safelaunch 1.0.19 → 1.0.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safelaunch",
-  "version": "1.0.19",
+  "version": "1.0.20",
   "description": "Validate your environment before every push. Catch missing, empty, and misconfigured env variables before they break production.",
   "main": "index.js",
   "bin": {

package/safelaunch/src/scan.js

@@ -1,9 +1,8 @@
 const fs = require('fs');
 const path = require('path');
+const { execSync } = require('child_process');
 const { track, shutdown } = require('./telemetry');
 
-// ─── Impact messages ──────────────────────────────────────────────────────────
-
 function impactBlock(lines) {
   return '   Impact:\n' + lines.map(l => '   ' + l).join('\n');
 }
@@ -11,51 +10,77 @@ function impactBlock(lines) {
 const IMPACT = {
   missing: (key) => impactBlock([
     'Your app cannot use ' + key,
-    '→ Will crash or behave incorrectly at runtime'
+    '\u2192 Will crash or behave incorrectly at runtime'
   ]),
   empty: (key) => impactBlock([
     key + ' is defined but has no value',
-    '→ Your app will treat it as blank — this will break things'
+    '\u2192 Your app will treat it as blank \u2014 this will break things'
   ]),
   duplicate: (key) => impactBlock([
     key + ' is defined more than once',
-    '→ The last value silently wins — likely not what you want'
+    '\u2192 The last value silently wins \u2014 likely not what you want'
   ]),
   depsNotInstalled: () => impactBlock([
     'node_modules is missing entirely',
-    '→ Your app will not start'
+    '\u2192 Your app will not start'
   ]),
   depsDrift: (dep) => impactBlock([
     dep + ' is in package.json but not installed',
-    '→ Any code that imports it will fail'
+    '\u2192 Any code that imports it will fail'
+  ]),
+  lockfileMissing: () => impactBlock([
+    'package-lock.json is missing',
+    '\u2192 npm install will resolve different versions each time \u2014 inconsistent deploys'
   ]),
   prefixVite: (key) => impactBlock([
     key + ' is missing the VITE_ prefix',
-    '→ It will not be exposed to the browser — your frontend will not see it'
+    '\u2192 It will not be exposed to the browser \u2014 your frontend will not see it'
   ]),
   prefixCra: (key) => impactBlock([
     key + ' is missing the REACT_APP_ prefix',
-    '→ It will not be exposed to the browser — your frontend will not see it'
+    '\u2192 It will not be exposed to the browser \u2014 your frontend will not see it'
   ]),
   noEnvFile: () => impactBlock([
     'No .env file found',
-    '→ Every environment variable your app needs will be missing'
+    '\u2192 Every environment variable your app needs will be missing'
+  ]),
+  envInGit: (file) => impactBlock([
+    file + ' is committed to your git history',
+    '\u2192 Your secrets are exposed to anyone with repo access'
+  ]),
+  envNotIgnored: () => impactBlock([
+    '.env is not in your .gitignore',
+    '\u2192 You are one git add away from leaking your secrets'
+  ]),
+  envExampleOutOfSync: (keys) => impactBlock([
+    keys.join(', ') + ' are in .env but missing from .env.example',
+    '\u2192 Teammates cloning this repo will not know these vars exist'
+  ]),
+  hardcodedSecret: (file) => impactBlock([
+    'Possible secret found hardcoded in ' + file,
+    '\u2192 Secrets in source code get committed and exposed in version history'
+  ]),
+  buildScriptMissing: () => impactBlock([
+    'No build script found in package.json',
+    '\u2192 Your deploy pipeline will not know how to build this project'
+  ]),
+  uncommittedChanges: () => impactBlock([
+    'You have uncommitted changes',
+    '\u2192 These changes will not be included in your deploy'
+  ]),
+  unpushedCommits: () => impactBlock([
+    'You have commits that have not been pushed',
+    '\u2192 Your deploy may not include your latest changes'
   ]),
 };
 
-const DIVIDER = '────────────────────────────';
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
+const DIVIDER = '\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500';
 
 function detectProjectType(cwd) {
   if (fs.existsSync(path.join(cwd, 'vite.config.js')) ||
-    fs.existsSync(path.join(cwd, 'vite.config.ts'))) {
-    return 'vite';
-  }
+    fs.existsSync(path.join(cwd, 'vite.config.ts'))) return 'vite';
   if (fs.existsSync(path.join(cwd, 'next.config.js')) ||
-    fs.existsSync(path.join(cwd, 'next.config.ts'))) {
-    return 'next';
-  }
+    fs.existsSync(path.join(cwd, 'next.config.ts'))) return 'next';
   const packagePath = path.join(cwd, 'package.json');
   if (fs.existsSync(packagePath)) {
     const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
@@ -76,9 +101,7 @@ function scanFiles(dir, extensions, pattern, found = new Set()) {
     } else if (extensions.some(ext => item.endsWith(ext))) {
       const content = fs.readFileSync(full, 'utf8');
       const matches = content.matchAll(pattern);
-      for (const match of matches) {
-        found.add(match[1]);
-      }
+      for (const match of matches) found.add(match[1]);
     }
   }
   return found;
@@ -118,23 +141,106 @@ function checkDependencies(cwd) {
   return { notInstalled: false, missing };
 }
 
-function renderIssue(number, title, impact) {
-  return (
-    number + '. ' + title + '\n' +
-    '\n' +
-    impact + '\n'
-  );
+function checkLockfile(cwd) {
+  return !fs.existsSync(path.join(cwd, 'package-lock.json')) &&
+         !fs.existsSync(path.join(cwd, 'yarn.lock')) &&
+         !fs.existsSync(path.join(cwd, 'pnpm-lock.yaml'));
 }
 
-// ─── Main ─────────────────────────────────────────────────────────────────────
+function checkEnvInGit(cwd) {
+  try {
+    const tracked = execSync('git ls-files', { cwd, stdio: ['pipe', 'pipe', 'ignore'] }).toString();
+    const files = tracked.split('\n');
+    return files.filter(f => f === '.env' || /^\.env\.(production|staging|live)$/.test(f));
+  } catch (_) { return []; }
+}
 
-async function scan() {
-  console.log('');
-  console.log('Scanning your project...');
+function checkEnvInGitignore(cwd) {
+  const gitignorePath = path.join(cwd, '.gitignore');
+  if (!fs.existsSync(gitignorePath)) return false;
+  const content = fs.readFileSync(gitignorePath, 'utf8');
+  return content.split('\n').some(line => line.trim() === '.env');
+}
+
+function checkEnvExampleSync(cwd, envVars) {
+  const examplePath = path.join(cwd, '.env.example');
+  if (!fs.existsSync(examplePath)) return [];
+  const exampleContent = fs.readFileSync(examplePath, 'utf8');
+  const exampleKeys = new Set();
+  for (const line of exampleContent.split('\n')) {
+    const match = line.match(/^([^=]+)=/);
+    if (match) exampleKeys.add(match[1].trim());
+  }
+  return Object.keys(envVars).filter(k => !exampleKeys.has(k));
+}
+
+function checkHardcodedSecrets(cwd) {
+  const extensions = ['.js', '.ts', '.jsx', '.tsx'];
+  const secretPatterns = [
+    /sk_live_[a-zA-Z0-9]{20,}/,
+    /pk_live_[a-zA-Z0-9]{20,}/,
+    /AKIA[0-9A-Z]{16}/,
+    /-----BEGIN (RSA |EC )?PRIVATE KEY-----/,
+    /ghp_[a-zA-Z0-9]{36}/,
+    /xox[baprs]-[0-9a-zA-Z-]{10,}/,
+  ];
+  const hits = [];
+  function walk(dir) {
+    try {
+      const items = fs.readdirSync(dir);
+      for (const item of items) {
+        if (item === 'node_modules' || item === '.git') continue;
+        const full = path.join(dir, item);
+        const stat = fs.statSync(full);
+        if (stat.isDirectory()) {
+          walk(full);
+        } else if (extensions.some(ext => item.endsWith(ext))) {
+          const content = fs.readFileSync(full, 'utf8');
+          for (const pattern of secretPatterns) {
+            if (pattern.test(content)) {
+              hits.push(path.relative(cwd, full));
+              break;
+            }
+          }
+        }
+      }
+    } catch (_) {}
+  }
+  walk(cwd);
+  return hits;
+}
+
+function checkBuildScript(cwd) {
+  const packagePath = path.join(cwd, 'package.json');
+  if (!fs.existsSync(packagePath)) return false;
+  const pkg = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+  return !!(pkg.scripts && pkg.scripts.build);
+}
+
+function checkGitStatus(cwd) {
+  try {
+    const status = execSync('git status --porcelain', { cwd, stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim();
+    const uncommitted = status.length > 0;
+    let unpushed = false;
+    try {
+      const ahead = execSync('git log @{u}.. --oneline', { cwd, stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim();
+      unpushed = ahead.length > 0;
+    } catch (_) {}
+    return { uncommitted, unpushed };
+  } catch (_) { return { uncommitted: false, unpushed: false }; }
+}
+
+function renderIssue(number, title, impact) {
+  return number + '. ' + title + '\n\n' + impact + '\n';
+}
 
+async function scan() {
   const cwd = process.cwd();
   const projectType = detectProjectType(cwd);
   const typeLabels = { vite: 'Vite', next: 'Next.js', cra: 'Create React App', node: 'Node.js' };
+
+  console.log('');
+  console.log('Scanning your project...');
   console.log('Detected: ' + typeLabels[projectType]);
   console.log('');
 
@@ -149,158 +255,115 @@ async function scan() {
   }
 
   const found = scanFiles(cwd, extensions, pattern);
-
-  if (found.size === 0) {
-    console.log('🛡️  Safelaunch Scan Report');
-    console.log('');
-    console.log('No environment variables found in your codebase.');
-    console.log('');
-    console.log(DIVIDER);
-    console.log('');
-    console.log('✅ Nothing to check');
-    console.log('');
-    console.log('   Your project does not appear to use process.env');
-    console.log('');
-    await track('safelaunch_scan_run', { project_type: projectType, vars_found: 0 });
-    await shutdown();
-    return;
-  }
-
   const result = readEnvDetailed(cwd);
-
-  if (!result) {
-    const varList = [...found].sort();
-    const criticals = [];
-    let issueNum = 1;
-
-    criticals.push(renderIssue(issueNum++, '.env file is missing', IMPACT.noEnvFile()));
-    for (const key of varList) {
-      criticals.push(renderIssue(issueNum++, key + ' is missing', IMPACT.missing(key)));
-    }
-
-    console.log('🚨 Safelaunch Scan Report');
-    console.log('');
-    console.log('This project is NOT safe to deploy');
-    console.log('');
-    console.log((varList.length + 1) + ' issues found');
-    console.log((varList.length + 1) + ' critical');
-    console.log('');
-    console.log(DIVIDER);
-    console.log('');
-    console.log('🚨 CRITICAL (will break your app)');
-    console.log('');
-    for (const block of criticals) {
-      console.log(block);
-      console.log('---');
-      console.log('');
-    }
-    console.log(DIVIDER);
-    console.log('');
-    console.log('💡 Next step');
-    console.log('');
-    console.log('   Create a .env file with your environment variables,');
-    console.log('   then run:');
-    console.log('');
-    console.log('   safelaunch init');
-    console.log('');
-    console.log('   Lock this configuration and prevent future breakage');
-    console.log('');
-    await track('safelaunch_scan_run', { project_type: projectType, vars_found: found.size, missing: found.size, no_env: true });
-    await shutdown();
-    return;
-  }
-
-  const { envVars, duplicates } = result;
-  const missing = [];
-  const empty = [];
-  const present = [];
-
-  for (const key of [...found].sort()) {
-    if (!(key in envVars)) {
-      missing.push(key);
-    } else if (envVars[key] === '') {
-      empty.push(key);
-    } else {
-      present.push(key);
+  const drift = checkDependencies(cwd);
+  const lockfileMissing = checkLockfile(cwd);
+  const envInGit = checkEnvInGit(cwd);
+  const envIgnored = checkEnvInGitignore(cwd);
+  const hardcodedSecrets = checkHardcodedSecrets(cwd);
+  const hasBuildScript = checkBuildScript(cwd);
+  const gitStatus = checkGitStatus(cwd);
+
+  let missing = [], empty = [], present = [], duplicates = [], envExampleOutOfSync = [];
+
+  if (result) {
+    const { envVars, duplicates: dups } = result;
+    duplicates = dups;
+    envExampleOutOfSync = checkEnvExampleSync(cwd, envVars);
+    for (const key of [...found].sort()) {
+      if (!(key in envVars)) missing.push(key);
+      else if (envVars[key] === '') empty.push(key);
+      else present.push(key);
     }
+  } else {
+    missing = [...found].sort();
   }
 
-  const drift = checkDependencies(cwd);
-
   const prefixWarnings = [];
   for (const key of found) {
     if (key === 'NODE_ENV') continue;
-    if (projectType === 'vite' && !key.startsWith('VITE_')) {
-      prefixWarnings.push({ key, type: 'vite' });
-    }
-    if (projectType === 'cra' && !key.startsWith('REACT_APP_')) {
-      prefixWarnings.push({ key, type: 'cra' });
-    }
+    if (projectType === 'vite' && !key.startsWith('VITE_')) prefixWarnings.push({ key, type: 'vite' });
+    if (projectType === 'cra' && !key.startsWith('REACT_APP_')) prefixWarnings.push({ key, type: 'cra' });
   }
 
   const criticalIssues = [];
   const warningIssues = [];
   const passingChecks = [];
 
-  for (const key of missing) {
-    criticalIssues.push({ title: key + ' is missing', impact: IMPACT.missing(key) });
-  }
-  for (const key of empty) {
-    criticalIssues.push({ title: key + ' is empty', impact: IMPACT.empty(key) });
-  }
-  if (drift && drift.notInstalled) {
-    criticalIssues.push({ title: 'Dependencies are not installed', impact: IMPACT.depsNotInstalled() });
-  }
+  if (!result) criticalIssues.push({ title: '.env file is missing', impact: IMPACT.noEnvFile() });
+  for (const key of missing) criticalIssues.push({ title: key + ' is missing', impact: IMPACT.missing(key) });
+  for (const key of empty) criticalIssues.push({ title: key + ' is empty', impact: IMPACT.empty(key) });
+  if (drift && drift.notInstalled) criticalIssues.push({ title: 'Dependencies are not installed', impact: IMPACT.depsNotInstalled() });
+  for (const file of envInGit) criticalIssues.push({ title: file + ' is tracked by git', impact: IMPACT.envInGit(file) });
+  for (const file of hardcodedSecrets) criticalIssues.push({ title: 'Hardcoded secret in ' + file, impact: IMPACT.hardcodedSecret(file) });
+
   if (drift && !drift.notInstalled && drift.missing.length > 0) {
-    for (const dep of drift.missing) {
-      warningIssues.push({ title: dep + ' is not installed', impact: IMPACT.depsDrift(dep) });
-    }
-  }
-  for (const key of duplicates) {
-    warningIssues.push({ title: key + ' is defined more than once', impact: IMPACT.duplicate(key) });
+    for (const dep of drift.missing) warningIssues.push({ title: dep + ' is not installed', impact: IMPACT.depsDrift(dep) });
   }
+  if (lockfileMissing) warningIssues.push({ title: 'No lockfile found', impact: IMPACT.lockfileMissing() });
+  for (const key of duplicates) warningIssues.push({ title: key + ' is defined more than once', impact: IMPACT.duplicate(key) });
   for (const { key, type } of prefixWarnings) {
-    if (type === 'vite') {
-      warningIssues.push({ title: key + ' is missing VITE_ prefix', impact: IMPACT.prefixVite(key) });
-    } else {
-      warningIssues.push({ title: key + ' is missing REACT_APP_ prefix', impact: IMPACT.prefixCra(key) });
-    }
+    if (type === 'vite') warningIssues.push({ title: key + ' is missing VITE_ prefix', impact: IMPACT.prefixVite(key) });
+    else warningIssues.push({ title: key + ' is missing REACT_APP_ prefix', impact: IMPACT.prefixCra(key) });
   }
+  if (!envIgnored && fs.existsSync(path.join(cwd, '.env'))) warningIssues.push({ title: '.env is not in .gitignore', impact: IMPACT.envNotIgnored() });
+  if (envExampleOutOfSync.length > 0) warningIssues.push({ title: '.env.example is out of sync', impact: IMPACT.envExampleOutOfSync(envExampleOutOfSync) });
+  if (!hasBuildScript && fs.existsSync(path.join(cwd, 'package.json'))) warningIssues.push({ title: 'No build script in package.json', impact: IMPACT.buildScriptMissing() });
+  if (gitStatus.uncommitted) warningIssues.push({ title: 'You have uncommitted changes', impact: IMPACT.uncommittedChanges() });
+  if (gitStatus.unpushed) warningIssues.push({ title: 'You have unpushed commits', impact: IMPACT.unpushedCommits() });
 
   if (result) passingChecks.push('Environment file detected');
+  if (envIgnored) passingChecks.push('.env is in .gitignore');
+  if (envInGit.length === 0) passingChecks.push('No env files tracked by git');
+  if (hardcodedSecrets.length === 0) passingChecks.push('No hardcoded secrets found');
+  if (!lockfileMissing) passingChecks.push('Lockfile present');
   if (!drift || (!drift.notInstalled && drift.missing.length === 0)) passingChecks.push('Dependencies installed');
   if (duplicates.length === 0) passingChecks.push('No duplicate variables');
-  for (const key of present) {
-    passingChecks.push(key + ' configured');
-  }
+  if (hasBuildScript) passingChecks.push('Build script found');
+  if (!gitStatus.uncommitted) passingChecks.push('No uncommitted changes');
+  if (!gitStatus.unpushed) passingChecks.push('No unpushed commits');
+  for (const key of present) passingChecks.push(key + ' configured');
 
   const totalIssues = criticalIssues.length + warningIssues.length;
   const hasFailed = totalIssues > 0;
 
+  if (found.size === 0 && totalIssues === 0) {
+    console.log('\uD83D\uDEE1\uFE0F  Safelaunch Scan Report');
+    console.log('');
+    console.log('No environment variables found in your codebase.');
+    console.log('');
+    console.log(DIVIDER);
+    console.log('');
+    console.log('\u2705 Nothing to check');
+    console.log('');
+    console.log('   Your project does not appear to use process.env');
+    console.log('');
+    await track('safelaunch_scan_run', { project_type: projectType, vars_found: 0 });
+    await shutdown();
+    return;
+  }
+
   if (hasFailed) {
     const parts = [];
     if (criticalIssues.length > 0) parts.push(criticalIssues.length + ' critical');
     if (warningIssues.length > 0) parts.push(warningIssues.length + ' warning' + (warningIssues.length !== 1 ? 's' : ''));
 
-    console.log('🚨 Safelaunch Scan Report');
+    console.log('\uD83D\uDEA8 Safelaunch Scan Report');
     console.log('');
     console.log('This project is NOT safe to deploy');
     console.log('');
     console.log(totalIssues + ' issue' + (totalIssues !== 1 ? 's' : '') + ' found');
-    console.log(parts.join(' · '));
+    console.log(parts.join(' \u00B7 '));
     console.log('');
     console.log(DIVIDER);
     console.log('');
 
     if (criticalIssues.length > 0) {
-      console.log('🚨 CRITICAL (will break your app)');
+      console.log('\uD83D\uDEA8 CRITICAL (will break your app)');
       console.log('');
       criticalIssues.forEach((issue, i) => {
         console.log(renderIssue(i + 1, issue.title, issue.impact));
-        if (i < criticalIssues.length - 1) {
-          console.log('---');
-          console.log('');
-        }
+        if (i < criticalIssues.length - 1) { console.log('---'); console.log(''); }
       });
       console.log('');
       console.log(DIVIDER);
@@ -308,15 +371,12 @@ async function scan() {
     }
 
     if (warningIssues.length > 0) {
-      console.log('⚠️  WARNINGS (may cause issues)');
+      console.log('\u26A0\uFE0F  WARNINGS (may cause issues)');
       console.log('');
       const offset = criticalIssues.length;
       warningIssues.forEach((issue, i) => {
         console.log(renderIssue(offset + i + 1, issue.title, issue.impact));
-        if (i < warningIssues.length - 1) {
-          console.log('---');
-          console.log('');
-        }
+        if (i < warningIssues.length - 1) { console.log('---'); console.log(''); }
       });
       console.log('');
       console.log(DIVIDER);
@@ -324,17 +384,15 @@ async function scan() {
     }
 
     if (passingChecks.length > 0) {
-      console.log("✅ What's working (" + passingChecks.length + ' checks passed)');
+      console.log('\u2705 What\'s working (' + passingChecks.length + ' checks passed)');
       console.log('');
-      for (const check of passingChecks) {
-        console.log('- ' + check);
-      }
+      for (const check of passingChecks) console.log('- ' + check);
       console.log('');
       console.log(DIVIDER);
       console.log('');
     }
 
-    console.log('💡 Next step');
+    console.log('\uD83D\uDCA1 Next step');
     console.log('');
     console.log('   Run:');
     console.log('   safelaunch init');
@@ -343,7 +401,7 @@ async function scan() {
     console.log('');
 
   } else {
-    console.log('🛡️  Safelaunch Scan Report');
+    console.log('\uD83D\uDEE1\uFE0F  Safelaunch Scan Report');
     console.log('');
     console.log('Your project is safe to deploy');
     console.log('');
@@ -351,15 +409,13 @@ async function scan() {
     console.log('');
     console.log(DIVIDER);
     console.log('');
-    console.log('✅ All checks passed');
+    console.log('\u2705 All checks passed');
     console.log('');
-    for (const check of passingChecks) {
-      console.log('- ' + check);
-    }
+    for (const check of passingChecks) console.log('- ' + check);
     console.log('');
     console.log(DIVIDER);
     console.log('');
-    console.log("🎉 You're good to go");
+    console.log('\uD83C\uDF89 You\'re good to go');
     console.log('');
     console.log('   Deploy with confidence');
     console.log('');
@@ -373,7 +429,14 @@ async function scan() {
     empty: empty.length,
     duplicates: duplicates.length,
     prefix_warnings: prefixWarnings.length,
-    dependency_drift: !!(drift && drift.missing.length > 0)
+    dependency_drift: !!(drift && drift.missing.length > 0),
+    env_in_git: envInGit.length,
+    hardcoded_secrets: hardcodedSecrets.length,
+    lockfile_missing: lockfileMissing,
+    env_not_ignored: !envIgnored,
+    build_script_missing: !hasBuildScript,
+    uncommitted: gitStatus.uncommitted,
+    unpushed: gitStatus.unpushed
   });
 
   await shutdown();