@hoanghainh/komagu 1.8.0 → 2.0.1

package/assess/lsa/examples/eval-run-5/gptoss-a/stack-profile.json

@@ -0,0 +1,226 @@
+{
+  "repo": "repo",
+  "generated_by": "lsa detect_stack.py 0.3.1",
+  "stacks": [
+    {
+      "id": "php",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "20 file(s) with extension .php, .php3, .php4, .php5, .phtml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-codeigniter",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "marker file php-codeigniter/system/core/CodeIgniter.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "php-laravel",
+      "language": "php",
+      "version_hint": null,
+      "evidence": [
+        "pattern /Route::(get|post|put|delete|any|match|re/ in php-laravel/routes/web.php"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-servlet",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/web.xml",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/OrderServlet.java",
+        "pattern /extends\\s+HttpServlet|@WebServlet/ in java-legacy/src/com/acme/web/ProfileServlet.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-jsp",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .jsp, .jspf"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-struts1",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "marker file java-legacy/WebContent/WEB-INF/struts-config.xml",
+        "pattern /extends\\s+(Dispatch|LookupDispatch|Mappi/ in java-legacy/src/com/acme/struts/EditUserAction.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-spring-mvc",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AccountController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/AdminUserController.java",
+        "pattern /@(Controller|RestController)\\b|@RequestM/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-mybatis",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /<mapper\\s+namespace=|org\\.apache\\.ibatis/ in java-legacy/src/com/acme/mapper/OrderMapper.xml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "java-hibernate",
+      "language": "java",
+      "version_hint": null,
+      "evidence": [
+        "pattern /org\\.hibernate\\.|\\.hbm\\.xml|createQuery\\/ in java-legacy/src/com/acme/web/InvoiceController.java"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-webforms",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .ascx, .aspx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-handlers",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .ashx"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "dotnet-mvc",
+      "language": "csharp/vbnet",
+      "version_hint": null,
+      "evidence": [
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/AdminController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "pattern /:\\s*(ControllerBase|Controller)\\b|Inheri/ in dotnet-legacy/Web/Controllers/InvoiceController.cs"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "classic-asp",
+      "language": "vbscript",
+      "version_hint": null,
+      "evidence": [
+        "4 file(s) with extension .asa, .asp"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "perl-cgi",
+      "language": "perl",
+      "version_hint": null,
+      "evidence": [
+        "1 file(s) with extension .cgi",
+        "pattern /use\\s+CGI\\b|CGI->new|use\\s+DBI\\b/ in perl-cgi/cgi-bin/order.cgi"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "coldfusion",
+      "language": "cfml",
+      "version_hint": null,
+      "evidence": [
+        "2 file(s) with extension .cfc, .cfm, .cfml"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "node-express",
+      "language": "javascript",
+      "version_hint": null,
+      "evidence": [
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/admin.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/orders.js",
+        "pattern /require\\(\\s*['\\\"]express['\\\"]\\s*\\)|from\\/ in node-express/routes/profile.js"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "python-flask",
+      "language": "python",
+      "version_hint": null,
+      "evidence": [
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/app.py",
+        "pattern /from\\s+flask\\s+import|import\\s+flask/ in python-flask/profile.py"
+      ],
+      "confirmed": false
+    },
+    {
+      "id": "sql-procedures",
+      "language": "sql",
+      "version_hint": null,
+      "evidence": [
+        "pattern /(?i)create\\s+(or\\s+replace\\s+)?proc(edur/ in sql-procs/sp_search_orders.sql"
+      ],
+      "confirmed": false
+    }
+  ],
+  "data_access": [
+    "JDBC",
+    "mysql_* (no binding)",
+    "ColdFusion cfquery",
+    "Entity Framework / LINQ to SQL",
+    "ADO.NET",
+    "Hibernate/JPA",
+    "Classic ADO",
+    "MyBatis/iBATIS",
+    "TypeORM (Node/TS)",
+    "Perl DBI",
+    "MongoDB",
+    "PDO"
+  ],
+  "databases": [
+    "MySQL",
+    "SQL Server",
+    "MongoDB"
+  ],
+  "file_counts": {
+    ".php": 20,
+    ".java": 7,
+    ".cs": 5,
+    ".asp": 4,
+    ".xml": 3,
+    ".js": 3,
+    ".aspx": 2,
+    ".py": 2,
+    ".cfc": 1,
+    ".cfm": 1,
+    ".config": 1,
+    ".ashx": 1,
+    ".vb": 1,
+    ".jsp": 1,
+    ".cgi": 1,
+    ".sql": 1
+  },
+  "knowledge_files": [
+    "knowledge/stacks/php.md",
+    "knowledge/stacks/java.md",
+    "knowledge/stacks/dotnet.md",
+    "knowledge/stacks/classic-asp.md",
+    "knowledge/stacks/perl-cgi.md",
+    "knowledge/stacks/coldfusion.md",
+    "knowledge/stacks/node-python-ruby.md"
+  ],
+  "notes": "Heuristic result. The stack-detector agent must confirm each item."
+}

package/assess/lsa/examples/eval-run-5/gptoss-b/ai-run-stats.json

@@ -0,0 +1,83 @@
+{
+  "model": "gpt-oss:20b",
+  "endpoint": "http://localhost:11434/v1/chat/completions",
+  "phases": {
+    "2-stack-detector": {
+      "seconds": 567.881,
+      "calls": 1,
+      "prompt_tokens": 3118,
+      "completion_tokens": 11596
+    },
+    "3-route-mapper": {
+      "seconds": 0.048,
+      "calls": 0,
+      "prompt_tokens": 0,
+      "completion_tokens": 0
+    },
+    "4a-bola-auditor": {
+      "seconds": 1670.708,
+      "calls": 7,
+      "prompt_tokens": 80567,
+      "completion_tokens": 33678
+    },
+    "4b-injection-auditor": {
+      "seconds": 672.139,
+      "calls": 2,
+      "prompt_tokens": 15801,
+      "completion_tokens": 21643
+    },
+    "4c-privilege-auditor": {
+      "seconds": 555.588,
+      "calls": 2,
+      "prompt_tokens": 24026,
+      "completion_tokens": 14528
+    },
+    "5-finding-verifier": {
+      "seconds": 1667.106,
+      "calls": 19,
+      "prompt_tokens": 133891,
+      "completion_tokens": 29835
+    }
+  },
+  "totals": {
+    "calls": 31,
+    "prompt_tokens": 257403,
+    "completion_tokens": 111280,
+    "seconds": 5130.466
+  },
+  "parse_failures": {
+    "4a-bola-auditor": [
+      "routes-001"
+    ]
+  },
+  "call_errors": {},
+  "retries": {
+    "4a-bola-auditor": [
+      "routes-001"
+    ]
+  },
+  "anchoring": {
+    "moved": [
+      "BOLA-R-0057-2",
+      "BOLA-R-0058-1",
+      "INJ-I-0021",
+      "INJ-I-0022",
+      "INJ-I-0023",
+      "INJ-I-0027",
+      "INJ-I-0032",
+      "INJ-I-0034",
+      "BFLA-R-0007-1",
+      "BFLA-R-0009-1",
+      "BFLA-R-0032-1",
+      "MASS-M-0001-1",
+      "MASS-M-0002-1",
+      "MASS-M-0003-1",
+      "MASS-M-0007-1",
+      "MASS-M-0010-1",
+      "MASS-M-0013-1",
+      "MASS-M-0015-1",
+      "MASS-M-0014-1"
+    ],
+    "unanchored": []
+  }
+}

package/assess/lsa/examples/eval-run-5/gptoss-b/coverage.json

@@ -0,0 +1,44 @@
+{
+  "route_candidates": 74,
+  "inventoried": 74,
+  "rejected": 0,
+  "missing_from_inventory": [],
+  "bola_routes_to_audit": 74,
+  "bola_routes_without_verdict": [
+    "R-0001",
+    "R-0002",
+    "R-0003",
+    "R-0004",
+    "R-0005",
+    "R-0006",
+    "R-0007",
+    "R-0008",
+    "R-0009",
+    "R-0013",
+    "R-0014",
+    "R-0015",
+    "R-0017",
+    "R-0018",
+    "R-0019"
+  ],
+  "bfla_routes_to_audit": 0,
+  "bfla_routes_without_verdict": [],
+  "injection_candidates": 38,
+  "injection_candidates_without_verdict": [],
+  "mass_candidates": 15,
+  "mass_candidates_without_verdict": [],
+  "findings_without_verification": [],
+  "duplicates_removed": [
+    {
+      "kept": "BOLA-R-0057-1",
+      "dropped": "BOLA-R-0057-2"
+    },
+    {
+      "kept": "BOLA-R-0058-1",
+      "dropped": "BOLA-R-0058-2"
+    }
+  ],
+  "validation_errors": [],
+  "new_issues_from_verifier": [],
+  "out_of_scope_notes": []
+}