shipready 1.2.0 → 1.3.0

package/README.md

@@ -53,9 +53,27 @@ Scans the project and prints a report with a 0-100 score.
 | `-v, --verbose` | show file and line locations for every finding |
 | `--json` | output the raw structured report as JSON (great for CI) |
 | `--fix` | apply safe fixes, re-scan, and show the score before/after |
+| `--history` | also scan the **full git history** (all branches) for secrets that were committed and later removed |
+| `--verify` | check detected keys against provider APIs to see if they are **live right now** |
 
 Exits with code `1` when errors are found, so you can use it in CI pipelines.
 
+#### `--history`: secrets buried in old commits
+
+Deleting a leaked key from your code does not delete it from git history — anyone who clones the repo can still read it. `shipready check --history` scans every added line in every commit on every branch, dedupes findings, and skips anything still present in the working tree (the regular scan already covers those). Each finding shows the abbreviated commit hash so you know where to look.
+
+If something is found: rotate the key, then purge it with [git filter-repo](https://github.com/newren/git-filter-repo) or [BFG](https://rtyley.github.io/bfg-repo-cleaner/).
+
+#### `--verify`: is the key actually live?
+
+For 12+ providers (OpenAI, Anthropic, GitHub, GitLab, Stripe, SendGrid, Google, npm, Hugging Face, Figma, and more) shipready can make a single read-only "who am I" request to the provider's API:
+
+- `[VERIFIED ACTIVE]` — the key works right now; this upgrades the finding to an error and jumps to the top of next steps
+- `[not active - rotate anyway]` — the provider rejected it (revoked or fake)
+- no marker — the provider has no safe verification endpoint, or the network was unavailable
+
+Verification requests contain only the key itself, go directly to the provider's official API host, and never mutate remote state. Nothing is ever sent to any third party.
+
 ### `shipready init [path]`
 
 Generates AI-agent instruction files based on your detected framework, package manager, and scripts:
@@ -79,26 +97,28 @@ It never deletes user code and never overwrites files without `--force`. A summa
 ## Example output
 
 ```txt
-shipready report
-
-Project: Next.js
-Package manager: pnpm
-
-Summary:
-✓ package.json found
-✓ README.md found
-✗ .env.example missing
-✗ .env is not ignored
-⚠ 4 TODO/FIXME comments found
-⚠ 2 console.log calls found
-✓ No obvious secrets found
-
-Score: 72/100
-
-Recommended next steps:
-1. Add .env to .gitignore
-2. Create .env.example (run: shipready fix)
-3. Remove debug logs before shipping
+╭──────────────────────────────────────────────────────────╮
+│ shipready v1.3.0                                         │
+│ project Next.js  ·  pm pnpm                              │
+╰──────────────────────────────────────────────────────────╯
+
+  Score  ████████████████████░░░░░░░░  72/100  almost there
+
+  ✓ package.json  ok
+  ✓ README        ok
+  ✗ Env safety    .env.example missing (3 env vars used in code)
+  ✗                .env is not ignored by git
+  ✓ Secrets       No obvious secrets found
+  ✗ Git history   1 secret buried in git history (removed from code but still exposed)
+  ⚠ Code hygiene  4 TODO/FIXME comments found
+  ⚠                2 console.log calls found
+  ✓ .gitignore    ok
+
+  Next steps
+    1. Purge leaked secrets from git history (BFG or git filter-repo) and rotate them
+    2. Add .env to .gitignore
+    3. Create .env.example (run: shipready fix)
+    4. Remove debug logs and debugger statements before shipping
 ```
 
 ## What it checks
@@ -166,6 +186,16 @@ False-positive protection:
 - **Bundle guard**: single-line minified blobs are skipped entirely
 - Matched values are always masked — shipready never prints a full secret
 
+### Suppressing a single finding
+
+If shipready flags a line you know is safe (a demo value, an already-revoked key in docs), add the `shipready-ignore` marker to that line:
+
+```js
+const DEMO_TOKEN = "ghp_thisIsADocumentationExample000000"; // shipready-ignore
+```
+
+The scanner skips any line containing `shipready-ignore`. For project-wide exceptions, prefer `secretAllowlist` in the config (see below) so the suppression is reviewable in one place.
+
 ## Configuration
 
 Optional `shipready.config.json` in your project root:

package/dist/checks/history.js

@@ -0,0 +1,146 @@
+import { execFileSync } from "node:child_process";
+import { scanContentForSecrets } from "./secrets.js";
+/** Paths in history we never scan (vendor noise, lockfiles, build output). */
+const HISTORY_SKIP_RE = /(^|\/)(node_modules|vendor|dist|build|\.next|out|coverage)(\/|$)|\.(lock|min\.js|min\.css|map|png|jpg|jpeg|gif|webp|ico|pdf|zip|gz|woff2?)$|(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i;
+/**
+ * Parses `git log -p --unified=0` output into added lines.
+ * Exported for testing.
+ */
+export function extractAddedLines(diffText) {
+    const added = [];
+    let commit = "";
+    let file = "";
+    for (const line of diffText.split("\n")) {
+        if (line.startsWith("commit ")) {
+            commit = line.slice(7, 14); // abbreviated hash
+            continue;
+        }
+        if (line.startsWith("+++ b/")) {
+            file = line.slice(6);
+            continue;
+        }
+        if (line.startsWith("+++")) {
+            // +++ /dev/null (file deletion)
+            file = "";
+            continue;
+        }
+        if (line.startsWith("+") && !line.startsWith("+++") && file) {
+            const content = line.slice(1);
+            // Skip empty lines and vendor/binary-ish paths early.
+            if (content.trim().length === 0)
+                continue;
+            if (HISTORY_SKIP_RE.test(file))
+                continue;
+            // Minified blobs are noise, mirroring the working-tree scanner.
+            if (content.length > 10000)
+                continue;
+            added.push({ commit, file, content });
+        }
+    }
+    return added;
+}
+/** True when the directory is inside a git repository. */
+export function isGitRepo(root) {
+    try {
+        execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+            cwd: root,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Scans the entire git history (all branches) for secrets in added lines.
+ * Findings that still exist in the working tree are excluded - the regular
+ * scanner already reports those; this check surfaces the ones hiding only
+ * in old commits.
+ */
+export function scanGitHistory(root, allowlist = [], workingTreeSecrets = []) {
+    let diffText;
+    try {
+        diffText = execFileSync("git", ["log", "--all", "-p", "--unified=0", "--no-color", "--diff-filter=AM"], { cwd: root, maxBuffer: 512 * 1024 * 1024, encoding: "utf8" });
+    }
+    catch {
+        return [];
+    }
+    const addedLines = extractAddedLines(diffText);
+    const currentMasks = new Set(workingTreeSecrets.map((s) => `${s.file}::${s.masked}`));
+    const seen = new Set();
+    const found = [];
+    for (const { commit, file, content } of addedLines) {
+        const hits = scanContentForSecrets(content, file, allowlist);
+        for (const hit of hits) {
+            // Skip if the same secret is already reported from the working tree.
+            if (currentMasks.has(`${hit.file}::${hit.masked}`))
+                continue;
+            // Dedupe repeats across commits (same value in the same file).
+            const key = `${hit.file}::${hit.masked}::${hit.kind}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({
+                ...hit,
+                line: 0,
+                source: "history",
+                commit,
+            });
+        }
+    }
+    return found;
+}
+/** Builds the CheckResult for git-history findings. */
+export function checkHistory(historySecrets, scanned) {
+    const findings = [];
+    if (!scanned) {
+        findings.push({
+            severity: "info",
+            rule: "history.skipped",
+            message: "Not a git repository - history scan skipped",
+        });
+        return { name: "git-history", findings };
+    }
+    if (historySecrets.length === 0) {
+        findings.push({
+            severity: "success",
+            rule: "history.clean",
+            message: "No secrets found in git history",
+        });
+        return { name: "git-history", findings };
+    }
+    const high = historySecrets.filter((s) => s.confidence !== "medium");
+    const medium = historySecrets.filter((s) => s.confidence === "medium");
+    if (high.length > 0) {
+        findings.push({
+            severity: "error",
+            rule: "history.secret",
+            message: `${high.length} secret${high.length > 1 ? "s" : ""} buried in git history (removed from code but still exposed)`,
+        });
+        for (const s of high) {
+            findings.push({
+                severity: "error",
+                rule: "history.secret-item",
+                message: `${s.kind}: ${s.masked} (commit ${s.commit})`,
+                file: s.file,
+            });
+        }
+    }
+    if (medium.length > 0) {
+        findings.push({
+            severity: "warning",
+            rule: "history.possible",
+            message: `${medium.length} possible secret${medium.length > 1 ? "s" : ""} in git history (lower confidence)`,
+        });
+        for (const s of medium) {
+            findings.push({
+                severity: "warning",
+                rule: "history.possible-item",
+                message: `${s.kind}: ${s.masked} (commit ${s.commit})`,
+                file: s.file,
+            });
+        }
+    }
+    return { name: "git-history", findings };
+}

package/dist/checks/secrets.js

@@ -300,6 +300,8 @@ export function scanContentForSecrets(content, file, allowlist = []) {
                 line: i + 1,
                 masked: maskSecret(value),
                 confidence,
+                // Raw value stays in memory only; used by --verify, never printed.
+                raw: value,
             });
             break; // one finding per line is enough
         }
@@ -319,6 +321,22 @@ export function checkSecrets(secretFindings) {
         });
         return { name: "secrets", findings };
     }
+    const verifiedActive = secretFindings.filter((s) => s.verified === "active");
+    if (verifiedActive.length > 0) {
+        findings.push({
+            severity: "error",
+            rule: "secrets.verified-active",
+            message: `${verifiedActive.length} key${verifiedActive.length > 1 ? "s" : ""} VERIFIED ACTIVE - rotate immediately`,
+        });
+    }
+    /** Suffix describing the live verification result, when available. */
+    const verifyNote = (s) => {
+        if (s.verified === "active")
+            return " [VERIFIED ACTIVE]";
+        if (s.verified === "inactive")
+            return " [not active - rotate anyway]";
+        return "";
+    };
     if (high.length > 0) {
         findings.push({
             severity: "error",
@@ -329,7 +347,7 @@ export function checkSecrets(secretFindings) {
             findings.push({
                 severity: "error",
                 rule: "secrets.detected-item",
-                message: `${s.kind}: ${s.masked}`,
+                message: `${s.kind}: ${s.masked}${verifyNote(s)}`,
                 file: s.file,
                 line: s.line,
             });
@@ -343,9 +361,10 @@ export function checkSecrets(secretFindings) {
         });
         for (const s of medium) {
             findings.push({
-                severity: "warning",
-                rule: "secrets.possible-item",
-                message: `${s.kind}: ${s.masked}`,
+                // A verified-active key is an error no matter the pattern confidence.
+                severity: s.verified === "active" ? "error" : "warning",
+                rule: s.verified === "active" ? "secrets.detected-item" : "secrets.possible-item",
+                message: `${s.kind}: ${s.masked}${verifyNote(s)}`,
                 file: s.file,
                 line: s.line,
             });

package/dist/checks/verify.js

@@ -0,0 +1,106 @@
+const TIMEOUT_MS = 6000;
+/** fetch with an AbortController timeout; never throws. */
+async function timedFetch(url, init) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: ctrl.signal });
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Maps an HTTP status to a verification result using a common convention:
+ * 401/403 => the key was understood but rejected (inactive/revoked),
+ * 2xx     => accepted (active),
+ * anything else (network, 404, 5xx, rate limit) => unknown.
+ */
+function statusToResult(res) {
+    if (!res)
+        return "unknown";
+    if (res.ok)
+        return "active";
+    if (res.status === 401 || res.status === 403)
+        return "inactive";
+    return "unknown";
+}
+/**
+ * Verifiers keyed by finding.kind. Only providers with a safe, well-known
+ * "who am I" endpoint are included. Everything else stays "unknown".
+ */
+const VERIFIERS = {
+    "OpenAI key": async (raw) => statusToResult(await timedFetch("https://api.openai.com/v1/models", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "Anthropic key": async (raw) => {
+        // /v1/models requires the key; 401 => bad key, 200 => good.
+        const res = await timedFetch("https://api.anthropic.com/v1/models", {
+            headers: { "x-api-key": raw, "anthropic-version": "2023-06-01" },
+        });
+        return statusToResult(res);
+    },
+    "GitHub token": async (raw) => statusToResult(await timedFetch("https://api.github.com/user", {
+        headers: {
+            Authorization: `Bearer ${raw}`,
+            "User-Agent": "shipready",
+            Accept: "application/vnd.github+json",
+        },
+    })),
+    "GitLab token": async (raw) => statusToResult(await timedFetch("https://gitlab.com/api/v4/user", {
+        headers: { "PRIVATE-TOKEN": raw },
+    })),
+    "Stripe live key": async (raw) => statusToResult(await timedFetch("https://api.stripe.com/v1/account", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "Stripe test key": async (raw) => statusToResult(await timedFetch("https://api.stripe.com/v1/account", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "SendGrid key": async (raw) => statusToResult(await timedFetch("https://api.sendgrid.com/v3/scopes", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "Google/Gemini key": async (raw) => statusToResult(await timedFetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(raw)}`, {})),
+    "npm token": async (raw) => statusToResult(await timedFetch("https://registry.npmjs.org/-/whoami", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "Hugging Face token": async (raw) => statusToResult(await timedFetch("https://huggingface.co/api/whoami-v2", {
+        headers: { Authorization: `Bearer ${raw}` },
+    })),
+    "Figma token": async (raw) => statusToResult(await timedFetch("https://api.figma.com/v1/me", {
+        headers: { "X-Figma-Token": raw },
+    })),
+    "GitHub fine-grained token": async (raw) => statusToResult(await timedFetch("https://api.github.com/user", {
+        headers: {
+            Authorization: `Bearer ${raw}`,
+            "User-Agent": "shipready",
+        },
+    })),
+};
+/** Number of providers shipready can actively verify. */
+export const VERIFIABLE_KINDS = Object.keys(VERIFIERS);
+/**
+ * Verifies findings against provider APIs, mutating each finding's
+ * `verified` field in place. Runs with limited concurrency and only for
+ * findings whose `kind` has a known verifier and whose `raw` value is present.
+ */
+export async function verifySecrets(findings, concurrency = 5) {
+    const targets = findings.filter((f) => f.raw && VERIFIERS[f.kind]);
+    let cursor = 0;
+    async function worker() {
+        while (cursor < targets.length) {
+            const finding = targets[cursor++];
+            try {
+                finding.verified = await VERIFIERS[finding.kind](finding.raw);
+            }
+            catch {
+                finding.verified = "unknown";
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(concurrency, targets.length) }, worker));
+    // Findings we didn't verify stay undefined (rendered as no live info).
+    return findings;
+}

package/dist/cli.js

@@ -69,14 +69,20 @@ export function buildProgram() {
         .option("-v, --verbose", "show file locations for every finding")
         .option("--json", "output the raw report as JSON")
         .option("--fix", "apply safe fixes, then re-scan and show the improved report")
+        .option("--history", "also scan the full git history for leaked secrets")
+        .option("--verify", "check detected keys against provider APIs to see if they are live")
         .action(async (dir, opts) => {
         try {
             const root = resolveRoot(dir);
-            let report = await runScan(root);
+            const scanOpts = { history: opts.history, verify: opts.verify };
+            if (opts.verify && !opts.json) {
+                console.log(pc.dim("\n  Verifying detected keys against provider APIs..."));
+            }
+            let report = await runScan(root, scanOpts);
             if (opts.fix) {
                 const before = report.score;
                 const results = await applyFixes(root, false);
-                report = await runScan(root);
+                report = await runScan(root, scanOpts);
                 if (!opts.json) {
                     console.log("");
                     console.log(pc.bold(pc.magenta("shipready check --fix")));
@@ -92,7 +98,7 @@ export function buildProgram() {
                 console.log(JSON.stringify(report, null, 2));
             }
             else {
-                console.log(renderReport(report, opts.verbose ?? false));
+                console.log(renderReport(report, opts.verbose ?? false, ownVersion()));
             }
             // Non-zero exit when errors are present, useful for CI.
             const hasErrors = report.results.some((r) => r.findings.some((f) => f.severity === "error"));

package/dist/scanner.js

@@ -4,6 +4,8 @@ import { checkGitignore } from "./checks/gitignore.js";
 import { checkPackageJson } from "./checks/packageJson.js";
 import { checkReadme } from "./checks/readme.js";
 import { checkSecrets, scanContentForSecrets } from "./checks/secrets.js";
+import { checkHistory, isGitRepo, scanGitHistory } from "./checks/history.js";
+import { verifySecrets } from "./checks/verify.js";
 import { checkTodos, scanContentForTodos } from "./checks/todos.js";
 import { fileExists, findSourceFiles, isProbablyBinary, readJsonFile, readTextFile, } from "./utils/files.js";
 import { detectFramework, detectPackageManager } from "./utils/framework.js";
@@ -80,6 +82,8 @@ export function calculateScore(results) {
         score -= 15;
     const secretCount = count("secrets.detected-item");
     score -= Math.min(secretCount * 25, 50);
+    const historyCount = count("history.secret-item");
+    score -= Math.min(historyCount * 10, 30);
     const todoCount = count("todos.item");
     score -= Math.min(todoCount * 2, 15);
     return Math.max(0, score);
@@ -94,15 +98,27 @@ function applyDisabledRules(results, disableRules) {
     }));
 }
 /** Runs the full scan and returns a structured report. */
-export async function runScan(root) {
+export async function runScan(root, options = {}) {
     const config = loadConfig(root);
     const project = await detectProject(root, config);
     const { envUsages, secrets, todos } = scanFiles(root, project.sourceFiles, config.secretAllowlist);
+    let historySecrets = [];
+    let historyScanned = false;
+    if (options.history) {
+        historyScanned = isGitRepo(root);
+        if (historyScanned) {
+            historySecrets = scanGitHistory(root, config.secretAllowlist, secrets);
+        }
+    }
+    if (options.verify) {
+        await verifySecrets([...secrets, ...historySecrets]);
+    }
     const rawResults = [
         checkPackageJson(project),
         checkReadme(root),
         checkEnv(root, envUsages),
         checkSecrets(secrets),
+        ...(options.history ? [checkHistory(historySecrets, historyScanned)] : []),
         checkTodos(todos),
         checkGitignore(root),
     ];

package/dist/utils/report.js

@@ -5,6 +5,59 @@ const ICONS = {
     warning: pc.yellow("\u26a0"),
     info: pc.cyan("\u2139"),
 };
+/** Inner width of the report layout (visible characters). */
+const WIDTH = 56;
+/** Visible length of a string, ignoring ANSI escape codes. */
+function visibleLength(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/\u001b\[[0-9;]*m/g, "").length;
+}
+/** Pads a string (which may contain ANSI codes) to a visible width. */
+function padVisible(s, width) {
+    const len = visibleLength(s);
+    return len >= width ? s : s + " ".repeat(width - len);
+}
+/** Draws a rounded box around the given lines. */
+function box(lines) {
+    const top = pc.dim("\u256d" + "\u2500".repeat(WIDTH + 2) + "\u256e");
+    const bottom = pc.dim("\u2570" + "\u2500".repeat(WIDTH + 2) + "\u256f");
+    const body = lines.map((l) => `${pc.dim("\u2502")} ${padVisible(l, WIDTH)} ${pc.dim("\u2502")}`);
+    return [top, ...body, bottom];
+}
+/** Renders the score progress bar. */
+function scoreBar(score) {
+    const total = 28;
+    const filled = Math.max(0, Math.min(total, Math.round((score / 100) * total)));
+    const fill = "\u2588".repeat(filled);
+    const rest = "\u2591".repeat(total - filled);
+    const painted = score >= 85 ? pc.green(fill) : score >= 60 ? pc.yellow(fill) : pc.red(fill);
+    return painted + pc.dim(rest);
+}
+function scoreLabel(score) {
+    const label = `${score}/100`;
+    if (score >= 85)
+        return pc.bold(pc.green(label));
+    if (score >= 60)
+        return pc.bold(pc.yellow(label));
+    return pc.bold(pc.red(label));
+}
+function verdict(score) {
+    if (score >= 85)
+        return pc.green("ready to ship");
+    if (score >= 60)
+        return pc.yellow("almost there");
+    return pc.red("not ready to ship");
+}
+/** Human-friendly labels for check names. */
+const CHECK_LABELS = {
+    "package.json": "package.json",
+    README: "README",
+    env: "Env safety",
+    secrets: "Secrets",
+    todos: "Code hygiene",
+    gitignore: ".gitignore",
+    "git-history": "Git history",
+};
 function colorFor(severity, text) {
     switch (severity) {
         case "success":
@@ -17,23 +70,19 @@ function colorFor(severity, text) {
             return pc.cyan(text);
     }
 }
-function scoreColor(score) {
-    const label = `${score}/100`;
-    if (score >= 85)
-        return pc.green(label);
-    if (score >= 60)
-        return pc.yellow(label);
-    return pc.red(label);
-}
 /** Builds recommended next steps from findings, highest severity first. */
 export function nextSteps(report) {
     const steps = [];
     const all = report.results.flatMap((r) => r.findings);
     const has = (rule) => all.some((f) => f.rule === rule);
+    if (has("secrets.verified-active"))
+        steps.push("A key was VERIFIED ACTIVE - rotate it right now");
     if (has("package-json.missing"))
         steps.push("Add a package.json (npm init -y)");
     if (has("secrets.detected"))
         steps.push("Rotate and remove hardcoded secrets immediately");
+    if (has("history.secret"))
+        steps.push("Purge leaked secrets from git history (BFG or git filter-repo) and rotate them");
     if (has("env.not-ignored"))
         steps.push("Add .env to .gitignore");
     if (has("env.example-missing"))
@@ -56,21 +105,45 @@ export function nextSteps(report) {
         steps.push("Resolve TODO/FIXME comments or track them as issues");
     return steps;
 }
+/** Worst severity across a set of findings (error > warning > info > success). */
+function worst(findings) {
+    if (findings.some((f) => f.severity === "error"))
+        return "error";
+    if (findings.some((f) => f.severity === "warning"))
+        return "warning";
+    if (findings.some((f) => f.severity === "info"))
+        return "info";
+    return "success";
+}
 /** Renders the full report to a printable string. */
-export function renderReport(report, verbose = false) {
+export function renderReport(report, verbose = false, version) {
     const lines = [];
     const { project } = report;
+    const title = pc.bold(pc.magenta("shipready")) + (version ? pc.dim(` v${version}`) : "");
+    const meta = pc.dim("project ") +
+        project.framework +
+        pc.dim("  \u00b7  ") +
+        pc.dim("pm ") +
+        project.packageManager;
     lines.push("");
-    lines.push(pc.bold(pc.magenta("shipready report")));
+    lines.push(...box([title, meta]));
     lines.push("");
-    lines.push(`${pc.dim("Project:")} ${project.framework}`);
-    lines.push(`${pc.dim("Package manager:")} ${project.packageManager}`);
+    lines.push(`  ${pc.bold("Score")}  ${scoreBar(report.score)}  ${scoreLabel(report.score)}  ${verdict(report.score)}`);
     lines.push("");
-    lines.push(pc.bold("Summary:"));
+    // Aligned checks table: one row per check, then its top-level findings.
+    const labelWidth = Math.max(...report.results.map((r) => (CHECK_LABELS[r.name] ?? r.name).length));
     for (const result of report.results) {
-        for (const finding of summarize(result.findings)) {
-            lines.push(`${ICONS[finding.severity]} ${finding.message}`);
+        const label = CHECK_LABELS[result.name] ?? result.name;
+        const summaryFindings = result.findings.filter((f) => !f.file);
+        const status = worst(result.findings);
+        if (summaryFindings.length === 0) {
+            lines.push(`  ${ICONS[status]} ${pc.bold(padVisible(label, labelWidth))}  ${pc.dim("ok")}`);
+            continue;
         }
+        summaryFindings.forEach((finding, i) => {
+            const name = i === 0 ? pc.bold(padVisible(label, labelWidth)) : " ".repeat(labelWidth);
+            lines.push(`  ${ICONS[finding.severity]} ${name}  ${finding.message}`);
+        });
     }
     // Detailed findings with file locations
     const located = report.results
@@ -78,31 +151,22 @@ export function renderReport(report, verbose = false) {
         .filter((f) => f.file && f.severity !== "success");
     if (located.length > 0 && verbose) {
         lines.push("");
-        lines.push(pc.bold("Details:"));
+        lines.push(`  ${pc.bold("Details")}`);
         for (const f of located) {
             const loc = f.line ? `${f.file}:${f.line}` : f.file;
-            lines.push(`  ${ICONS[f.severity]} ${pc.dim(loc ?? "")} ${colorFor(f.severity, f.message)}`);
+            lines.push(`    ${ICONS[f.severity]} ${pc.dim(loc ?? "")} ${colorFor(f.severity, f.message)}`);
         }
     }
-    lines.push("");
-    lines.push(`${pc.bold("Score:")} ${scoreColor(report.score)}`);
     const steps = nextSteps(report);
     if (steps.length > 0) {
         lines.push("");
-        lines.push(pc.bold("Recommended next steps:"));
-        steps.forEach((step, i) => lines.push(`${i + 1}. ${step}`));
+        lines.push(`  ${pc.bold("Next steps")}`);
+        steps.forEach((step, i) => lines.push(`    ${pc.dim(`${i + 1}.`)} ${step}`));
     }
     if (located.length > 0 && !verbose) {
         lines.push("");
-        lines.push(pc.dim("Run with --verbose to see file locations."));
+        lines.push(pc.dim("  Run with --verbose to see file locations."));
     }
     lines.push("");
     return lines.join("\n");
 }
-/**
- * Collapses per-file findings into summary lines while keeping
- * top-level findings (those without a file) as-is.
- */
-function summarize(findings) {
-    return findings.filter((f) => !f.file);
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",