shipready 1.0.3 → 1.2.0

package/README.md

@@ -108,7 +108,7 @@ Recommended next steps:
 | **package.json** | Existence, package manager (lockfiles), framework, `dev`/`build`/`test`/`lint` scripts |
 | **README** | Existence, installation/usage/license sections, not-too-empty |
 | **Env safety** | `.env` gitignored, `.env.example` present and complete, no real values in examples |
-| **Secrets** | 18 token patterns, all masked in output (see table below) |
+| **Secrets** | 30+ token patterns with entropy analysis and confidence levels, all masked in output (see table below) |
 | **Debug leftovers** | `TODO`, `FIXME`, `HACK`, `XXX`, `console.log`, `debugger`, `throw new Error("Not implemented")` |
 | **.gitignore** | Existence and important entries (`.env`, `node_modules`, `dist`, `build`, `.next`) |
 
@@ -116,28 +116,55 @@ Ignored during scans: `node_modules`, `.git`, `dist`, `build`, `.next`, `out`, `
 
 ## Detected secrets
 
+The scanner combines provider-specific patterns with **Shannon entropy analysis** so that placeholders, examples, and templated values never pollute the report.
+
+**High confidence** (reported as errors):
+
 | Type | Recognized by |
 | --- | --- |
 | OpenAI | `sk-`, `sk-proj-` |
 | Anthropic | `sk-ant-` |
 | Google / Gemini | `AIza...` |
-| GitHub | `ghp_`, `github_pat_` |
-| Stripe (live) | `sk_live_`, `rk_live_` |
-| Slack | `xoxb-`, `xoxp-` |
-| AWS | `AKIA...` |
+| GitHub | `ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`, `github_pat_` |
+| GitLab | `glpat-...` |
+| Stripe (live) | `sk_live_`, `rk_live_`, `whsec_` |
+| Slack | `xoxb-`, `xoxp-`, `xapp-`, webhook URLs |
+| Discord | bot tokens, webhook URLs |
+| AWS | `AKIA...` key IDs, `aws_secret_access_key` assignments |
 | Supabase | `sbp_...` |
 | Vercel | `vercel_...` |
 | npm | `npm_...` |
 | SendGrid | `SG.xxx.xxx` |
 | Twilio | `AC` / `SK` + 32 hex |
 | Telegram bot | `123456789:AA...` |
+| DigitalOcean | `dop_v1_`, `doo_v1_`, `dor_v1_` |
+| Hugging Face | `hf_...` |
+| Shopify | `shpat_`, `shpss_`, `shpca_` |
+| Mailchimp | 32 hex + `-usNN` |
+| Airtable | `pat...` |
+| Fly.io | `fo1_...` |
+| Cloudflare | `CLOUDFLARE_API_TOKEN=` assignments |
+| Heroku | `HEROKU_API_KEY=` UUIDs |
 | Database URL with password | `postgres://user:pass@host` (also mysql, mongodb, redis, amqp) |
 | GCP service account | `"private_key_id"` in JSON |
 | Private key block | `-----BEGIN ... PRIVATE KEY-----` |
-| JWT | `eyJ...` |
-| Generic credential | `API_KEY=`, `SECRET=`, `PASSWORD=` assignments |
 
-Placeholders (`your-api-key`, `changeme`, `xxxx`, ...) are ignored. Matched values are always masked — shipready never prints a full secret.
+**Medium confidence** (reported as warnings, so real keys never hide among noise):
+
+| Type | Recognized by |
+| --- | --- |
+| Stripe (test) | `sk_test_`, `pk_test_` |
+| JWT | `eyJ...` with valid structure |
+| Generic credential | `API_KEY=`, `SECRET=`, `PASSWORD=` assignments — only when the value has high entropy |
+| Any finding in test/fixture/mock files | automatically downgraded |
+
+False-positive protection:
+
+- **Entropy gate**: generic assignments are only flagged when the value is statistically random (real keys are; `changeme` is not)
+- **Placeholder detection**: `your-api-key`, `xxxx`, `<token>`, `${VAR}`, `process.env.X`, and template literals are skipped
+- **Repeat/sequence filter**: `aaaa...`, `1234...` never match
+- **Bundle guard**: single-line minified blobs are skipped entirely
+- Matched values are always masked — shipready never prints a full secret
 
 ## Configuration
 
@@ -159,7 +186,9 @@ Optional `shipready.config.json` in your project root:
 
 ## Using in CI
 
-`shipready check` exits with code `1` when errors are found:
+### GitHub Action (recommended)
+
+Add the quality gate to any workflow with a single step:
 
 ```yaml
 # .github/workflows/quality.yml
@@ -170,9 +199,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: formalness/shipready@v1
+```
+
+The job fails when errors (secrets, unignored `.env`, ...) are found.
+
+| Input | Default | Purpose |
+| --- | --- | --- |
+| `path` | `.` | Project directory to scan |
+| `verbose` | `true` | Show file/line locations for every finding |
+| `version` | `latest` | shipready version to run (npm tag or exact version) |
+| `args` | `""` | Extra arguments for `shipready check` (e.g. `--json`) |
+
+Example with options:
+
+```yaml
+      - uses: formalness/shipready@v1
         with:
-          node-version: 20
+          path: apps/web
+          verbose: "false"
+          version: "1.0.3"
+```
+
+### Manual setup
+
+`shipready check` exits with code `1` when errors are found, so it works in any CI:
+
+```yaml
       - run: npx shipready check --verbose
 ```
 

package/dist/checks/secrets.js

@@ -1,47 +1,263 @@
+import { hasLongRepeat, hasSequentialRun, shannonEntropy, } from "../utils/entropy.js";
+/**
+ * Ordered pattern list: most specific first. The first matching pattern
+ * wins for a given line.
+ */
 const PATTERNS = [
-    { kind: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
-    { kind: "OpenAI key", re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{16,}\b/ },
-    { kind: "Google/Gemini key", re: /\bAIza[A-Za-z0-9_-]{30,}\b/ },
-    { kind: "GitHub token", re: /\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/ },
-    { kind: "Stripe live key", re: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/ },
-    { kind: "Slack token", re: /\bxox[bp]-[A-Za-z0-9-]{10,}\b/ },
-    { kind: "AWS access key", re: /\bAKIA[A-Z0-9]{16}\b/ },
-    { kind: "Supabase personal token", re: /\bsbp_[a-f0-9]{40}\b/ },
-    { kind: "Vercel token", re: /\bvercel_[A-Za-z0-9]{24,}\b/ },
-    { kind: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/ },
-    { kind: "SendGrid key", re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/ },
-    { kind: "Twilio credential", re: /\b(?:AC|SK)[a-f0-9]{32}\b/ },
-    { kind: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/ },
     {
-        kind: "Database URL with password",
-        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:[^@\s"']+@/,
+        kind: "Private key block",
+        re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/,
+        confidence: "high",
+        skipValueChecks: true,
     },
     {
-        kind: "Private key block",
-        re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/,
+        kind: "AWS access key ID",
+        re: /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "AWS secret access key",
+        re: /\baws_?secret_?access_?key\b.{0,10}[=:]\s*["']?([A-Za-z0-9/+=]{40})\b/i,
+        confidence: "high",
+        group: 1,
+        minEntropy: 3.5,
+    },
+    {
+        kind: "GitHub token",
+        re: /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{20,})\b/,
+        confidence: "high",
+    },
+    {
+        kind: "GitLab token",
+        re: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+        confidence: "high",
+    },
+    { kind: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/, confidence: "high" },
+    {
+        kind: "OpenAI key",
+        re: /\bsk-(?:proj-|svcacct-|None-)?[A-Za-z0-9_-]{16,}\b/,
+        confidence: "high",
+        minEntropy: 3.2,
+    },
+    {
+        kind: "Google/Gemini key",
+        re: /\bAIza[A-Za-z0-9_-]{30,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Stripe live key",
+        re: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Stripe webhook secret",
+        re: /\bwhsec_[A-Za-z0-9]{24,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Stripe test key",
+        re: /\b(?:sk|rk)_test_[A-Za-z0-9]{16,}\b/,
+        confidence: "medium",
+    },
+    {
+        kind: "Slack token",
+        re: /\bxox[abpsr]-[A-Za-z0-9-]{10,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Slack webhook URL",
+        re: /hooks\.slack\.com\/services\/T[A-Z0-9]{5,}\/B[A-Z0-9]{5,}\/[A-Za-z0-9]{18,}/,
+        confidence: "high",
+    },
+    {
+        kind: "SendGrid key",
+        re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Twilio credential",
+        re: /\b(?:AC|SK)[a-f0-9]{32}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Telegram bot token",
+        re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/,
+        confidence: "high",
+    },
+    { kind: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/, confidence: "high" },
+    {
+        kind: "Supabase personal token",
+        re: /\bsbp_[a-f0-9]{40}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Vercel token",
+        re: /\bvercel_[A-Za-z0-9]{24,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "DigitalOcean token",
+        re: /\bdo[pors]_v1_[a-f0-9]{64}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Shopify token",
+        re: /\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Mailchimp key",
+        re: /\b[a-f0-9]{32}-us\d{1,2}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Mailgun key",
+        re: /\bkey-[a-f0-9]{32}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Airtable token",
+        re: /\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Notion token",
+        re: /\b(?:secret_[A-Za-z0-9]{43}|ntn_[A-Za-z0-9]{40,})\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Linear key",
+        re: /\blin_api_[A-Za-z0-9]{40,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Figma token",
+        re: /\bfigd_[A-Za-z0-9_-]{40,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Hugging Face token",
+        re: /\bhf_[A-Za-z0-9]{30,}\b/,
+        confidence: "high",
+    },
+    { kind: "Groq key", re: /\bgsk_[A-Za-z0-9]{30,}\b/, confidence: "high" },
+    {
+        kind: "Replicate token",
+        re: /\br8_[A-Za-z0-9]{30,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Perplexity key",
+        re: /\bpplx-[A-Za-z0-9]{40,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Databricks token",
+        re: /\bdapi[a-f0-9]{32}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Doppler token",
+        re: /\bdp\.pt\.[A-Za-z0-9]{40,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Postman key",
+        re: /\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "PyPI token",
+        re: /\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}\b/,
+        confidence: "high",
+    },
+    {
+        kind: "Sentry token",
+        re: /\bsntrys_[A-Za-z0-9_+/=.-]{40,}\b/,
+        confidence: "high",
     },
     {
         kind: "GCP service account key",
         re: /"private_key_id"\s*:\s*"[a-f0-9]{20,}"/,
+        confidence: "high",
+        skipValueChecks: true,
+    },
+    {
+        kind: "Discord webhook URL",
+        re: /discord(?:app)?\.com\/api\/webhooks\/\d{15,20}\/[A-Za-z0-9_-]{60,}/,
+        confidence: "high",
+    },
+    {
+        kind: "Discord bot token",
+        re: /\b[MNO][A-Za-z\d_-]{23,25}\.[A-Za-z\d_-]{6}\.[A-Za-z\d_-]{27,}\b/,
+        confidence: "medium",
+        minEntropy: 4.0,
+    },
+    {
+        // Placeholder checks run against the password only (group 1), so
+        // documentation hosts like db.example.com don't suppress real leaks.
+        kind: "Database URL with password",
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:([^@\s"']+)@/,
+        confidence: "high",
+        group: 1,
+    },
+    {
+        kind: "Basic auth in URL",
+        re: /https?:\/\/[^:\s"'/@]{3,}:([^@\s"']{8,})@/,
+        confidence: "medium",
+        group: 1,
+        minEntropy: 3.0,
     },
     {
         kind: "JWT",
         re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
+        confidence: "medium",
+        minEntropy: 4.0,
     },
     {
-        // Credential-style assignment with a long opaque value
+        kind: "Authorization header",
+        re: /\b(?:authorization|x-api-key)["']?\s*[:=]\s*["']?(?:Bearer|Basic|token)\s+([A-Za-z0-9+/_.=-]{20,})\b/i,
+        confidence: "medium",
+        group: 1,
+        minEntropy: 3.5,
+    },
+    {
+        // Credential-style assignment with a long opaque quoted value
         kind: "Hardcoded credential",
-        re: /\b(?:API_KEY|APIKEY|SECRET|SECRET_KEY|ACCESS_TOKEN|AUTH_TOKEN|PASSWORD)\s*[=:]\s*["']?[A-Za-z0-9+/_-]{16,}["']?/i,
+        re: /\b[A-Z0-9_]*(?:API_?KEY|SECRET(?:_KEY)?|ACCESS_TOKEN|AUTH_TOKEN|PASSWORD|PASSWD|CREDENTIALS?)[A-Z0-9_]*\s*[=:]\s*["']([A-Za-z0-9+/_.=-]{16,})["']/i,
+        confidence: "medium",
+        group: 1,
+        minEntropy: 3.8,
     },
 ];
-/** Values that indicate a placeholder, not a real secret. */
-const PLACEHOLDER_RE = /your[-_ ]?|example|placeholder|changeme|change[-_ ]me|dummy|fake|test[-_ ]?key|<[^>]*>|x{4,}|\*{4,}|123456|abcdef/i;
-/** Masks a secret, keeping a short prefix and suffix. */
+/** Words and shapes that indicate a placeholder, not a real secret. */
+const PLACEHOLDER_VALUE_RE = /your[-_ ]?|example|sample|placeholder|change[-_ ]?me|dummy|fake|insert|replace|redacted|deadbeef|lorem|goes[-_ ]?here|test[-_ ]?key|x{4,}|\*{3,}|\.\.\.|123456|abcdef/i;
+/**
+ * Line-level markers for documentation/example lines. Deliberately narrow:
+ * broad words like "example" would hide real keys on lines that merely
+ * mention example.com. Value-level checks handle those instead.
+ */
+const PLACEHOLDER_LINE_RE = /\b(?:do not commit|for docs only|shipready-ignore)\b|<[A-Z_][A-Z0-9_ -]*>/i;
+/** Paths whose findings are downgraded to medium confidence. */
+const TEST_PATH_RE = /(^|[/\\])(tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|examples?|samples?|docs?)([/\\]|$)|\.(test|spec)\.[a-z]+$/i;
+/** True when a matched value looks like a placeholder or templated string. */
+function isPlaceholderValue(value) {
+    if (PLACEHOLDER_VALUE_RE.test(value))
+        return true;
+    if (value.includes("${") || value.includes("{{") || value.includes("%s")) {
+        return true;
+    }
+    if (hasLongRepeat(value))
+        return true;
+    if (hasSequentialRun(value))
+        return true;
+    return false;
+}
+/** Masks a secret, keeping a short recognizable prefix and last 4 chars. */
 export function maskSecret(secret) {
     if (secret.length <= 8)
         return "*".repeat(secret.length);
-    // Keep a recognizable prefix (e.g. "sk-proj-ab") and last 4 chars.
-    const prefixMatch = secret.match(/^(sk-ant-|sk-proj-|sk-|sk_live_|rk_live_|ghp_|github_pat_|AIza|xoxb-|xoxp-|AKIA|sbp_|vercel_|npm_|SG\.|AC|SK|eyJ)/);
+    const prefixMatch = secret.match(/^(sk-ant-|sk-proj-|sk-svcacct-|sk-|sk_live_|sk_test_|rk_live_|rk_test_|whsec_|gh[pousr]_|github_pat_|glpat-|AIza|xox[abpsr]-|AKIA|ASIA|sbp_|vercel_|npm_|SG\.|dop_v1_|doo_v1_|dor_v1_|dos_v1_|shpat_|shpca_|shppa_|shpss_|hf_|gsk_|r8_|pplx-|lin_api_|figd_|secret_|ntn_|dapi|dp\.pt\.|PMAK-|pypi-|sntrys_|key-|glsa_|AC|SK|eyJ|pat)/);
     const prefixLen = (prefixMatch?.[0].length ?? 0) + 2;
     const prefix = secret.slice(0, Math.min(prefixLen, secret.length - 4));
     const suffix = secret.slice(-4);
@@ -51,26 +267,41 @@ export function maskSecret(secret) {
 export function scanContentForSecrets(content, file, allowlist = []) {
     const found = [];
     const lines = content.split("\n");
+    const isTestPath = TEST_PATH_RE.test(file);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        // Skip obvious placeholder lines and comments about examples
-        if (PLACEHOLDER_RE.test(line))
+        // Bundled/minified single-line blobs are noise, not user code.
+        if (line.length > 10000)
             continue;
-        for (const { kind, re } of PATTERNS) {
-            const match = line.match(re);
-            if (match) {
-                // User-configured false positives (substring match on the value or line)
-                if (allowlist.some((a) => match[0].includes(a) || line.includes(a))) {
+        // Documentation/example lines are not real leaks.
+        if (PLACEHOLDER_LINE_RE.test(line))
+            continue;
+        for (const pattern of PATTERNS) {
+            const match = line.match(pattern.re);
+            if (!match)
+                continue;
+            const value = match[pattern.group ?? 0];
+            if (!pattern.skipValueChecks) {
+                if (isPlaceholderValue(value))
+                    continue;
+                if (pattern.minEntropy !== undefined &&
+                    shannonEntropy(value) < pattern.minEntropy) {
                     continue;
                 }
-                found.push({
-                    kind,
-                    file,
-                    line: i + 1,
-                    masked: maskSecret(match[0]),
-                });
-                break; // one finding per line is enough
             }
+            // User-configured false positives (substring match on the value or line)
+            if (allowlist.some((a) => match[0].includes(a) || line.includes(a))) {
+                continue;
+            }
+            const confidence = isTestPath ? "medium" : pattern.confidence;
+            found.push({
+                kind: pattern.kind,
+                file,
+                line: i + 1,
+                masked: maskSecret(value),
+                confidence,
+            });
+            break; // one finding per line is enough
         }
     }
     return found;
@@ -78,20 +309,23 @@ export function scanContentForSecrets(content, file, allowlist = []) {
 /** Builds the CheckResult from all secret findings. */
 export function checkSecrets(secretFindings) {
     const findings = [];
+    const high = secretFindings.filter((s) => s.confidence !== "medium");
+    const medium = secretFindings.filter((s) => s.confidence === "medium");
     if (secretFindings.length === 0) {
         findings.push({
             severity: "success",
             rule: "secrets.none",
             message: "No obvious secrets found",
         });
+        return { name: "secrets", findings };
     }
-    else {
+    if (high.length > 0) {
         findings.push({
             severity: "error",
             rule: "secrets.detected",
-            message: `${secretFindings.length} potential secret${secretFindings.length > 1 ? "s" : ""} detected`,
+            message: `${high.length} potential secret${high.length > 1 ? "s" : ""} detected`,
         });
-        for (const s of secretFindings) {
+        for (const s of high) {
             findings.push({
                 severity: "error",
                 rule: "secrets.detected-item",
@@ -101,5 +335,21 @@ export function checkSecrets(secretFindings) {
             });
         }
     }
+    if (medium.length > 0) {
+        findings.push({
+            severity: "warning",
+            rule: "secrets.possible",
+            message: `${medium.length} possible secret${medium.length > 1 ? "s" : ""} detected (lower confidence)`,
+        });
+        for (const s of medium) {
+            findings.push({
+                severity: "warning",
+                rule: "secrets.possible-item",
+                message: `${s.kind}: ${s.masked}`,
+                file: s.file,
+                line: s.line,
+            });
+        }
+    }
     return { name: "secrets", findings };
 }

package/dist/utils/entropy.js

@@ -0,0 +1,42 @@
+/**
+ * String randomness heuristics used by the secret scanner.
+ *
+ * Real credentials are generated by CSPRNGs, so they have high Shannon
+ * entropy and no human-friendly structure. Placeholders and dictionary
+ * words score much lower, which lets us separate the two without
+ * hardcoding every possible fake value.
+ */
+/** Shannon entropy of a string, in bits per character. */
+export function shannonEntropy(s) {
+    if (s.length === 0)
+        return 0;
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of freq.values()) {
+        const p = count / s.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/** True when the string contains a run of 5+ identical characters (e.g. "aaaaa", "-----"). */
+export function hasLongRepeat(s) {
+    return /(.)\1{4,}/.test(s);
+}
+/**
+ * True when the string contains a long ascending or descending character
+ * run such as "abcdefgh" or "87654321" — a strong placeholder signal.
+ */
+export function hasSequentialRun(s, minRun = 8) {
+    let asc = 1;
+    let desc = 1;
+    for (let i = 1; i < s.length; i++) {
+        const d = s.charCodeAt(i) - s.charCodeAt(i - 1);
+        asc = d === 1 ? asc + 1 : 1;
+        desc = d === -1 ? desc + 1 : 1;
+        if (asc >= minRun || desc >= minRun)
+            return true;
+    }
+    return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.0.3",
+  "version": "1.2.0",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",