ikanban 0.3.1 → 0.3.3

package/lib/roadmap.js

@@ -156,6 +156,9 @@ if command -v npx >/dev/null 2>&1; then
 fi
 `;
 const AGENT_COMMAND = "node .iKanban/hooks/roadmap-sync.js";
+// IKA-2244: Claude Code runs a hook in the session's working folder, which is often not the
+// repository root; $CLAUDE_PROJECT_DIR is the root (Claude Code hooks reference).
+const CLAUDE_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.iKanban/hooks/roadmap-sync.js"';
 
 function mergeJson(file, update) {
   const cur = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : {};
@@ -164,18 +167,21 @@ function mergeJson(file, update) {
   fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
 }
 
-/** Adds one entry to hooks[event] unless an entry already runs our command. */
+/** Adds one entry to hooks[event]; an entry that already runs roadmap-sync.js is replaced
+ *  by it (IKA-2244: so a re-install fixes an older install's command), never doubled. */
 function addHook(settings, event, entry) {
   settings.hooks = settings.hooks || {};
   const list = (settings.hooks[event] = settings.hooks[event] || []);
-  if (!JSON.stringify(list).includes("roadmap-sync.js")) list.push(entry);
+  const at = list.findIndex((e) => JSON.stringify(e).includes("roadmap-sync.js"));
+  if (at < 0) list.push(entry);
+  else list[at] = entry;
   return settings;
 }
 
 const AGENTS = {
   claude: (root) => {
     mergeJson(path.join(root, ".claude", "settings.json"), (s) =>
-      addHook(s, "PostToolUse", { matcher: "Write|Edit|MultiEdit", hooks: [{ type: "command", command: AGENT_COMMAND, timeout: 90 }] }));
+      addHook(s, "PostToolUse", { matcher: "Write|Edit|MultiEdit", hooks: [{ type: "command", command: CLAUDE_COMMAND, timeout: 90 }] }));
     return ".claude/settings.json (PostToolUse)";
   },
   gemini: (root) => {
@@ -224,6 +230,9 @@ function installHooks(opts) {
   }
   for (const d of done) console.log(`  installed: ${d}`);
   console.log("Plan files (JSON with a top-level \"roadmap\" block) now reach the Roadmap on every agent write and every git push.");
+  // IKA-2244: the sync's default server is prod; say which one this repository will use.
+  const base = connection({}, path.join(root, "plan.json")).base;
+  console.log(`  server: ${base} (set api_url in .iKanban/settings-local.json, or IKANBAN_BASE_URL, to use another)`);
   return 0;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md"],

package/scanners/ikanban-secscan.py

@@ -64,7 +64,7 @@ from pathlib import Path
 # that npm no longer hosts the package. Starting at 1.0.0 rather than continuing
 # the npm package's 0.1.x line: that counter belonged to the wrapper, not to
 # this file, and reusing it would suggest a continuity that does not exist.
-SECSCAN_VERSION = "1.2.1"
+SECSCAN_VERSION = "1.3.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -430,6 +430,50 @@ def git_ignored(root: Path, rels: list) -> set:
     return {l.strip() for l in p.stdout.splitlines() if l.strip()}
 
 
+# Plan 11 G6: test code inside a normal file holds fake keys as often as a test folder
+# does (a Rust #[cfg(test)] module, a #[test] fn, a Python test_ function). Its lines are
+# suppressed and counted like a test path.
+# ponytail: braces are counted without parsing strings or comments, so a brace inside a
+# string can end a Rust block early; a real parser is the upgrade if that misses cases.
+RUST_TEST_ATTR = re.compile(r"^\s*#\[(cfg\(test\)|test)\]")
+PY_TEST_DEF = re.compile(r"^(\s*)(async\s+)?def test_\w*\s*\(")
+
+
+def test_code_lines(rel: str, text: str) -> set:
+    lines = text.splitlines()
+    out = set()
+    if rel.endswith(".rs"):
+        i = 0
+        while i < len(lines):
+            if not RUST_TEST_ATTR.match(lines[i]):
+                i += 1
+                continue
+            depth, opened, j = 0, False, i
+            while j < len(lines):
+                depth += lines[j].count("{") - lines[j].count("}")
+                opened = opened or "{" in lines[j]
+                out.add(j + 1)
+                if opened and depth <= 0:
+                    break
+                j += 1
+            i = j + 1
+    elif rel.endswith(".py"):
+        i = 0
+        while i < len(lines):
+            m = PY_TEST_DEF.match(lines[i])
+            if not m:
+                i += 1
+                continue
+            indent = len(m.group(1))
+            out.add(i + 1)
+            j = i + 1
+            while j < len(lines) and (not lines[j].strip() or len(lines[j]) - len(lines[j].lstrip()) > indent):
+                out.add(j + 1)
+                j += 1
+            i = j
+    return out
+
+
 def scan_secrets(root: Path) -> Section:
     sec = Section("Committed secrets")
     sec.ran.append(f"{len(SECRET_RULES)} high-confidence patterns")
@@ -441,13 +485,16 @@ def scan_secrets(root: Path) -> Section:
             text = path.read_text(errors="ignore")
         except OSError:
             continue
+        in_test = None
         for _id, severity, rx, desc in SECRET_RULES:
             for m in rx.finditer(text):
                 line_no = text.count("\n", 0, m.start()) + 1
                 line = text.splitlines()[line_no - 1] if line_no <= len(text.splitlines()) else ""
                 if EXAMPLE_MARKERS.search(line):
                     continue
-                if is_fixture:
+                if in_test is None:
+                    in_test = test_code_lines(rel, text)
+                if is_fixture or line_no in in_test:
                     suppressed += 1
                     continue
                 hit = m.group(0)
@@ -477,7 +524,7 @@ def scan_secrets(root: Path) -> Section:
 
     if suppressed:
         sec.skipped.append(
-            f"{suppressed} match(es) in test/fixture/doc paths were suppressed "
+            f"{suppressed} match(es) in test code, test/fixture/doc paths were suppressed "
             "as expected fake credentials — re-check by hand if a real secret "
             "could have been committed to a test file")
     return sec