ikanban 0.3.4 → 0.4.0

package/README.md

@@ -7,6 +7,9 @@ results into [iKanban](https://i-kanban.com).
 npx ikanban secscan                 # dependencies, committed secrets, risky file permissions
 npx ikanban aiscan --help           # red-team scan of your AI app (OWASP LLM Top 10)
 npx ikanban secscan --publish       # also file the report and findings into iKanban
+npx ikanban infrascan --image app:1 # IaC misconfiguration and container image scan (Trivy)
+npx ikanban dastscan --url URL      # passive web scan of a registered URL (OWASP ZAP in Docker)
+npx ikanban secscan --task IKA-123  # also show the run in that task's Pipelines
 npx ikanban roadmap sync plan.json  # make the Roadmap plan match the plan file
 npx ikanban hooks install           # sync plan files on every agent write and git push
 ```
@@ -23,10 +26,26 @@ exits 1 when the Roadmap differs. With no file it syncs every tracked plan file.
 agent hook for Claude Code, Gemini CLI and Copilot CLI (`.iKanban/hooks/roadmap-sync.js`).
 No CI is needed.
 
+## Infrastructure scans
+
+`infrascan` runs [Trivy](https://github.com/aquasecurity/trivy) on the repository's IaC files
+(`trivy fs --scanners misconfig`) and on each `--image` (`trivy image`). `dastscan` runs the
+[OWASP ZAP](https://www.zaproxy.org/docs/docker/baseline-scan/) baseline scan in Docker: it reads
+the site's responses and does not attack. It scans only a URL the team registered in iKASecure →
+Infrastructure, so it always needs `--team` and a key. Findings show on the Infrastructure tab. A
+missing Trivy or Docker is reported as SKIPPED with the install command, never as a pass.
+
+## Pipelines
+
+Every scanner takes `--task IKA-123` (or `IKANBAN_TASK`) and `--task-team` (default `--team`). The
+run then shows in that task's Pipelines view: running, then passed, failed or skipped with a
+one-line summary, and the masked report as its log. A plan without Pipelines never fails the scan.
+
 ## What you need
 
 - Node.js 18 or newer.
 - Python 3.9 or newer. The scanners are Python; `ikanban` finds `python3`, `python` or `py -3`.
+- `infrascan`: Trivy (macOS `brew install trivy`; other systems: a release binary). `dastscan`: Docker.
 
 ## Free and paid
 

package/bin/ikanban.js

@@ -10,10 +10,12 @@ const { version } = require("../package.json");
 const COMMANDS = {
   aiscan: { file: "ikanban-aiscan.py", about: "Red-team scan of your AI app (OWASP LLM Top 10)" },
   secscan: { file: "ikanban-secscan.py", about: "Dependency, secret and file-permission scan of a repo" },
+  infrascan: { file: "ikanban-infrascan.py", about: "Container image and IaC scan (needs Trivy)" },
+  dastscan: { file: "ikanban-dastscan.py", about: "Passive web scan of a registered URL (needs Docker)" },
 };
 
 function help() {
-  const lines = Object.entries(COMMANDS).map(([n, c]) => `  ${n.padEnd(9)}${c.about}`);
+  const lines = Object.entries(COMMANDS).map(([n, c]) => `  ${n.padEnd(10)}${c.about}`);
   console.log(`ikanban ${version}
 
 Usage: ikanban <command> [options]
@@ -26,7 +28,8 @@ ${lines.join("\n")}
   pipeline Report a task's stage and stream its log to iKanban (any CI)
 
 Run "ikanban <command> --help" for its options. Add --publish to file the
-results into iKanban (needs an API token; the server checks your plan).
+results into iKanban (needs an API token; the server checks your plan), and
+--task IKA-123 to show the run in that task's Pipelines.
 Needs Python 3.9 or newer.`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],

package/scanners/ikanban-aiscan.py

@@ -57,7 +57,7 @@ PROMPTFOO_VERSION = "0.123.1"
 # so this string is the release identity. Bump it when publishing a release —
 # a customer pinning a version is pinning this value, and re-uploading different
 # bytes under a version someone already fetched defeats the sha256 they pinned.
-AISCAN_VERSION = "0.3.2"
+AISCAN_VERSION = "0.4.0"
 
 # The ten categories, their labels, and their plugins -- the forward map, copied
 # from promptfoo's OWASP_LLM_TOP_10_MAPPING (src/redteam/constants/frameworks.ts).
@@ -669,6 +669,132 @@ def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results
         return False, 0, 0
 
 
+# ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
+# Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
+# "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
+# then the report as log chunks. A plan without Pipelines (402) or any error never fails the scan.
+_UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
+PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
+LAST_RUN = {"report": "", "detail": "", "skipped": False}
+
+
+def add_pipeline_args(ap):
+    ap.add_argument("--task", default=os.environ.get("IKANBAN_TASK", ""),
+                    help="Also show this run in the task's Pipelines (a key like IKA-123, or its id; "
+                         "or IKANBAN_TASK)")
+    ap.add_argument("--task-team", default=os.environ.get("IKANBAN_TASK_TEAM", ""),
+                    help="The task's team: id or identifier like IKA (or IKANBAN_TASK_TEAM; default --team)")
+
+
+def summary_detail(counts: dict, total: int, skipped: list) -> str:
+    if skipped and not total and all(s for s in skipped):
+        return ("SKIPPED: " + "; ".join(skipped))[:300]
+    worst = ", ".join(f"{counts[s]} {s}" for s in ("critical", "high", "medium", "low") if counts.get(s))
+    return f"{total} findings" + (f": {worst}" if worst else "")
+
+
+def mask_report(text: str) -> str:
+    """The report is masked already; mask again before it leaves for Pipelines."""
+    scrub = globals().get("scrub_report")
+    if scrub:
+        return scrub(text)[0]
+    text = re.sub(r"\bvk_[A-Za-z0-9_-]{8,}", lambda m: m.group(0)[:4] + "…[hidden]", text)
+    home = str(Path.home())
+    return text.replace(home, "~") if home and home != "/" else text
+
+
+def log_chunks(text: str) -> list:
+    """Whole lines, each chunk under PIPE_CHUNK bytes (a longer single line is cut)."""
+    chunks, cur = [], ""
+    for line in text.splitlines(keepends=True):
+        while len(line.encode()) > PIPE_CHUNK:
+            head = line.encode()[:PIPE_CHUNK].decode(errors="ignore")
+            chunks.append(head)
+            line = line[len(head):]
+        if len((cur + line).encode()) > PIPE_CHUNK:
+            chunks.append(cur)
+            cur = ""
+        cur += line
+    if cur:
+        chunks.append(cur)
+    return chunks
+
+
+class Pipeline:
+    def __init__(self, stage, task, team, base_url, token):
+        self.stage, self.task, self.team, self.base, self.token = stage, task, team, base_url, token
+        self.on = bool(task and team and token)
+        self.tid = None
+
+    def _off(self, why):
+        self.on = False
+        note = "the plan does not include Pipelines" if "402" in str(why) else why
+        print(f"ikanban: Pipelines not updated ({note}); the scan goes on", file=sys.stderr)
+
+    def _call(self, method, path, body=None):
+        try:
+            return api(method, path, self.base, self.token, body)
+        except SystemExit as e:  # ikanban_api refuses a base URL that is not iKanban's
+            return False, str(e)
+
+    def _post(self, path, body):
+        if not self.on:
+            return
+        if self.tid is None:
+            if _UUID.match(self.team):
+                self.tid = self.team
+            else:
+                ok, teams = self._call("GET", "/teams")
+                if not ok:
+                    return self._off(teams)
+                found = [t.get("id") for t in teams or [] if (t.get("identifier") or "").lower() == self.team.lower()]
+                if not found:
+                    return self._off(f"team {self.team} not found among your teams")
+                self.tid = found[0]
+        ok, data = self._call("POST", f"/teams/{self.tid}/{path}", body)
+        if not ok:
+            self._off(data or "this iKanban server has no Pipelines")
+
+    def start(self):
+        self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": "running",
+                                       "source": "laptop", "actor": f"ikanban-{self.stage}"})
+
+    def finish(self, code):
+        status = "failed" if code else ("skipped" if LAST_RUN["skipped"] else "passed")
+        detail = LAST_RUN["detail"] or ("the scan stopped with an error" if code == 2 else "")
+        if code == 1 and not LAST_RUN["skipped"]:
+            detail = (detail + " (at or above --fail-on)").strip()
+        self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": status,
+                                       "source": "laptop", "actor": f"ikanban-{self.stage}",
+                                       "detail": detail[:300] or None})
+        for chunk in log_chunks(mask_report(LAST_RUN["report"])):
+            self._post("pipeline-logs", {"task": self.task, "stage": self.stage, "text": chunk})
+
+
+def run_main(stage, main_fn, argv=None):
+    """main() as it is, wrapped in Pipelines events when --task is given."""
+    raw = sys.argv[1:] if argv is None else argv
+    if any(a in ("-h", "--help", "--version", "--list-apps") for a in raw):
+        return main_fn(argv)
+    pre = argparse.ArgumentParser(add_help=False)
+    pre.add_argument("--task", default=os.environ.get("IKANBAN_TASK", ""))
+    pre.add_argument("--task-team", default=os.environ.get("IKANBAN_TASK_TEAM", ""))
+    pre.add_argument("--team", default=os.environ.get("IKANBAN_TEAM_ID", ""))
+    pre.add_argument("--token", default=os.environ.get("VIBE_API_TOKEN", ""))
+    pre.add_argument("--base-url", default=os.environ.get("IKANBAN_BASE_URL", "https://api.i-kanban.com"))
+    known, _ = pre.parse_known_args(raw)
+    pl = Pipeline(stage, known.task, known.task_team or known.team, known.base_url, known.token)
+    pl.start()
+    try:
+        code = main_fn(argv)
+    except SystemExit as e:
+        if not isinstance(e.code, int):
+            print(e.code, file=sys.stderr)
+        code = e.code if isinstance(e.code, int) else 2
+    pl.finish(code)
+    return code
+
+
 def main(argv=None):
     ap = argparse.ArgumentParser(prog="ikanban aiscan")
     # Lets someone who downloaded a copy tell which release it is, and verify it
@@ -701,6 +827,7 @@ def main(argv=None):
                     help="Permit --config, --html and --out to point outside the working "
                          "directory. Off by default so a mistyped path cannot overwrite "
                          "something elsewhere; turn it on for CI writing to an artifacts dir.")
+    add_pipeline_args(ap)
     args = ap.parse_args(argv)
 
     # Resolve every caller-supplied path up front, before any scanning happens.
@@ -857,6 +984,18 @@ def main(argv=None):
     for label, missing in uncovered:
         log(f"  partial — {label}: {len(missing)} plugin(s) unavailable locally")
 
+    # Plan 11 H12: the Pipelines log (no attack prompts or answers: titles and counts only).
+    counts = {s: sum(1 for f in findings if f["severity"] == s) for s in SEVERITIES}
+    LAST_RUN.update(
+        report="\n".join(
+            [f"# AI endpoint scan — {args.target}", "", f"{len(findings)} finding(s) across {scanned} categories tested"]
+            + [f"- [{f['severity']}] {f['llm_category']}: {f['title']}" for f in findings]
+            + [f"- not covered: {label}" for label in skipped]
+            + [f"- DID NOT RUN: {label}" for label in failed]),
+        detail=summary_detail(counts, len(findings), []) + (f"; {len(failed)} categories did not run" if failed else ""),
+        skipped=scanned == 0 and not findings,
+    )
+
     coverage = {
         "target": args.target,
         "categories_tested": scanned,
@@ -911,4 +1050,4 @@ def main(argv=None):
 
 
 if __name__ == "__main__":
-    sys.exit(main())
+    sys.exit(run_main("aiscan", main))