shippingszn 0.3.0 → 0.5.0

package/dist/checks/public-assets.js

@@ -1,4 +1,55 @@
+import { readFileSafe } from "../scan.js";
 import { findPublicDirs, isAssetEmittedDynamically } from "./helpers.js";
+/**
+ * Parse a robots.txt body and return true if the `User-agent: *` block (or
+ * any wildcard block) disallows everything (`Disallow: /`). That's a
+ * declaration that the site intentionally opts out of all crawling, so we
+ * shouldn't nag about a missing sitemap — sitemaps for disallowed sites are
+ * contradictory.
+ */
+function robotsDisallowsAll(content) {
+    const lines = content.split(/\r?\n/);
+    let inWildcardBlock = false;
+    let sawWildcardBlock = false;
+    for (const raw of lines) {
+        // Strip comments and trailing whitespace.
+        const line = raw.replace(/#.*$/, "").trim();
+        if (line === "") {
+            // Blank line ends the current block.
+            inWildcardBlock = false;
+            continue;
+        }
+        const match = line.match(/^([A-Za-z-]+)\s*:\s*(.*)$/);
+        if (!match)
+            continue;
+        const directive = match[1].toLowerCase();
+        const value = match[2].trim();
+        if (directive === "user-agent") {
+            inWildcardBlock = value === "*";
+            if (inWildcardBlock)
+                sawWildcardBlock = true;
+            continue;
+        }
+        if (inWildcardBlock && directive === "disallow" && value === "/") {
+            return true;
+        }
+    }
+    // If the file has no wildcard block at all, conservatively assume it
+    // doesn't disallow everything (some sites only target specific bots).
+    void sawWildcardBlock;
+    return false;
+}
+async function hasDisallowAllRobots(ctx) {
+    const robotsFiles = ctx.files.filter((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
+    for (const file of robotsFiles) {
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        if (robotsDisallowsAll(content))
+            return true;
+    }
+    return false;
+}
 export async function checkRobotsTxt(ctx) {
     const has = ctx.files.some((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
     if (has)
@@ -26,6 +77,11 @@ export async function checkSitemapXml(ctx) {
     const dirs = await findPublicDirs(ctx);
     if (dirs.length === 0)
         return [];
+    // If the project has declared itself non-indexable via robots.txt
+    // (User-agent: * / Disallow: /), a sitemap would be contradictory.
+    // Suppress the nag — the site owner has made a deliberate choice.
+    if (await hasDisallowAllRobots(ctx))
+        return [];
     return [
         {
             checkId: "missing-sitemap-xml",

package/dist/index.js

@@ -4,6 +4,7 @@ import * as process from "node:process";
 import { ALL_CHECKS } from "./checks.js";
 import { listFiles, getTrackedFiles } from "./scan.js";
 import { CHECKLIST_ITEMS, permalinkFor } from "./items.js";
+import { publishScan } from "./publish.js";
 const UNTRACKED_DOWNGRADE = {
     critical: "lower",
     high: "lower",
@@ -30,7 +31,7 @@ function applyTrackingAwareSeverity(findings, tracked) {
     });
 }
 const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = "0.3.0";
+const PKG_VERSION = "0.5.0";
 function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),
@@ -166,6 +167,20 @@ async function run() {
         totals,
         findings: enriched,
     };
+    // Best-effort anonymous publish to the Wall of Launches. Runs once per
+    // scan, before any return path. Never blocks on network failure. Full
+    // opt-out via SHIPPINGSZN_DISABLE_PUBLISH=1.
+    let publishResult = "skipped";
+    try {
+        publishResult = await publishScan(totals, files.length, {
+            cwd: opts.cwd,
+            baseUrl: opts.baseUrl,
+            scannerVersion: PKG_VERSION,
+        });
+    }
+    catch {
+        /* never block on wall publish */
+    }
     if (opts.json) {
         process.stdout.write(JSON.stringify(report, null, 2) + "\n");
         return totals.critical > 0 ? 1 : 0;
@@ -184,6 +199,9 @@ async function run() {
     process.stdout.write(c.dim(`Scanned ${files.length} files in ${opts.cwd}\n\n`));
     if (enriched.length === 0) {
         process.stdout.write(c.green("✓ No findings. Nice work — still walk through the full checklist before launch.\n\n"));
+        if (publishResult === "published") {
+            process.stdout.write(c.dim(`Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n(opt out: SHIPPINGSZN_DISABLE_PUBLISH=1)\n\n`));
+        }
         return 0;
     }
     // Strip ASCII control characters (including ESC) so a maliciously-named
@@ -208,6 +226,9 @@ async function run() {
         process.stdout.write("\n");
     }
     process.stdout.write(`${c.bold("Summary:")} ${c.red(`${totals.critical} critical`)}, ${c.yellow(`${totals.high} high`)}, ${c.blue(`${totals.medium} medium`)}, ${c.gray(`${totals.lower} lower`)}\n`);
+    if (publishResult === "published") {
+        process.stdout.write(c.dim(`\nPosted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n(opt out: SHIPPINGSZN_DISABLE_PUBLISH=1)\n`));
+    }
     if (totals.critical > 0) {
         process.stdout.write(c.red("\nCritical findings detected. Exiting with code 1.\n"));
         return 1;

package/dist/publish.js

@@ -0,0 +1,126 @@
+/**
+ * Anonymous auto-publish of scan results to the Wall of Launches at
+ * shippingszn.com. Runs once per scan, best-effort. Never blocks the CLI
+ * on network failure — if anything goes wrong we fail silently and the
+ * scan result still prints normally.
+ *
+ * Absolute guarantees about the payload: no secrets, no paths, no
+ * filenames, no project-name-derived strings. The only thing we send
+ * is: files scanned count, findings counts by severity, detected stack
+ * tags, scanner version. Users can opt out entirely by setting
+ * SHIPPINGSZN_DISABLE_PUBLISH=1 in their environment.
+ */
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+const DEFAULT_BASE_URL = "https://shippingszn.com";
+const PUBLISH_TIMEOUT_MS = 3000;
+function shouldPublish() {
+    const v = process.env["SHIPPINGSZN_DISABLE_PUBLISH"] ?? "";
+    return v !== "1" && v.toLowerCase() !== "true" && v !== "yes";
+}
+// Detect a small list of tech-stack tags from package.json / manifest
+// files. Deliberately shallow: we only want a handful of widely-known
+// framework tags. Nothing else is read or transmitted.
+async function detectStack(cwd) {
+    const tags = new Set();
+    try {
+        const raw = await fs.readFile(path.join(cwd, "package.json"), "utf8");
+        const pkg = JSON.parse(raw);
+        const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+        const has = (n) => n in deps;
+        if (has("react"))
+            tags.add("react");
+        if (has("next"))
+            tags.add("next");
+        if (has("vue") || has("nuxt"))
+            tags.add("vue");
+        if (has("svelte") || has("@sveltejs/kit"))
+            tags.add("svelte");
+        if (has("astro"))
+            tags.add("astro");
+        if (has("express"))
+            tags.add("express");
+        if (has("fastify"))
+            tags.add("fastify");
+        if (has("hono"))
+            tags.add("hono");
+        if (has("drizzle-orm"))
+            tags.add("drizzle");
+        if (has("prisma"))
+            tags.add("prisma");
+        if (has("@supabase/supabase-js"))
+            tags.add("supabase");
+        if (has("firebase"))
+            tags.add("firebase");
+        if (has("stripe"))
+            tags.add("stripe");
+        if (has("typescript"))
+            tags.add("ts");
+        if (has("vite"))
+            tags.add("vite");
+        if (has("expo"))
+            tags.add("expo");
+        if (has("react-native"))
+            tags.add("react-native");
+    }
+    catch {
+        /* no package.json — not a node project, that's fine */
+    }
+    // Language/framework detection beyond node — cheap file-existence checks.
+    const checks = [
+        ["requirements.txt", "python"],
+        ["pyproject.toml", "python"],
+        ["Gemfile", "ruby"],
+        ["go.mod", "go"],
+        ["Cargo.toml", "rust"],
+        ["composer.json", "php"],
+        ["pom.xml", "java"],
+        ["build.gradle", "java"],
+    ];
+    for (const [file, tag] of checks) {
+        try {
+            await fs.access(path.join(cwd, file));
+            tags.add(tag);
+        }
+        catch {
+            /* not present */
+        }
+    }
+    return [...tags].slice(0, 12);
+}
+export function buildPayload(totals, filesScanned, stack, scannerVersion) {
+    const out = {
+        filesScanned,
+        findingsCritical: totals.critical ?? 0,
+        findingsHigh: totals.high ?? 0,
+        findingsMedium: totals.medium ?? 0,
+        findingsLower: totals.lower ?? 0,
+        scannerVersion,
+    };
+    if (stack.length > 0)
+        out.stack = stack;
+    return out;
+}
+export async function publishScan(totals, filesScanned, opts) {
+    if (!shouldPublish())
+        return "skipped";
+    const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+    const stack = await detectStack(opts.cwd);
+    const payload = buildPayload(totals, filesScanned, stack, opts.scannerVersion);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), PUBLISH_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${baseUrl}/api/wall`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        return res.ok ? "published" : "failed";
+    }
+    catch {
+        clearTimeout(timer);
+        return "failed";
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",