@hoanghainh/komagu 1.8.0 → 2.0.1

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.0.1](https://github.com/hoanghainh1188/komagu/compare/v2.0.0...v2.0.1) (2026-10-31)
+
+
+### Bug Fixes
+
+* **ai:** anchor findings to Tier 1 routes, retry bad replies, show model fields ([#321](https://github.com/hoanghainh1188/komagu/issues/321)) ([97dc16e](https://github.com/hoanghainh1188/komagu/commit/97dc16e635f917079061702b54b50cbe6ff4c64e))
+
+## [2.0.0](https://github.com/hoanghainh1188/komagu/compare/v1.8.0...v2.0.0) (2026-10-30)
+
+
+### ⚠ BREAKING CHANGES
+
+* rename identifiers kept as "komainu" and remove 1.x shims ([#315](https://github.com/hoanghainh1188/komagu/issues/315))
+  Rule IDs, the SARIF fingerprint key, audit event and logger names, WAF tags, the default token audience, the PostgreSQL role and Terraform resource names change; `KOMAINU_*` env vars, `komainu.security.*` properties and the `komainu` npm bins are removed. Read [Migrating to Komagu 2.0](https://github.com/hoanghainh1188/komagu/blob/main/docs/migration-2.0.md) before upgrading.
+
+### Features
+
+* rename identifiers kept as "komainu" and remove 1.x shims ([#315](https://github.com/hoanghainh1188/komagu/issues/315)) ([cbc63de](https://github.com/hoanghainh1188/komagu/commit/cbc63de3c4e1f90985420b74ba5211740ef4fe25))
+* **test:** read BFLA and mass assignment findings from SARIF in --from-scan and --export-poc ([#313](https://github.com/hoanghainh1188/komagu/issues/313)) ([f91c2fa](https://github.com/hoanghainh1188/komagu/commit/f91c2fa345972bb8da91c503537cafaec7e4ed7b))
+
 ## [1.8.0](https://github.com/hoanghainh1188/komagu/compare/v1.7.0...v1.8.0) (2026-10-30)
 
 

package/README.md

@@ -68,7 +68,7 @@ sequenceDiagram
 
     Note over Team,Komagu: Phase 1: Day 1 — Non-Invasive Audit (Tier 1 & Tier 2)
     Team->>Komagu: npx @hoanghainh/komagu scan ./legacy-app --format html
-    Komagu-->>Team: report.html & SARIF (Zero false alarms, 1.000 precision)
+    Komagu-->>Team: report.html & SARIF (verified findings with file:line evidence)
 
     Note over Team,Edge: Phase 2: Day 2 — Zero-Code Perimeter Shield
     Team->>Edge: npx @hoanghainh/komagu protect --up

package/assess/lsa/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.1 — 2026-10-30
+
+SARIF replay properties (#289).
+
+- **`findings_to_sarif.py`:** each SARIF result's `properties` now carries `finding_id`, `category`, `endpoint`, `attack_vector` (`method`, `path`, `fields`, `readback`, `target_param`) and `consensus_score`, so `komagu test --from-scan` and `--export-poc` can replay BFLA and mass assignment findings from SARIF. `suggested_payload` is not exported, to keep attack strings out of code scanning.
+
 ## 0.2.3 — 2026-10-26
 
 Runtime adapters (#244).

package/assess/lsa/VERSION

@@ -1 +1 @@
-0.3.0
+0.3.1

package/assess/lsa/adapters/build_adapters.py

@@ -118,8 +118,11 @@ Scripts: `python3 {ref}/scripts/<script>.py` (Python 3.8+, standard library only
     print("Next step: In your Claude Code workspace, prompt: 'Run the legacy-security-audit skill. TARGET=src, OUT=lsa-out'")
 
 
-AGENTS_MD_BEGIN = "<!-- komainu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
-AGENTS_MD_END = "<!-- komainu-lsa:end -->"
+AGENTS_MD_BEGIN = "<!-- komagu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
+AGENTS_MD_END = "<!-- komagu-lsa:end -->"
+# Pre-2.0 markers, still replaced in place for one major release (#312)
+LEGACY_AGENTS_MD_BEGIN = "<!-- komainu-lsa:begin (generated by adapters/build_adapters.py; edits inside this block are overwritten) -->"
+LEGACY_AGENTS_MD_END = "<!-- komainu-lsa:end -->"
 
 
 def toml_multiline(text: str) -> str:
@@ -156,13 +159,16 @@ def agents_md_with_block(path: Path, block: str) -> str:
             raise ValueError(f"{path} is not UTF-8 ({e}); convert it, then re-run") from e
     nl = "\r\n" if "\r\n" in current else "\n"
     section = f"{AGENTS_MD_BEGIN}\n{block.strip()}\n{AGENTS_MD_END}\n".replace("\n", nl)
-    begins, ends = current.count(AGENTS_MD_BEGIN), current.count(AGENTS_MD_END)
+    begin_marker, end_marker = AGENTS_MD_BEGIN, AGENTS_MD_END
+    if begin_marker not in current and end_marker not in current:
+        begin_marker, end_marker = LEGACY_AGENTS_MD_BEGIN, LEGACY_AGENTS_MD_END
+    begins, ends = current.count(begin_marker), current.count(end_marker)
     if begins == 0 and ends == 0:
         return section if not current.strip() else current.rstrip("\r\n") + nl + nl + section
-    start, stop = current.find(AGENTS_MD_BEGIN), current.find(AGENTS_MD_END)
+    start, stop = current.find(begin_marker), current.find(end_marker)
     if begins != 1 or ends != 1 or stop < start:
-        raise ValueError(f"{path} has unbalanced komainu-lsa markers; remove them by hand, then re-run")
-    stop += len(AGENTS_MD_END)
+        raise ValueError(f"{path} has unbalanced komagu-lsa markers; remove them by hand, then re-run")
+    stop += len(end_marker)
     if current.startswith(nl, stop):
         stop += len(nl)
     return current[:start] + section + current[stop:]
@@ -252,7 +258,9 @@ def build_cursor(dest: Path) -> None:
     print("Next step: In Cursor, open a new chat and invoke: '@lsa-orchestrator run security audit on TARGET=src, OUT=lsa-out'")
 
 
-GENERATOR = "komainu-lsa"
+GENERATOR = "komagu-lsa"
+# contract.json files written before 2.0 carry the old value; still recognised for one major release (#312)
+KNOWN_GENERATORS = (GENERATOR, "komainu-lsa")
 
 
 def check_generic_dest(dest: Path) -> None:
@@ -266,7 +274,7 @@ def check_generic_dest(dest: Path) -> None:
             data = json.loads(contract.read_text(encoding="utf-8"))
         except (UnicodeDecodeError, ValueError):
             data = None
-        if not isinstance(data, dict) or data.get("generator") != GENERATOR:
+        if not isinstance(data, dict) or data.get("generator") not in KNOWN_GENERATORS:
             raise ValueError(f"{contract} was not generated by Komagu LSA (no \"generator\": \"{GENERATOR}\"); "
                              "choose an empty DEST such as ./lsa-bundle, or move that file away")
         return

package/assess/lsa/adapters/codex/README.md

@@ -15,7 +15,7 @@ This creates:
   directory up to the repository root.
 - `.codex/agents/lsa-*.toml` — one project custom agent per role
   (`name`, `description`, `developer_instructions`).
-- `AGENTS.md` — an LSA section between `komainu-lsa:begin` / `komainu-lsa:end`
+- `AGENTS.md` — an LSA section between `komagu-lsa:begin` / `komagu-lsa:end`
   markers. Anything you write outside the markers is kept; re-running the
   generator only replaces the section.
 

package/assess/lsa/adapters/generic/README.md

@@ -8,7 +8,7 @@ komagu init --ai generic ./lsa-bundle
 ```
 
 It writes `system-prompts/`, `kit/` and `contract.json` into that folder.
-The contract carries `"generator": "komainu-lsa"`. Re-running refreshes a
+The contract carries `"generator": "komagu-lsa"`. Re-running refreshes a
 bundle that has this marker. The generator refuses, before writing anything,
 when the folder has a `contract.json` without the marker, or a `kit/` or
 `system-prompts/` folder but no `contract.json`. This keeps a project's own