shapi-cli 0.2.0 → 0.3.0

package/README.md

@@ -1,3 +1,5 @@
+<p align="center"><a href="https://shapi.dev/"><img src="https://raw.githubusercontent.com/SriVarshini09/YC/main/brand/png/shapi-lockup-horizontal-light-on-bg-1024.png" alt="SHAPI" width="320"></a></p>
+
 # shapi-cli
 
 **Find the code that breaks when a third-party API changes, and fix it test-first.**
@@ -22,7 +24,7 @@ Install it to get the `shapi` command:
 
 ```sh
 npm install -g shapi-cli
-shapi scan path/to/repo
+shapi scan path/to/repo        # or: shapi-cli scan path/to/repo
 ```
 
 ## What it checks
@@ -41,9 +43,9 @@ Node.js 22 or later.
 
 ## More
 
-- Documentation: https://srivarshini09.github.io/YC/
-- The GitHub App watches your repositories, posts a check on each push, and opens verified fix pull requests: https://github.com/SriVarshini09/YC
-- Report a problem: https://github.com/SriVarshini09/YC/issues
+- Documentation: https://shapi.dev/
+- The GitHub App watches your repositories, posts a check on each push, and opens verified fix pull requests: https://app.shapi.dev
+- Report a problem: https://github.com/SriVarshini09/shapi-advisories/issues or sri@shapi.dev
 
 ## License
 

package/dist/index.js

@@ -469,6 +469,14 @@ function providerForHost(host) {
   }
   return best?.provider;
 }
+var PATH_SIGNATURES = [
+  { provider: "shopify", path: /^\/admin\/api\/\d{4}-\d{2}(\/|$)/ },
+  { provider: "hubspot", path: /^\/crm-pipelines\/v\d+(\/|$)/ }
+];
+function providerForPath(path13) {
+  const hit = PATH_SIGNATURES.find((s) => s.path.test(path13));
+  return hit ? getProvider(hit.provider) : void 0;
+}
 function providerForPackage(name) {
   return loadProviders().find((p) => p.sdkPackages.includes(name));
 }
@@ -689,10 +697,16 @@ function matchAdvisories(lock, advisories, options = {}) {
   const horizon = options.horizonDays ?? 90;
   const affected = [];
   const exposed = [];
+  const possible = [];
   const hitsPerAdvisory = /* @__PURE__ */ new Map();
   for (const advisory of advisories) {
     for (const callSite of lock.callSites) {
-      if (!endpointMatches(callSite, advisory)) continue;
+      if (!endpointMatches(callSite, advisory)) {
+        if (endpointMayMatch(callSite, advisory) && triggerReasons(callSite, advisory.trigger).length > 0) {
+          possible.push({ advisory, callSite, reasons: [`builds the path at runtime (${describe(callSite)}); affected if it reaches ${advisory.endpoint.path}`] });
+        }
+        continue;
+      }
       hitsPerAdvisory.set(advisory.id, (hitsPerAdvisory.get(advisory.id) ?? 0) + 1);
       const reasons = triggerReasons(callSite, advisory.trigger);
       if (reasons.length > 0) affected.push({ advisory, callSite, reasons });
@@ -706,7 +720,7 @@ function matchAdvisories(lock, advisories, options = {}) {
     daysUntil: Math.round((Date.parse(advisory.effectiveDate) - today) / DAY_MS),
     callSites: hitsPerAdvisory.get(advisory.id) ?? 0
   })).filter((u) => present.has(u.advisory.provider) && u.daysUntil >= 0 && u.daysUntil <= horizon).sort((a, b) => a.daysUntil - b.daysUntil || cmp2(a.advisory.id, b.advisory.id));
-  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), upcoming };
+  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), possible: possible.sort(byFinding), upcoming };
 }
 function endpointMatches(site, advisory) {
   const pattern = advisory.endpoint;
@@ -715,6 +729,30 @@ function endpointMatches(site, advisory) {
   if (pattern.hosts && !(site.host && pattern.hosts.includes(site.host))) return false;
   return pathMatches(site.endpoint, pattern);
 }
+function endpointMayMatch(site, advisory) {
+  const pattern = advisory.endpoint;
+  if (site.provider !== advisory.provider || site.endpoint === null) return false;
+  if (pattern.method !== "*" && site.method !== null && site.method !== pattern.method) return false;
+  if (pattern.hosts && site.host && !pattern.hosts.includes(site.host)) return false;
+  if (!/\{[^}]*\}/.test(site.endpoint)) return false;
+  const known = segments(site.endpoint);
+  const runtimeAt = known.findIndex(isRuntime);
+  const literals = segments(pattern.path).filter((p) => !/[*{]/.test(p));
+  if (!literals.some((l) => known.slice(0, runtimeAt < 0 ? known.length : runtimeAt).includes(l))) return false;
+  return segmentsMayMatch(known, segments(pattern.path));
+}
+var segments = (p) => p.split("/").filter(Boolean);
+var isRuntime = (seg) => /^\{[^}]*\}$/.test(seg);
+function segmentsMayMatch(site, pattern) {
+  if (pattern.length === 0) return site.length === 0;
+  const [p, ...prest] = pattern;
+  if (p === "**") return segmentsMayMatch(site, prest) || site.length > 0 && segmentsMayMatch(site.slice(1), pattern);
+  if (site.length === 0) return false;
+  const [s, ...srest] = site;
+  if (isRuntime(s)) return srest.length === 0 || segmentsMayMatch(srest, prest);
+  if (!pathMatches(`/${s}`, { path: `/${p}` })) return false;
+  return segmentsMayMatch(srest, prest);
+}
 function pathMatches(endpoint, pattern) {
   const sample = endpoint.replace(/\{[^}]*\}/g, "\0");
   let re = "";
@@ -857,7 +895,11 @@ function collectConsts(ctx) {
   for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
     const list = decl.getVariableStatement()?.getDeclarationKind();
     const init = decl.getInitializer();
-    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) ctx.consts.set(decl.getName(), init);
+    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) {
+      ctx.consts.set(decl.getName(), init);
+      ctx.declared ??= /* @__PURE__ */ new Map();
+      ctx.declared.set(decl.getName(), [...ctx.declared.get(decl.getName()) ?? [], init]);
+    }
   }
 }
 function collectClients(ctx) {
@@ -990,7 +1032,7 @@ function httpSite(ctx, call, lib, url, method, options, params) {
   const surface = emptySurface();
   surface.headers = headersOf(ctx, options);
   surface.query = [...query, ...objectEntries(ctx, params)];
-  const provider = host ? providerForHost(host)?.id ?? null : null;
+  const provider = providerOf(host, path13);
   return {
     call,
     options,
@@ -1172,9 +1214,16 @@ function evalString(ctx, node, depth = 0) {
     }
   }
   if (Node.isIdentifier(expr)) {
-    const init = ctx.consts.get(expr.getText());
+    const init = nearestConst(ctx, expr) ?? ctx.consts.get(expr.getText());
     return init && init !== node ? evalString(ctx, init, depth + 1) : void 0;
   }
+  if (Node.isCallExpression(expr)) {
+    const callee = expr.getExpression();
+    const args = expr.getArguments();
+    if (Node.isPropertyAccessExpression(callee) && callee.getName() === "toString" && args.length === 0) return evalString(ctx, callee.getExpression(), depth + 1);
+    if (Node.isIdentifier(callee) && callee.getText() === "String" && args.length === 1) return evalString(ctx, args[0], depth + 1);
+  }
+  if (Node.isPropertyAccessExpression(expr) && expr.getName() === "href") return evalString(ctx, expr.getExpression(), depth + 1);
   if (Node.isNewExpression(expr) && expr.getExpression().getText() === "URL") {
     const [p, base] = expr.getArguments();
     const pathPart = evalString(ctx, p, depth + 1);
@@ -1183,6 +1232,18 @@ function evalString(ctx, node, depth = 0) {
   }
   return void 0;
 }
+function nearestConst(ctx, id) {
+  const inits = ctx.declared?.get(id.getText());
+  if (!inits || inits.length < 2) return void 0;
+  let best;
+  for (const init of inits) {
+    const scope = init.getFirstAncestor((a) => Node.isBlock(a) || Node.isSourceFile(a));
+    if (!scope || id.getPos() < scope.getPos() || id.getEnd() > scope.getEnd()) continue;
+    const size = scope.getEnd() - scope.getPos();
+    if (!best || size < best.size) best = { init, size };
+  }
+  return best?.init;
+}
 function placeholder(node) {
   const expr = unwrap(node);
   if (Node.isIdentifier(expr)) return `{${expr.getText()}}`;
@@ -1190,6 +1251,53 @@ function placeholder(node) {
   if (Node.isCallExpression(expr) && expr.getArguments().length === 1) return placeholder(expr.getArguments()[0]);
   return "{}";
 }
+function providerOf(host, path13) {
+  if (host) return providerForHost(host)?.id ?? null;
+  return path13 ? providerForPath(path13)?.id ?? null : null;
+}
+function urlParts(value2) {
+  const v = value2.trim().replace(/\{\{\s*([^{}]*?)\s*\}\}/g, "{$1}");
+  if (/^(?:https?:)?\/\//i.test(v)) return parseUrl(v);
+  const asPath = "/" + v.replace(/^\{[^}]*\}(?=\/)/, "").replace(/^\/+/, "");
+  if (providerForPath(asPath.split(/[?#]/)[0])) return parseUrl(asPath);
+  return void 0;
+}
+function looseUrlSites(sf, file, found) {
+  const ctx = { sf, imports: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map(), http: /* @__PURE__ */ new Map(), sdk: /* @__PURE__ */ new Map() };
+  collectConsts(ctx);
+  const covered = new Set(found.map((f) => `${f.site.provider} ${f.site.endpoint}`));
+  const inFoundCall = (node) => found.some((f) => node.getPos() >= f.call.getPos() && node.getEnd() <= f.call.getEnd());
+  const candidates = [];
+  for (const node of sf.getDescendants()) {
+    if (!Node.isStringLiteral(node) && !Node.isNoSubstitutionTemplateLiteral(node) && !Node.isTemplateExpression(node) && !isConcat(node)) continue;
+    const parent = node.getParent();
+    if (parent && (Node.isTemplateSpan(parent) || isConcat(parent) || Node.isImportDeclaration(parent) || Node.isExportDeclaration(parent))) continue;
+    if (parent && Node.isPropertyAssignment(parent) && parent.getNameNode() === node) continue;
+    if (inFoundCall(node)) continue;
+    const value2 = evalString(ctx, node);
+    const parts = value2 === void 0 ? void 0 : urlParts(value2);
+    if (!parts?.path || parts.path === "/") continue;
+    const provider = providerOf(parts.host, parts.path);
+    if (provider) candidates.push({ node, host: parts.host, path: parts.path, query: parts.query, provider });
+  }
+  const sites = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of candidates) {
+    const key = `${c.provider} ${c.path}`;
+    if (covered.has(key) || seen.has(key)) continue;
+    if (candidates.some((o) => o.provider === c.provider && o.path !== c.path && o.path.startsWith(`${c.path}/`))) continue;
+    if (found.some((f) => f.site.provider === c.provider && f.site.endpoint?.startsWith(`${c.path}/`))) continue;
+    seen.add(key);
+    const { line, column } = sf.getLineAndColumnAtPos(c.node.getStart());
+    const surface = emptySurface();
+    surface.query = c.query;
+    sites.push({ file, line, column, provider: c.provider, kind: "http", client: "url", method: null, host: c.host, endpoint: c.path, resolved: true, surface });
+  }
+  return sites;
+}
+function isConcat(node) {
+  return Node.isBinaryExpression(node) && node.getOperatorToken().getKind() === SyntaxKind.PlusToken;
+}
 function joinUrl(base, url) {
   if (url === void 0) return void 0;
   if (!base || /^[a-z]+:\/\//i.test(url)) return url;
@@ -1583,6 +1691,7 @@ function extractPython(source, file) {
     collectConsts2(root, ctx);
     collectClients2(root, ctx);
     const sites = [];
+    const calls = [];
     for (const call of root.descendantsOfType("call")) {
       if (!call) continue;
       const site = httpCall(ctx, call) ?? sdkCall(ctx, call);
@@ -1592,8 +1701,9 @@ function extractPython(source, file) {
       site.column = call.startPosition.column + 1;
       addResponseSurface2(call, site);
       sites.push(site);
+      calls.push(call);
     }
-    return sites;
+    return [...sites, ...looseUrls(ctx, root, file, sites, calls)];
   } finally {
     tree.delete();
   }
@@ -1698,7 +1808,7 @@ function httpCall(ctx, call) {
   const surface = emptySurface2();
   surface.headers = [...binding.kind === "http-client" ? binding.headers : [], ...dictEntries(ctx, keyword(args, "headers"))].map((h) => ({ ...h, name: h.name.toLowerCase() }));
   surface.query = [...query, ...dictEntries(ctx, keyword(args, "params"))];
-  const provider = host ? providerForHost(host)?.id ?? null : null;
+  const provider = providerOf(host, path13);
   return { file: "", line: 0, column: 0, provider, kind: "http", client: binding.lib, method, host, endpoint: path13, resolved: Boolean(provider && path13 && method), surface };
 }
 function sdkCall(ctx, call) {
@@ -1983,7 +2093,7 @@ function evalString2(ctx, node, depth = 0) {
     return (l ?? placeholder2(n.childForFieldName("left") ?? void 0)) + (r ?? placeholder2(n.childForFieldName("right") ?? void 0));
   }
   if (n.type === "identifier") {
-    const init = ctx.consts.get(n.text);
+    const init = localAssignment(n) ?? ctx.consts.get(n.text);
     return init && init.id !== node.id ? evalString2(ctx, init, depth + 1) : void 0;
   }
   if (n.type === "call") {
@@ -1993,6 +2103,52 @@ function evalString2(ctx, node, depth = 0) {
   }
   return void 0;
 }
+function localAssignment(use3) {
+  let scope = use3.parent;
+  while (scope && scope.type !== "function_definition" && scope.type !== "module") scope = scope.parent;
+  if (!scope || scope.type === "module") return void 0;
+  let last;
+  for (const assign of scope.descendantsOfType("assignment")) {
+    if (!assign || assign.endIndex > use3.startIndex) continue;
+    const left = assign.childForFieldName("left");
+    if (left?.type !== "identifier" || left.text !== use3.text) continue;
+    let owner = assign.parent;
+    while (owner && owner.type !== "function_definition") owner = owner.parent;
+    if (owner?.id !== scope.id) continue;
+    last = assign.childForFieldName("right") ?? void 0;
+  }
+  return last;
+}
+function looseUrls(ctx, root, file, sites, calls) {
+  const covered = new Set(sites.map((s) => `${s.provider} ${s.endpoint}`));
+  const inCall = (n) => calls.some((c) => n.startIndex >= c.startIndex && n.endIndex <= c.endIndex);
+  const candidates = [];
+  for (const node of root.descendantsOfType(["string", "concatenated_string", "binary_operator"])) {
+    if (!node) continue;
+    if (node.type === "binary_operator" && node.childForFieldName("operator")?.text !== "+") continue;
+    const p = node.parent;
+    if (p && (p.type === "concatenated_string" || p.type === "interpolation" || p.type === "expression_statement" || p.type === "binary_operator" && p.childForFieldName("operator")?.text === "+")) continue;
+    if (inCall(node)) continue;
+    const value2 = evalString2(ctx, node);
+    const parts = value2 === void 0 ? void 0 : urlParts(value2);
+    if (!parts?.path || parts.path === "/") continue;
+    const provider = providerOf(parts.host, parts.path);
+    if (provider) candidates.push({ node, host: parts.host, path: parts.path, query: parts.query, provider });
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of candidates) {
+    const key = `${c.provider} ${c.path}`;
+    if (covered.has(key) || seen.has(key)) continue;
+    if (candidates.some((o) => o.provider === c.provider && o.path !== c.path && o.path.startsWith(`${c.path}/`))) continue;
+    if (sites.some((s) => s.provider === c.provider && s.endpoint?.startsWith(`${c.path}/`))) continue;
+    seen.add(key);
+    const surface = emptySurface2();
+    surface.query = c.query;
+    out.push({ file, line: c.node.startPosition.row + 1, column: c.node.startPosition.column + 1, provider: c.provider, kind: "http", client: "url", method: null, host: c.host, endpoint: c.path, resolved: true, surface });
+  }
+  return out;
+}
 function placeholder2(n) {
   if (!n) return "{}";
   const e = unwrap2(n);
@@ -2056,16 +2212,19 @@ function extractCallSites(rootDir) {
     compilerOptions: { allowJs: true }
   });
   const found = [];
+  const loose = [];
   for (const abs of sources) {
     const rel = toPosix(path4.relative(root, abs));
     const sf = project.createSourceFile(`/${rel}`, readFileSync3(abs, "utf8"), {
       overwrite: true,
       scriptKind: SCRIPT_KINDS[path4.extname(abs)] ?? ScriptKind.TS
     });
-    for (const f of extractFromFile(sf, rel)) {
+    const inFile = extractFromFile(sf, rel);
+    for (const f of inFile) {
       addResponseSurface(f);
       found.push(f);
     }
+    loose.push(...looseUrlSites(sf, rel, inFile));
   }
   found.sort((a, b) => a.site.file.localeCompare(b.site.file) || a.site.line - b.site.line || a.site.column - b.site.column);
   const skipped = [];
@@ -2082,7 +2241,7 @@ function extractCallSites(rootDir) {
       skipped.push({ file: rel, reason: err instanceof Error ? err.message : String(err) });
     }
   }
-  const callSites = [...found.map((f) => f.site), ...pythonSites].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.column - b.column);
+  const callSites = [...found.map((f) => f.site), ...loose, ...pythonSites].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.column - b.column);
   return {
     root,
     filesScanned: sources.length + python.length - skipped.length,
@@ -3860,7 +4019,7 @@ function renderPrBody({ advisory, repair, shapeSource }) {
     `Migration note: ${advisory.migrationNote}`,
     "",
     "---",
-    "Opened by [SHAPI](https://github.com/SriVarshini09/YC). A change is kept only when its contract test failed before it and passes after it."
+    "Opened by [SHAPI](https://shapi.dev). A change is kept only when its contract test failed before it and passes after it."
   ];
   return lines.join("\n") + "\n";
 }
@@ -3898,7 +4057,7 @@ function bundledDir(published, monorepo) {
 }
 
 // packages/cli/src/scan.ts
-var VERSION = "0.2.0";
+var VERSION = "0.3.0";
 var DEFAULT_ADVISORIES = bundledDir("advisories", "advisories");
 async function preparePython() {
   await loadPythonParser().catch(() => void 0);
@@ -3925,8 +4084,10 @@ function scan(target, opts) {
     const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES);
     const match = matchAdvisories(lock, advisories, { now });
     const failing = failOn === "none" ? [] : match.affected.filter((f) => SEVERITY_RANK[f.advisory.severity] <= SEVERITY_RANK[failOn]);
+    const where = opts.repo ? `--repo ${opts.repo}` : label2;
     return {
       label: label2,
+      fixTarget: /\s/.test(where) ? JSON.stringify(where) : where,
       filesScanned: extracted.filesScanned,
       skipped: extracted.skipped,
       lock,
@@ -3960,6 +4121,7 @@ function toJsonReport(o) {
     filesScanned: o.filesScanned,
     affected: o.match.affected.map(finding),
     exposed: o.match.exposed.map(finding),
+    possible: o.match.possible.map(finding),
     upcoming: o.match.upcoming.map((u) => ({
       advisory: u.advisory.id,
       provider: u.advisory.provider,
@@ -4093,13 +4255,19 @@ function originRepo(dir) {
 
 // packages/cli/src/report.ts
 import { styleText } from "util";
+var APP_URL = "https://app.shapi.dev";
+function title(color) {
+  const paint = (style, s) => color ? styleText(style, s) : s;
+  return `${paint("bold", "SHAPI")}  ${paint("dim", "third-party API changes, caught and fixed")}`;
+}
 function renderText(o, color) {
   const paint = (style, s) => color ? styleText(style, s) : s;
   const out = [];
   const { lock, match } = o;
   const providers = lock.providers;
   const unresolved = lock.callSites.filter((c) => !c.resolved).length;
-  out.push(`${paint("bold", "SHAPI scan")}  ${o.label}`);
+  out.push(title(color));
+  out.push(`${paint("bold", "scan")}  ${o.label}`);
   out.push(
     paint(
       "dim",
@@ -4120,6 +4288,11 @@ function renderText(o, color) {
   if (match.affected.length === 0) out.push("  none");
   for (const f of match.affected) out.push(...renderFinding(f, paint));
   out.push("");
+  if (match.possible.length > 0) {
+    out.push(paint("bold", `Possibly affected, check these (${match.possible.length})`));
+    for (const f of match.possible) out.push(...renderFinding(f, paint));
+    out.push("");
+  }
   if (match.exposed.length > 0) {
     out.push(paint("bold", `Exposed, not affected (${match.exposed.length})`));
     for (const f of match.exposed) {
@@ -4137,6 +4310,10 @@ function renderText(o, color) {
     out.push("");
     out.push(paint("dim", `${plural(unresolved, "call site")} could not be fully resolved (see --json or --out api.lock).`));
   }
+  out.push("");
+  out.push(paint("bold", "Next"));
+  if (match.affected.length > 0) out.push(`  npx shapi-cli fix ${o.fixTarget}  ${paint("dim", "fix the affected call sites test-first (nothing changes until you add --write or --pr)")}`);
+  out.push(`  ${APP_URL}  ${paint("dim", "install the GitHub App: every push scanned, verified fix PRs, and a dashboard")}`);
   return out.join("\n") + "\n";
 }
 var SEVERITY_STYLE = { critical: "red", high: "yellow", medium: "cyan", low: "gray" };
@@ -4167,7 +4344,11 @@ var processIo = {
 async function run(argv, io = processIo, fixDeps = {}) {
   let exitCode = 0;
   await preparePython();
-  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
+  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).addHelpText("beforeAll", `${title(Boolean(io.isTTY))}
+`).addHelpText("afterAll", `
+Run it without installing: npx shapi-cli scan .
+Fix PRs and a dashboard on every push: install the GitHub App at ${APP_URL}
+`).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
   program.command("scan").description("Scan a repository and report affected call sites").argument("[path]", "directory to scan", ".").option("--json", "print a JSON report (includes the api.lock)").option("--out <file>", "write the api.lock to this file").option("--repo <url>", "clone a git repository (shallow) into a temp dir and scan it").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--fail-on <severity>", "exit 1 when an affected call site is at least this severe (critical|high|medium|low|none)", "critical").option("--no-color", "disable color").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action((target, opts) => {
     const outcome = scan(opts.repo ? void 0 : target, opts);
     if (opts.json) io.stdout(JSON.stringify(toJsonReport(outcome), null, 2) + "\n");
@@ -4175,8 +4356,13 @@ async function run(argv, io = processIo, fixDeps = {}) {
     exitCode = outcome.exitCode;
   });
   program.command("fix").description("Repair affected call sites test-first: generate a contract test, apply the recipe (or Claude), keep the change only if the test passes").argument("[path]", "repository to fix", ".").option("--repo <url>", "clone a GitHub repository (shallow) and fix it; with --pr the PR goes to that repository").option("--advisory <id>", "only this advisory").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--db <file>", "shape store with canary observations (checked before recordings)", ".shapi/shapes.db").option("--recordings <dir>", "recorded response sequences (default: the bundled fixtures/recordings/)").option("--llm", "ask Claude when no recipe fixes the call site (needs ANTHROPIC_API_KEY)").option("--write", "write the fix and the contract test into the local repository").option("--pr", "open a pull request with the fix and the contract test").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action(async (target, opts) => {
+    io.stdout(`${title(Boolean(io.isTTY))}
+`);
     const outcomes = await fix(opts.repo ? void 0 : target, opts, { log: (l) => io.stdout(`${l}
 `), ...fixDeps });
+    if (outcomes.some((o) => o.result?.status === "fixed") && !opts.write && !opts.pr) io.stdout("\nNothing was changed. Add --write to keep these fixes, or --pr to open pull requests.\n");
+    io.stdout(`Fix PRs and a dashboard on every push: install the GitHub App at ${APP_URL}
+`);
     exitCode = outcomes.every((o) => o.result?.status === "fixed" || o.result?.status === "already-handled") ? 0 : 1;
   });
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapi-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Find the code that breaks when a third-party API changes, and fix it test-first.",
   "keywords": [
     "api",
@@ -14,7 +14,8 @@
   ],
   "type": "module",
   "bin": {
-    "shapi": "bin/shapi.js"
+    "shapi": "bin/shapi.js",
+    "shapi-cli": "bin/shapi.js"
   },
   "files": [
     "bin",
@@ -28,14 +29,10 @@
     "node": ">=22"
   },
   "license": "Apache-2.0",
-  "homepage": "https://github.com/SriVarshini09/YC#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/SriVarshini09/YC.git",
-    "directory": "packages/cli"
-  },
+  "homepage": "https://shapi.dev",
   "bugs": {
-    "url": "https://github.com/SriVarshini09/YC/issues"
+    "url": "https://github.com/SriVarshini09/shapi-advisories/issues",
+    "email": "sri@shapi.dev"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^1.1.0",