shipready 1.6.0 → 1.8.0

package/README.md

@@ -242,6 +242,53 @@ console.log("startup banner"); // shipready-ignore
 
 For project-wide exceptions, prefer `secretAllowlist` in the config (see below) so the suppression is reviewable in one place.
 
+## Secret autofix
+
+`shipready fix` moves hardcoded secrets out of your code into `.env`:
+
+```js
+// before
+const githubToken = "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
+// after
+const githubToken = process.env.GITHUB_TOKEN;
+```
+
+The value lands in `.env` (gitignored), a placeholder lands in `.env.example`, and env var names are derived from your identifiers (`stripeApiKey` becomes `STRIPE_API_KEY`). TypeScript gets `process.env.NAME!` to keep strict mode compiling; Python gets `os.environ["NAME"]` with the `import os` added.
+
+It never breaks your program - a rewrite only happens when it is provably safe:
+
+- only complete quoted string literals are replaced; a password embedded in a database URL is flagged for manual restructuring instead
+- client-side code (`"use client"`, `import.meta.env`) is never rewritten - an env var would still ship to the browser, so shipready tells you to move the call behind a server endpoint
+- after rewriting, the file is re-scanned; if the secret somehow survived, the file is restored untouched
+- identical values across files map to one env var; name collisions get numeric suffixes; existing `.env` entries are never overwritten
+- if nothing in your project loads `.env` (no dotenv/Next.js/Vite), shipready tells you to run with `node --env-file=.env`
+
+Use `--dry-run` to preview every change first. Remember to rotate any key that was already pushed - moving it to `.env` does not un-leak it.
+
+## Scoring
+
+The score starts at 100 and every deduction is itemized right under the score bar - the number is never a black box:
+
+| Deduction | Points |
+| --- | --- |
+| No package.json | -20 |
+| No README | -15 |
+| Weak README | -8 |
+| No build script | -8 |
+| No test script | -6 |
+| `.env.example` missing | -10 |
+| `.env` not ignored by git | -15 |
+| Hardcoded secret | -25 each (capped at -50) |
+| Secret in git history | -10 each (capped at -30) |
+| TODO/FIXME comment | -2 each (capped at -15) |
+
+Checks adapt to what your repo actually is:
+
+- **Monorepos** - workspaces (`package.json` `workspaces`, `pnpm-workspace.yaml`, including `**` globs) and conventional `frontend/` + `backend/` splits are detected; scripts and `.env.example` files in workspace packages count.
+- **Libraries** - packages with a `files` allowlist aren't required to have `dev`/`build` scripts.
+- **Non-JS ecosystems** - Go/Rust/Python/etc. projects get ecosystem-appropriate `.gitignore` expectations, and `.env` is only expected if the code actually reads env vars.
+- **Mixed-language repos** - a FastAPI + React project reads "Vite + Python", not just "Vite".
+
 ## Configuration
 
 Optional `shipready.config.json` in your project root:

package/dist/checks/gitignore.js

@@ -26,13 +26,30 @@ const ECOSYSTEM_IGNORES = {
     unknown: [".env"],
 };
 /** Returns the entries a project of the given framework should ignore. */
-export function importantIgnoresFor(framework) {
-    if (!framework || isNodeEcosystem(framework))
+export function importantIgnoresFor(framework, ctx) {
+    // Without context, keep the legacy full list (also the config-less API).
+    if (!framework && !ctx)
         return IMPORTANT_IGNORES;
-    return ECOSYSTEM_IGNORES[framework] ?? [".env"];
+    if (!framework || isNodeEcosystem(framework)) {
+        const entries = [".env", ".env.local", "node_modules"];
+        // Build output dirs are only worth ignoring when something builds.
+        if (ctx?.hasBuildScript !== false) {
+            if (framework === "Next.js")
+                entries.push(".next");
+            else
+                entries.push("dist");
+        }
+        return entries;
+    }
+    const base = ECOSYSTEM_IGNORES[framework] ?? [".env"];
+    // A repo that reads no env vars gains nothing from ignoring .env -
+    // suggesting it to e.g. ripgrep is pure noise.
+    if (ctx?.usesEnv === false)
+        return base.filter((e) => e !== ".env");
+    return base;
 }
 /** Returns which important entries are missing from gitignore content. */
-export function missingIgnoreEntries(content, framework) {
+export function missingIgnoreEntries(content, framework, ctx) {
     const lines = content
         .split("\n")
         .map((l) => l.trim())
@@ -47,10 +64,10 @@ export function missingIgnoreEntries(content, framework) {
         // "node_modules/" style already normalized above
         return false;
     });
-    return importantIgnoresFor(framework).filter((e) => !covers(e));
+    return importantIgnoresFor(framework, ctx).filter((e) => !covers(e));
 }
 /** Checks .gitignore existence and important entries. */
-export function checkGitignore(root, framework) {
+export function checkGitignore(root, framework, ctx) {
     const findings = [];
     const content = readTextFile(root, ".gitignore");
     if (content === null) {
@@ -61,7 +78,7 @@ export function checkGitignore(root, framework) {
         });
         return { name: "gitignore", findings };
     }
-    const missing = missingIgnoreEntries(content, framework);
+    const missing = missingIgnoreEntries(content, framework, ctx);
     if (missing.length > 0) {
         findings.push({
             severity: "warning",

package/dist/checks/packageJson.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import { fileExists } from "../utils/files.js";
 import { isNodeEcosystem } from "../utils/framework.js";
 const IMPORTANT_SCRIPTS = ["dev", "build", "test", "lint"];
@@ -43,9 +45,27 @@ export function checkPackageJson(project) {
         message: "package.json found",
     });
     const hasLinterConfig = LINTER_CONFIGS.some((f) => fileExists(project.root, f));
+    // Published libraries (a "files" allowlist, not private) ship source, not
+    // a running app - requiring dev/build scripts of e.g. express is noise.
+    const pkg = project.packageJson;
+    const isLibrary = Array.isArray(pkg?.["files"]) && pkg?.["private"] !== true;
+    // In monorepos the scripts live in workspace packages, not the root.
+    const workspaceScripts = new Set();
+    for (const dir of project.workspaceDirs ?? []) {
+        try {
+            const wsPkg = JSON.parse(fs.readFileSync(path.join(project.root, dir, "package.json"), "utf8"));
+            for (const name of Object.keys(wsPkg.scripts ?? {}))
+                workspaceScripts.add(name);
+        }
+        catch { /* skip unreadable workspace */ }
+    }
     const missing = IMPORTANT_SCRIPTS.filter((s) => {
         if (project.scripts[s])
             return false;
+        if (workspaceScripts.has(s))
+            return false;
+        if (isLibrary && (s === "dev" || s === "build"))
+            return false;
         // A biome/eslint config means linting is set up; the script name is
         // a convention, not a requirement (e.g. Biome repos run "biome check").
         if (s === "lint" && hasLinterConfig)

package/dist/cli.js

@@ -7,6 +7,7 @@ import { detectProject, runScan, scanFiles } from "./scanner.js";
 import { loadConfig } from "./config.js";
 import { fixAgentFiles } from "./fixers/agentFiles.js";
 import { fixEnvExample } from "./fixers/envExample.js";
+import { fixSecrets, projectLoadsDotenv } from "./fixers/secrets.js";
 import { fixGitignore } from "./fixers/gitignore.js";
 import { renderReport } from "./utils/report.js";
 import { toSarif } from "./utils/sarif.js";
@@ -47,12 +48,30 @@ function resolveRoot(dir) {
 async function applyFixes(root, force, dryRun = false) {
     const config = loadConfig(root);
     const project = await detectProject(root, config);
-    const { envUsages } = scanFiles(root, project.sourceFiles, config.secretAllowlist);
-    return [
-        fixEnvExample(root, envUsages, force, dryRun),
+    const { envUsages, secrets } = scanFiles(root, project.sourceFiles, config.secretAllowlist);
+    const secretFix = fixSecrets(root, secrets, dryRun);
+    const handled = new Set(secretFix.results.map((r) => r.file));
+    const results = [
+        ...secretFix.results,
+        ...[fixEnvExample(root, envUsages, force, dryRun)].filter((r) => !(r.action === "skipped" && handled.has(r.file))),
         fixGitignore(root, dryRun),
         ...fixAgentFiles(root, project, force, dryRun),
     ];
+    for (const { finding, reason } of secretFix.manual) {
+        results.push({
+            file: finding.file,
+            action: "skipped",
+            reason: `secret at line ${finding.line} needs a manual fix: ${reason}`,
+        });
+    }
+    if (secretFix.envAdditions.length > 0 && !projectLoadsDotenv(root)) {
+        results.push({
+            file: ".env",
+            action: "skipped",
+            reason: "heads up: nothing loads .env automatically - run with `node --env-file=.env` (Node 20+) or add dotenv",
+        });
+    }
+    return results;
 }
 /** Reads the CLI's own version from its package.json (works from dist/ at runtime). */
 function ownVersion() {
@@ -152,7 +171,7 @@ export function buildProgram() {
     });
     program
         .command("fix")
-        .description("Apply safe automatic fixes (.env.example, .gitignore, agent files)")
+        .description("Apply safe automatic fixes (move secrets to .env, .env.example, .gitignore, agent files)")
         .argument("[path]", "project directory (defaults to current directory)")
         .option("-f, --force", "overwrite existing files")
         .option("--dry-run", "show what would change without writing anything")

package/dist/fixers/secrets.js

@@ -0,0 +1,269 @@
+import path from "node:path";
+import { scanContentForSecrets } from "../checks/secrets.js";
+import { fileExists, readTextFile, writeTextFile } from "../utils/files.js";
+/** File extensions where we know how to rewrite a string literal safely. */
+const CODE_EXTENSIONS = new Set([
+    ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py",
+]);
+const QUOTES = new Set(["'", '"', "`"]);
+/**
+ * Converts an identifier (stripeKey, api_key, STRIPE_KEY) to
+ * SCREAMING_SNAKE_CASE for use as an env var name.
+ */
+function toEnvName(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replace(/[^A-Za-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .toUpperCase();
+}
+/** Names too vague to stand alone as env vars. */
+const GENERIC_NAMES = new Set(["KEY", "TOKEN", "SECRET", "PASSWORD", "AUTH", "API_KEY"]);
+/** Derives an env var name from the secret's kind ("GitHub token" -> GITHUB_TOKEN). */
+function nameFromKind(kind) {
+    return toEnvName(kind);
+}
+/**
+ * Derives an env var name from the code context: the identifier being
+ * assigned right before the literal, falling back to the finding's kind.
+ */
+function deriveEnvName(linePrefix, kind) {
+    const m = linePrefix.match(/([A-Za-z_$][A-Za-z0-9_$]*)\s*["']?\s*[:=]\s*$/);
+    if (m) {
+        const name = toEnvName(m[1]);
+        // "key" or "token" alone says nothing - qualify it with the kind.
+        if (GENERIC_NAMES.has(name))
+            return nameFromKind(kind);
+        if (name.length >= 3)
+            return name;
+    }
+    return nameFromKind(kind);
+}
+/** Builds the language-appropriate replacement expression. */
+function replacementFor(file, envName) {
+    const ext = path.extname(file);
+    if (ext === ".py")
+        return `os.environ["${envName}"]`;
+    // Non-null assertion keeps TS strict mode compiling; at runtime the
+    // behavior matches plain JS (undefined if unset).
+    if (ext === ".ts" || ext === ".tsx")
+        return `process.env.${envName}!`;
+    return `process.env.${envName}`;
+}
+/** True when the file is client-bundle code where env vars still leak. */
+function looksLikeClientCode(content) {
+    return (/^\s*["']use client["']/m.test(content) || content.includes("import.meta.env"));
+}
+/** Ensures `import os` exists in a Python file, inserting it if needed. */
+function ensurePythonOsImport(lines) {
+    if (lines.some((l) => /^\s*(import os\b|from os\b)/.test(l)))
+        return;
+    // Insert after shebang / encoding comments, before the first real line.
+    let insertAt = 0;
+    while (insertAt < lines.length &&
+        (lines[insertAt].startsWith("#!") || /^#.*coding[:=]/.test(lines[insertAt]))) {
+        insertAt++;
+    }
+    lines.splice(insertAt, 0, "import os");
+}
+/**
+ * Moves hardcoded secrets out of source code into .env, replacing each
+ * literal with the language's env accessor.
+ *
+ * Safety rules - a replacement only happens when ALL hold, otherwise the
+ * finding is reported for manual fixing:
+ * - the file is a known code type (JS/TS family or Python)
+ * - the file is not client-bundle code (env vars still ship to the browser)
+ * - the secret is a COMPLETE quoted string literal, not a substring of one
+ *   (a password inside a URL needs restructuring, not substitution)
+ * - after rewriting, a re-scan of the file confirms the raw value is gone;
+ *   if not, the file is restored untouched
+ */
+export function fixSecrets(root, secrets, dryRun = false) {
+    const results = [];
+    const manual = [];
+    const envAdditions = [];
+    // Same raw value everywhere maps to one env var; name collisions with
+    // different values get numeric suffixes.
+    const valueToName = new Map();
+    const nameToValue = new Map();
+    // Pre-seed with existing .env so we never clobber an existing entry.
+    const existingEnv = readTextFile(root, ".env") ?? "";
+    for (const line of existingEnv.split("\n")) {
+        const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+        if (m)
+            nameToValue.set(m[1], m[2]);
+    }
+    const claimName = (wanted, value) => {
+        const known = valueToName.get(value);
+        if (known)
+            return known;
+        let name = wanted;
+        let n = 2;
+        while (nameToValue.has(name) && nameToValue.get(name) !== value) {
+            name = `${wanted}_${n++}`;
+        }
+        valueToName.set(value, name);
+        nameToValue.set(name, value);
+        return name;
+    };
+    const byFile = new Map();
+    for (const f of secrets) {
+        if (!f.raw)
+            continue;
+        const list = byFile.get(f.file) ?? [];
+        list.push(f);
+        byFile.set(f.file, list);
+    }
+    for (const [file, findings] of byFile) {
+        const ext = path.extname(file);
+        if (!CODE_EXTENSIONS.has(ext)) {
+            for (const f of findings) {
+                manual.push({ finding: f, reason: `unsupported file type (${ext || "no extension"}) - move the value manually` });
+            }
+            continue;
+        }
+        const original = readTextFile(root, file);
+        if (original === null) {
+            for (const f of findings)
+                manual.push({ finding: f, reason: "file unreadable" });
+            continue;
+        }
+        if (looksLikeClientCode(original)) {
+            for (const f of findings) {
+                manual.push({
+                    finding: f,
+                    reason: "client-side code - an env var would still ship to the browser; move this call behind a server endpoint",
+                });
+            }
+            continue;
+        }
+        const lines = original.split("\n");
+        const fixedNames = [];
+        let changed = false;
+        // Bottom-up so earlier line numbers stay valid if we insert imports.
+        const sorted = [...findings].sort((a, b) => b.line - a.line);
+        for (const f of sorted) {
+            const raw = f.raw;
+            const lineIdx = f.line - 1;
+            const line = lines[lineIdx];
+            if (line === undefined) {
+                manual.push({ finding: f, reason: "line not found (file changed since scan)" });
+                continue;
+            }
+            const idx = line.indexOf(raw);
+            if (idx === -1) {
+                manual.push({ finding: f, reason: "value not found on its line (file changed since scan)" });
+                continue;
+            }
+            const before = line[idx - 1];
+            const after = line[idx + raw.length];
+            const isWholeLiteral = before !== undefined && after !== undefined && before === after && QUOTES.has(before);
+            if (!isWholeLiteral) {
+                manual.push({
+                    finding: f,
+                    reason: "secret is embedded inside a larger string (e.g. a URL) - restructure it manually",
+                });
+                continue;
+            }
+            const envName = claimName(deriveEnvName(line.slice(0, idx - 1), f.kind), raw);
+            const replacement = replacementFor(file, envName);
+            lines[lineIdx] =
+                line.slice(0, idx - 1) + replacement + line.slice(idx + raw.length + 1);
+            envAdditions.push({ name: envName, value: raw });
+            fixedNames.push(envName);
+            changed = true;
+        }
+        if (!changed)
+            continue;
+        if (ext === ".py")
+            ensurePythonOsImport(lines);
+        const updated = lines.join("\n");
+        // Verification gate: the raw values must be gone from a fresh scan.
+        const stillLeaking = scanContentForSecrets(updated, file).some((s) => findings.some((f) => f.raw === s.raw && fixedNames.length > 0));
+        const rawsGone = findings
+            .filter((f) => f.raw && fixedNames.length > 0)
+            .every((f) => !updated.includes(f.raw) || manual.some((m) => m.finding === f));
+        if (stillLeaking || !rawsGone) {
+            // Restore and report rather than half-fix.
+            for (const f of findings) {
+                manual.push({ finding: f, reason: "post-fix verification failed - file left untouched" });
+            }
+            // Roll back env additions for this file.
+            for (const name of fixedNames) {
+                const value = nameToValue.get(name);
+                if (value !== undefined) {
+                    valueToName.delete(value);
+                    nameToValue.delete(name);
+                }
+                const i = envAdditions.findIndex((e) => e.name === name);
+                if (i !== -1)
+                    envAdditions.splice(i, 1);
+            }
+            continue;
+        }
+        if (!dryRun)
+            writeTextFile(root, file, updated);
+        results.push({
+            file,
+            action: "updated",
+            dryRun,
+            preview: fixedNames.map((n) => `-> ${replacementFor(file, n)}`).join("\n"),
+        });
+    }
+    // Write .env and .env.example additions.
+    if (envAdditions.length > 0) {
+        const uniqueAdditions = envAdditions.filter((e, i) => envAdditions.findIndex((x) => x.name === e.name) === i);
+        const newEnvLines = uniqueAdditions
+            .filter((e) => !new RegExp(`^${e.name}=`, "m").test(existingEnv))
+            .map((e) => `${e.name}=${e.value}`);
+        if (newEnvLines.length > 0) {
+            const envContent = existingEnv.length > 0
+                ? existingEnv.replace(/\n*$/, "\n") + newEnvLines.join("\n") + "\n"
+                : "# Managed by shipready - do not commit this file.\n" + newEnvLines.join("\n") + "\n";
+            if (!dryRun)
+                writeTextFile(root, ".env", envContent);
+            results.push({
+                file: ".env",
+                action: existingEnv ? "updated" : "created",
+                dryRun,
+                preview: newEnvLines.map((l) => l.replace(/=.*/, "=***")).join("\n"),
+            });
+        }
+        const existingExample = readTextFile(root, ".env.example") ?? "";
+        const newExampleLines = uniqueAdditions
+            .filter((e) => !new RegExp(`^${e.name}=`, "m").test(existingExample))
+            .map((e) => `${e.name}=`);
+        if (newExampleLines.length > 0) {
+            const exampleContent = existingExample.length > 0
+                ? existingExample.replace(/\n*$/, "\n") + newExampleLines.join("\n") + "\n"
+                : newExampleLines.join("\n") + "\n";
+            if (!dryRun)
+                writeTextFile(root, ".env.example", exampleContent);
+            results.push({
+                file: ".env.example",
+                action: fileExists(root, ".env.example") && existingExample ? "updated" : "created",
+                dryRun,
+                preview: newExampleLines.join("\n"),
+            });
+        }
+    }
+    return { results, envAdditions, manual };
+}
+/**
+ * True when the project will pick up .env automatically at runtime; when
+ * false the caller should tell the user how to load it.
+ */
+export function projectLoadsDotenv(root) {
+    const pkgRaw = readTextFile(root, "package.json");
+    if (!pkgRaw)
+        return false;
+    try {
+        const pkg = JSON.parse(pkgRaw);
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        return Boolean(deps["dotenv"] || deps["next"] || deps["vite"] || deps["@dotenvx/dotenvx"]);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/scanner.js

@@ -8,7 +8,7 @@ import { checkHistory, isGitRepo, scanGitHistory } from "./checks/history.js";
 import { verifySecrets } from "./checks/verify.js";
 import { checkTodos, scanContentForTodos } from "./checks/todos.js";
 import { fileExists, findSourceFiles, isProbablyBinary, readJsonFile, readTextFile, } from "./utils/files.js";
-import { detectFramework, detectPackageManager, findWorkspaceDirs } from "./utils/framework.js";
+import { detectExtraLanguages, detectFramework, detectPackageManager, findWorkspaceDirs } from "./utils/framework.js";
 import { isRuleDisabled, loadConfig } from "./config.js";
 /** File extensions considered code for content scanning (not config/data). */
 const CODE_ONLY = new Set([
@@ -31,6 +31,7 @@ export async function detectProject(root, config) {
         scripts: pkg?.scripts ?? {},
         sourceFiles,
         workspaceDirs,
+        extraLanguages: detectExtraLanguages(root, detectFramework(pkg, root, sourceFiles, workspaceDirs)),
     };
 }
 /** Extracts env usages, secrets, and todos from all source files. */
@@ -75,37 +76,50 @@ export function scanFiles(root, files, secretAllowlist = []) {
     }
     return { envUsages, secrets, todos };
 }
-/** Score deductions per the shipready scoring model. */
-export function calculateScore(results) {
-    let score = 100;
+/**
+ * Score deductions per the shipready scoring model. Returns the breakdown
+ * so users can see exactly where every point went instead of trusting an
+ * opaque number.
+ */
+export function calculateScoreBreakdown(results) {
     const all = results.flatMap((r) => r.findings);
     const has = (rule) => all.some((f) => f.rule === rule);
     const count = (rule) => all.filter((f) => f.rule === rule).length;
+    const deductions = [];
+    const deduct = (points, reason) => {
+        if (points > 0)
+            deductions.push({ reason, points });
+    };
     if (has("package-json.missing"))
-        score -= 20;
+        deduct(20, "no package.json");
     if (has("readme.missing"))
-        score -= 15;
+        deduct(15, "no README");
     if (has("readme.weak"))
-        score -= 8;
+        deduct(8, "weak README");
     // Missing scripts: look at message to determine which ones
     const scriptsFinding = all.find((f) => f.rule === "scripts.missing");
     if (scriptsFinding) {
         if (scriptsFinding.message.includes("build"))
-            score -= 8;
+            deduct(8, "no build script");
         if (scriptsFinding.message.includes("test"))
-            score -= 6;
+            deduct(6, "no test script");
     }
     if (has("env.example-missing"))
-        score -= 10;
+        deduct(10, ".env.example missing");
     if (has("env.not-ignored"))
-        score -= 15;
+        deduct(15, ".env not ignored");
     const secretCount = count("secrets.detected-item");
-    score -= Math.min(secretCount * 25, 50);
+    deduct(Math.min(secretCount * 25, 50), secretCount === 1 ? "hardcoded secret" : `hardcoded secrets (${secretCount})`);
     const historyCount = count("history.secret-item");
-    score -= Math.min(historyCount * 10, 30);
+    deduct(Math.min(historyCount * 10, 30), historyCount === 1 ? "secret in git history" : `secrets in git history (${historyCount})`);
     const todoCount = count("todos.item");
-    score -= Math.min(todoCount * 2, 15);
-    return Math.max(0, score);
+    deduct(Math.min(todoCount * 2, 15), todoCount === 1 ? "TODO comment" : `TODO comments (${todoCount})`);
+    const total = deductions.reduce((sum, d) => sum + d.points, 0);
+    return { score: Math.max(0, 100 - total), deductions };
+}
+/** Score per the shipready scoring model (see calculateScoreBreakdown). */
+export function calculateScore(results) {
+    return calculateScoreBreakdown(results).score;
 }
 /** Removes findings whose rules are disabled by config. */
 function applyDisabledRules(results, disableRules) {
@@ -139,13 +153,16 @@ export async function runScan(root, options = {}) {
         checkSecrets(secrets),
         ...(options.history ? [checkHistory(historySecrets, historyScanned)] : []),
         checkTodos(todos),
-        checkGitignore(root, project.framework),
+        checkGitignore(root, project.framework, {
+            hasBuildScript: Boolean(project.scripts["build"]),
+            usesEnv: envUsages.length > 0,
+        }),
     ];
     // Disabled rules are removed before scoring so they don't affect the score.
     const results = applyDisabledRules(rawResults, config.disableRules);
     return {
         project,
         results,
-        score: calculateScore(results),
+        ...calculateScoreBreakdown(results),
     };
 }

package/dist/utils/framework.js

@@ -38,29 +38,71 @@ export function findWorkspaceDirs(root, pkg) {
         catch { /* unreadable yaml: treat as no workspaces */ }
     }
     const dirs = new Set();
+    const addPackagesUnder = (base, depth) => {
+        const abs = path.join(root, base);
+        if (!fs.existsSync(abs))
+            return;
+        try {
+            for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.name === "node_modules")
+                    continue;
+                const rel = path.join(base, entry.name);
+                if (fs.existsSync(path.join(root, rel, "package.json")))
+                    dirs.add(rel);
+                // "packages/**/*" style patterns nest one extra level (e.g. astro's
+                // packages/integrations/react). Depth-capped to avoid crawling.
+                else if (depth > 1)
+                    addPackagesUnder(rel, depth - 1);
+            }
+        }
+        catch { /* unreadable dir */ }
+    };
     for (const pattern of patterns) {
         if (pattern.startsWith("!"))
             continue;
-        if (pattern.endsWith("/*")) {
-            const base = pattern.slice(0, -2);
-            const abs = path.join(root, base);
-            if (!fs.existsSync(abs))
-                continue;
-            try {
-                for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
-                    if (entry.isDirectory() && fs.existsSync(path.join(abs, entry.name, "package.json"))) {
-                        dirs.add(path.join(base, entry.name));
-                    }
-                }
-            }
-            catch { /* unreadable dir */ }
+        if (pattern.includes("**")) {
+            addPackagesUnder(pattern.slice(0, pattern.indexOf("**")).replace(/\/$/, ""), 3);
+        }
+        else if (pattern.endsWith("/*")) {
+            addPackagesUnder(pattern.slice(0, -2), 1);
         }
         else if (fs.existsSync(path.join(root, pattern, "package.json"))) {
             dirs.add(pattern);
         }
     }
+    // Repos without workspace config often still split into conventional
+    // app dirs (frontend/ + backend/, client/ + server/). Treating those as
+    // pseudo-workspaces makes env/script checks see the whole project.
+    if (dirs.size === 0) {
+        for (const conventional of ["frontend", "backend", "client", "server", "web", "app", "api"]) {
+            if (fs.existsSync(path.join(root, conventional, "package.json"))) {
+                dirs.add(conventional);
+            }
+        }
+    }
     return [...dirs].sort();
 }
+/**
+ * Detects non-JS languages living alongside the primary framework, so a
+ * FastAPI + React template reads "Vite + Python" instead of hiding half
+ * the project.
+ */
+export function detectExtraLanguages(root, framework) {
+    const markers = [
+        ["pyproject.toml", "Python"],
+        ["requirements.txt", "Python"],
+        ["go.mod", "Go"],
+        ["Cargo.toml", "Rust"],
+        ["Gemfile", "Ruby"],
+        ["composer.json", "PHP"],
+    ];
+    const found = new Set();
+    for (const [file, lang] of markers) {
+        if (lang !== framework && fs.existsSync(path.join(root, file)))
+            found.add(lang);
+    }
+    return [...found];
+}
 /** Detects the package manager based on lockfiles and manifests. */
 export function detectPackageManager(root) {
     // Node ecosystems (lockfile wins over manifest)

package/dist/utils/report.js

@@ -125,6 +125,7 @@ export function renderReport(report, verbose = false, version) {
         : project.packageManager;
     const meta = pc.dim("project ") +
         project.framework +
+        (project.extraLanguages.length > 0 ? " + " + project.extraLanguages.join(" + ") : "") +
         pc.dim("  \u00b7  ") +
         pc.dim("pm ") +
         pmLabel;
@@ -132,6 +133,12 @@ export function renderReport(report, verbose = false, version) {
     lines.push(...box([title, meta]));
     lines.push("");
     lines.push(`  ${pc.bold("Score")}  ${scoreBar(report.score)}  ${scoreLabel(report.score)}  ${verdict(report.score)}`);
+    if (report.deductions.length > 0) {
+        lines.push("  " +
+            pc.dim(report.deductions
+                .map((d) => `-${d.points} ${d.reason}`)
+                .join("  \u00b7  ")));
+    }
     lines.push("");
     // Aligned checks table: one row per check, then its top-level findings.
     const labelWidth = Math.max(...report.results.map((r) => (CHECK_LABELS[r.name] ?? r.name).length));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",