shippingszn 0.8.5 → 0.9.2

package/README.md

@@ -6,65 +6,45 @@ leaked API keys, missing crawl assets, weak browser defenses, dangerous code
 patterns, and last-mile polish gaps.
 
 ```bash
-npx shippingszn
+npx shippingszn@latest
 # or
-pnpm dlx shippingszn
+pnpm dlx shippingszn@latest
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-By default it posts one anonymous Wall of Launches entry with score, severity
-counts, files scanned, scanner version, and safe stack tags. It never uploads
-source code, paths, filenames, repo URLs, project names, secrets, handles, or
-emails. Use `--no-publish` for a private local run.
+Normal runs send one anonymous aggregate summary with score, severity counts,
+files scanned, scanner version, and safe stack tags. It never uploads source
+code, paths, filenames, repo URLs, project names, secrets, handles, or emails.
+This aggregate signal is automatic and not user-configurable.
 
-Human output starts with a Launch Readiness Score, scope covered, the top next
-step to fix, and severity counts. Run with `--json` to get machine-readable
-findings plus the Wall/report handoff fields:
+Human output starts with a Launch Readiness Score, scope covered, and severity
+counts. Run with `--json` to get the same score-and-counts summary in a
+machine-readable shape:
 
 ```json
 {
-  "launchReadiness": {
-    "score": 43,
-    "rawScore": 43,
-    "label": "No-go: launch blocked",
-    "decisionLabel": "No-go: launch blocked",
-    "goNoGoLabel": "No-go",
-    "confidence": "high",
-    "coveragePenalty": 0,
-    "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
-    "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
-    "wallUrl": "https://shippingszn.com/wall",
-    "reportUrl": "https://shippingszn.com/report"
-  },
-  "findings": [
-    {
-      "severity": "critical",
-      "message": "Possible OpenAI API key hardcoded in source.",
-      "whatFailed": "A secret-like token appears in a scanned file.",
-      "whyItBlocksLaunch": "A leaked key can spend money or expose customer data before you notice."
-    }
-  ]
+  "score": 43,
+  "band": "no_go",
+  "counts": { "critical": 1, "high": 3, "medium": 4, "lower": 2 },
+  "filesScanned": 128,
+  "detailsLocked": true,
+  "unlockUrl": "https://shippingszn.com/fix-kit"
 }
 ```
 
-When Critical or High findings make paid confidence relevant, the summary also
-includes a `/report` link. Clean scans and lower-risk findings do not push the
-paid report CTA.
+Finding titles, files, evidence, fix prompts, and verification steps are paid.
+They unlock inside the Launch Fix Kit.
 
-## Wall publishing
+## Aggregate summary
 
-Plain `npx shippingszn` feeds the Wall automatically. The public row is
-anonymous and intentionally small: score, launch label, files scanned, finding
-counts, detected stack tags, scanner version, and timestamp.
+Plain `npx shippingszn@latest` sends the aggregate summary automatically. The
+stored row is anonymous and intentionally small: score, launch label, files
+scanned, finding counts, detected stack tags, scanner version, and timestamp.
 
-Use this when you want a completely private local run:
-
-```bash
-npx shippingszn --no-publish
-```
-
-For a paid-report handoff, run `npx shippingszn --json > shippingszn-scan.json`
-and paste or upload the file at `https://shippingszn.com/scan`.
+For a scan-specific paid-report handoff, run `npx shippingszn@latest --proof`.
+That uploads the canonical scan result, returns a proof URL plus a
+`/fix-kit?scanResultId=...` URL, and gives the paid Launch Fix Kit the evidence
+it needs after checkout.
 
 ## What gets checked
 
@@ -90,8 +70,9 @@ maps back to one of the items on the checklist.
 - Placeholder content (`lorem ipsum`, `John Doe`, `test@example.com`) and
   `TODO` / `FIXME` / `XXX` / `HACK` comments.
 
-Each finding is tagged Critical, High, Medium, or Lower and links back to the
-relevant checklist item on shippingszn.com.
+Internally each finding is tagged Critical, High, Medium, or Lower and maps to
+the relevant checklist item. The free CLI output keeps that finding-level detail
+locked.
 
 ## Suppressing false positives
 
@@ -141,12 +122,12 @@ ship.
 shippingszn [path] [options]
 
 Options:
-  --json                Output a machine-readable JSON report.
-  --publish             Legacy alias. Anonymous Wall stats publish by default.
-  --no-publish          Disable the anonymous Wall post for this run.
-  --base-url <url>      Base URL used to build links back to checklist items.
+  --json                Output a machine-readable JSON summary.
+  --proof               Upload full scan evidence and return a scan-specific
+                        Launch Fix Kit URL.
+  --base-url <url>      Base URL used to build checkout and Fix Kit links.
   --cwd <path>          Directory to scan. Default: current working directory.
-  --no-color            Disable ANSI colors in the human-readable report.
+  --no-color            Disable ANSI colors in the human-readable summary.
   -h, --help            Show help.
   -v, --version         Print version.
 ```
@@ -161,22 +142,20 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json > launch-check.json
+- run: npx shippingszn@latest --json > launch-check.json
 ```
 
 For PR scan signal, have GitHub Actions run the scanner and post the JSON
-summary as a comment: score, severity counts, top next step, Wall URL, report
-URL, and worst Critical/High findings.
+summary as a comment: score, severity counts, and unlock URL.
 
 ## Privacy
 
 `shippingszn` reads files on your machine. It never uploads source code. By
-default it makes one best-effort outbound request to post anonymous Wall stats:
-score, launch label, files scanned count, finding counts by severity, detected
-stack tags, scanner version, and timestamp. It never uploads source code, file
-paths, filenames, project names, repo URLs, secrets, emails, handles, or report
-contents. Use `--no-publish` or `SHIPPINGSZN_DISABLE_PUBLISH=1` to disable that
-request.
+default it makes one best-effort outbound request to post an anonymous aggregate
+summary: score, launch label, files scanned count, finding counts by severity,
+detected stack tags, scanner version, and timestamp. It never uploads source
+code, file paths, filenames, project names, repo URLs, secrets, emails, handles,
+or report contents. The aggregate summary is automatic and not user-configurable.
 
 ## License