length) {
+    console.log(`${C.red}${C.b}${missed.length} check${missed.length === 1 ? '' : 's'} did not complete${C.off}`);
+    console.log(`  ${C.d}These are not a pass. Nothing below was ruled out.${C.off}`);
+    for (const m of missed.slice(0, 8)) {
+      console.log(`  ${C.red}~${C.off} ${C.g}${m.id.padEnd(12)}${C.off}${C.d}${(m.title || '').slice(0, 58)}${C.off}`);
+    }
+    if (missed.length > 8) console.log(`  ${C.d}and ${missed.length - 8} more${C.off}`);
+    if (r.data.coverage !== undefined) {
+      console.log(`  ${C.d}${Math.round(r.data.coverage * 100)}% of the ${r.data.rulesAsked} checks in this scan answered.${C.off}`);
+    }
+    if (r.data.refunded) {
+      console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
+    }
+    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+  }
+
   if (r.data.report?.url) {
     console.log(`${C.b}Your report${C.off}`);
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
+
+  // --fail-on <severity>: the CI gate, same contract as the free scan. The
+  // human report above has fully printed; the pipeline now gets its verdict.
+  // A scan with holes trips the gate too — a check that did not run has not
+  // passed, and a gate that shrugs at that is a gate that waves through the
+  // exact case it exists for.
+  const failOn = args[args.indexOf('--fail-on') + 1];
+  if (args.includes('--fail-on')) {
+    if (!(failOn in rank) && failOn !== 'any') {
+      console.error('  --fail-on must be one of: critical, high, medium, low, any');
+      process.exit(2);
+    }
+    const limit = failOn === 'any' ? 3 : rank[failOn];
+    if (findings.some(f => rank[f.severity] <= limit) || missed.length) process.exit(1);
+  }
 }
 
 function help() {
@@ -145,8 +186,10 @@ ${C.b}${BRAND.name}${C.off} ${C.d}${BRAND.tagline}${C.off}
   ${C.b}npx ${BRAND.slug} logout${C.off}           forget the key
   ${C.b}npx ${BRAND.slug} deep${C.off} ${C.d}[path]${C.off}     the paid scan — asks before sending anything
 
-  ${C.d}--yes${C.off}   skip the upload confirmation ${C.d}(for CI)${C.off}
-  ${C.d}--json${C.off}  machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--yes${C.off}              skip the upload confirmation ${C.d}(for CI)${C.off}
+  ${C.d}--json${C.off}             machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--fail-on${C.off} ${C.d}<sev>${C.off}    exit 1 if findings reach this severity — fails a CI build
+                     ${C.d}critical | high | medium | low | any${C.off}
 
   ${C.d}https://${BRAND.slug}.dev${C.off}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -11,12 +11,15 @@
     "net",
     "bin",
     "scripts/verify-readonly.mjs",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs"
+    "test": "node test/run.mjs && node test/gate.mjs",
+    "prepack": "node scripts/prepare-publish.mjs",
+    "postpack": "node scripts/restore-after-publish.mjs"
   },
   "keywords": [
     "security",
@@ -29,13 +32,11 @@
     "checklist"
   ],
   "homepage": "https://launchprep.dev",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/312labs/launchprep-app.git",
-    "directory": "cli"
-  },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "engines": {
     "node": ">=18"
+  },
+  "bugs": {
+    "email": "hello@launchprep.dev"
   }
 }

package/src/index.mjs

@@ -5,9 +5,38 @@ import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
 import { runChecks, runRootChecks } from './checks.mjs';
 import { render } from './report.mjs';
+import { existsSync, statSync } from 'node:fs';
 
-const target = process.argv[2] || process.cwd();
-const asJson = process.argv.includes('--json');
+const args = process.argv.slice(2);
+const target = args.find(a => !a.startsWith('-')) || process.cwd();
+const asJson = args.includes('--json');
+
+// --fail-on <severity>: the CI gate. Findings at or above the threshold turn
+// the exit code to 1 so a pipeline can stop the deploy. Opt-in on purpose —
+// a person reading the report in a terminal gets information, a robot gets a
+// verdict only when asked for one.
+const RANK_GATE = { critical: 0, high: 1, medium: 2, low: 3, any: 3 };
+let failOn = null;
+{
+  const i = args.indexOf('--fail-on');
+  if (i !== -1) {
+    failOn = args[i + 1];
+    if (!(failOn in RANK_GATE)) {
+      process.stderr.write(`\n  --fail-on must be one of: critical, high, medium, low, any\n\n`);
+      process.exit(2);
+    }
+  }
+}
+
+// A path that does not exist must be a loud error, never a clean report. A
+// scan of nothing looks exactly like a scan that found nothing, and telling
+// someone they are safe because they mistyped a folder name is the one thing
+// this tool must never do.
+if (!existsSync(target) || !statSync(target).isDirectory()) {
+  process.stderr.write(`\n  \x1b[31mThat path does not exist: ${target}\x1b[0m\n`);
+  process.stderr.write(`  \x1b[2mNothing was scanned. Check the folder name and run it again.\x1b[0m\n\n`);
+  process.exit(2);
+}
 
 const repo = scanRepo(target, { maxFiles: 12000 });
 const packages = splitWorkspaces(repo);
@@ -69,3 +98,9 @@ if (asJson) {
 } else {
   process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
 }
+
+// The gate, after the full report has printed: the human still sees
+// everything, and the pipeline sees the verdict it asked for.
+if (failOn && findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
+  process.exit(1);
+}