ikanban 0.2.1 → 0.3.0

package/README.md

@@ -7,8 +7,22 @@ results into [iKanban](https://i-kanban.com).
 npx ikanban secscan                 # dependencies, committed secrets, risky file permissions
 npx ikanban aiscan --help           # red-team scan of your AI app (OWASP LLM Top 10)
 npx ikanban secscan --publish       # also file the report and findings into iKanban
+npx ikanban roadmap sync plan.json  # make the Roadmap plan match the plan file
+npx ikanban hooks install           # sync plan files on every agent write and git push
 ```
 
+## Roadmap follows the plan file
+
+A plan file is a JSON file with a top-level `roadmap` block (`team`, `project`, and `plan_id`
+after the first sync) and `phases`, each with an `id`, `title`, `status`, `depends_on` and
+`tasks` (`id`, `description`, `status`). `ikanban roadmap sync` sends it to iKanban, which
+creates or updates the plan's phases and tasks, matched by id. `--check` changes nothing and
+exits 1 when the Roadmap differs. With no file it syncs every tracked plan file.
+
+`ikanban hooks install` adds a git `pre-push` hook (any git host, never blocks a push) and an
+agent hook for Claude Code, Gemini CLI and Copilot CLI (`.iKanban/hooks/roadmap-sync.js`).
+No CI is needed.
+
 ## What you need
 
 - Node.js 18 or newer.

package/bin/ikanban.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-// ikanban: one CLI for iKanban. Each command runs a bundled Python scanner.
+// ikanban: one CLI for iKanban. The scan commands run a bundled Python scanner;
+// roadmap and hooks keep the Roadmap in step with a plan file (lib/roadmap.js).
 // Scans run free on your machine; only --publish talks to iKanban, and the
 // server checks your plan there (a 402 means the plan, not the scan).
-const { spawnSync } = require("node:child_process");
 const path = require("node:path");
+const { runCommand } = require("../lib/ikanban-safe.js");
 const { version } = require("../package.json");
 
 const COMMANDS = {
@@ -19,6 +20,10 @@ Usage: ikanban <command> [options]
 
 Commands:
 ${lines.join("\n")}
+  roadmap  Keep a Roadmap plan in step with its plan file: roadmap sync [plan.json] [--check]
+  hooks    Install the hooks that run that sync on every agent write and git push
+
+  pipeline Report a task's stage and stream its log to iKanban (any CI)
 
 Run "ikanban <command> --help" for its options. Add --publish to file the
 results into iKanban (needs an API token; the server checks your plan).
@@ -31,7 +36,7 @@ function findPython() {
     ? [["py", ["-3"]], ["python", []], ["python3", []]]
     : [["python3", []], ["python", []]];
   for (const [cmd, pre] of candidates) {
-    const r = spawnSync(cmd, [...pre, "-c", "import sys; sys.exit(0 if sys.version_info >= (3, 9) else 1)"]);
+    const r = runCommand(cmd, [...pre, "-c", "import sys; sys.exit(0 if sys.version_info >= (3, 9) else 1)"]);
     if (r.status === 0) return [cmd, pre];
   }
   return null;
@@ -46,6 +51,21 @@ if (cmd === "--version" || cmd === "-v") {
   console.log(version);
   process.exit(0);
 }
+if (cmd === "roadmap" || cmd === "hooks") {
+  require("../lib/roadmap.js").run(cmd, args).then((code) => process.exit(code), (e) => {
+    console.error(`ikanban: ${e.message}`);
+    process.exit(1);
+  });
+  return;
+}
+// Plan 21 F10: report a task's pipeline stages and stream their logs, from any CI.
+if (cmd === "pipeline") {
+  require("../lib/pipeline.js").run(args).then((code) => process.exit(code), (e) => {
+    console.error(`ikanban pipeline: ${e.message}`);
+    process.exit(1);
+  });
+  return;
+}
 const command = COMMANDS[cmd];
 if (!command) {
   console.error(`ikanban: unknown command "${cmd}". Run "ikanban --help".`);
@@ -60,5 +80,5 @@ const [py, pre] = python;
 const script = path.join(__dirname, "..", "scanners", command.file);
 // Windows consoles default to cp1252, which lacks characters the reports print.
 const env = { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" };
-const r = spawnSync(py, [...pre, script, ...args], { stdio: "inherit", env });
+const r = runCommand(py, [...pre, script, ...args], { stdio: "inherit", env });
 process.exit(r.status === null ? 1 : r.status);

package/hooks/ikanban-safe.js

@@ -0,0 +1,96 @@
+// iKanban: the two safe ways for a hook or the CLI to touch the outside world.
+//   runCommand(file, args, opts)  runs one program with an argument list, never a shell,
+//                                 so a file name, branch or plan text stays one argument.
+//   startCommand(file, args, opts) the same rule, but returns the running child (spawn), for
+//                                 output that has to stream while the program runs.
+//   ikanbanFetch(path, opts)      calls iKanban's API with your key. The key goes only to
+//                                 iKanban's API (or this machine), never on a redirect,
+//                                 and is never printed.
+// The `ikanban` npm package carries a copy (vibe-cli/lib/); this file is the source.
+const path = require("node:path");
+const { spawn, spawnSync } = require("node:child_process");
+
+const API_ORIGINS = new Set(["https://api.i-kanban.com", "https://dev-api.i-kanban.com"]);
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "[::1]"]);
+
+/** The checks both runners share: one program, a list of string arguments, no shell. */
+function checkCommand(name, file, args, opts) {
+  if (opts.shell) throw new Error(`${name} never runs a shell; pass each value as its own argument`);
+  if (typeof file !== "string" || !file || (/\s/.test(file) && !path.isAbsolute(file))) {
+    throw new Error(`${name} runs one program; "${file}" looks like a command line. Put its words in the argument list`);
+  }
+  if (!Array.isArray(args) || args.some((a) => typeof a !== "string")) {
+    throw new Error(`${name} takes its arguments as a list of strings`);
+  }
+}
+
+/** spawn with the same rules as runCommand; returns the child process. */
+function startCommand(file, args = [], opts = {}) {
+  checkCommand("startCommand", file, args, opts);
+  if (process.platform === "win32" && (file === "npx" || file === "npm")) {
+    const cli = path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", `${file}-cli.js`);
+    return spawn(process.execPath, [cli, ...args], { ...opts, shell: false });
+  }
+  return spawn(file, args, { ...opts, shell: false });
+}
+
+/** spawnSync with an argument list and no shell. Returns spawnSync's result. */
+function runCommand(file, args = [], opts = {}) {
+  checkCommand("runCommand", file, args, opts);
+  // Windows runs npm and npx through .cmd files, which need a shell; run npm's own script with node instead.
+  // ponytail: assumes the standard Node layout on Windows (npm next to node.exe); a custom layout fails clearly.
+  if (process.platform === "win32" && (file === "npx" || file === "npm")) {
+    const cli = path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", `${file}-cli.js`);
+    return spawnSync(process.execPath, [cli, ...args], { ...opts, shell: false });
+  }
+  return spawnSync(file, args, { ...opts, shell: false });
+}
+
+/** The origin of an iKanban API address, or an error that names it (never the key). */
+function apiOrigin(base) {
+  let u;
+  try {
+    u = new URL(String(base || ""));
+  } catch {
+    u = null;
+  }
+  const ok = u && !u.username && !u.password && u.pathname === "/" && !u.search &&
+    (API_ORIGINS.has(u.origin) || (u.protocol === "http:" && LOOPBACK.has(u.hostname)));
+  if (!ok) {
+    throw new Error(`${base || "(empty)"} is not an iKanban API (${[...API_ORIGINS].join(", ")} or this machine); the key was not sent`);
+  }
+  return u.origin;
+}
+
+/**
+ * fetch() to iKanban's API. opts: base (the signed-in api_url), token, method, body (sent as
+ * JSON), timeoutMs. Refuses another host, an absolute or protocol-relative path, and redirects.
+ */
+async function ikanbanFetch(apiPath, { base, token, method = "GET", body, timeoutMs = 60000 } = {}) {
+  const origin = apiOrigin(base);
+  if (typeof apiPath !== "string" || !apiPath.startsWith("/") || apiPath.startsWith("//")) {
+    throw new Error(`"${apiPath}" is not a path on the iKanban API; the key was not sent`);
+  }
+  const url = new URL(apiPath, origin);
+  if (url.origin !== origin) throw new Error(`"${apiPath}" leaves ${origin}; the key was not sent`);
+  const headers = { Authorization: `Bearer ${token}` };
+  if (body !== undefined) headers["Content-Type"] = "application/json";
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    throw new Error(`cannot reach ${origin} (${e.cause?.code || e.name})`);
+  }
+  if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+    throw new Error(`${origin} answered with a redirect (HTTP ${res.status}); it was not followed, so the key went nowhere else`);
+  }
+  return res;
+}
+
+module.exports = { runCommand, startCommand, ikanbanFetch, apiOrigin };

package/hooks/roadmap-sync.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// iKanban: keep the Roadmap in step with the plan file. An agent hook runs this
+// after each file write (Claude Code PostToolUse, Gemini CLI AfterTool, Copilot
+// CLI postToolUse; `npx ikanban hooks install` wires them). It reads the hook's
+// JSON on stdin, and only when the written file is a plan file (a JSON file with
+// a top-level "roadmap" block) it runs `ikanban roadmap sync <file>`.
+// It never blocks the agent: it always exits 0 and prints "{}" (the hook answer
+// every agent accepts); messages go to stderr.
+const fs = require("node:fs");
+const path = require("node:path");
+const { runCommand } = require("./ikanban-safe.js");
+
+function filePaths(value, out = []) {
+  if (typeof value === "string") {
+    // Copilot CLI sends the tool arguments as a JSON string.
+    if (value.trim().startsWith("{")) {
+      try { filePaths(JSON.parse(value), out); } catch { /* not JSON */ }
+    }
+    return out;
+  }
+  if (value && typeof value === "object") {
+    for (const [k, v] of Object.entries(value)) {
+      if (["file_path", "path", "absolute_path", "filePath"].includes(k) && typeof v === "string") out.push(v);
+      else filePaths(v, out);
+    }
+  }
+  return out;
+}
+
+/** The repository root (git), so a plan file outside it is never synced. */
+function repoRoot(cwd) {
+  const r = runCommand("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8" });
+  return r.status === 0 ? fs.realpathSync(r.stdout.trim()) : null;
+}
+
+/** A registered plan file: a .json file inside the repository with a top-level "roadmap" block. */
+function isPlan(file, root) {
+  if (!file.endsWith(".json") || !fs.existsSync(file)) return false;
+  const real = fs.realpathSync(file);
+  const rel = path.relative(root, real);
+  if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) return false;
+  try {
+    const doc = JSON.parse(fs.readFileSync(real, "utf8"));
+    return Boolean(doc && doc.roadmap && typeof doc.roadmap === "object" && !Array.isArray(doc.roadmap));
+  } catch {
+    return false;
+  }
+}
+
+/** How to run the CLI as an argument list, never through a shell: IKANBAN_CLI
+ *  (a laptop's local build, split on spaces), else npm's own npx script run by
+ *  this node, else the npx binary (macOS, Linux). */
+function cliCommand() {
+  if (process.env.IKANBAN_CLI) {
+    const [cmd, ...pre] = process.env.IKANBAN_CLI.split(" ").filter(Boolean);
+    return [cmd, pre];
+  }
+  const dir = path.dirname(process.execPath);
+  for (const npx of [path.join(dir, "node_modules", "npm", "bin", "npx-cli.js"),
+                     path.join(dir, "..", "lib", "node_modules", "npm", "bin", "npx-cli.js")]) {
+    if (fs.existsSync(npx)) return [process.execPath, [npx, "-y", "ikanban"]];
+  }
+  return ["npx", ["-y", "ikanban"]];
+}
+
+function main(input) {
+  let event = {};
+  try { event = JSON.parse(input || "{}"); } catch { return; }
+  if (!event || typeof event !== "object") return;
+  const cwd = typeof event.cwd === "string" && fs.existsSync(event.cwd) ? event.cwd : process.cwd();
+  const root = repoRoot(cwd);
+  if (!root) return;
+  const args = event.tool_input || event.toolArgs || event.tool_args || {};
+  const plans = [...new Set(filePaths(args).map((p) => path.resolve(cwd, p)))].filter((f) => isPlan(f, root));
+  const [cmd, pre] = cliCommand();
+  for (const plan of plans) {
+    // An argument array and no shell: nothing from the hook input or the plan is
+    // ever read by a shell. The path is absolute, so it cannot look like an option.
+    const r = runCommand(cmd, [...pre, "roadmap", "sync", fs.realpathSync(plan)], {
+      cwd: root, encoding: "utf8", shell: false, timeout: 60000,
+    });
+    process.stderr.write(`iKanban Roadmap: ${(r.stdout || "").trim() || (r.stderr || "").trim() || "sync did not run"}\n`);
+  }
+}
+
+let input = "";
+process.stdin.on("data", (c) => { input += c; });
+process.stdin.on("end", () => {
+  try { main(input); } catch (e) { process.stderr.write(`iKanban Roadmap hook: ${e.message}\n`); }
+  process.stdout.write("{}\n");
+  process.exit(0);
+});

package/lib/ikanban-safe.js

@@ -0,0 +1,96 @@
+// iKanban: the two safe ways for a hook or the CLI to touch the outside world.
+//   runCommand(file, args, opts)  runs one program with an argument list, never a shell,
+//                                 so a file name, branch or plan text stays one argument.
+//   startCommand(file, args, opts) the same rule, but returns the running child (spawn), for
+//                                 output that has to stream while the program runs.
+//   ikanbanFetch(path, opts)      calls iKanban's API with your key. The key goes only to
+//                                 iKanban's API (or this machine), never on a redirect,
+//                                 and is never printed.
+// The `ikanban` npm package carries a copy (vibe-cli/lib/); this file is the source.
+const path = require("node:path");
+const { spawn, spawnSync } = require("node:child_process");
+
+const API_ORIGINS = new Set(["https://api.i-kanban.com", "https://dev-api.i-kanban.com"]);
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "[::1]"]);
+
+/** The checks both runners share: one program, a list of string arguments, no shell. */
+function checkCommand(name, file, args, opts) {
+  if (opts.shell) throw new Error(`${name} never runs a shell; pass each value as its own argument`);
+  if (typeof file !== "string" || !file || (/\s/.test(file) && !path.isAbsolute(file))) {
+    throw new Error(`${name} runs one program; "${file}" looks like a command line. Put its words in the argument list`);
+  }
+  if (!Array.isArray(args) || args.some((a) => typeof a !== "string")) {
+    throw new Error(`${name} takes its arguments as a list of strings`);
+  }
+}
+
+/** spawn with the same rules as runCommand; returns the child process. */
+function startCommand(file, args = [], opts = {}) {
+  checkCommand("startCommand", file, args, opts);
+  if (process.platform === "win32" && (file === "npx" || file === "npm")) {
+    const cli = path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", `${file}-cli.js`);
+    return spawn(process.execPath, [cli, ...args], { ...opts, shell: false });
+  }
+  return spawn(file, args, { ...opts, shell: false });
+}
+
+/** spawnSync with an argument list and no shell. Returns spawnSync's result. */
+function runCommand(file, args = [], opts = {}) {
+  checkCommand("runCommand", file, args, opts);
+  // Windows runs npm and npx through .cmd files, which need a shell; run npm's own script with node instead.
+  // ponytail: assumes the standard Node layout on Windows (npm next to node.exe); a custom layout fails clearly.
+  if (process.platform === "win32" && (file === "npx" || file === "npm")) {
+    const cli = path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", `${file}-cli.js`);
+    return spawnSync(process.execPath, [cli, ...args], { ...opts, shell: false });
+  }
+  return spawnSync(file, args, { ...opts, shell: false });
+}
+
+/** The origin of an iKanban API address, or an error that names it (never the key). */
+function apiOrigin(base) {
+  let u;
+  try {
+    u = new URL(String(base || ""));
+  } catch {
+    u = null;
+  }
+  const ok = u && !u.username && !u.password && u.pathname === "/" && !u.search &&
+    (API_ORIGINS.has(u.origin) || (u.protocol === "http:" && LOOPBACK.has(u.hostname)));
+  if (!ok) {
+    throw new Error(`${base || "(empty)"} is not an iKanban API (${[...API_ORIGINS].join(", ")} or this machine); the key was not sent`);
+  }
+  return u.origin;
+}
+
+/**
+ * fetch() to iKanban's API. opts: base (the signed-in api_url), token, method, body (sent as
+ * JSON), timeoutMs. Refuses another host, an absolute or protocol-relative path, and redirects.
+ */
+async function ikanbanFetch(apiPath, { base, token, method = "GET", body, timeoutMs = 60000 } = {}) {
+  const origin = apiOrigin(base);
+  if (typeof apiPath !== "string" || !apiPath.startsWith("/") || apiPath.startsWith("//")) {
+    throw new Error(`"${apiPath}" is not a path on the iKanban API; the key was not sent`);
+  }
+  const url = new URL(apiPath, origin);
+  if (url.origin !== origin) throw new Error(`"${apiPath}" leaves ${origin}; the key was not sent`);
+  const headers = { Authorization: `Bearer ${token}` };
+  if (body !== undefined) headers["Content-Type"] = "application/json";
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    throw new Error(`cannot reach ${origin} (${e.cause?.code || e.name})`);
+  }
+  if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+    throw new Error(`${origin} answered with a redirect (HTTP ${res.status}); it was not followed, so the key went nowhere else`);
+  }
+  return res;
+}
+
+module.exports = { runCommand, startCommand, ikanbanFetch, apiOrigin };

package/lib/pipeline.js

@@ -0,0 +1,217 @@
+// `ikanban pipeline`: tell iKanban where a task is, from any CI (plan 21 F10).
+//
+//   ikanban pipeline run   --task IKA-1[,IKA-2] --stage build -- <command> [args...]
+//       runs the command, prints its output as usual, streams the lines to the task's
+//       Pipelines view (secrets masked first), posts running → passed/failed, and exits
+//       with the command's own exit code. iKanban being down never fails the command.
+//   ikanban pipeline event --task IKA-1 --stage deploy --status passed [--url U] [--sha S] [--detail D]
+//   ikanban pipeline log   --task IKA-1 --stage build   < output.txt
+//
+// Team: --team or IKANBAN_TEAM (identifier like IKA, or its id). Key: VIBE_API_TOKEN.
+// Server: --base-url or IKANBAN_BASE_URL (default https://api.i-kanban.com); the key goes
+// only there (ikanbanFetch).
+const { startCommand, ikanbanFetch, apiOrigin } = require("./ikanban-safe.js");
+
+const SECRET_NAME = /(TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|API_?KEY|ACCESS_?KEY|_KEY$)/i;
+const MAX_CHUNK = 15 * 1024; // the server takes 16 KB per chunk
+const FLUSH_MS = 1000;
+
+/** Values to hide: every env var whose name looks secret, plus --mask NAME,NAME. */
+function secretValues(env, extraNames = []) {
+  const out = new Set();
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || value.length < 6) continue;
+    if (SECRET_NAME.test(name) || extraNames.includes(name)) out.add(value);
+  }
+  // Longest first, so a value that contains another is hidden whole.
+  return [...out].sort((a, b) => b.length - a.length);
+}
+
+function masker(values) {
+  return (line) => values.reduce((s, v) => s.split(v).join("***"), line);
+}
+
+function parse(args) {
+  const opts = { _: [] };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") {
+      opts.command = args.slice(i + 1);
+      break;
+    }
+    if (!a.startsWith("--")) opts._.push(a);
+    else opts[a.slice(2)] = args[++i];
+  }
+  return opts;
+}
+
+async function api(path, { base, token, method = "GET", body }) {
+  const res = await ikanbanFetch(path, { base, token, method, body });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.success === false) throw new Error(`HTTP ${res.status}: ${data.message || "refused"}`);
+  return data.data;
+}
+
+/** The team's id: given as an id, or found by its identifier among the caller's teams. */
+async function teamId(conn, team) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(team)) return team;
+  const teams = await api("/api/teams", conn);
+  const t = (teams || []).find((x) => (x.identifier || "").toLowerCase() === team.toLowerCase());
+  if (!t) throw new Error(`team ${team} not found among your teams`);
+  return t.id;
+}
+
+function connection(opts) {
+  const token = process.env.VIBE_API_TOKEN || "";
+  if (!token) throw new Error("set VIBE_API_TOKEN to an iKanban API key (Settings → API keys)");
+  const team = opts.team || process.env.IKANBAN_TEAM || "";
+  if (!team) throw new Error("set --team or IKANBAN_TEAM (for example IKA)");
+  // F11: each task may name its own run, "IKA-1@pr-159"; otherwise --run (or none).
+  const tasks = String(opts.task || process.env.IKANBAN_TASK || "").split(",").map((s) => s.trim()).filter(Boolean)
+    .map((t) => {
+      const [task, run] = t.split("@");
+      return { task, run: run || opts.run || process.env.IKANBAN_RUN || undefined };
+    });
+  if (!tasks.length) throw new Error("set --task (for example IKA-123; several: IKA-1,IKA-2; with a run: IKA-1@pr-159)");
+  if (!opts.stage) throw new Error("set --stage (for example build, deploy, smoke)");
+  return {
+    base: apiOrigin(opts["base-url"] || process.env.IKANBAN_BASE_URL || "https://api.i-kanban.com"),
+    token, team, tasks,
+    source: opts.source || process.env.IKANBAN_SOURCE || undefined,
+    actor: opts.actor || process.env.IKANBAN_ACTOR || undefined,
+  };
+}
+
+async function postEvent(conn, tid, t, fields) {
+  const body = { task: t.task, run: t.run, source: conn.source, actor: conn.actor, ...fields };
+  return api(`/api/teams/${tid}/pipeline-events`, { ...conn, method: "POST", body });
+}
+
+/** Sends log text in order, one request at a time; drops lines (once warned) if iKanban is unreachable. */
+function logSender(conn, tid, stage) {
+  let queue = "";
+  let chain = Promise.resolve();
+  let warned = false;
+  const send = (text) => {
+    chain = chain.then(async () => {
+      for (const t of conn.tasks) {
+        try {
+          await api(`/api/teams/${tid}/pipeline-logs`, { ...conn, method: "POST", body: { task: t.task, run: t.run, stage, text } });
+        } catch (e) {
+          if (!warned) console.error(`ikanban: log not sent to iKanban (${e.message}); the command goes on`);
+          warned = true;
+        }
+      }
+    });
+  };
+  const flush = () => {
+    // Whole lines only, so a secret never splits across two chunks and escapes the mask.
+    const cut = queue.lastIndexOf("\n");
+    if (cut < 0 && queue.length < MAX_CHUNK) return;
+    const take = cut < 0 ? queue.length : cut + 1;
+    for (let i = 0; i < take; i += MAX_CHUNK) send(queue.slice(i, Math.min(take, i + MAX_CHUNK)));
+    queue = queue.slice(take);
+  };
+  return {
+    push(text) { queue += text; if (queue.length >= MAX_CHUNK) flush(); },
+    flush,
+    async end() { if (queue) { send(queue); queue = ""; } await chain; },
+  };
+}
+
+async function runStage(opts) {
+  const conn = connection(opts);
+  if (!opts.command || !opts.command.length) throw new Error("put the command after --, for example: -- cargo build");
+  const tid = await teamId(conn, conn.team);
+  const mask = masker(secretValues(process.env, String(opts.mask || "").split(",").filter(Boolean)));
+  const started = Date.now();
+  const tell = async (status, detail) => {
+    for (const t of conn.tasks) {
+      try {
+        await postEvent(conn, tid, t, { stage: opts.stage, status, url: opts.url, commit_sha: opts.sha, detail });
+      } catch (e) {
+        console.error(`ikanban: stage ${status} not sent for ${t.task} (${e.message})`);
+      }
+    }
+  };
+  await tell("running");
+  const log = logSender(conn, tid, opts.stage);
+  const timer = setInterval(() => log.flush(), FLUSH_MS);
+  const [file, ...args] = opts.command;
+  const code = await new Promise((resolve) => {
+    let child;
+    try {
+      child = startCommand(file, args, { stdio: ["inherit", "pipe", "pipe"] });
+    } catch (e) {
+      console.error(`ikanban: ${e.message}`);
+      return resolve(127);
+    }
+    let partial = "";
+    const onData = (stream) => (buf) => {
+      stream.write(buf);
+      partial += buf.toString("utf8");
+      const cut = partial.lastIndexOf("\n");
+      if (cut >= 0) {
+        log.push(partial.slice(0, cut + 1).split("\n").map(mask).join("\n"));
+        partial = partial.slice(cut + 1);
+      }
+    };
+    child.stdout.on("data", onData(process.stdout));
+    child.stderr.on("data", onData(process.stderr));
+    child.on("error", (e) => { console.error(`ikanban: ${e.message}`); resolve(127); });
+    child.on("close", (c) => {
+      if (partial) log.push(mask(partial));
+      resolve(c === null ? 1 : c);
+    });
+  });
+  clearInterval(timer);
+  await log.end();
+  const secs = Math.round((Date.now() - started) / 1000);
+  await tell(code === 0 ? "passed" : "failed", `${secs} s${code === 0 ? "" : `, exit ${code}`}`);
+  return code;
+}
+
+async function readStdin() {
+  const parts = [];
+  for await (const c of process.stdin) parts.push(c);
+  return Buffer.concat(parts).toString("utf8");
+}
+
+async function run(args) {
+  const [sub, ...rest] = args;
+  const opts = parse(rest);
+  if (sub === "run") return runStage(opts);
+  if (sub === "event") {
+    const conn = connection(opts);
+    if (!opts.status) throw new Error("set --status (queued, running, passed, failed, skipped, held, cancelled)");
+    const tid = await teamId(conn, conn.team);
+    for (const t of conn.tasks) {
+      await postEvent(conn, tid, t, { stage: opts.stage, status: opts.status, url: opts.url, commit_sha: opts.sha, detail: opts.detail });
+    }
+    console.log(`${opts.stage} ${opts.status}: ${conn.tasks.map((t) => (t.run ? `${t.task}@${t.run}` : t.task)).join(", ")}`);
+    return 0;
+  }
+  if (sub === "log") {
+    const conn = connection(opts);
+    const tid = await teamId(conn, conn.team);
+    const mask = masker(secretValues(process.env, String(opts.mask || "").split(",").filter(Boolean)));
+    const log = logSender(conn, tid, opts.stage);
+    log.push((await readStdin()).split("\n").map(mask).join("\n"));
+    await log.end();
+    return 0;
+  }
+  console.log(HELP);
+  return sub ? 2 : 0;
+}
+
+const HELP = `Usage:
+  ikanban pipeline run   --task IKA-1[@pr-159][,IKA-2] --stage build [--url U] [--sha S] [--mask NAME,...] -- <command> [args...]
+  ikanban pipeline event --task IKA-1 --stage deploy --status passed [--url U] [--sha S] [--detail D]
+  ikanban pipeline log   --task IKA-1 --stage build < output.txt
+Every command also takes --run R (the run: a PR like pr-159, or a branch), --source S (where:
+github, gitlab, laptop, ci) and --actor A (who). One run per task: IKA-1@pr-159.
+Team: --team or IKANBAN_TEAM. Key: VIBE_API_TOKEN. Server: --base-url or IKANBAN_BASE_URL.
+Values of environment variables named like a secret (TOKEN, SECRET, PASSWORD, *_KEY…) and of
+--mask names are replaced with *** before a line is sent.`;
+
+module.exports = { run, secretValues, masker, parse, logSender, HELP };

package/lib/roadmap.js

@@ -0,0 +1,280 @@
+// ikanban roadmap sync / ikanban hooks install: keep iKanban's Roadmap in step
+// with the plan file an agent keeps in its repository. No CI: the sync runs from
+// the agent's hook and from git's pre-push hook, on any git host.
+//
+// A plan file opts in with a top-level block:
+//   "roadmap": {"team": "<team id or identifier>", "plan_id": "<plan feature id>",
+//               "project": "<project id or name for new tasks>", "name": "<plan name>"}
+// plan_id is written back after the first sync creates the plan. Phases:
+//   [{id, title, status, depends_on, tasks: [{id, description|title, status}]}]
+const fs = require("node:fs");
+const path = require("node:path");
+const { runCommand, ikanbanFetch, apiOrigin } = require("./ikanban-safe.js");
+
+const TASK_STATUS = {
+  done: "done", complete: "done", completed: "done",
+  in_progress: "inprogress", inprogress: "inprogress", "in-progress": "inprogress", started: "inprogress",
+  in_review: "inreview", inreview: "inreview", review: "inreview",
+  pending: "todo", todo: "todo", waiting: "todo", deferred: "todo", blocked: "todo",
+  cancelled: "cancelled", canceled: "cancelled", skipped: "cancelled", dropped: "cancelled",
+};
+const PHASE_STATUS = { done: "done", in_progress: "in_progress", inprogress: "in_progress", "in-progress": "in_progress" };
+
+/** First clause of a task text, cut at a word; no links or email addresses. */
+function short(text, limit = 60) {
+  const first = String(text || "").trim().split(/(?<=[a-z0-9)])\. |\s\(|\s—\s/)[0].replace(/[.:]+$/, "");
+  let out = "";
+  for (const w of first.split(/\s+/).filter((w) => w && !w.includes("://") && !w.includes("@"))) {
+    if ((out + " " + w).trim().length > limit) return out + "…";
+    out = (out + " " + w).trim();
+  }
+  return out;
+}
+
+/** Plan file → the document POST /api/teams/{team}/roadmap/sync takes. */
+function toDocument(plan) {
+  const block = plan.roadmap || {};
+  const errors = [];
+  const phases = (plan.phases || []).map((ph) => {
+    const title = String(ph.name || ph.title || "").split(" (")[0].trim();
+    const name = title.startsWith(`${ph.id} `) || title === ph.id ? title : `${ph.id} ${title}`.trim();
+    const phaseWord = String(ph.status || "").toLowerCase();
+    return {
+      key: ph.id,
+      name,
+      depends_on: ph.depends_on || [],
+      status: PHASE_STATUS[phaseWord] || (phaseWord ? "waiting" : undefined),
+      // Only an explicit "name" renames an existing phase; a name made from the
+      // title only names a new one, so a rename on the Roadmap (the pencil) stays.
+      rename: Boolean(ph.name),
+      tasks: (ph.tasks || []).map((t) => {
+        const word = String(t.status || "pending").toLowerCase();
+        let status = TASK_STATUS[word];
+        if (!status) errors.push(`task ${t.id}: unknown status "${t.status}"`);
+        // A deferred task in a phase the plan calls done is out of its scope.
+        if (word === "deferred" && phaseWord === "done") status = "cancelled";
+        return { key: t.id, title: `${t.id}: ${short(t.title || t.description)}`, status, rename: Boolean(t.title) };
+      }),
+    };
+  });
+  if (errors.length) throw new Error(errors.join("; "));
+  return {
+    plan: { id: block.plan_id || undefined, name: block.name || (block.plan_id ? undefined : plan.title) },
+    project: block.project,
+    phases,
+  };
+}
+
+/** .iKanban/settings-local.json (or the older .i-kanban/) nearest to `dir`. */
+function localSettings(dir) {
+  for (let d = path.resolve(dir); ; d = path.dirname(d)) {
+    for (const folder of [".iKanban", ".i-kanban"]) {
+      const f = path.join(d, folder, "settings-local.json");
+      if (fs.existsSync(f)) {
+        try { return JSON.parse(fs.readFileSync(f, "utf8")); } catch { return {}; }
+      }
+    }
+    if (path.dirname(d) === d) return {};
+  }
+}
+
+// The key only ever goes to iKanban's own API (or this machine, for a local
+// server): never to an address from a plan file, a repository's settings file or
+// an environment variable that names another host.
+
+function connection(opts, file) {
+  const s = localSettings(path.dirname(file));
+  return {
+    base: apiOrigin(opts["base-url"] || process.env.IKANBAN_BASE_URL || s.api_url || "https://api.i-kanban.com"),
+    token: opts.token || process.env.VIBE_API_TOKEN || s.api_key || "",
+    team: process.env.IKANBAN_TEAM_ID || s.team || "",
+    project: s.project,
+  };
+}
+
+/** Adds "plan_id" to the roadmap block as text, so the file keeps its layout. */
+function writePlanId(file, id) {
+  const text = fs.readFileSync(file, "utf8");
+  const next = text.replace(/("roadmap"\s*:\s*\{)(\s*)/, (_, open, space) => `${open}${space}"plan_id": "${id}",${space || " "}`);
+  if (next !== text && JSON.parse(next).roadmap.plan_id === id) fs.writeFileSync(file, next);
+}
+
+async function syncFile(file, opts) {
+  const plan = JSON.parse(fs.readFileSync(file, "utf8"));
+  if (!plan.roadmap) {
+    console.log(`${file}: no "roadmap" block, skipped`);
+    return 0;
+  }
+  const c = connection(opts, file);
+  const team = plan.roadmap.team || c.team;
+  if (!c.token) throw new Error("no API key: set VIBE_API_TOKEN, pass --token, or set api_key in .iKanban/settings-local.json");
+  if (!team) throw new Error('no team: add "team" to the roadmap block or .iKanban/settings-local.json');
+  const doc = toDocument(plan);
+  doc.project = doc.project || c.project;
+  doc.dry_run = Boolean(opts.check || opts["dry-run"]);
+  // Deleting an empty phase the sync created needs an explicit flag; MCP never deletes.
+  if (opts["allow-delete"]) doc.allow_delete = true;
+  let res;
+  try {
+    // The shared helper sends the key only to iKanban's API or this machine, never on a redirect.
+    res = await ikanbanFetch(`/api/teams/${encodeURIComponent(team)}/roadmap/sync`, {
+      base: c.base, token: c.token, method: "POST", body: doc,
+    });
+  } catch (e) {
+    throw new Error(`${e.message}; the Roadmap was not changed`);
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || body.success === false) throw new Error(`HTTP ${res.status}: ${body.message || "sync refused"}`);
+  const out = body.data;
+  const drift = out.changes.filter((ch) => !ch.action.startsWith("adopt_"));
+  for (const ch of drift) {
+    const what = ch.name || ch.title || (ch.to ? `${ch.from} → ${ch.to}` : "") || (ch.depends_on ? `after ${ch.depends_on.join(", ") || "nothing"}` : "");
+    console.log(`  ${ch.action} ${ch.key || ""} ${what}`.trimEnd());
+  }
+  for (const w of out.warnings) console.log(`  warning: ${w}`);
+  const verb = out.applied ? `${drift.length} change(s) applied` : out.in_sync ? "in sync" : `${drift.length} difference(s)`;
+  console.log(`${path.basename(file)} → ${out.plan_name || "plan"}: ${verb}`);
+  if (out.applied && out.plan_id && !plan.roadmap.plan_id) {
+    writePlanId(file, out.plan_id);
+    console.log(`  plan_id ${out.plan_id} written to the roadmap block`);
+  }
+  return opts.check && !out.in_sync ? 1 : 0;
+}
+
+/** Tracked JSON files with a top-level "roadmap" block in this git repository. */
+function registeredPlans(cwd) {
+  const r = runCommand("git", ["grep", "-l", '"roadmap"', "--", "*.json"], { cwd, encoding: "utf8" });
+  return (r.stdout || "").split("\n").filter(Boolean).map((f) => path.join(cwd, f)).filter((f) => {
+    try { return Boolean(JSON.parse(fs.readFileSync(f, "utf8")).roadmap); } catch { return false; }
+  });
+}
+
+const HOOK_MARK = "# ikanban roadmap sync";
+const PRE_PUSH = `${HOOK_MARK} (added by "ikanban hooks install"; never blocks the push)
+if command -v npx >/dev/null 2>&1; then
+  npx -y ikanban roadmap sync --quiet-errors || true
+fi
+`;
+const AGENT_COMMAND = "node .iKanban/hooks/roadmap-sync.js";
+
+function mergeJson(file, update) {
+  const cur = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : {};
+  const next = update(cur);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
+}
+
+/** Adds one entry to hooks[event] unless an entry already runs our command. */
+function addHook(settings, event, entry) {
+  settings.hooks = settings.hooks || {};
+  const list = (settings.hooks[event] = settings.hooks[event] || []);
+  if (!JSON.stringify(list).includes("roadmap-sync.js")) list.push(entry);
+  return settings;
+}
+
+const AGENTS = {
+  claude: (root) => {
+    mergeJson(path.join(root, ".claude", "settings.json"), (s) =>
+      addHook(s, "PostToolUse", { matcher: "Write|Edit|MultiEdit", hooks: [{ type: "command", command: AGENT_COMMAND, timeout: 90 }] }));
+    return ".claude/settings.json (PostToolUse)";
+  },
+  gemini: (root) => {
+    mergeJson(path.join(root, ".gemini", "settings.json"), (s) =>
+      addHook(s, "AfterTool", { matcher: "write_file|replace", hooks: [{ name: "ikanban-roadmap-sync", type: "command", command: AGENT_COMMAND, timeout: 90000 }] }));
+    return ".gemini/settings.json (AfterTool)";
+  },
+  copilot: (root) => {
+    const file = path.join(root, ".github", "hooks", "ikanban-roadmap.json");
+    mergeJson(file, (s) => {
+      s.version = 1;
+      return addHook(s, "postToolUse", { type: "command", bash: AGENT_COMMAND, powershell: AGENT_COMMAND, cwd: ".", timeoutSec: 90 });
+    });
+    return ".github/hooks/ikanban-roadmap.json (postToolUse)";
+  },
+};
+
+function installHooks(opts) {
+  const root = runCommand("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).stdout.trim();
+  if (!root) throw new Error("run this inside a git repository");
+  const done = [];
+  // The agent hook script ships in .iKanban/hooks/; this package carries a copy.
+  const script = path.join(root, ".iKanban", "hooks", "roadmap-sync.js");
+  fs.mkdirSync(path.dirname(script), { recursive: true });
+  // The hook runs its commands through ikanban-safe.js, so both files go together.
+  for (const name of ["roadmap-sync.js", "ikanban-safe.js"]) {
+    fs.copyFileSync(path.join(__dirname, "..", "hooks", name), path.join(path.dirname(script), name));
+    done.push(`.iKanban/hooks/${name}`);
+  }
+
+  const hooksDir = runCommand("git", ["rev-parse", "--git-path", "hooks"], { cwd: root, encoding: "utf8" }).stdout.trim();
+  const prePush = path.resolve(root, hooksDir, "pre-push");
+  const cur = fs.existsSync(prePush) ? fs.readFileSync(prePush, "utf8") : "#!/bin/sh\n";
+  if (!cur.includes(HOOK_MARK)) {
+    fs.mkdirSync(path.dirname(prePush), { recursive: true });
+    fs.writeFileSync(prePush, `${cur.replace(/\n*$/, "\n")}\n${PRE_PUSH}`);
+  }
+  fs.chmodSync(prePush, 0o755);
+  done.push("git pre-push hook");
+
+  const wanted = opts.agent ? String(opts.agent).split(",") : Object.keys(AGENTS).filter((a) =>
+    fs.existsSync(path.join(root, { claude: ".claude", gemini: ".gemini", copilot: ".github" }[a])));
+  for (const a of wanted) {
+    if (!AGENTS[a]) throw new Error(`unknown agent "${a}" (claude, gemini, copilot)`);
+    done.push(AGENTS[a](root));
+  }
+  for (const d of done) console.log(`  installed: ${d}`);
+  console.log("Plan files (JSON with a top-level \"roadmap\" block) now reach the Roadmap on every agent write and every git push.");
+  return 0;
+}
+
+const HELP = `Usage:
+  ikanban roadmap sync [plan.json ...] [--check] [--dry-run] [--allow-delete] [--token T] [--base-url URL]
+      Make each plan's Roadmap match the file. No file: every tracked JSON file
+      with a top-level "roadmap" block. --check: change nothing, exit 1 on drift.
+      --allow-delete: also delete an emptied phase the sync created (else it stays).
+  ikanban hooks install [--agent claude,gemini,copilot]
+      Keep the Roadmap in step without CI: a git pre-push hook (any git host) and
+      a hook for each agent whose folder exists (.claude, .gemini, .github).
+
+Key: VIBE_API_TOKEN, --token, or api_key in .iKanban/settings-local.json.
+Server: IKANBAN_BASE_URL, --base-url, or api_url there (default https://api.i-kanban.com).`;
+
+function parse(args) {
+  const opts = { _: [] };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (!a.startsWith("--")) opts._.push(a);
+    else if (["--token", "--base-url", "--agent"].includes(a)) opts[a.slice(2)] = args[++i];
+    else opts[a.slice(2)] = true;
+  }
+  return opts;
+}
+
+async function run(cmd, args) {
+  const opts = parse(args);
+  const [sub, ...files] = opts._;
+  if (opts.help || !sub) {
+    console.log(HELP);
+    return 0;
+  }
+  if (cmd === "hooks" && sub === "install") return installHooks(opts);
+  if (cmd !== "roadmap" || sub !== "sync") {
+    console.error(`ikanban: unknown command "${cmd} ${sub}". Run "ikanban roadmap --help".`);
+    return 2;
+  }
+  const list = files.length ? files.map((f) => path.resolve(f)) : registeredPlans(process.cwd());
+  if (!list.length) console.log('No plan files: add a top-level "roadmap" block to a plan JSON file.');
+  let code = 0;
+  for (const f of list) {
+    try {
+      code = Math.max(code, await syncFile(f, opts));
+    } catch (e) {
+      console.error(`${path.basename(f)}: ${e.message}`);
+      // From a git hook, an error never blocks the push.
+      if (!opts["quiet-errors"]) code = Math.max(code, 1);
+    }
+  }
+  return code;
+}
+
+module.exports = { run, toDocument, short, writePlanId, addHook, apiOrigin };

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ikanban",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
-  "files": ["bin", "scanners", "README.md"],
+  "files": ["bin", "lib", "hooks", "scanners", "README.md"],
   "scripts": {
     "prepack": "node scripts/copy-scanners.js",
     "pretest": "node scripts/copy-scanners.js",
-    "test": "node --test test/cli.test.js"
+    "test": "node --test test/cli.test.js test/safe.test.js test/roadmap.test.js test/pipeline.test.js"
   },
   "engines": { "node": ">=18" },
   "homepage": "https://i-kanban.com",

package/scanners/ikanban-aiscan.py

@@ -44,6 +44,7 @@ import subprocess
 import sys
 import tempfile
 import urllib.error
+import urllib.parse
 import urllib.request
 import uuid
 from datetime import datetime, timezone
@@ -56,7 +57,7 @@ PROMPTFOO_VERSION = "0.123.1"
 # so this string is the release identity. Bump it when publishing a release —
 # a customer pinning a version is pinning this value, and re-uploading different
 # bytes under a version someone already fetched defeats the sha256 they pinned.
-AISCAN_VERSION = "0.3.1"
+AISCAN_VERSION = "0.3.2"
 
 # The ten categories, their labels, and their plugins -- the forward map, copied
 # from promptfoo's OWASP_LLM_TOP_10_MAPPING (src/redteam/constants/frameworks.ts).
@@ -291,7 +292,8 @@ def build_config(target, spec, plugins, num_tests, base_url, token, workspace_id
                 "server": {
                     "url": spec["mcp_url"],
                     "name": target,
-                    "auth": {"type": "bearer", "token": spec.get("bearer") or token},
+                    # An MCP server from aiscan.toml gets only its own auth, never the iKanban key (T3).
+                    "auth": {"type": "bearer", "token": spec.get("bearer") or ("" if spec.get("from_config") else token)},
                 },
             },
         }
@@ -597,6 +599,30 @@ machine against the target named above.</footer>"""
     Path(path).write_text(doc, encoding="utf-8")
 
 
+# Coding standard T3: the iKanban key goes only to iKanban's API (or this machine), and never
+# on a redirect. A --base-url, IKANBAN_BASE_URL or config file cannot send it anywhere else.
+IKANBAN_APIS = ("https://api.i-kanban.com", "https://dev-api.i-kanban.com")
+
+
+def ikanban_api(base_url):
+    """The origin of base_url if it is iKanban's API; otherwise stop, naming it (never the key)."""
+    u = urllib.parse.urlsplit(base_url or "")
+    origin = f"{u.scheme}://{u.netloc}"
+    if u.username is None and u.path in ("", "/") and not u.query and (
+            origin in IKANBAN_APIS or (u.scheme == "http" and u.hostname in ("127.0.0.1", "localhost", "::1"))):
+        return origin
+    raise SystemExit(f"error: {base_url or '(empty)'} is not an iKanban API "
+                     f"({', '.join(IKANBAN_APIS)} or this machine); the key was not sent")
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None  # a 3xx comes back as an HTTPError, and the key goes nowhere else
+
+
+_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
 def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results):
     payload = {
         "scan_run_id": run_id,
@@ -611,13 +637,13 @@ def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results
         "plugin_results": plugin_results,
     }
     req = urllib.request.Request(
-        f"{base_url.rstrip('/')}/api/teams/{team_id}/security/ai-seed",
+        f"{ikanban_api(base_url)}/api/teams/{team_id}/security/ai-seed",
         data=json.dumps(payload).encode(),
         headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
         method="POST",
     )
     try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
+        with _OPENER.open(req, timeout=30) as resp:
             body = json.loads(resp.read().decode())
             data = body.get("data", body)
             # plugin_results_stored is absent on a backend that predates
@@ -710,6 +736,10 @@ def main(argv=None):
             % (args.target, ", ".join(sorted(targets)))
         )
     spec = targets[args.target]
+    # Before the scan, not after it: the key goes to base_url when publishing and for the
+    # builtin authenticated targets, so it must be iKanban's API (T3).
+    if args.token and (args.publish or (spec.get("auth") and not spec.get("from_config"))):
+        args.base_url = ikanban_api(args.base_url)
 
     if shutil.which("npx") is None:
         log("error: npx not found. promptfoo needs Node.js — https://nodejs.org")

package/scanners/ikanban-secscan.py

@@ -54,6 +54,7 @@ import stat
 import subprocess
 import sys
 import urllib.error
+import urllib.parse
 import urllib.request
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -63,7 +64,7 @@ from pathlib import Path
 # that npm no longer hosts the package. Starting at 1.0.0 rather than continuing
 # the npm package's 0.1.x line: that counter belonged to the wrapper, not to
 # this file, and reusing it would suggest a continuity that does not exist.
-SECSCAN_VERSION = "1.2.0"
+SECSCAN_VERSION = "1.2.1"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -674,17 +675,41 @@ def build_findings_payload(sections: list, home: str | None = None) -> tuple[lis
 OLD_SERVER = "this iKanban server does not take them yet; the report is filed"
 
 
+# Coding standard T3: the iKanban key goes only to iKanban's API (or this machine), and never
+# on a redirect. A --base-url, IKANBAN_BASE_URL or config file cannot send it anywhere else.
+IKANBAN_APIS = ("https://api.i-kanban.com", "https://dev-api.i-kanban.com")
+
+
+def ikanban_api(base_url):
+    """The origin of base_url if it is iKanban's API; otherwise stop, naming it (never the key)."""
+    u = urllib.parse.urlsplit(base_url or "")
+    origin = f"{u.scheme}://{u.netloc}"
+    if u.username is None and u.path in ("", "/") and not u.query and (
+            origin in IKANBAN_APIS or (u.scheme == "http" and u.hostname in ("127.0.0.1", "localhost", "::1"))):
+        return origin
+    raise SystemExit(f"error: {base_url or '(empty)'} is not an iKanban API "
+                     f"({', '.join(IKANBAN_APIS)} or this machine); the key was not sent")
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args, **kwargs):
+        return None  # a 3xx comes back as an HTTPError, and the key goes nowhere else
+
+
+_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
 def api(method: str, path: str, base_url: str, token: str, payload=None):
     """(ok, data | error text | None for 404)."""
     req = urllib.request.Request(
-        f"{base_url.rstrip('/')}/api{path}",
+        f"{ikanban_api(base_url)}/api{path}",
         data=json.dumps(payload).encode() if payload is not None else None,
         headers={"Authorization": f"Bearer {token}",
                  "Content-Type": "application/json"},
         method=method,
     )
     try:
-        with urllib.request.urlopen(req, timeout=30) as r:
+        with _OPENER.open(req, timeout=30) as r:
             body = json.loads(r.read().decode() or "{}")
         return True, body.get("data", body)
     except urllib.error.HTTPError as e:
@@ -757,14 +782,14 @@ def publish(md: str, title: str, base_url: str, token: str, team_id: str,
     # workspace has an active subscription. Scanning stays free; only filing the
     # report into iKanban is a paid feature.
     req = urllib.request.Request(
-        f"{base_url.rstrip('/')}/api/security/scan-reports",
+        f"{ikanban_api(base_url)}/api/security/scan-reports",
         data=json.dumps(payload).encode(),
         headers={"Authorization": f"Bearer {token}",
                  "Content-Type": "application/json"},
         method="POST",
     )
     try:
-        with urllib.request.urlopen(req, timeout=30) as r:
+        with _OPENER.open(req, timeout=30) as r:
             body = json.loads(r.read().decode() or "{}")
         doc = body.get("data", body)
         return True, doc.get("id", "")