@hoanghainh/komagu 1.7.0 → 2.0.0

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.0.0](https://github.com/hoanghainh1188/komagu/compare/v1.8.0...v2.0.0) (2026-10-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* rename identifiers kept as "komainu" and remove 1.x shims ([#315](https://github.com/hoanghainh1188/komagu/issues/315))
+  Rule IDs, the SARIF fingerprint key, audit event and logger names, WAF tags, the default token audience, the PostgreSQL role and Terraform resource names change; `KOMAINU_*` env vars, `komainu.security.*` properties and the `komainu` npm bins are removed. Read [Migrating to Komagu 2.0](https://github.com/hoanghainh1188/komagu/blob/main/docs/migration-2.0.md) before upgrading.
+
+### Features
+
+* rename identifiers kept as "komainu" and remove 1.x shims ([#315](https://github.com/hoanghainh1188/komagu/issues/315)) ([cbc63de](https://github.com/hoanghainh1188/komagu/commit/cbc63de3c4e1f90985420b74ba5211740ef4fe25))
+* **test:** read BFLA and mass assignment findings from SARIF in --from-scan and --export-poc ([#313](https://github.com/hoanghainh1188/komagu/issues/313)) ([f91c2fa](https://github.com/hoanghainh1188/komagu/commit/f91c2fa345972bb8da91c503537cafaec7e4ed7b))
+
+## [1.8.0](https://github.com/hoanghainh1188/komagu/compare/v1.7.0...v1.8.0) (2026-10-30)
+
+
+### Features
+
+* **cli:** rename CLI and npm package to komagu (@hoanghainh/komagu) ([#296](https://github.com/hoanghainh1188/komagu/issues/296)) ([a37e8ec](https://github.com/hoanghainh1188/komagu/commit/a37e8ecae013b851dc8d69ba6c9ad7ddc600ae78))
+
+
+### Bug Fixes
+
+* **cli:** show "Komagu" in the ASCII banner; point npm links to @hoanghainh/komagu ([#309](https://github.com/hoanghainh1188/komagu/issues/309)) ([533d9b0](https://github.com/hoanghainh1188/komagu/commit/533d9b0de0511825a0704c1f9b2eb5f6546632f7))
+* **spring:** make the member-portal Spring example compile and start ([#305](https://github.com/hoanghainh1188/komagu/issues/305)) ([578197d](https://github.com/hoanghainh1188/komagu/commit/578197d891b2905e03996cd3dbfa9c86445966e0))
+
+
+### Code Refactoring
+
+* **dotnet:** rename .NET modules to Komagu.Security.* ([#298](https://github.com/hoanghainh1188/komagu/issues/298)) ([e8ca9d8](https://github.com/hoanghainh1188/komagu/commit/e8ca9d8feffdd6393f37aea8fa1234fe46e73505))
+* **remediate:** rename Python, Go, Node.js, shims and edge modules to Komagu ([#300](https://github.com/hoanghainh1188/komagu/issues/300)) ([54e3daf](https://github.com/hoanghainh1188/komagu/commit/54e3daf8fec80e40626eabb39d9679e834729615))
+* **spring:** rename Spring/Kotlin modules to io.komagu ([#299](https://github.com/hoanghainh1188/komagu/issues/299)) ([7202f6e](https://github.com/hoanghainh1188/komagu/commit/7202f6eef289124761b5f87420c27383be347c92))
+
+
+### Documentation
+
+* **changelog:** name the package @hoanghainh/komagu in the header ([#307](https://github.com/hoanghainh1188/komagu/issues/307)) ([c773ba9](https://github.com/hoanghainh1188/komagu/commit/c773ba9b8e871b8b7da04c6c2d4df2c6d2eb31cc))
+* rename LSA, contracts, docs and demo app to Komagu; add ADR-0007 ([#303](https://github.com/hoanghainh1188/komagu/issues/303)) ([9d193d9](https://github.com/hoanghainh1188/komagu/commit/9d193d94f607afb9917fedbe9d4593ca9f8f57c0))
+
 ## [1.7.0](https://github.com/hoanghainh1188/komainu/compare/v1.6.0...v1.7.0) (2026-10-30)
 
 

package/assess/lsa/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.1 — 2026-10-30
+
+SARIF replay properties (#289).
+
+- **`findings_to_sarif.py`:** each SARIF result's `properties` now carries `finding_id`, `category`, `endpoint`, `attack_vector` (`method`, `path`, `fields`, `readback`, `target_param`) and `consensus_score`, so `komagu test --from-scan` and `--export-poc` can replay BFLA and mass assignment findings from SARIF. `suggested_payload` is not exported, to keep attack strings out of code scanning.
+
 ## 0.2.3 — 2026-10-26
 
 Runtime adapters (#244).

package/assess/lsa/VERSION

@@ -1 +1 @@
-0.3.0
+0.3.1

package/assess/lsa/adapters/build_adapters.py

@@ -118,8 +118,11 @@ Scripts: `python3 {ref}/scripts/<script>.py` (Python 3.8+, standard library only
     print("Next step: In your Claude Code workspace, prompt: 'Run the legacy-security-audit skill. TARGET=src, OUT=lsa-out'")
 
 
-AGENTS_MD_BEGIN = "<!-- komainu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
-AGENTS_MD_END = "<!-- komainu-lsa:end -->"
+AGENTS_MD_BEGIN = "<!-- komagu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
+AGENTS_MD_END = "<!-- komagu-lsa:end -->"
+# Pre-2.0 markers, still replaced in place for one major release (#312)
+LEGACY_AGENTS_MD_BEGIN = "<!-- komainu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
+LEGACY_AGENTS_MD_END = "<!-- komainu-lsa:end -->"
 
 
 def toml_multiline(text: str) -> str:
@@ -156,13 +159,16 @@ def agents_md_with_block(path: Path, block: str) -> str:
             raise ValueError(f"{path} is not UTF-8 ({e}); convert it, then re-run") from e
     nl = "\r\n" if "\r\n" in current else "\n"
     section = f"{AGENTS_MD_BEGIN}\n{block.strip()}\n{AGENTS_MD_END}\n".replace("\n", nl)
-    begins, ends = current.count(AGENTS_MD_BEGIN), current.count(AGENTS_MD_END)
+    begin_marker, end_marker = AGENTS_MD_BEGIN, AGENTS_MD_END
+    if begin_marker not in current and end_marker not in current:
+        begin_marker, end_marker = LEGACY_AGENTS_MD_BEGIN, LEGACY_AGENTS_MD_END
+    begins, ends = current.count(begin_marker), current.count(end_marker)
     if begins == 0 and ends == 0:
         return section if not current.strip() else current.rstrip("\r\n") + nl + nl + section
-    start, stop = current.find(AGENTS_MD_BEGIN), current.find(AGENTS_MD_END)
+    start, stop = current.find(begin_marker), current.find(end_marker)
     if begins != 1 or ends != 1 or stop < start:
-        raise ValueError(f"{path} has unbalanced komainu-lsa markers; remove them by hand, then re-run")
-    stop += len(AGENTS_MD_END)
+        raise ValueError(f"{path} has unbalanced komagu-lsa markers; remove them by hand, then re-run")
+    stop += len(end_marker)
     if current.startswith(nl, stop):
         stop += len(nl)
     return current[:start] + section + current[stop:]
@@ -252,7 +258,9 @@ def build_cursor(dest: Path) -> None:
     print("Next step: In Cursor, open a new chat and invoke: '@lsa-orchestrator run security audit on TARGET=src, OUT=lsa-out'")
 
 
-GENERATOR = "komainu-lsa"
+GENERATOR = "komagu-lsa"
+# contract.json files written before 2.0 carry the old value; still recognised for one major release (#312)
+KNOWN_GENERATORS = (GENERATOR, "komainu-lsa")
 
 
 def check_generic_dest(dest: Path) -> None:
@@ -266,7 +274,7 @@ def check_generic_dest(dest: Path) -> None:
             data = json.loads(contract.read_text(encoding="utf-8"))
         except (UnicodeDecodeError, ValueError):
             data = None
-        if not isinstance(data, dict) or data.get("generator") != GENERATOR:
+        if not isinstance(data, dict) or data.get("generator") not in KNOWN_GENERATORS:
             raise ValueError(f"{contract} was not generated by Komagu LSA (no \"generator\": \"{GENERATOR}\"); "
                              "choose an empty DEST such as ./lsa-bundle, or move that file away")
         return

package/assess/lsa/adapters/codex/README.md

@@ -15,7 +15,7 @@ This creates:
   directory up to the repository root.
 - `.codex/agents/lsa-*.toml` — one project custom agent per role
   (`name`, `description`, `developer_instructions`).
-- `AGENTS.md` — an LSA section between `komainu-lsa:begin` / `komainu-lsa:end`
+- `AGENTS.md` — an LSA section between `komagu-lsa:begin` / `komagu-lsa:end`
   markers. Anything you write outside the markers is kept; re-running the
   generator only replaces the section.
 

package/assess/lsa/adapters/generic/README.md

@@ -8,7 +8,7 @@ komagu init --ai generic ./lsa-bundle
 ```
 
 It writes `system-prompts/`, `kit/` and `contract.json` into that folder.
-The contract carries `"generator": "komainu-lsa"`. Re-running refreshes a
+The contract carries `"generator": "komagu-lsa"`. Re-running refreshes a
 bundle that has this marker. The generator refuses, before writing anything,
 when the folder has a `contract.json` without the marker, or a `kit/` or
 `system-prompts/` folder but no `contract.json`. This keeps a project's own

package/assess/lsa/knowledge/severity-and-cwe.md

@@ -43,7 +43,7 @@ Finding id prefixes: `BOLA-`, `INJ-`, `BFLA-`, `MASS-`.
 
 `fingerprint` is optional. When present it has the form `kfp1:<64 lowercase hex>`
 and must not depend on line numbers, so the same issue keeps the same value
-across scans. Exporters copy it to SARIF `partialFingerprints["komainu/v1"]`.
+across scans. Exporters copy it to SARIF `partialFingerprints["komagu/v1"]`.
 
 ## SARIF level mapping
 

package/assess/lsa/scripts/baseline.py

@@ -35,7 +35,9 @@ from trend import append_history, mttr_by_severity, snapshot  # noqa: E402
 
 SEVERITY_RANK = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
 FAIL_ON = ("none", "new", "any")
-SARIF_FINGERPRINT_KEY = "komainu/v1"
+SARIF_FINGERPRINT_KEY = "komagu/v1"
+# SARIF baselines written before 2.0 use the old key; still read for one major release (#312)
+LEGACY_SARIF_FINGERPRINT_KEY = "komainu/v1"
 
 
 class BaselineError(Exception):
@@ -57,7 +59,8 @@ def _entries_from_sarif(doc: Dict) -> Dict[str, Dict]:
     entries: Dict[str, Dict] = {}
     for run in doc.get("runs") or []:
         for result in run.get("results") or []:
-            fp = (result.get("partialFingerprints") or {}).get(SARIF_FINGERPRINT_KEY)
+            fingerprints = result.get("partialFingerprints") or {}
+            fp = fingerprints.get(SARIF_FINGERPRINT_KEY) or fingerprints.get(LEGACY_SARIF_FINGERPRINT_KEY)
             if not fp:
                 continue
             props = result.get("properties") or {}

package/assess/lsa/scripts/findings_to_sarif.py

@@ -132,6 +132,28 @@ OWASP_TAGS = {
 }
 
 
+# Attack-vector keys that `komagu test --from-scan` and `--export-poc` need to replay a
+# finding from SARIF. suggested_payload is left out so attack strings stay out of code scanning.
+REPLAY_KEYS = ("method", "path", "fields", "readback", "target_param")
+
+
+def replay_properties(f: Dict[str, Any]) -> Dict[str, Any]:
+    """Result properties that let a SARIF result be replayed like a findings.json entry."""
+    props: Dict[str, Any] = {"finding_id": f.get("finding_id"), "category": f.get("category", "bola")}
+    ep = f.get("endpoint")
+    if isinstance(ep, dict) and ep.get("path"):
+        props["endpoint"] = {k: ep[k] for k in ("method", "path") if ep.get(k)}
+    av = f.get("attack_vector")
+    if isinstance(av, dict):
+        kept = {k: av[k] for k in REPLAY_KEYS if av.get(k) not in (None, "", {})}
+        if kept:
+            props["attack_vector"] = kept
+    cons = f.get("consensus")
+    if isinstance(cons, dict) and isinstance(cons.get("score"), (int, float)):
+        props["consensus_score"] = cons["score"]
+    return props
+
+
 def normalize_cwe_id(cwe_val: Any) -> str:
     """Normalize numeric or prefixed CWE ID to standard 'CWE-XXX' format."""
     s = str(cwe_val).strip()
@@ -319,7 +341,7 @@ def to_sarif(
 
         fingerprints = {"lsaFindingId": f.get("finding_id", f"LSA-{len(results)+1}")}
         if f.get("fingerprint"):
-            fingerprints["komainu/v1"] = f["fingerprint"]
+            fingerprints["komagu/v1"] = f["fingerprint"]
 
         result_taxa = []
         for c in norm_cwes:
@@ -352,6 +374,7 @@ def to_sarif(
                 "confidence": f.get("confidence", "high"),
                 "status": f.get("status", "unverified"),
                 "cwe": norm_cwes,
+                **replay_properties(f),
             },
         }
         state = f.get("baseline_state")

package/assess/lsa/tests/test_adapters.py

@@ -93,6 +93,17 @@ class TestCodexAdapter(unittest.TestCase):
         self.assertEqual(text.count(AGENTS_MD_BEGIN), 1)
         self.assertEqual(text.count(AGENTS_MD_END), 1)
 
+    def test_pre_2_0_markers_are_replaced_in_place(self) -> None:
+        old = (f"# Notes\n\n{build_adapters.LEGACY_AGENTS_MD_BEGIN}\nold block\n"
+               f"{build_adapters.LEGACY_AGENTS_MD_END}\n\n# Footer\n")
+        (self.dest / "AGENTS.md").write_text(old, encoding="utf-8")
+        build("codex", self.dest)
+        text = (self.dest / "AGENTS.md").read_text(encoding="utf-8")
+        self.assertNotIn("komainu-lsa", text)
+        self.assertNotIn("old block", text)
+        self.assertEqual(text.count(AGENTS_MD_BEGIN), 1)
+        self.assertTrue(text.startswith("# Notes\n\n") and text.endswith("# Footer\n"))
+
     def test_unbalanced_markers_fail_before_touching_workspace(self) -> None:
         user = f"# Notes\n{AGENTS_MD_BEGIN}\nimportant user text\n"
         (self.dest / "AGENTS.md").write_text(user, encoding="utf-8")
@@ -187,7 +198,7 @@ class TestGenericAdapterGuard(unittest.TestCase):
 
     def test_contract_carries_generator_marker(self) -> None:
         build("generic", self.dest)
-        self.assertEqual(json.loads(self.contract.read_text(encoding="utf-8"))["generator"], "komainu-lsa")
+        self.assertEqual(json.loads(self.contract.read_text(encoding="utf-8"))["generator"], "komagu-lsa")
 
     def test_rebuild_refreshes_generated_contract(self) -> None:
         build("generic", self.dest)
@@ -197,6 +208,14 @@ class TestGenericAdapterGuard(unittest.TestCase):
         build("generic", self.dest)
         self.assertEqual(json.loads(self.contract.read_text(encoding="utf-8"))["kit_version"], build_adapters.VERSION)
 
+    def test_rebuild_accepts_pre_2_0_generator(self) -> None:
+        build("generic", self.dest)
+        data = json.loads(self.contract.read_text(encoding="utf-8"))
+        data["generator"] = "komainu-lsa"
+        self.contract.write_text(json.dumps(data), encoding="utf-8")
+        build("generic", self.dest)
+        self.assertEqual(json.loads(self.contract.read_text(encoding="utf-8"))["generator"], "komagu-lsa")
+
     def test_foreign_contract_fails_before_touching_workspace(self) -> None:
         self.contract.write_text('{"name": "my-project-contract"}', encoding="utf-8")
         with self.assertRaisesRegex(ValueError, "contract.json"):
@@ -211,7 +230,7 @@ class TestGenericAdapterGuard(unittest.TestCase):
         self.assert_untouched("contract.json")
 
     def test_non_object_contract_fails(self) -> None:
-        self.contract.write_text('["komainu-lsa"]', encoding="utf-8")
+        self.contract.write_text('["komagu-lsa"]', encoding="utf-8")
         with self.assertRaises(ValueError):
             build("generic", self.dest)
 

package/assess/lsa/tests/test_baseline.py

@@ -198,6 +198,14 @@ class TestLoadBaseline(unittest.TestCase):
         entries = load_baseline(self.dir / "prev.sarif")
         self.assertEqual(entries["kfp1:" + "e" * 64]["state"], "open")
 
+    def test_loads_pre_2_0_sarif_fingerprint_key(self) -> None:
+        sarif = to_sarif({"findings": [{**_finding(), "fingerprint": "kfp1:" + "f" * 64}]})
+        for result in sarif["runs"][0]["results"]:
+            fps = result["partialFingerprints"]
+            fps["komainu/v1"] = fps.pop("komagu/v1")
+        write_json(self.dir / "old.sarif", sarif)
+        self.assertIn("kfp1:" + "f" * 64, load_baseline(self.dir / "old.sarif"))
+
     def test_invalid_file_raises(self) -> None:
         (self.dir / "bad.json").write_text("{not json", encoding="utf-8")
         with self.assertRaises(BaselineError):

package/assess/lsa/tests/test_contract_groundwork.py

@@ -156,9 +156,9 @@ class TestLsaSarifExport(unittest.TestCase):
         by_rule = {r["ruleId"]: r for r in self.run["results"]}
         mass_fp = by_rule["lsa/mass_assignment/whole_object_binding"]["partialFingerprints"]
         bfla_fp = by_rule["lsa/bfla/missing_role_check"]["partialFingerprints"]
-        self.assertEqual(mass_fp["komainu/v1"], FINGERPRINT)
+        self.assertEqual(mass_fp["komagu/v1"], FINGERPRINT)
         self.assertEqual(mass_fp["lsaFindingId"], "MASS-R-0002-1")
-        self.assertNotIn("komainu/v1", bfla_fp)
+        self.assertNotIn("komagu/v1", bfla_fp)
 
 
 class TestOperateSarifExport(unittest.TestCase):
@@ -166,16 +166,16 @@ class TestOperateSarifExport(unittest.TestCase):
         sarif = convert_findings_to_sarif([_finding(cwe=285), {**_mass_assignment(), "cwe": 915}])
         run = sarif["runs"][0]
         rule_ids = {r["id"] for r in run["tool"]["driver"]["rules"]}
-        self.assertEqual(rule_ids, {"KOMAINU-BFLA-CWE285", "KOMAINU-MASS-CWE915"})
-        mass = next(r for r in run["results"] if r["ruleId"] == "KOMAINU-MASS-CWE915")
-        self.assertEqual(mass["partialFingerprints"], {"komainu/v1": FINGERPRINT})
-        bfla = next(r for r in run["results"] if r["ruleId"] == "KOMAINU-BFLA-CWE285")
+        self.assertEqual(rule_ids, {"KOMAGU-BFLA-CWE285", "KOMAGU-MASS-CWE915"})
+        mass = next(r for r in run["results"] if r["ruleId"] == "KOMAGU-MASS-CWE915")
+        self.assertEqual(mass["partialFingerprints"], {"komagu/v1": FINGERPRINT})
+        bfla = next(r for r in run["results"] if r["ruleId"] == "KOMAGU-BFLA-CWE285")
         self.assertNotIn("partialFingerprints", bfla)
 
     def test_default_cwe_for_new_categories(self) -> None:
         sarif = convert_findings_to_sarif([_finding(cwe=None), {**_mass_assignment(), "cwe": None}])
         rule_ids = {r["id"] for r in sarif["runs"][0]["tool"]["driver"]["rules"]}
-        self.assertEqual(rule_ids, {"KOMAINU-BFLA-CWE285", "KOMAINU-MASS-CWE915"})
+        self.assertEqual(rule_ids, {"KOMAGU-BFLA-CWE285", "KOMAGU-MASS-CWE915"})
 
 
 class TestSummaryAndReports(unittest.TestCase):

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "1.7.0"  # x-release-please-version
+__version__ = "2.0.0"  # x-release-please-version

package/operate/cli/commands/scan.py

@@ -165,13 +165,8 @@ Examples:
 
 
 def _default_suppressions_file(target_path: Path) -> Path:
-    """TARGET/.komagu/suppressions.json, or the pre-rename .komainu/ copy with a warning."""
-    current = target_path / ".komagu" / "suppressions.json"
-    legacy = target_path / ".komainu" / "suppressions.json"
-    if not current.is_file() and legacy.is_file():
-        print(f"warning: {legacy} is deprecated, move it to {current}", file=sys.stderr)
-        return legacy
-    return current
+    """TARGET/.komagu/suppressions.json."""
+    return target_path / ".komagu" / "suppressions.json"
 
 
 def execute_scan(args: argparse.Namespace) -> int:

package/operate/cli/commands/test.py

@@ -297,7 +297,7 @@ def execute_test(args: argparse.Namespace) -> int:
 
 
 def _matrix_cases_from_scan(scan_file: Path, args: argparse.Namespace, min_consensus: float) -> List[MatrixCase]:
-    """BFLA and mass assignment findings from findings.json (SARIF is not read here)."""
+    """BFLA and mass assignment findings from findings.json or SARIF."""
     try:
         data = json.loads(scan_file.read_text(encoding="utf-8"))
     except (OSError, ValueError):

package/operate/cli/env.py

@@ -1,30 +1,14 @@
-"""Environment variable lookup with the pre-rename KOMAINU_* fallback (#290)."""
+"""Environment variable lookup for KOMAGU_* settings."""
 
 from __future__ import annotations
 
 import os
-import sys
-from typing import Mapping, Optional, Set
+from typing import Mapping, Optional
 
 PREFIX = "KOMAGU_"
-LEGACY_PREFIX = "KOMAINU_"
-
-_warned: Set[str] = set()
 
 
 def getenv(name: str, default: Optional[str] = None, env: Optional[Mapping[str, str]] = None) -> Optional[str]:
-    """Read KOMAGU_<name>; fall back to the deprecated KOMAINU_<name> with a one-time warning."""
+    """Read KOMAGU_<name>."""
     env = os.environ if env is None else env
-    value = env.get(PREFIX + name)
-    if value is not None:
-        return value
-    legacy = env.get(LEGACY_PREFIX + name)
-    if legacy is not None:
-        if name not in _warned:
-            _warned.add(name)
-            print(
-                f"warning: {LEGACY_PREFIX}{name} is deprecated, set {PREFIX}{name} instead",
-                file=sys.stderr,
-            )
-        return legacy
-    return default
+    return env.get(PREFIX + name, default)

package/operate/cross_user_tester/persona_matrix.py

@@ -27,6 +27,8 @@ import urllib.request
 from dataclasses import dataclass, field
 from typing import Any, Dict, List, Mapping, Optional, Tuple
 
+from operate.lsa_sarif.sarif_findings import findings_from_sarif, is_sarif
+
 SUITE_VERSION = 2
 DENY_STATUS = (401, 403, 404)
 STRICT_DENY_STATUS = (404,)
@@ -278,12 +280,14 @@ def generate_matrix_cases_from_findings(
     default_id: str = "12345",
     min_consensus: float = 0.0,
 ) -> List[MatrixCase]:
-    """Turn BFLA and mass assignment findings into matrix cases.
+    """Turn BFLA and mass assignment findings (findings.json or SARIF) into matrix cases.
 
     BFLA findings are replayed by a normal user (``token_env``) who must be
     refused. Mass assignment findings are probed by the same user with the
     privileged fields from ``attack_vector.fields`` (default: role / is_admin).
     """
+    if is_sarif(data):
+        data = findings_from_sarif(data)
     items = data if isinstance(data, list) else (data.get("findings", []) if isinstance(data, dict) else [])
     persona = Persona(name="user", token_env=token_env)
     cases: List[MatrixCase] = []

package/operate/devsecops/pipeline.py

@@ -107,14 +107,14 @@ class DevSecOpsPipeline:
         results = []
         rules = [
             {
-                "id": "KOMAINU-SECRET-001",
+                "id": "KOMAGU-SECRET-001",
                 "name": "HardcodedCredentialDetected",
                 "shortDescription": {"text": "Potential hardcoded secret or API credential detected."},
                 "defaultConfiguration": {"level": "error"},
             }
         ]
 
-        skip_dirs = {".git", "node_modules", "bin", "obj", ".komagu", ".komagu-devsecops", ".komainu", ".komainu-devsecops", "dist", "build"}
+        skip_dirs = {".git", "node_modules", "bin", "obj", ".komagu", ".komagu-devsecops", "dist", "build"}
         skip_exts = {".png", ".jpg", ".jpeg", ".gif", ".ico", ".pdf", ".zip", ".tar", ".gz", ".db", ".sqlite"}
 
         for dirpath, dirnames, filenames in os.walk(self.target_dir):
@@ -137,7 +137,7 @@ class DevSecOpsPipeline:
                                 if re.search(pattern, line):
                                     results.append(
                                         {
-                                            "ruleId": "KOMAINU-SECRET-001",
+                                            "ruleId": "KOMAGU-SECRET-001",
                                             "level": "error",
                                             "message": {"text": f"{desc} found in {rel_path}"},
                                             "locations": [
@@ -324,7 +324,7 @@ class DevSecOpsPipeline:
         results = []
         rules = [
             {
-                "id": "KOMAINU-CONTAINER-001",
+                "id": "KOMAGU-CONTAINER-001",
                 "name": "DockerfileSecurityMisconfiguration",
                 "shortDescription": {"text": "Container configuration deviates from production hardening standards."},
                 "defaultConfiguration": {"level": "warning"},
@@ -343,7 +343,7 @@ class DevSecOpsPipeline:
                                     if re.search(pattern, line.strip()):
                                         results.append(
                                             {
-                                                "ruleId": "KOMAINU-CONTAINER-001",
+                                                "ruleId": "KOMAGU-CONTAINER-001",
                                                 "level": level,
                                                 "message": {"text": f"{msg} at {rel_path}:{line_no}"},
                                                 "locations": [

package/operate/exploit/generator.py

@@ -15,6 +15,8 @@ import re
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Union
 
+from operate.lsa_sarif.sarif_findings import findings_from_sarif, is_sarif
+
 
 class PoCArtifact:
     """Represents a generated Proof-of-Concept exploit artifact."""
@@ -317,7 +319,9 @@ curl -i -G "{self.base_url}{path}" \\
         self,
         findings_data: Union[Dict[str, Any], List[Dict[str, Any]]],
     ) -> List[PoCArtifact]:
-        """Generate PoC artifacts for all confirmed/likely findings."""
+        """Generate PoC artifacts for all confirmed/likely findings (findings.json or SARIF)."""
+        if is_sarif(findings_data):
+            findings_data = findings_from_sarif(findings_data)
         items = findings_data if isinstance(findings_data, list) else findings_data.get("findings", [])
         artifacts: List[PoCArtifact] = []
 

package/operate/lsa_sarif/lsa_to_sarif.py

@@ -69,7 +69,28 @@ RULE_ID_PREFIX = {"bola": "BOLA", "bfla": "BFLA", "mass_assignment": "MASS"}
 
 def _get_rule_id(category: str, cwe: int) -> str:
     cat_prefix = RULE_ID_PREFIX.get(category, "INJ")
-    return f"KOMAINU-{cat_prefix}-CWE{cwe}"
+    return f"KOMAGU-{cat_prefix}-CWE{cwe}"
+
+
+# Same replay properties as assess/lsa/scripts/findings_to_sarif.py, so `komagu test --from-scan`
+# and `--export-poc` can read either exporter's SARIF. suggested_payload is left out on purpose.
+_REPLAY_KEYS = ("method", "path", "fields", "readback", "target_param")
+
+
+def _replay_properties(finding: Dict[str, Any]) -> Dict[str, Any]:
+    props: Dict[str, Any] = {}
+    ep = finding.get("endpoint")
+    if isinstance(ep, dict) and ep.get("path"):
+        props["endpoint"] = {k: ep[k] for k in ("method", "path") if ep.get(k)}
+    av = finding.get("attack_vector")
+    if isinstance(av, dict):
+        kept = {k: av[k] for k in _REPLAY_KEYS if av.get(k) not in (None, "", {})}
+        if kept:
+            props["attack_vector"] = kept
+    cons = finding.get("consensus")
+    if isinstance(cons, dict) and isinstance(cons.get("score"), (int, float)):
+        props["consensus_score"] = cons["score"]
+    return props
 
 
 def convert_findings_to_sarif(
@@ -172,6 +193,7 @@ def convert_findings_to_sarif(
                 "confidence": finding.get("confidence"),
                 "cwe": cwe,
                 "status": finding.get("status", "new"),
+                **_replay_properties(finding),
             },
         }
 
@@ -179,7 +201,7 @@ def convert_findings_to_sarif(
             result_item["relatedLocations"] = related_locations
 
         if finding.get("fingerprint"):
-            result_item["partialFingerprints"] = {"komainu/v1": finding["fingerprint"]}
+            result_item["partialFingerprints"] = {"komagu/v1": finding["fingerprint"]}
 
         results.append(result_item)
 

package/operate/lsa_sarif/sarif_findings.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Read LSA SARIF results back as findings.json-style entries (#289).
+
+`komagu test --from-scan` and `--export-poc` work on findings.json entries. This lets them take
+the SARIF that `komagu scan` writes instead. Both LSA exporters (assess/lsa/scripts/findings_to_sarif.py
+and operate/lsa_sarif/lsa_to_sarif.py) put finding_id, category, endpoint, attack_vector and
+consensus_score in each result's properties; older SARIF without them falls back to the rule id,
+the OWASP rule tags and the "[METHOD /path]" part of the message.
+
+Python standard library only.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Dict, List, Optional
+
+# OWASP API Top 10 rule tags written by findings_to_sarif.py, for SARIF whose ruleId has no category
+_TAG_CATEGORY = {
+    "owasp-api1:2023-bola": "bola",
+    "owasp-api5:2023-bfla": "bfla",
+    "owasp-api3:2023-bopla": "mass_assignment",
+}
+# Rule id prefixes written by operate/lsa_sarif/lsa_to_sarif.py (KOMAGU-<PREFIX>-CWE<n>;
+# 1.x SARIF files use KOMAINU-, still read for one major release, #312)
+_LEGACY_PREFIX_CATEGORY = {"BOLA": "bola", "BFLA": "bfla", "MASS": "mass_assignment", "INJ": "sql_injection"}
+_ENDPOINT_IN_MESSAGE = re.compile(r"\[(GET|POST|PUT|PATCH|DELETE)(?:\|[A-Z]+)*\s+(/[^\]\s]*)\]")
+
+
+def is_sarif(data: Any) -> bool:
+    return isinstance(data, dict) and isinstance(data.get("runs"), list)
+
+
+def _rule_tags(run: Dict[str, Any]) -> Dict[str, List[str]]:
+    rules = ((run.get("tool") or {}).get("driver") or {}).get("rules") or []
+    return {
+        str(r.get("id", "")): [str(t).lower() for t in ((r.get("properties") or {}).get("tags") or [])]
+        for r in rules
+        if isinstance(r, dict)
+    }
+
+
+def _category(rule_id: str, props: Dict[str, Any], tags: List[str]) -> Optional[str]:
+    if props.get("category"):
+        return str(props["category"]).lower()
+    if rule_id.startswith("lsa/"):
+        parts = rule_id.split("/")
+        if len(parts) > 1 and parts[1]:
+            return parts[1].lower()
+    m = re.match(r"(?:KOMAINU|KOMAGU)-([A-Z]+)-", rule_id)
+    if m and m.group(1) in _LEGACY_PREFIX_CATEGORY:
+        return _LEGACY_PREFIX_CATEGORY[m.group(1)]
+    for tag in tags:
+        if tag in _TAG_CATEGORY:
+            return _TAG_CATEGORY[tag]
+    return None
+
+
+def findings_from_sarif(data: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """Return one findings.json-style dict per SARIF result that names an endpoint."""
+    findings: List[Dict[str, Any]] = []
+    for run in data.get("runs") or []:
+        if not isinstance(run, dict):
+            continue
+        tags_by_rule = _rule_tags(run)
+        for result in run.get("results") or []:
+            if not isinstance(result, dict):
+                continue
+            rule_id = str(result.get("ruleId", ""))
+            props = result.get("properties") or {}
+            category = _category(rule_id, props, tags_by_rule.get(rule_id, []))
+            if category is None:
+                continue
+            message = str((result.get("message") or {}).get("text", ""))
+            endpoint = props.get("endpoint") if isinstance(props.get("endpoint"), dict) else None
+            if not endpoint:
+                m = _ENDPOINT_IN_MESSAGE.search(message)
+                endpoint = {"method": m.group(1), "path": m.group(2)} if m else None
+            attack_vector = props.get("attack_vector") if isinstance(props.get("attack_vector"), dict) else None
+            if not endpoint and not (attack_vector and attack_vector.get("path")):
+                continue
+            finding_id = props.get("finding_id") or (result.get("partialFingerprints") or {}).get("lsaFindingId") or rule_id
+            finding: Dict[str, Any] = {
+                "finding_id": str(finding_id),
+                "category": category,
+                "title": message.split(" [", 1)[0] or rule_id,
+                "status": props.get("status", "confirmed"),
+            }
+            if endpoint:
+                finding["endpoint"] = dict(endpoint)
+            if attack_vector:
+                finding["attack_vector"] = dict(attack_vector)
+            if isinstance(props.get("consensus_score"), (int, float)):
+                finding["consensus"] = {"score": props["consensus_score"]}
+            findings.append(finding)
+    return findings