shipready 1.3.1 → 1.4.0

package/dist/checks/packageJson.js

@@ -1,8 +1,19 @@
+import { isNodeEcosystem } from "../utils/framework.js";
 const IMPORTANT_SCRIPTS = ["dev", "build", "test", "lint"];
 /** Checks package.json existence and important scripts. */
 export function checkPackageJson(project) {
     const findings = [];
     if (!project.hasPackageJson) {
+        // Static sites, Python, Go, Rust, etc. don't need a package.json -
+        // penalizing them for it would be unfair noise.
+        if (!isNodeEcosystem(project.framework)) {
+            findings.push({
+                severity: "info",
+                rule: "package-json.not-applicable",
+                message: `package.json not required for a ${project.framework} project`,
+            });
+            return { name: "package.json", findings };
+        }
         findings.push({
             severity: "error",
             rule: "package-json.missing",

package/dist/checks/secrets.js

@@ -196,16 +196,19 @@ const PATTERNS = [
     {
         // Placeholder checks run against the password only (group 1), so
         // documentation hosts like db.example.com don't suppress real leaks.
+        // The host (group 2) downgrades localhost URLs to medium confidence.
         kind: "Database URL with password",
-        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:([^@\s"']+)@/,
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:([^@\s"']+)@([^\s"'/:?]+)/,
         confidence: "high",
         group: 1,
+        hostGroup: 2,
     },
     {
         kind: "Basic auth in URL",
-        re: /https?:\/\/[^:\s"'/@]{3,}:([^@\s"']{8,})@/,
+        re: /https?:\/\/[^:\s"'/@]{3,}:([^@\s"']{8,})@([^\s"'/:?]+)/,
         confidence: "medium",
         group: 1,
+        hostGroup: 2,
         minEntropy: 3.0,
     },
     {
@@ -240,6 +243,13 @@ const PLACEHOLDER_VALUE_RE = /your[-_ ]?|example|sample|placeholder|change[-_ ]?
 const PLACEHOLDER_LINE_RE = /\b(?:do not commit|for docs only|shipready-ignore)\b|<[A-Z_][A-Z0-9_ -]*>/i;
 /** Paths whose findings are downgraded to medium confidence. */
 const TEST_PATH_RE = /(^|[/\\])(tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|examples?|samples?|docs?)([/\\]|$)|\.(test|spec)\.[a-z]+$/i;
+/**
+ * Default/dev passwords that appear in scaffolding templates and docker
+ * compose files. A URL credential equal to one of these is not a leak.
+ */
+const COMMON_DEV_PASSWORD_RE = /^(?:password|passwd|pass|root|admin|postgres|mysql|mongo|redis|rabbitmq|secret|test|dev|guest|user|toor|changeit|letmein|qwerty)$/i;
+/** Hosts that indicate a local dev database, not a production leak. */
+const LOCAL_HOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[?::1\]?|host\.docker\.internal|db|database|postgres|mysql|mongo|redis)$/i;
 /** True when a matched value looks like a placeholder or templated string. */
 function isPlaceholderValue(value) {
     if (PLACEHOLDER_VALUE_RE.test(value))
@@ -293,7 +303,16 @@ export function scanContentForSecrets(content, file, allowlist = []) {
             if (allowlist.some((a) => match[0].includes(a) || line.includes(a))) {
                 continue;
             }
-            const confidence = isTestPath ? "medium" : pattern.confidence;
+            let effective = pattern.confidence;
+            if (pattern.hostGroup !== undefined) {
+                // Scaffolding defaults like root:password@localhost are not leaks.
+                if (COMMON_DEV_PASSWORD_RE.test(value))
+                    continue;
+                const host = match[pattern.hostGroup] ?? "";
+                if (LOCAL_HOST_RE.test(host))
+                    effective = "medium";
+            }
+            const confidence = isTestPath ? "medium" : effective;
             found.push({
                 kind: pattern.kind,
                 file,

package/dist/scanner.js

@@ -14,6 +14,8 @@ import { isRuleDisabled, loadConfig } from "./config.js";
 const CODE_ONLY = new Set([
     ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts",
     ".vue", ".svelte", ".py", ".rb", ".go", ".rs", ".java", ".php",
+    // Inline <script> in static sites carries console.log/TODO noise too
+    ".html", ".htm",
 ]);
 /** Gathers structured project info from the given root. */
 export async function detectProject(root, config) {
@@ -24,7 +26,7 @@ export async function detectProject(root, config) {
         hasPackageJson: fileExists(root, "package.json"),
         packageJson: pkg,
         packageManager: detectPackageManager(root),
-        framework: detectFramework(pkg),
+        framework: detectFramework(pkg, root, sourceFiles),
         scripts: pkg?.scripts ?? {},
         sourceFiles,
     };

package/dist/utils/files.js

@@ -3,14 +3,34 @@ import path from "node:path";
 import fg from "fast-glob";
 /** Glob patterns that are always ignored when scanning. */
 export const IGNORE_PATTERNS = [
-    "node_modules/**",
-    ".git/**",
-    "dist/**",
-    "build/**",
-    ".next/**",
-    "out/**",
-    "coverage/**",
-    ".cache/**",
+    // Dependencies and VCS (at any depth)
+    "**/node_modules/**",
+    "**/.git/**",
+    // Build output (at any depth, e.g. mobile/build/)
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/out/**",
+    "**/coverage/**",
+    "**/.cache/**",
+    "**/.turbo/**",
+    "**/.output/**",
+    // Minified/bundled vendor assets — not user code
+    "**/*.min.js",
+    "**/*.min.css",
+    "**/*.bundle.js",
+    "**/*.chunk.js",
+    "**/vendor/**",
+    "**/vendors/**",
+    // Python artifacts
+    "**/__pycache__/**",
+    "**/.venv/**",
+    "**/venv/**",
+    // Lockfiles and maps
+    "**/*.map",
+    "**/package-lock.json",
+    "**/pnpm-lock.yaml",
+    "**/yarn.lock",
 ];
 /** Extensions we treat as scannable text/code files. */
 export const CODE_EXTENSIONS = [
@@ -36,6 +56,9 @@ export const CODE_EXTENSIONS = [
     "toml",
     "env",
     "sh",
+    // Static sites: inline <script> blocks can leak keys just as easily
+    "html",
+    "htm",
 ];
 /** Returns true if the file exists (relative to root or absolute). */
 export function fileExists(root, rel) {

package/dist/utils/framework.js

@@ -1,6 +1,7 @@
 import { fileExists } from "./files.js";
-/** Detects the package manager based on lockfiles. */
+/** Detects the package manager based on lockfiles and manifests. */
 export function detectPackageManager(root) {
+    // Node ecosystems (lockfile wins over manifest)
     if (fileExists(root, "pnpm-lock.yaml"))
         return "pnpm";
     if (fileExists(root, "yarn.lock"))
@@ -9,34 +10,131 @@ export function detectPackageManager(root) {
         return "bun";
     if (fileExists(root, "package-lock.json"))
         return "npm";
+    if (fileExists(root, "deno.json") || fileExists(root, "deno.jsonc"))
+        return "deno";
+    // package.json without a lockfile is still an npm-family project
+    if (fileExists(root, "package.json"))
+        return "npm";
+    // Other ecosystems
+    if (fileExists(root, "uv.lock"))
+        return "uv";
+    if (fileExists(root, "poetry.lock"))
+        return "poetry";
+    if (fileExists(root, "requirements.txt") ||
+        fileExists(root, "pyproject.toml") ||
+        fileExists(root, "Pipfile")) {
+        return "pip";
+    }
+    if (fileExists(root, "Cargo.toml"))
+        return "cargo";
+    if (fileExists(root, "go.mod"))
+        return "go";
+    if (fileExists(root, "composer.json"))
+        return "composer";
+    if (fileExists(root, "Gemfile"))
+        return "bundler";
+    return "none";
+}
+/** Counts source files matching any of the given extensions. */
+function countByExt(files, exts) {
+    return files.filter((f) => exts.some((e) => f.toLowerCase().endsWith(e))).length;
+}
+/**
+ * Detects the framework/project type. Checks package.json dependencies
+ * first, then falls back to manifest files and source file extensions so
+ * that static sites, Python, Go, Rust, PHP, and Ruby projects are
+ * identified instead of reported as "unknown".
+ */
+export function detectFramework(pkg, root, sourceFiles = []) {
+    if (pkg) {
+        const deps = {
+            ...pkg.dependencies,
+            ...pkg.devDependencies,
+        };
+        // Order matters: meta-frameworks before their underlying libraries.
+        if (deps["next"])
+            return "Next.js";
+        if (deps["astro"])
+            return "Astro";
+        if (deps["@remix-run/react"] || deps["@remix-run/node"])
+            return "Remix";
+        if (deps["@angular/core"])
+            return "Angular";
+        if (deps["gatsby"])
+            return "Gatsby";
+        if (deps["@nestjs/core"])
+            return "NestJS";
+        if (deps["nuxt"] || deps["vue"])
+            return "Vue";
+        if (deps["svelte"] || deps["@sveltejs/kit"])
+            return "Svelte";
+        if (deps["vite"])
+            return "Vite";
+        if (deps["react"])
+            return "React";
+        if (deps["express"])
+            return "Express";
+        return "Node.js";
+    }
+    // No package.json: detect by manifests, then by dominant file type.
+    if (root) {
+        if (fileExists(root, "deno.json") || fileExists(root, "deno.jsonc"))
+            return "Deno";
+        if (fileExists(root, "pyproject.toml") ||
+            fileExists(root, "requirements.txt") ||
+            fileExists(root, "Pipfile")) {
+            return "Python";
+        }
+        if (fileExists(root, "Cargo.toml"))
+            return "Rust";
+        if (fileExists(root, "go.mod"))
+            return "Go";
+        if (fileExists(root, "composer.json"))
+            return "PHP";
+        if (fileExists(root, "Gemfile"))
+            return "Ruby";
+        if (fileExists(root, "pom.xml") || fileExists(root, "build.gradle") || fileExists(root, "build.gradle.kts")) {
+            return "Java";
+        }
+    }
+    const html = countByExt(sourceFiles, [".html", ".htm"]);
+    const py = countByExt(sourceFiles, [".py"]);
+    const go = countByExt(sourceFiles, [".go"]);
+    const rs = countByExt(sourceFiles, [".rs"]);
+    const php = countByExt(sourceFiles, [".php"]);
+    const rb = countByExt(sourceFiles, [".rb"]);
+    const js = countByExt(sourceFiles, [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
+    const counts = [
+        ["Python", py],
+        ["Go", go],
+        ["Rust", rs],
+        ["PHP", php],
+        ["Ruby", rb],
+    ];
+    const [lang, max] = counts.reduce((a, b) => (b[1] > a[1] ? b : a), ["unknown", 0]);
+    // A language wins only when it clearly dominates over HTML/JS glue files.
+    if (max > 0 && max >= html && max >= js)
+        return lang;
+    // HTML pages with (or without) plain JS assets: a static site.
+    if (html > 0)
+        return "Static HTML";
+    if (js > 0)
+        return "Node.js";
     return "unknown";
 }
-/** Detects the framework from package.json dependencies. */
-export function detectFramework(pkg) {
-    if (!pkg)
-        return "unknown";
-    const deps = {
-        ...pkg.dependencies,
-        ...pkg.devDependencies,
-    };
-    // Order matters: meta-frameworks before their underlying libraries.
-    if (deps["next"])
-        return "Next.js";
-    if (deps["@nestjs/core"])
-        return "NestJS";
-    if (deps["nuxt"] || deps["vue"])
-        return "Vue";
-    if (deps["svelte"] || deps["@sveltejs/kit"])
-        return "Svelte";
-    if (deps["vite"] && deps["react"])
-        return "Vite";
-    if (deps["vite"])
-        return "Vite";
-    if (deps["react"])
-        return "React";
-    if (deps["express"])
-        return "Express";
-    return "Node.js";
+/** True when the project belongs to the npm/Node ecosystem. */
+export function isNodeEcosystem(framework) {
+    return ![
+        "Static HTML",
+        "Python",
+        "Go",
+        "Rust",
+        "PHP",
+        "Ruby",
+        "Java",
+        "Deno",
+        "unknown",
+    ].includes(framework);
 }
 /** Returns the install command for a given package manager. */
 export function installCommand(pm) {
@@ -47,8 +145,21 @@ export function installCommand(pm) {
             return "yarn install";
         case "bun":
             return "bun install";
-        case "npm":
-        case "unknown":
+        case "poetry":
+            return "poetry install";
+        case "uv":
+            return "uv sync";
+        case "pip":
+            return "pip install -r requirements.txt";
+        case "cargo":
+            return "cargo build";
+        case "go":
+            return "go mod download";
+        case "composer":
+            return "composer install";
+        case "bundler":
+            return "bundle install";
+        default:
             return "npm install";
     }
 }
@@ -61,8 +172,7 @@ export function runCommand(pm, script) {
             return `yarn ${script}`;
         case "bun":
             return `bun run ${script}`;
-        case "npm":
-        case "unknown":
+        default:
             return `npm run ${script}`;
     }
 }

package/dist/utils/report.js

@@ -120,11 +120,14 @@ export function renderReport(report, verbose = false, version) {
     const lines = [];
     const { project } = report;
     const title = pc.bold(pc.magenta("shipready")) + (version ? pc.dim(` v${version}`) : "");
+    const pmLabel = project.packageManager === "none" || project.packageManager === "unknown"
+        ? pc.dim("\u2014")
+        : project.packageManager;
     const meta = pc.dim("project ") +
         project.framework +
         pc.dim("  \u00b7  ") +
         pc.dim("pm ") +
-        project.packageManager;
+        pmLabel;
     lines.push("");
     lines.push(...box([title, meta]));
     lines.push("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",