ikanban 0.4.9 → 0.5.0

package/lib/scanstore.js

@@ -0,0 +1,403 @@
+// Plan 5 X3: the encrypted scan store. A scanner writes its report and raw tool output into a
+// private temp folder; afterwards every file is sealed with AES-256-GCM into
+// ~/.ikanban/scans/<repo>-<8 hex of sha256(repo path)>/<scan id>/ and the temp folder is removed.
+// The key (32 random bytes) lives in the OS keychain: macOS `security`, Windows DPAPI (CurrentUser)
+// through PowerShell, Linux `secret-tool`; else an owner-only file. Node standard library only.
+// The key is never printed, logged, or put on a command line: it travels on stdin and stdout pipes.
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { runCommand } = require("./ikanban-safe.js");
+
+const SERVICE = "ikanban-scan-store";
+const ACCOUNT = "ikanban";
+const MAGIC = Buffer.from("IKS1");
+const SCAN_ID = /^[a-z]+-[0-9A-Za-z-]+$/;
+const OLD_SCAN_DIR = /^(secscan|aiscan|infrascan|dastscan|cloudscan|controlscan|import)-\d{8}-\d{6}$/;
+const BAD_SEAL = "cannot decrypt: the stored file was changed, or the key is not the one that sealed it";
+
+class ScanStoreError extends Error {}
+
+function newScanId(scanner, now = new Date()) {
+  const t = now.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  return `${scanner}-${t}`;
+}
+
+function repoDirName(repoPath) {
+  const abs = path.resolve(repoPath);
+  const digest = crypto.createHash("sha256").update(abs).digest("hex").slice(0, 8);
+  const name = (path.basename(abs) || "root").replace(/[^A-Za-z0-9._-]+/g, "_");
+  return `${name}-${digest}`;
+}
+
+function mkdirPrivate(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.chmodSync(dir, 0o700); // mkdir's mode is masked by umask
+}
+
+function writePrivate(file, data) {
+  fs.writeFileSync(file, data, { mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+}
+
+// ── key stores: get() → Buffer | null, set(Buffer) ─────────────────────────────
+function checkKey(buf, where) {
+  if (!buf || buf.length !== 32) throw new ScanStoreError(`the scan store key in ${where} is not 32 bytes`);
+  return buf;
+}
+
+function fileKeyStore(home, note = (l) => console.error(l)) {
+  const file = path.join(home, ".ikanban", "scan-store.key");
+  return {
+    kind: "file",
+    get() {
+      if (!fs.existsSync(file)) return null;
+      return checkKey(Buffer.from(fs.readFileSync(file, "utf8").trim(), "hex"), file);
+    },
+    set(key) {
+      mkdirPrivate(path.dirname(file));
+      fs.writeFileSync(file, key.toString("hex"), { mode: 0o600, flag: "wx" });
+      fs.chmodSync(file, 0o600);
+      note(`ikanban: the scan store key is a file (${file}, owner only): no OS keychain was found on this machine.`);
+    },
+  };
+}
+
+function macKeyStore() {
+  return {
+    kind: "macos-keychain",
+    get() {
+      const r = runCommand("security", ["find-generic-password", "-s", SERVICE, "-a", ACCOUNT, "-w"], { encoding: "utf8" });
+      if (r.status !== 0) return null;
+      return checkKey(Buffer.from(r.stdout.trim(), "hex"), "the macOS keychain");
+    },
+    set(key) {
+      // `security -i` reads its command from stdin, so the key is never in the process list.
+      const r = runCommand("security", ["-i"], {
+        input: `add-generic-password -U -s ${SERVICE} -a ${ACCOUNT} -w ${key.toString("hex")}\n`, encoding: "utf8",
+      });
+      if (r.status !== 0) throw new ScanStoreError("the macOS keychain refused the scan store key");
+    },
+  };
+}
+
+function linuxKeyStore() {
+  return {
+    kind: "secret-tool",
+    get() {
+      const r = runCommand("secret-tool", ["lookup", "service", SERVICE], { encoding: "utf8" });
+      if (r.status !== 0 || !r.stdout.trim()) return null;
+      return checkKey(Buffer.from(r.stdout.trim(), "hex"), "secret-tool");
+    },
+    set(key) {
+      const r = runCommand("secret-tool", ["store", "--label", "ikanban scan store", "service", SERVICE], {
+        input: key.toString("hex"), encoding: "utf8",
+      });
+      if (r.status !== 0) throw new ScanStoreError("secret-tool could not store the scan store key (no keyring running?)");
+    },
+  };
+}
+
+const PS_PROTECT = "Add-Type -AssemblyName System.Security; $d=[Convert]::FromBase64String([Console]::In.ReadToEnd().Trim()); " +
+  "$p=[System.Security.Cryptography.ProtectedData]::Protect($d,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser); " +
+  "[Console]::Out.Write([Convert]::ToBase64String($p))";
+const PS_UNPROTECT = PS_PROTECT.replace("]::Protect(", "]::Unprotect(");
+
+function powershell(script, input) {
+  const r = runCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { input, encoding: "utf8" });
+  if (r.status !== 0) throw new ScanStoreError("Windows DPAPI (PowerShell) could not handle the scan store key");
+  return r.stdout.trim();
+}
+
+function windowsKeyStore(home) {
+  const file = path.join(home, ".ikanban", "scan-store.key.dpapi");
+  return {
+    kind: "windows-dpapi",
+    get() {
+      if (!fs.existsSync(file)) return null;
+      return checkKey(Buffer.from(powershell(PS_UNPROTECT, fs.readFileSync(file, "utf8").trim()), "base64"), file);
+    },
+    set(key) {
+      const blob = powershell(PS_PROTECT, key.toString("base64"));
+      mkdirPrivate(path.dirname(file));
+      writePrivate(file, blob);
+    },
+  };
+}
+
+function hasTool(tool) {
+  const r = runCommand(process.platform === "win32" ? "where" : "which", [tool], { encoding: "utf8" });
+  return r.status === 0;
+}
+
+function pickKeyStoreKind(platform, has) {
+  if (platform === "darwin") return "macos-keychain";
+  if (platform === "win32") return "windows-dpapi";
+  if (platform === "linux" && has("secret-tool")) return "secret-tool";
+  return "file";
+}
+
+/** The OS key store, falling back to the key file when the keychain tool fails. */
+function osKeyStore(home) {
+  const file = fileKeyStore(home);
+  if (process.env.IKANBAN_SCAN_STORE === "file") return file; // CI runners and tests: no keychain
+  const kind = pickKeyStoreKind(process.platform, hasTool);
+  const main = { "macos-keychain": macKeyStore, "windows-dpapi": () => windowsKeyStore(home), "secret-tool": linuxKeyStore }[kind];
+  if (!main) return file;
+  const ks = main();
+  return {
+    kind,
+    get() {
+      return file.get() || ks.get(); // a key file exists only after the keychain failed once
+    },
+    set(key) {
+      try {
+        ks.set(key);
+        if (!checkKey(ks.get(), kind).equals(key)) throw new ScanStoreError(`${kind} gave back a different key`);
+      } catch {
+        file.set(key); // prints the one-line note that the key is a file
+      }
+    },
+  };
+}
+
+// ── the store ───────────────────────────────────────────────────────────────────
+function listFiles(dir, base = dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...listFiles(full, base));
+    else if (entry.isFile()) out.push(path.relative(base, full).split(path.sep).join("/"));
+  }
+  return out;
+}
+
+function aad(scanId, name) {
+  return Buffer.from(`${scanId}\0${name}`, "utf8");
+}
+
+function createStore({ home = os.homedir(), keyStore = null } = {}) {
+  const root = path.join(home, ".ikanban", "scans");
+  const ks = keyStore || osKeyStore(home);
+  let cached = null;
+
+  function key(create) {
+    if (cached) return cached;
+    let k = ks.get();
+    if (!k && create) {
+      k = crypto.randomBytes(32);
+      ks.set(k);
+    }
+    if (!k) throw new ScanStoreError("no scan store key on this machine: scans sealed elsewhere cannot be opened here");
+    cached = checkKey(k, ks.kind);
+    return cached;
+  }
+
+  function makeTempDir() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ikanban-scan-"));
+    fs.chmodSync(dir, 0o700);
+    return dir;
+  }
+
+  function seal(srcDir, { scanner, scanId, repoPath }) {
+    if (!SCAN_ID.test(scanId)) throw new ScanStoreError(`not a scan id: ${scanId}`);
+    const names = listFiles(srcDir);
+    const k = key(true);
+    const repoDir = path.join(root, repoDirName(repoPath));
+    const dest = path.join(repoDir, scanId);
+    if (fs.existsSync(dest)) throw new ScanStoreError(`a scan named ${scanId} is already stored`);
+    const partial = path.join(repoDir, `.${scanId}.partial`);
+    fs.rmSync(partial, { recursive: true, force: true });
+    mkdirPrivate(root);
+    mkdirPrivate(repoDir);
+    mkdirPrivate(partial);
+    const files = names.map((name, i) => {
+      const plain = fs.readFileSync(path.join(srcDir, ...name.split("/")));
+      const iv = crypto.randomBytes(12);
+      const c = crypto.createCipheriv("aes-256-gcm", k, iv);
+      c.setAAD(aad(scanId, name));
+      const ct = Buffer.concat([c.update(plain), c.final()]);
+      const blob = `${String(i + 1).padStart(4, "0")}.bin`;
+      writePrivate(path.join(partial, blob), Buffer.concat([MAGIC, iv, c.getAuthTag(), ct]));
+      return { name, size: plain.length, blob };
+    });
+    const manifest = { version: 1, scan_id: scanId, scanner, repo_path: path.resolve(repoPath), created: new Date().toISOString(), files };
+    writePrivate(path.join(partial, "manifest.json"), JSON.stringify(manifest, null, 2));
+    fs.renameSync(partial, dest);
+    fs.rmSync(srcDir, { recursive: true, force: true });
+    return dest;
+  }
+
+  function manifests() {
+    if (!fs.existsSync(root)) return [];
+    const out = [];
+    for (const repo of fs.readdirSync(root)) {
+      const repoDir = path.join(root, repo);
+      if (!fs.statSync(repoDir).isDirectory()) continue;
+      for (const id of fs.readdirSync(repoDir)) {
+        const mfile = path.join(repoDir, id, "manifest.json");
+        if (id.startsWith(".") || !fs.existsSync(mfile)) continue;
+        try {
+          const m = JSON.parse(fs.readFileSync(mfile, "utf8"));
+          out.push({ id, repo, dir: path.join(repoDir, id), scanner: m.scanner, created: m.created, repoPath: m.repo_path, files: m.files || [] });
+        } catch {
+          out.push({ id, repo, dir: path.join(repoDir, id), scanner: "?", created: "", repoPath: "", files: [], broken: true });
+        }
+      }
+    }
+    return out.sort((a, b) => String(b.created).localeCompare(String(a.created)));
+  }
+
+  function list(repoPath) {
+    const all = manifests();
+    return repoPath ? all.filter((m) => m.repo === repoDirName(repoPath)) : all;
+  }
+
+  function find(id, repoPath) {
+    const hits = list(repoPath).filter((m) => m.id === id);
+    if (!hits.length) throw new ScanStoreError(`no scan ${id} in ${root} (see: ikanban scans list)`);
+    if (hits.length > 1) throw new ScanStoreError(`${id} is stored for ${hits.length} repositories; add --repo PATH`);
+    if (hits[0].broken) throw new ScanStoreError(`the manifest of ${id} cannot be read`);
+    return hits[0];
+  }
+
+  function read(id, name, repoPath) {
+    const m = find(id, repoPath);
+    const entry = m.files.find((f) => f.name === name);
+    if (!entry) throw new ScanStoreError(`${id} has no file ${name}; it has: ${m.files.map((f) => f.name).join(", ")}`);
+    if (!/^\d{4}\.bin$/.test(entry.blob || "")) throw new ScanStoreError(`the manifest of ${id} is damaged`);
+    const data = fs.readFileSync(path.join(m.dir, entry.blob));
+    if (data.length < 32 || !data.subarray(0, 4).equals(MAGIC)) throw new ScanStoreError(BAD_SEAL);
+    try {
+      const d = crypto.createDecipheriv("aes-256-gcm", key(false), data.subarray(4, 16));
+      d.setAAD(aad(id, name));
+      d.setAuthTag(data.subarray(16, 32));
+      return Buffer.concat([d.update(data.subarray(32)), d.final()]);
+    } catch (e) {
+      if (e instanceof ScanStoreError) throw e;
+      throw new ScanStoreError(BAD_SEAL);
+    }
+  }
+
+  /** Run a scanner with IKANBAN_SCAN_DIR / IKANBAN_SCAN_ID set, then seal what it wrote. */
+  function runSealed({ scanner, repoPath, run, now = new Date(), log = (l) => console.error(l), extraDirs = () => [] }) {
+    const scanId = newScanId(scanner, now);
+    const dir = makeTempDir();
+    let status;
+    try {
+      status = run({ IKANBAN_SCAN_DIR: dir, IKANBAN_SCAN_ID: scanId });
+    } finally {
+      try {
+        for (const extra of extraDirs()) {
+          fs.cpSync(extra, dir, { recursive: true }); // the --work-dir run folder becomes the scan root
+          fs.rmSync(extra, { recursive: true, force: true });
+        }
+        if (listFiles(dir).length) {
+          seal(dir, { scanner, scanId, repoPath });
+        } else {
+          fs.rmSync(dir, { recursive: true, force: true });
+        }
+      } catch (e) {
+        log(`ikanban: the scan files were NOT sealed (${e.message}); they are still in ${dir}`);
+      }
+    }
+    return status === null || status === undefined ? 1 : status;
+  }
+
+  /** Seal old plain <repo>/.iKanban/scans/<scanner>-* folders and remove them. */
+  function migrate(repoPath) {
+    const scans = path.join(path.resolve(repoPath), ".iKanban", "scans");
+    if (!fs.existsSync(scans)) return [];
+    const done = [];
+    for (const entry of fs.readdirSync(scans, { withFileTypes: true })) {
+      if (!entry.isDirectory() || !OLD_SCAN_DIR.test(entry.name)) continue;
+      seal(path.join(scans, entry.name), { scanner: entry.name.split("-")[0], scanId: entry.name, repoPath });
+      done.push(entry.name);
+    }
+    return done.sort();
+  }
+
+  return { root, keyStore: ks, makeTempDir, seal, list, read, find, runSealed, migrate };
+}
+
+// ── `ikanban scans …` ───────────────────────────────────────────────────────────
+function option(args, name) {
+  const i = args.indexOf(name);
+  if (i >= 0) return args[i + 1];
+  const eq = args.find((a) => a.startsWith(`${name}=`));
+  return eq ? eq.slice(name.length + 1) : undefined;
+}
+
+function positional(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    if (["--repo", "--out", "--path"].includes(args[i])) i++;
+    else if (!args[i].startsWith("--")) out.push(args[i]);
+  }
+  return out;
+}
+
+const SCANS_HELP = `Usage:
+  ikanban scans list [--repo PATH | --all]      stored scans of a repository (default: this folder)
+  ikanban scans show <id> [file] [--out FILE]   decrypt a file to the terminal (default report.md)
+  ikanban scans migrate [--path PATH]           seal old .iKanban/scans folders and remove the plain copies
+
+Scans are stored encrypted in ~/.ikanban/scans; the key stays in this machine's keychain.`;
+
+function run(args, { store = null, out = process.stdout } = {}) {
+  const [sub, ...rest] = args;
+  if (!sub || sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(SCANS_HELP);
+    return 0;
+  }
+  try {
+    const s = store || createStore();
+    if (sub === "list") {
+      const rows = s.list(rest.includes("--all") ? undefined : option(rest, "--repo") || process.cwd());
+      if (!rows.length) {
+        console.log("no scans stored for this repository (run a scan, or: ikanban scans list --all)");
+        return 0;
+      }
+      for (const r of rows) {
+        const size = r.files.reduce((n, f) => n + (f.size || 0), 0);
+        console.log(`${r.id.padEnd(34)} ${String(r.created).slice(0, 19).padEnd(20)} ${String(r.files.length).padStart(3)} files ${String(size).padStart(9)} B  ${r.repoPath}`);
+      }
+      return 0;
+    }
+    if (sub === "show") {
+      const [id, file] = positional(rest);
+      if (!id) throw new ScanStoreError("give a scan id: ikanban scans show <id> [file]");
+      const repo = option(rest, "--repo");
+      const m = s.find(id, repo);
+      const name = file || ["report.md", "report.html"].find((n) => m.files.some((f) => f.name === n));
+      if (!name) {
+        console.log(`${id} holds: ${m.files.map((f) => f.name).join(", ")}\nShow one: ikanban scans show ${id} <file>`);
+        return 0;
+      }
+      const data = s.read(id, name, repo);
+      const target = option(rest, "--out");
+      if (target) {
+        writePrivate(path.resolve(target), data);
+        console.error(`wrote ${name} to ${path.resolve(target)}`);
+      } else {
+        out.write(data);
+      }
+      return 0;
+    }
+    if (sub === "migrate") {
+      const repo = option(rest, "--path") || process.cwd();
+      const ids = s.migrate(repo);
+      console.log(ids.length ? `sealed and removed ${ids.length} plain scan folder(s): ${ids.join(", ")}` : `no old scan folders in ${path.join(path.resolve(repo), ".iKanban", "scans")}`);
+      return 0;
+    }
+    throw new ScanStoreError(`unknown subcommand "${sub}"\n${SCANS_HELP}`);
+  } catch (e) {
+    console.error(`ikanban scans: ${e instanceof ScanStoreError ? e.message : e.message}`);
+    return 1;
+  }
+}
+
+module.exports = {
+  ScanStoreError, newScanId, repoDirName, createStore, fileKeyStore, osKeyStore, pickKeyStoreKind, run,
+};

package/lib/statuswords.js

@@ -0,0 +1,13 @@
+// The Roadmap's status words, shared by the sync (roadmap.js) and the plan check (plancheck.js),
+// so a plan that passes the check is a plan the sync accepts. No other require: the plan gate
+// loads plancheck.js from a plain checkout, where the copied ikanban-safe.js may be missing.
+const TASK_STATUS = {
+  done: "done", complete: "done", completed: "done",
+  in_progress: "inprogress", inprogress: "inprogress", "in-progress": "inprogress", started: "inprogress",
+  in_review: "inreview", inreview: "inreview", review: "inreview",
+  pending: "todo", todo: "todo", waiting: "todo", deferred: "todo", blocked: "todo",
+  cancelled: "cancelled", canceled: "cancelled", skipped: "cancelled", dropped: "cancelled",
+};
+const PHASE_STATUS = { done: "done", in_progress: "in_progress", inprogress: "in_progress", "in-progress": "in_progress" };
+
+module.exports = { TASK_STATUS, PHASE_STATUS };

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "ikanban",
-  "version": "0.4.9",
-  "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
+  "version": "0.5.0",
+  "description": "iKanban CLI: AI and security scans of your own repo; findings filed into iKanban, reports kept encrypted on your machine",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],
   "scripts": {
     "prepack": "node scripts/copy-scanners.js",
     "pretest": "node scripts/copy-scanners.js",
-    "test": "node --test test/cli.test.js test/safe.test.js test/roadmap.test.js test/pipeline.test.js"
+    "test": "node --test test/cli.test.js test/safe.test.js test/roadmap.test.js test/pipeline.test.js test/scanstore.test.js test/trace.test.js test/deploy-check.test.js test/plan-check.test.js test/plan-gate.test.js"
   },
   "engines": { "node": ">=18" },
   "homepage": "https://i-kanban.com",

package/scanners/ikanban-aiscan.py

@@ -686,11 +686,27 @@ def api(method: str, path: str, base_url: str, token: str, payload=None):
         return False, str(e)
 
 
+AI_EVIDENCE = ("attack_prompt", "model_response", "grader_reason")
+AI_EVIDENCE_MAX = 2000  # plan 5 D3: evidence is sent scrubbed and cut to 2,000 characters
+
+
+def findings_payload(findings):
+    """The findings --publish sends: every text field through scrub_text, evidence cut (plan 5 X2)."""
+    out = []
+    for f in findings:
+        f = scrub_finding(f)
+        for key in AI_EVIDENCE:
+            if isinstance(f.get(key), str):
+                f[key] = f[key][:AI_EVIDENCE_MAX]
+        out.append(f)
+    return out
+
+
 def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results):
     payload = {
         "scan_run_id": run_id,
         "scanned_at": datetime.now(timezone.utc).isoformat(),
-        "findings": findings,
+        "findings": findings_payload(findings),
         # Sent even when findings is empty. A clean scan that records nothing is
         # indistinguishable from never having scanned, and "0 findings" means
         # something different at 17 plugins than at 2.
@@ -776,9 +792,21 @@ def add_work_dir_arg(ap):
     ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
                     help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
                          "<repository>/.iKanban/scans)")
+    ap.add_argument("--print-report", action="store_true",
+                    help="Print the full report on stdout (under the ikanban CLI stdout otherwise shows the "
+                         "counts and `ikanban scans show <id>`)")
 
 
 def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    # Plan 5 X3: the ikanban CLI hands over a private temp folder (IKANBAN_SCAN_DIR) and the scan id
+    # (IKANBAN_SCAN_ID). That folder is this run's folder; the CLI seals it into ~/.ikanban/scans.
+    cli_dir = os.environ.get("IKANBAN_SCAN_DIR", "")
+    if override and cli_dir and os.environ.get("IKANBAN_SCAN_ID") and (
+            Path(override).expanduser().resolve() == Path(cli_dir).expanduser().resolve()):
+        run_dir = Path(cli_dir).expanduser().resolve()
+        run_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+        os.chmod(run_dir, 0o700)
+        return run_dir
     scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
     scans.mkdir(parents=True, exist_ok=True)
     ignore = scans / ".gitignore"
@@ -804,14 +832,72 @@ def slug(text: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
 
 
+# ── scrub_text: identical in every scanner (test_scrub_text.py compares the copies) ──────────
+# Plan 5 X2-T1: every text field of every finding passes through scrub_text before it leaves this
+# machine. A secret keeps its first 4 characters; a home folder becomes ~. The server scrubs again.
+_SCRUB_CUT = (
+    re.compile(r"-{5}BEGIN [A-Z ]*PRIVATE KEY-{5}.*?(?:-{5}END [A-Z ]*PRIVATE KEY-{5}|\Z)", re.S),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b"),
+    re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}\b"),
+    re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"),
+    re.compile(r"\bxox[abposr]-[A-Za-z0-9-]{10,}\b"),
+    re.compile(r"\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b"),
+    re.compile(r"\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,}\b"),
+    re.compile(r"\bwhsec_[A-Za-z0-9]{16,}\b"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"),
+    re.compile(r"\bvk_[A-Za-z0-9_-]{8,}"),
+)
+_SCRUB_ASSIGNED = re.compile(
+    r"(?i)(\b(?:aws_secret_access_key|aws_session_token|client_secret|secret_key|private_key|api[_-]?key|"
+    r"access[_-]?token|auth[_-]?token|token|password|passwd|pwd|secret)\b[\"']?\s*[:=]\s*[\"']?)([^\s\"',;&]+)")
+_SCRUB_BEARER = re.compile(r"(?i)(\b(?:bearer|basic)\s+)([A-Za-z0-9._~+/=-]{12,})")
+_SCRUB_URL_CREDS = re.compile(r"(\b[a-z][a-z0-9+.-]*://[^\s/:@]+:)([^\s@/]+)(@)")
+_SCRUB_HOME = re.compile(r"(?<![\w.-])(?:[A-Za-z]:\\[Uu]sers\\|/Users/|/home/)[^\\/\s\"'<>]+")
+
+
+def scrub_text(text) -> str:
+    """Secrets, iKanban keys, tokens, AWS and GitHub keys, private key blocks and home folders
+    cut from one text. None becomes ""."""
+    if text is None:
+        return ""
+    text = str(text)
+    for rx in _SCRUB_CUT:
+        text = rx.sub(lambda m: m.group(0)[:4] + "…[hidden]", text)
+    text = _SCRUB_ASSIGNED.sub(
+        lambda m: m.group(1) + "[hidden]" if len(m.group(2)) >= 8 or any(c.isdigit() for c in m.group(2))
+        else m.group(0), text)
+    text = _SCRUB_BEARER.sub(lambda m: m.group(1) + "[hidden]", text)
+    text = _SCRUB_URL_CREDS.sub(lambda m: m.group(1) + "[hidden]" + m.group(3), text)
+    home = str(Path.home())
+    if home and home not in ("/", "\\") and home in text:
+        text = text.replace(home, "~")
+    return _SCRUB_HOME.sub("~", text)
+
+
+def scrub_finding(value):
+    """scrub_text on every string in a finding, through nested dicts and lists; other values stay."""
+    if isinstance(value, str):
+        return scrub_text(value)
+    if isinstance(value, dict):
+        return {k: scrub_finding(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [scrub_finding(v) for v in value]
+    return value
+
+
+# ── end scrub_text ──
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
-# then the report as log chunks. A plan without Pipelines (402) or any error never fails the scan.
+# then that line as the log (plan 5: never the report). A plan without Pipelines (402) or any error never fails the scan.
 _UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
 # Every iKanban scanner reports into one named lane, not the server's "legacy" lane.
 PIPE_RUN = "security-scan"
-PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
+PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per log line
 LAST_RUN = {"report": "", "detail": "", "skipped": False}
 
 
@@ -831,39 +917,40 @@ def summary_detail(counts: dict, total: int, skipped: list) -> str:
 
 
 def mask_report(text: str) -> str:
-    """The report is masked already; mask again before it leaves for Pipelines."""
+    """scrub_text before a line leaves for Pipelines, plus a scanner's own rules (scrub_report)."""
+    text = scrub_text(text)
     scrub = globals().get("scrub_report")
-    if scrub:
-        return scrub(text)[0]
-    text = re.sub(r"\bvk_[A-Za-z0-9_-]{8,}", lambda m: m.group(0)[:4] + "…[hidden]", text)
-    home = str(Path.home())
-    return text.replace(home, "~") if home and home != "/" else text
-
-
-def log_chunks(text: str) -> list:
-    """Whole lines, each chunk under PIPE_CHUNK bytes (a longer single line is cut)."""
-    chunks, cur = [], ""
-    for line in text.splitlines(keepends=True):
-        while len(line.encode()) > PIPE_CHUNK:
-            head = line.encode()[:PIPE_CHUNK].decode(errors="ignore")
-            chunks.append(head)
-            line = line[len(head):]
-        if len((cur + line).encode()) > PIPE_CHUNK:
-            chunks.append(cur)
-            cur = ""
-        cur += line
-    if cur:
-        chunks.append(cur)
-    return chunks
+    return scrub(text)[0] if scrub else text
+
+
+def show_report(md: str, summary: str, print_report: bool = False) -> None:
+    """Plan 5 X3: under the ikanban CLI (IKANBAN_SCAN_ID set) stdout gets the counts and where the
+    full report is stored; the body only with --print-report. A plain python run prints the body."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    if scan_id and not print_report:
+        print(summary)
+        print(f"Full report: ikanban scans show {scan_id}")
+    else:
+        print(md)
+
+
+def scan_files_note(work: Path) -> str:
+    """Where this run's files are: the encrypted store under the CLI, else the run folder."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    return f"scan files: sealed into ~/.ikanban/scans as {scan_id}" if scan_id else f"scan files: {work}"
+
+
 
 # The running Pipeline (set by run_main with --task). Owner: Pipelines showed nothing while a
-# scan ran, so each step also sends one line as it starts and ends; the full report follows at the end.
+# scan ran, so each step also sends one line as it starts and ends; the one-line summary follows at the end.
 # Progress lines are fixed status text: never raw tool output or an error body (it can carry
 # secrets or text an attacker wrote). Those stay on local stderr and in the masked report.
 PIPE = None
 
 
 def progress(text: str) -> None:
+    if os.environ.get("IKANBAN_SCAN_ID") and "--json" not in sys.argv:
+        print(text, flush=True)  # Plan 5: under the CLI stdout shows progress, not the report
     if PIPE:
         PIPE.log(text)
 
@@ -921,8 +1008,10 @@ class Pipeline:
         self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": status,
                                        "run": PIPE_RUN, "source": "laptop", "actor": f"ikanban-{self.stage}",
                                        "detail": detail[:300] or None})
-        for chunk in log_chunks(mask_report(LAST_RUN["report"])):
-            self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage, "text": chunk})
+        # Plan 5 X1-T2: the summary only; the report stays on the machine that ran the scan.
+        summary = f"{self.stage} {status}" + (f": {detail[:300]}" if detail else "")
+        self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage,
+                                     "text": mask_report(summary) + "\n"})
 
 
 def run_main(stage, main_fn, argv=None):
@@ -1171,7 +1260,7 @@ def main(argv=None):
         skipped=scanned == 0 and not findings,
     )
     write_private(workdir / "report.md", LAST_RUN["report"])
-    log(f"scan files: {workdir}")
+    log(scan_files_note(workdir))
 
     coverage = {
         "target": args.target,
@@ -1197,6 +1286,8 @@ def main(argv=None):
         )
         log(f"wrote {args.out}")
 
+    if os.environ.get("IKANBAN_SCAN_ID") or args.print_report:
+        show_report(LAST_RUN["report"], LAST_RUN["detail"], args.print_report)
     if args.dry_run:
         print(json.dumps({"scan_run_id": run_id, "coverage": coverage, "findings": findings}, indent=2))
     elif args.publish: