ship-safe 9.2.1 → 9.2.2

package/cli/.ship-safe/history.json

@@ -0,0 +1,190 @@
+[
+  {
+    "timestamp": "2026-04-24T05:18:07.805Z",
+    "score": 13,
+    "grade": "F",
+    "totalFindings": 533,
+    "totalDepVulns": 0,
+    "categoryScores": {
+      "secrets": {
+        "deduction": 15,
+        "counts": {
+          "critical": 5,
+          "high": 0,
+          "medium": 2,
+          "low": 0
+        }
+      },
+      "injection": {
+        "deduction": 15,
+        "counts": {
+          "critical": 24,
+          "high": 47,
+          "medium": 22,
+          "low": 0
+        }
+      },
+      "deps": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "auth": {
+        "deduction": 15,
+        "counts": {
+          "critical": 5,
+          "high": 18,
+          "medium": 10,
+          "low": 0
+        }
+      },
+      "config": {
+        "deduction": 8,
+        "counts": {
+          "critical": 3,
+          "high": 16,
+          "medium": 12,
+          "low": 2
+        }
+      },
+      "supply-chain": {
+        "deduction": 12,
+        "counts": {
+          "critical": 3,
+          "high": 4,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "api": {
+        "deduction": 10,
+        "counts": {
+          "critical": 3,
+          "high": 21,
+          "medium": 5,
+          "low": 6
+        }
+      },
+      "llm": {
+        "deduction": 12,
+        "counts": {
+          "critical": 23,
+          "high": 178,
+          "medium": 124,
+          "low": 0
+        }
+      }
+    },
+    "suppressions": {
+      "total": 94,
+      "rules": {
+        "suppression": 1,
+        "_unspecified": 78,
+        "annotations": 2,
+        "on": 4,
+        "comments": 1,
+        "RULE_NAME": 1,
+        "comment": 5,
+        "as": 2
+      }
+    }
+  },
+  {
+    "timestamp": "2026-04-25T19:29:18.418Z",
+    "score": 13,
+    "grade": "F",
+    "totalFindings": 541,
+    "totalDepVulns": 0,
+    "categoryScores": {
+      "secrets": {
+        "deduction": 15,
+        "counts": {
+          "critical": 6,
+          "high": 0,
+          "medium": 2,
+          "low": 0
+        }
+      },
+      "injection": {
+        "deduction": 15,
+        "counts": {
+          "critical": 24,
+          "high": 47,
+          "medium": 22,
+          "low": 0
+        }
+      },
+      "deps": {
+        "deduction": 0,
+        "counts": {
+          "critical": 0,
+          "high": 0,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "auth": {
+        "deduction": 15,
+        "counts": {
+          "critical": 5,
+          "high": 18,
+          "medium": 10,
+          "low": 0
+        }
+      },
+      "config": {
+        "deduction": 8,
+        "counts": {
+          "critical": 3,
+          "high": 16,
+          "medium": 12,
+          "low": 2
+        }
+      },
+      "supply-chain": {
+        "deduction": 12,
+        "counts": {
+          "critical": 3,
+          "high": 4,
+          "medium": 0,
+          "low": 0
+        }
+      },
+      "api": {
+        "deduction": 10,
+        "counts": {
+          "critical": 3,
+          "high": 21,
+          "medium": 5,
+          "low": 6
+        }
+      },
+      "llm": {
+        "deduction": 12,
+        "counts": {
+          "critical": 23,
+          "high": 165,
+          "medium": 144,
+          "low": 0
+        }
+      }
+    },
+    "suppressions": {
+      "total": 94,
+      "rules": {
+        "_unspecified": 78,
+        "suppression": 1,
+        "annotations": 2,
+        "on": 4,
+        "comments": 1,
+        "RULE_NAME": 1,
+        "comment": 5,
+        "as": 2
+      }
+    }
+  }
+]

package/cli/commands/audit.js

@@ -327,7 +327,7 @@ export async function auditCommand(targetPath = '.', options = {}) {
   );
 
   // ── AI Classification (optional, with LLM cache) ───────────────────────
-  if (options.ai !== false) {
+  if (options.ai !== false && !options.noAi) {
     const provider = autoDetectProvider(absolutePath, {
       provider:   options.provider,
       baseUrl:    options.baseUrl,

package/cli/commands/shell.js

@@ -292,13 +292,16 @@ async function handleSlashCommand(line, state, options) {
     case 'agent':
     case 'fix': {
       // Hand off to agent command. Pass through caller options + any inline flags.
+      // Forward the active provider key so /provider switches take effect.
       const opts = { ...options };
+      if (state.providerKey) opts.provider = state.providerKey;
       for (const a of args) {
         if (a === '--plan-only')   opts.planOnly = true;
         if (a === '--allow-dirty') opts.allowDirty = true;
         if (a === '--branch')      opts.branch = true;
         if (a === '--pr')          opts.pr = true;
         if (a.startsWith('--severity=')) opts.severity = a.slice('--severity='.length);
+        if (a.startsWith('--provider=')) opts.provider = a.slice('--provider='.length);
       }
       try {
         await agentFixCommand(state.root, opts);
@@ -328,7 +331,8 @@ async function handleSlashCommand(line, state, options) {
       if (!next) {
         console.log(chalk.yellow(`  Could not load provider "${name}" — is the API key set?`));
       } else {
-        state.provider = next;
+        state.provider    = next;
+        state.providerKey = name;   // keep the string so /agent can forward it
         console.log(chalk.green(`  Provider switched to ${next.name}.`));
       }
       return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ship-safe",
-  "version": "9.2.1",
+  "version": "9.2.2",
   "description": "AI-powered multi-agent security platform. 23 agents scan 80+ attack classes including AI integration supply chain (Vercel-class attacks), Hermes Agent deployments (ASI-01–ASI-10), tool registry poisoning, function-call injection, skill permission drift, and agent attestation. Ship Safe × Hermes Agent.",
   "main": "cli/index.js",
   "bin": {