launchprep 0.5.3 → 0.5.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "launchprep",
-  "version": "0.5.3",
-  "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
+  "version": "0.5.4",
+  "description": "Read-only CLI that scans your AI-built app and reports what will break before real users hit it — auth, tenant isolation, data, payments, GDPR. 117 checks run free on your machine.",
   "type": "module",
   "bin": {
     "launchprep": "bin/launchprep.mjs"
@@ -17,18 +17,26 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs && node test/interactive.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs && node test/interactive.mjs && node test/detect.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },
   "keywords": [
+    "pre-launch",
+    "launch-readiness",
     "security",
-    "audit",
-    "readiness",
-    "scanner",
-    "prelaunch",
+    "owasp",
+    "gdpr",
+    "static-analysis",
+    "code-review",
+    "vibe-coding",
+    "ai",
+    "cursor",
+    "lovable",
+    "bolt",
+    "saas",
     "cli",
-    "launch",
+    "scanner",
     "checklist"
   ],
   "homepage": "https://launchprep.dev",

package/src/checks-batch2.mjs

@@ -274,7 +274,7 @@ export const BATCH2_CHECKS = [
   }},
 
 // ---- observability & legal ----------------------------------------------
-{ id: 'OBS-001', run(repo, profile) {
+{ id: 'OBS-001', scope: 'root', run(repo, profile) {
     if (profile.stage !== 'production') return [];
     if (profile.surface === 'library') return [];
     const has = repo.grep(/@sentry|bugsnag|rollbar|honeybadger|datadog|new relic|appsignal|@opentelemetry/i,
@@ -288,7 +288,7 @@ export const BATCH2_CHECKS = [
       'Add an error reporter. Sentry\'s free tier covers a small product entirely.')];
   }},
 
-{ id: 'LEG-001', run(repo, profile) {
+{ id: 'LEG-001', scope: 'root', run(repo, profile) {
     if (profile.data_sensitivity === 'none' || !profile.is_public) return [];
     if (!profile.has_accounts) return [];   // a real product with users, not a template
     const has = repo.has(/privacy[-_]?policy|privacy\.(html|tsx|jsx|md|erb|vue)|\/privacy\//i) ||

package/src/checks-batch3.mjs

@@ -233,7 +233,7 @@ export const BATCH3_CHECKS = [
       'Set an expiry, and refresh it while the user is active.')];
   }},
 
-{ id: 'RU-010', run(repo, profile) {
+{ id: 'RU-010', scope: 'root', run(repo, profile) {
     if (!profile.is_public || profile.stage !== 'production') return [];
     if (profile.surface === 'library') return [];
     const has = repo.grep(/mailto:|support@|help@|contact@|\/contact\b/i,
@@ -313,7 +313,12 @@ export const BATCH3_CHECKS = [
       'Add og:image and twitter:image tags with a 1200x630 image.')];
   }},
 
-{ id: 'INC-004', run(repo, profile) {
+{ id: 'INC-004', scope: 'root', run(repo, profile) {
+    // scope:'root'. A security contact is ONE thing per repository - a
+    // SECURITY.md and a /.well-known/security.txt at the root. Run per
+    // workspace it fired on every package of a monorepo that has the file at
+    // the root (997 times across the corpus), because each workspace view
+    // cannot see the root. Root-scoped, it looks once, at the whole repo.
     if (!profile.is_public || profile.stage !== 'production') return [];
     if (repo.has(/security\.txt$|SECURITY\.md$/i)) return [];
     if (repo.grep(/security@/i).length) return [];

package/src/checks-batch4.mjs

@@ -294,6 +294,14 @@ export const BATCH4_CHECKS = [
         const line = lineAt(t, m.index);
         if (/console\.|logger\.|log\(|logging\.|capture|Sentry/.test(line)) continue;  // logging is right
         if (!/(res\.|Response\.json|json\(|send\(|return\s*\{|jsonify|content\s*:|message\s*:)/.test(line)) continue;
+        // The caught error must be from an AI call, not any error in a file that
+        // merely mentions an AI SDK. On real code this fired on a Wildberries
+        // connection-error handler because the module imported the AI client
+        // elsewhere. Tie the leak to an actual model call in the try block this
+        // catch belongs to, or the rationale ("names the model, your org id,
+        // your rate limits") is simply not true of this error.
+        const beforeCatch = t.slice(Math.max(0, m.index - 600), m.index);
+        if (!/messages\.create|chat\.completions|\.(responses|embeddings)\.create|\banthropic\.|\bopenai\.|new (Anthropic|OpenAI)/i.test(beforeCatch)) continue;
         out.push(finding('AIOP-016', 'The provider\'s error text is shown to the user', 'medium',
           f.path, lineOf(t, m.index),
           'Provider errors name the model, your organisation id, your rate limits and sometimes your account tier. Your user sees your bill, and a stranger learns which vendor to attack.',
@@ -309,7 +317,12 @@ export const BATCH4_CHECKS = [
     const out = [];
     for (const f of repo.find(/app\/.*\/route\.(ts|js)$|pages\/api\/.*\.(ts|js)$/)) {
       const t = f.text; if (!t) continue;
-      if (!/messages\.create|chat\.completions|generateText|streamText|anthropic|openai/i.test(t)) continue;
+      // Require an actual model INVOCATION, not just the library name. Matching
+      // the bare words "openai"/"anthropic" fired on every route that merely
+      // imported the SDK or constructed a client - `import OpenAI from 'openai'`,
+      // `new OpenAI()` - with no call at all. That was 66 false positives across
+      // two SDK example monorepos. Read the call, not the identifier.
+      if (!/\.(?:messages|chat\.completions|completions|responses)\.(?:create|stream)\s*\(|\b(?:generateText|streamText|generateObject|streamObject)\s*\(/i.test(t)) continue;
       // Two routers, two spellings. App Router exports maxDuration/runtime at the
       // top level; Pages Router puts them inside `export const config = {...}`.
       // Only handling the first flagged 77 supabase routes that WERE configured.
@@ -331,8 +344,22 @@ export const BATCH4_CHECKS = [
       const t = f.text; if (!t) continue;
       if (!/export\s+default\s+async\s+function|await\s+(?:fetch|db|prisma|sql|supabase)/.test(t)) continue;
       if (/<Suspense/.test(t)) continue;
-      const dir = f.path.replace(/[^/]+$/, '');
-      if (repo.files.some(x => x.path.startsWith(dir) && /loading\.(tsx|jsx|ts|js)$/.test(x.path))) continue;
+      // Next App Router inheritance: a loading.tsx covers its own segment AND
+      // every nested segment that does not define its own. The old check looked
+      // only in the page's OWN directory, so one app/(app)/loading.tsx that
+      // legitimately covers a dozen nested pages was missed and every one flagged
+      // - a false positive on real code. Walk from the page's directory up to the
+      // app/ root and accept a loading file at any level.
+      const segs = f.path.split('/');
+      const appIdx = segs.indexOf('app');
+      if (appIdx < 0) continue;
+      let covered = false;
+      for (let len = segs.length - 1; len >= appIdx + 1; len--) {
+        const prefix = segs.slice(0, len).join('/') + '/';
+        if (repo.files.some(x => x.path.startsWith(prefix) &&
+            /^loading\.(tsx|jsx|ts|js)$/.test(x.path.slice(prefix.length)))) { covered = true; break; }
+      }
+      if (covered) continue;
       out.push(finding('NEXT-012', 'Nothing shown while this page loads its data', 'low',
         f.path, 1,
         'The browser stays on the previous page with no sign anything happened. On a slow connection people press the link again, or decide it is broken and leave.',
@@ -408,7 +435,7 @@ export const BATCH4_CHECKS = [
   }},
 
 // ── LEG-003 ─────────────────────────────────────────────────────────────────
-{ id: 'LEG-003', run(repo, profile) {
+{ id: 'LEG-003', scope: 'root', run(repo, profile) {
     if (!profile.is_public || !profile.has_accounts) return [];
     if (repo.has(/terms|\/tos[./]|conditions/i)) return [];
     if (repo.grep(/terms of (?:service|use)/i, /\.(tsx|jsx|html|erb|md|vue|svelte)$/).length) return [];
@@ -431,6 +458,12 @@ export const BATCH4_CHECKS = [
       while ((m = re.exec(t))) {
         const tag = m[0];
         if (/\balt\s*=/.test(tag) || /\baria-hidden\s*=\s*["'{]?true/.test(tag)) continue;
+        // Not every <img> in source is a UI image. Skip XSS test payloads a
+        // sanitiser keeps inline (<img src=x onerror=alert(...)>) and empty
+        // placeholder tags with no image at all - neither is a screen-reader
+        // concern, and both were false positives in the corpus.
+        if (/\bon(?:error|load)\s*=\s*["']?\s*(?:alert|eval|javascript:)/i.test(tag)) continue;
+        if (!/\bsrc\s*=\s*["'{]?\s*\S/.test(tag)) continue;
         out.push(finding('LEG-006', 'Image with no alt attribute', 'medium',
           f.path, lineOf(t, m.index),
           'A screen reader reads the file name instead, which tells a blind visitor nothing. In the US and Australia this is the single most commonly litigated accessibility failure, and the fix is one attribute.',

package/src/detect.mjs

@@ -125,14 +125,23 @@ function detectAuth(repo, deps) {
   return fact('none','low',[]);
 }
 
-function detectHost(repo, deps) {
-  if (repo.exists('vercel.json') || deps['@vercel/analytics']) return fact('vercel','high',['vercel.json']);
-  if (repo.exists('netlify.toml'))  return fact('netlify','high',['netlify.toml']);
-  if (repo.exists('wrangler.toml')) return fact('cloudflare','high',['wrangler.toml']);
-  if (repo.exists('fly.toml'))      return fact('fly','high',['fly.toml']);
-  if (repo.exists('railway.json'))  return fact('railway','high',['railway.json']);
-  if (repo.exists('render.yaml'))   return fact('render','high',['render.yaml']);
-  if (repo.has(/^Dockerfile$|docker-compose\.ya?ml$/)) return fact('vps','low',['Dockerfile — host inferred']);
+function detectHost(repo, deps, root = null) {
+  // Deploy config lives at the REPO ROOT. In a monorepo the app being profiled
+  // is a workspace (apps/web), which does not contain railway.json / fly.toml /
+  // vercel.json - those sit one level up. Checking the workspace only reported
+  // "no host", which made detectStage below call a live app a prototype and
+  // skip every production check. Look at the root too, exactly as detectDatabase
+  // already does.
+  const has = (f) => repo.exists(f) || Boolean(root?.exists(f));
+  if (has('vercel.json') || deps['@vercel/analytics']) return fact('vercel','high',['vercel.json']);
+  if (has('netlify.toml'))  return fact('netlify','high',['netlify.toml']);
+  if (has('wrangler.toml')) return fact('cloudflare','high',['wrangler.toml']);
+  if (has('fly.toml'))      return fact('fly','high',['fly.toml']);
+  if (has('railway.json') || has('railway.toml')) return fact('railway','high',['railway.json']);
+  if (has('render.yaml'))   return fact('render','high',['render.yaml']);
+  if (has('Procfile'))      return fact('heroku','low',['Procfile']);
+  if (repo.has(/^Dockerfile$|docker-compose\.ya?ml$/) || root?.has(/(^|\/)Dockerfile$|docker-compose\.ya?ml$/))
+    return fact('vps','low',['Dockerfile — host inferred']);
   return fact(null,'low',[]);
 }
 
@@ -166,6 +175,13 @@ const PII    = /\b(email|phone|first_?name|last_?name|address|date_?of_?birth|do
 const FIN    = /\b(card_?number|iban|invoice|amount_cents|stripe_customer|tax_id|vat)\b/i;
 const HEALTH = /\b(diagnosis|patient|medical_record|prescription|icd_?10)\b/i;
 const CHILD  = /\b(parental_consent|guardian|is_minor|age_gate)\b/i;
+// Third-party credentials stored at rest: an app holding a user's WB token, a
+// bot token or an API key in its own database is a far bigger target than one
+// holding an email - if that database leaks, the attacker gets into the user's
+// OTHER accounts. Matches encrypted-token columns (…tokenEnc, …secretEnc) and
+// the common credential field names, but NOT a bare "token" (a session or reset
+// token is the app's own auth, not a stored third-party secret).
+const CRED   = /\b(\w+(?:token|key|secret)_?enc|api_?key|access_?token|refresh_?token|client_?secret|bot_?token|webhook_?secret|oauth_?token)\b/i;
 // only count matches inside actual schema declarations, with comments removed
 function schemaHits(repo, re) {
   const files = repo.files.filter(f => f.text && /\.(sql|prisma|ts|py|rb)$/.test(f.path));
@@ -187,7 +203,11 @@ function detectSensitivity(repo) {
   const health = schemaHits(repo, HEALTH), child = schemaHits(repo, CHILD);
   if (terms(health).length >= 2) return fact('health','high',[`clinical fields: ${terms(health).join(', ')}`]);
   if (terms(child).length  >= 2) return fact('children','high',[`minor/guardian fields: ${terms(child).join(', ')}`]);
-  const fin = schemaHits(repo, FIN), pii = schemaHits(repo, PII);
+  const cred = schemaHits(repo, CRED), fin = schemaHits(repo, FIN), pii = schemaHits(repo, PII);
+  // Stored third-party credentials carry the same at-rest duties as financial
+  // data - encryption, access audit - so they map to the value those rules gate
+  // on, with evidence that says plainly what was found.
+  if (terms(cred).length >= 1) return fact('financial','high',[`credentials stored at rest: ${terms(cred).slice(0,4).join(', ')}`]);
   if (terms(fin).length >= 1) return fact('financial','high',[`financial fields: ${terms(fin).slice(0,4).join(', ')}`]);
   if (terms(pii).length >= 2) return fact('pii','high',[`personal fields: ${terms(pii).slice(0,4).join(', ')}`]);
   if (terms(pii).length === 1) return fact('pii','low',[`single personal field: ${terms(pii)[0]}`]);
@@ -244,11 +264,16 @@ function detectSurface(repo, framework, deps) {
   return fact('web-app','low',[]);
 }
 
-function detectStage(repo, host) {
+function detectStage(repo, host, root = null) {
+  const has = (f) => repo.exists(f) || Boolean(root?.exists(f));
+  const hasRe = (re) => repo.has(re) || Boolean(root?.has(re));
   const signals = [];
   if (host.value) signals.push(`host config (${host.value})`);
-  if (repo.has(/^\.github\/workflows\//)) signals.push('CI workflows');
-  if (repo.exists('.env.production') || repo.exists('.env.prod')) signals.push('production env file');
+  if (hasRe(/(^|\/)\.github\/workflows\//)) signals.push('CI workflows');
+  if (has('.env.production') || has('.env.prod')) signals.push('production env file');
+  // A start script or Procfile is a "this is meant to be deployed and run"
+  // signal a prototype rarely has - scripts/start.sh, a Procfile, bin/start.
+  if (has('scripts/start.sh') || has('Procfile') || has('bin/start')) signals.push('start script');
   if (signals.length >= 2) return fact('production','low',signals);
   if (signals.length === 1) return fact('pre-launch','low',signals);
   return fact('prototype','low',['no deploy signals']);
@@ -263,7 +288,7 @@ export function detectProfile(repo, opts = {}) {
   const framework = detectFramework(repo, deps);
   const database  = detectDatabase(repo, deps, root);
   const auth      = detectAuth(repo, deps);
-  const host      = detectHost(repo, deps);
+  const host      = detectHost(repo, deps, root);
   const llm       = detectLlm(repo, deps);
   const accounts  = detectAccounts(repo, deps, auth);
 
@@ -279,10 +304,10 @@ export function detectProfile(repo, opts = {}) {
     tenancy:          (() => { const l = detectTenancy(repo, accounts.value);
                                return (['none','single-user'].includes(l.value) && root)
                                  ? detectTenancy(root, accounts.value) : l; })(),
-    stage:            detectStage(repo, host),
+    stage:            detectStage(repo, host, root),
     // cheap extras that gate real rules
     has_migrations:   repo.has(/migrations?\//) ? fact(true,'high',['migrations dir']) : fact(false,'low',[]),
-    has_ci:           repo.has(/^\.github\/workflows\//) ? fact(true,'high',['github workflows']) : fact(false,'high',[]),
+    has_ci:           (repo.has(/^\.github\/workflows\//) || root?.has(/(^|\/)\.github\/workflows\//)) ? fact(true,'high',['github workflows']) : fact(false,'high',[]),
     sends_email:      dep(deps,'resend','@sendgrid/mail','nodemailer','postmark','@aws-sdk/client-ses')
                         ? fact(true,'high',['email sdk']) : fact(false,'low',[]),
     handles_payments: dep(deps,'stripe','@stripe/stripe-js') ? fact('stripe','high',['stripe sdk'])

package/src/index.mjs

@@ -202,6 +202,15 @@ function printDelta(fresh, moreRan) {
   const SEV = { critical: '\x1b[31m', high: '\x1b[33m', medium: '\x1b[34m', low: '\x1b[90m' };
   const p = (s = '') => process.stdout.write(s + '\n');
 
+  // Nothing new RAN is different from checks running and passing. When an answer
+  // points away from a regime - "other" means no specific privacy law, "no"
+  // means the AI cannot act - the checks it would unlock simply do not apply, or
+  // they need the deep scan. Saying "they all passed" there is a small lie.
+  if (moreRan === 0) {
+    p(`\n  ${C.d}Your answers unlocked no more free checks here — the ones they point to`);
+    p(`  either don't apply to what you said, or need the deep scan.${C.o}\n`);
+    return;
+  }
   p(`\n  ${C.grn}${moreRan} more check${moreRan === 1 ? '' : 's'} ran with your answers.${C.o}`);
   if (!fresh.length) {
     p(`  ${C.d}They all passed — nothing new to fix.${C.o}\n`);

package/src/report.mjs

@@ -13,7 +13,13 @@ export function render({ repo, scanned, lead, findings, questions, shallow = [],
   const p = (s = '') => L.push(s);
   const pr = lead.profile;
 
-  p(`\n${C.bold}${BRAND.name.toUpperCase()}${C.off} ${C.dim}${repo}${C.off}\n`);
+  // Collapse the home directory to ~, so the header does not print the user's
+  // OS username and full folder layout. It is only shown in their own terminal,
+  // but a screenshot or a pasted report would otherwise carry it. process.env
+  // (not node:os) so nothing new is imported and the read-only guard is happy.
+  const home = process.env.HOME || process.env.USERPROFILE || '';
+  const shownPath = home && repo.startsWith(home + '/') ? '~' + repo.slice(home.length) : repo;
+  p(`\n${C.bold}${BRAND.name.toUpperCase()}${C.off} ${C.dim}${shownPath}${C.off}\n`);
 
   // ---------- what this app is ----------
   p(`${C.bold}What we found${C.off}`);