[claude]

Requested by Justin Helmer · Slack thread

Before: the CLI talked about scanning ("Scanning 3 cloud accounts…", "Finding scan targets…", "The staging scan didn't finish"). After: every user-visible string says what the user gets: issues found and risks surfaced.

"Scan" frames the work as us extracting value from the user instead of delivering value to them, so it disappears from everything a user can read (W6 of the onboarding rework, coreplanelabs/nominal#1227).

How: each string was rewritten for its context rather than find/replaced. The scan command name, file names, function and type identifiers, the scan_reports.* API routes, generated client code, and console /scans URLs are all untouched; this PR is copy only. Tests asserting the old copy were updated, and root help stays within the 35-line cap (one description line changed, none added).

Notable rewrites

Before	After
Scan connected cloud accounts and integrations for key risks (help description, --help and root help)	Find key risks in your connected cloud accounts and integrations
Scanning 3 cloud accounts and 2 integrations… (1/5 complete) (progress spinner)	Finding issues in 3 cloud accounts and 2 integrations… (1/5 complete)
Finding scan targets… (spinner)	Checking what's connected…
Nothing to scan yet: no cloud accounts or integrations are connected.	Nothing to check yet: no cloud accounts or integrations are connected.
The <label> scan didn't finish (…).	The <label> check didn't finish (…).
2 scans are still running; view progress in the console.	Still looking for issues in 2 places; view progress in the console.
Workspace to scan (prompt)	Workspace to check

Remaining "scan" audit

grep -rni scan over the repo (excluding node_modules, dist, .git, package-lock.json) leaves 181 hits, all out-of-scope identifiers, grouped by category:

Command name (kept by design):

• src/commands/scan.ts — command/file name, name: 'scan', examples polylane scan … (3 hits among its 55)
• src/registry.ts (1) — scan resource key/name in RESOURCE_ORDER
• src/main.ts (part of 3) — 'scan' in the pre-auth command routing list
• src/commands/index.ts (2) — scanCommand import/registration
• test/resolve.test.ts (1), test/registry.test.ts (5) — command name in routing/typo-suggestion tests

Code identifiers (types, functions, fixtures):

• src/commands/scan.ts (bulk of 55) — ScanTarget, ScanRunResult, RunScanOps, runScans, scanProgressLabel, scansIndexUrl, SCAN_TIMEOUT_MS, seedInvestigations params, plus /scans console-URL parsing
• test/scan.test.ts (59) — imports of those identifiers, scan_report_* fixture ids, /scans URLs, test descriptions (developer-facing, not user output)

API routes / operationIds (machine contract):

• src/client/scan-reports.ts (33) — /v1/scan_reports routes, ScanReport* request/response types, code comments
• src/generated/{types,client,commands}.ts (7) — auto-generated from the OpenAPI spec (scan_reports.* operationIds), do-not-edit
• src/commands/scan.ts — operationId: 'scan_reports.generate'

Different meaning of "scan" (argument parsing, not the product feature):

• src/args.ts (1), src/main.ts (2 of 3), test/args.test.ts (8) — scanCommandPath, the argv tokenizer

False positives:

• src/utils/prompt.ts (6) — p.isCancel matches "sCan" case-insensitively

Verification

• npm run typecheck — pass
• npm run lint — pass
• npm run test — 258/258 pass

---

Generated by Claude Code