shippingszn 0.8.3 → 0.8.5

package/README.md

@@ -12,13 +12,14 @@ pnpm dlx shippingszn
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-Everything stays on your machine unless you explicitly opt in with `--proof`
-or `--publish`.
+By default it posts one anonymous Wall of Launches entry with score, severity
+counts, files scanned, scanner version, and safe stack tags. It never uploads
+source code, paths, filenames, repo URLs, project names, secrets, handles, or
+emails. Use `--no-publish` for a private local run.
 
 Human output starts with a Launch Readiness Score, scope covered, the top next
 step to fix, and severity counts. Run with `--json` to get machine-readable
-findings, copy/paste fix prompts for your AI builder, and proof/report handoff
-fields:
+findings plus the Wall/report handoff fields:
 
 ```json
 {
@@ -32,24 +33,15 @@ fields:
     "coveragePenalty": 0,
     "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
     "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
-    "proofCreatePath": "https://shippingszn.com/scan",
-    "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
-    "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
-    "proofResultId": "00000000-0000-4000-8000-000000000123",
-    "badgeMarkdown": "[![Launch readiness proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
     "wallUrl": "https://shippingszn.com/wall",
-    "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
+    "reportUrl": "https://shippingszn.com/report"
   },
   "findings": [
     {
       "severity": "critical",
       "message": "Possible OpenAI API key hardcoded in source.",
-      "remediation": {
-        "fixPrompt": "You are fixing a shippingszn launch-readiness finding...",
-        "verify": "Re-run npx shippingszn --json and confirm this exact finding is gone...",
-        "escalation": "Escalate before launch if this touches secrets, auth, payments...",
-        "proofNextStep": "After the fix verifies clean, run npx shippingszn --json..."
-      }
+      "whatFailed": "A secret-like token appears in a scanned file.",
+      "whyItBlocksLaunch": "A leaked key can spend money or expose customer data before you notice."
     }
   ]
 }
@@ -59,26 +51,20 @@ When Critical or High findings make paid confidence relevant, the summary also
 includes a `/report` link. Clean scans and lower-risk findings do not push the
 paid report CTA.
 
-## Direct proof publishing
+## Wall publishing
 
-Use `--proof` when you want the current scan to become shareable launch proof:
+Plain `npx shippingszn` feeds the Wall automatically. The public row is
+anonymous and intentionally small: score, launch label, files scanned, finding
+counts, detected stack tags, scanner version, and timestamp.
+
+Use this when you want a completely private local run:
 
 ```bash
-npx shippingszn --json --proof > shippingszn-scan.json
+npx shippingszn --no-publish
 ```
 
-That opt-in posts the scan summary and remediation fields to
-`/api/scan-results`, then adds `launchReadiness.proofUrl`,
-`launchReadiness.proofResultId`, `launchReadiness.badgeMarkdown`,
-`launchReadiness.wallUrl`, and `launchReadiness.reportUrl` to the JSON. It
-also posts a proof-linked severity summary to the Wall of Launches. If proof
-upload fails, findings still print and JSON includes
-`launchReadiness.proofUploadError`; if the Wall publish fails, JSON includes
-`launchReadiness.wallPublishError`.
-
-For a manual handoff, you can still run `npx shippingszn --json >
-shippingszn-scan.json` and paste or upload the file at
-`https://shippingszn.com/scan`.
+For a paid-report handoff, run `npx shippingszn --json > shippingszn-scan.json`
+and paste or upload the file at `https://shippingszn.com/scan`.
 
 ## What gets checked
 
@@ -93,6 +79,9 @@ maps back to one of the items on the checklist.
 - Missing security-header middleware in common server configs.
 - Dangerous code patterns: unsafe HTML injection in React, runtime
   code-execution calls, wildcard CORS.
+- OTP/auth readiness signals: phone normalization, resend/cooldown behavior,
+  anti-enumeration copy, mobile one-time-code input, delivery-smoke evidence,
+  recovery paths, and paid report access that depends on OTP.
 - Python: common debug-mode slip-ups, hardcoded framework secrets, missing
   env-var loading.
 - Ruby: unsafe string rendering, hardcoded Rails secrets.
@@ -104,6 +93,32 @@ maps back to one of the items on the checklist.
 Each finding is tagged Critical, High, Medium, or Lower and links back to the
 relevant checklist item on shippingszn.com.
 
+## Suppressing false positives
+
+Two opt-out mechanisms, both off by default:
+
+- **`.gitignore` is respected.** Files your repo gitignores (build output,
+  generated reports, local `.env`, vendored sub-projects) are skipped.
+  This works automatically inside any git repo; outside a git repo the
+  scanner falls back to walking the full directory.
+- **Inline ignore markers.** For one-off cases where a file legitimately
+  contains a pattern the scanner detects (a regex literal, copy that
+  describes a placeholder, a test fixture), add one of:
+
+  ```ts
+  // shippingszn:ignore — placed on the same line as the match
+  const x = "lorem ipsum"; // shippingszn:ignore — fixture text
+
+  // shippingszn:ignore-next-line — placed on the line above the match
+  // shippingszn:ignore-next-line
+  const greeting = "hello placeholder";
+  ```
+
+  Markers apply to substring/regex checks (placeholder content, dangerous
+  patterns, language patterns). They deliberately do **not** apply to
+  hardcoded-secret detection — false positives there should be addressed
+  by removing the secret pattern, not by allowlisting.
+
 ## What does NOT get checked
 
 These are deliberately out of scope for v1:
@@ -127,12 +142,8 @@ shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON report.
-  --publish             Opt in to posting an anonymous summary to the public
-                        Wall of Launches. Never uploads source code, paths,
-                        filenames, or project names.
-  --proof               Opt in to posting this scan to /api/scan-results and
-                        printing a proof URL, Wall URL, report URL, and badge.
-                        Can also be enabled with SHIPPINGSZN_PROOF=1.
+  --publish             Legacy alias. Anonymous Wall stats publish by default.
+  --no-publish          Disable the anonymous Wall post for this run.
   --base-url <url>      Base URL used to build links back to checklist items.
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable report.
@@ -150,32 +161,22 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json --proof > launch-check.json
+- run: npx shippingszn --json > launch-check.json
 ```
 
-For PR scan proof, have GitHub Actions run the scanner with `--proof` and post
-the JSON summary as a comment: score, severity counts, top next step, proof URL,
-badge markdown, Wall URL, report URL, and worst Critical/High findings. Keep
-`--publish` out of the workflow unless you explicitly want to publish an
-anonymous Wall summary when proof upload fails.
+For PR scan signal, have GitHub Actions run the scanner and post the JSON
+summary as a comment: score, severity counts, top next step, Wall URL, report
+URL, and worst Critical/High findings.
 
 ## Privacy
 
-`shippingszn` reads files on your machine. It never uploads source code,
-makes outbound network calls, or phones home by default. No accounts.
-Inspect the source or audit `npm pack --dry-run` to confirm.
-
-If you want public launch-readiness proof, pass `--proof`. That opt-in posts
-the current scan result to shippingszn so it can create a proof page, report
-handoff, README badge, and proof-linked Wall entry. It uploads finding titles,
-messages, remediation prompts, verification text, checklist permalinks,
-severity counts, score, file count, target folder name, and scanner version. It
-does not upload source code or secret values.
-
-If you only want an anonymous Wall of Launches summary, pass `--publish`.
-That opt-in posts files scanned count, finding counts by severity, detected
-stack tags, and scanner version. It never uploads source code, file paths,
-filenames, project names, secrets, or report contents.
+`shippingszn` reads files on your machine. It never uploads source code. By
+default it makes one best-effort outbound request to post anonymous Wall stats:
+score, launch label, files scanned count, finding counts by severity, detected
+stack tags, scanner version, and timestamp. It never uploads source code, file
+paths, filenames, project names, repo URLs, secrets, emails, handles, or report
+contents. Use `--no-publish` or `SHIPPINGSZN_DISABLE_PUBLISH=1` to disable that
+request.
 
 ## License
 

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 import * as process2 from "node:process";
 import { createRequire } from "node:module";
 
@@ -246,6 +246,7 @@ var PATTERN_DEFINITION_FILES = /* @__PURE__ */ new Set([
   "tools/cli/src/checks/dangerous.ts",
   "tools/cli/src/checks/quality.ts",
   "tools/cli/src/checks/language.ts",
+  "tools/cli/src/checks/otp-auth.ts",
   "tools/cli/README.md",
   // Test fixture for the redaction module: contains intentional fake
   // secret patterns whose whole purpose is to verify the redactor scrubs
@@ -1164,6 +1165,258 @@ async function checkPlaceholderContent(ctx) {
   return findings.concat(placeholderHits.slice(0, 25));
 }
 
+// src/checks/otp-auth.ts
+import * as path9 from "node:path";
+var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".md",
+  ".mdx",
+  ".html",
+  ".htm",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".py",
+  ".rb",
+  ".go",
+  ".php",
+  ".java",
+  ".kt",
+  ".swift",
+  ".cs"
+]);
+var OTP_CONTEXT = /\b(otp|one[-\s]?time(?: password| code)?|verification code|verify code|login code|magic code|passcode|2fa|mfa|two[-\s]?factor)\b/i;
+var AUTH_CONTEXT = /\b(auth|sign[-\s]?in|signin|login|session|protected route|private route)\b/i;
+var SMS_OR_PHONE_CONTEXT = /\b(sms|text message|twilio|phone|mobile number|mobile phone|PhoneInput)\b/i;
+var PAID_REPORT_CONTEXT = /\b(paid report|report access|checkout handoff|checkoutHandoff|Stripe checkout|checkout email|checkout phone|checkout mobile|retrieve your report|account\/purchases|report session)\b/i;
+var FRONTEND_PATH_CONTEXT = /(^|\/)(login|signin|sign-in|auth|account|report|checkout)[^/]*\.(tsx|jsx|html|vue|svelte|astro)$/i;
+var PHONE_NORMALIZATION = /\b(normalizePhone|libphonenumber|parsePhoneNumber|isValidPhoneNumber|PhoneInput|E\.164|e164|react-phone-number-input|AsYouType)\b/i;
+var RESEND_BEHAVIOR = /\b(resend|send another|send a new code|request another|retry-after|try again in|wait a minute|cooldown|backoff)\b/i;
+var RATE_LIMIT = /\b(rateLimit|rate limit|Too many requests|retry-after|429|throttl|attempt limit|cooldown)\b/i;
+var ANTI_ENUMERATION = /\b(anti[-\s]?enumeration|success[-\s]?shaped|generic response|do not reveal|without revealing|hasPaidPurchase|no paid purchase|paid purchases|return\s+\{?\s*ok:\s*true|res\.json\(\s*\{\s*ok:\s*true)\b/i;
+var ENUMERATION_LEAK = /\b(?:user|account|email|phone|checkout|purchase|report)\s+(?:not\s+found|does\s+not\s+exist|not\s+recognized|not\s+registered|has no paid|has no purchase|not paid)|\bno\s+(?:account|user|purchase|paid checkout)\b/i;
+var MOBILE_OTP_INPUT = /\b(inputMode|inputmode|one-time-code|autocomplete=["']one-time-code|maxLength\s*=\s*\{?\s*6|type=["']tel|pattern=["'][^"']*\\d|InputOTP|numeric)\b/i;
+var CLEAR_COPY = /\b(6[-\s]?digit|six[-\s]?digit|verification code|one[-\s]?time code|code expires|expires? in|latest code|checkout email|checkout mobile|same email|same mobile|SMS code|Email code|Stripe receipt)\b/i;
+var RECOVERY_PATH = /\b(support|receipt|fallback|email fallback|alternate channel|try email|try sms|contact us|restart checkout|fulfillment|purchase history|account\/purchases|returnTo|different contact)\b/i;
+var DELIVERY_VERIFICATION = /\b(deliverability|delivery|delivered|arrives?|smoke|gateway|Twilio Verify|Email OTP Gateway|verifyGateway|requestGateway|mail[-\s]?tester|SPF|DKIM|DMARC|branded)\b/i;
+function shouldScan(file) {
+  if (!isTextFile(file)) return false;
+  if (isScanExempt(file.relPath)) return false;
+  const ext = path9.extname(file.relPath).toLowerCase();
+  return SCANNABLE_EXTENSIONS.has(ext);
+}
+function firstHit(file, content, regex) {
+  const match = regex.exec(content);
+  if (!match) return void 0;
+  if (lineContainsIgnoreMarker(content, match.index)) return void 0;
+  return {
+    file: relPosix(file.relPath),
+    line: findLine(content, match.index),
+    text: match[0]
+  };
+}
+function pick(existing, next) {
+  return existing ?? next;
+}
+function evidence(hit, fallback) {
+  if (!hit) return fallback;
+  return `${hit.file}:${hit.line} matched "${hit.text}".`;
+}
+function finding(input) {
+  return {
+    checkId: input.checkId,
+    itemId: "secure-auth",
+    severity: input.severity,
+    message: input.message,
+    evidence: input.evidence,
+    ...input.hit ? { file: input.hit.file, line: input.hit.line } : {}
+  };
+}
+async function collectOtpAuthSignals(ctx) {
+  const signals = {
+    hasOtp: false,
+    hasSmsOrPhone: false,
+    hasPaidReportOtp: false,
+    hasFrontendOtp: false
+  };
+  for (const file of ctx.files) {
+    if (!shouldScan(file)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const rel = relPosix(file.relPath);
+    const otpHit = firstHit(file, content, OTP_CONTEXT);
+    const authHit = firstHit(file, content, AUTH_CONTEXT);
+    const smsHit = firstHit(file, content, SMS_OR_PHONE_CONTEXT);
+    const paidHit = firstHit(file, content, PAID_REPORT_CONTEXT);
+    const frontendContext = FRONTEND_PATH_CONTEXT.test(rel);
+    signals.hasOtp = signals.hasOtp || Boolean(otpHit);
+    signals.hasSmsOrPhone = signals.hasSmsOrPhone || Boolean(smsHit);
+    signals.hasPaidReportOtp = signals.hasPaidReportOtp || Boolean(paidHit && (otpHit || authHit));
+    signals.hasFrontendOtp = signals.hasFrontendOtp || Boolean(frontendContext && (otpHit || authHit));
+    signals.contextHit = pick(
+      signals.contextHit,
+      otpHit ?? paidHit ?? authHit ?? smsHit
+    );
+    signals.phoneNormalization = pick(
+      signals.phoneNormalization,
+      firstHit(file, content, PHONE_NORMALIZATION)
+    );
+    signals.resendBehavior = pick(
+      signals.resendBehavior,
+      firstHit(file, content, RESEND_BEHAVIOR)
+    );
+    signals.rateLimit = pick(signals.rateLimit, firstHit(file, content, RATE_LIMIT));
+    signals.antiEnumeration = pick(
+      signals.antiEnumeration,
+      firstHit(file, content, ANTI_ENUMERATION)
+    );
+    signals.enumerationLeak = pick(
+      signals.enumerationLeak,
+      firstHit(file, content, ENUMERATION_LEAK)
+    );
+    signals.mobileOtpInput = pick(
+      signals.mobileOtpInput,
+      firstHit(file, content, MOBILE_OTP_INPUT)
+    );
+    signals.clearCopy = pick(
+      signals.clearCopy,
+      firstHit(file, content, CLEAR_COPY)
+    );
+    signals.recoveryPath = pick(
+      signals.recoveryPath,
+      firstHit(file, content, RECOVERY_PATH)
+    );
+    signals.deliveryVerification = pick(
+      signals.deliveryVerification,
+      firstHit(file, content, DELIVERY_VERIFICATION)
+    );
+  }
+  return signals;
+}
+async function checkOtpAuthReadiness(ctx) {
+  const signals = await collectOtpAuthSignals(ctx);
+  if (!signals.hasOtp && !signals.hasPaidReportOtp) return [];
+  const findings = [];
+  if (signals.hasSmsOrPhone && !signals.phoneNormalization) {
+    findings.push(
+      finding({
+        checkId: "otp-phone-normalization-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "OTP/auth flow mentions SMS or phone numbers but no phone normalization signal was found. Normalize to E.164 before lookup, delivery, and paid report access.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP/SMS context was found without a phone normalization signal."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.rateLimit) {
+    findings.push(
+      finding({
+        checkId: "otp-rate-limit-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show a rate limit, retry-after, or throttling signal. Launching without this invites brute-force code guessing and SMS/email abuse.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without a rate-limit signal."
+        )
+      })
+    );
+  }
+  if (signals.enumerationLeak && !signals.antiEnumeration) {
+    findings.push(
+      finding({
+        checkId: "otp-enumeration-leak",
+        severity: "high",
+        hit: signals.enumerationLeak,
+        message: "OTP/auth copy appears to reveal whether a user, purchase, or report exists. Use success-shaped start responses and generic failure copy before launch.",
+        evidence: evidence(
+          signals.enumerationLeak,
+          "Potential enumeration copy was found."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.resendBehavior) {
+    findings.push(
+      finding({
+        checkId: "otp-resend-behavior-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show resend, cooldown, or retry copy. Users need a clear path when an email/SMS code is delayed.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without resend or cooldown evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasFrontendOtp && !signals.mobileOtpInput) {
+    findings.push(
+      finding({
+        checkId: "otp-mobile-input-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "Frontend OTP/auth flow does not show mobile-friendly one-time-code input behavior. Use six numeric slots or inputMode/autocomplete support before launch.",
+        evidence: evidence(
+          signals.contextHit,
+          "Frontend OTP context was found without mobile one-time-code input evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.clearCopy) {
+    findings.push(
+      finding({
+        checkId: "otp-copy-clarity-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show clear code copy. Say which contact receives the code, the expected code format, and what to do if the latest code fails.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without clear verification-code copy."
+        )
+      })
+    );
+  }
+  if (signals.hasPaidReportOtp && !signals.recoveryPath) {
+    findings.push(
+      finding({
+        checkId: "otp-paid-report-recovery-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "Paid report access appears to depend on OTP, but no recovery path was found. Add alternate contact, receipt/support, or purchase-history recovery before launch.",
+        evidence: evidence(
+          signals.contextHit,
+          "Paid report OTP context was found without recovery-path evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.deliveryVerification) {
+    findings.push(
+      finding({
+        checkId: "otp-delivery-proof-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show delivery verification evidence. Treat gateway success as a start signal, then smoke a real delivered email/SMS code in the target environment.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without delivery smoke or gateway evidence."
+        )
+      })
+    );
+  }
+  return findings;
+}
+
 // src/checks/index.ts
 var ALL_CHECKS = [
   { id: "hardcoded-secrets", run: checkHardcodedSecrets },
@@ -1181,7 +1434,8 @@ var ALL_CHECKS = [
   { id: "language-patterns", run: checkLanguagePatterns },
   { id: "python-secret-key-env", run: checkPythonSecretKeyEnv },
   { id: "ruby-secret-key-base-env", run: checkRubySecretKeyBaseEnv },
-  { id: "placeholder-content", run: checkPlaceholderContent }
+  { id: "placeholder-content", run: checkPlaceholderContent },
+  { id: "otp-auth-readiness", run: checkOtpAuthReadiness }
 ];
 
 // src/items.ts
@@ -1206,6 +1460,11 @@ var CHECKLIST_ITEMS = {
     title: "Keep your test data away from real users",
     priority: "critical"
   },
+  "secure-auth": {
+    id: "secure-auth",
+    title: "Prove auth, OTP, and report access before launch",
+    priority: "critical"
+  },
   github: {
     id: "github",
     title: "Get your code into GitHub safely",
@@ -1244,17 +1503,13 @@ function permalinkFor(itemId, baseUrl) {
 
 // src/publish.ts
 import { promises as fs2 } from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var DEFAULT_BASE_URL = "https://shippingszn.com";
 var PUBLISH_TIMEOUT_MS = 3e3;
-function shouldPublish() {
-  const v = process.env["SHIPPINGSZN_PUBLISH"] ?? "";
-  return v === "1" || v.toLowerCase() === "true" || v === "yes";
-}
 async function detectStack(cwd2) {
   const tags = /* @__PURE__ */ new Set();
   try {
-    const raw = await fs2.readFile(path9.join(cwd2, "package.json"), "utf8");
+    const raw = await fs2.readFile(path10.join(cwd2, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const has = (n) => n in deps;
@@ -1289,15 +1544,18 @@ async function detectStack(cwd2) {
   ];
   for (const [file, tag] of checks) {
     try {
-      await fs2.access(path9.join(cwd2, file));
+      await fs2.access(path10.join(cwd2, file));
       tags.add(tag);
     } catch {
     }
   }
   return [...tags].slice(0, 12);
 }
-function buildPayload(totals, filesScanned, stack, scannerVersion) {
+function buildPayload(totals, filesScanned, stack, scannerVersion, score, label) {
   const out = {
+    source: "cli",
+    score,
+    label,
     filesScanned,
     findingsCritical: totals.critical ?? 0,
     findingsHigh: totals.high ?? 0,
@@ -1309,14 +1567,15 @@ function buildPayload(totals, filesScanned, stack, scannerVersion) {
   return out;
 }
 async function publishScan(totals, filesScanned, opts) {
-  if (!shouldPublish()) return "skipped";
   const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
   const stack = await detectStack(opts.cwd);
   const payload = buildPayload(
     totals,
     filesScanned,
     stack,
-    opts.scannerVersion
+    opts.scannerVersion,
+    opts.score,
+    opts.label
   );
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PUBLISH_TIMEOUT_MS);
@@ -1336,7 +1595,7 @@ async function publishScan(totals, filesScanned, opts) {
 }
 
 // src/proof.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var PROOF_TIMEOUT_MS = 5e3;
 var MAX_FINDINGS = 100;
 function shouldUploadProof() {
@@ -1347,9 +1606,9 @@ function clampText(value, max, fallback = "") {
   const text = value ?? fallback;
   return text.length > max ? text.slice(0, max - 3) + "..." : text;
 }
-function locationFromFinding(finding) {
-  if (!finding.file) return void 0;
-  return finding.line ? `${finding.file}:${finding.line}` : finding.file;
+function locationFromFinding(finding2) {
+  if (!finding2.file) return void 0;
+  return finding2.line ? `${finding2.file}:${finding2.line}` : finding2.file;
 }
 function buildBadgeMarkdown(baseUrl, id, score) {
   const params = new URLSearchParams({
@@ -1357,7 +1616,7 @@ function buildBadgeMarkdown(baseUrl, id, score) {
     theme: "dark"
   });
   const proofUrl = `${baseUrl}/proof/${encodeURIComponent(id)}`;
-  return `[![Launch readiness proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
+  return `[![shippingszn scan proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
 }
 function buildProofPayload(report, scannerVersion) {
   const counts = {
@@ -1370,7 +1629,7 @@ function buildProofPayload(report, scannerVersion) {
     version: 1,
     source: report.source ?? "cli",
     scanner: "shippingszn",
-    targetName: path10.basename(report.cwd) || "CLI scan",
+    targetName: path11.basename(report.cwd) || "CLI scan",
     score: report.launchReadiness.score,
     label: report.launchReadiness.label,
     decision: report.launchReadiness.decision,
@@ -1379,22 +1638,17 @@ function buildProofPayload(report, scannerVersion) {
     confidence: report.launchReadiness.confidence,
     checkedAt: report.generatedAt,
     counts,
-    findings: report.findings.slice(0, MAX_FINDINGS).map((finding) => ({
-      severity: finding.severity,
-      title: clampText(finding.itemTitle || finding.checkId, 160),
-      body: clampText(finding.message, 3e3),
-      whatFailed: clampText(finding.whatFailed, 3e3),
-      whyItBlocksLaunch: clampText(finding.whyItBlocksLaunch, 3e3),
-      fixInstructions: clampText(finding.fixInstructions, 4e3),
-      aiBuilderPrompt: clampText(finding.aiBuilderPrompt, 4e3),
-      evidence: clampText(finding.evidence, 3e3),
-      confidence: finding.confidence,
-      fixPrompt: clampText(finding.aiBuilderPrompt, 4e3),
-      verify: clampText(finding.verificationStep, 3e3),
-      verificationStep: clampText(finding.verificationStep, 3e3),
-      ...locationFromFinding(finding) ? { location: clampText(locationFromFinding(finding), 500) } : {},
-      permalink: finding.permalink,
-      itemTitle: clampText(finding.itemTitle, 160)
+    findings: report.findings.slice(0, MAX_FINDINGS).map((finding2) => ({
+      severity: finding2.severity,
+      title: clampText(finding2.itemTitle || finding2.checkId, 160),
+      body: clampText(finding2.message, 3e3),
+      whatFailed: clampText(finding2.whatFailed, 3e3),
+      whyItBlocksLaunch: clampText(finding2.whyItBlocksLaunch, 3e3),
+      evidence: clampText(finding2.evidence, 3e3),
+      confidence: finding2.confidence,
+      ...locationFromFinding(finding2) ? { location: clampText(locationFromFinding(finding2), 500) } : {},
+      permalink: finding2.permalink,
+      itemTitle: clampText(finding2.itemTitle, 160)
     })),
     filesScanned: report.filesScanned,
     topNextStep: clampText(report.launchReadiness.topNextStep, 1e3),
@@ -1502,52 +1756,6 @@ async function uploadProof(report, opts) {
   }
 }
 
-// src/remediation.ts
-var SEVERITY_INTENT = {
-  critical: "Treat this as launch-blocking until fixed.",
-  high: "Fix this before public traffic or paid acquisition.",
-  medium: "Fix this before announcing or indexing the launch.",
-  lower: "Fix this when polishing the launch artifact."
-};
-var ESCALATION = {
-  critical: "Escalate before launch if this touches secrets, auth, payments, customer data, production infrastructure, or anything already exposed publicly.",
-  high: "Escalate if the fix affects auth, payments, deploy config, browser security, or a user-visible production path.",
-  medium: "Escalate only if the fix changes routing, indexing, analytics, or public launch messaging.",
-  lower: "Escalation is usually unnecessary unless this blocks installability, branding, or a promised launch surface."
-};
-function locationForPrompt(finding) {
-  if (!finding.file) return "No specific file was attached to the finding.";
-  const line = finding.line ? `:${finding.line}` : "";
-  return `Likely location: ${finding.file}${line}.`;
-}
-function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
-  const proofStep = `After the fix verifies clean, run npx shippingszn --json and paste or upload the JSON at ${proofCreatePath} to create launch proof.`;
-  if (severity === "critical" || severity === "high") {
-    return `${proofStep} If this app has users, revenue, client trust, or paid API exposure, attach the clean scan to a paid launch-readiness report at ${reportUrl}.`;
-  }
-  return proofStep;
-}
-function buildRemediationPrompt({
-  finding,
-  item,
-  proofCreatePath,
-  reportUrl
-}) {
-  const itemTitle = item?.title ?? finding.itemId;
-  const location = locationForPrompt(finding);
-  const intent = SEVERITY_INTENT[finding.severity];
-  return {
-    fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding.severity}. Checklist area: ${itemTitle}. Finding: ${finding.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
-    verify: "Re-run npx shippingszn --json and confirm this exact finding is gone. Also run the app's normal typecheck/test/build command when the fix changes code, config, routing, security behavior, or public assets.",
-    escalation: ESCALATION[finding.severity],
-    proofNextStep: proofStepForSeverity(
-      finding.severity,
-      proofCreatePath,
-      reportUrl
-    )
-  };
-}
-
 // ../../lib/launch-readiness/src/index.ts
 var SEVERITY_WEIGHTS = {
   critical: 35,
@@ -1584,7 +1792,7 @@ var SCORE_BANDS = [
     id: "launchable",
     minScore: 90,
     maxScore: 100,
-    label: "Launchable with proof",
+    label: "Launchable",
     decision: "go",
     goNoGoLabel: "Go"
   }
@@ -1599,7 +1807,7 @@ var COVERAGE_LABELS = {
   public_surface: "Public launch surface",
   repo_static: "Repository static scan",
   secrets: "Secrets and config exposure",
-  auth: "Auth and private surfaces",
+  auth: "Auth, OTP, and private surfaces",
   paid_api: "Paid API and abuse risk",
   deployment: "Deployment and runtime config",
   content: "Launch content and metadata",
@@ -1644,8 +1852,8 @@ function normalizeLaunchCounts(counts) {
 }
 function countLaunchFindings(findings) {
   const counts = emptyLaunchReadinessCounts();
-  for (const finding of findings) {
-    counts[canonicalSeverity(finding.severity)] += 1;
+  for (const finding2 of findings) {
+    counts[canonicalSeverity(finding2.severity)] += 1;
   }
   return counts;
 }
@@ -1663,12 +1871,12 @@ function sourceLabel(source) {
   if (source === "url") return "public URL scan";
   return "manual intake";
 }
-function coverageArea(id, status, evidence, confidence) {
+function coverageArea(id, status, evidence2, confidence) {
   return {
     id,
     label: COVERAGE_LABELS[id],
     status,
-    evidence,
+    evidence: evidence2,
     confidence: confidence ?? (status === "checked" ? "high" : status === "partial" ? "medium" : "low")
   };
 }
@@ -1694,7 +1902,7 @@ function coverageForSource(source) {
       coverageArea(
         "auth",
         "not_checked",
-        "Private routes and role guards cannot be proven from a public unauthenticated fetch."
+        "Private routes, role guards, OTP delivery, phone normalization, resend behavior, and recovery paths cannot be proven from a public unauthenticated fetch."
       ),
       coverageArea(
         "paid_api",
@@ -1741,7 +1949,7 @@ function coverageForSource(source) {
       coverageArea(
         "auth",
         "partial",
-        "Static auth-risk signals were checked; runtime role behavior still needs verification."
+        "Static auth and OTP-risk signals were checked; runtime role behavior and real email/SMS delivery still need verification."
       ),
       coverageArea(
         "paid_api",
@@ -1787,7 +1995,7 @@ function coverageForSource(source) {
     coverageArea(
       "auth",
       "partial",
-      "Manual evidence can mention auth risk; runtime verification is still required.",
+      "Manual evidence can mention auth and OTP risk; runtime verification and delivered-code smoke are still required.",
       "low"
     ),
     coverageArea(
@@ -1837,10 +2045,10 @@ function defaultWhy(severity, source) {
   }
   return `This is lower-priority readiness polish, but it still belongs in the fix queue before the launch proof is treated as clean.`;
 }
-function locationLine(finding) {
-  if (finding.location?.trim()) return finding.location.trim();
-  if (!finding.file?.trim()) return "";
-  return finding.line ? `${finding.file.trim()}:${finding.line}` : finding.file.trim();
+function locationLine(finding2) {
+  if (finding2.location?.trim()) return finding2.location.trim();
+  if (!finding2.file?.trim()) return "";
+  return finding2.line ? `${finding2.file.trim()}:${finding2.line}` : finding2.file.trim();
 }
 function defaultPrompt(input) {
   const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
@@ -1856,37 +2064,37 @@ function defaultPrompt(input) {
     "Make the smallest production-safe change, preserve existing behavior, list files changed, and do not suppress the scanner unless you prove a false positive."
   ].join(" ");
 }
-function normalizeLaunchFinding(finding, source = "manual") {
-  const severity = canonicalSeverity(finding.severity);
+function normalizeLaunchFinding(finding2, source = "manual") {
+  const severity = canonicalSeverity(finding2.severity);
   const title = clampText2(
-    finding.title ?? finding.itemTitle,
+    finding2.title ?? finding2.itemTitle,
     "Launch-readiness finding",
     160
   );
   const body = clampText2(
-    finding.body ?? finding.message,
+    finding2.body ?? finding2.message,
     "The scan flagged this as a launch-readiness risk.",
     3e3
   );
-  const whatFailed = clampText2(finding.whatFailed, body, 3e3);
+  const whatFailed = clampText2(finding2.whatFailed, body, 3e3);
   const whyItBlocksLaunch = clampText2(
-    finding.whyItBlocksLaunch,
+    finding2.whyItBlocksLaunch,
     body || defaultWhy(severity, source),
     3e3
   );
   const fixInstructions = clampText2(
-    finding.fixInstructions ?? finding.fixPrompt,
+    finding2.fixInstructions ?? finding2.fixPrompt,
     `Fix the underlying ${severity} launch-readiness risk and keep the app behavior intact.`,
     4e3
   );
   const verificationStep = clampText2(
-    finding.verificationStep ?? finding.verify,
+    finding2.verificationStep ?? finding2.verify,
     "Run the same scan again and confirm this finding is gone before launch.",
     3e3
   );
-  const location = locationLine(finding);
+  const location = locationLine(finding2);
   const aiBuilderPrompt = clampText2(
-    finding.aiBuilderPrompt,
+    finding2.aiBuilderPrompt,
     defaultPrompt({
       severity,
       title,
@@ -1898,13 +2106,13 @@ function normalizeLaunchFinding(finding, source = "manual") {
     }),
     4e3
   );
-  const evidence = clampText2(
-    finding.evidence,
+  const evidence2 = clampText2(
+    finding2.evidence,
     location ? `Observed at ${location}.` : body,
     3e3
   );
   const confidence = normalizeConfidence(
-    finding.confidence,
+    finding2.confidence,
     confidenceForSource(source)
   );
   return {
@@ -1915,21 +2123,21 @@ function normalizeLaunchFinding(finding, source = "manual") {
     fixInstructions,
     aiBuilderPrompt,
     verificationStep,
-    evidence,
+    evidence: evidence2,
     confidence,
     body,
     message: body,
     fixPrompt: aiBuilderPrompt,
     verify: verificationStep,
     ...location ? { location } : {},
-    ...finding.file ? { file: finding.file } : {},
-    ...finding.line ? { line: finding.line } : {},
-    ...finding.permalink ? { permalink: finding.permalink } : {},
-    ...finding.itemTitle ? { itemTitle: finding.itemTitle } : {}
+    ...finding2.file ? { file: finding2.file } : {},
+    ...finding2.line ? { line: finding2.line } : {},
+    ...finding2.permalink ? { permalink: finding2.permalink } : {},
+    ...finding2.itemTitle ? { itemTitle: finding2.itemTitle } : {}
   };
 }
 function prioritizeLaunchFindings(findings, source = "manual") {
-  return findings.map((finding) => normalizeLaunchFinding(finding, source)).sort((a, b) => {
+  return findings.map((finding2) => normalizeLaunchFinding(finding2, source)).sort((a, b) => {
     const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
     if (bySeverity !== 0) return bySeverity;
     return a.title.localeCompare(b.title);
@@ -1965,12 +2173,12 @@ function decisionText(band, counts, source) {
     return `Fix the high-risk launch gaps before a real campaign, customer demo, or paid traffic.`;
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as clean proof.`;
+    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as launchable.`;
   }
   if (source === "url") {
     return "No public-page blockers were found. Run the CLI or GitHub Action before calling the app launch-ready.";
   }
-  return `${band.goNoGoLabel}: no scan-detected blockers were found. Keep the proof attached to the launch record.`;
+  return `${band.goNoGoLabel}: no scan-detected blockers were found. Monitor first production traffic.`;
 }
 function topNextStep(blockers, counts, source) {
   const top = blockers[0];
@@ -1981,12 +2189,12 @@ function topNextStep(blockers, counts, source) {
     return "Run the repo scan next so secrets, auth, API routes, and generated-code risks are checked before launch.";
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return "Fix the remaining readiness gaps and rescan before publishing proof.";
+    return "Fix the remaining readiness gaps and rescan before launch.";
   }
-  return "Attach this clean scan proof to the launch record and keep monitoring the first production traffic.";
+  return "No obvious launch blockers caught. Monitor first production traffic and keep the paid report for higher-stakes launches.";
 }
 function aggregateConfidence(source, findings) {
-  if (findings.some((finding) => finding.confidence === "low")) return "low";
+  if (findings.some((finding2) => finding2.confidence === "low")) return "low";
   if (source === "url") return "medium";
   return "high";
 }
@@ -2003,7 +2211,7 @@ function assessLaunchReadiness(input) {
   const checkedAreas = coverage.filter((area) => area.status === "checked");
   const uncheckedAreas = coverage.filter((area) => area.status !== "checked");
   const blockers = findings.filter(
-    (finding) => finding.severity === "critical" || finding.severity === "high"
+    (finding2) => finding2.severity === "critical" || finding2.severity === "high"
   );
   const decision = decisionText(band, counts, source);
   const reportRecommended = counts.critical > 0 || counts.high > 0 || coveragePenalty > 0;
@@ -2068,7 +2276,7 @@ function parseArgs(argv2) {
     help: false,
     version: false,
     noColor: !!process2.env.NO_COLOR,
-    publish: false,
+    publish: !publishDisabledByEnv(),
     proof: shouldUploadProof()
   };
   for (let i = 0; i < argv2.length; i++) {
@@ -2077,14 +2285,30 @@ function parseArgs(argv2) {
     else if (a === "--version" || a === "-v") opts.version = true;
     else if (a === "--json") opts.json = true;
     else if (a === "--publish") opts.publish = true;
+    else if (a === "--no-publish") opts.publish = false;
     else if (a === "--proof") opts.proof = true;
     else if (a === "--no-color") opts.noColor = true;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
-    else if (a === "--cwd") opts.cwd = path11.resolve(argv2[++i] ?? opts.cwd);
-    else if (!a.startsWith("-")) opts.cwd = path11.resolve(a);
+    else if (a === "--cwd") opts.cwd = path12.resolve(argv2[++i] ?? opts.cwd);
+    else if (!a.startsWith("-")) opts.cwd = path12.resolve(a);
   }
   return opts;
 }
+function envTruthy(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+function envFalsey(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "0" || normalized === "false" || normalized === "no";
+}
+function publishDisabledByEnv() {
+  if (envTruthy(process2.env.SHIPPINGSZN_DISABLE_PUBLISH)) return true;
+  if (envFalsey(process2.env.SHIPPINGSZN_PUBLISH)) return true;
+  return false;
+}
 function color(enabled) {
   const wrap = (codes) => (s) => enabled ? `\x1B[${codes}m${s}\x1B[0m` : s;
   return {
@@ -2118,12 +2342,8 @@ Usage:
 
 Options:
   --json                Output a machine-readable JSON report.
-  --publish             Opt in to posting an anonymous summary to the public
-                        Wall of Launches. Never uploads source code, paths,
-                        filenames, or project names.
-  --proof               Opt in to posting this scan to /api/scan-results and
-                        printing a proof URL, Wall URL, report URL, and badge.
-                        Can also be enabled with SHIPPINGSZN_PROOF=1.
+  --publish             Legacy alias. Anonymous Wall stats publish by default.
+  --no-publish          Disable the anonymous Wall post for this run.
   --base-url <url>      Base URL used to build links back to checklist items.
                         (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
@@ -2131,8 +2351,9 @@ Options:
   -h, --help            Show this help.
   -v, --version         Print version.
 
-The scanner only reads files. It never writes, modifies, deletes, or makes
-network requests unless you explicitly opt in with --publish or --proof.
+The scanner only reads files. It never writes, modifies, or deletes. It posts
+anonymous aggregate Wall stats by default: no source code, paths, filenames,
+project names, secrets, handles, emails, or repo URLs.
 Exit code is non-zero if any Critical findings are detected.
 `
   );
@@ -2173,18 +2394,13 @@ async function run() {
   const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
   const reportUrl = `${trimmedBaseUrl}/report`;
   const proofCreatePath = `${trimmedBaseUrl}/scan`;
-  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.";
+  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON on shippingszn.com/scan if you want to attach the local scan to a paid report handoff.";
   const tracked_aware = applyTrackingAwareSeverity(all, tracked);
   const source = scanSource();
   const enriched = tracked_aware.map((f) => {
     const item = CHECKLIST_ITEMS[f.itemId];
-    const remediation = buildRemediationPrompt({
-      finding: f,
-      item,
-      proofCreatePath,
-      reportUrl
-    });
     const itemTitle = item?.title ?? f.itemId;
+    const permalink = permalinkFor(f.itemId, opts.baseUrl);
     const normalized = normalizeLaunchFinding(
       {
         severity: f.severity,
@@ -2194,22 +2410,26 @@ async function run() {
         evidence: f.evidence,
         file: f.file,
         line: f.line,
-        permalink: permalinkFor(f.itemId, opts.baseUrl),
-        itemTitle,
-        fixInstructions: remediation.fixPrompt,
-        aiBuilderPrompt: remediation.fixPrompt,
-        verificationStep: remediation.verify,
-        fixPrompt: remediation.fixPrompt,
-        verify: remediation.verify
+        permalink,
+        itemTitle
       },
       source
     );
     return {
       ...f,
-      ...normalized,
+      severity: normalized.severity,
+      title: normalized.title,
+      body: normalized.body,
+      message: normalized.message,
+      whatFailed: normalized.whatFailed,
+      whyItBlocksLaunch: normalized.whyItBlocksLaunch,
+      evidence: normalized.evidence,
+      confidence: normalized.confidence,
+      ...normalized.location ? { location: normalized.location } : {},
+      ...normalized.file ? { file: normalized.file } : {},
+      ...normalized.line ? { line: normalized.line } : {},
       itemTitle,
-      permalink: permalinkFor(f.itemId, opts.baseUrl),
-      remediation
+      permalink
     };
   });
   enriched.sort((a, b) => {
@@ -2276,16 +2496,18 @@ async function run() {
   }
   let publishResult = "skipped";
   try {
-    if (opts.publish) {
-      process2.env["SHIPPINGSZN_PUBLISH"] = "1";
-    }
     const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
-    if (!proofAlreadyPublishedWall) {
+    if (opts.publish && !proofAlreadyPublishedWall) {
       publishResult = await publishScan(totals, files.length, {
         cwd: opts.cwd,
         baseUrl: opts.baseUrl,
-        scannerVersion: PKG_VERSION
+        scannerVersion: PKG_VERSION,
+        score: launchReadiness.score,
+        label: launchReadiness.label
       });
+      if (publishResult === "published") {
+        report.launchReadiness.wallUrl = `${opts.baseUrl.replace(/\/$/, "")}/wall`;
+      }
     }
   } catch {
   }
@@ -2323,12 +2545,12 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
   );
   process2.stdout.write(
-    `${c.bold("Fix prompts:")} ${c.dim("Run with --json for copy/paste AI-builder remediation prompts.")}
+    `${c.bold("Action plan:")} ${c.dim("Exact AI-builder prompts and verification steps are in the paid report.")}
 `
   );
   if (launchReadiness.reportUrl) {
     process2.stdout.write(
-      `${c.bold("Need paid confidence?")} ${c.dim(`Get a launch-readiness report: ${launchReadiness.reportUrl}`)}
+      `${c.bold("Need a written launch decision?")} ${c.dim(`Get the $49 report: ${launchReadiness.reportUrl}`)}
 `
     );
   }
@@ -2363,8 +2585,9 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
     );
   } else {
+    const wallLine = publishResult === "published" ? `Posted anonymous scan stats to ${opts.baseUrl.replace(/\/$/, "")}/wall.` : opts.publish ? "Anonymous Wall stats post by default. If the network is blocked, the local scan still finishes." : "Private local run: Wall publish disabled.";
     process2.stdout.write(
-      `${c.bold("Share proof:")} ${c.dim("Run with --proof to publish this scan to a public proof URL.")}
+      `${c.bold("Wall signal:")} ${c.dim(wallLine)}
 `
     );
   }
@@ -2372,7 +2595,7 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
   if (enriched.length === 0) {
     process2.stdout.write(
       c.green(
-        "No findings. Attach the clean scan proof to the launch record before shipping.\n\n"
+        "No findings. The scanner did not catch obvious launch blockers in this pass.\n\n"
       )
     );
     if (publishResult === "published") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",