nativekeel 0.1.9 → 0.1.11

package/README.md

@@ -6,7 +6,7 @@ Health check for React Native and Expo apps. One command, no install, no account
 npx nativekeel
 ```
 
-**What's new in 0.1.9:** Android components open to every app, API calls over plain HTTP, and correct plans for old Expo projects. Since 0.1.8: known vulnerabilities in the exact dependency versions you ship, passwords that leak into crash reports, databases or AsyncStorage, unsafe WebViews, and setups that build fine but crash at runtime. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
+**What's new in 0.1.11:** the GitHub Action is fixed and tested on every change. **0.1.10:** every report opens with *Start here*, the three most urgent first steps; missing iOS permission texts (a crash and an App Review rejection) are caught. Recent releases added known vulnerabilities in the exact versions you ship, password leaks into logs and databases, unsafe WebViews, open Android components, plain-HTTP API calls and runtime crash risks. Tuned on 280+ open-source React Native and Expo apps to keep false alarms out. [All releases →](https://nativekeel.com/changelog)
 
 It answers the questions that decide whether your app can still ship:
 
@@ -19,7 +19,7 @@ It answers the questions that decide whether your app can still ship:
 - **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
 - **Do you ship known vulnerabilities?** Advisories from the GitHub Advisory Database for the exact versions in your lockfile or `node_modules`. Advisories that only affect Node.js servers are kept, at low severity.
 - **Can someone read your users' data?** Passwords that flow into crash reports, analytics, remote databases or plain AsyncStorage (followed through intermediate variables), WebViews that let page scripts read local files or load HTTP into HTTPS, Android backups that copy tokens, Android components any app can start, API calls over plain HTTP.
-- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release.
+- **Will it crash at runtime?** Reanimated without its Babel plugin or `react-native-worklets`, mixed `@react-native-firebase/*` or `@react-navigation/*` majors, a second copy of React or React Native inside a dependency, Kotlin modules that cannot load through the New Architecture interop layer, AppDelegate setups that crash in Release, camera/photos/location access without the Info.plist description iOS requires.
 - **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nativekeel",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Health check for React Native and Expo apps: upgrade blockers, store deadlines, crash risks, vulnerable dependencies and leaked secrets, with a step-by-step upgrade plan.",
   "type": "module",
   "bin": {

package/src/plan.js

@@ -542,6 +542,11 @@ export function buildPlan(result) {
     });
   }
 
+  // Store deadlines sit together, right after the target SDK.
+  const storeAt = phases.findIndex((p) => p.title === 'Meet App Store and Google Play requirements');
+  const targetAt = phases.findIndex((p) => p.title === 'Meet the Google Play target SDK');
+  if (storeAt > targetAt + 1 && targetAt >= 0) phases.splice(targetAt + 1, 0, ...phases.splice(storeAt, 1));
+
   // Only worth it when the plan changes code: secrets alone do not need UI tests.
   const leaksFirst = phases[0] && phases[0].title === 'Stop the leaks' ? 1 : 0;
   if (phases.length > leaksFirst) {
@@ -582,3 +587,18 @@ export function planToMarkdown(result, plan) {
   lines.push('---', `No time to do it yourself? We do fixed-price upgrades on a branch of your repo: ${SITE_URL}/#services`);
   return `${lines.join('\n')}\n`;
 }
+
+// The first concrete step of the first few phases: what to do today. Shown at the top of the
+// HTML report and under the summary in the terminal.
+const URGENCY = ['Stop the leaks', 'Fix crash risks', 'Meet the Google Play target SDK', 'Meet App Store and Google Play requirements', 'Close security gaps', 'Avoid known traps'];
+
+export function startHere(result, count = 3) {
+  const skip = new Set(['Set up a safety net', 'Verify before you ship']);
+  const rank = (t) => (URGENCY.indexOf(t) >= 0 ? URGENCY.indexOf(t) : URGENCY.length);
+  return buildPlan(result)
+    .phases.filter((p) => !skip.has(p.title) && p.steps.length)
+    .map((p, i) => ({ p, i }))
+    .sort((a, b) => rank(a.p.title) - rank(b.p.title) || a.i - b.i)
+    .slice(0, count)
+    .map(({ p }) => ({ phase: p.title, step: p.steps[0].replace(/ The [^.]* phase below gets you there;.*$/, '') }));
+}

package/src/report-html.js

@@ -1,5 +1,6 @@
 import { SEVERITIES, countBySeverity } from './analyze.js';
 import { SITE_URL } from './config.js';
+import { startHere } from './plan.js';
 
 const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
 // Turns `code` spans from finding text into <code>.
@@ -58,6 +59,7 @@ h1{font-size:26px;margin:0 0 4px}h2{font-size:19px;margin:32px 0 12px}h2 small{f
 .stat.critical b{color:var(--critical)}.stat.high b{color:var(--high)}
 .facts{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:12px 16px;margin-top:12px;display:flex;flex-wrap:wrap;gap:6px 24px;font-size:14px}
 ul.list{list-style:none;padding:0;margin:0;display:grid;gap:8px}
+.start{background:var(--card);border:1px solid var(--line);border-left:4px solid var(--accent);border-radius:8px;padding:6px 18px 10px;margin-top:20px}.start h2{margin:10px 0 6px}.start li{margin:6px 0}
 details.bumps{margin-top:8px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}details.bumps summary{cursor:pointer;font-weight:600}details.bumps table{width:100%;border-collapse:collapse;margin-top:10px;font-size:14px}details.bumps th,details.bumps td{text-align:left;padding:4px 8px;border-top:1px solid var(--line)}.muted{color:var(--muted);font-weight:400}
 .f{display:flex;gap:12px;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--low);border-radius:8px;padding:10px 14px}
 .f p{margin:2px 0 0;color:var(--muted);font-size:14px}.f strong{overflow-wrap:anywhere}
@@ -88,6 +90,7 @@ ${p.expo ? `<span>Expo SDK <b>${esc(p.expo.split('.')[0])}</b></span>` : ''}
 ${p.android && p.android.targetSdk ? `<span>targetSdk <b>${p.android.targetSdk}</b></span>` : ''}
 <span>${result.deps.length} dependencies (${result.deps.filter((d) => d.native).length} native)</span>
 </div>
+${n.critical + n.high > 0 ? `<section class="start"><h2>Start here</h2><ol>${startHere(result).map((x) => `<li>${rich(x.step)} <span class="muted">(${esc(x.phase)})</span></li>`).join('')}</ol><p class="muted">The full, ordered plan: <code>npx nativekeel plan</code>.</p></section>` : ''}
 <h2>Findings</h2>
 ${result.findings.length ? `${rows ? `<ul class="list">${rows}</ul>` : ''}${bumpTable}` : '<p>No issues found.</p>'}
 ${planHtml}

package/src/report-text.js

@@ -1,5 +1,6 @@
 import { SEVERITIES, countBySeverity } from './analyze.js';
 import { SITE_URL } from './config.js';
+import { startHere } from './plan.js';
 
 export function textReport(result, { color = true, verbose = false } = {}) {
   const paint = (code) => (s) => (color ? `\x1b[${code}m${s}\x1b[0m` : s);
@@ -64,7 +65,12 @@ export function textReport(result, { color = true, verbose = false } = {}) {
 
   if (n.critical + n.high > 0) {
     out.push('');
-    out.push(`Next: ${c.bold('npx nativekeel plan')} writes a step-by-step upgrade plan.`);
+    out.push(c.bold('Start here'));
+    const plain = (t) => t.replace(/\*\*/g, '').replace(/`/g, '');
+    const cut = (t) => (t.length > 150 ? `${t.slice(0, 147).replace(/\s+\S*$/, '')}…` : t);
+    startHere(result).forEach((s, i) => out.push(`  ${i + 1}. ${cut(plain(s.step))}`));
+    out.push('');
+    out.push(`Next: ${c.bold('npx nativekeel plan')} writes the full step-by-step plan.`);
     out.push(c.gray(`No time to do it yourself? Fixed-price upgrades: ${SITE_URL}/#services`));
   } else if (!result.findings.length) {
     out.push(c.green('Nothing to fix. This app is in good shape.'));

package/src/stability.js

@@ -158,6 +158,7 @@ export function stabilityChecks(project) {
     }
   }
 
+  for (const f of iosUsageDescriptions(project)) add(f);
   return findings;
 }
 
@@ -184,3 +185,64 @@ function listPackages(nm) {
   }
   return out;
 }
+
+// iOS terminates an app that touches a protected resource without the matching usage
+// description in Info.plist, and App Review rejects it. Expo managed apps get these from config
+// plugins, so only projects with their own ios/ folder are checked.
+const USAGE_KEYS = [
+  { key: 'NSCameraUsageDescription', what: 'the camera', pkgs: ['react-native-vision-camera', 'react-native-camera', 'expo-camera', 'react-native-camera-kit', 'react-native-qrcode-scanner'] },
+  { key: 'NSPhotoLibraryUsageDescription', what: 'the photo library', pkgs: ['@react-native-camera-roll/camera-roll', '@react-native-community/cameraroll', 'expo-media-library', 'react-native-image-crop-picker'] },
+  { key: 'NSLocationWhenInUseUsageDescription', what: 'location', pkgs: ['@react-native-community/geolocation', 'react-native-geolocation-service', 'expo-location', 'react-native-background-geolocation', '@mauron85/react-native-background-geolocation'] },
+  { key: 'NSMicrophoneUsageDescription', what: 'the microphone', pkgs: ['@react-native-voice/voice', 'react-native-audio-recorder-player', 'expo-audio', 'react-native-audio-record'] },
+  { key: 'NSContactsUsageDescription', what: 'contacts', pkgs: ['react-native-contacts', 'expo-contacts'] },
+  { key: 'NSCalendarsUsageDescription', what: 'calendars', pkgs: ['react-native-calendar-events', 'expo-calendar'] },
+  { key: 'NSBluetoothAlwaysUsageDescription', what: 'Bluetooth', pkgs: ['react-native-ble-plx', 'react-native-ble-manager'] },
+  { key: 'NSFaceIDUsageDescription', what: 'Face ID', pkgs: ['react-native-biometrics', '@sbaiahmed1/react-native-biometrics', 'expo-local-authentication', 'react-native-touch-id'] },
+];
+
+export function iosUsageDescriptions(project) {
+  const iosDir = path.join(project.root, 'ios');
+  if (!fs.existsSync(iosDir) || project.managed) return [];
+  const plists = [];
+  const walk = (dir, depth) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && depth < 2 && !['Pods', 'build', 'DerivedData'].includes(e.name) && !/Tests?$|Extension$|Widget/.test(e.name)) walk(path.join(dir, e.name), depth + 1);
+      else if (e.name === 'Info.plist') plists.push(path.join(dir, e.name));
+    }
+  };
+  walk(iosDir, 0);
+  if (!plists.length) return [];
+  const text = plists.map(readText).join('\n');
+  // Expo projects can add the keys at prebuild from app.json/app.config (infoPlist or a config
+  // plugin of the same package): count those too.
+  const expoConfig = project.expoVersion ? ['app.json', 'app.config.js', 'app.config.ts'].map((f) => readText(path.join(project.root, f)) || '').join('\n') : '';
+  const deps = { ...project.deps };
+  const missing = [];
+  for (const u of USAGE_KEYS) {
+    // In Expo projects, prebuild applies the config plugins of installed expo-* packages on its
+    // own, and they add default usage strings.
+    const used = u.pkgs.filter((p) => deps[p] && !(project.expoVersion && p.startsWith('expo-')));
+    if (!used.length) continue;
+    const keys = u.key === 'NSPhotoLibraryUsageDescription' ? [u.key, 'NSPhotoLibraryAddUsageDescription'] : [u.key];
+    const inPlist = keys.some((k) => text.includes(`<key>${k}</key>`));
+    const inExpo = keys.some((k) => expoConfig.includes(k)) || used.some((p) => expoConfig.includes(`"${p}"`) || expoConfig.includes(`'${p}'`));
+    if (!inPlist && !inExpo) missing.push({ ...u, used });
+  }
+  if (!missing.length) return [];
+  return [
+    {
+      id: 'crash-ios-usage-description',
+      severity: 'high',
+      area: 'crash',
+      title: `Info.plist is missing ${missing.length === 1 ? 'a usage description' : `${missing.length} usage descriptions`} (${missing.map((m) => m.key).join(', ')})`,
+      detail: `${missing.map((m) => `${m.used[0]} uses ${m.what}`).join('; ')}. iOS terminates the app the moment it asks for access without the matching key, and App Review rejects the build. Add each key with a sentence that says why the app needs it.`,
+      fix: { kind: 'crash', step: `Add ${missing.map((m) => `\`${m.key}\``).join(', ')} to the app's Info.plist, each with a user-facing reason.` },
+    },
+  ];
+}