sapper-ai 0.6.0 → 0.6.2

package/dist/auth.d.ts

@@ -0,0 +1,11 @@
+export declare function getAuthPath(): string;
+export declare function loadOpenAiApiKey(options?: {
+    env?: NodeJS.ProcessEnv;
+    authPath?: string;
+}): Promise<string | null>;
+export declare function maskApiKey(apiKey: string): string;
+export declare function promptAndSaveOpenAiApiKey(options?: {
+    authPath?: string;
+    mask?: string;
+}): Promise<string | null>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAkBA,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAsB,gBAAgB,CAAC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkB3H;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,wBAAsB,yBAAyB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B1H"}

package/dist/auth.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuthPath = getAuthPath;
+exports.loadOpenAiApiKey = loadOpenAiApiKey;
+exports.maskApiKey = maskApiKey;
+exports.promptAndSaveOpenAiApiKey = promptAndSaveOpenAiApiKey;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const password_1 = __importDefault(require("@inquirer/password"));
+const fs_1 = require("./utils/fs");
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function getAuthPath() {
+    return (0, node_path_1.join)((0, node_os_1.homedir)(), '.sapperai', 'auth.json');
+}
+async function loadOpenAiApiKey(options = {}) {
+    const env = options.env ?? process.env;
+    const fromEnv = env.OPENAI_API_KEY;
+    if (isNonEmptyString(fromEnv)) {
+        return fromEnv.trim();
+    }
+    const authPath = options.authPath ?? getAuthPath();
+    const raw = await (0, fs_1.readFileIfExists)(authPath);
+    if (raw === null)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const key = parsed.openai?.apiKey;
+        return isNonEmptyString(key) ? key.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function maskApiKey(apiKey) {
+    const trimmed = apiKey.trim();
+    if (trimmed.length <= 3)
+        return '***';
+    return `${trimmed.slice(0, 3)}${'█'.repeat(Math.min(24, Math.max(6, trimmed.length - 3)))}`;
+}
+async function promptAndSaveOpenAiApiKey(options = {}) {
+    const key = await (0, password_1.default)({
+        message: 'Enter your API key:',
+        mask: options.mask ?? '█',
+    });
+    if (!isNonEmptyString(key))
+        return null;
+    const authPath = options.authPath ?? getAuthPath();
+    const payload = {
+        openai: {
+            apiKey: key.trim(),
+            savedAt: new Date().toISOString(),
+        },
+    };
+    await (0, fs_1.atomicWriteFile)(authPath, `${JSON.stringify(payload, null, 2)}\n`, { mode: 0o600 });
+    // Best-effort: ensure perms even if the file already existed with broader mode.
+    // On Windows this is typically a no-op; prefer env vars there.
+    try {
+        const { chmod } = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+        await chmod(authPath, 0o600);
+    }
+    catch {
+    }
+    return payload.openai.apiKey;
+}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAkBA,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAuFpF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAiBA,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFpF"}

package/dist/cli.js

@@ -39,7 +39,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
 const node_fs_1 = require("node:fs");
-const node_child_process_1 = require("node:child_process");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const readline = __importStar(require("node:readline"));
@@ -111,9 +110,6 @@ async function runCli(argv = process.argv.slice(2)) {
         }
         return (0, quarantine_1.runQuarantineRestore)({ id: parsed.id, quarantineDir: parsed.quarantineDir, force: parsed.force });
     }
-    if (argv[0] === 'dashboard') {
-        return runDashboard();
-    }
     if (argv[0] !== 'init') {
         printUsage();
         return 1;
@@ -133,7 +129,8 @@ Usage:
   sapper-ai scan ./path       Scan a specific file/directory
   sapper-ai scan --policy ./sapperai.config.yaml  Use explicit policy path (fatal if invalid)
   sapper-ai scan --fix        Quarantine blocked files
-  sapper-ai scan --ai         Deep scan with AI analysis (requires OPENAI_API_KEY)
+  sapper-ai scan --ai         Deep scan with AI analysis (OpenAI; prompts for key in a TTY)
+  sapper-ai scan --no-color   Disable ANSI colors
   sapper-ai scan --no-prompt  Disable all prompts (CI-safe)
   sapper-ai scan --harden     After scan, offer to apply recommended hardening
   sapper-ai scan --no-open    Skip opening report in browser
@@ -146,7 +143,6 @@ Usage:
   sapper-ai quarantine list   List quarantined files
   sapper-ai quarantine restore <id> [--force]  Restore quarantined file by id
   sapper-ai init          Interactive setup wizard
-  sapper-ai dashboard     Launch web dashboard
   sapper-ai --help        Show this help
 
 Learn more: https://github.com/sapper-ai/sapperai
@@ -161,6 +157,7 @@ function parseScanArgs(argv) {
     let ai = false;
     let noSave = false;
     let noOpen = false;
+    let noColor = false;
     let noPrompt = false;
     let harden = false;
     for (let index = 0; index < argv.length; index += 1) {
@@ -190,6 +187,10 @@ function parseScanArgs(argv) {
             ai = true;
             continue;
         }
+        if (arg === '--no-color') {
+            noColor = true;
+            continue;
+        }
         if (arg === '--no-prompt') {
             noPrompt = true;
             continue;
@@ -211,12 +212,13 @@ function parseScanArgs(argv) {
         }
         targets.push(arg);
     }
-    return { targets, policyPath, fix, deep, system, ai, noSave, noOpen, noPrompt, harden };
+    return { targets, policyPath, fix, deep, system, ai, noSave, noOpen, noColor, noPrompt, harden };
 }
 function parseHardenArgs(argv) {
     let apply = false;
     let includeSystem = false;
     let yes = false;
+    let noColor = false;
     let noPrompt = false;
     let force = false;
     let workflowVersion;
@@ -240,6 +242,10 @@ function parseHardenArgs(argv) {
             yes = true;
             continue;
         }
+        if (arg === '--no-color') {
+            noColor = true;
+            continue;
+        }
         if (arg === '--no-prompt') {
             noPrompt = true;
             continue;
@@ -268,6 +274,7 @@ function parseHardenArgs(argv) {
         apply,
         includeSystem,
         yes,
+        noColor,
         noPrompt,
         force,
         workflowVersion,
@@ -454,7 +461,7 @@ async function promptScanDepth() {
         choices: [
             { name: 'Quick scan (rules only)      Fast regex pattern matching', value: false },
             {
-                name: 'Deep scan (rules + AI)       AI-powered analysis (requires OPENAI_API_KEY)',
+                name: 'Deep scan (rules + AI)       AI-powered analysis (OpenAI)',
                 value: true,
             },
         ],
@@ -468,6 +475,8 @@ async function resolveScanOptions(args) {
         fix: args.fix,
         noSave: args.noSave,
         noOpen: args.noOpen,
+        noColor: args.noColor,
+        noPrompt: args.noPrompt,
         policyPath: args.policyPath,
     };
     if (args.system) {
@@ -510,43 +519,6 @@ async function resolveScanOptions(args) {
     }
     return { ...common, targets: [cwd], deep: true, ai, scopeLabel: 'Current + subdirectories' };
 }
-async function runDashboard() {
-    const configuredPort = process.env.PORT;
-    const standalonePort = configuredPort ?? '4100';
-    const devPort = configuredPort ?? '3000';
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const startPath = require.resolve('@sapper-ai/dashboard/bin/start');
-        process.env.PORT = standalonePort;
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        require(startPath);
-        return await new Promise((resolveExit) => {
-            const stop = () => resolveExit(0);
-            process.once('SIGINT', stop);
-            process.once('SIGTERM', stop);
-        });
-    }
-    catch {
-    }
-    const webDir = (0, node_path_1.resolve)(__dirname, '../../../apps/web');
-    if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(webDir, 'package.json'))) {
-        console.log(`\n  SapperAI Dashboard (dev): http://localhost:${devPort}/dashboard\n`);
-        console.log('  Press Ctrl+C to stop\n');
-        const child = (0, node_child_process_1.spawn)('npx', ['next', 'dev', '--port', devPort], {
-            cwd: webDir,
-            stdio: 'inherit',
-            env: process.env,
-        });
-        process.on('SIGINT', () => child.kill('SIGINT'));
-        process.on('SIGTERM', () => child.kill('SIGTERM'));
-        return await new Promise((resolveExit) => {
-            child.on('close', (code) => resolveExit(code ?? 0));
-        });
-    }
-    console.error('\n  Install @sapper-ai/dashboard for standalone mode:');
-    console.error('  pnpm add @sapper-ai/dashboard\n');
-    return 1;
-}
 async function runInitWizard() {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const ask = (q) => new Promise((res) => rl.question(q, res));

package/dist/postinstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,IAAI,IAAI,CAKrC"}
+{"version":3,"file":"postinstall.d.ts","sourceRoot":"","sources":["../src/postinstall.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,IAAI,IAAI,CAYrC"}

package/dist/postinstall.js

@@ -1,10 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPostinstall = runPostinstall;
-const MESSAGE = "SapperAI installed. Run 'npx sapper-ai scan' and follow the prompts to harden your setup.";
+const package_json_1 = __importDefault(require("../package.json"));
+const format_1 = require("./utils/format");
 function runPostinstall() {
     try {
-        console.log(MESSAGE);
+        const colors = (0, format_1.createColors)();
+        const version = typeof package_json_1.default.version === 'string' ? package_json_1.default.version : '';
+        const name = colors.olive ? `${colors.olive}sapper-ai${colors.reset}` : 'sapper-ai';
+        const ver = version ? `${colors.dim}v${version}${colors.reset}` : '';
+        console.log(`\n  ${name} ${ver}\n`);
+        console.log('  Run npx sapper-ai scan to get started.\n');
     }
     catch {
     }

package/dist/scan.d.ts

@@ -8,6 +8,8 @@ export interface ScanOptions {
     ai?: boolean;
     noSave?: boolean;
     noOpen?: boolean;
+    noPrompt?: boolean;
+    noColor?: boolean;
 }
 export interface ScanResult {
     version: '1.0';

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAgBD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE;QACP,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;QACpB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,wBAAwB,EAAE,MAAM,CAAA;QAChC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,QAAQ,EAAE,KAAK,CAAC;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,WAAW,EAAE,KAAK,CAAC;YACjB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAA;YAC3B,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,MAAM,CAAA;SAChB,CAAC,CAAA;KACH,CAAC,CAAA;CACH;AAgcD,wBAAsB,OAAO,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkRxE"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAiBD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE;QACP,cAAc,EAAE,OAAO,CAAA;KACxB,CAAA;IACD,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;QACpB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,wBAAwB,EAAE,MAAM,CAAA;QAChC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,QAAQ,EAAE,KAAK,CAAC;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,OAAO,EAAE,MAAM,EAAE,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,EAAE,CAAA;QACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;QACzB,WAAW,EAAE,KAAK,CAAC;YACjB,KAAK,EAAE,MAAM,CAAA;YACb,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAA;YAC3B,SAAS,EAAE,MAAM,CAAA;YACjB,OAAO,EAAE,MAAM,CAAA;SAChB,CAAC,CAAA;KACH,CAAC,CAAA;CACH;AA8XD,wBAAsB,OAAO,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6RxE"}

package/dist/scan.js

@@ -38,12 +38,11 @@ const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const core_1 = require("@sapper-ai/core");
+const auth_1 = require("./auth");
 const presets_1 = require("./presets");
+const progress_1 = require("./utils/progress");
+const format_1 = require("./utils/format");
 const repoRoot_1 = require("./utils/repoRoot");
-const GREEN = '\x1b[32m';
-const YELLOW = '\x1b[33m';
-const RED = '\x1b[31m';
-const RESET = '\x1b[0m';
 const SYSTEM_SCAN_PATHS = (() => {
     const home = (0, node_os_1.homedir)();
     return [
@@ -134,84 +133,37 @@ async function collectFiles(targetPath, deep) {
     }
     return results;
 }
-function riskColor(risk) {
-    if (risk >= 0.8)
-        return RED;
-    if (risk >= 0.5)
-        return YELLOW;
-    return GREEN;
-}
-function stripAnsi(text) {
-    return text.replace(/\x1b\[[0-9;]*m/g, '');
-}
-function truncateToWidth(text, maxWidth) {
-    if (maxWidth <= 0) {
-        return '';
-    }
-    if (text.length <= maxWidth) {
-        return text;
-    }
-    if (maxWidth <= 3) {
-        return '.'.repeat(maxWidth);
-    }
-    return `...${text.slice(text.length - (maxWidth - 3))}`;
-}
-function renderProgressBar(current, total, width) {
-    const safeTotal = Math.max(1, total);
-    const pct = Math.floor((current / safeTotal) * 100);
-    const filled = Math.floor((current / safeTotal) * width);
-    const bar = '█'.repeat(filled) + '░'.repeat(Math.max(0, width - filled));
-    return `  ${bar}  ${pct}% │ ${current}/${total} files`;
-}
 function extractPatternLabel(decision) {
     const reason = decision.reasons[0];
     if (!reason)
         return 'threat';
     return reason.startsWith('Detected pattern: ') ? reason.slice('Detected pattern: '.length) : reason;
 }
-function padRight(text, width) {
-    if (text.length >= width)
-        return text;
-    return text + ' '.repeat(width - text.length);
-}
-function padRightVisual(text, width) {
-    const visLen = stripAnsi(text).length;
-    if (visLen >= width)
-        return text;
-    return text + ' '.repeat(width - visLen);
-}
-function padLeft(text, width) {
-    if (text.length >= width)
-        return text;
-    return ' '.repeat(width - text.length) + text;
-}
 function renderFindingsTable(findings, opts) {
-    const rows = findings.map((f, i) => {
-        const file = f.filePath.startsWith(opts.cwd + '/') ? f.filePath.slice(opts.cwd.length + 1) : f.filePath;
-        const pattern = extractPatternLabel(f.decision);
-        const riskValue = f.decision.risk.toFixed(2);
-        const riskPlain = padLeft(riskValue, 4);
-        const risk = opts.color ? `${riskColor(f.decision.risk)}${riskPlain}${RESET}` : riskPlain;
-        return { idx: String(i + 1), file, risk, pattern };
-    });
-    const idxWidth = Math.max(1, ...rows.map((r) => r.idx.length));
     const riskWidth = 4;
-    const patternWidth = Math.min(20, Math.max('Pattern'.length, ...rows.map((r) => r.pattern.length)));
-    const baseWidth = 2 + idxWidth + 2 + 2 + riskWidth + 2 + 2 + patternWidth + 2;
+    const patternWidth = Math.min(20, Math.max('Pattern'.length, ...findings.map((f) => extractPatternLabel(f.decision).length)));
+    const sourceWidth = opts.includeSource ? Math.max('Source'.length, 5) : 0;
     const maxTableWidth = Math.max(60, Math.min(opts.columns || 80, 120));
+    const sepWidth = 2;
+    const baseWidth = 'File'.length + sepWidth + riskWidth + sepWidth + patternWidth + (opts.includeSource ? sepWidth + sourceWidth : 0);
     const fileWidth = Math.max(20, Math.min(50, maxTableWidth - baseWidth));
-    const top = `  ┌${'─'.repeat(idxWidth + 2)}┬${'─'.repeat(fileWidth + 2)}┬${'─'.repeat(riskWidth + 2)}┬${'─'.repeat(patternWidth + 2)}┐`;
-    const header = `  │ ${padRight('#', idxWidth)} │ ${padRight('File', fileWidth)} │ ${padRight('Risk', riskWidth)} │ ${padRight('Pattern', patternWidth)} │`;
-    const sep = `  ├${'─'.repeat(idxWidth + 2)}┼${'─'.repeat(fileWidth + 2)}┼${'─'.repeat(riskWidth + 2)}┼${'─'.repeat(patternWidth + 2)}┤`;
-    const lines = [top, header, sep];
-    for (const r of rows) {
-        const file = truncateToWidth(r.file, fileWidth);
-        const pattern = truncateToWidth(r.pattern, patternWidth);
-        lines.push(`  │ ${padRight(r.idx, idxWidth)} │ ${padRight(file, fileWidth)} │ ${padRightVisual(r.risk, riskWidth)} │ ${padRight(pattern, patternWidth)} │`);
-    }
-    const bottom = `  └${'─'.repeat(idxWidth + 2)}┴${'─'.repeat(fileWidth + 2)}┴${'─'.repeat(riskWidth + 2)}┴${'─'.repeat(patternWidth + 2)}┘`;
-    lines.push(bottom);
-    return lines;
+    const headers = opts.includeSource ? ['File', 'Risk', 'Pattern', 'Source'] : ['File', 'Risk', 'Pattern'];
+    const rows = findings.map((f) => {
+        const relative = f.filePath.startsWith(opts.cwd + '/') ? f.filePath.slice(opts.cwd.length + 1) : f.filePath;
+        const file = (0, format_1.truncateToWidth)(relative, fileWidth);
+        const label = extractPatternLabel(f.decision);
+        const patternPlain = (0, format_1.truncateToWidth)(label, patternWidth);
+        const pattern = `${opts.colors.dim}${patternPlain}${opts.colors.reset}`;
+        const riskValue = f.decision.risk.toFixed(2);
+        const riskPlain = (0, format_1.padLeft)(riskValue, riskWidth);
+        const risk = `${(0, format_1.riskColor)(f.decision.risk, opts.colors)}${riskPlain}${opts.colors.reset}`;
+        if (!opts.includeSource) {
+            return [file, risk, pattern];
+        }
+        const src = f.source === 'ai' ? `${opts.colors.olive}ai${opts.colors.reset}` : `${opts.colors.dim}rules${opts.colors.reset}`;
+        return [file, risk, pattern, src];
+    });
+    return (0, format_1.table)(headers, rows, opts.colors);
 }
 function isThreat(decision, policy) {
     const { riskThreshold, blockMinConfidence } = getThresholds(policy);
@@ -390,15 +342,34 @@ async function buildScanResult(params) {
 }
 async function runScan(options = {}) {
     const cwd = process.cwd();
+    const colors = (0, format_1.createColors)({ noColor: options.noColor });
     const policy = resolvePolicy(cwd, { policyPath: options.policyPath });
     const fix = options.fix === true;
+    console.log(`\n${(0, format_1.header)('scan', colors)}\n`);
     const aiEnabled = options.ai === true;
     let llmConfig = null;
     if (aiEnabled) {
-        const apiKey = process.env.OPENAI_API_KEY;
+        let apiKey = await (0, auth_1.loadOpenAiApiKey)();
         if (!apiKey) {
-            console.log('\n  Error: OPENAI_API_KEY environment variable is required for --ai mode.\n');
-            return 1;
+            const canPrompt = options.noPrompt !== true && process.stdout.isTTY === true && process.stdin.isTTY === true;
+            if (!canPrompt) {
+                console.log('  Error: OPENAI_API_KEY environment variable is required for --ai mode.\n');
+                return 1;
+            }
+            console.log('  No OpenAI API key found.\n');
+            console.log(`  ${colors.olive}Get one at https://platform.openai.com/api-keys${colors.reset}`);
+            console.log();
+            apiKey = await (0, auth_1.promptAndSaveOpenAiApiKey)();
+            if (!apiKey) {
+                console.log('\n  Error: API key is required for --ai mode.\n');
+                return 1;
+            }
+            const authPath = (0, auth_1.getAuthPath)();
+            const home = (0, node_os_1.homedir)();
+            const displayAuthPath = authPath === home ? '~' : authPath.startsWith(home + '/') ? `~/${authPath.slice(home.length + 1)}` : authPath;
+            console.log();
+            console.log(`${colors.dim}  Key saved to ${displayAuthPath}${colors.reset}`);
+            console.log();
         }
         llmConfig = { provider: 'openai', apiKey, model: 'gpt-4.1-mini' };
     }
@@ -412,17 +383,6 @@ async function runScan(options = {}) {
     const detectors = (0, core_1.createDetectors)({ policy, preferredDetectors: ['rules'] });
     const quarantineDir = process.env.SAPPERAI_QUARANTINE_DIR;
     const quarantineManager = quarantineDir ? new core_1.QuarantineManager({ quarantineDir }) : new core_1.QuarantineManager();
-    const isTTY = process.stdout.isTTY === true;
-    const color = isTTY;
-    const scopeLabel = options.scopeLabel ??
-        (options.system
-            ? 'AI system scan'
-            : deep
-                ? 'Current + subdirectories'
-                : 'Current directory only');
-    console.log('\n  SapperAI Security Scanner\n');
-    console.log(`  Scope: ${scopeLabel}`);
-    console.log();
     const fileSet = new Set();
     for (const target of targets) {
         const files = await collectFiles(target, deep);
@@ -431,139 +391,137 @@ async function runScan(options = {}) {
         }
     }
     const files = Array.from(fileSet).sort();
-    console.log(`  Collecting files...  ${files.length} files found`);
-    const eligibleByName = files.filter((f) => (0, core_1.isConfigLikeFile)(f)).length;
-    console.log(`  Filter: config-like only (${eligibleByName} eligible / ${files.length} total)`);
+    const eligibleFiles = files.filter((f) => (0, core_1.isConfigLikeFile)(f));
+    const eligibleByName = eligibleFiles.length;
+    const skippedNotEligible = Math.max(0, files.length - eligibleByName);
+    console.log(`${colors.dim}  Scanning ${eligibleByName} files...${colors.reset}`);
     console.log();
-    if (aiEnabled) {
-        console.log('  Phase 1/2: Rules scan');
-        console.log();
-    }
     const scannedFindings = [];
     let scannedFiles = 0;
-    let eligibleFiles = 0;
-    let skippedNotEligible = 0;
     let skippedEmptyOrUnreadable = 0;
-    const total = files.length;
-    const progressWidth = Math.max(10, Math.min(30, (process.stdout.columns ?? 80) - 30));
-    for (let i = 0; i < files.length; i += 1) {
-        const filePath = files[i];
-        if (isTTY && total > 0) {
-            const bar = renderProgressBar(i + 1, total, progressWidth);
-            const label = '  Scanning: ';
-            const maxPath = Math.max(10, (process.stdout.columns ?? 80) - stripAnsi(bar).length - label.length);
-            const scanning = `${label}${truncateToWidth(filePath, maxPath)}`;
-            if (i === 0) {
-                process.stdout.write(`${bar}\n${scanning}\n`);
+    const rulesProgress = (0, progress_1.createProgressBar)({
+        label: aiEnabled ? 'Phase 1 rules' : 'Scan',
+        total: eligibleFiles.length,
+        colors,
+    });
+    rulesProgress.start();
+    try {
+        for (const filePath of eligibleFiles) {
+            try {
+                const result = await scanFile(filePath, policy, scanner, detectors, fix, quarantineManager);
+                if (result.skipReason === 'empty_or_unreadable') {
+                    skippedEmptyOrUnreadable += 1;
+                    continue;
+                }
+                if (result.scanned && result.decision) {
+                    scannedFiles += 1;
+                    scannedFindings.push({
+                        filePath,
+                        decision: result.decision,
+                        quarantinedId: result.quarantinedId,
+                        source: aiEnabled ? 'rules' : undefined,
+                    });
+                }
             }
-            else {
-                process.stdout.write(`\x1b[2A\x1b[2K\r${bar}\n\x1b[2K\r${scanning}\n`);
+            finally {
+                rulesProgress.tick(filePath);
             }
         }
-        const result = await scanFile(filePath, policy, scanner, detectors, fix, quarantineManager);
-        if (result.skipReason === 'not_eligible') {
-            skippedNotEligible += 1;
-            continue;
-        }
-        eligibleFiles += 1;
-        if (result.skipReason === 'empty_or_unreadable') {
-            skippedEmptyOrUnreadable += 1;
-            continue;
-        }
-        if (result.scanned && result.decision) {
-            scannedFiles += 1;
-            scannedFindings.push({ filePath, decision: result.decision, quarantinedId: result.quarantinedId });
-        }
     }
-    if (isTTY && total > 0) {
-        process.stdout.write('\x1b[2A\x1b[2K\r\x1b[1B\x1b[2K\r');
+    finally {
+        rulesProgress.done();
     }
+    let aiTargetsCount = 0;
     if (aiEnabled && llmConfig) {
         const suspiciousFindings = scannedFindings.filter((f) => f.decision.risk >= 0.5);
         const maxAiFiles = 50;
         if (suspiciousFindings.length > 0) {
             const aiTargets = suspiciousFindings.slice(0, maxAiFiles);
-            if (suspiciousFindings.length > maxAiFiles) {
-                console.log(`  Note: AI scan limited to ${maxAiFiles} files (${suspiciousFindings.length} suspicious)`);
-            }
-            console.log();
-            console.log(`  Phase 2/2: AI deep scan (${aiTargets.length} files)`);
-            console.log();
+            aiTargetsCount = aiTargets.length;
             const detectorsList = (policy.detectors ?? ['rules']).slice();
             if (!detectorsList.includes('llm')) {
                 detectorsList.push('llm');
             }
             const aiPolicy = { ...policy, llm: llmConfig, detectors: detectorsList };
             const aiDetectors = (0, core_1.createDetectors)({ policy: aiPolicy, preferredDetectors: ['rules', 'llm'] });
-            for (let i = 0; i < aiTargets.length; i += 1) {
-                const finding = aiTargets[i];
-                if (isTTY) {
-                    const bar = renderProgressBar(i + 1, aiTargets.length, progressWidth);
-                    const label = '  Analyzing: ';
-                    const maxPath = Math.max(10, (process.stdout.columns ?? 80) - stripAnsi(bar).length - label.length);
-                    const scanning = `${label}${truncateToWidth(finding.filePath, maxPath)}`;
-                    if (i === 0) {
-                        process.stdout.write(`${bar}\n${scanning}\n`);
-                    }
-                    else {
-                        process.stdout.write(`\x1b[2A\x1b[2K\r${bar}\n\x1b[2K\r${scanning}\n`);
-                    }
-                }
-                try {
-                    const raw = await readFileIfPresent(finding.filePath);
-                    if (!raw)
-                        continue;
-                    const surface = (0, core_1.normalizeSurfaceText)(raw);
-                    const targetType = (0, core_1.classifyTargetType)(finding.filePath);
-                    const id = `${targetType}:${(0, core_1.buildEntryName)(finding.filePath)}`;
-                    const aiDecision = await scanner.scanTool(id, surface, aiPolicy, aiDetectors, {
-                        scanSource: 'file_surface',
-                        sourcePath: finding.filePath,
-                        sourceType: targetType,
-                    });
-                    const mergedReasons = uniq([...finding.decision.reasons, ...aiDecision.reasons]);
-                    const existingEvidence = finding.decision.evidence;
-                    const mergedEvidence = [...existingEvidence];
-                    for (const ev of aiDecision.evidence) {
-                        if (!mergedEvidence.some((e) => e.detectorId === ev.detectorId)) {
-                            mergedEvidence.push(ev);
+            const aiProgress = (0, progress_1.createProgressBar)({
+                label: 'Phase 2 ai',
+                total: aiTargets.length,
+                colors,
+            });
+            aiProgress.start();
+            try {
+                for (const finding of aiTargets) {
+                    try {
+                        const raw = await readFileIfPresent(finding.filePath);
+                        if (!raw)
+                            continue;
+                        const surface = (0, core_1.normalizeSurfaceText)(raw);
+                        const targetType = (0, core_1.classifyTargetType)(finding.filePath);
+                        const id = `${targetType}:${(0, core_1.buildEntryName)(finding.filePath)}`;
+                        const aiDecision = await scanner.scanTool(id, surface, aiPolicy, aiDetectors, {
+                            scanSource: 'file_surface',
+                            sourcePath: finding.filePath,
+                            sourceType: targetType,
+                        });
+                        const aiDominates = aiDecision.risk > finding.decision.risk;
+                        const mergedReasons = aiDominates
+                            ? uniq([...aiDecision.reasons, ...finding.decision.reasons])
+                            : uniq([...finding.decision.reasons, ...aiDecision.reasons]);
+                        const existingEvidence = finding.decision.evidence;
+                        const mergedEvidence = [...existingEvidence];
+                        for (const ev of aiDecision.evidence) {
+                            if (!mergedEvidence.some((e) => e.detectorId === ev.detectorId)) {
+                                mergedEvidence.push(ev);
+                            }
                         }
-                    }
-                    const nextDecision = {
-                        ...finding.decision,
-                        reasons: mergedReasons,
-                        evidence: mergedEvidence,
-                    };
-                    if (aiDecision.risk > finding.decision.risk) {
-                        finding.decision = {
-                            ...nextDecision,
-                            action: aiDecision.action,
-                            risk: aiDecision.risk,
-                            confidence: aiDecision.confidence,
+                        const nextDecision = {
+                            ...finding.decision,
+                            reasons: mergedReasons,
+                            evidence: mergedEvidence,
                         };
+                        if (aiDominates) {
+                            finding.source = 'ai';
+                            finding.decision = {
+                                ...nextDecision,
+                                action: aiDecision.action,
+                                risk: aiDecision.risk,
+                                confidence: aiDecision.confidence,
+                            };
+                        }
+                        else {
+                            finding.source = finding.source ?? 'rules';
+                            finding.decision = nextDecision;
+                        }
+                        finding.aiAnalysis =
+                            aiDecision.reasons.find((r) => !r.startsWith('Detected pattern:')) ?? null;
                     }
-                    else {
-                        finding.decision = nextDecision;
+                    catch {
+                    }
+                    finally {
+                        aiProgress.tick(finding.filePath);
                     }
-                    finding.aiAnalysis =
-                        aiDecision.reasons.find((r) => !r.startsWith('Detected pattern:')) ?? null;
-                }
-                catch {
                 }
             }
-            if (isTTY && aiTargets.length > 0) {
-                process.stdout.write('\x1b[2A\x1b[2K\r\x1b[1B\x1b[2K\r');
+            finally {
+                aiProgress.done();
             }
         }
     }
+    const scopeLabel = options.scopeLabel ??
+        (options.system
+            ? 'AI system scan'
+            : deep
+                ? 'Current + subdirectories'
+                : 'Current directory only');
     const skippedFiles = skippedNotEligible + skippedEmptyOrUnreadable;
     const threats = scannedFindings.filter((f) => isThreat(f.decision, policy));
     const scanResult = await buildScanResult({
         scope: scopeLabel,
         target: targets.join(', '),
         ai: aiEnabled,
-        totalFiles: total,
-        eligibleFiles,
+        totalFiles: files.length,
+        eligibleFiles: eligibleByName,
         scannedFiles,
         skippedFiles,
         skippedNotEligible,
@@ -581,8 +539,8 @@ async function runScan(options = {}) {
         const html = generateHtmlReport(scanResult);
         const htmlPath = (0, node_path_1.join)(scanDir, `${ts}.html`);
         await (0, promises_1.writeFile)(htmlPath, html, 'utf8');
-        console.log(`  Saved to ${jsonPath}`);
-        console.log(`  Report: ${htmlPath}`);
+        console.log(`${colors.dim}  Saved to ${jsonPath}${colors.reset}`);
+        console.log(`${colors.dim}  Report: ${htmlPath}${colors.reset}`);
         console.log();
         if (options.noOpen !== true) {
             try {
@@ -599,28 +557,33 @@ async function runScan(options = {}) {
             }
         }
     }
+    if (aiEnabled) {
+        const countWidth = Math.max(String(eligibleByName).length, String(aiTargetsCount).length);
+        const rulesName = `${colors.dim}rules${colors.reset}`;
+        const aiName = `${colors.olive}ai${colors.reset}`;
+        console.log(`  Phase 1  ${(0, format_1.padRightVisual)(rulesName, 5)}  ${(0, format_1.padLeft)(String(eligibleByName), countWidth)} files`);
+        console.log(`  Phase 2  ${(0, format_1.padRightVisual)(aiName, 5)}  ${(0, format_1.padLeft)(String(aiTargetsCount), countWidth)} files`);
+        console.log();
+    }
     if (threats.length === 0) {
-        const msg = `  ✓ All clear — ${scannedFiles}/${eligibleFiles} eligible files scanned, 0 threats detected (${total} total files)`;
-        console.log(color ? `${GREEN}${msg}${RESET}` : msg);
+        console.log(`  ${colors.olive}All clear — 0 threats in ${eligibleByName} files${colors.reset}`);
         console.log();
+        return 0;
+    }
+    console.log(renderFindingsTable(threats, {
+        cwd,
+        columns: process.stdout.columns ?? 80,
+        colors,
+        includeSource: aiEnabled,
+    }));
+    console.log();
+    console.log(`  ${threats.length} threats found in ${eligibleByName} files (${files.length} total)`);
+    console.log();
+    if (!fix) {
+        console.log('  Run npx sapper-ai scan --fix to quarantine.\n');
     }
     else {
-        const warn = `  ⚠ ${scannedFiles}/${eligibleFiles} eligible files scanned, ${threats.length} threats detected (${total} total files)`;
-        console.log(color ? `${RED}${warn}${RESET}` : warn);
         console.log();
-        const tableLines = renderFindingsTable(threats, {
-            cwd,
-            columns: process.stdout.columns ?? 80,
-            color,
-        });
-        for (const line of tableLines) {
-            console.log(line);
-        }
-        console.log();
-        if (!fix) {
-            console.log("  Run 'npx sapper-ai scan --fix' to quarantine blocked files.");
-            console.log();
-        }
     }
-    return threats.length > 0 ? 1 : 0;
+    return 1;
 }

package/dist/utils/format.d.ts

@@ -0,0 +1,22 @@
+export interface Colors {
+    olive: string;
+    dim: string;
+    bold: string;
+    red: string;
+    yellow: string;
+    reset: string;
+}
+export declare function createColors(options?: {
+    noColor?: boolean;
+    env?: NodeJS.ProcessEnv;
+    stdoutIsTTY?: boolean;
+}): Colors;
+export declare function header(command: string, colors: Colors): string;
+export declare function riskColor(risk: number, colors: Colors): string;
+export declare function stripAnsi(text: string): string;
+export declare function truncateToWidth(text: string, maxWidth: number): string;
+export declare function padRight(text: string, width: number): string;
+export declare function padRightVisual(text: string, width: number): string;
+export declare function padLeft(text: string, width: number): string;
+export declare function table(headers: string[], rows: string[][], colors: Colors): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/utils/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/utils/format.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAQD,wBAAgB,YAAY,CAC1B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAClF,MAAM,CAkBR;AAGD,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG9D;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAStE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG3D;AAID,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsBjF"}

package/dist/utils/format.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createColors = createColors;
+exports.header = header;
+exports.riskColor = riskColor;
+exports.stripAnsi = stripAnsi;
+exports.truncateToWidth = truncateToWidth;
+exports.padRight = padRight;
+exports.padRightVisual = padRightVisual;
+exports.padLeft = padLeft;
+exports.table = table;
+function supportsTruecolor(env) {
+    const value = env.COLORTERM?.toLowerCase();
+    if (!value)
+        return false;
+    return value.includes('truecolor') || value.includes('24bit');
+}
+function createColors(options = {}) {
+    const env = options.env ?? process.env;
+    const stdoutIsTTY = options.stdoutIsTTY ?? process.stdout.isTTY;
+    const disabled = env.NO_COLOR !== undefined || options.noColor === true || stdoutIsTTY !== true;
+    if (disabled) {
+        return { olive: '', dim: '', bold: '', red: '', yellow: '', reset: '' };
+    }
+    const olive = supportsTruecolor(env) ? '\x1b[38;2;107;142;35m' : '\x1b[32m';
+    return {
+        olive,
+        dim: '\x1b[2m',
+        bold: '\x1b[1m',
+        red: '\x1b[31m',
+        yellow: '\x1b[33m',
+        reset: '\x1b[0m',
+    };
+}
+// Header: "  sapper-ai <command>"
+function header(command, colors) {
+    const name = colors.olive ? `${colors.olive}sapper-ai${colors.reset}` : 'sapper-ai';
+    return `  ${name} ${command}`;
+}
+// Risk color by value (>= 0.8 red+bold, 0.5~0.8 yellow, < 0.5 dim)
+function riskColor(risk, colors) {
+    if (risk >= 0.8)
+        return `${colors.bold}${colors.red}`;
+    if (risk >= 0.5)
+        return colors.yellow;
+    return colors.dim;
+}
+function stripAnsi(text) {
+    return text.replace(/\x1b\[[0-9;]*m/g, '');
+}
+function truncateToWidth(text, maxWidth) {
+    if (maxWidth <= 0)
+        return '';
+    if (text.length <= maxWidth)
+        return text;
+    if (maxWidth <= 3) {
+        return '.'.repeat(maxWidth);
+    }
+    return `...${text.slice(text.length - (maxWidth - 3))}`;
+}
+function padRight(text, width) {
+    if (text.length >= width)
+        return text;
+    return text + ' '.repeat(width - text.length);
+}
+function padRightVisual(text, width) {
+    const visLen = stripAnsi(text).length;
+    if (visLen >= width)
+        return text;
+    return text + ' '.repeat(width - visLen);
+}
+function padLeft(text, width) {
+    if (text.length >= width)
+        return text;
+    return ' '.repeat(width - text.length) + text;
+}
+// Aligned table (Vercel style, no box borders).
+// ANSI-aware: stripAnsi based visible width.
+function table(headers, rows, colors) {
+    const columnCount = headers.length;
+    const normalizedRows = rows.map((row) => {
+        const out = row.slice(0, columnCount);
+        while (out.length < columnCount)
+            out.push('');
+        return out;
+    });
+    const headerRow = headers.map((h) => (colors.dim ? `${colors.dim}${h}${colors.reset}` : h));
+    const all = [headerRow, ...normalizedRows];
+    const widths = headers.map((_, col) => Math.max(0, ...all.map((r) => stripAnsi(r[col] ?? '').length)));
+    const sep = '  ';
+    const lines = [];
+    lines.push(`  ${headerRow.map((cell, i) => padRightVisual(cell, widths[i])).join(sep)}`.trimEnd());
+    for (const row of normalizedRows) {
+        lines.push(`  ${row.map((cell, i) => padRightVisual(cell, widths[i])).join(sep)}`.trimEnd());
+    }
+    return lines.join('\n');
+}

package/dist/utils/fs.d.ts

@@ -1,5 +1,7 @@
 export declare function readFileIfExists(filePath: string): Promise<string | null>;
 export declare function ensureDir(dirPath: string): Promise<void>;
 export declare function backupFile(originalPath: string): Promise<string>;
-export declare function atomicWriteFile(filePath: string, content: string): Promise<void>;
+export declare function atomicWriteFile(filePath: string, content: string, options?: {
+    mode?: number;
+}): Promise<void>;
 //# sourceMappingURL=fs.d.ts.map

package/dist/utils/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM/E;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAkBD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAStF"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAIA,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAM/E;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAkBD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKtE;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/utils/fs.js

@@ -37,11 +37,11 @@ async function backupFile(originalPath) {
     await (0, promises_1.copyFile)(originalPath, backupPath);
     return backupPath;
 }
-async function atomicWriteFile(filePath, content) {
+async function atomicWriteFile(filePath, content, options = {}) {
     const dir = (0, node_path_1.dirname)(filePath);
     await ensureDir(dir);
     const tmpName = `.${(0, node_path_1.basename)(filePath)}.tmp.${process.pid}.${Date.now()}`;
     const tmpPath = (0, node_path_1.join)(dir, tmpName);
-    await (0, promises_1.writeFile)(tmpPath, content, 'utf8');
+    await (0, promises_1.writeFile)(tmpPath, content, { encoding: 'utf8', mode: options.mode });
     await (0, promises_1.rename)(tmpPath, filePath);
 }

package/dist/utils/progress.d.ts

@@ -0,0 +1,40 @@
+import type { Colors } from './format';
+export interface ProgressStream {
+    isTTY?: boolean;
+    columns?: number;
+    write(text: string): boolean;
+}
+export interface ProgressBarOptions {
+    label: string;
+    total: number;
+    colors: Colors;
+    stream?: ProgressStream;
+    now?: () => number;
+    minIntervalMs?: number;
+    minBarWidth?: number;
+    maxBarWidth?: number;
+}
+export declare class ProgressBar {
+    private readonly options;
+    private readonly stream;
+    private readonly now;
+    private readonly minIntervalMs;
+    private readonly minBarWidth;
+    private readonly maxBarWidth;
+    private readonly enabled;
+    private current;
+    private detail;
+    private lastRenderAt;
+    private rendered;
+    private finished;
+    constructor(options: ProgressBarOptions);
+    start(detail?: string): void;
+    tick(detail?: string): void;
+    done(detail?: string): void;
+    private render;
+    private isComplete;
+    private renderLine;
+    private renderBar;
+}
+export declare function createProgressBar(options: ProgressBarOptions): ProgressBar;
+//# sourceMappingURL=progress.d.ts.map

package/dist/utils/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/utils/progress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAGtC,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAUD,qBAAa,WAAW;IAaV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAZpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,OAAO,CAAI;IACnB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAQ;gBAEK,OAAO,EAAE,kBAAkB;IASxD,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAM5B,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAU3B,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAW3B,OAAO,CAAC,MAAM;IAYd,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,UAAU;IA4BlB,OAAO,CAAC,SAAS;CAoBlB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE1E"}

package/dist/utils/progress.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProgressBar = void 0;
+exports.createProgressBar = createProgressBar;
+const format_1 = require("./format");
+const DEFAULT_MIN_INTERVAL_MS = 100;
+const DEFAULT_MIN_BAR_WIDTH = 10;
+const DEFAULT_MAX_BAR_WIDTH = 40;
+function clamp(value, min, max) {
+    return Math.min(max, Math.max(min, value));
+}
+class ProgressBar {
+    constructor(options) {
+        this.options = options;
+        this.current = 0;
+        this.lastRenderAt = 0;
+        this.rendered = false;
+        this.finished = false;
+        this.stream = options.stream ?? process.stdout;
+        this.now = options.now ?? Date.now;
+        this.minIntervalMs = options.minIntervalMs ?? DEFAULT_MIN_INTERVAL_MS;
+        this.minBarWidth = options.minBarWidth ?? DEFAULT_MIN_BAR_WIDTH;
+        this.maxBarWidth = options.maxBarWidth ?? DEFAULT_MAX_BAR_WIDTH;
+        this.enabled = this.stream.isTTY === true;
+    }
+    start(detail) {
+        if (!this.enabled)
+            return;
+        this.detail = detail;
+        this.render(true);
+    }
+    tick(detail) {
+        if (!this.enabled || this.finished)
+            return;
+        this.current += 1;
+        if (this.options.total > 0 && this.current > this.options.total) {
+            this.current = this.options.total;
+        }
+        this.detail = detail;
+        this.render(false);
+    }
+    done(detail) {
+        if (!this.enabled || this.finished)
+            return;
+        if (this.options.total > 0) {
+            this.current = this.options.total;
+        }
+        this.detail = detail;
+        this.render(true);
+        this.stream.write('\n');
+        this.finished = true;
+    }
+    render(force) {
+        const now = this.now();
+        if (!force && this.rendered && now - this.lastRenderAt < this.minIntervalMs && !this.isComplete()) {
+            return;
+        }
+        const line = this.renderLine();
+        this.stream.write(`\r\x1b[2K${line}`);
+        this.lastRenderAt = now;
+        this.rendered = true;
+    }
+    isComplete() {
+        if (this.options.total <= 0) {
+            return true;
+        }
+        return this.current >= this.options.total;
+    }
+    renderLine() {
+        const total = this.options.total;
+        const safeCurrent = total > 0 ? clamp(this.current, 0, total) : 0;
+        const ratio = total > 0 ? safeCurrent / total : 1;
+        const percent = Math.round(ratio * 100);
+        const countText = `${safeCurrent}/${total}`;
+        const percentText = `${String(percent).padStart(3, ' ')}%`;
+        const suffix = `${countText} ${percentText}`;
+        const columns = this.stream.columns ?? 80;
+        const label = this.options.label;
+        const baseReserved = 2 + label.length + 1 + 2 + 2 + 1 + suffix.length;
+        const maxFitWidth = Math.max(1, columns - baseReserved);
+        const availableForBar = maxFitWidth >= this.minBarWidth ? Math.min(this.maxBarWidth, maxFitWidth) : maxFitWidth;
+        const bar = this.renderBar(availableForBar, ratio);
+        const detailPrefix = '  ';
+        const detailMaxWidth = Math.max(0, columns - (2 + label.length + 1 + 2 + availableForBar + 2 + suffix.length + detailPrefix.length));
+        const rawDetail = this.detail ? (0, format_1.truncateToWidth)(this.detail, detailMaxWidth) : '';
+        const detail = rawDetail
+            ? `${detailPrefix}${this.options.colors.dim}${rawDetail}${this.options.colors.reset}`
+            : '';
+        return `  ${label} [${bar}] ${suffix}${detail}`;
+    }
+    renderBar(width, ratio) {
+        if (width <= 0)
+            return '';
+        const safeRatio = clamp(ratio, 0, 1);
+        const filled = Math.floor(safeRatio * width);
+        if (filled >= width) {
+            const body = '='.repeat(width);
+            return this.options.colors.olive ? `${this.options.colors.olive}${body}${this.options.colors.reset}` : body;
+        }
+        const visibleFilled = Math.max(1, filled);
+        const leadCount = Math.max(0, visibleFilled - 1);
+        const lead = '='.repeat(leadCount);
+        const head = '>';
+        const tail = '-'.repeat(Math.max(0, width - visibleFilled));
+        const filledPart = this.options.colors.olive ? `${this.options.colors.olive}${lead}${head}${this.options.colors.reset}` : `${lead}${head}`;
+        const emptyPart = this.options.colors.dim ? `${this.options.colors.dim}${tail}${this.options.colors.reset}` : tail;
+        return `${filledPart}${emptyPart}`;
+    }
+}
+exports.ProgressBar = ProgressBar;
+function createProgressBar(options) {
+    return new ProgressBar(options);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sapper-ai",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "AI security guardrails - single install, sensible defaults",
   "keywords": [
     "security",
@@ -39,19 +39,12 @@
     "access": "public"
   },
   "dependencies": {
+    "@inquirer/password": "^4.0.0",
     "@inquirer/select": "^4.0.0",
     "@sapper-ai/core": "0.2.2",
-    "@sapper-ai/mcp": "0.3.0",
+    "@sapper-ai/mcp": "0.3.1",
     "@sapper-ai/types": "0.2.1"
   },
-  "peerDependencies": {
-    "@sapper-ai/openai": "^0.2.2"
-  },
-  "peerDependenciesMeta": {
-    "@sapper-ai/openai": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@types/node": "^20.0.0",
     "typescript": "^5.3.0",