shippingszn 0.7.1 → 0.8.2

package/README.md

@@ -1,10 +1,9 @@
 # shippingszn
 
-A small, read-only CLI that scans a project for common pre-launch issues from
-the [shippingszn.com launch checklist](https://shippingszn.com). Run it
-before you ship to catch obvious mistakes — leaked API keys, missing
-`robots.txt`, no security headers, and so on — and get a friendly report
-linking each finding back to the matching checklist item.
+Primary local scanner for shippingszn launch readiness. Run it inside the app
+you are about to ship to catch the launch blockers AI builders commonly miss:
+leaked API keys, missing crawl assets, weak browser defenses, dangerous code
+patterns, and last-mile polish gaps.
 
 ```bash
 npx shippingszn
@@ -12,8 +11,74 @@ npx shippingszn
 pnpm dlx shippingszn
 ```
 
-Run it inside any project root. The CLI **never writes, modifies, or deletes**
-any files — it only reads. Everything stays on your machine.
+The CLI **never writes, modifies, or deletes** any files - it only reads.
+Everything stays on your machine unless you explicitly opt in with `--proof`
+or `--publish`.
+
+Human output starts with a Launch Readiness Score, scope covered, the top next
+step to fix, and severity counts. Run with `--json` to get machine-readable
+findings, copy/paste fix prompts for your AI builder, and proof/report handoff
+fields:
+
+```json
+{
+  "launchReadiness": {
+    "score": 43,
+    "rawScore": 43,
+    "label": "No-go: launch blocked",
+    "decisionLabel": "No-go: launch blocked",
+    "goNoGoLabel": "No-go",
+    "confidence": "high",
+    "coveragePenalty": 0,
+    "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
+    "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
+    "proofCreatePath": "https://shippingszn.com/scan",
+    "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
+    "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
+    "proofResultId": "00000000-0000-4000-8000-000000000123",
+    "badgeMarkdown": "[![Launch readiness proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
+    "wallUrl": "https://shippingszn.com/wall",
+    "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
+  },
+  "findings": [
+    {
+      "severity": "critical",
+      "message": "Possible OpenAI API key hardcoded in source.",
+      "remediation": {
+        "fixPrompt": "You are fixing a shippingszn launch-readiness finding...",
+        "verify": "Re-run npx shippingszn --json and confirm this exact finding is gone...",
+        "escalation": "Escalate before launch if this touches secrets, auth, payments...",
+        "proofNextStep": "After the fix verifies clean, run npx shippingszn --json..."
+      }
+    }
+  ]
+}
+```
+
+When Critical or High findings make paid confidence relevant, the summary also
+includes a `/report` link. Clean scans and lower-risk findings do not push the
+paid report CTA.
+
+## Direct proof publishing
+
+Use `--proof` when you want the current scan to become shareable launch proof:
+
+```bash
+npx shippingszn --json --proof > shippingszn-scan.json
+```
+
+That opt-in posts the scan summary and remediation fields to
+`/api/scan-results`, then adds `launchReadiness.proofUrl`,
+`launchReadiness.proofResultId`, `launchReadiness.badgeMarkdown`,
+`launchReadiness.wallUrl`, and `launchReadiness.reportUrl` to the JSON. It
+also posts a proof-linked severity summary to the Wall of Launches. If proof
+upload fails, findings still print and JSON includes
+`launchReadiness.proofUploadError`; if the Wall publish fails, JSON includes
+`launchReadiness.wallPublishError`.
+
+For a manual handoff, you can still run `npx shippingszn --json >
+shippingszn-scan.json` and paste or upload the file at
+`https://shippingszn.com/scan`.
 
 ## What gets checked
 
@@ -62,6 +127,12 @@ shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON report.
+  --publish             Opt in to posting an anonymous summary to the public
+                        Wall of Launches. Never uploads source code, paths,
+                        filenames, or project names.
+  --proof               Opt in to posting this scan to /api/scan-results and
+                        printing a proof URL, Wall URL, report URL, and badge.
+                        Can also be enabled with SHIPPINGSZN_PROOF=1.
   --base-url <url>      Base URL used to build links back to checklist items.
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable report.
@@ -79,15 +150,33 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json > launch-check.json
+- run: npx shippingszn --json --proof > launch-check.json
 ```
 
+For PR scan proof, have GitHub Actions run the scanner with `--proof` and post
+the JSON summary as a comment: score, severity counts, top next step, proof URL,
+badge markdown, Wall URL, report URL, and worst Critical/High findings. Keep
+`--publish` out of the workflow unless you explicitly want to publish an
+anonymous Wall summary when proof upload fails.
+
 ## Privacy
 
 `shippingszn` reads files on your machine. It never uploads source code,
-makes outbound network calls, or phones home. No telemetry. No accounts.
+makes outbound network calls, or phones home by default. No accounts.
 Inspect the source or audit `npm pack --dry-run` to confirm.
 
+If you want public launch-readiness proof, pass `--proof`. That opt-in posts
+the current scan result to shippingszn so it can create a proof page, report
+handoff, README badge, and proof-linked Wall entry. It uploads finding titles,
+messages, remediation prompts, verification text, checklist permalinks,
+severity counts, score, file count, target folder name, and scanner version. It
+does not upload source code or secret values.
+
+If you only want an anonymous Wall of Launches summary, pass `--publish`.
+That opt-in posts files scanned count, finding counts by severity, detected
+stack tags, and scanner version. It never uploads source code, file paths,
+filenames, project names, secrets, or report contents.
+
 ## License
 
 MIT. See [LICENSE](./LICENSE).

package/dist/checks/helpers.js

@@ -11,19 +11,38 @@ export function findLine(content, idx) {
     return line;
 }
 /**
- * Inline opt-out marker. Any line containing this token is exempt from
- * substring/regex-based checks (placeholder content, dangerous patterns).
- * Used by the scanner's own source to avoid matching its pattern definitions.
+ * Inline opt-out markers. Two flavors, both optional:
  *
- * The literal value is split across a concatenation so that grep'ing for the
- * marker only finds the *uses*, not this definition.
+ * - `shippingszn:ignore` on the same line as the match suppresses it.
+ * - `shippingszn:ignore-next-line` on the line ABOVE the match suppresses
+ *   it. This exists because formatters (prettier, biome) routinely
+ *   reflow trailing comments onto their own line, which would otherwise
+ *   silently break the same-line marker. Mirrors the eslint /
+ *   prettier-ignore-next conventions.
+ *
+ * The literal values are split across concatenations so that grep'ing
+ * for the marker only finds the *uses*, not these definitions.
  */
 export const IGNORE_MARKER = "shippingszn" + ":ignore";
-export function lineContainsIgnoreMarker(content, charIndex) {
+export const IGNORE_NEXT_LINE_MARKER = "shippingszn" + ":ignore-next-line";
+function getLine(content, charIndex) {
     const lineStart = content.lastIndexOf("\n", charIndex - 1) + 1;
     const lineEnd = content.indexOf("\n", charIndex);
-    const line = content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
-    return line.includes(IGNORE_MARKER);
+    return content.slice(lineStart, lineEnd === -1 ? undefined : lineEnd);
+}
+function getPreviousLine(content, charIndex) {
+    const lineStart = content.lastIndexOf("\n", charIndex - 1) + 1;
+    if (lineStart === 0)
+        return null;
+    const prevEnd = lineStart - 1;
+    const prevStart = content.lastIndexOf("\n", prevEnd - 1) + 1;
+    return content.slice(prevStart, prevEnd);
+}
+export function lineContainsIgnoreMarker(content, charIndex) {
+    if (getLine(content, charIndex).includes(IGNORE_MARKER))
+        return true;
+    const prev = getPreviousLine(content, charIndex);
+    return prev !== null && prev.includes(IGNORE_NEXT_LINE_MARKER);
 }
 const PUBLIC_DIR_CANDIDATES = [
     "public",
@@ -87,6 +106,11 @@ const PATTERN_DEFINITION_FILES = new Set([
     "tools/cli/src/checks/quality.ts",
     "tools/cli/src/checks/language.ts",
     "tools/cli/README.md",
+    // Test fixture for the redaction module: contains intentional fake
+    // secret patterns whose whole purpose is to verify the redactor scrubs
+    // them. Functionally identical to tools/cli/test/fixtures/, just lives
+    // in a different package.
+    "artifacts/api-server/src/lib/__tests__/redaction.test.ts",
 ]);
 const PATTERN_DEFINITION_PREFIXES = [
     "tools/cli/test/fixtures/",

package/dist/checks/public-assets.js

@@ -104,7 +104,7 @@ export async function checkFavicon(ctx) {
             checkId: "missing-favicon",
             itemId: "launch-polish",
             severity: "lower",
-            message: "No custom favicon found in your public directory. The default browser favicon (or the framework starter one) tells visitors this is a vibe-coded project.",
+            message: "No custom favicon found in your public directory. The default browser favicon (or the framework starter one) tells visitors this is an unfinished AI-built project.",
         },
     ];
 }

package/dist/index.js

@@ -6,6 +6,9 @@ import { ALL_CHECKS } from "./checks.js";
 import { listFiles, getTrackedFiles } from "./scan.js";
 import { CHECKLIST_ITEMS, permalinkFor } from "./items.js";
 import { publishScan } from "./publish.js";
+import { shouldUploadProof, uploadProof, } from "./proof.js";
+import { buildRemediationPrompt, } from "./remediation.js";
+import { assessLaunchReadiness, normalizeLaunchFinding, } from "@workspace/launch-readiness";
 const UNTRACKED_DOWNGRADE = {
     critical: "lower",
     high: "lower",
@@ -41,10 +44,14 @@ function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),
         json: false,
-        baseUrl: process.env.VIBE_LAUNCH_CHECK_BASE_URL ?? DEFAULT_BASE_URL,
+        baseUrl: process.env.SHIPPINGSZN_BASE_URL ??
+            process.env.VIBE_LAUNCH_CHECK_BASE_URL ??
+            DEFAULT_BASE_URL,
         help: false,
         version: false,
         noColor: !!process.env.NO_COLOR,
+        publish: false,
+        proof: shouldUploadProof(),
     };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -54,6 +61,10 @@ function parseArgs(argv) {
             opts.version = true;
         else if (a === "--json")
             opts.json = true;
+        else if (a === "--publish")
+            opts.publish = true;
+        else if (a === "--proof")
+            opts.proof = true;
         else if (a === "--no-color")
             opts.noColor = true;
         else if (a === "--base-url")
@@ -90,13 +101,19 @@ function printHelp() {
     process.stdout.write(`shippingszn v${PKG_VERSION}
 
 Read-only scanner that checks the current project against a small set of
-high-signal items from the Vibe Coder Launch Checklist.
+high-signal launch-readiness items from shippingszn.
 
 Usage:
   npx shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON report.
+  --publish             Opt in to posting an anonymous summary to the public
+                        Wall of Launches. Never uploads source code, paths,
+                        filenames, or project names.
+  --proof               Opt in to posting this scan to /api/scan-results and
+                        printing a proof URL, Wall URL, report URL, and badge.
+                        Can also be enabled with SHIPPINGSZN_PROOF=1.
   --base-url <url>      Base URL used to build links back to checklist items.
                         (default: ${DEFAULT_BASE_URL})
   --cwd <path>          Directory to scan. Default: current working directory.
@@ -104,10 +121,21 @@ Options:
   -h, --help            Show this help.
   -v, --version         Print version.
 
-The scanner only reads files. It never writes, modifies, or deletes anything.
+The scanner only reads files. It never writes, modifies, deletes, or makes
+network requests unless you explicitly opt in with --publish or --proof.
 Exit code is non-zero if any Critical findings are detected.
 `);
 }
+function buildTopNextStep(findings) {
+    const top = findings[0];
+    if (!top) {
+        return "Attach this clean repo scan proof to the launch record, then monitor first production traffic.";
+    }
+    return `Fix ${top.itemTitle}: ${top.message}`;
+}
+function scanSource() {
+    return process.env.GITHUB_ACTIONS === "true" ? "github" : "cli";
+}
 async function run() {
     const opts = parseArgs(process.argv.slice(2));
     if (opts.help) {
@@ -138,13 +166,43 @@ async function run() {
             });
         }
     }
+    const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
+    const reportUrl = `${trimmedBaseUrl}/report`;
+    const proofCreatePath = `${trimmedBaseUrl}/scan`;
+    const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.";
     const tracked_aware = applyTrackingAwareSeverity(all, tracked);
+    const source = scanSource();
     const enriched = tracked_aware.map((f) => {
         const item = CHECKLIST_ITEMS[f.itemId];
+        const remediation = buildRemediationPrompt({
+            finding: f,
+            item,
+            proofCreatePath,
+            reportUrl,
+        });
+        const itemTitle = item?.title ?? f.itemId;
+        const normalized = normalizeLaunchFinding({
+            severity: f.severity,
+            title: itemTitle,
+            body: f.message,
+            message: f.message,
+            evidence: f.evidence,
+            file: f.file,
+            line: f.line,
+            permalink: permalinkFor(f.itemId, opts.baseUrl),
+            itemTitle,
+            fixInstructions: remediation.fixPrompt,
+            aiBuilderPrompt: remediation.fixPrompt,
+            verificationStep: remediation.verify,
+            fixPrompt: remediation.fixPrompt,
+            verify: remediation.verify,
+        }, source);
         return {
             ...f,
-            itemTitle: item?.title ?? f.itemId,
+            ...normalized,
+            itemTitle,
             permalink: permalinkFor(f.itemId, opts.baseUrl),
+            remediation,
         };
     });
     enriched.sort((a, b) => {
@@ -164,24 +222,72 @@ async function run() {
     };
     for (const f of enriched)
         totals[f.severity]++;
+    const assessment = assessLaunchReadiness({
+        source,
+        findings: enriched,
+        counts: totals,
+    });
+    const launchReadiness = {
+        score: assessment.score,
+        rawScore: assessment.rawScore,
+        label: assessment.label,
+        decision: assessment.decision,
+        decisionLabel: assessment.decisionLabel,
+        goNoGoLabel: assessment.goNoGoLabel,
+        confidence: assessment.confidence,
+        coveragePenalty: assessment.coveragePenalty,
+        coverageSummary: assessment.coverageSummary,
+        topNextStep: assessment.topNextStep,
+        proofCreatePath,
+        proofUploadHint,
+        reportRecommended: assessment.reportRecommended,
+        ...(assessment.reportRecommended ? { reportUrl } : {}),
+    };
     const report = {
         generatedAt: new Date().toISOString(),
+        source,
         baseUrl: opts.baseUrl,
         cwd: opts.cwd,
         filesScanned: files.length,
         totals,
+        launchReadiness,
         findings: enriched,
     };
-    // Best-effort anonymous publish to the Wall of Launches. Runs once per
-    // scan, before any return path. Never blocks on network failure. Full
-    // opt-out via SHIPPINGSZN_DISABLE_PUBLISH=1.
-    let publishResult = "skipped";
-    try {
-        publishResult = await publishScan(totals, files.length, {
-            cwd: opts.cwd,
+    let proofResult = { status: "skipped" };
+    if (opts.proof) {
+        proofResult = await uploadProof(report, {
             baseUrl: opts.baseUrl,
             scannerVersion: PKG_VERSION,
         });
+        if (proofResult.status === "uploaded") {
+            report.launchReadiness.proofUrl = proofResult.proofUrl;
+            report.launchReadiness.proofResultId = proofResult.id;
+            report.launchReadiness.badgeMarkdown = proofResult.badgeMarkdown;
+            report.launchReadiness.reportUrl = proofResult.reportUrl;
+            report.launchReadiness.wallUrl = proofResult.wallUrl;
+            report.launchReadiness.wallPublishError = proofResult.wallPublishError;
+        }
+        else if (proofResult.status === "failed") {
+            report.launchReadiness.proofUploadError =
+                proofResult.error ?? "Proof upload failed.";
+        }
+    }
+    // Best-effort anonymous publish to the Wall of Launches. This is explicit
+    // opt-in because shippingszn is a trust product; scanning must stay local
+    // unless the user asks to publish proof.
+    let publishResult = "skipped";
+    try {
+        if (opts.publish) {
+            process.env["SHIPPINGSZN_PUBLISH"] = "1";
+        }
+        const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
+        if (!proofAlreadyPublishedWall) {
+            publishResult = await publishScan(totals, files.length, {
+                cwd: opts.cwd,
+                baseUrl: opts.baseUrl,
+                scannerVersion: PKG_VERSION,
+            });
+        }
     }
     catch {
         /* never block on wall publish */
@@ -200,19 +306,44 @@ async function run() {
             return c.blue;
         return c.gray;
     };
+    // Strip ASCII control characters (including ESC) so a maliciously-named
+    // file or matched secret slice cannot inject ANSI escape sequences into
+    // the operator's terminal.
+    const safe = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?");
     process.stdout.write(`\n${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}\n`);
     process.stdout.write(c.dim(`Scanned ${files.length} files in ${opts.cwd}\n\n`));
+    process.stdout.write(`${c.bold("Launch Readiness Score:")} ${launchReadiness.score}/100 ${c.dim(`(${launchReadiness.label})`)}\n`);
+    process.stdout.write(`${c.bold("Scope:")} ${safe(launchReadiness.coverageSummary)}\n`);
+    process.stdout.write(`${c.bold("Top next step:")} ${safe(launchReadiness.topNextStep)}\n`);
+    process.stdout.write(`${c.bold("Fix prompts:")} ${c.dim("Run with --json for copy/paste AI-builder remediation prompts.")}\n`);
+    if (launchReadiness.reportUrl) {
+        process.stdout.write(`${c.bold("Need paid confidence?")} ${c.dim(`Get a launch-readiness report: ${launchReadiness.reportUrl}`)}\n`);
+    }
+    if (proofResult.status === "uploaded") {
+        process.stdout.write(`${c.bold("Proof URL:")} ${c.dim(proofResult.proofUrl ?? "")}\n`);
+        process.stdout.write(`${c.bold("Report URL:")} ${c.dim(proofResult.reportUrl ?? "")}\n`);
+        if (proofResult.wallUrl) {
+            process.stdout.write(`${c.bold("Wall URL:")} ${c.dim(proofResult.wallUrl)}\n`);
+        }
+        process.stdout.write(`${c.bold("Badge Markdown:")} ${c.dim(proofResult.badgeMarkdown ?? "")}\n`);
+        if (proofResult.wallPublishError) {
+            process.stdout.write(`${c.bold("Wall publish failed:")} ${c.dim(proofResult.wallPublishError)}\n`);
+        }
+    }
+    else if (proofResult.status === "failed") {
+        process.stdout.write(`${c.bold("Proof upload failed:")} ${c.dim(proofResult.error ?? "Unknown upload error.")}\n`);
+    }
+    else {
+        process.stdout.write(`${c.bold("Share proof:")} ${c.dim("Run with --proof to publish this scan to a public proof URL.")}\n`);
+    }
+    process.stdout.write("\n");
     if (enriched.length === 0) {
-        process.stdout.write(c.green("✓ No findings. Nice work — still walk through the full checklist before launch.\n\n"));
+        process.stdout.write(c.green("No findings. Attach the clean scan proof to the launch record before shipping.\n\n"));
         if (publishResult === "published") {
-            process.stdout.write(c.dim(`Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n(opt out: SHIPPINGSZN_DISABLE_PUBLISH=1)\n\n`));
+            process.stdout.write(c.dim(`Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n`));
         }
         return 0;
     }
-    // Strip ASCII control characters (including ESC) so a maliciously-named
-    // file or matched secret slice cannot inject ANSI escape sequences into
-    // the operator's terminal.
-    const safe = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?");
     for (const sev of SEVERITY_ORDER) {
         const group = enriched.filter((f) => f.severity === sev);
         if (group.length === 0)
@@ -232,7 +363,7 @@ async function run() {
     }
     process.stdout.write(`${c.bold("Summary:")} ${c.red(`${totals.critical} critical`)}, ${c.yellow(`${totals.high} high`)}, ${c.blue(`${totals.medium} medium`)}, ${c.gray(`${totals.lower} lower`)}\n`);
     if (publishResult === "published") {
-        process.stdout.write(c.dim(`\nPosted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n(opt out: SHIPPINGSZN_DISABLE_PUBLISH=1)\n`));
+        process.stdout.write(c.dim(`\nPosted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n`));
     }
     if (totals.critical > 0) {
         process.stdout.write(c.red("\nCritical findings detected. Exiting with code 1.\n"));

package/dist/proof.js

@@ -0,0 +1,161 @@
+import * as path from "node:path";
+const PROOF_TIMEOUT_MS = 5000;
+const MAX_FINDINGS = 100;
+export function shouldUploadProof() {
+    const v = process.env["SHIPPINGSZN_PROOF"] ?? "";
+    return v === "1" || v.toLowerCase() === "true" || v === "yes";
+}
+function clampText(value, max, fallback = "") {
+    const text = value ?? fallback;
+    return text.length > max ? text.slice(0, max - 3) + "..." : text;
+}
+function locationFromFinding(finding) {
+    if (!finding.file)
+        return undefined;
+    return finding.line ? `${finding.file}:${finding.line}` : finding.file;
+}
+export function buildBadgeMarkdown(baseUrl, id, score) {
+    const params = new URLSearchParams({
+        scanResultId: id,
+        theme: "dark",
+    });
+    const proofUrl = `${baseUrl}/proof/${encodeURIComponent(id)}`;
+    return `[![Launch readiness proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
+}
+export function buildProofPayload(report, scannerVersion) {
+    const counts = {
+        critical: report.totals.critical,
+        high: report.totals.high,
+        medium: report.totals.medium,
+        lower: report.totals.lower,
+    };
+    return {
+        version: 1,
+        source: report.source ?? "cli",
+        scanner: "shippingszn",
+        targetName: path.basename(report.cwd) || "CLI scan",
+        score: report.launchReadiness.score,
+        label: report.launchReadiness.label,
+        decision: report.launchReadiness.decision,
+        decisionLabel: report.launchReadiness.decisionLabel,
+        goNoGoLabel: report.launchReadiness.goNoGoLabel,
+        confidence: report.launchReadiness.confidence,
+        checkedAt: report.generatedAt,
+        counts,
+        findings: report.findings.slice(0, MAX_FINDINGS).map((finding) => ({
+            severity: finding.severity,
+            title: clampText(finding.itemTitle || finding.checkId, 160),
+            body: clampText(finding.message, 3000),
+            whatFailed: clampText(finding.whatFailed, 3000),
+            whyItBlocksLaunch: clampText(finding.whyItBlocksLaunch, 3000),
+            fixInstructions: clampText(finding.fixInstructions, 4000),
+            aiBuilderPrompt: clampText(finding.aiBuilderPrompt, 4000),
+            evidence: clampText(finding.evidence, 3000),
+            confidence: finding.confidence,
+            fixPrompt: clampText(finding.aiBuilderPrompt, 4000),
+            verify: clampText(finding.verificationStep, 3000),
+            verificationStep: clampText(finding.verificationStep, 3000),
+            ...(locationFromFinding(finding)
+                ? { location: clampText(locationFromFinding(finding), 500) }
+                : {}),
+            permalink: finding.permalink,
+            itemTitle: clampText(finding.itemTitle, 160),
+        })),
+        filesScanned: report.filesScanned,
+        topNextStep: clampText(report.launchReadiness.topNextStep, 1000),
+        reportRecommended: report.launchReadiness.reportRecommended,
+        ...(report.launchReadiness.reportUrl
+            ? { reportUrl: report.launchReadiness.reportUrl }
+            : {}),
+        scannerVersion,
+    };
+}
+function buildWallPayload(report, scanResultId, scannerVersion) {
+    return {
+        source: "cli",
+        scanResultId,
+        score: report.launchReadiness.score,
+        label: report.launchReadiness.label,
+        filesScanned: report.filesScanned,
+        findingsCritical: report.totals.critical,
+        findingsHigh: report.totals.high,
+        findingsMedium: report.totals.medium,
+        findingsLower: report.totals.lower,
+        scannerVersion,
+    };
+}
+async function publishProofToWall(baseUrl, report, scanResultId, scannerVersion) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), PROOF_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${baseUrl}/api/wall`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": `shippingszn-cli/${scannerVersion}`,
+            },
+            body: JSON.stringify(buildWallPayload(report, scanResultId, scannerVersion)),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!res.ok) {
+            return { error: `Wall publish failed with HTTP ${res.status}.` };
+        }
+        return { wallUrl: `${baseUrl}/wall` };
+    }
+    catch (err) {
+        clearTimeout(timer);
+        return {
+            error: `Wall publish failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+export async function uploadProof(report, opts) {
+    const baseUrl = opts.baseUrl.replace(/\/$/, "");
+    const payload = buildProofPayload(report, opts.scannerVersion);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), PROOF_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${baseUrl}/api/scan-results`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": `shippingszn-cli/${opts.scannerVersion}`,
+            },
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        if (!res.ok) {
+            return {
+                status: "failed",
+                error: `Proof upload failed with HTTP ${res.status}.`,
+            };
+        }
+        const body = (await res.json());
+        const id = typeof body.id === "string" ? body.id : "";
+        if (!id) {
+            return {
+                status: "failed",
+                error: "Proof upload succeeded but the response did not include an id.",
+            };
+        }
+        const wall = await publishProofToWall(baseUrl, report, id, opts.scannerVersion);
+        return {
+            status: "uploaded",
+            id,
+            proofUrl: `${baseUrl}/proof/${encodeURIComponent(id)}`,
+            reportUrl: `${baseUrl}/report?${new URLSearchParams({ scanResultId: id }).toString()}`,
+            badgeMarkdown: buildBadgeMarkdown(baseUrl, id, report.launchReadiness.score),
+            ...(wall.wallUrl ? { wallUrl: wall.wallUrl } : {}),
+            ...(wall.error ? { wallPublishError: wall.error } : {}),
+        };
+    }
+    catch (err) {
+        clearTimeout(timer);
+        return {
+            status: "failed",
+            error: `Proof upload failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}

package/dist/publish.js

@@ -1,22 +1,21 @@
 /**
- * Anonymous auto-publish of scan results to the Wall of Launches at
- * shippingszn.com. Runs once per scan, best-effort. Never blocks the CLI
- * on network failure — if anything goes wrong we fail silently and the
- * scan result still prints normally.
+ * Anonymous opt-in publish of scan results to the Wall of Launches at
+ * shippingszn.com. Never blocks the CLI on network failure — if anything
+ * goes wrong we fail silently and the scan result still prints normally.
  *
  * Absolute guarantees about the payload: no secrets, no paths, no
  * filenames, no project-name-derived strings. The only thing we send
  * is: files scanned count, findings counts by severity, detected stack
- * tags, scanner version. Users can opt out entirely by setting
- * SHIPPINGSZN_DISABLE_PUBLISH=1 in their environment.
+ * tags, scanner version. Publishing only runs when the user passes
+ * --publish or sets SHIPPINGSZN_PUBLISH=1 in their environment.
  */
 import { promises as fs } from "node:fs";
 import * as path from "node:path";
 const DEFAULT_BASE_URL = "https://shippingszn.com";
 const PUBLISH_TIMEOUT_MS = 3000;
 function shouldPublish() {
-    const v = process.env["SHIPPINGSZN_DISABLE_PUBLISH"] ?? "";
-    return v !== "1" && v.toLowerCase() !== "true" && v !== "yes";
+    const v = process.env["SHIPPINGSZN_PUBLISH"] ?? "";
+    return v === "1" || v.toLowerCase() === "true" || v === "yes";
 }
 // Detect a small list of tech-stack tags from package.json / manifest
 // files. Deliberately shallow: we only want a handful of widely-known

package/dist/remediation.js

@@ -0,0 +1,36 @@
+const SEVERITY_INTENT = {
+    critical: "Treat this as launch-blocking until fixed.",
+    high: "Fix this before public traffic or paid acquisition.",
+    medium: "Fix this before announcing or indexing the launch.",
+    lower: "Fix this when polishing the launch artifact.",
+};
+const ESCALATION = {
+    critical: "Escalate before launch if this touches secrets, auth, payments, customer data, production infrastructure, or anything already exposed publicly.",
+    high: "Escalate if the fix affects auth, payments, deploy config, browser security, or a user-visible production path.",
+    medium: "Escalate only if the fix changes routing, indexing, analytics, or public launch messaging.",
+    lower: "Escalation is usually unnecessary unless this blocks installability, branding, or a promised launch surface.",
+};
+function locationForPrompt(finding) {
+    if (!finding.file)
+        return "No specific file was attached to the finding.";
+    const line = finding.line ? `:${finding.line}` : "";
+    return `Likely location: ${finding.file}${line}.`;
+}
+function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
+    const proofStep = `After the fix verifies clean, run npx shippingszn --json and paste or upload the JSON at ${proofCreatePath} to create launch proof.`;
+    if (severity === "critical" || severity === "high") {
+        return `${proofStep} If this app has users, revenue, client trust, or paid API exposure, attach the clean scan to a paid launch-readiness report at ${reportUrl}.`;
+    }
+    return proofStep;
+}
+export function buildRemediationPrompt({ finding, item, proofCreatePath, reportUrl, }) {
+    const itemTitle = item?.title ?? finding.itemId;
+    const location = locationForPrompt(finding);
+    const intent = SEVERITY_INTENT[finding.severity];
+    return {
+        fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding.severity}. Checklist area: ${itemTitle}. Finding: ${finding.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
+        verify: "Re-run npx shippingszn --json and confirm this exact finding is gone. Also run the app's normal typecheck/test/build command when the fix changes code, config, routing, security behavior, or public assets.",
+        escalation: ESCALATION[finding.severity],
+        proofNextStep: proofStepForSeverity(finding.severity, proofCreatePath, reportUrl),
+    };
+}

package/dist/scan.js

@@ -21,6 +21,29 @@ export function getTrackedFiles(rootDir) {
     }
     return out;
 }
+/**
+ * Ask git for tracked + untracked-but-not-ignored files. Used to filter the
+ * filesystem walk so that gitignored output (build artifacts, generated
+ * playwright reports, local caches, .env files) doesn't generate noisy
+ * false-positive findings. Returns null when the directory isn't a git
+ * work tree, in which case the caller falls back to scanning everything
+ * the directory walker finds.
+ *
+ * `-c` cached, `-o` others, `--exclude-standard` honors .gitignore +
+ * .git/info/exclude + the user's global excludesfile. This is the
+ * standard "git-aware" file listing approach.
+ */
+export function getNotIgnoredFiles(rootDir) {
+    const result = spawnSync("git", ["-C", rootDir, "ls-files", "-co", "--exclude-standard", "-z"], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    if (result.status !== 0 || !result.stdout)
+        return null;
+    const out = new Set();
+    for (const rel of result.stdout.split("\0")) {
+        if (rel)
+            out.add(rel);
+    }
+    return out;
+}
 const DEFAULT_IGNORES = new Set([
     "node_modules",
     ".git",
@@ -85,6 +108,13 @@ export async function listFiles(rootDir) {
     const out = [];
     const visited = new Set();
     const rootResolved = path.resolve(rootDir);
+    // When running inside a git repo, exclude anything .gitignore'd from the
+    // walk. This stops generated artifacts (e2e/playwright-report/, dist/
+    // contents the user's repo gitignores explicitly, .env files in projects
+    // that ignore them but live outside our DEFAULT_IGNORES) from producing
+    // noisy false-positive findings. Outside a git repo we fall back to
+    // walking everything DEFAULT_IGNORES doesn't already strip.
+    const allowed = getNotIgnoredFiles(rootDir);
     async function walk(dir, depth) {
         if (depth > MAX_DEPTH)
             return;
@@ -145,6 +175,14 @@ export async function listFiles(rootDir) {
             }
             else if (entry.isFile()) {
                 const rel = path.relative(rootDir, abs);
+                // Honor .gitignore when we have it. Comparison uses POSIX-style
+                // separators because git ls-files always returns forward-slashed
+                // paths even on Windows.
+                if (allowed) {
+                    const relPosixPath = rel.split(path.sep).join("/");
+                    if (!allowed.has(relPosixPath))
+                        continue;
+                }
                 let size = 0;
                 try {
                     const st = await fs.stat(abs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.7.1",
+  "version": "0.8.2",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",
@@ -45,6 +45,7 @@
     "prepublishOnly": "npm run clean && npm run build && npm test"
   },
   "devDependencies": {
+    "@workspace/launch-readiness": "workspace:*",
     "@types/node": "catalog:",
     "tsx": "catalog:",
     "typescript": "^5.6.3"