launchprep 0.5.6 → 0.5.7

package/README.md

@@ -12,6 +12,10 @@ npx launchprep
 No signup, no dashboard, nothing added to your repo. The free scan runs entirely
 on your machine and uploads nothing.
 
+*(`npx` fetches it, runs it once and cleans up — there is nothing to install.
+npm shows an `npm i` line above because it shows one for every package; you do
+not need it unless you want the command available offline.)*
+
 ## Built with Cursor, Claude, Lovable, v0, Bolt or Replit?
 
 That is who this is for. The code works — that is not the same as being safe to

package/net/commands.mjs

@@ -191,6 +191,19 @@ async function deep(args) {
     process.exit(1);
   }
 
+  // A dead replay comes back as HTTP 200 carrying { status: 'failed' } - the
+  // request succeeded, the SCAN did not. Every guard above tests r.ok, so this
+  // sailed through and rendered as a clean scan with zero findings: the worst
+  // possible answer, because "0 findings" reads as "you are fine". Observed on a
+  // real licence twice. A scan that did not finish must never render as one that
+  // found nothing.
+  if (r.data?.status === 'failed') {
+    console.error(`\n  ${C.red}That scan did not finish.${C.off} ${C.d}${r.data.error || ''}${C.off}`);
+    if (r.data.refunded) console.error(`  ${C.grn}It was not counted — your scans are intact.${C.off}`);
+    console.error(`  ${C.d}Run this again to start a fresh one.${C.off}\n`);
+    process.exit(1);
+  }
+
   const findings = r.data.findings || [];
   const rank = { critical:0, high:1, medium:2, low:3 };
   findings.sort((a, b) => rank[a.severity] - rank[b.severity]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Read-only CLI that scans your AI-built app and reports what will break before real users hit it — auth, tenant isolation, data, payments, GDPR. 117 checks run free on your machine.",
   "type": "module",
   "bin": {