launchprep 0.5.1 → 0.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs && node test/interactive.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/checks-auth.mjs

@@ -115,11 +115,25 @@ export const AUTH_CHECKS = [
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path)) continue;
-      const re = /createHash\s*\(\s*['"](md5|sha1|sha256|sha512)['"]\)/g;
+      const re = /createHash\s*\(\s*['"](md5|sha1|sha256|sha512)['"]\)\s*\.update\s*\(\s*([A-Za-z0-9_$.]+)?/g;
       let m;
       while ((m = re.exec(f.text))) {
-        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 400);
-        if (!/password|passwd|\bpwd\b|credential/i.test(around)) continue;
+        // Judge what is being HASHED, not a 400-char neighbourhood. On real
+        // code this fired CRITICAL on `hashToken(raw){ createHash('sha256')
+        // .update(raw) }` because the word "password" appeared elsewhere in the
+        // file (a password-policy import). sha256 on a high-entropy token - a
+        // reset token, a session token, a CSRF value - is correct; on a user's
+        // password it is the vulnerability. The thing being hashed decides.
+        const arg = m[2] || '';
+        const TOKEN = /token|csrf|nonce|otp|session|reset|verif|magic|digest|\braw\b|hmac|signature|fingerprint|etag|checksum|api[_-]?key/i;
+        const PASS  = /password|passwd|\bpwd\b|\bpass\b/i;
+        if (TOKEN.test(arg)) continue;                    // hashing a token, not a password
+        const ctx = f.text.slice(Math.max(0, m.index - 200), m.index + 80);
+        const ctxToken = /token|csrf|nonce|\botp\b|session|reset|verif|magic|fingerprint/i.test(ctx);
+        const ctxPass  = /password|passwd|\bpwd\b/i.test(ctx);
+        // fire only when a password is what is hashed here: the argument names
+        // it, or the immediate surroundings do and are not about a token.
+        if (!(PASS.test(arg) || (ctxPass && !ctxToken))) continue;
         out.push(finding('AUTH-008', `Passwords hashed with ${m[1]}`, 'critical',
           f.path, lineOf(f.text, m.index),
           `${m[1]} is built to be fast, which is exactly wrong for passwords — a modern GPU tries billions of guesses per second. If your database leaks, the passwords are recoverable.`,

package/src/index.mjs

@@ -5,11 +5,17 @@ import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
 import { runChecks, runRootChecks, CHECKS } from './checks.mjs';
 import { render } from './report.mjs';
+import { askQuestions, confirm } from './interactive.mjs';
+import { questionFor } from './questions.mjs';
 import { existsSync, statSync } from 'node:fs';
 
 const args = process.argv.slice(2);
 const target = args.find(a => !a.startsWith('-')) || process.cwd();
 const asJson = args.includes('--json');
+// Opt out of the terminal Q&A: --yes (take defaults, ask nothing) or the
+// explicit --no-interactive. It is also skipped automatically when there is no
+// TTY, so a pipe or a CI job never blocks waiting on a keypress.
+const noInteractive = args.includes('--yes') || args.includes('--no-interactive');
 
 // --fail-on <severity>: the CI gate. Findings at or above the threshold turn
 // the exit code to 1 so a pipeline can stop the deploy. Opt-in on purpose —
@@ -45,12 +51,10 @@ const packages = splitWorkspaces(repo);
 //
 // The scanner works most things out from the code, but some facts are simply
 // not in the code — where the users live, whether the AI is allowed to act,
-// how many people are expected. Those checks were skipped and the report said
-// "Correct it and the checks adjust", which was false: there was no way to
-// correct anything. This is that way.
-//
-// Reading a file the user wrote is still read-only. Nothing is written.
-const stated = (() => {
+// how many people are expected. Those come either from a launchprep.json the
+// user wrote, or from the terminal Q&A below. Reading a file the user wrote is
+// still read-only, and the Q&A only reads the keyboard: nothing is written.
+const fileStated = (() => {
   const raw = repo.read('launchprep.json');
   if (raw === null) return null;
   try {
@@ -67,7 +71,7 @@ const stated = (() => {
 
 // Merge one level deep so { "stack": { "auth": "clerk" } } overrides only auth
 // and leaves the detected framework and database alone.
-const applyStated = (profile) => {
+const applyStated = (profile, stated) => {
   if (!stated) return profile;
   const out = { ...profile };
   for (const [k, v] of Object.entries(stated)) {
@@ -78,77 +82,137 @@ const applyStated = (profile) => {
   return out;
 };
 
-// Profile and gate every app in the repo. Libraries are profiled too - they
-// simply match very few rules, which is the correct outcome, not a bug.
-const scanned = packages.map(w => {
-  const full = detectProfile(w.view, { root: repo });
-  const profile = applyStated(toGateProfile(full));
-  const g = gate(profile);
-  const applicableIds = new Set(g.evaluated.map(r => r.id));
-  const findings = runChecks(w.view, profile, applicableIds)
-    .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
-  return { name: w.name, full, profile, gate: g, findings };
-});
-
-// The app most representative of this repo leads the report.
-const apps = scanned.filter(s => s.profile.surface !== 'library');
-const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
-
-// Root-scoped checks see the whole repo, once, regardless of how many
-// workspaces it contains. Gated by the lead app's profile.
-const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
-const rootFindings = runRootChecks(repo, lead.profile, rootIds);
-
-const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
-const seen = new Set();
-// Each workspace sorts its own findings, but concatenating several workspaces
-// and the root-scoped checks destroys that order - a monorepo would show a LOW
-// from apps/web above a CRITICAL from apps/api. Sort once, at the end.
 const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
-const findings = allFindings
-  .filter(f => {
-    const k = `${f.id}:${f.file}:${f.line}`;
-    if (seen.has(k)) return false;
-    seen.add(k); return true;
-  })
-  .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
-
-// Eleven tier-2 rules have a cheap static approximation that ships free. When
-// one of those finds nothing that is NOT a pass - a pattern cannot see an
-// ownership check that lives in middleware. Reporting it as clean would tell
-// someone they are safe when the check simply could not look. Say so instead.
-const firedIds = new Set(findings.map(f => f.id));
-const shallow = lead.gate.evaluated
-  .filter(r => r.has_static_approximation && !firedIds.has(r.id));
-
-const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
-
-// "51 checks apply to this app" counted 17 that nothing examined — tier-2 rules
-// that need the deep scan. Counting them as applying is a silent pass on a
-// third of the headline number, which is the one thing this scanner must never
-// do. It also threw away the sentence that sells the paid tier: those 17 are
-// not a gap, they are the product.
 const implemented = new Set(CHECKS.map(c => c.id));
-const coverage = {
-  ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
-  needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
-};
+const keyOf = (f) => `${f.id}:${f.file}:${f.line}`;
+
+// One scan pass, given whatever the user has stated so far. Called once for the
+// initial report and again after the terminal Q&A, so the answers can unlock
+// more checks without asking the user to touch a file.
+function analyze(stated) {
+  // Profile and gate every app in the repo. Libraries are profiled too - they
+  // simply match very few rules, which is the correct outcome, not a bug.
+  const scanned = packages.map(w => {
+    const full = detectProfile(w.view, { root: repo });
+    const profile = applyStated(toGateProfile(full), stated);
+    const g = gate(profile);
+    const applicableIds = new Set(g.evaluated.map(r => r.id));
+    const findings = runChecks(w.view, profile, applicableIds)
+      .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
+    return { name: w.name, full, profile, gate: g, findings };
+  });
+
+  // The app most representative of this repo leads the report.
+  const apps = scanned.filter(s => s.profile.surface !== 'library');
+  const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
+
+  // Root-scoped checks see the whole repo, once, regardless of how many
+  // workspaces it contains. Gated by the lead app's profile.
+  const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
+  const rootFindings = runRootChecks(repo, lead.profile, rootIds);
+
+  const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
+  const seen = new Set();
+  // Concatenating several workspaces and the root-scoped checks destroys each
+  // one's own order - a monorepo would show a LOW from apps/web above a
+  // CRITICAL from apps/api. Sort once, at the end.
+  const findings = allFindings
+    .filter(f => { const k = keyOf(f); if (seen.has(k)) return false; seen.add(k); return true; })
+    .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+
+  // Eleven tier-2 rules have a cheap static approximation that ships free. When
+  // one of those finds nothing that is NOT a pass - a pattern cannot see an
+  // ownership check that lives in middleware. Reporting it as clean would tell
+  // someone they are safe when the check simply could not look. Say so instead.
+  const firedIds = new Set(findings.map(f => f.id));
+  const shallow = lead.gate.evaluated.filter(r => r.has_static_approximation && !firedIds.has(r.id));
+
+  const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
+
+  // "51 checks apply" counted tier-2 rules that nothing examined - a silent pass
+  // on a third of the headline number. Split them: what actually ran, and what
+  // still needs the deep scan (which is the product, not a gap).
+  const coverage = {
+    ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
+    needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
+  };
+
+  return { scanned, lead, findings, shallow, questions, coverage };
+}
+
+let stated = fileStated;
+let r = analyze(stated);
 
 if (asJson) {
   console.log(JSON.stringify({
-    packages: scanned.map(s => ({
+    packages: r.scanned.map(s => ({
       name: s.name, profile: s.profile,
       evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
     })),
-    findings, questions, coverage, stated,
-    shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
+    findings: r.findings, questions: r.questions, coverage: r.coverage, stated,
+    shallow: r.shallow.map(s => ({ id: s.id, title: s.title, severity: s.severity })),
   }, null, 2));
 } else {
-  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow, coverage, stated }));
+  process.stdout.write(render({ repo: target, ...r, stated }));
+
+  // The Q&A. Only in a real terminal, only when there is something to unlock,
+  // and never when the caller opted out - so a pipe, --json or a CI job is
+  // untouched. Answers are held in memory and merged; no file is written.
+  if (!noInteractive && process.stdin.isTTY && process.stdout.isTTY && r.questions.length) {
+    const unlocks = r.questions.reduce((n, [, c]) => n + c, 0);
+    const yes = await confirm(
+      `\n  \x1b[36mAnswer ${r.questions.length} quick question${r.questions.length === 1 ? '' : 's'}` +
+      ` to unlock up to ${unlocks} more checks?\x1b[0m \x1b[2m[Y/n]\x1b[0m `);
+    if (yes) {
+      const answers = await askQuestions(r.questions.map(([fact]) => fact));
+      if (Object.keys(answers).length) {
+        const before = new Set(r.findings.map(keyOf));
+        const ranBefore = r.coverage.ran;
+        stated = { ...(fileStated || {}), ...answers };
+        r = analyze(stated);
+        const fresh = r.findings.filter(f => !before.has(keyOf(f)));
+        printDelta(fresh, r.coverage.ran - ranBefore);
+      } else {
+        process.stdout.write(`\n  \x1b[2mNothing answered — the report above is unchanged.\x1b[0m\n\n`);
+      }
+    }
+  }
 }
 
-// The gate, after the full report has printed: the human still sees
-// everything, and the pipeline sees the verdict it asked for.
-if (failOn && findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
+// The gate, after everything has printed: the human sees the whole report, the
+// pipeline sees the verdict it asked for. Uses the final findings, so an answer
+// that unlocked a critical still fails the build.
+if (failOn && r.findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
   process.exit(1);
 }
+
+// The extra findings the answers unlocked, grouped the same way the main report
+// groups: one line per rule with a count, so a check that fired on many files
+// does not bury the rest.
+function printDelta(fresh, moreRan) {
+  const C = { d: '\x1b[2m', b: '\x1b[1m', o: '\x1b[0m', grn: '\x1b[32m', gry: '\x1b[90m' };
+  const SEV = { critical: '\x1b[31m', high: '\x1b[33m', medium: '\x1b[34m', low: '\x1b[90m' };
+  const p = (s = '') => process.stdout.write(s + '\n');
+
+  p(`\n  ${C.grn}${moreRan} more check${moreRan === 1 ? '' : 's'} ran with your answers.${C.o}`);
+  if (!fresh.length) {
+    p(`  ${C.d}They all passed — nothing new to fix.${C.o}\n`);
+    return;
+  }
+  const groups = [];
+  const byId = new Map();
+  for (const f of fresh) {
+    if (byId.has(f.id)) byId.get(f.id).push(f);
+    else { const arr = [f]; byId.set(f.id, arr); groups.push(arr); }
+  }
+  p(`  ${C.d}${fresh.length} new finding${fresh.length === 1 ? '' : 's'}:${C.o}`);
+  for (const g of groups) {
+    const f = g[0];
+    const more = g.length - 1;
+    p(`\n  ${SEV[f.severity]}${C.b}${f.severity.toUpperCase()}${C.o}  ${f.title}${more ? `${C.d}  · ${g.length} places${C.o}` : ''}`);
+    p(`  ${C.gry}${f.file}:${f.line}${C.o}`);
+    p(`      ${f.detail}`);
+    p(`      ${C.grn}Fix${C.o}  ${f.fix}`);
+  }
+  p('');
+}

package/src/interactive.mjs

@@ -0,0 +1,100 @@
+// The optional questions, asked in the terminal instead of made into homework.
+//
+// The report ends with "put these in launchprep.json and run again" - which
+// means writing JSON with keys like "llm_tools_enabled" before the extra checks
+// unlock. For a one-off scan that is friction most people will not pay. This
+// asks the same questions out loud, takes a number or a word, and re-runs with
+// the answers held in memory.
+//
+// READ-ONLY, deliberately. It reads the keyboard and nothing else: no file is
+// written, so launchprep.json is never created behind the user's back and the
+// read-only promise holds. Power users who want the answers saved for CI still
+// write the file themselves - that path is unchanged.
+
+import { createInterface } from 'node:readline';
+import { questionFor } from './questions.mjs';
+
+const C = { d: '\x1b[2m', b: '\x1b[1m', o: '\x1b[0m', c: '\x1b[36m', g: '\x1b[32m' };
+
+// Turn a QUESTION's `answer` example - the exact JSON a user would paste - into
+// the shape of the question: which key it sets, whether it is a yes/no or a
+// choice, and (for a choice) the options. Parsing the example rather than
+// duplicating it keeps one source of truth: questions.mjs.
+export function shapeOf(answerExample) {
+  const dash = answerExample.indexOf('—');
+  const json = (dash >= 0 ? answerExample.slice(0, dash) : answerExample).trim();
+  const rest = dash >= 0 ? answerExample.slice(dash + 1).trim() : '';
+
+  const nested  = json.match(/"([\w-]+)"\s*:\s*\{\s*"([\w-]+)"/);   // "stack": { "auth": ... }
+  const topKey  = json.match(/^"([\w-]+)"/)?.[1] || null;
+  const isArray = /:\s*\[/.test(json);
+  const isBool  = !nested && /:\s*(true|false)\s*$/.test(json) && !rest;
+
+  const choices = isBool
+    ? ['yes', 'no']
+    : rest.replace(/^any of:\s*/i, '').split(',').map(s => s.trim()).filter(Boolean);
+
+  // Fold the chosen value into a stated-shaped object, matching whatever the
+  // example demonstrated: nested (stack.auth), array (jurisdictions), boolean
+  // (has_rag), or a plain string (business_model).
+  const apply = (stated, value) => {
+    if (nested) stated[nested[1]] = { ...(stated[nested[1]] || {}), [nested[2]]: value };
+    else if (isArray) stated[topKey] = [value];
+    else if (isBool)  stated[topKey] = (value === 'yes' || value === true);
+    else stated[topKey] = value;
+    return stated;
+  };
+
+  return { choices, isBool, apply, ok: Boolean(topKey && choices.length) };
+}
+
+const rlQuestion = (rl, q) => new Promise(res => rl.question(q, res));
+
+// Ask up to `facts` in the terminal. Returns a stated-shaped object of the
+// answers given; an empty object if the user answered nothing.
+export async function askQuestions(facts, { input = process.stdin, output = process.stdout, readLine } = {}) {
+  const rl = readLine ? null : createInterface({ input, output });
+  const ask = readLine || ((prompt) => new Promise(res => rl.question(prompt, res)));
+  const stated = {};
+  try {
+    for (const fact of facts) {
+      const q = questionFor(fact);
+      if (!q) continue;
+      const shape = shapeOf(q.answer);
+      if (!shape.ok) continue;
+
+      output.write(`\n  ${C.c}${q.ask}${C.o}\n`);
+      const numbered = shape.choices.map((c, i) => `${C.d}${i + 1})${C.o} ${c}`).join('   ');
+      output.write(`    ${numbered}\n`);
+
+      // Accept a number, the literal value, or blank to skip. Re-ask on garbage
+      // rather than silently dropping it - a wrong answer the user thinks landed
+      // is worse than being asked again.
+      let value = null;
+      while (value === null) {
+        const raw = (await ask(`  ${C.b}›${C.o} `)).trim().toLowerCase();
+        if (raw === '') break;                                  // skip this one
+        const n = Number(raw);
+        if (Number.isInteger(n) && n >= 1 && n <= shape.choices.length) value = shape.choices[n - 1];
+        else if (shape.choices.includes(raw)) value = raw;
+        else output.write(`  ${C.d}pick a number 1–${shape.choices.length}, or press Enter to skip${C.o}\n`);
+      }
+      if (value !== null) shape.apply(stated, value);
+    }
+  } finally {
+    rl?.close();
+  }
+  return stated;
+}
+
+// The yes/no gate before any of it. Returns true only on an explicit yes.
+export async function confirm(prompt, { input = process.stdin, output = process.stdout, readLine } = {}) {
+  const rl = readLine ? null : createInterface({ input, output });
+  const ask = readLine || ((q) => new Promise(res => rl.question(q, res)));
+  try {
+    const raw = (await ask(prompt)).trim().toLowerCase();
+    return raw === '' || raw === 'y' || raw === 'yes';        // default yes
+  } finally {
+    rl?.close();
+  }
+}

package/src/report.mjs

@@ -65,14 +65,34 @@ export function render({ repo, scanned, lead, findings, questions, shallow = [],
     const summary = ['critical', 'high', 'medium', 'low']
       .filter(k => counts[k]).map(k => `${counts[k]} ${k}`).join(' · ');
     p(`  ${C.dim}${summary}${C.off}`);
-    for (const f of findings.slice(0, 25)) {
+
+    // Group by rule. One check firing on 43 tables is ONE issue in 43 places,
+    // not 43 issues - listing each pushed the genuinely distinct findings off
+    // the bottom into "and N more", the drowning this tool exists to avoid.
+    // Findings arrive severity-sorted, so first-seen order keeps that order.
+    const groups = [];
+    const byId = new Map();
+    for (const f of findings) {
+      if (byId.has(f.id)) byId.get(f.id).push(f);
+      else { const arr = [f]; byId.set(f.id, arr); groups.push(arr); }
+    }
+    if (groups.length < findings.length)
+      p(`  ${C.dim}${groups.length} distinct, across ${findings.length} places${C.off}`);
+
+    for (const g of groups.slice(0, 25)) {
+      const f = g[0];
       const [col, label] = SEV[f.severity];
-      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}`);
+      const more = g.length - 1;
+      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}${more ? `${C.dim}  · ${g.length} places${C.off}` : ''}`);
       p(`  ${C.gry}${f.file}:${f.line}${C.off}`);
+      if (more) {
+        const also = g.slice(1, 4).map(x => `${x.file}:${x.line}`).join('  ');
+        p(`  ${C.dim}${also}${more > 3 ? `  + ${more - 3} more` : ''}${C.off}`);
+      }
       p(`      ${f.detail}`);
       p(`      ${C.grn}Fix${C.off}  ${f.fix}`);
     }
-    if (findings.length > 25) p(`\n  ${C.dim}… and ${findings.length - 25} more${C.off}`);
+    if (groups.length > 25) p(`\n  ${C.dim}… and ${groups.length - 25} more issues${C.off}`);
   }
 
   // ---------- checked, but only as far as a program can see ----------