fix: CLI setup-command/color UX and harden save-deliverable path handling

[jeypzz]

Summary

A small batch of correctness/UX fixes found while reading through the CLI and worker code.

CLI / UX

1. Invalid command in config error — the invalid-config error path told users to run shn setup, but the published binary is shannon (see apps/cli/package.json bin); there is no shn command. It now matches the sibling parse-error message in the same file (npx @keygraph/shannon setup).

2. Splash ignored NO_COLOR / non-TTY — displaySplash always emitted raw ANSI color codes, so escape sequences leaked into piped/redirected output and the NO_COLOR convention was ignored. Color is now gated behind a shouldUseColor() check (NO_COLOR disables, FORCE_COLOR forces, otherwise TTY-only). The box-drawing glyphs are unaffected, so the logo still renders in monochrome.

Worker

3. Broken path-traversal guard in save-deliverable — the check used resolved.startsWith(${cwd}/) with a hardcoded / separator and a brittle string-prefix match. On Windows resolve() returns backslash paths, so legitimate paths were rejected as traversal attempts, and the prefix match could false-trigger on sibling directories. Replaced with a path.relative()-based check (separator-correct, no prefix aliasing).

4. Duplicated path logic — the same script rebuilt the deliverables directory inline with the same subdir.split('/') logic and a hardcoded default string that already lives in deliverablesDir() / DEFAULT_DELIVERABLES_SUBDIR in paths.ts (used by every other call site). It now reuses the shared helper, which also removes a local variable that shadowed it.

Testing

• tsc --noEmit passes for both packages (turbo run check).
• biome lint is clean on all changed files.
• The new traversal logic was verified against inside / parent / absolute path cases.

[ezl-keygraph]

Hi @jeypzz, thanks for reporting these.

Both CLI/UX fixes have since been resolved independently:

• shn setup in the config error: fixed in docs: rename shn command references to npx @keygraph/shannon #375, which renamed the stale shn references to npx @keygraph/shannon.
• Splash ignoring NO_COLOR / non-TTY: fixed in feat(cli): restructure run folder and improve terminal UX #384, which gates splash color behind a supportsColor() check.

On save-deliverable: we are planning to remove it in an upcoming update.

Closing this out, appreciate the work.