launchprep 0.2.0 → 0.4.0

package/LICENSE

@@ -0,0 +1,31 @@
+Launchprep Licence
+
+Copyright (c) 2026 Bc. Bektur Aibekov, IČO 29522471, Prague, Czech Republic.
+All rights reserved.
+
+You may:
+
+  1. Install and run this software to scan source code that you own or are
+     authorised to scan.
+  2. Make copies as reasonably necessary for that use (for example, inside a
+     CI pipeline or a container image you operate).
+
+You may not:
+
+  3. Copy, redistribute, sublicense, sell, or publish this software or any
+     part of it, including the rule and check definitions it contains.
+  4. Extract, reproduce, or adapt the rule and check definitions for use in
+     any other product or service, commercial or not.
+  5. Remove or alter this notice.
+
+Versions 0.1.0 and 0.2.0 of the "launchprep" npm package were published under
+the MIT licence; that grant stands for those versions. This licence applies to
+this version and all later ones.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE. Findings are produced
+by automated analysis and may be incomplete or wrong; they are information,
+not a guarantee of security or fitness for launch.
+
+Questions and permissions: hello@launchprep.dev

package/README.md

@@ -13,7 +13,7 @@ No signup. No dashboard. Nothing added to your repo.
 
 ## What it does
 
-288 checks — but it works out what you built **before** running any of them, so
+289 checks — but it works out what you built **before** running any of them, so
 you are not told about problems you cannot have. A static site is asked 48
 questions; a multi-tenant SaaS with payments and AI is asked 158.
 
@@ -69,6 +69,19 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## In CI
+
+```bash
+npx launchprep . --fail-on critical         # exit 1 if a critical is found
+npx launchprep deep . --yes --fail-on high  # the paid scan as a gate
+```
+
+Without `--fail-on` the exit code stays 0 — a report, not a verdict. With it,
+findings at or above the threshold (`critical`, `high`, `medium`, `low`, `any`)
+fail the build. On a deep scan, checks that did not complete fail it too — a
+check that could not run has not passed. A path that does not exist always
+exits 2: a scan of nothing must never look like a clean scan of something.
+
 ## Free and paid
 
 Everything above is free, unlimited, forever — every check a program can make on
@@ -81,4 +94,6 @@ delete. See <https://launchprep.dev>.
 
 ## Licence
 
-MIT
+Proprietary — see the LICENSE file. Run it on anything you are authorised to
+scan; the rules and checks may not be copied into other products. Versions
+0.1.0 and 0.2.0 were published under MIT and remain so.

package/net/commands.mjs

@@ -99,6 +99,12 @@ async function deep(args) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
   }
+  if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
+    console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
+    console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
+    console.error(`  wrong on our side rather than yours — mail ${BRAND.email} and we will sort it out.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402) {
     console.error(`\n  ${C.red}No deep scans left${C.off} ${C.d}(${r.data?.used}/${r.data?.limit} used)${C.off}\n`);
     process.exit(1);
@@ -127,12 +133,47 @@ async function deep(args) {
     console.log(`      ${f.detail}`);
     console.log(`      ${C.grn}Fix${C.off}  ${f.fix}\n`);
   }
+  // Printed BEFORE the report link, and before the scans-left line, because a
+  // reader who stops at the findings must still have seen this. A check that
+  // did not run is a hole in the answer, not a footnote to it.
+  const missed = r.data.incomplete || [];
+  if (missed.length) {
+    console.log(`${C.red}${C.b}${missed.length} check${missed.length === 1 ? '' : 's'} did not complete${C.off}`);
+    console.log(`  ${C.d}These are not a pass. Nothing below was ruled out.${C.off}`);
+    for (const m of missed.slice(0, 8)) {
+      console.log(`  ${C.red}~${C.off} ${C.g}${m.id.padEnd(12)}${C.off}${C.d}${(m.title || '').slice(0, 58)}${C.off}`);
+    }
+    if (missed.length > 8) console.log(`  ${C.d}and ${missed.length - 8} more${C.off}`);
+    if (r.data.coverage !== undefined) {
+      console.log(`  ${C.d}${Math.round(r.data.coverage * 100)}% of the ${r.data.rulesAsked} checks in this scan answered.${C.off}`);
+    }
+    if (r.data.refunded) {
+      console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
+    }
+    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+  }
+
   if (r.data.report?.url) {
     console.log(`${C.b}Your report${C.off}`);
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
+
+  // --fail-on <severity>: the CI gate, same contract as the free scan. The
+  // human report above has fully printed; the pipeline now gets its verdict.
+  // A scan with holes trips the gate too — a check that did not run has not
+  // passed, and a gate that shrugs at that is a gate that waves through the
+  // exact case it exists for.
+  const failOn = args[args.indexOf('--fail-on') + 1];
+  if (args.includes('--fail-on')) {
+    if (!(failOn in rank) && failOn !== 'any') {
+      console.error('  --fail-on must be one of: critical, high, medium, low, any');
+      process.exit(2);
+    }
+    const limit = failOn === 'any' ? 3 : rank[failOn];
+    if (findings.some(f => rank[f.severity] <= limit) || missed.length) process.exit(1);
+  }
 }
 
 function help() {
@@ -145,8 +186,10 @@ ${C.b}${BRAND.name}${C.off} ${C.d}${BRAND.tagline}${C.off}
   ${C.b}npx ${BRAND.slug} logout${C.off}           forget the key
   ${C.b}npx ${BRAND.slug} deep${C.off} ${C.d}[path]${C.off}     the paid scan — asks before sending anything
 
-  ${C.d}--yes${C.off}   skip the upload confirmation ${C.d}(for CI)${C.off}
-  ${C.d}--json${C.off}  machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--yes${C.off}              skip the upload confirmation ${C.d}(for CI)${C.off}
+  ${C.d}--json${C.off}             machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--fail-on${C.off} ${C.d}<sev>${C.off}    exit 1 if findings reach this severity — fails a CI build
+                     ${C.d}critical | high | medium | low | any${C.off}
 
   ${C.d}https://${BRAND.slug}.dev${C.off}
 `);

package/net/consent.mjs

@@ -21,6 +21,11 @@ export async function confirmUpload({ digest, host, assumeYes = false, showFiles
   console.log(`\n${C.b}Before this runs${C.off}\n`);
   console.log(`  This sends ${C.b}${files} files${C.off} of your code ${C.d}(about ${tokens} tokens)${C.off}`);
   console.log(`  to ${C.b}${host}${C.off}, and from there to Anthropic, so a model can read them.\n`);
+  if (digest.secretsRedacted > 0) {
+    console.log(`  ${C.g}${digest.secretsRedacted} secret${digest.secretsRedacted === 1 ? '' : 's'} masked before sending${C.off} — keys, passwords, tokens and`);
+    console.log(`  the rows of any database dump are replaced on this machine, so their`);
+    console.log(`  values never leave it. Only that they existed, and where, is sent.\n`);
+  }
   console.log(`  ${C.g}Your code is not stored.${C.off} It is held in memory for the scan and discarded.`);
   console.log(`  ${C.g}The findings are kept${C.off} — file names, line numbers, and what to fix —`);
   console.log(`  so the report link keeps working. That link expires.\n`);

package/package.json

@@ -1,22 +1,25 @@
 {
   "name": "launchprep",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
-    "launchprep": "./bin/launchprep.mjs"
+    "launchprep": "bin/launchprep.mjs"
   },
   "files": [
     "src",
     "net",
     "bin",
     "scripts/verify-readonly.mjs",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs"
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs",
+    "prepack": "node scripts/prepare-publish.mjs",
+    "postpack": "node scripts/restore-after-publish.mjs"
   },
   "keywords": [
     "security",
@@ -29,13 +32,11 @@
     "checklist"
   ],
   "homepage": "https://launchprep.dev",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/312labs/launchprep-app.git",
-    "directory": "cli"
-  },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "engines": {
     "node": ">=18"
+  },
+  "bugs": {
+    "email": "hello@launchprep.dev"
   }
 }

package/src/digest.mjs

@@ -1,3 +1,5 @@
+import { redact } from './redact.mjs';
+
 // Build the block of code the model reads.
 //
 // This is the single most expensive decision in the product. Every token here
@@ -128,9 +130,15 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
   const omitted = [];
   const spentByKind = {};
   let tokens = 0;
+  let secretsRedacted = 0;
 
   const take = (f, respectShare) => {
-    let body = f.text;
+    // Scrub secret values on this machine, before the file can enter the
+    // payload. A masked secret never leaves the user's disk. Done here rather
+    // than at read time so the free scan — which reads the same files but sends
+    // nothing — pays nothing for it.
+    const scrubbed = redact(f.text, f.path);
+    let body = scrubbed.text;
     let truncated = false;
     if (body.length > MAX_FILE_CHARS) { body = body.slice(0, MAX_FILE_CHARS); truncated = true; }
     const block = `\n──── ${f.path}${truncated ? '  [truncated]' : ''}\n${body}\n`;
@@ -144,6 +152,7 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
     included.push({ path: f.path, kind: f.kind, tokens: cost });
     spentByKind[f.kind] = (spentByKind[f.kind] || 0) + cost;
     tokens += cost;
+    secretsRedacted += scrubbed.count;
     return true;
   };
 
@@ -157,6 +166,9 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
     tokens,
     included,
     omitted,
+    // How many secret values were masked before anything left the machine.
+    // Surfaced on the consent screen so the promise is visible, not just made.
+    secretsRedacted,
     // what the model must be told it cannot see, or it will reason as though
     // the absence of an ownership check is proof there isn't one
     coverage: {

package/src/index.mjs

@@ -5,9 +5,38 @@ import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
 import { runChecks, runRootChecks } from './checks.mjs';
 import { render } from './report.mjs';
+import { existsSync, statSync } from 'node:fs';
 
-const target = process.argv[2] || process.cwd();
-const asJson = process.argv.includes('--json');
+const args = process.argv.slice(2);
+const target = args.find(a => !a.startsWith('-')) || process.cwd();
+const asJson = args.includes('--json');
+
+// --fail-on <severity>: the CI gate. Findings at or above the threshold turn
+// the exit code to 1 so a pipeline can stop the deploy. Opt-in on purpose —
+// a person reading the report in a terminal gets information, a robot gets a
+// verdict only when asked for one.
+const RANK_GATE = { critical: 0, high: 1, medium: 2, low: 3, any: 3 };
+let failOn = null;
+{
+  const i = args.indexOf('--fail-on');
+  if (i !== -1) {
+    failOn = args[i + 1];
+    if (!(failOn in RANK_GATE)) {
+      process.stderr.write(`\n  --fail-on must be one of: critical, high, medium, low, any\n\n`);
+      process.exit(2);
+    }
+  }
+}
+
+// A path that does not exist must be a loud error, never a clean report. A
+// scan of nothing looks exactly like a scan that found nothing, and telling
+// someone they are safe because they mistyped a folder name is the one thing
+// this tool must never do.
+if (!existsSync(target) || !statSync(target).isDirectory()) {
+  process.stderr.write(`\n  \x1b[31mThat path does not exist: ${target}\x1b[0m\n`);
+  process.stderr.write(`  \x1b[2mNothing was scanned. Check the folder name and run it again.\x1b[0m\n\n`);
+  process.exit(2);
+}
 
 const repo = scanRepo(target, { maxFiles: 12000 });
 const packages = splitWorkspaces(repo);
@@ -69,3 +98,9 @@ if (asJson) {
 } else {
   process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
 }
+
+// The gate, after the full report has printed: the human still sees
+// everything, and the pipeline sees the verdict it asked for.
+if (failOn && findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
+  process.exit(1);
+}

package/src/redact.mjs

@@ -0,0 +1,127 @@
+// Strip secret VALUES out of a file before it is ever put in the upload digest.
+//
+// The deep scan sends a digest of the user's code to our server and on to
+// Anthropic. The privacy page promises credentials are never transmitted, and
+// until this module existed that promise was false: a backup.sql full of card
+// numbers, a docker-compose.yml with a plaintext password, or a key hardcoded
+// in source went up verbatim. Only .env was excluded.
+//
+// This runs in the CLI, on the user's machine, BEFORE anything leaves it — so a
+// masked secret never travels at all, not even to us. That is the only correct
+// place for it; redacting server-side would mean the secret already left.
+//
+// The rule of thumb is the inverse of the scanner's. The scanner must not cry
+// wolf, so it needs evidence before it fires. Redaction is the opposite: a
+// masked non-secret costs a little context, a leaked real secret is the whole
+// failure. So this leans aggressive on things SHAPED like secrets, and only
+// holds back where masking would destroy code the scan genuinely needs — a
+// reference like `process.env.STRIPE_KEY` is good code, not a leak, and stays.
+//
+// What the tier-2 rules ask about — authorization, tenancy, deletion, spend —
+// is never answered by the literal value of a key or a row of customer data, so
+// nothing here reduces what the scan can find.
+
+const TAG = (kind) => `«redacted:${kind}»`;
+
+// 1. PEM private-key blocks — the whole block, header to footer.
+const PEM = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g;
+
+// 2. Credentials embedded in a connection URL: scheme://user:pass@host.
+//    Keep the scheme and host (useful shape), mask only user:pass.
+const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+
+// 3. Provider keys by their published shape. pk_ (Stripe publishable) is left
+//    alone on purpose — it is designed to be public, and masking it was one of
+//    the original false positives this whole product learned from.
+const SHAPES = [
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}/g,               'stripe-key'],
+  [/\bwhsec_[A-Za-z0-9]{20,}/g,                                 'webhook-secret'],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}/g,                              'anthropic-key'],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g,                        'openai-key'],
+  [/\bAKIA[0-9A-Z]{16}\b/g,                                     'aws-access-key'],
+  [/\bASIA[0-9A-Z]{16}\b/g,                                     'aws-temp-key'],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g,                                'google-key'],
+  [/\bya29\.[0-9A-Za-z_-]{20,}/g,                               'google-oauth'],
+  [/\bgh[pousr]_[A-Za-z0-9]{36,}/g,                             'github-token'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g,                               'gitlab-token'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}/g,                           'slack-token'],
+  [/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,             'sendgrid-key'],
+  [/\bre_[A-Za-z0-9_-]{20,}/g,                                  'resend-key'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, 'jwt'],
+];
+
+// 4. A value assigned to a secret-NAMED identifier. This catches the passwords
+//    and tokens that have no distinctive shape. It fires only on string
+//    literals, and holds back where the value is plainly not a secret: an env
+//    reference, a template placeholder, an interpolation, an empty string.
+const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
+const ASSIGN = new RegExp(
+  '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)(["\'`])([^"\'`\\n]{6,}?)\\2',
+  'gi',
+);
+// values that are NOT secrets even though the key name matched
+const NOT_A_SECRET = /^(?:process\.env|import\.meta|os\.environ|ENV\[|Deno\.env|\$\{|\$[A-Z(]|<[A-Za-z%{]|\{\{|%[A-Za-z]|your[_-]|change[_-]?me|placeholder|example|dummy|test[_-]?key|xxx+|\*{3,}|\.{3,}|null|undefined|true|false|none|n\/?a)/i;
+
+// 4b. The same, unquoted: `POSTGRES_PASSWORD: hunter2` / `DB_PASS=hunter2` /
+//     Dockerfile `ENV SECRET hunter2`. This is how .env, YAML, Dockerfiles,
+//     Terraform and .ini files carry secrets, and none of them quote. Applied
+//     ONLY to those config files — in real code a bare `password: foo` is a
+//     variable reference (foo), and masking it would delete a name the scan
+//     wants. The value runs to end of line.
+// colon or equals, spaced or not: `PASSWORD: hunter2` (yaml), `SECRET=hunter2`
+// (.env), `token = "..."` handled by the quoted rule above.
+const ASSIGN_BARE = new RegExp(
+  '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)([^\\s"\'`#][^\\n#]*?)(\\s*(?:#.*)?)$',
+  'gim',
+);
+// Dockerfile / shell: `ENV DB_PASSWORD hunter2`, `ARG API_TOKEN=hunter2`. The
+// secret word is a substring of the identifier, and the value is one token.
+const DOCKER_ENV = new RegExp(
+  '\\b(ENV|ARG|export)\\s+([A-Za-z0-9_]*' + SECRET_NAME.source + '[A-Za-z0-9_]*[\\s=]+)(["\']?)([^\\s"\']+)\\3',
+  'gi',
+);
+const CONFIGISH = /(^|\/)(\.env|.*\.env|.*\.ya?ml|.*\.tf|.*\.tfvars|.*\.toml|.*\.ini|.*\.conf|.*\.properties|Dockerfile[^/]*|.*\.dockerfile)$/i;
+
+// 5. Bulk data in a SQL dump. The schema the scan needs comes from CREATE TABLE
+//    and ALTER; the rows do not, and the rows are where the customer PII and any
+//    secret literals in a dump actually live.
+const SQL_INSERT = /(\bINSERT\s+INTO\s+[^\n(]+?)(\([^)]*\)\s*)?\bVALUES\b[\s\S]*?;/gi;
+const SQL_COPY = /(\bCOPY\s+[^\n]+?FROM\s+stdin\s*;)[\s\S]*?\n\\\.$/gim;
+
+export function redact(text, path = '') {
+  if (!text) return { text, count: 0 };
+  let count = 0;
+  const bump = (n = 1) => { count += n; };
+
+  let out = text.replace(PEM, () => (bump(), TAG('private-key')));
+
+  out = out.replace(CONN, (_, scheme) => (bump(), `${scheme}${TAG('credentials')}@`));
+
+  for (const [re, kind] of SHAPES) {
+    out = out.replace(re, () => (bump(), TAG(kind)));
+  }
+
+  out = out.replace(ASSIGN, (m, head, q, val) => {
+    if (NOT_A_SECRET.test(val)) return m;
+    bump();
+    return `${head}${q}${TAG('secret')}${q}`;
+  });
+
+  if (CONFIGISH.test(path)) {
+    out = out.replace(ASSIGN_BARE, (m, head, val, trail) => {
+      if (NOT_A_SECRET.test(val)) return m;
+      bump();
+      return `${head}${TAG('secret')}${trail}`;
+    });
+    out = out.replace(DOCKER_ENV, (m, kw, name, q, val) => {
+      if (NOT_A_SECRET.test(val)) return m;
+      bump();
+      return `${kw} ${name}${q}${TAG('secret')}${q}`;
+    });
+  }
+
+  out = out.replace(SQL_INSERT, (m, head) => (bump(), `${head}VALUES ${TAG('rows')};`));
+  out = out.replace(SQL_COPY, (_, head) => (bump(), `${head} ${TAG('rows')}\n\\.`));
+
+  return { text: out, count };
+}