safelaunch 1.0.32 → 1.0.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safelaunch",
-  "version": "1.0.32",
+  "version": "1.0.33",
   "description": "Backend Reliability Infrastructure - catch what breaks production before it breaks",
   "main": "index.js",
   "bin": {

package/src/scan.js

@@ -63,11 +63,26 @@ const IMPACTS = {
     impact: "Different tools read different copies. Behaviour is unpredictable — one service may use the wrong value.",
     fix:    `Remove the duplicate ${name} entry from your .env file.`,
   }),
+  NODE_MODULES_STALE: () => ({
+    title:  "node_modules may be out of date",
+    impact: "package.json was modified after node_modules was last updated. You may be running old or missing dependencies.",
+    fix:    "Run npm install to sync your dependencies.",
+  }),
   MISSING_NODE_MODULES: () => ({
     title:  "node_modules is missing",
     impact: "The app won't start. Nothing is installed.",
     fix:    "Run npm install.",
   }),
+  AUDIT_HIGH: (count) => ({
+    title:  `${count} high-severity vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
+    impact: "Known vulnerabilities exist that could be exploited. These should be fixed before deploying.",
+    fix:    "Run npm audit fix or check npm audit for manual fixes.",
+  }),
+  AUDIT_HIGH: (count) => ({
+    title:  `${count} high-severity vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
+    impact: "Known vulnerabilities exist that could be exploited. These should be fixed before deploying.",
+    fix:    "Run npm audit fix or check npm audit for manual fixes.",
+  }),
   AUDIT_CRITICAL: (count) => ({
     title:  `${count} critical vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
     impact: "Known exploits exist for these packages. Shipping them puts your users and infrastructure at risk.",
@@ -200,12 +215,21 @@ function checkNodeModules(cwd) {
   if (!fileExists(pkgPath)) return issues;
   try {
     const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-    const deps = Object.keys(pkg.dependencies || {});
+    const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
     if (deps.length === 0) return issues;
   } catch { return issues; }
-  if (!fileExists(path.join(cwd, "node_modules"))) {
+  const nmPath = path.join(cwd, "node_modules");
+  if (!fileExists(nmPath)) {
     issues.push({ severity: "block", ...IMPACTS.MISSING_NODE_MODULES() });
+    return issues;
   }
+  try {
+    const pkgStat = fs.statSync(pkgPath);
+    const nmStat  = fs.statSync(nmPath);
+    if (pkgStat.mtimeMs > nmStat.mtimeMs) {
+      issues.push({ severity: "warn", ...IMPACTS.NODE_MODULES_STALE() });
+    }
+  } catch {}
   return issues;
 }
 
@@ -213,12 +237,15 @@ function checkNpmAudit(cwd) {
   const issues = [];
   if (!fileExists(path.join(cwd, "package.json"))) return issues;
   try {
-    execSync("npm audit --audit-level=critical --json", { cwd, encoding: "utf8", stdio: ["pipe","pipe","pipe"] });
+    execSync("npm audit --json", { cwd, encoding: "utf8", stdio: ["pipe","pipe","pipe"] });
   } catch (e) {
     try {
       const data = JSON.parse(e.stdout || "");
-      const critCount = (data.metadata && data.metadata.vulnerabilities && data.metadata.vulnerabilities.critical) || 0;
-      if (critCount > 0) issues.push({ severity: "warn", ...IMPACTS.AUDIT_CRITICAL(critCount) });
+      const vulns = (data.metadata && data.metadata.vulnerabilities) || {};
+      const critCount = vulns.critical || 0;
+      const highCount = vulns.high || 0;
+      if (critCount > 0) issues.push({ severity: "block", ...IMPACTS.AUDIT_CRITICAL(critCount) });
+      if (highCount > 0) issues.push({ severity: "warn", ...IMPACTS.AUDIT_HIGH(highCount) });
     } catch {}
   }
   return issues;