ikanban 0.4.9 → 0.5.0

package/scanners/ikanban-infrascan.py

@@ -6,7 +6,7 @@ repository and images, reporting into iKanban's Infrastructure tab (plan 11 H12)
     npx ikanban infrascan                          # inventory + IaC scan of cwd
     npx ikanban infrascan --path . --path ../infra # infra in another folder or repo too
     npx ikanban infrascan --image myapp:latest     # also scan a container image
-    npx ikanban infrascan --publish --team TEAM    # file the report and its findings
+    npx ikanban infrascan --publish --team TEAM    # file the findings (the report stays here)
 
 Plan 11 H12-T10 (owner: assume messy development). It starts with an inventory of each path:
 what infrastructure it found, what Trivy scanned, and what it could not scan and why. Infra
@@ -458,20 +458,17 @@ def finding_key(kind: str, scope: str, rule: str, location: str, line: str | Non
     return "infrascan-" + hashlib.sha256(raw.encode()).hexdigest()[:16]
 
 
-def findings_payload(sec: Section, home: str | None = None) -> list:
-    home = home if home is not None else str(Path.home())
-
-    def clean(s):
-        return s.replace(home, "~") if s and home and home != "/" else s
-    return [{
+def findings_payload(sec: Section) -> list:
+    """The findings --publish files; every text field through scrub_text (plan 5 X2)."""
+    return [scrub_finding({
         "finding_key": finding_key(sec.kind, sec.scope, f.rule, f.location, f.line),
         "owasp_category": CATEGORY[sec.kind],
         "severity": "Low" if f.severity == "info" else f.severity.capitalize(),
-        "title": clean(f.title)[:300],
-        "location_file": clean(f.location) or None,
+        "title": scrub_text(f.title)[:300],
+        "location_file": f.location or None,
         "location_lines": f.line,
-        "remediation": clean(" ".join(x for x in (f.detail, f.remediation) if x)),
-    } for f in (sec.filed if sec.filed is not None else sec.findings)]
+        "remediation": " ".join(x for x in (f.detail, f.remediation) if x),
+    }) for f in (sec.filed if sec.filed is not None else sec.findings)]
 
 
 # ── copied from ikanban-secscan.py: scope, key-host pinning, API ─────────────────────
@@ -551,13 +548,8 @@ def api(method: str, path: str, base_url: str, token: str, payload=None):
         return False, str(e)
 
 
-def publish(md: str, title: str, sections: list, args) -> int:
-    ok, info = api("POST", "/security/scan-reports", args.base_url, args.token,
-                   {"team_id": args.team, "title": title, "content": md.replace(str(Path.home()), "~")})
-    print(f"\npublished: {(info or {}).get('id', '') if ok else ''}" if ok else f"\npublish FAILED: {info}",
-          file=sys.stderr)
-    if not ok:
-        return 2
+def publish(sections: list, args) -> int:
+    """Plan 5 X1: findings only, one scan-findings call per section; the report stays here."""
     for sec in sections:
         nothing_found = any(x.startswith("No infrastructure-as-code files found") for x in sec.skipped)
         cut = any("more were left out" in n for n in sec.notes)
@@ -586,9 +578,21 @@ def add_work_dir_arg(ap):
     ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
                     help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
                          "<repository>/.iKanban/scans)")
+    ap.add_argument("--print-report", action="store_true",
+                    help="Print the full report on stdout (under the ikanban CLI stdout otherwise shows the "
+                         "counts and `ikanban scans show <id>`)")
 
 
 def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    # Plan 5 X3: the ikanban CLI hands over a private temp folder (IKANBAN_SCAN_DIR) and the scan id
+    # (IKANBAN_SCAN_ID). That folder is this run's folder; the CLI seals it into ~/.ikanban/scans.
+    cli_dir = os.environ.get("IKANBAN_SCAN_DIR", "")
+    if override and cli_dir and os.environ.get("IKANBAN_SCAN_ID") and (
+            Path(override).expanduser().resolve() == Path(cli_dir).expanduser().resolve()):
+        run_dir = Path(cli_dir).expanduser().resolve()
+        run_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+        os.chmod(run_dir, 0o700)
+        return run_dir
     scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
     scans.mkdir(parents=True, exist_ok=True)
     ignore = scans / ".gitignore"
@@ -614,14 +618,72 @@ def slug(text: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
 
 
+# ── scrub_text: identical in every scanner (test_scrub_text.py compares the copies) ──────────
+# Plan 5 X2-T1: every text field of every finding passes through scrub_text before it leaves this
+# machine. A secret keeps its first 4 characters; a home folder becomes ~. The server scrubs again.
+_SCRUB_CUT = (
+    re.compile(r"-{5}BEGIN [A-Z ]*PRIVATE KEY-{5}.*?(?:-{5}END [A-Z ]*PRIVATE KEY-{5}|\Z)", re.S),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b"),
+    re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}\b"),
+    re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"),
+    re.compile(r"\bxox[abposr]-[A-Za-z0-9-]{10,}\b"),
+    re.compile(r"\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b"),
+    re.compile(r"\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,}\b"),
+    re.compile(r"\bwhsec_[A-Za-z0-9]{16,}\b"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"),
+    re.compile(r"\bvk_[A-Za-z0-9_-]{8,}"),
+)
+_SCRUB_ASSIGNED = re.compile(
+    r"(?i)(\b(?:aws_secret_access_key|aws_session_token|client_secret|secret_key|private_key|api[_-]?key|"
+    r"access[_-]?token|auth[_-]?token|token|password|passwd|pwd|secret)\b[\"']?\s*[:=]\s*[\"']?)([^\s\"',;&]+)")
+_SCRUB_BEARER = re.compile(r"(?i)(\b(?:bearer|basic)\s+)([A-Za-z0-9._~+/=-]{12,})")
+_SCRUB_URL_CREDS = re.compile(r"(\b[a-z][a-z0-9+.-]*://[^\s/:@]+:)([^\s@/]+)(@)")
+_SCRUB_HOME = re.compile(r"(?<![\w.-])(?:[A-Za-z]:\\[Uu]sers\\|/Users/|/home/)[^\\/\s\"'<>]+")
+
+
+def scrub_text(text) -> str:
+    """Secrets, iKanban keys, tokens, AWS and GitHub keys, private key blocks and home folders
+    cut from one text. None becomes ""."""
+    if text is None:
+        return ""
+    text = str(text)
+    for rx in _SCRUB_CUT:
+        text = rx.sub(lambda m: m.group(0)[:4] + "…[hidden]", text)
+    text = _SCRUB_ASSIGNED.sub(
+        lambda m: m.group(1) + "[hidden]" if len(m.group(2)) >= 8 or any(c.isdigit() for c in m.group(2))
+        else m.group(0), text)
+    text = _SCRUB_BEARER.sub(lambda m: m.group(1) + "[hidden]", text)
+    text = _SCRUB_URL_CREDS.sub(lambda m: m.group(1) + "[hidden]" + m.group(3), text)
+    home = str(Path.home())
+    if home and home not in ("/", "\\") and home in text:
+        text = text.replace(home, "~")
+    return _SCRUB_HOME.sub("~", text)
+
+
+def scrub_finding(value):
+    """scrub_text on every string in a finding, through nested dicts and lists; other values stay."""
+    if isinstance(value, str):
+        return scrub_text(value)
+    if isinstance(value, dict):
+        return {k: scrub_finding(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [scrub_finding(v) for v in value]
+    return value
+
+
+# ── end scrub_text ──
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
-# then the report as log chunks. A plan without Pipelines (402) or any error never fails the scan.
+# then that line as the log (plan 5: never the report). A plan without Pipelines (402) or any error never fails the scan.
 _UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
 # Every iKanban scanner reports into one named lane, not the server's "legacy" lane.
 PIPE_RUN = "security-scan"
-PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
+PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per log line
 LAST_RUN = {"report": "", "detail": "", "skipped": False}
 INVENTORY: list = []  # (scope, table rows) per --path, for the report
 
@@ -642,39 +704,40 @@ def summary_detail(counts: dict, total: int, skipped: list) -> str:
 
 
 def mask_report(text: str) -> str:
-    """The report is masked already; mask again before it leaves for Pipelines."""
+    """scrub_text before a line leaves for Pipelines, plus a scanner's own rules (scrub_report)."""
+    text = scrub_text(text)
     scrub = globals().get("scrub_report")
-    if scrub:
-        return scrub(text)[0]
-    text = re.sub(r"\bvk_[A-Za-z0-9_-]{8,}", lambda m: m.group(0)[:4] + "…[hidden]", text)
-    home = str(Path.home())
-    return text.replace(home, "~") if home and home != "/" else text
-
-
-def log_chunks(text: str) -> list:
-    """Whole lines, each chunk under PIPE_CHUNK bytes (a longer single line is cut)."""
-    chunks, cur = [], ""
-    for line in text.splitlines(keepends=True):
-        while len(line.encode()) > PIPE_CHUNK:
-            head = line.encode()[:PIPE_CHUNK].decode(errors="ignore")
-            chunks.append(head)
-            line = line[len(head):]
-        if len((cur + line).encode()) > PIPE_CHUNK:
-            chunks.append(cur)
-            cur = ""
-        cur += line
-    if cur:
-        chunks.append(cur)
-    return chunks
+    return scrub(text)[0] if scrub else text
+
+
+def show_report(md: str, summary: str, print_report: bool = False) -> None:
+    """Plan 5 X3: under the ikanban CLI (IKANBAN_SCAN_ID set) stdout gets the counts and where the
+    full report is stored; the body only with --print-report. A plain python run prints the body."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    if scan_id and not print_report:
+        print(summary)
+        print(f"Full report: ikanban scans show {scan_id}")
+    else:
+        print(md)
+
+
+def scan_files_note(work: Path) -> str:
+    """Where this run's files are: the encrypted store under the CLI, else the run folder."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    return f"scan files: sealed into ~/.ikanban/scans as {scan_id}" if scan_id else f"scan files: {work}"
+
+
 
 # The running Pipeline (set by run_main with --task). Owner: Pipelines showed nothing while a
-# scan ran, so each step also sends one line as it starts and ends; the full report follows at the end.
+# scan ran, so each step also sends one line as it starts and ends; the one-line summary follows at the end.
 # Progress lines are fixed status text: never raw tool output or an error body (it can carry
 # secrets or text an attacker wrote). Those stay on local stderr and in the masked report.
 PIPE = None
 
 
 def progress(text: str) -> None:
+    if os.environ.get("IKANBAN_SCAN_ID") and "--json" not in sys.argv:
+        print(text, flush=True)  # Plan 5: under the CLI stdout shows progress, not the report
     if PIPE:
         PIPE.log(text)
 
@@ -732,8 +795,10 @@ class Pipeline:
         self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": status,
                                        "run": PIPE_RUN, "source": "laptop", "actor": f"ikanban-{self.stage}",
                                        "detail": detail[:300] or None})
-        for chunk in log_chunks(mask_report(LAST_RUN["report"])):
-            self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage, "text": chunk})
+        # Plan 5 X1-T2: the summary only; the report stays on the machine that ran the scan.
+        summary = f"{self.stage} {status}" + (f": {detail[:300]}" if detail else "")
+        self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage,
+                                     "text": mask_report(summary) + "\n"})
 
 
 def run_main(stage, main_fn, argv=None):
@@ -772,7 +837,8 @@ def main(argv=None):
     ap.add_argument("--no-iac", action="store_true", help="Scan only the --image images")
     ap.add_argument("--no-compose-images", action="store_true",
                     help="Do not scan the images that docker-compose files name")
-    ap.add_argument("--publish", action="store_true", help="File the report and findings into iKanban")
+    ap.add_argument("--publish", action="store_true",
+                    help="File the findings into iKanban (the full report stays on this machine)")
     ap.add_argument("--team", default=os.environ.get("IKANBAN_TEAM_ID", ""),
                     help="Team UUID to publish into (or IKANBAN_TEAM_ID)")
     ap.add_argument("--base-url", default=os.environ.get("IKANBAN_BASE_URL", "https://api.i-kanban.com"))
@@ -842,13 +908,12 @@ def main(argv=None):
         print(json.dumps({"paths": [str(r) for r in roots], "images": images, "total": total, "counts": counts,
                           "skipped": [s for sec in sections for s in sec.skipped], "work_dir": str(work)}, indent=2))
     else:
-        print(md)
+        show_report(md, LAST_RUN["detail"], args.print_report)
     sys.stdout.flush()
-    print(f"scan files: {work}", file=sys.stderr)
+    print(scan_files_note(work), file=sys.stderr)
 
     if args.publish:
-        title = f"Infrastructure scan — {root.name} — {datetime.now(timezone.utc):%Y-%m-%d %H:%M} UTC"
-        code = publish(md, title, sections, args)
+        code = publish(sections, args)
         if code:
             return code
 

package/scanners/ikanban-secscan.py

@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """
 ikanban-secscan — a standalone security scan you run against YOUR OWN repo,
-which reports its findings into iKanban as a document.
+which files its findings into iKanban. The full report stays on your machine.
 
     python3 ikanban-secscan.py                      # scan cwd, print report
     python3 ikanban-secscan.py --path ~/src/myapp   # scan somewhere else
-    python3 ikanban-secscan.py --publish            # also file the report and its findings into iKanban
+    python3 ikanban-secscan.py --publish            # also file the findings into iKanban (the report stays here)
     python3 ikanban-secscan.py --fail-on high       # non-zero exit for CI
 
 WHAT IT ACTUALLY CHECKS (IKA-1640)
@@ -32,8 +32,8 @@ DESIGN NOTES
 - No AWS calls, no iKanban-repo assumptions, no network access unless you
   pass --publish. It is meant to run on a laptop against any repo.
 - Ecosystems are detected from lockfiles present; nothing is assumed.
-- Publishing reuses the existing documents API with a personal API key
-  (VIBE_API_TOKEN). No new auth surface, per the ticket.
+- Publishing sends findings only (plan 5 X1), with a personal API key
+  (VIBE_API_TOKEN); every text field passes through scrub_text first.
 
 Closest siblings considered: vibe-security/scripts/owasp-scan.py (source-pattern
 scanner) and run-security-audit.py (AWS posture). Both are iKanban-internal —
@@ -678,18 +678,6 @@ def build_report(root: Path, sections: list) -> tuple:
 IKANBAN_KEY = re.compile(r"\bvk_[A-Za-z0-9_-]{8,}")
 
 
-def repo_name(root: Path) -> str:
-    """The repository's name from origin (an agent's run folder is named by its run id);
-    else the folder name."""
-    try:
-        url = subprocess.run(["git", "-C", str(root), "remote", "get-url", "origin"],
-                             capture_output=True, text=True, timeout=10).stdout.strip()
-    except (OSError, subprocess.SubprocessError):
-        url = ""
-    name = url.rstrip("/").rsplit("/", 1)[-1].rsplit(":", 1)[-1]
-    return name[:-4] if name.endswith(".git") else (name or root.name)
-
-
 def normalize_remote(url: str) -> str:
     """owner/repo from any remote style (scp, https, ssh, a host alias), lower case;
     never the user or a token in the URL."""
@@ -766,7 +754,8 @@ def build_findings_payload(sections: list, home: str | None = None) -> tuple[lis
     def clean(value):
         if value is None:
             return None
-        out, h = scrub_report(value, home)
+        _, h = scrub_report(value, home)  # the counts; scrub_text first sees whole key blocks
+        out = scrub_report(scrub_text(value), home)[0]
         hidden["secrets"] += h["secrets"]
         hidden["paths"] += h["paths"]
         return out
@@ -780,7 +769,7 @@ def build_findings_payload(sections: list, home: str | None = None) -> tuple[lis
             path, _, line = f.location.rpartition(":")
             if not (path and line.isdigit()):
                 path, line = f.location, None
-            payload.append({
+            payload.append(scrub_finding({
                 "finding_key": finding_key(f.rule, path, line),
                 "owasp_category": category,
                 "severity": "Low" if f.severity == "info" else f.severity.capitalize(),
@@ -788,13 +777,12 @@ def build_findings_payload(sections: list, home: str | None = None) -> tuple[lis
                 "location_file": clean(path),
                 "location_lines": line,
                 "remediation": clean(f"{f.detail}. {advice}" if f.detail else advice),
-            })
+            }))
     return payload, hidden
 
 
-# A server older than this scanner has no route for these (an empty 404 or 405); the
-# report is still filed, so that is a note, not a failure.
-OLD_SERVER = "this iKanban server does not take them yet; the report is filed"
+# A server older than this scanner has no route for these (an empty 404 or 405): a note, not a failure.
+OLD_SERVER = "this iKanban server does not take them yet"
 
 
 # Coding standard T3: the iKanban key goes only to iKanban's API (or this machine), and never
@@ -894,46 +882,6 @@ def parse_app_maps(values: list, root: Path) -> list:
     return maps
 
 
-def publish(md: str, title: str, base_url: str, token: str, team_id: str,
-            folder_id: str | None):
-    payload = {"team_id": team_id, "title": title, "content": md}
-    if folder_id:
-        payload["folder_id"] = folder_id
-    # IKA-1672: /api/security/scan-reports, not /api/documents. Same payload —
-    # the endpoint delegates to the document handler after checking that the
-    # workspace has an active subscription. Scanning stays free; only filing the
-    # report into iKanban is a paid feature.
-    req = urllib.request.Request(
-        f"{ikanban_api(base_url)}/api/security/scan-reports",
-        data=json.dumps(payload).encode(),
-        headers={"Authorization": f"Bearer {token}",
-                 "Content-Type": "application/json"},
-        method="POST",
-    )
-    try:
-        with _OPENER.open(req, timeout=30) as r:
-            body = json.loads(r.read().decode() or "{}")
-        doc = body.get("data", body)
-        return True, doc.get("id", "")
-    except urllib.error.HTTPError as e:
-        detail = e.read().decode()[:300]
-        if e.code == 402:
-            # Not a failure of the scan — the report is still on stdout, and
-            # --out writes it to a file. Say so instead of just echoing 402.
-            # The backend's ErrorResponse serialises the text under "error",
-            # not "message"; "message" is still checked so this keeps working
-            # if that ever changes.
-            try:
-                body = json.loads(detail)
-                detail = body.get("error") or body.get("message") or detail
-            except (ValueError, AttributeError):
-                pass
-            return False, detail
-        return False, f"HTTP {e.code}: {detail}"
-    except Exception as e:  # noqa: BLE001 — surface any transport failure verbatim
-        return False, str(e)
-
-
 # ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
 # <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
 # holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
@@ -941,9 +889,21 @@ def add_work_dir_arg(ap):
     ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
                     help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
                          "<repository>/.iKanban/scans)")
+    ap.add_argument("--print-report", action="store_true",
+                    help="Print the full report on stdout (under the ikanban CLI stdout otherwise shows the "
+                         "counts and `ikanban scans show <id>`)")
 
 
 def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    # Plan 5 X3: the ikanban CLI hands over a private temp folder (IKANBAN_SCAN_DIR) and the scan id
+    # (IKANBAN_SCAN_ID). That folder is this run's folder; the CLI seals it into ~/.ikanban/scans.
+    cli_dir = os.environ.get("IKANBAN_SCAN_DIR", "")
+    if override and cli_dir and os.environ.get("IKANBAN_SCAN_ID") and (
+            Path(override).expanduser().resolve() == Path(cli_dir).expanduser().resolve()):
+        run_dir = Path(cli_dir).expanduser().resolve()
+        run_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+        os.chmod(run_dir, 0o700)
+        return run_dir
     scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
     scans.mkdir(parents=True, exist_ok=True)
     ignore = scans / ".gitignore"
@@ -969,14 +929,72 @@ def slug(text: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
 
 
+# ── scrub_text: identical in every scanner (test_scrub_text.py compares the copies) ──────────
+# Plan 5 X2-T1: every text field of every finding passes through scrub_text before it leaves this
+# machine. A secret keeps its first 4 characters; a home folder becomes ~. The server scrubs again.
+_SCRUB_CUT = (
+    re.compile(r"-{5}BEGIN [A-Z ]*PRIVATE KEY-{5}.*?(?:-{5}END [A-Z ]*PRIVATE KEY-{5}|\Z)", re.S),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b"),
+    re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}\b"),
+    re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"),
+    re.compile(r"\bxox[abposr]-[A-Za-z0-9-]{10,}\b"),
+    re.compile(r"\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b"),
+    re.compile(r"\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,}\b"),
+    re.compile(r"\bwhsec_[A-Za-z0-9]{16,}\b"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"),
+    re.compile(r"\bvk_[A-Za-z0-9_-]{8,}"),
+)
+_SCRUB_ASSIGNED = re.compile(
+    r"(?i)(\b(?:aws_secret_access_key|aws_session_token|client_secret|secret_key|private_key|api[_-]?key|"
+    r"access[_-]?token|auth[_-]?token|token|password|passwd|pwd|secret)\b[\"']?\s*[:=]\s*[\"']?)([^\s\"',;&]+)")
+_SCRUB_BEARER = re.compile(r"(?i)(\b(?:bearer|basic)\s+)([A-Za-z0-9._~+/=-]{12,})")
+_SCRUB_URL_CREDS = re.compile(r"(\b[a-z][a-z0-9+.-]*://[^\s/:@]+:)([^\s@/]+)(@)")
+_SCRUB_HOME = re.compile(r"(?<![\w.-])(?:[A-Za-z]:\\[Uu]sers\\|/Users/|/home/)[^\\/\s\"'<>]+")
+
+
+def scrub_text(text) -> str:
+    """Secrets, iKanban keys, tokens, AWS and GitHub keys, private key blocks and home folders
+    cut from one text. None becomes ""."""
+    if text is None:
+        return ""
+    text = str(text)
+    for rx in _SCRUB_CUT:
+        text = rx.sub(lambda m: m.group(0)[:4] + "…[hidden]", text)
+    text = _SCRUB_ASSIGNED.sub(
+        lambda m: m.group(1) + "[hidden]" if len(m.group(2)) >= 8 or any(c.isdigit() for c in m.group(2))
+        else m.group(0), text)
+    text = _SCRUB_BEARER.sub(lambda m: m.group(1) + "[hidden]", text)
+    text = _SCRUB_URL_CREDS.sub(lambda m: m.group(1) + "[hidden]" + m.group(3), text)
+    home = str(Path.home())
+    if home and home not in ("/", "\\") and home in text:
+        text = text.replace(home, "~")
+    return _SCRUB_HOME.sub("~", text)
+
+
+def scrub_finding(value):
+    """scrub_text on every string in a finding, through nested dicts and lists; other values stay."""
+    if isinstance(value, str):
+        return scrub_text(value)
+    if isinstance(value, dict):
+        return {k: scrub_finding(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [scrub_finding(v) for v in value]
+    return value
+
+
+# ── end scrub_text ──
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
-# then the report as log chunks. A plan without Pipelines (402) or any error never fails the scan.
+# then that line as the log (plan 5: never the report). A plan without Pipelines (402) or any error never fails the scan.
 _UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
 # Every iKanban scanner reports into one named lane, not the server's "legacy" lane.
 PIPE_RUN = "security-scan"
-PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
+PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per log line
 LAST_RUN = {"report": "", "detail": "", "skipped": False}
 
 
@@ -996,39 +1014,40 @@ def summary_detail(counts: dict, total: int, skipped: list) -> str:
 
 
 def mask_report(text: str) -> str:
-    """The report is masked already; mask again before it leaves for Pipelines."""
+    """scrub_text before a line leaves for Pipelines, plus a scanner's own rules (scrub_report)."""
+    text = scrub_text(text)
     scrub = globals().get("scrub_report")
-    if scrub:
-        return scrub(text)[0]
-    text = re.sub(r"\bvk_[A-Za-z0-9_-]{8,}", lambda m: m.group(0)[:4] + "…[hidden]", text)
-    home = str(Path.home())
-    return text.replace(home, "~") if home and home != "/" else text
-
-
-def log_chunks(text: str) -> list:
-    """Whole lines, each chunk under PIPE_CHUNK bytes (a longer single line is cut)."""
-    chunks, cur = [], ""
-    for line in text.splitlines(keepends=True):
-        while len(line.encode()) > PIPE_CHUNK:
-            head = line.encode()[:PIPE_CHUNK].decode(errors="ignore")
-            chunks.append(head)
-            line = line[len(head):]
-        if len((cur + line).encode()) > PIPE_CHUNK:
-            chunks.append(cur)
-            cur = ""
-        cur += line
-    if cur:
-        chunks.append(cur)
-    return chunks
+    return scrub(text)[0] if scrub else text
+
+
+def show_report(md: str, summary: str, print_report: bool = False) -> None:
+    """Plan 5 X3: under the ikanban CLI (IKANBAN_SCAN_ID set) stdout gets the counts and where the
+    full report is stored; the body only with --print-report. A plain python run prints the body."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    if scan_id and not print_report:
+        print(summary)
+        print(f"Full report: ikanban scans show {scan_id}")
+    else:
+        print(md)
+
+
+def scan_files_note(work: Path) -> str:
+    """Where this run's files are: the encrypted store under the CLI, else the run folder."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    return f"scan files: sealed into ~/.ikanban/scans as {scan_id}" if scan_id else f"scan files: {work}"
+
+
 
 # The running Pipeline (set by run_main with --task). Owner: Pipelines showed nothing while a
-# scan ran, so each step also sends one line as it starts and ends; the full report follows at the end.
+# scan ran, so each step also sends one line as it starts and ends; the one-line summary follows at the end.
 # Progress lines are fixed status text: never raw tool output or an error body (it can carry
 # secrets or text an attacker wrote). Those stay on local stderr and in the masked report.
 PIPE = None
 
 
 def progress(text: str) -> None:
+    if os.environ.get("IKANBAN_SCAN_ID") and "--json" not in sys.argv:
+        print(text, flush=True)  # Plan 5: under the CLI stdout shows progress, not the report
     if PIPE:
         PIPE.log(text)
 
@@ -1086,8 +1105,10 @@ class Pipeline:
         self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": status,
                                        "run": PIPE_RUN, "source": "laptop", "actor": f"ikanban-{self.stage}",
                                        "detail": detail[:300] or None})
-        for chunk in log_chunks(mask_report(LAST_RUN["report"])):
-            self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage, "text": chunk})
+        # Plan 5 X1-T2: the summary only; the report stays on the machine that ran the scan.
+        summary = f"{self.stage} {status}" + (f": {detail[:300]}" if detail else "")
+        self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage,
+                                     "text": mask_report(summary) + "\n"})
 
 
 def run_main(stage, main_fn, argv=None):
@@ -1124,10 +1145,10 @@ def main(argv=None):
     ap.add_argument("--version", action="version", version=f"ikanban secscan {SECSCAN_VERSION}")
     ap.add_argument("--path", default=".", help="Repo to scan (default: cwd)")
     ap.add_argument("--publish", action="store_true",
-                    help="File the report into iKanban as a document")
+                    help="File the findings into iKanban (the full report stays on this machine)")
     ap.add_argument("--team", default=os.environ.get("IKANBAN_TEAM_ID", ""),
                     help="Team UUID to publish into (or IKANBAN_TEAM_ID)")
-    ap.add_argument("--folder", default=None, help="Optional folder UUID")
+    ap.add_argument("--folder", default=None, help=argparse.SUPPRESS)  # reports are no longer filed
     ap.add_argument("--base-url", default=os.environ.get(
         "IKANBAN_BASE_URL", "https://api.i-kanban.com"))
     ap.add_argument("--token", default=os.environ.get("VIBE_API_TOKEN", ""),
@@ -1203,27 +1224,18 @@ def main(argv=None):
         print(json.dumps({"repo": str(root), "total": total, "counts": counts},
                          indent=2))
     else:
-        print(md)
+        show_report(md, LAST_RUN["detail"], args.print_report)
     # The lines below go to stderr; flush first so they follow the report when both are
     # piped into one stream (an agent's `2>&1 | tail` would otherwise cut them off).
     sys.stdout.flush()
-    print(f"scan files: {work}", file=sys.stderr)
+    print(scan_files_note(work), file=sys.stderr)
 
     if args.publish:
         if not args.token or not args.team:
             print("\nerror: --publish needs --token (or VIBE_API_TOKEN) and "
                   "--team (or IKANBAN_TEAM_ID)", file=sys.stderr)
             return 2
-        title = f"Security scan — {repo_name(root)} — {datetime.now(timezone.utc):%Y-%m-%d %H:%M} UTC"
-        sent, hidden = scrub_report(md)
-        if hidden["secrets"] or hidden["paths"]:
-            print(f"hidden before sending: {hidden['secrets']} secret(s), {hidden['paths']} home path(s)",
-                  file=sys.stderr)
-        ok, info = publish(sent, title, args.base_url, args.token, args.team, args.folder)
-        print(f"\npublished: {info}" if ok else f"\npublish FAILED: {info}",
-              file=sys.stderr)
-        if not ok:
-            return 2
+        # Plan 5 X1: findings only; the report stays on this machine.
         findings, hidden = build_findings_payload(sections)
         if hidden["secrets"] or hidden["paths"]:
             print(f"hidden in findings: {hidden['secrets']} secret(s), {hidden['paths']} home path(s)",