sapper-ai 0.6.0 → 0.6.1

package/dist/auth.d.ts

@@ -0,0 +1,11 @@
+export declare function getAuthPath(): string;
+export declare function loadOpenAiApiKey(options?: {
+    env?: NodeJS.ProcessEnv;
+    authPath?: string;
+}): Promise<string | null>;
+export declare function maskApiKey(apiKey: string): string;
+export declare function promptAndSaveOpenAiApiKey(options?: {
+    authPath?: string;
+    mask?: string;
+}): Promise<string | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAkBA,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAsB,gBAAgB,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkB3H;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,wBAAsB,yBAAyB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B1H"}

package/dist/auth.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuthPath = getAuthPath;
+exports.loadOpenAiApiKey = loadOpenAiApiKey;
+exports.maskApiKey = maskApiKey;
+exports.promptAndSaveOpenAiApiKey = promptAndSaveOpenAiApiKey;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const password_1 = __importDefault(require("@inquirer/password"));
+const fs_1 = require("./utils/fs");
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function getAuthPath() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), '.sapperai', 'auth.json');
+}
+async function loadOpenAiApiKey(options = {}) {
+    const env = options.env ?? process.env;
+    const fromEnv = env.OPENAI_API_KEY;
+    if (isNonEmptyString(fromEnv)) {
+        return fromEnv.trim();
+    }
+    const authPath = options.authPath ?? getAuthPath();
+    const raw = await (0, fs_1.readFileIfExists)(authPath);
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const key = parsed.openai?.apiKey;
+        return isNonEmptyString(key) ? key.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function maskApiKey(apiKey) {
+    const trimmed = apiKey.trim();
+    if (trimmed.length <= 3)
+        return '***';
+    return `${trimmed.slice(0, 3)}${'█'.repeat(Math.min(24, Math.max(6, trimmed.length - 3)))}`;
+}
+async function promptAndSaveOpenAiApiKey(options = {}) {
+    const key = await (0, password_1.default)({
+        message: 'Enter your API key:',
+        mask: options.mask ?? '█',
+    });
+    if (!isNonEmptyString(key))
+        return null;
+    const authPath = options.authPath ?? getAuthPath();
+    const payload = {
+        openai: {
+            apiKey: key.trim(),
+            savedAt: new Date().toISOString(),
+        },
+    };
+    await (0, fs_1.atomicWriteFile)(authPath, `${JSON.stringify(payload, null, 2)}\n`, { mode: 0o600 });
+    // Best-effort: ensure perms even if the file already existed with broader mode.
+    // On Windows this is typically a no-op; prefer env vars there.
+    try {
+        const { chmod } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+        await chmod(authPath, 0o600);
+    }
+    catch {
+    }
+    return payload.openai.apiKey;
+}

package/dist/cli.js

@@ -133,7 +133,8 @@ Usage:
   sapper-ai scan ./path       Scan a specific file/directory
   sapper-ai scan --policy ./sapperai.config.yaml  Use explicit policy path (fatal if invalid)
   sapper-ai scan --fix        Quarantine blocked files
-  sapper-ai scan --ai         Deep scan with AI analysis (requires OPENAI_API_KEY)
+  sapper-ai scan --ai         Deep scan with AI analysis (OpenAI; prompts for key in a TTY)
+  sapper-ai scan --no-color   Disable ANSI colors
   sapper-ai scan --no-prompt  Disable all prompts (CI-safe)
   sapper-ai scan --harden     After scan, offer to apply recommended hardening
   sapper-ai scan --no-open    Skip opening report in browser
@@ -161,6 +162,7 @@ function parseScanArgs(argv) {
     let ai = false;
     let noSave = false;
     let noOpen = false;
+    let noColor = false;
     let noPrompt = false;
     let harden = false;
     for (let index = 0; index < argv.length; index += 1) {
@@ -190,6 +192,10 @@ function parseScanArgs(argv) {
             ai = true;
             continue;
         }
+        if (arg === '--no-color') {
+            noColor = true;
+            continue;
+        }
         if (arg === '--no-prompt') {
             noPrompt = true;
             continue;
@@ -211,12 +217,13 @@ function parseScanArgs(argv) {
         }
         targets.push(arg);
     }
-    return { targets, policyPath, fix, deep, system, ai, noSave, noOpen, noPrompt, harden };
+    return { targets, policyPath, fix, deep, system, ai, noSave, noOpen, noColor, noPrompt, harden };
 }
 function parseHardenArgs(argv) {
     let apply = false;
     let includeSystem = false;
     let yes = false;
+    let noColor = false;
     let noPrompt = false;
     let force = false;
     let workflowVersion;
@@ -240,6 +247,10 @@ function parseHardenArgs(argv) {
             yes = true;
             continue;
         }
+        if (arg === '--no-color') {
+            noColor = true;
+            continue;
+        }
         if (arg === '--no-prompt') {
             noPrompt = true;
             continue;
@@ -268,6 +279,7 @@ function parseHardenArgs(argv) {
         apply,
         includeSystem,
         yes,
+        noColor,
         noPrompt,
         force,
         workflowVersion,
@@ -454,7 +466,7 @@ async function promptScanDepth() {
         choices: [
             { name: 'Quick scan (rules only)      Fast regex pattern matching', value: false },
             {
-                name: 'Deep scan (rules + AI)       AI-powered analysis (requires OPENAI_API_KEY)',
+                name: 'Deep scan (rules + AI)       AI-powered analysis (OpenAI)',
                 value: true,
             },
         ],
@@ -468,6 +480,8 @@ async function resolveScanOptions(args) {
         fix: args.fix,
         noSave: args.noSave,
         noOpen: args.noOpen,
+        noColor: args.noColor,
+        noPrompt: args.noPrompt,
         policyPath: args.policyPath,
     };
     if (args.system) {

package/dist/postinstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,IAAI,IAAI,CAKrC"}
+{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,IAAI,IAAI,CAYrC"}

package/dist/postinstall.js

@@ -1,10 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPostinstall = runPostinstall;
-const MESSAGE = "SapperAI installed. Run 'npx sapper-ai scan' and follow the prompts to harden your setup.";
+const package_json_1 = __importDefault(require("../package.json"));
+const format_1 = require("./utils/format");
 function runPostinstall() {
     try {
-        console.log(MESSAGE);
+        const colors = (0, format_1.createColors)();
+        const version = typeof package_json_1.default.version === 'string' ? package_json_1.default.version : '';
+        const name = colors.olive ? `${colors.olive}sapper-ai${colors.reset}` : 'sapper-ai';
+        const ver = version ? `${colors.dim}v${version}${colors.reset}` : '';
+        console.log(`\n  ${name} ${ver}\n`);
+        console.log('  Run npx sapper-ai scan to get started.\n');
     }
     catch {
     }

package/dist/scan.d.ts

@@ -8,6 +8,8 @@ export interface ScanOptions {
     ai?: boolean;
     noSave?: boolean;
     noOpen?: boolean;
+    noPrompt?: boolean;
+    noColor?: boolean;
 }
 export interface ScanResult {
     version: '1.0';

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAgBD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE;QACP,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;QACpB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,wBAAwB,EAAE,MAAM,CAAA;QAChC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,QAAQ,EAAE,KAAK,CAAC;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,WAAW,EAAE,KAAK,CAAC;YACjB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAA;YAC3B,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,MAAM,CAAA;SAChB,CAAC,CAAA;KACH,CAAC,CAAA;CACH;AAgcD,wBAAsB,OAAO,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkRxE"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAiBD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE;QACP,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;QACpB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,wBAAwB,EAAE,MAAM,CAAA;QAChC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,QAAQ,EAAE,KAAK,CAAC;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,WAAW,EAAE,KAAK,CAAC;YACjB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAA;YAC3B,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,MAAM,CAAA;SAChB,CAAC,CAAA;KACH,CAAC,CAAA;CACH;AA8XD,wBAAsB,OAAO,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiQxE"}

package/dist/scan.js

@@ -38,12 +38,10 @@ const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const core_1 = require("@sapper-ai/core");
+const auth_1 = require("./auth");
 const presets_1 = require("./presets");
+const format_1 = require("./utils/format");
 const repoRoot_1 = require("./utils/repoRoot");
-const GREEN = '\x1b[32m';
-const YELLOW = '\x1b[33m';
-const RED = '\x1b[31m';
-const RESET = '\x1b[0m';
 const SYSTEM_SCAN_PATHS = (() => {
     const home = (0, node_os_1.homedir)();
     return [
@@ -134,84 +132,37 @@ async function collectFiles(targetPath, deep) {
     }
     return results;
 }
-function riskColor(risk) {
-    if (risk >= 0.8)
-        return RED;
-    if (risk >= 0.5)
-        return YELLOW;
-    return GREEN;
-}
-function stripAnsi(text) {
-    return text.replace(/\x1b\[[0-9;]*m/g, '');
-}
-function truncateToWidth(text, maxWidth) {
-    if (maxWidth <= 0) {
-        return '';
-    }
-    if (text.length <= maxWidth) {
-        return text;
-    }
-    if (maxWidth <= 3) {
-        return '.'.repeat(maxWidth);
-    }
-    return `...${text.slice(text.length - (maxWidth - 3))}`;
-}
-function renderProgressBar(current, total, width) {
-    const safeTotal = Math.max(1, total);
-    const pct = Math.floor((current / safeTotal) * 100);
-    const filled = Math.floor((current / safeTotal) * width);
-    const bar = '█'.repeat(filled) + '░'.repeat(Math.max(0, width - filled));
-    return `  ${bar}  ${pct}% │ ${current}/${total} files`;
-}
 function extractPatternLabel(decision) {
     const reason = decision.reasons[0];
     if (!reason)
         return 'threat';
     return reason.startsWith('Detected pattern: ') ? reason.slice('Detected pattern: '.length) : reason;
 }
-function padRight(text, width) {
-    if (text.length >= width)
-        return text;
-    return text + ' '.repeat(width - text.length);
-}
-function padRightVisual(text, width) {
-    const visLen = stripAnsi(text).length;
-    if (visLen >= width)
-        return text;
-    return text + ' '.repeat(width - visLen);
-}
-function padLeft(text, width) {
-    if (text.length >= width)
-        return text;
-    return ' '.repeat(width - text.length) + text;
-}
 function renderFindingsTable(findings, opts) {
-    const rows = findings.map((f, i) => {
-        const file = f.filePath.startsWith(opts.cwd + '/') ? f.filePath.slice(opts.cwd.length + 1) : f.filePath;
-        const pattern = extractPatternLabel(f.decision);
-        const riskValue = f.decision.risk.toFixed(2);
-        const riskPlain = padLeft(riskValue, 4);
-        const risk = opts.color ? `${riskColor(f.decision.risk)}${riskPlain}${RESET}` : riskPlain;
-        return { idx: String(i + 1), file, risk, pattern };
-    });
-    const idxWidth = Math.max(1, ...rows.map((r) => r.idx.length));
     const riskWidth = 4;
-    const patternWidth = Math.min(20, Math.max('Pattern'.length, ...rows.map((r) => r.pattern.length)));
-    const baseWidth = 2 + idxWidth + 2 + 2 + riskWidth + 2 + 2 + patternWidth + 2;
+    const patternWidth = Math.min(20, Math.max('Pattern'.length, ...findings.map((f) => extractPatternLabel(f.decision).length)));
+    const sourceWidth = opts.includeSource ? Math.max('Source'.length, 5) : 0;
     const maxTableWidth = Math.max(60, Math.min(opts.columns || 80, 120));
+    const sepWidth = 2;
+    const baseWidth = 'File'.length + sepWidth + riskWidth + sepWidth + patternWidth + (opts.includeSource ? sepWidth + sourceWidth : 0);
     const fileWidth = Math.max(20, Math.min(50, maxTableWidth - baseWidth));
-    const top = `  ┌${'─'.repeat(idxWidth + 2)}┬${'─'.repeat(fileWidth + 2)}┬${'─'.repeat(riskWidth + 2)}┬${'─'.repeat(patternWidth + 2)}┐`;
-    const header = `  │ ${padRight('#', idxWidth)} │ ${padRight('File', fileWidth)} │ ${padRight('Risk', riskWidth)} │ ${padRight('Pattern', patternWidth)} │`;
-    const sep = `  ├${'─'.repeat(idxWidth + 2)}┼${'─'.repeat(fileWidth + 2)}┼${'─'.repeat(riskWidth + 2)}┼${'─'.repeat(patternWidth + 2)}┤`;
-    const lines = [top, header, sep];
-    for (const r of rows) {
-        const file = truncateToWidth(r.file, fileWidth);
-        const pattern = truncateToWidth(r.pattern, patternWidth);
-        lines.push(`  │ ${padRight(r.idx, idxWidth)} │ ${padRight(file, fileWidth)} │ ${padRightVisual(r.risk, riskWidth)} │ ${padRight(pattern, patternWidth)} │`);
-    }
-    const bottom = `  └${'─'.repeat(idxWidth + 2)}┴${'─'.repeat(fileWidth + 2)}┴${'─'.repeat(riskWidth + 2)}┴${'─'.repeat(patternWidth + 2)}┘`;
-    lines.push(bottom);
-    return lines;
+    const headers = opts.includeSource ? ['File', 'Risk', 'Pattern', 'Source'] : ['File', 'Risk', 'Pattern'];
+    const rows = findings.map((f) => {
+        const relative = f.filePath.startsWith(opts.cwd + '/') ? f.filePath.slice(opts.cwd.length + 1) : f.filePath;
+        const file = (0, format_1.truncateToWidth)(relative, fileWidth);
+        const label = extractPatternLabel(f.decision);
+        const patternPlain = (0, format_1.truncateToWidth)(label, patternWidth);
+        const pattern = `${opts.colors.dim}${patternPlain}${opts.colors.reset}`;
+        const riskValue = f.decision.risk.toFixed(2);
+        const riskPlain = (0, format_1.padLeft)(riskValue, riskWidth);
+        const risk = `${(0, format_1.riskColor)(f.decision.risk, opts.colors)}${riskPlain}${opts.colors.reset}`;
+        if (!opts.includeSource) {
+            return [file, risk, pattern];
+        }
+        const src = f.source === 'ai' ? `${opts.colors.olive}ai${opts.colors.reset}` : `${opts.colors.dim}rules${opts.colors.reset}`;
+        return [file, risk, pattern, src];
+    });
+    return (0, format_1.table)(headers, rows, opts.colors);
 }
 function isThreat(decision, policy) {
     const { riskThreshold, blockMinConfidence } = getThresholds(policy);
@@ -390,15 +341,34 @@ async function buildScanResult(params) {
 }
 async function runScan(options = {}) {
     const cwd = process.cwd();
+    const colors = (0, format_1.createColors)({ noColor: options.noColor });
     const policy = resolvePolicy(cwd, { policyPath: options.policyPath });
     const fix = options.fix === true;
+    console.log(`\n${(0, format_1.header)('scan', colors)}\n`);
     const aiEnabled = options.ai === true;
     let llmConfig = null;
     if (aiEnabled) {
-        const apiKey = process.env.OPENAI_API_KEY;
+        let apiKey = await (0, auth_1.loadOpenAiApiKey)();
         if (!apiKey) {
-            console.log('\n  Error: OPENAI_API_KEY environment variable is required for --ai mode.\n');
-            return 1;
+            const canPrompt = options.noPrompt !== true && process.stdout.isTTY === true && process.stdin.isTTY === true;
+            if (!canPrompt) {
+                console.log('  Error: OPENAI_API_KEY environment variable is required for --ai mode.\n');
+                return 1;
+            }
+            console.log('  No OpenAI API key found.\n');
+            console.log(`  ${colors.olive}Get one at https://platform.openai.com/api-keys${colors.reset}`);
+            console.log();
+            apiKey = await (0, auth_1.promptAndSaveOpenAiApiKey)();
+            if (!apiKey) {
+                console.log('\n  Error: API key is required for --ai mode.\n');
+                return 1;
+            }
+            const authPath = (0, auth_1.getAuthPath)();
+            const home = (0, node_os_1.homedir)();
+            const displayAuthPath = authPath === home ? '~' : authPath.startsWith(home + '/') ? `~/${authPath.slice(home.length + 1)}` : authPath;
+            console.log();
+            console.log(`${colors.dim}  Key saved to ${displayAuthPath}${colors.reset}`);
+            console.log();
         }
         llmConfig = { provider: 'openai', apiKey, model: 'gpt-4.1-mini' };
     }
@@ -412,17 +382,6 @@ async function runScan(options = {}) {
     const detectors = (0, core_1.createDetectors)({ policy, preferredDetectors: ['rules'] });
     const quarantineDir = process.env.SAPPERAI_QUARANTINE_DIR;
     const quarantineManager = quarantineDir ? new core_1.QuarantineManager({ quarantineDir }) : new core_1.QuarantineManager();
-    const isTTY = process.stdout.isTTY === true;
-    const color = isTTY;
-    const scopeLabel = options.scopeLabel ??
-        (options.system
-            ? 'AI system scan'
-            : deep
-                ? 'Current + subdirectories'
-                : 'Current directory only');
-    console.log('\n  SapperAI Security Scanner\n');
-    console.log(`  Scope: ${scopeLabel}`);
-    console.log();
     const fileSet = new Set();
     for (const target of targets) {
         const files = await collectFiles(target, deep);
@@ -431,84 +390,44 @@ async function runScan(options = {}) {
         }
     }
     const files = Array.from(fileSet).sort();
-    console.log(`  Collecting files...  ${files.length} files found`);
-    const eligibleByName = files.filter((f) => (0, core_1.isConfigLikeFile)(f)).length;
-    console.log(`  Filter: config-like only (${eligibleByName} eligible / ${files.length} total)`);
+    const eligibleFiles = files.filter((f) => (0, core_1.isConfigLikeFile)(f));
+    const eligibleByName = eligibleFiles.length;
+    const skippedNotEligible = Math.max(0, files.length - eligibleByName);
+    console.log(`${colors.dim}  Scanning ${eligibleByName} files...${colors.reset}`);
     console.log();
-    if (aiEnabled) {
-        console.log('  Phase 1/2: Rules scan');
-        console.log();
-    }
     const scannedFindings = [];
     let scannedFiles = 0;
-    let eligibleFiles = 0;
-    let skippedNotEligible = 0;
     let skippedEmptyOrUnreadable = 0;
-    const total = files.length;
-    const progressWidth = Math.max(10, Math.min(30, (process.stdout.columns ?? 80) - 30));
-    for (let i = 0; i < files.length; i += 1) {
-        const filePath = files[i];
-        if (isTTY && total > 0) {
-            const bar = renderProgressBar(i + 1, total, progressWidth);
-            const label = '  Scanning: ';
-            const maxPath = Math.max(10, (process.stdout.columns ?? 80) - stripAnsi(bar).length - label.length);
-            const scanning = `${label}${truncateToWidth(filePath, maxPath)}`;
-            if (i === 0) {
-                process.stdout.write(`${bar}\n${scanning}\n`);
-            }
-            else {
-                process.stdout.write(`\x1b[2A\x1b[2K\r${bar}\n\x1b[2K\r${scanning}\n`);
-            }
-        }
+    for (const filePath of eligibleFiles) {
         const result = await scanFile(filePath, policy, scanner, detectors, fix, quarantineManager);
-        if (result.skipReason === 'not_eligible') {
-            skippedNotEligible += 1;
-            continue;
-        }
-        eligibleFiles += 1;
         if (result.skipReason === 'empty_or_unreadable') {
             skippedEmptyOrUnreadable += 1;
             continue;
         }
         if (result.scanned && result.decision) {
             scannedFiles += 1;
-            scannedFindings.push({ filePath, decision: result.decision, quarantinedId: result.quarantinedId });
+            scannedFindings.push({
+                filePath,
+                decision: result.decision,
+                quarantinedId: result.quarantinedId,
+                source: aiEnabled ? 'rules' : undefined,
+            });
         }
     }
-    if (isTTY && total > 0) {
-        process.stdout.write('\x1b[2A\x1b[2K\r\x1b[1B\x1b[2K\r');
-    }
+    let aiTargetsCount = 0;
     if (aiEnabled && llmConfig) {
         const suspiciousFindings = scannedFindings.filter((f) => f.decision.risk >= 0.5);
         const maxAiFiles = 50;
         if (suspiciousFindings.length > 0) {
             const aiTargets = suspiciousFindings.slice(0, maxAiFiles);
-            if (suspiciousFindings.length > maxAiFiles) {
-                console.log(`  Note: AI scan limited to ${maxAiFiles} files (${suspiciousFindings.length} suspicious)`);
-            }
-            console.log();
-            console.log(`  Phase 2/2: AI deep scan (${aiTargets.length} files)`);
-            console.log();
+            aiTargetsCount = aiTargets.length;
             const detectorsList = (policy.detectors ?? ['rules']).slice();
             if (!detectorsList.includes('llm')) {
                 detectorsList.push('llm');
             }
             const aiPolicy = { ...policy, llm: llmConfig, detectors: detectorsList };
             const aiDetectors = (0, core_1.createDetectors)({ policy: aiPolicy, preferredDetectors: ['rules', 'llm'] });
-            for (let i = 0; i < aiTargets.length; i += 1) {
-                const finding = aiTargets[i];
-                if (isTTY) {
-                    const bar = renderProgressBar(i + 1, aiTargets.length, progressWidth);
-                    const label = '  Analyzing: ';
-                    const maxPath = Math.max(10, (process.stdout.columns ?? 80) - stripAnsi(bar).length - label.length);
-                    const scanning = `${label}${truncateToWidth(finding.filePath, maxPath)}`;
-                    if (i === 0) {
-                        process.stdout.write(`${bar}\n${scanning}\n`);
-                    }
-                    else {
-                        process.stdout.write(`\x1b[2A\x1b[2K\r${bar}\n\x1b[2K\r${scanning}\n`);
-                    }
-                }
+            for (const finding of aiTargets) {
                 try {
                     const raw = await readFileIfPresent(finding.filePath);
                     if (!raw)
@@ -521,7 +440,10 @@ async function runScan(options = {}) {
                         sourcePath: finding.filePath,
                         sourceType: targetType,
                     });
-                    const mergedReasons = uniq([...finding.decision.reasons, ...aiDecision.reasons]);
+                    const aiDominates = aiDecision.risk > finding.decision.risk;
+                    const mergedReasons = aiDominates
+                        ? uniq([...aiDecision.reasons, ...finding.decision.reasons])
+                        : uniq([...finding.decision.reasons, ...aiDecision.reasons]);
                     const existingEvidence = finding.decision.evidence;
                     const mergedEvidence = [...existingEvidence];
                     for (const ev of aiDecision.evidence) {
@@ -534,7 +456,8 @@ async function runScan(options = {}) {
                         reasons: mergedReasons,
                         evidence: mergedEvidence,
                     };
-                    if (aiDecision.risk > finding.decision.risk) {
+                    if (aiDominates) {
+                        finding.source = 'ai';
                         finding.decision = {
                             ...nextDecision,
                             action: aiDecision.action,
@@ -543,6 +466,7 @@ async function runScan(options = {}) {
                         };
                     }
                     else {
+                        finding.source = finding.source ?? 'rules';
                         finding.decision = nextDecision;
                     }
                     finding.aiAnalysis =
@@ -551,19 +475,22 @@ async function runScan(options = {}) {
                 catch {
                 }
             }
-            if (isTTY && aiTargets.length > 0) {
-                process.stdout.write('\x1b[2A\x1b[2K\r\x1b[1B\x1b[2K\r');
-            }
         }
     }
+    const scopeLabel = options.scopeLabel ??
+        (options.system
+            ? 'AI system scan'
+            : deep
+                ? 'Current + subdirectories'
+                : 'Current directory only');
     const skippedFiles = skippedNotEligible + skippedEmptyOrUnreadable;
     const threats = scannedFindings.filter((f) => isThreat(f.decision, policy));
     const scanResult = await buildScanResult({
         scope: scopeLabel,
         target: targets.join(', '),
         ai: aiEnabled,
-        totalFiles: total,
-        eligibleFiles,
+        totalFiles: files.length,
+        eligibleFiles: eligibleByName,
         scannedFiles,
         skippedFiles,
         skippedNotEligible,
@@ -581,8 +508,8 @@ async function runScan(options = {}) {
         const html = generateHtmlReport(scanResult);
         const htmlPath = (0, node_path_1.join)(scanDir, `${ts}.html`);
         await (0, promises_1.writeFile)(htmlPath, html, 'utf8');
-        console.log(`  Saved to ${jsonPath}`);
-        console.log(`  Report: ${htmlPath}`);
+        console.log(`${colors.dim}  Saved to ${jsonPath}${colors.reset}`);
+        console.log(`${colors.dim}  Report: ${htmlPath}${colors.reset}`);
         console.log();
         if (options.noOpen !== true) {
             try {
@@ -599,28 +526,33 @@ async function runScan(options = {}) {
             }
         }
     }
+    if (aiEnabled) {
+        const countWidth = Math.max(String(eligibleByName).length, String(aiTargetsCount).length);
+        const rulesName = `${colors.dim}rules${colors.reset}`;
+        const aiName = `${colors.olive}ai${colors.reset}`;
+        console.log(`  Phase 1  ${(0, format_1.padRightVisual)(rulesName, 5)}  ${(0, format_1.padLeft)(String(eligibleByName), countWidth)} files`);
+        console.log(`  Phase 2  ${(0, format_1.padRightVisual)(aiName, 5)}  ${(0, format_1.padLeft)(String(aiTargetsCount), countWidth)} files`);
+        console.log();
+    }
     if (threats.length === 0) {
-        const msg = `  ✓ All clear — ${scannedFiles}/${eligibleFiles} eligible files scanned, 0 threats detected (${total} total files)`;
-        console.log(color ? `${GREEN}${msg}${RESET}` : msg);
+        console.log(`  ${colors.olive}All clear — 0 threats in ${eligibleByName} files${colors.reset}`);
         console.log();
+        return 0;
+    }
+    console.log(renderFindingsTable(threats, {
+        cwd,
+        columns: process.stdout.columns ?? 80,
+        colors,
+        includeSource: aiEnabled,
+    }));
+    console.log();
+    console.log(`  ${threats.length} threats found in ${eligibleByName} files (${files.length} total)`);
+    console.log();
+    if (!fix) {
+        console.log('  Run npx sapper-ai scan --fix to quarantine.\n');
     }
     else {
-        const warn = `  ⚠ ${scannedFiles}/${eligibleFiles} eligible files scanned, ${threats.length} threats detected (${total} total files)`;
-        console.log(color ? `${RED}${warn}${RESET}` : warn);
         console.log();
-        const tableLines = renderFindingsTable(threats, {
-            cwd,
-            columns: process.stdout.columns ?? 80,
-            color,
-        });
-        for (const line of tableLines) {
-            console.log(line);
-        }
-        console.log();
-        if (!fix) {
-            console.log("  Run 'npx sapper-ai scan --fix' to quarantine blocked files.");
-            console.log();
-        }
     }
-    return threats.length > 0 ? 1 : 0;
+    return 1;
 }

package/dist/utils/format.d.ts

@@ -0,0 +1,22 @@
+export interface Colors {
+    olive: string;
+    dim: string;
+    bold: string;
+    red: string;
+    yellow: string;
+    reset: string;
+}
+export declare function createColors(options?: {
+    noColor?: boolean;
+    env?: NodeJS.ProcessEnv;
+    stdoutIsTTY?: boolean;
+}): Colors;
+export declare function header(command: string, colors: Colors): string;
+export declare function riskColor(risk: number, colors: Colors): string;
+export declare function stripAnsi(text: string): string;
+export declare function truncateToWidth(text: string, maxWidth: number): string;
+export declare function padRight(text: string, width: number): string;
+export declare function padRightVisual(text: string, width: number): string;
+export declare function padLeft(text: string, width: number): string;
+export declare function table(headers: string[], rows: string[][], colors: Colors): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/utils/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/utils/format.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAQD,wBAAgB,YAAY,CAC1B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAClF,MAAM,CAkBR;AAGD,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG9D;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAStE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG3D;AAID,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsBjF"}

package/dist/utils/format.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createColors = createColors;
+exports.header = header;
+exports.riskColor = riskColor;
+exports.stripAnsi = stripAnsi;
+exports.truncateToWidth = truncateToWidth;
+exports.padRight = padRight;
+exports.padRightVisual = padRightVisual;
+exports.padLeft = padLeft;
+exports.table = table;
+function supportsTruecolor(env) {
+    const value = env.COLORTERM?.toLowerCase();
+    if (!value)
+        return false;
+    return value.includes('truecolor') || value.includes('24bit');
+}
+function createColors(options = {}) {
+    const env = options.env ?? process.env;
+    const stdoutIsTTY = options.stdoutIsTTY ?? process.stdout.isTTY;
+    const disabled = env.NO_COLOR !== undefined || options.noColor === true || stdoutIsTTY !== true;
+    if (disabled) {
+        return { olive: '', dim: '', bold: '', red: '', yellow: '', reset: '' };
+    }
+    const olive = supportsTruecolor(env) ? '\x1b[38;2;107;142;35m' : '\x1b[32m';
+    return {
+        olive,
+        dim: '\x1b[2m',
+        bold: '\x1b[1m',
+        red: '\x1b[31m',
+        yellow: '\x1b[33m',
+        reset: '\x1b[0m',
+    };
+}
+// Header: "  sapper-ai <command>"
+function header(command, colors) {
+    const name = colors.olive ? `${colors.olive}sapper-ai${colors.reset}` : 'sapper-ai';
+    return `  ${name} ${command}`;
+}
+// Risk color by value (>= 0.8 red+bold, 0.5~0.8 yellow, < 0.5 dim)
+function riskColor(risk, colors) {
+    if (risk >= 0.8)
+        return `${colors.bold}${colors.red}`;
+    if (risk >= 0.5)
+        return colors.yellow;
+    return colors.dim;
+}
+function stripAnsi(text) {
+    return text.replace(/\x1b\[[0-9;]*m/g, '');
+}
+function truncateToWidth(text, maxWidth) {
+    if (maxWidth <= 0)
+        return '';
+    if (text.length <= maxWidth)
+        return text;
+    if (maxWidth <= 3) {
+        return '.'.repeat(maxWidth);
+    }
+    return `...${text.slice(text.length - (maxWidth - 3))}`;
+}
+function padRight(text, width) {
+    if (text.length >= width)
+        return text;
+    return text + ' '.repeat(width - text.length);
+}
+function padRightVisual(text, width) {
+    const visLen = stripAnsi(text).length;
+    if (visLen >= width)
+        return text;
+    return text + ' '.repeat(width - visLen);
+}
+function padLeft(text, width) {
+    if (text.length >= width)
+        return text;
+    return ' '.repeat(width - text.length) + text;
+}
+// Aligned table (Vercel style, no box borders).
+// ANSI-aware: stripAnsi based visible width.
+function table(headers, rows, colors) {
+    const columnCount = headers.length;
+    const normalizedRows = rows.map((row) => {
+        const out = row.slice(0, columnCount);
+        while (out.length < columnCount)
+            out.push('');
+        return out;
+    });
+    const headerRow = headers.map((h) => (colors.dim ? `${colors.dim}${h}${colors.reset}` : h));
+    const all = [headerRow, ...normalizedRows];
+    const widths = headers.map((_, col) => Math.max(0, ...all.map((r) => stripAnsi(r[col] ?? '').length)));
+    const sep = '  ';
+    const lines = [];
+    lines.push(`  ${headerRow.map((cell, i) => padRightVisual(cell, widths[i])).join(sep)}`.trimEnd());
+    for (const row of normalizedRows) {
+        lines.push(`  ${row.map((cell, i) => padRightVisual(cell, widths[i])).join(sep)}`.trimEnd());
+    }
+    return lines.join('\n');
+}

package/dist/utils/fs.d.ts

@@ -1,5 +1,7 @@
 export declare function readFileIfExists(filePath: string): Promise<string | null>;
 export declare function ensureDir(dirPath: string): Promise<void>;
 export declare function backupFile(originalPath: string): Promise<string>;
-export declare function atomicWriteFile(filePath: string, content: string): Promise<void>;
+export declare function atomicWriteFile(filePath: string, content: string, options?: {
+    mode?: number;
+}): Promise<void>;
 //# sourceMappingURL=fs.d.ts.map

package/dist/utils/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM/E;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAkBD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAStF"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM/E;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAkBD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/utils/fs.js

@@ -37,11 +37,11 @@ async function backupFile(originalPath) {
     await (0, promises_1.copyFile)(originalPath, backupPath);
     return backupPath;
 }
-async function atomicWriteFile(filePath, content) {
+async function atomicWriteFile(filePath, content, options = {}) {
     const dir = (0, node_path_1.dirname)(filePath);
     await ensureDir(dir);
     const tmpName = `.${(0, node_path_1.basename)(filePath)}.tmp.${process.pid}.${Date.now()}`;
     const tmpPath = (0, node_path_1.join)(dir, tmpName);
-    await (0, promises_1.writeFile)(tmpPath, content, 'utf8');
+    await (0, promises_1.writeFile)(tmpPath, content, { encoding: 'utf8', mode: options.mode });
     await (0, promises_1.rename)(tmpPath, filePath);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sapper-ai",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "AI security guardrails - single install, sensible defaults",
   "keywords": [
     "security",
@@ -39,9 +39,10 @@
     "access": "public"
   },
   "dependencies": {
+    "@inquirer/password": "^4.0.0",
     "@inquirer/select": "^4.0.0",
     "@sapper-ai/core": "0.2.2",
-    "@sapper-ai/mcp": "0.3.0",
+    "@sapper-ai/mcp": "0.3.1",
     "@sapper-ai/types": "0.2.1"
   },
   "peerDependencies": {