Stop reporting measurements that were never taken

[TechLuddite]

Why

A review of the whole app surfaced one problem that mattered more than the rest:

The visualization quality was far ahead of the measurement honesty.

Several headline numbers were fabricated rather than measured, then presented as real in the UI, saved to localStorage, and written into exported CSV reports. Concretely: an offline machine still produced a complete, confident, entirely fictional speed test and an A-grade.

This PR fixes that, plus a confirmed XSS, a silently broken export pipeline, and the tooling gaps that let all of it ship unnoticed.

Measurement honesty

Failed measurements now report null plus a typed reason, and the UI renders — with an explanation. Removed:

Site	Invented
network.ts:360	navigator.connection.downlink || 25 when download measurement failed
network.ts:412	downloadSpeed * 0.45 on upload error — and counted payloadSize / 2 bytes that were never sent
network.ts:445	uploadSpeed = downloadSpeed * 0.4
network.ts:449	loadedPing = ping + 14, which then graded bufferbloat
network.ts:241	ping = 18; jitter = 3 when every probe failed
network.ts:818	Score defaulted to dl=30, ul=10, lat=35, jit=5, so a user who had never run a test got a letter grade. Used || not ??, so a genuine 0 Mbps silently became 30
tracert.ts:127,164	Hardcoded Washington DC and San Francisco coordinates on GeoIP failure, plotted on the map as if looked up
tracert.ts:85	Every private/loopback address resolved to San Francisco — your own LAN gateway, mapped to California
tracert.ts:268	AS7018 (AT&T) as a fallback ASN, attributing a real network operator to an unobserved hop
PortScanner.tsx:114	Hardcoded 192.168.1.50, labelled "Detected Interface"
SpeedTest.tsx:315	Bufferbloat rendered a passing A+ before any test ran

Two genuine measurement bugs fixed along the way: upload throughput averaged each concurrent worker's rate instead of aggregating bytes (understating it by roughly the worker count), and download reported a trailing moving average rather than excluding TCP slow start.

calculateNetReadyScore now returns null when nothing is measurable, and otherwise scores only the categories whose inputs exist — naming the rest in missingInputs.

Security

• DOM XSS (confirmed). L.divIcon({html}) and bindPopup() are innerHTML sinks, and both were fed the user's raw typed hostname plus unvalidated third-party GeoIP strings. A target of x">``<img src=x onerror=...>'`` executed in-origin. Both now build DOM nodes via textContent`.
• CSV formula injection. =, +, -, @, tab and CR are now neutralised in the shared escaper. Fields include user targets and third-party ISP strings, so =cmd|'/c calc'!A1 as a hostname reached Excel as a live formula.
• Removed the unused @google/genai dependency and the MAJOR_CAPABILITY_SERVER_SIDE_GEMINI_API declaration. No key was ever exposed, but the scaffolding advertised a server-side path this pure-client bundle cannot provide.

Exports were silently empty

Six field-name mismatches (downloadMbps vs downloadSpeed, sent vs packetsSent, queryTimeMs vs responseTimeMs, r.ttl vs r.TTL, …) meant the speed test, ping, port scanner and DNS CSVs produced structurally valid files with no data in them. geoip was missing from TEST_TYPES entirely, so those records could never be exported at all.

Root cause was HistoryItem.data: any, which hid every one of these from tsc.

Honest privacy statement

The modal claimed "we do not collect, transmit, track, or record any IP addresses, scan targets, domain names, or diagnostic logs." That is true of NetReady's servers — there are none — but the browser sends your public IP, every resolved domain and every scan target to twelve third parties. The modal and README now enumerate each provider and what it receives, and call out the tools that contact nobody.

The traceroute tab carries a non-dismissible banner: browsers cannot send ICMP or set an IP TTL, so its intermediate hops are generated, not measured. History and exports mark those records simulated.

Tooling

@types/react was missing entirely, so the whole React surface was implicitly any. Adding it allowed strict mode to go on with zero errors. Also added ESLint + Vitest, gated CI on typecheck/lint/test, added an ErrorBoundary (a render throw previously blanked the page), removed four unused dependencies, deleted the Express server in favour of a pure static build, and dropped the second lockfile.

Verification

• npm run check — strict typecheck clean, 0 lint errors, 60 tests passing.
• Driven in Chromium, 10/10 smoke checks, including the one that matters: an offline run renders em-dashes and a failure explanation with no fabricated figures anywhere.
• The browser pass caught two bugs static review missed — the default A+ bufferbloat grade, and a bare 0 rendered in the navbar from {connInfo.downlink && …}.

New tests cover the CSV generators (the regression test for the empty-export bug), CIDR math including RFC 3021 /31, OUI decoding, scoring, and private-address detection.

Deliberately not in scope

The port scanner remains a heuristic — it infers state from connection timing because browsers hide connection failures. I fixed the bug where a shared start timestamp made the entire fallback probe path dead code, but did not make the output look more confident than the method supports.

The synthetic traceroute is still present, behind the banner, rather than deleted — so the map has something to render until it is replaced by real DNS/TCP/TLS/TTFB phase timings, CDN edge discovery, and HTTP/3 negotiation detection.

---

Generated by Claude Code