shippingszn 0.8.4 → 0.8.5

package/README.md

@@ -12,13 +12,14 @@ pnpm dlx shippingszn
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-Everything stays on your machine unless you explicitly opt in with `--proof`
-or `--publish`.
+By default it posts one anonymous Wall of Launches entry with score, severity
+counts, files scanned, scanner version, and safe stack tags. It never uploads
+source code, paths, filenames, repo URLs, project names, secrets, handles, or
+emails. Use `--no-publish` for a private local run.
 
 Human output starts with a Launch Readiness Score, scope covered, the top next
 step to fix, and severity counts. Run with `--json` to get machine-readable
-findings, copy/paste fix prompts for your AI builder, and proof/report handoff
-fields:
+findings plus the Wall/report handoff fields:
 
 ```json
 {
@@ -32,24 +33,15 @@ fields:
     "coveragePenalty": 0,
     "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
     "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
-    "proofCreatePath": "https://shippingszn.com/scan",
-    "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
-    "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
-    "proofResultId": "00000000-0000-4000-8000-000000000123",
-    "badgeMarkdown": "[![shippingszn scan proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
     "wallUrl": "https://shippingszn.com/wall",
-    "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
+    "reportUrl": "https://shippingszn.com/report"
   },
   "findings": [
     {
       "severity": "critical",
       "message": "Possible OpenAI API key hardcoded in source.",
-      "remediation": {
-        "fixPrompt": "You are fixing a shippingszn launch-readiness finding...",
-        "verify": "Re-run npx shippingszn --json and confirm this exact finding is gone...",
-        "escalation": "Escalate before launch if this touches secrets, auth, payments...",
-        "proofNextStep": "After the fix verifies clean, run npx shippingszn --json..."
-      }
+      "whatFailed": "A secret-like token appears in a scanned file.",
+      "whyItBlocksLaunch": "A leaked key can spend money or expose customer data before you notice."
     }
   ]
 }
@@ -59,26 +51,20 @@ When Critical or High findings make paid confidence relevant, the summary also
 includes a `/report` link. Clean scans and lower-risk findings do not push the
 paid report CTA.
 
-## Direct proof publishing
+## Wall publishing
 
-Use `--proof` when you want the current scan to become shareable launch proof:
+Plain `npx shippingszn` feeds the Wall automatically. The public row is
+anonymous and intentionally small: score, launch label, files scanned, finding
+counts, detected stack tags, scanner version, and timestamp.
+
+Use this when you want a completely private local run:
 
 ```bash
-npx shippingszn --json --proof > shippingszn-scan.json
+npx shippingszn --no-publish
 ```
 
-That opt-in posts the scan summary and remediation fields to
-`/api/scan-results`, then adds `launchReadiness.proofUrl`,
-`launchReadiness.proofResultId`, `launchReadiness.badgeMarkdown`,
-`launchReadiness.wallUrl`, and `launchReadiness.reportUrl` to the JSON. It
-also posts a proof-linked severity summary to the Wall of Launches. If proof
-upload fails, findings still print and JSON includes
-`launchReadiness.proofUploadError`; if the Wall publish fails, JSON includes
-`launchReadiness.wallPublishError`.
-
-For a manual handoff, you can still run `npx shippingszn --json >
-shippingszn-scan.json` and paste or upload the file at
-`https://shippingszn.com/scan`.
+For a paid-report handoff, run `npx shippingszn --json > shippingszn-scan.json`
+and paste or upload the file at `https://shippingszn.com/scan`.
 
 ## What gets checked
 
@@ -156,12 +142,8 @@ shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON report.
-  --publish             Opt in to posting an anonymous summary to the public
-                        Wall of Launches. Never uploads source code, paths,
-                        filenames, or project names.
-  --proof               Opt in to posting this scan to /api/scan-results and
-                        printing a proof URL, Wall URL, report URL, and badge.
-                        Can also be enabled with SHIPPINGSZN_PROOF=1.
+  --publish             Legacy alias. Anonymous Wall stats publish by default.
+  --no-publish          Disable the anonymous Wall post for this run.
   --base-url <url>      Base URL used to build links back to checklist items.
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable report.
@@ -179,32 +161,22 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json --proof > launch-check.json
+- run: npx shippingszn --json > launch-check.json
 ```
 
-For PR scan proof, have GitHub Actions run the scanner with `--proof` and post
-the JSON summary as a comment: score, severity counts, top next step, proof URL,
-badge markdown, Wall URL, report URL, and worst Critical/High findings. Keep
-`--publish` out of the workflow unless you explicitly want to publish an
-anonymous Wall summary when proof upload fails.
+For PR scan signal, have GitHub Actions run the scanner and post the JSON
+summary as a comment: score, severity counts, top next step, Wall URL, report
+URL, and worst Critical/High findings.
 
 ## Privacy
 
-`shippingszn` reads files on your machine. It never uploads source code,
-makes outbound network calls, or phones home by default. No accounts.
-Inspect the source or audit `npm pack --dry-run` to confirm.
-
-If you want public launch-readiness proof, pass `--proof`. That opt-in posts
-the current scan result to shippingszn so it can create a proof page, report
-handoff, README badge, and proof-linked Wall entry. It uploads finding titles,
-messages, remediation prompts, verification text, checklist permalinks,
-severity counts, score, file count, target folder name, and scanner version. It
-does not upload source code or secret values.
-
-If you only want an anonymous Wall of Launches summary, pass `--publish`.
-That opt-in posts files scanned count, finding counts by severity, detected
-stack tags, and scanner version. It never uploads source code, file paths,
-filenames, project names, secrets, or report contents.
+`shippingszn` reads files on your machine. It never uploads source code. By
+default it makes one best-effort outbound request to post anonymous Wall stats:
+score, launch label, files scanned count, finding counts by severity, detected
+stack tags, scanner version, and timestamp. It never uploads source code, file
+paths, filenames, project names, repo URLs, secrets, emails, handles, or report
+contents. Use `--no-publish` or `SHIPPINGSZN_DISABLE_PUBLISH=1` to disable that
+request.
 
 ## License
 

package/dist/index.js

@@ -1506,10 +1506,6 @@ import { promises as fs2 } from "node:fs";
 import * as path10 from "node:path";
 var DEFAULT_BASE_URL = "https://shippingszn.com";
 var PUBLISH_TIMEOUT_MS = 3e3;
-function shouldPublish() {
-  const v = process.env["SHIPPINGSZN_PUBLISH"] ?? "";
-  return v === "1" || v.toLowerCase() === "true" || v === "yes";
-}
 async function detectStack(cwd2) {
   const tags = /* @__PURE__ */ new Set();
   try {
@@ -1555,8 +1551,11 @@ async function detectStack(cwd2) {
   }
   return [...tags].slice(0, 12);
 }
-function buildPayload(totals, filesScanned, stack, scannerVersion) {
+function buildPayload(totals, filesScanned, stack, scannerVersion, score, label) {
   const out = {
+    source: "cli",
+    score,
+    label,
     filesScanned,
     findingsCritical: totals.critical ?? 0,
     findingsHigh: totals.high ?? 0,
@@ -1568,14 +1567,15 @@ function buildPayload(totals, filesScanned, stack, scannerVersion) {
   return out;
 }
 async function publishScan(totals, filesScanned, opts) {
-  if (!shouldPublish()) return "skipped";
   const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
   const stack = await detectStack(opts.cwd);
   const payload = buildPayload(
     totals,
     filesScanned,
     stack,
-    opts.scannerVersion
+    opts.scannerVersion,
+    opts.score,
+    opts.label
   );
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), PUBLISH_TIMEOUT_MS);
@@ -1644,13 +1644,8 @@ function buildProofPayload(report, scannerVersion) {
       body: clampText(finding2.message, 3e3),
       whatFailed: clampText(finding2.whatFailed, 3e3),
       whyItBlocksLaunch: clampText(finding2.whyItBlocksLaunch, 3e3),
-      fixInstructions: clampText(finding2.fixInstructions, 4e3),
-      aiBuilderPrompt: clampText(finding2.aiBuilderPrompt, 4e3),
       evidence: clampText(finding2.evidence, 3e3),
       confidence: finding2.confidence,
-      fixPrompt: clampText(finding2.aiBuilderPrompt, 4e3),
-      verify: clampText(finding2.verificationStep, 3e3),
-      verificationStep: clampText(finding2.verificationStep, 3e3),
       ...locationFromFinding(finding2) ? { location: clampText(locationFromFinding(finding2), 500) } : {},
       permalink: finding2.permalink,
       itemTitle: clampText(finding2.itemTitle, 160)
@@ -1761,52 +1756,6 @@ async function uploadProof(report, opts) {
   }
 }
 
-// src/remediation.ts
-var SEVERITY_INTENT = {
-  critical: "Treat this as launch-blocking until fixed.",
-  high: "Fix this before public traffic or paid acquisition.",
-  medium: "Fix this before announcing or indexing the launch.",
-  lower: "Fix this when polishing the launch artifact."
-};
-var ESCALATION = {
-  critical: "Escalate before launch if this touches secrets, auth, payments, customer data, production infrastructure, or anything already exposed publicly.",
-  high: "Escalate if the fix affects auth, payments, deploy config, browser security, or a user-visible production path.",
-  medium: "Escalate only if the fix changes routing, indexing, analytics, or public launch messaging.",
-  lower: "Escalation is usually unnecessary unless this blocks installability, branding, or a promised launch surface."
-};
-function locationForPrompt(finding2) {
-  if (!finding2.file) return "No specific file was attached to the finding.";
-  const line = finding2.line ? `:${finding2.line}` : "";
-  return `Likely location: ${finding2.file}${line}.`;
-}
-function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
-  const proofStep = `After the fix verifies clean, run npx shippingszn --json and paste or upload the JSON at ${proofCreatePath} to create launch proof.`;
-  if (severity === "critical" || severity === "high") {
-    return `${proofStep} If this app has users, revenue, client trust, or paid API exposure, attach the clean scan to a paid launch-readiness report at ${reportUrl}.`;
-  }
-  return proofStep;
-}
-function buildRemediationPrompt({
-  finding: finding2,
-  item,
-  proofCreatePath,
-  reportUrl
-}) {
-  const itemTitle = item?.title ?? finding2.itemId;
-  const location = locationForPrompt(finding2);
-  const intent = SEVERITY_INTENT[finding2.severity];
-  return {
-    fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding2.severity}. Checklist area: ${itemTitle}. Finding: ${finding2.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
-    verify: "Re-run npx shippingszn --json and confirm this exact finding is gone. Also run the app's normal typecheck/test/build command when the fix changes code, config, routing, security behavior, or public assets.",
-    escalation: ESCALATION[finding2.severity],
-    proofNextStep: proofStepForSeverity(
-      finding2.severity,
-      proofCreatePath,
-      reportUrl
-    )
-  };
-}
-
 // ../../lib/launch-readiness/src/index.ts
 var SEVERITY_WEIGHTS = {
   critical: 35,
@@ -1843,7 +1792,7 @@ var SCORE_BANDS = [
     id: "launchable",
     minScore: 90,
     maxScore: 100,
-    label: "Launchable with proof",
+    label: "Launchable",
     decision: "go",
     goNoGoLabel: "Go"
   }
@@ -2224,12 +2173,12 @@ function decisionText(band, counts, source) {
     return `Fix the high-risk launch gaps before a real campaign, customer demo, or paid traffic.`;
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as clean proof.`;
+    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as launchable.`;
   }
   if (source === "url") {
     return "No public-page blockers were found. Run the CLI or GitHub Action before calling the app launch-ready.";
   }
-  return `${band.goNoGoLabel}: no scan-detected blockers were found. Keep the proof attached to the launch record.`;
+  return `${band.goNoGoLabel}: no scan-detected blockers were found. Monitor first production traffic.`;
 }
 function topNextStep(blockers, counts, source) {
   const top = blockers[0];
@@ -2240,9 +2189,9 @@ function topNextStep(blockers, counts, source) {
     return "Run the repo scan next so secrets, auth, API routes, and generated-code risks are checked before launch.";
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return "Fix the remaining readiness gaps and rescan before publishing proof.";
+    return "Fix the remaining readiness gaps and rescan before launch.";
   }
-  return "Attach this clean scan proof to the launch record and keep monitoring the first production traffic.";
+  return "No obvious launch blockers caught. Monitor first production traffic and keep the paid report for higher-stakes launches.";
 }
 function aggregateConfidence(source, findings) {
   if (findings.some((finding2) => finding2.confidence === "low")) return "low";
@@ -2327,7 +2276,7 @@ function parseArgs(argv2) {
     help: false,
     version: false,
     noColor: !!process2.env.NO_COLOR,
-    publish: false,
+    publish: !publishDisabledByEnv(),
     proof: shouldUploadProof()
   };
   for (let i = 0; i < argv2.length; i++) {
@@ -2336,6 +2285,7 @@ function parseArgs(argv2) {
     else if (a === "--version" || a === "-v") opts.version = true;
     else if (a === "--json") opts.json = true;
     else if (a === "--publish") opts.publish = true;
+    else if (a === "--no-publish") opts.publish = false;
     else if (a === "--proof") opts.proof = true;
     else if (a === "--no-color") opts.noColor = true;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
@@ -2344,6 +2294,21 @@ function parseArgs(argv2) {
   }
   return opts;
 }
+function envTruthy(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+function envFalsey(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "0" || normalized === "false" || normalized === "no";
+}
+function publishDisabledByEnv() {
+  if (envTruthy(process2.env.SHIPPINGSZN_DISABLE_PUBLISH)) return true;
+  if (envFalsey(process2.env.SHIPPINGSZN_PUBLISH)) return true;
+  return false;
+}
 function color(enabled) {
   const wrap = (codes) => (s) => enabled ? `\x1B[${codes}m${s}\x1B[0m` : s;
   return {
@@ -2377,12 +2342,8 @@ Usage:
 
 Options:
   --json                Output a machine-readable JSON report.
-  --publish             Opt in to posting an anonymous summary to the public
-                        Wall of Launches. Never uploads source code, paths,
-                        filenames, or project names.
-  --proof               Opt in to posting this scan to /api/scan-results and
-                        printing a proof URL, Wall URL, report URL, and badge.
-                        Can also be enabled with SHIPPINGSZN_PROOF=1.
+  --publish             Legacy alias. Anonymous Wall stats publish by default.
+  --no-publish          Disable the anonymous Wall post for this run.
   --base-url <url>      Base URL used to build links back to checklist items.
                         (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
@@ -2390,8 +2351,9 @@ Options:
   -h, --help            Show this help.
   -v, --version         Print version.
 
-The scanner only reads files. It never writes, modifies, deletes, or makes
-network requests unless you explicitly opt in with --publish or --proof.
+The scanner only reads files. It never writes, modifies, or deletes. It posts
+anonymous aggregate Wall stats by default: no source code, paths, filenames,
+project names, secrets, handles, emails, or repo URLs.
 Exit code is non-zero if any Critical findings are detected.
 `
   );
@@ -2432,18 +2394,13 @@ async function run() {
   const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
   const reportUrl = `${trimmedBaseUrl}/report`;
   const proofCreatePath = `${trimmedBaseUrl}/scan`;
-  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.";
+  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON on shippingszn.com/scan if you want to attach the local scan to a paid report handoff.";
   const tracked_aware = applyTrackingAwareSeverity(all, tracked);
   const source = scanSource();
   const enriched = tracked_aware.map((f) => {
     const item = CHECKLIST_ITEMS[f.itemId];
-    const remediation = buildRemediationPrompt({
-      finding: f,
-      item,
-      proofCreatePath,
-      reportUrl
-    });
     const itemTitle = item?.title ?? f.itemId;
+    const permalink = permalinkFor(f.itemId, opts.baseUrl);
     const normalized = normalizeLaunchFinding(
       {
         severity: f.severity,
@@ -2453,22 +2410,26 @@ async function run() {
         evidence: f.evidence,
         file: f.file,
         line: f.line,
-        permalink: permalinkFor(f.itemId, opts.baseUrl),
-        itemTitle,
-        fixInstructions: remediation.fixPrompt,
-        aiBuilderPrompt: remediation.fixPrompt,
-        verificationStep: remediation.verify,
-        fixPrompt: remediation.fixPrompt,
-        verify: remediation.verify
+        permalink,
+        itemTitle
       },
       source
     );
     return {
       ...f,
-      ...normalized,
+      severity: normalized.severity,
+      title: normalized.title,
+      body: normalized.body,
+      message: normalized.message,
+      whatFailed: normalized.whatFailed,
+      whyItBlocksLaunch: normalized.whyItBlocksLaunch,
+      evidence: normalized.evidence,
+      confidence: normalized.confidence,
+      ...normalized.location ? { location: normalized.location } : {},
+      ...normalized.file ? { file: normalized.file } : {},
+      ...normalized.line ? { line: normalized.line } : {},
       itemTitle,
-      permalink: permalinkFor(f.itemId, opts.baseUrl),
-      remediation
+      permalink
     };
   });
   enriched.sort((a, b) => {
@@ -2535,16 +2496,18 @@ async function run() {
   }
   let publishResult = "skipped";
   try {
-    if (opts.publish) {
-      process2.env["SHIPPINGSZN_PUBLISH"] = "1";
-    }
     const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
-    if (!proofAlreadyPublishedWall) {
+    if (opts.publish && !proofAlreadyPublishedWall) {
       publishResult = await publishScan(totals, files.length, {
         cwd: opts.cwd,
         baseUrl: opts.baseUrl,
-        scannerVersion: PKG_VERSION
+        scannerVersion: PKG_VERSION,
+        score: launchReadiness.score,
+        label: launchReadiness.label
       });
+      if (publishResult === "published") {
+        report.launchReadiness.wallUrl = `${opts.baseUrl.replace(/\/$/, "")}/wall`;
+      }
     }
   } catch {
   }
@@ -2582,12 +2545,12 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
   );
   process2.stdout.write(
-    `${c.bold("Fix prompts:")} ${c.dim("Run with --json for copy/paste AI-builder remediation prompts.")}
+    `${c.bold("Action plan:")} ${c.dim("Exact AI-builder prompts and verification steps are in the paid report.")}
 `
   );
   if (launchReadiness.reportUrl) {
     process2.stdout.write(
-      `${c.bold("Need paid confidence?")} ${c.dim(`Get a launch-readiness report: ${launchReadiness.reportUrl}`)}
+      `${c.bold("Need a written launch decision?")} ${c.dim(`Get the $49 report: ${launchReadiness.reportUrl}`)}
 `
     );
   }
@@ -2622,8 +2585,9 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
     );
   } else {
+    const wallLine = publishResult === "published" ? `Posted anonymous scan stats to ${opts.baseUrl.replace(/\/$/, "")}/wall.` : opts.publish ? "Anonymous Wall stats post by default. If the network is blocked, the local scan still finishes." : "Private local run: Wall publish disabled.";
     process2.stdout.write(
-      `${c.bold("Share proof:")} ${c.dim("Run with --proof to publish this scan to a public proof URL.")}
+      `${c.bold("Wall signal:")} ${c.dim(wallLine)}
 `
     );
   }
@@ -2631,7 +2595,7 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
   if (enriched.length === 0) {
     process2.stdout.write(
       c.green(
-        "No findings. Attach the clean scan proof to the launch record before shipping.\n\n"
+        "No findings. The scanner did not catch obvious launch blockers in this pass.\n\n"
       )
     );
     if (publishResult === "published") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",