shippingszn 0.10.0 → 0.10.1

package/README.md

@@ -27,11 +27,13 @@ will be; the Fix Kit is how you fix what it finds.
 The CLI **never writes, modifies, or deletes** any files - it only reads. (The
 one exception is a tiny first-run marker under your config dir,
 `~/.config/shippingszn/seen`, used to show the telemetry notice once.) By
-default each run creates a scan handoff for checkout and sends one anonymous
-Wall report-card summary with score, severity counts, files scanned, scanner
-version, and safe stack tags. It never uploads source code, repo URLs, project
-names, secrets, handles, or emails. Pass `--no-telemetry` to run fully offline
-(zero network calls).
+default each run makes two anonymous requests: a scan handoff for checkout that
+carries finding-level detail (severity, checklist item, `file:line`, and a short
+evidence snippet — secret values always redacted before upload), and an
+aggregate Wall summary with score, severity counts, files scanned, scanner
+version, and safe stack tags. Neither uploads full source files, repo URLs,
+project names, unredacted secrets, handles, or emails. Pass `--no-telemetry` to
+run fully offline (zero network calls). Details in [Telemetry](#telemetry).
 
 **The free scan is the full diagnosis.** Human output prints a verdict, a
 higher-is-better Readiness Score, severity counts, and **every finding grouped
@@ -76,15 +78,23 @@ exactly what's wrong; the Launch Fix Kit is how you fix it.
 
 ## Telemetry
 
-Plain `npx shippingszn@latest` sends one anonymous Wall summary automatically.
-The stored row is intentionally small: score, launch label, files scanned,
-finding counts by severity, detected stack tags, scanner version, and timestamp.
-It never includes code, file paths, filenames, project names, repo URLs,
-secrets, emails, or any finding-level detail.
-
-On the **first run on a machine**, the CLI prints the exact anonymous payload it
-would send (to stderr, so it never corrupts `--json` output) and a note that you
-can turn it off. Telemetry is default-on but fully transparent and opt-out-able:
+Plain `npx shippingszn@latest` makes **two** anonymous requests per run:
+
+1. **Scan handoff** (`POST /api/scan-results`) — powers the `/fix-kit` link the
+   CLI prints. It carries finding-level detail: each finding's severity, the
+   checklist item it maps to, its `file:line` location, and a short evidence
+   snippet from the matched line. Secret values are always redacted to a
+   `abc123…x9z2` form before upload. It does not include your repo URL, project
+   name, or full source files.
+2. **Aggregate Wall summary** (`POST /api/wall`) — intentionally small: score,
+   launch label, files scanned, finding counts by severity, detected stack
+   tags, scanner version, and timestamp. No paths, no filenames, no
+   finding-level detail.
+
+On the **first run on a machine**, the CLI prints a description of both requests
+plus the exact aggregate payload (to stderr, so it never corrupts `--json`
+output) and a note that you can turn it off. Telemetry is default-on but fully
+transparent and opt-out-able:
 
 ```bash
 npx shippingszn@latest --no-telemetry   # zero network calls, fully offline

package/dist/index.js

@@ -99,22 +99,59 @@ var TEXT_EXT = /* @__PURE__ */ new Set([
 var MAX_FILE_BYTES = 512 * 1024;
 var MAX_DEPTH = 24;
 var MAX_FILES = 5e4;
-async function listFiles(rootDir) {
+var ScanInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ScanInputError";
+  }
+};
+var ScanLimitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ScanLimitError";
+  }
+};
+async function listFiles(rootDir, options = {}) {
+  const maxFiles = options.maxFiles ?? MAX_FILES;
+  const maxDepth = options.maxDepth ?? MAX_DEPTH;
+  if (!Number.isSafeInteger(maxFiles) || maxFiles <= 0) {
+    throw new ScanInputError("maxFiles must be a positive safe integer");
+  }
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 0) {
+    throw new ScanInputError("maxDepth must be a non-negative safe integer");
+  }
+  let rootStat;
+  try {
+    rootStat = await fs.stat(rootDir);
+  } catch {
+    throw new ScanInputError(
+      `Scan target does not exist or cannot be read: ${rootDir}`
+    );
+  }
+  if (!rootStat.isDirectory()) {
+    throw new ScanInputError(`Scan target is not a directory: ${rootDir}`);
+  }
   const out = [];
   const visited = /* @__PURE__ */ new Set();
-  const rootResolved = path.resolve(rootDir);
+  const rootResolved = await fs.realpath(rootDir);
+  visited.add(rootResolved);
   const allowed = getNotIgnoredFiles(rootDir);
   async function walk(dir, depth) {
-    if (depth > MAX_DEPTH) return;
-    if (out.length >= MAX_FILES) return;
+    if (depth > maxDepth) {
+      throw new ScanLimitError(
+        `Scan stopped: directory depth exceeds the ${maxDepth}-level safety limit.`
+      );
+    }
     let entries;
     try {
       entries = await fs.readdir(dir, { withFileTypes: true });
     } catch {
+      if (depth === 0) {
+        throw new ScanInputError(`Scan target cannot be read: ${rootDir}`);
+      }
       return;
     }
     for (const entry of entries) {
-      if (out.length >= MAX_FILES) return;
       if (entry.name.startsWith(".") && DEFAULT_IGNORES.has(entry.name))
         continue;
       if (DEFAULT_IGNORES.has(entry.name)) continue;
@@ -153,6 +190,11 @@ async function listFiles(rootDir) {
         } catch {
           continue;
         }
+        if (out.length >= maxFiles) {
+          throw new ScanLimitError(
+            `Scan stopped: project contains more than ${maxFiles.toLocaleString("en-US")} files, above the safety limit.`
+          );
+        }
         out.push({ absPath: abs, relPath: rel, size });
       }
     }
@@ -172,10 +214,27 @@ function isTextFile(file) {
 }
 async function readFileSafe(file) {
   if (file.size > MAX_FILE_BYTES) return null;
+  let handle = null;
   try {
-    return await fs.readFile(file.absPath, "utf8");
+    handle = await fs.open(file.absPath, "r");
+    const buffer = Buffer.allocUnsafe(MAX_FILE_BYTES + 1);
+    let offset = 0;
+    while (offset < buffer.length) {
+      const { bytesRead } = await handle.read(
+        buffer,
+        offset,
+        buffer.length - offset,
+        offset
+      );
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+    }
+    if (offset > MAX_FILE_BYTES) return null;
+    return buffer.subarray(0, offset).toString("utf8");
   } catch {
     return null;
+  } finally {
+    await handle?.close().catch(() => void 0);
   }
 }
 async function fileExists(p) {
@@ -4189,6 +4248,30 @@ var PKG_VERSION = (() => {
   const pkg = require2("../package.json");
   return pkg.version;
 })();
+var CliInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CliInputError";
+  }
+};
+function normalizeBaseUrl(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new CliInputError(`Invalid --base-url value: ${raw}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new CliInputError("--base-url must use http:// or https://");
+  }
+  if (parsed.username || parsed.password) {
+    throw new CliInputError("--base-url must not contain credentials");
+  }
+  parsed.hash = "";
+  parsed.search = "";
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "") || "/";
+  return parsed.toString().replace(/\/+$/, "");
+}
 function parseArgs(argv2) {
   const opts = {
     cwd: process.cwd(),
@@ -4200,8 +4283,32 @@ function parseArgs(argv2) {
     proof: true,
     telemetry: true
   };
+  let targetWasSet = false;
+  let positionalOnly = false;
+  const requireValue = (flag, index) => {
+    const value = argv2[index + 1];
+    if (!value || value.startsWith("-")) {
+      throw new CliInputError(`${flag} requires a value`);
+    }
+    return value;
+  };
+  const setTarget = (raw) => {
+    if (targetWasSet) {
+      throw new CliInputError("Specify exactly one scan target");
+    }
+    opts.cwd = path21.resolve(raw);
+    targetWasSet = true;
+  };
   for (let i = 0; i < argv2.length; i++) {
     const a = argv2[i];
+    if (positionalOnly) {
+      setTarget(a);
+      continue;
+    }
+    if (a === "--") {
+      positionalOnly = true;
+      continue;
+    }
     if (a === "--help" || a === "-h") opts.help = true;
     else if (a === "--version" || a === "-v") opts.version = true;
     else if (a === "--json") opts.json = true;
@@ -4209,10 +4316,19 @@ function parseArgs(argv2) {
     else if (a === "--no-color") opts.noColor = true;
     else if (a === "--no-telemetry" || a === "--no-wall" || a === "--no-publish")
       opts.telemetry = false;
-    else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
-    else if (a === "--cwd") opts.cwd = path21.resolve(argv2[++i] ?? opts.cwd);
-    else if (!a.startsWith("-")) opts.cwd = path21.resolve(a);
+    else if (a === "--base-url") {
+      opts.baseUrl = requireValue(a, i);
+      i += 1;
+    } else if (a === "--cwd") {
+      setTarget(requireValue(a, i));
+      i += 1;
+    } else if (a.startsWith("-")) {
+      throw new CliInputError(`Unknown option: ${a}`);
+    } else {
+      setTarget(a);
+    }
   }
+  opts.baseUrl = normalizeBaseUrl(opts.baseUrl);
   return opts;
 }
 function color(enabled) {
@@ -4277,16 +4393,19 @@ function printTelemetryDisclosure(info) {
   const stackList = stack.length ? stack.join(", ") : "(none detected)";
   process.stderr.write(
     `
-shippingszn sends one anonymous telemetry ping per run (this keeps the public
-Wall and aggregate stats current). This run would send exactly:
-  - score: ${score}
-  - severity counts: ${totals.critical} critical, ${totals.high} high, ${totals.medium} medium, ${totals.lower} lower
-  - files scanned: ${filesScanned}
-  - scanner version: ${scannerVersion}
-  - stack tags: ${stackList}
-It never includes your code, file paths, filenames, project name, repo URL,
-secrets, emails, or any finding-level detail. Disable it anytime with
---no-telemetry (the CLI then runs fully offline). This notice shows once per machine.
+shippingszn sends two anonymous telemetry requests per run by default:
+1. A scan handoff (creates your /fix-kit link): each finding's severity,
+   checklist item, file:line location, and a short evidence snippet from the
+   matched line. Secret values are always redacted before upload.
+2. An aggregate Wall ping. This run's aggregate payload:
+   - score: ${score}
+   - severity counts: ${totals.critical} critical, ${totals.high} high, ${totals.medium} medium, ${totals.lower} lower
+   - files scanned: ${filesScanned}
+   - scanner version: ${scannerVersion}
+   - stack tags: ${stackList}
+Neither request includes your repo URL, project name, full source files, or
+unredacted secret values. Disable both with --no-telemetry (the CLI then runs
+fully offline, zero network calls). This notice shows once per machine.
 
 `
   );
@@ -4320,11 +4439,13 @@ finding \u2014 severity, the checklist item it maps to, the file and line, and w
 wrong \u2014 plus a 0-100 readiness score. The $49 Launch Fix Kit is the REMEDIATION
 layer: per-finding fix instructions, prompts to paste straight into your AI
 builder, the 58-item launch workbook, unlimited re-scans, and launch monitoring.
-Read-only on disk. By default each run sends one anonymous, transparent
-telemetry ping (score, severity counts, file count, scanner version, stack tags
-\u2014 never code, paths, project names, or finding-level detail) and creates a scan
-handoff so checkout can carry this exact scan into the Fix Kit; pass
---no-telemetry to disable both. Exit code non-zero if any critical findings.
+Read-only on disk. By default each run sends two anonymous requests: a scan
+handoff carrying finding-level detail (severity, checklist item, file:line, and
+a short evidence snippet \u2014 secret values always redacted) so checkout can carry
+this exact scan into the Fix Kit, and an aggregate Wall ping (score, severity
+counts, file count, scanner version, stack tags). Neither includes your repo
+URL, project name, or full source files. Pass --no-telemetry to disable both.
+Exit code non-zero if any critical findings.
 `
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Read-only launch inspector for AI-built apps.",
   "license": "MIT",
   "type": "module",