shippingszn 0.8.4 → 0.9.0

package/README.md

@@ -12,13 +12,14 @@ pnpm dlx shippingszn
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-Everything stays on your machine unless you explicitly opt in with `--proof`
-or `--publish`.
+By default it posts one anonymous Wall of Launches entry with score, severity
+counts, files scanned, scanner version, and safe stack tags. It never uploads
+source code, paths, filenames, repo URLs, project names, secrets, handles, or
+emails. Use `--no-publish` for a private local run.
 
 Human output starts with a Launch Readiness Score, scope covered, the top next
 step to fix, and severity counts. Run with `--json` to get machine-readable
-findings, copy/paste fix prompts for your AI builder, and proof/report handoff
-fields:
+findings plus the Wall/report handoff fields:
 
 ```json
 {
@@ -32,24 +33,15 @@ fields:
     "coveragePenalty": 0,
     "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
     "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
-    "proofCreatePath": "https://shippingszn.com/scan",
-    "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
-    "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
-    "proofResultId": "00000000-0000-4000-8000-000000000123",
-    "badgeMarkdown": "[![shippingszn scan proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
     "wallUrl": "https://shippingszn.com/wall",
-    "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
+    "reportUrl": "https://shippingszn.com/report"
   },
   "findings": [
     {
       "severity": "critical",
       "message": "Possible OpenAI API key hardcoded in source.",
-      "remediation": {
-        "fixPrompt": "You are fixing a shippingszn launch-readiness finding...",
-        "verify": "Re-run npx shippingszn --json and confirm this exact finding is gone...",
-        "escalation": "Escalate before launch if this touches secrets, auth, payments...",
-        "proofNextStep": "After the fix verifies clean, run npx shippingszn --json..."
-      }
+      "whatFailed": "A secret-like token appears in a scanned file.",
+      "whyItBlocksLaunch": "A leaked key can spend money or expose customer data before you notice."
     }
   ]
 }
@@ -59,26 +51,20 @@ When Critical or High findings make paid confidence relevant, the summary also
 includes a `/report` link. Clean scans and lower-risk findings do not push the
 paid report CTA.
 
-## Direct proof publishing
+## Wall publishing
 
-Use `--proof` when you want the current scan to become shareable launch proof:
+Plain `npx shippingszn` feeds the Wall automatically. The public row is
+anonymous and intentionally small: score, launch label, files scanned, finding
+counts, detected stack tags, scanner version, and timestamp.
+
+Use this when you want a completely private local run:
 
 ```bash
-npx shippingszn --json --proof > shippingszn-scan.json
+npx shippingszn --no-publish
 ```
 
-That opt-in posts the scan summary and remediation fields to
-`/api/scan-results`, then adds `launchReadiness.proofUrl`,
-`launchReadiness.proofResultId`, `launchReadiness.badgeMarkdown`,
-`launchReadiness.wallUrl`, and `launchReadiness.reportUrl` to the JSON. It
-also posts a proof-linked severity summary to the Wall of Launches. If proof
-upload fails, findings still print and JSON includes
-`launchReadiness.proofUploadError`; if the Wall publish fails, JSON includes
-`launchReadiness.wallPublishError`.
-
-For a manual handoff, you can still run `npx shippingszn --json >
-shippingszn-scan.json` and paste or upload the file at
-`https://shippingszn.com/scan`.
+For a paid-report handoff, run `npx shippingszn --json > shippingszn-scan.json`
+and paste or upload the file at `https://shippingszn.com/scan`.
 
 ## What gets checked
 
@@ -156,12 +142,8 @@ shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON report.
-  --publish             Opt in to posting an anonymous summary to the public
-                        Wall of Launches. Never uploads source code, paths,
-                        filenames, or project names.
-  --proof               Opt in to posting this scan to /api/scan-results and
-                        printing a proof URL, Wall URL, report URL, and badge.
-                        Can also be enabled with SHIPPINGSZN_PROOF=1.
+  --publish             Legacy alias. Anonymous Wall stats publish by default.
+  --no-publish          Disable the anonymous Wall post for this run.
   --base-url <url>      Base URL used to build links back to checklist items.
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable report.
@@ -179,32 +161,22 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json --proof > launch-check.json
+- run: npx shippingszn --json > launch-check.json
 ```
 
-For PR scan proof, have GitHub Actions run the scanner with `--proof` and post
-the JSON summary as a comment: score, severity counts, top next step, proof URL,
-badge markdown, Wall URL, report URL, and worst Critical/High findings. Keep
-`--publish` out of the workflow unless you explicitly want to publish an
-anonymous Wall summary when proof upload fails.
+For PR scan signal, have GitHub Actions run the scanner and post the JSON
+summary as a comment: score, severity counts, top next step, Wall URL, report
+URL, and worst Critical/High findings.
 
 ## Privacy
 
-`shippingszn` reads files on your machine. It never uploads source code,
-makes outbound network calls, or phones home by default. No accounts.
-Inspect the source or audit `npm pack --dry-run` to confirm.
-
-If you want public launch-readiness proof, pass `--proof`. That opt-in posts
-the current scan result to shippingszn so it can create a proof page, report
-handoff, README badge, and proof-linked Wall entry. It uploads finding titles,
-messages, remediation prompts, verification text, checklist permalinks,
-severity counts, score, file count, target folder name, and scanner version. It
-does not upload source code or secret values.
-
-If you only want an anonymous Wall of Launches summary, pass `--publish`.
-That opt-in posts files scanned count, finding counts by severity, detected
-stack tags, and scanner version. It never uploads source code, file paths,
-filenames, project names, secrets, or report contents.
+`shippingszn` reads files on your machine. It never uploads source code. By
+default it makes one best-effort outbound request to post anonymous Wall stats:
+score, launch label, files scanned count, finding counts by severity, detected
+stack tags, scanner version, and timestamp. It never uploads source code, file
+paths, filenames, project names, repo URLs, secrets, emails, handles, or report
+contents. Use `--no-publish` or `SHIPPINGSZN_DISABLE_PUBLISH=1` to disable that
+request.
 
 ## License