ikanban 0.4.3 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],

package/scanners/ikanban-aiscan.py

@@ -57,7 +57,7 @@ PROMPTFOO_VERSION = "0.123.1"
 # so this string is the release identity. Bump it when publishing a release —
 # a customer pinning a version is pinning this value, and re-uploading different
 # bytes under a version someone already fetched defeats the sha256 they pinned.
-AISCAN_VERSION = "0.6.0"
+AISCAN_VERSION = "0.6.1"
 
 # The ten categories, their labels, and their plugins -- the forward map, copied
 # from promptfoo's OWASP_LLM_TOP_10_MAPPING (src/redteam/constants/frameworks.ts).
@@ -356,9 +356,15 @@ def build_config(target, spec, plugins, num_tests, base_url, token, workspace_id
     }
 
 
-def run_promptfoo(args, cwd, allow_remote):
+def run_promptfoo(args, cwd, allow_remote, openai=None):
     cmd = ["npx", "-y", f"promptfoo@{PROMPTFOO_VERSION}"] + args
     env = dict(os.environ)
+    # G22: openai_env's names; None removes a name from promptfoo's environment.
+    for name, value in (openai or {}).items():
+        if value is None:
+            env.pop(name, None)
+        else:
+            env[name] = value
     if not allow_remote:
         # Pinned here rather than left to the caller's shell. promptfoo decides
         # remote-vs-local by looking for OPENAI_API_KEY (shouldGenerateRemote in
@@ -403,7 +409,7 @@ def config_secrets(node) -> set:
     return {x for x in out if len(x) >= 8}
 
 
-def scan_category(label, target, cfg, workdir, allow_remote):
+def scan_category(label, target, cfg, workdir, allow_remote, openai=None):
     """generate + eval one category. Returns (findings, plugins_that_ran, errors).
 
     Plan 11 H12-T10 review: promptfoo's config and cases hold the iKanban token, so they live
@@ -412,12 +418,12 @@ def scan_category(label, target, cfg, workdir, allow_remote):
     replaced, are copied into the scan's work folder."""
     private = Path(tempfile.mkdtemp(prefix="ikanban-aiscan-"))  # mkdtemp creates it 0700
     try:
-        return _scan_category(label, target, cfg, workdir, allow_remote, private)
+        return _scan_category(label, target, cfg, workdir, allow_remote, private, openai)
     finally:
         shutil.rmtree(private, ignore_errors=True)
 
 
-def _scan_category(label, target, cfg, workdir, allow_remote, private):
+def _scan_category(label, target, cfg, workdir, allow_remote, private, openai=None):
     cfg_path = private / "config.yaml"
     cases_path = private / "cases.yaml"
     out_path = private / "results.json"
@@ -428,7 +434,7 @@ def _scan_category(label, target, cfg, workdir, allow_remote, private):
     cfg_path.write_text(json.dumps(cfg, indent=2), encoding="utf-8")
 
     if not run_promptfoo(
-        ["redteam", "generate", "-c", str(cfg_path), "-o", str(cases_path)], private, allow_remote
+        ["redteam", "generate", "-c", str(cfg_path), "-o", str(cases_path)], private, allow_remote, openai
     ):
         return None
     if not cases_path.exists():
@@ -438,7 +444,7 @@ def _scan_category(label, target, cfg, workdir, allow_remote, private):
     # tests failed, i.e. attacks got through, i.e. exactly the findings we came
     # for. The results file decides, not the exit code.
     run_promptfoo(
-        ["redteam", "eval", "-c", str(cases_path), "-o", str(out_path), "--no-cache"], private, allow_remote
+        ["redteam", "eval", "-c", str(cases_path), "-o", str(out_path), "--no-cache"], private, allow_remote, openai
     )
     if not out_path.exists():
         log("  promptfoo wrote no results file — the run genuinely failed")
@@ -446,7 +452,9 @@ def _scan_category(label, target, cfg, workdir, allow_remote, private):
 
     raw = out_path.read_text(encoding="utf-8")
     redacted = raw
-    for secret in sorted(config_secrets(cfg), key=len, reverse=True):
+    # G22: the iKanban key promptfoo sends to the relay is hidden like the config's own.
+    relay_key = (openai or {}).get("OPENAI_API_KEY")
+    for secret in sorted(config_secrets(cfg) | ({relay_key} if relay_key else set()), key=len, reverse=True):
         redacted = redacted.replace(secret, "[hidden]")
     write_private(workdir / f"results-{re.sub(r'[^A-Za-z0-9_-]+', '_', label)}.json", redacted)
     doc = json.loads(raw)
@@ -701,6 +709,43 @@ def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results
         return False, 0, 0
 
 
+# G22 (owner): the attacks are made with the team's OpenAI key kept in iKanban. The key
+# stays on the server: promptfoo's OpenAI base URL is iKanban's relay, which adds the key and
+# forwards only the OpenAI calls promptfoo makes. promptfoo 0.123.1 reads OPENAI_API_HOST
+# first, then OPENAI_API_BASE_URL, then OPENAI_BASE_URL (OpenAiGenericProvider.getApiUrl).
+NO_OPENAI_KEY = ("AI endpoints skipped: no OpenAI key. Add the team's OpenAI key in iKanban "
+                 "(Settings → AI Provider Keys), or set OPENAI_API_KEY in the shell that runs the scan.")
+NO_AI_PLAN = "AI endpoints skipped: the team's plan has no AI findings (Pro+)."
+
+
+def openai_env(environ, base_url, token, team):
+    """(promptfoo env changes, None) to scan, or (None, the SKIPPED line). A shell key wins."""
+    if environ.get("OPENAI_API_KEY"):
+        return {}, None
+    if not (token and team):
+        return None, NO_OPENAI_KEY
+    relay = f"{ikanban_api(base_url)}/api/teams/{urllib.parse.quote(team, safe='')}/security/ai-relay"
+    req = urllib.request.Request(relay, headers={"Authorization": f"Bearer {token}"})
+    try:
+        with _OPENER.open(req, timeout=30) as resp:
+            body = json.loads(resp.read().decode())
+    except urllib.error.HTTPError as exc:
+        if exc.code == 402:
+            return None, NO_AI_PLAN
+        return None, f"AI endpoints skipped: iKanban answered {exc.code} for the team's OpenAI key."
+    except (urllib.error.URLError, ValueError) as exc:
+        return None, f"AI endpoints skipped: could not reach iKanban for the team's OpenAI key ({type(exc).__name__})."
+    if not body.get("data", body).get("openai_key"):
+        return None, NO_OPENAI_KEY
+    return {
+        "OPENAI_API_HOST": None,
+        "OPENAI_API_BASE_URL": f"{relay}/v1",
+        "OPENAI_BASE_URL": f"{relay}/v1",
+        # The iKanban key, sent only to the relay above (iKanban's API, T3).
+        "OPENAI_API_KEY": token,
+    }, None
+
+
 # ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
 # <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
 # holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
@@ -909,7 +954,8 @@ def main(argv=None):
     ap.add_argument("--allow-remote-generation", action="store_true",
                     help="Let promptfoo generate attacks on its hosted service. Off by default: "
                          "it needs an email registered with promptfoo, and it sends the purpose "
-                         "string off this machine. Local generation needs OPENAI_API_KEY instead.")
+                         "string off this machine. Local generation uses OPENAI_API_KEY from the shell, "
+                         "else the team's OpenAI key in iKanban through its relay.")
     ap.add_argument("--dry-run", action="store_true", help="Print the payload, POST nothing")
     ap.add_argument("--allow-outside-cwd", action="store_true",
                     help="Permit --config, --html and --out to point outside the working "
@@ -980,6 +1026,15 @@ def main(argv=None):
         log(f"error: unknown collection {args.plugins!r}")
         return 2
 
+    openai = None
+    if not args.allow_remote_generation:
+        openai, why = openai_env(os.environ, args.base_url, args.token, args.team)
+        if openai is None:
+            log(why)
+            progress(why)
+            LAST_RUN.update(report=f"# AI endpoint scan — {args.target}\n\n{why}", detail=why[:300], skipped=True)
+            return 0
+
     # MEASURED 2026-09-20, promptfoo 0.123.1: of the MCP plugin set, only `rbac`
     # generates locally. `mcp` itself, `bfla` and `bola` all require promptfoo's
     # hosted generator and produce zero tests without it -- so a local-only MCP
@@ -1018,7 +1073,7 @@ def main(argv=None):
         progress(f"{label} started · {len(plugins)} plugins, {args.num_tests} tests each")
         cfg = build_config(args.target, spec, plugins, args.num_tests,
                            args.base_url, args.token, args.workspace_id)
-        got = scan_category(label, args.target, cfg, workdir, args.allow_remote_generation)
+        got = scan_category(label, args.target, cfg, workdir, args.allow_remote_generation, openai)
         if got is None:
             progress(f"{label} finished · did not run")
             failed.append(label)