ship-safe 9.2.0 → 9.2.1

package/cli/bin/ship-safe.js

@@ -663,7 +663,9 @@ How it works:
 // No command + interactive TTY → drop into the REPL.
 // Help banner is still available via `--help` and shown when stdin is piped.
 if (process.argv.length === 2 && process.stdin.isTTY) {
-  shellCommand('.', {});
+  // Await shell before exiting; do NOT fall through to program.parse() or it
+  // will print the help banner concurrently with the REPL banner.
+  shellCommand('.', {}).then(() => process.exit(0)).catch(() => process.exit(1));
 } else if (process.argv.length === 2) {
   console.log(banner);
   console.log(chalk.yellow('\nQuick start:\n'));
@@ -707,6 +709,6 @@ if (process.argv.length === 2 && process.stdin.isTTY) {
   console.log(chalk.white('\n  npx ship-safe --help        ') + chalk.gray('# Show all options'));
   console.log();
   process.exit(0);
+} else {
+  program.parse();
 }
-
-program.parse();

package/cli/commands/shell.js

@@ -20,7 +20,9 @@
 
 import { createInterface } from 'readline';
 import { execFileSync, spawnSync } from 'child_process';
+import { readFileSync as fsReadFileSync } from 'fs';
 import path from 'path';
+import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import ora from 'ora';
 import { autoDetectProvider } from '../providers/llm-provider.js';
@@ -31,6 +33,84 @@ import * as output from '../utils/output.js';
 
 const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
+// Read version from package.json so the banner stays in sync with releases.
+const PKG_VERSION = (() => {
+  try {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const pkg  = JSON.parse(fsReadFileSync(path.join(here, '..', '..', 'package.json'), 'utf8'));
+    return pkg.version;
+  } catch { return ''; }
+})();
+
+const BANNER_LINES = [
+  '  ███████╗██╗  ██╗██╗██████╗     ███████╗ █████╗ ███████╗███████╗',
+  '  ██╔════╝██║  ██║██║██╔══██╗    ██╔════╝██╔══██╗██╔════╝██╔════╝',
+  '  ███████╗███████║██║██████╔╝    ███████╗███████║█████╗  █████╗  ',
+  '  ╚════██║██╔══██║██║██╔═══╝     ╚════██║██╔══██║██╔══╝  ██╔══╝  ',
+  '  ███████║██║  ██║██║██║         ███████║██║  ██║██║     ███████╗',
+  '  ╚══════╝╚═╝  ╚═╝╚═╝╚═╝         ╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝',
+];
+
+// Characters drawn from the same box-drawing + block set the banner uses,
+// so random frames look plausibly related rather than pure noise.
+const GLITCH_CHARS = '█▓▒░╔╗╚╝╠╣╦╩╬═║┼┤├┬┴┐└┘┌─│╱╲╳';
+
+function glitchFrame(line, reveal) {
+  // `reveal` is 0.0..1.0 — characters left of the reveal frontier are real,
+  // everything to the right is randomised from the glitch set.
+  return line.split('').map((ch, i) => {
+    const pos = i / line.length;
+    if (pos < reveal || ch === ' ') return ch;
+    return GLITCH_CHARS[Math.floor(Math.random() * GLITCH_CHARS.length)];
+  }).join('');
+}
+
+function sleep(ms) {
+  return new Promise(r => setTimeout(r, ms));
+}
+
+async function shipSafeBannerAnimated() {
+  const cols   = process.stdout.columns;
+  const narrow = typeof cols === 'number' && cols > 0 && cols < 70;
+  if (narrow) {
+    console.log(chalk.cyan.bold('  S H I P   S A F E'));
+    return;
+  }
+
+  const lines = BANNER_LINES;
+  const FRAMES    = 8;   // glitch passes before the line locks in
+  const FRAME_MS  = 18;  // ms between frames within a line
+  const LINE_MS   = 28;  // ms between lines starting
+
+  // Print an empty placeholder so we know exactly where each line lives.
+  // We'll overwrite them in-place using cursor-up escape codes.
+  process.stdout.write('\n');
+  for (const line of lines) {
+    process.stdout.write(' '.repeat(line.length) + '\n');
+  }
+  process.stdout.write('\n');
+
+  for (let li = 0; li < lines.length; li++) {
+    const line = lines[li];
+    // Move cursor up to this line's row (from the blank line after the banner).
+    const stepsUp = lines.length - li + 1;
+    process.stdout.write(`\x1B[${stepsUp}A`); // cursor up N
+
+    // Animate: reveal marches from 0 → 1 across FRAMES frames.
+    for (let f = 0; f <= FRAMES; f++) {
+      const reveal = f / FRAMES;
+      const scrambled = glitchFrame(line, reveal);
+      process.stdout.write('\r' + chalk.cyan(scrambled));
+      if (f < FRAMES) await sleep(FRAME_MS);
+    }
+
+    // Write the final clean line and move back down to the bottom blank line.
+    process.stdout.write('\r' + chalk.cyan(line));
+    process.stdout.write(`\x1B[${stepsUp}B`); // cursor down N
+    await sleep(LINE_MS);
+  }
+}
+
 export async function shellCommand(targetPath = '.', options = {}) {
   const root = path.resolve(targetPath);
 
@@ -49,13 +129,18 @@ export async function shellCommand(targetPath = '.', options = {}) {
     think:    options.think || false,
   });
 
+  // Branded entry: big wordmark, version + provider + cwd, then a CTA hint.
+  // Modeled on Claude Code / Gemini CLI / Aider — establish the tool's identity
+  // in the first second, then get out of the way.
   console.log();
-  output.header('Ship Safe — Interactive Shell');
-  console.log(chalk.gray(`  cwd:      ${root}`));
-  console.log(chalk.gray(`  provider: ${state.provider ? chalk.cyan(state.provider.name) : chalk.yellow('none — set DEEPSEEK_API_KEY or similar')}`));
+  await shipSafeBannerAnimated();
+  // trailing blank line is already written by the animation loop
+  const ver  = PKG_VERSION ? `v${PKG_VERSION}` : '';
+  const prov = state.provider ? chalk.cyan(state.provider.name) : chalk.yellow('no provider');
+  const cwd  = chalk.gray(prettyCwd(root));
+  console.log(`  ${chalk.bold(ver)}  ${chalk.gray('·')}  ${prov}  ${chalk.gray('·')}  ${cwd}`);
   console.log();
-  console.log(chalk.gray('  Type /help for commands, anything else to ask the agent.'));
-  console.log(chalk.gray('  /quit or Ctrl-D to exit.'));
+  console.log(chalk.gray('  /scan to find issues  ·  /agent to fix them  ·  /help for more'));
   console.log();
 
   const rl = createInterface({
@@ -407,6 +492,12 @@ function sevTag(sev) {
   }
 }
 
+function prettyCwd(p) {
+  const home = process.env.HOME || '';
+  if (home && p.startsWith(home + '/')) return '~' + p.slice(home.length);
+  return p;
+}
+
 function gradeColor(score) {
   if (score == null) return chalk.gray;
   if (score >= 80) return chalk.green;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ship-safe",
-  "version": "9.2.0",
+  "version": "9.2.1",
   "description": "AI-powered multi-agent security platform. 23 agents scan 80+ attack classes including AI integration supply chain (Vercel-class attacks), Hermes Agent deployments (ASI-01–ASI-10), tool registry poisoning, function-call injection, skill permission drift, and agent attestation. Ship Safe × Hermes Agent.",
   "main": "cli/index.js",
   "bin": {