shippingszn 0.5.0 → 0.7.0

package/dist/checks/dangerous.js

@@ -23,6 +23,13 @@ const DANGEROUS_PATTERNS = [
         severity: "medium",
         message: "Wildcard CORS (Access-Control-Allow-Origin: *). Lock this down to specific origins for any authenticated endpoint.",
     },
+    {
+        id: "shell-exec-call",
+        regex: /(^|[^A-Za-z0-9_$.])(exec|execSync)\s*\(/,
+        itemId: "common-attacks",
+        severity: "high",
+        message: "Shell execution via exec/execSync — if any argument includes user input, this is a command-injection path. Prefer execFile with an argument array, or validate input strictly against an allowlist.",
+    },
 ];
 export async function checkDangerousPatterns(ctx) {
     const findings = [];
@@ -32,7 +39,16 @@ export async function checkDangerousPatterns(ctx) {
         if (isScanExempt(file.relPath))
             continue;
         const ext = path.extname(file.relPath).toLowerCase();
-        if (![".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".json", ".html"].includes(ext))
+        if (![
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs",
+            ".cjs",
+            ".json",
+            ".html",
+        ].includes(ext))
             continue;
         const content = await readFileSafe(file);
         if (!content)

package/dist/checks/index.js

@@ -9,13 +9,13 @@
  */
 import { checkHardcodedSecrets, checkConfigSecretLeaks } from "./secrets.js";
 import { checkEnvCommitted, checkEnvExample, checkGitignore } from "./env.js";
-import { checkRobotsTxt, checkSitemapXml, checkFavicon } from "./public-assets.js";
+import { checkRobotsTxt, checkSitemapXml, checkFavicon, checkLlmsTxt, checkPwaManifest, } from "./public-assets.js";
 import { checkSecurityHeaders } from "./headers.js";
 import { checkDangerousPatterns } from "./dangerous.js";
 import { checkLanguagePatterns, checkPythonSecretKeyEnv, checkRubySecretKeyBaseEnv, } from "./language.js";
 import { checkPlaceholderContent } from "./quality.js";
 export * from "./types.js";
-export { checkHardcodedSecrets, checkConfigSecretLeaks, checkEnvCommitted, checkEnvExample, checkGitignore, checkRobotsTxt, checkSitemapXml, checkFavicon, checkSecurityHeaders, checkDangerousPatterns, checkLanguagePatterns, checkPythonSecretKeyEnv, checkRubySecretKeyBaseEnv, checkPlaceholderContent, };
+export { checkHardcodedSecrets, checkConfigSecretLeaks, checkEnvCommitted, checkEnvExample, checkGitignore, checkRobotsTxt, checkSitemapXml, checkFavicon, checkLlmsTxt, checkPwaManifest, checkSecurityHeaders, checkDangerousPatterns, checkLanguagePatterns, checkPythonSecretKeyEnv, checkRubySecretKeyBaseEnv, checkPlaceholderContent, };
 export const ALL_CHECKS = [
     { id: "hardcoded-secrets", run: checkHardcodedSecrets },
     { id: "config-secret-leaks", run: checkConfigSecretLeaks },
@@ -25,6 +25,8 @@ export const ALL_CHECKS = [
     { id: "robots-txt", run: checkRobotsTxt },
     { id: "sitemap-xml", run: checkSitemapXml },
     { id: "favicon", run: checkFavicon },
+    { id: "llms-txt", run: checkLlmsTxt },
+    { id: "pwa-manifest", run: checkPwaManifest },
     { id: "security-headers", run: checkSecurityHeaders },
     { id: "dangerous-patterns", run: checkDangerousPatterns },
     { id: "language-patterns", run: checkLanguagePatterns },

package/dist/checks/public-assets.js

@@ -108,3 +108,38 @@ export async function checkFavicon(ctx) {
         },
     ];
 }
+export async function checkLlmsTxt(ctx) {
+    const has = ctx.files.some((f) => /(^|\/)llms\.txt$/i.test(f.relPath));
+    if (has)
+        return [];
+    if (await isAssetEmittedDynamically(ctx, "llms.txt"))
+        return [];
+    const dirs = await findPublicDirs(ctx);
+    if (dirs.length === 0)
+        return [];
+    return [
+        {
+            checkId: "missing-llms-txt",
+            itemId: "aeo",
+            severity: "lower",
+            message: `No llms.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so AI crawlers (ChatGPT, Perplexity, Claude) can understand your site.`,
+        },
+    ];
+}
+export async function checkPwaManifest(ctx) {
+    const dirs = await findPublicDirs(ctx);
+    if (dirs.length === 0)
+        return [];
+    const manifestRegex = /(^|\/)(manifest\.(json|webmanifest)|site\.webmanifest)$/i;
+    const has = ctx.files.some((f) => manifestRegex.test(f.relPath));
+    if (has)
+        return [];
+    return [
+        {
+            checkId: "missing-pwa-manifest",
+            itemId: "installable-app",
+            severity: "lower",
+            message: `No PWA manifest found in any public directory (looked in: ${dirs.join(", ")}). Add manifest.json (or site.webmanifest) so users can install your app to their phone's home screen.`,
+        },
+    ];
+}

package/dist/index.js

@@ -31,7 +31,7 @@ function applyTrackingAwareSeverity(findings, tracked) {
     });
 }
 const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = "0.5.0";
+const PKG_VERSION = "0.6.0";
 function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),

package/dist/items.js

@@ -39,6 +39,16 @@ export const CHECKLIST_ITEMS = {
         title: "Audit what your AI builder actually shipped",
         priority: "critical",
     },
+    aeo: {
+        id: "aeo",
+        title: "Make AI assistants able to recommend you",
+        priority: "lower",
+    },
+    "installable-app": {
+        id: "installable-app",
+        title: "Make your app installable on phones",
+        priority: "lower",
+    },
 };
 export function permalinkFor(itemId, baseUrl) {
     const trimmed = baseUrl.replace(/\/+$/, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",
@@ -45,12 +45,12 @@
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "devDependencies": {
-    "@types/node": "^25.3.3",
-    "tsx": "4.21.0",
+    "@types/node": "catalog:",
+    "tsx": "catalog:",
     "typescript": "^5.6.3"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   }
-}
+}