@hoanghainh/komagu 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.4.0](https://github.com/hoanghainh1188/komagu/compare/v2.3.0...v2.4.0) (2026-11-03)
+
+
+### Features
+
+* **pilot:** prepare the AMS pilot on a Java legacy system and redact secrets sent to the model ([#352](https://github.com/hoanghainh1188/komagu/issues/352)) ([fb02b3c](https://github.com/hoanghainh1188/komagu/commit/fb02b3cbdf70e3d6e5ee7c73c7e308f03c2ff7f3))
+
+
+### Documentation
+
+* **delivery:** remove Komainu leftovers and file:/// links from pilot deliverables ([#353](https://github.com/hoanghainh1188/komagu/issues/353)) ([f61d1df](https://github.com/hoanghainh1188/komagu/commit/f61d1dff03469986970d0a6d640a37fd2f7b947f))
+
 ## [2.3.0](https://github.com/hoanghainh1188/komagu/compare/v2.2.1...v2.3.0) (2026-11-01)
 
 

package/assess/lsa/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## Unreleased
+
+AMS pilot readiness (#350).
+
+- **Secret redaction (`scripts/redaction.py`, re-exported by `lsa_common`):** besides quoted `password`-like values, it now masks:
+  - unquoted config values (`.properties`, YAML, `.env`) and dotted keys inside comments (`<%-- db.password=x --%>`);
+  - JSON and PHP keys, plus `pass`, `pw`, `passphrase` and `credential` key names such as Tomcat `keystorePass`;
+  - Java legacy forms: `setPassword("x")`, `getConnection(url, user, "x")`, `PasswordAuthentication`, Spring XML `<property name=… value=…>`, and `web.xml` `<param-name>` / `<param-value>`, including when split across lines;
+  - credentials in connection strings and URIs (`;password=`, `?pwd=`, `password={…}`, `scheme://user:pass@host`, `jdbc:oracle:thin:user/pass@host`);
+  - `Basic` / `Bearer` values and AWS, GitHub, `sk-` and Google API tokens;
+  - private key blocks.
+
+  Lines longer than 4,000 characters are dropped whole, which keeps the regexes linear on minified files. The headless runner applies `redact_lines()` to every code excerpt it sends to the model (`operate/ai/context.py`).
+- **`detect_stack.py`:** JPA's `@Entity` and Spring Data's `getRepository` no longer report "TypeORM (Node/TS)" on Java code.
+
 ## 0.3.1 — 2026-10-30
 
 SARIF replay properties (#289).

package/assess/lsa/scripts/detect_stack.py

@@ -86,7 +86,8 @@ DATA_ACCESS = [
     ("database/sql (Go)", r"sql\.Open|db\.Query|db\.Exec"),
     ("SQLAlchemy (Python)", r"sqlalchemy\.|create_engine|SessionLocal"),
     ("Prisma (Node/TS)", r"PrismaClient|@prisma/client"),
-    ("TypeORM (Node/TS)", r"typeorm|@Entity|getRepository"),
+    # Not bare @Entity / getRepository: JPA and Spring Data use the same names
+    ("TypeORM (Node/TS)", r"['\"]typeorm['\"]|\bTypeORM\b"),
     ("Drizzle ORM (Node/TS)", r"drizzle-orm"),
     ("postgres.js (Node/TS)", r"from\s+['\"]postgres['\"]|require\(\s*['\"]postgres['\"]\s*\)"),
 ]

package/assess/lsa/scripts/lsa_common.py

@@ -166,8 +166,4 @@ def snippet(lines: List[str], lineno: int, max_len: int = 220) -> str:
     return s if len(s) <= max_len else s[: max_len - 3] + "..."
 
 
-SECRET_RE = re.compile(r"(?i)(password|passwd|pwd|secret|api[_-]?key|token)\s*[=:]\s*['\"][^'\"]{4,}['\"]")
-
-
-def redact(s: str) -> str:
-    return SECRET_RE.sub(lambda m: m.group(1) + "=[REDACTED]", s)
+from redaction import redact, redact_lines  # noqa: E402,F401  (re-exported for the Tier 1 scripts)

package/assess/lsa/scripts/redaction.py

@@ -0,0 +1,118 @@
+"""Secret redaction for code excerpts: Tier 1 snippets and every excerpt the headless agents send to a model (#350).
+
+Pattern-based, so it cannot catch every secret: the pilot runbook also leaves key and environment config files
+out of the source copy. Standard-library only (Python 3.8+ compatible).
+"""
+
+from __future__ import annotations
+
+import re
+from typing import List, Optional, Tuple
+
+MASK = "[REDACTED]"
+# Longer lines (minified bundles, generated data) are dropped whole: they are not useful to an auditor and
+# keep the regexes below from running on megabyte-long input
+MAX_LINE_CHARS = 4000
+
+# A secret-like key name; the lookahead keeps passwordPolicy, tokenizer and Passenger out
+_KW = r"(?:password|passwd|passphrase|pwd|pw|pass|secret|credential|api[_-]?key|token)(?![a-z])"
+_NAME_TAGS = r"(?:param-name|name|key)"
+_VALUE_TAGS = r"(?:param-value|value)"
+
+
+def _rx(pattern: str, flags: int = re.IGNORECASE) -> re.Pattern[str]:
+    return re.compile(pattern, flags)
+
+
+# (pattern, replacement); applied in order to each line
+_RULES: Tuple[Tuple[re.Pattern[str], str], ...] = (
+    # -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- on one line
+    (_rx(r"(-----BEGIN [A-Z ]*PRIVATE KEY-----).*?(-----END [A-Z ]*PRIVATE KEY-----)", 0), r"\1" + MASK + r"\2"),
+    # "password": "x", 'password' => 'x', pw = "x", keystorePass="x", setProperty("mail.smtp.password", "x")
+    (_rx(r"(?<![\w.\-])((['\"]?)[\w.\-]*?" + _KW + r"\2\s*(?:=>|->|[=:,])\s*)(['\"])[^'\"]+\3"), r"\1\3" + MASK + r"\3"),
+    # conn.setPassword("x"), setKeystorePass("x")
+    (_rx(r"(\bset\w*?" + _KW + r"\s*\(\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # DriverManager.getConnection(url, "sa", "x")
+    (_rx(r"(\bgetConnection\s*\([^,()]*,[^,()]*,\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # new PasswordAuthentication("u", "x".toCharArray())
+    (_rx(r"(\bPasswordAuthentication\s*\([^,()]*,\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    # <property name="jdbc.password" value="x"/>
+    (_rx(r"(\bname\s*=\s*['\"][^'\"]*?" + _KW + r"[^'\"]*['\"][^>]*?\bvalue\s*=\s*)(['\"])[^'\"]*\2"),
+     r"\1\2" + MASK + r"\2"),
+    # <param-name>password</param-name><param-value>x</param-value>
+    (_rx(r"(<" + _NAME_TAGS + r">[^<]*?" + _KW + r"[^<]*</" + _NAME_TAGS + r">\s*<" + _VALUE_TAGS + r">)[^<]+"),
+     r"\1" + MASK),
+    # <password>x</password>
+    (_rx(r"(<([\w.\-:]*?" + _KW + r")\s*>)[^<]+(?=</\2\s*>)"), r"\1" + MASK),
+    # jdbc:sqlserver://h;password=x  ?pwd=x&  password={a;b}
+    (_rx(r"([;?&](?:password|passwd|pwd)=)(?:\{[^}]*\}|[^;\"'&\s]+)"), r"\1" + MASK),
+    # scheme://user:pass@host
+    (_rx(r"(?<![a-z0-9+.\-])([a-z][a-z0-9+.\-]*://[^/\s:@\"']+:)[^@\s\"'/]+@"), r"\1" + MASK + "@"),
+    # jdbc:oracle:thin:user/pass@host
+    (_rx(r"(\bjdbc:oracle:\w+:[^/\s:@\"']+/)[^@\s\"']+@"), r"\1" + MASK + "@"),
+    # Authorization: Basic xxx / Bearer xxx
+    (_rx(r"(\b(?:Basic|Bearer)\s+)[A-Za-z0-9._~+/=\-]{8,}"), r"\1" + MASK),
+    # Well-known token formats (case-sensitive)
+    (_rx(r"\b(?:AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_\w{20,}|sk-[A-Za-z0-9_\-]{20,}"
+         r"|AIza[0-9A-Za-z_\-]{35})\b", 0), MASK),
+    # Unquoted config values (.properties, YAML, .env) on their own line; ${PLACEHOLDER} and code are kept
+    (_rx(r"^(\s*[\w.\-]*?" + _KW + r"[\w.\-]*\s*[=:]\s*)(?![\"'$=\s])[^\s\"'(){}<>,;]+\s*(?:(?:#|//).*)?$"), r"\1" + MASK),
+    # Dotted config keys inside comments or strings: <%-- db.password=x --%>
+    (_rx(r"(?<![\w.\-])([\w\-]+\.[\w.\-]*?" + _KW + r"[\w\-]*\s*=\s*)(?![\"'$=\s])[^\s\"'(){}<>,;]+(?=\s|$|[\"'])"),
+     r"\1" + MASK),
+)
+
+_PRIVATE_KEY_BEGIN = _rx(r"-----BEGIN [A-Z ]*PRIVATE KEY-----", 0)
+_PRIVATE_KEY_END = _rx(r"-----END [A-Z ]*PRIVATE KEY-----", 0)
+# A secret name whose value follows on a later line: <property name="password"\n value="x"/>, web.xml params
+_PENDING_NAME = _rx(r"\bname\s*=\s*['\"][^'\"]*?" + _KW + r"[^'\"]*['\"]|<" + _NAME_TAGS + r">[^<]*?" + _KW)
+_PENDING_VALUE: Tuple[Tuple[re.Pattern[str], str], ...] = (
+    (_rx(r"(\bvalue\s*=\s*)(['\"])[^'\"]*\2"), r"\1\2" + MASK + r"\2"),
+    (_rx(r"(<" + _VALUE_TAGS + r">)[^<]+"), r"\1" + MASK),
+)
+_PENDING_LINES = 2
+
+
+def _too_long(s: str) -> Optional[str]:
+    return f"[line of {len(s)} characters omitted]" if len(s) > MAX_LINE_CHARS else None
+
+
+def redact(s: str) -> str:
+    """Mask secrets in one line of code or config."""
+    omitted = _too_long(s)
+    if omitted:
+        return omitted
+    for pattern, repl in _RULES:
+        s = pattern.sub(repl, s)
+    return s
+
+
+def _redact_pending(line: str) -> Tuple[str, bool]:
+    for pattern, repl in _PENDING_VALUE:
+        masked, n = pattern.subn(repl, line)
+        if n:
+            return masked, True
+    return line, False
+
+
+def redact_lines(lines: List[str]) -> List[str]:
+    """Redact each line, blank out private key bodies and mask values split from their names.
+
+    The line count stays the same, so line numbers in excerpts remain valid.
+    """
+    out: List[str] = []
+    in_key, pending = False, 0
+    for line in lines:
+        if in_key:
+            in_key = not _PRIVATE_KEY_END.search(line)
+            out.append(MASK if in_key else line)
+            continue
+        masked = redact(line)
+        if pending:
+            masked, done = _redact_pending(masked)
+            pending = 0 if done else pending - 1
+        if _PENDING_NAME.search(line) and MASK not in masked:
+            pending = _PENDING_LINES
+        in_key = bool(_PRIVATE_KEY_BEGIN.search(line)) and not _PRIVATE_KEY_END.search(line)
+        out.append(masked)
+    return out

package/assess/lsa/tests/test_modern_stacks.py

@@ -255,6 +255,19 @@ async fn f(pool: &PgPool, id: &str) {
         self.assertEqual(raw, {4, 5})
 
     # --- Medium: wrong output ----------------------------------------------------------
+    def test_jpa_entity_is_not_reported_as_typeorm(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / "Account.java").write_text(
+                'import javax.persistence.Entity;\n@Entity\npublic class Account { Long id; String role; }\n',
+                encoding="utf-8")
+            data_access = detect(root, self.config)["data_access"]
+            self.assertIn("Hibernate/JPA", data_access)
+            self.assertNotIn("TypeORM (Node/TS)", data_access)
+            (root / "user.entity.ts").write_text(
+                "import { Entity, Column } from 'typeorm';\n@Entity()\nexport class User {}\n", encoding="utf-8")
+            self.assertIn("TypeORM (Node/TS)", detect(root, self.config)["data_access"])
+
     def test_go_stack_label_ignores_gin_substring(self) -> None:
         routes, _ = self.scan({"main.go": '''package main
 import "github.com/labstack/echo/v4"

package/operate/ai/context.py

@@ -5,18 +5,38 @@ Standard-library only (Python 3.8+ compatible).
 
 from __future__ import annotations
 
+import importlib.util
 import re
 from pathlib import Path
+from types import ModuleType
 from typing import Any, Dict, List, Optional
 
+LSA_REDACTION = Path(__file__).resolve().parents[2] / "assess" / "lsa" / "scripts" / "redaction.py"
+
+
+def _load_redaction() -> ModuleType:
+    """Load the LSA kit's stdlib-only redaction module, so Tier 1 and the agents share one set of patterns."""
+    spec = importlib.util.spec_from_file_location("komagu_lsa_redaction", LSA_REDACTION)
+    if spec is None or spec.loader is None:
+        raise ImportError(f"cannot load LSA redaction from {LSA_REDACTION}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+_redact_lines = _load_redaction().redact_lines
+
 
 def _read_snippet(target_dir: Path, rel_file: str, line: int, radius: int = 15) -> str:
-    """Read a window of code around target line from the audited repository."""
+    """Read a window of code around target line from the audited repository, with secrets redacted.
+
+    Every code excerpt sent to the model goes through here (#350).
+    """
     full_path = target_dir / rel_file
     if not full_path.is_file():
         return f"[File not found: {rel_file}]"
     try:
-        lines = full_path.read_text(encoding="utf-8", errors="replace").splitlines()
+        lines = _redact_lines(full_path.read_text(encoding="utf-8", errors="replace").splitlines())
         start = max(0, line - radius - 1)
         end = min(len(lines), line + radius)
         numbered = [f"{i + 1:4d} | {lines[i]}" for i in range(start, end)]

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.3.0"  # x-release-please-version
+__version__ = "2.4.0"  # x-release-please-version

package/operate/tests/test_ai_redaction.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Secrets are masked in every code snippet the headless agents send to the model (#350)."""
+
+from __future__ import annotations
+
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+import time
+
+from operate.ai.context import _model_source, _read_snippet, _redact_lines, _verification_context
+
+JAVA_DAO = '''package com.acme.dao;
+public class AccountDao {
+    private static final String URL = "jdbc:sqlserver://db01;databaseName=ams;user=sa;password=Ams#2019!";
+    private static final String MONGO = "mongodb://svc:Mongo2020pw@mongo01:27017/ams";
+    private static final String ORA = "jdbc:oracle:thin:scott/Tiger2018@db02:1521/AMS";
+    // db.password=CommentPw7 (old config, kept for reference)
+    private String apiKey = "sk-live-abcdef123456";
+    public Account find(HttpServletRequest req) {
+        String password = req.getParameter("password");
+        String sql = "SELECT * FROM account WHERE id = " + req.getParameter("id");
+        return jdbc.query(sql);
+    }
+}
+'''
+
+PROPERTIES = '''spring.datasource.url=jdbc:oracle:thin:@db02:1521/AMS
+spring.datasource.username=ams_app
+spring.datasource.password=Oracle#Pw2021
+mail.smtp.password: smtpPw99
+app.jwt.secret=c2VjcmV0LWtleS1mb3ItYW1z
+app.token.placeholder=${APP_TOKEN}
+'''
+
+PRIVATE_KEY = '''-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwJ1rdTw6kLqA
+Zm9vYmFyYmF6cXV4cXV1eHF1dXg=
+-----END RSA PRIVATE KEY-----
+class Signer {}
+'''
+
+JSP = '''<%-- legacy: ldap.bind.password=LdapPw55 --%>
+<%@ page import="java.sql.*" %>
+<% String id = request.getParameter("id"); %>
+'''
+
+SECRETS = ("Ams#2019!", "Mongo2020pw", "Tiger2018", "CommentPw7", "sk-live-abcdef123456", "Oracle#Pw2021", "smtpPw99",
+           "c2VjcmV0LWtleS1mb3ItYW1z", "MIIEowIBAAKCAQEAwJ1rdTw6kLqA", "Zm9vYmFyYmF6cXV4cXV1eHF1dXg=", "LdapPw55")
+
+
+class TestSnippetRedaction(unittest.TestCase):
+    def setUp(self) -> None:
+        self.target = Path(tempfile.mkdtemp(prefix="komagu_redact_"))
+        files = {"src/com/acme/dao/AccountDao.java": JAVA_DAO, "src/main/resources/application.properties": PROPERTIES,
+                 "src/com/acme/Signer.java": PRIVATE_KEY, "WebContent/user/detail.jsp": JSP}
+        for rel, text in files.items():
+            (self.target / rel).parent.mkdir(parents=True, exist_ok=True)
+            (self.target / rel).write_text(text, encoding="utf-8")
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.target, ignore_errors=True)
+
+    def assert_no_secret(self, text: str) -> None:
+        for secret in SECRETS:
+            self.assertNotIn(secret, text)
+
+    def test_java_source_snippet_masks_connection_strings_and_keys(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/dao/AccountDao.java", 5)
+        self.assert_no_secret(snip)
+        self.assertIn("[REDACTED]", snip)
+
+    def test_code_the_auditor_needs_is_kept(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/dao/AccountDao.java", 5)
+        self.assertIn('String password = req.getParameter("password");', snip)
+        self.assertIn('"SELECT * FROM account WHERE id = " + req.getParameter("id")', snip)
+        self.assertIn("jdbc:sqlserver://db01;databaseName=ams;user=sa;password=[REDACTED]", snip)
+        self.assertIn("mongodb://svc:[REDACTED]@mongo01:27017/ams", snip)
+        self.assertIn("jdbc:oracle:thin:scott/[REDACTED]@db02:1521/AMS", snip)
+
+    def test_config_line_inside_a_comment_is_masked(self) -> None:
+        snip = _read_snippet(self.target, "WebContent/user/detail.jsp", 2)
+        self.assert_no_secret(snip)
+        self.assertIn("ldap.bind.password=[REDACTED] --%>", snip)
+        self.assertIn('String id = request.getParameter("id");', snip)
+
+    def test_assignments_in_code_are_kept(self) -> None:
+        lines = ["user.password = req.body.password;", "if (token == null) return;", "token: req.headers.authorization,"]
+        (self.target / "app.js").write_text("\n".join(lines) + "\n", encoding="utf-8")
+        snip = _read_snippet(self.target, "app.js", 2)
+        for line in lines:
+            self.assertIn(line, snip)
+
+    def test_unquoted_properties_values_are_masked(self) -> None:
+        snip = _read_snippet(self.target, "src/main/resources/application.properties", 3)
+        self.assert_no_secret(snip)
+        self.assertIn("spring.datasource.username=ams_app", snip)
+        self.assertIn("app.token.placeholder=${APP_TOKEN}", snip)
+
+    def test_private_key_block_is_masked_with_line_numbers_kept(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/Signer.java", 3)
+        self.assert_no_secret(snip)
+        self.assertIn("   5 | class Signer {}", snip)
+
+    def test_model_and_verifier_context_are_masked(self) -> None:
+        model = _model_source(self.target, "AccountDao", "src/com/acme/dao/AccountDao.java", 1)
+        self.assert_no_secret(model["code"])
+        ctx = _verification_context(self.target, {"location": {"file": "src/com/acme/dao/AccountDao.java", "start_line": 8},
+                                                  "evidence": [{"file": "src/main/resources/application.properties", "line": 3}]})
+        self.assert_no_secret(str(ctx))
+
+
+class TestJavaLegacySecretForms(unittest.TestCase):
+    """Forms found in a security review of the first version (#350); each must hide Hunter2x."""
+
+    LEAKS = (
+        '<property name="password" value="Hunter2x"/>',
+        '<property name="jdbc.password"\n          value="Hunter2x"/>',
+        "<param-name>db.password</param-name><param-value>Hunter2x</param-value>",
+        "<init-param>\n  <param-name>password</param-name>\n  <param-value>Hunter2x</param-value>",
+        "<password>Hunter2x</password>",
+        'conn.setPassword("Hunter2x");',
+        'props.setProperty("mail.smtp.password", "Hunter2x");',
+        'Connection c = DriverManager.getConnection(url, "sa", "Hunter2x");',
+        'return new PasswordAuthentication("svc", "Hunter2x".toCharArray());',
+        'String pw = "Hunter2x";',
+        'static final String DB_PASS = "Hunter2x";',
+        '<Connector port="8443" keystorePass="Hunter2x" truststorePass="Hunter2x"/>',
+        '{"password":"Hunter2x", "apikey" : "Hunter2x"}',
+        "$conf = array('password' => 'Hunter2x');",
+        "db_password: Hunter2x  # prod",
+        "mail.smtp.pass=Hunter2x",
+        "ssl.key.passphrase=Hunter2x",
+        "jdbc:sqlserver://db;user=sa;password={Hunter2x;x}",
+        'conn.setRequestProperty("Authorization", "Basic SHVudGVyMng6eHl6");',
+        'h.put("Authorization", "Bearer Hunter2xHunter2x.eyJzdWIiOiIxIn0.sig");',
+        "-----BEGIN PRIVATE KEY----- Hunter2xMIIEvQIBADANBgkq -----END PRIVATE KEY-----",
+    )
+    TOKENS = ("AKIAIOSFODNN7EXAMPLE", "ghp_" + "a" * 36, "sk-ant-api03-" + "b" * 40, "AIza" + "c" * 35)
+    KEPT = (
+        'String password = req.getParameter("password");',
+        "String sql = \"SELECT * FROM users WHERE login='\" + u + \"' AND pwd='\" + p + \"'\";",
+        "<select id=\"login\">SELECT * FROM users WHERE pwd = #{password}</select>",
+        "spring.datasource.password=${DB_PASS}",
+        "user.password = req.body.password;",
+        "if (token == null) return;",
+        'String header = "Bearer " + token;',
+        '<property name="username" value="ams_app"/>',
+        "Passenger p = passengerDao.find(id);",
+    )
+
+    def redact(self, text: str) -> str:
+        return "\n".join(_redact_lines(text.split("\n")))
+
+    def test_java_legacy_forms_are_masked(self) -> None:
+        for sample in self.LEAKS:
+            with self.subTest(sample=sample):
+                self.assertNotIn("Hunter2x", self.redact(sample))
+
+    def test_cloud_and_vcs_tokens_are_masked(self) -> None:
+        for token in self.TOKENS:
+            with self.subTest(token=token[:8]):
+                self.assertNotIn(token, self.redact(f'String key = cfg.get("{token}");'))
+
+    def test_code_the_auditor_needs_is_kept(self) -> None:
+        for line in self.KEPT:
+            with self.subTest(line=line):
+                self.assertEqual(self.redact(line), line)
+
+    def test_long_lines_are_fast_and_not_sent(self) -> None:
+        lines = ["a.b" * 300000 + "password", "a-" * 500000 + "://", "a-b." * 250000, "x" * 1000000]
+        start = time.monotonic()
+        out = _redact_lines(lines)
+        self.assertLess(time.monotonic() - start, 2.0)
+        self.assertTrue(all(o.startswith("[line of ") for o in out))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_headless_ai.py

@@ -19,7 +19,7 @@ if str(PROJECT_ROOT) not in sys.path:
     sys.path.insert(0, str(PROJECT_ROOT))
 
 from operate.ai.client import LLMClient
-from operate.ai.mock_server import start_mock_llm_server
+from operate.ai.mock_server import MockLLMHandler, start_mock_llm_server
 from operate.ai.runner import HeadlessAIRunner
 from operate.cli.main import main as cli_main
 
@@ -295,6 +295,21 @@ module.exports = app;
         self.assertEqual(stats["parse_failures"], {})
         self.assertEqual(stats["anchoring"]["unanchored"], [])
 
+    def test_no_planted_secret_reaches_the_model(self) -> None:
+        planted = ("PlantedPg9", "planted-key-42", "PlantedOra3")
+        with (self.target_dir / "app.js").open("a", encoding="utf-8") as fh:
+            fh.write('const DB = "postgres://app:PlantedPg9@db/orders";\nconst apiKey = "planted-key-42";\n'
+                     '// legacy: db.password=PlantedOra3\n')
+        self._prescan()
+        client = LLMClient(endpoint=self.base_url, model="mock-model", api_key="test")
+        HeadlessAIRunner(self.target_dir, self.out_dir, client).run()
+
+        sent = json.dumps(MockLLMHandler.received_requests)
+        self.assertIn("5-finding-verifier", json.loads((self.out_dir / "ai-run-stats.json").read_text())["phases"])
+        self.assertIn("[REDACTED]", sent)
+        for secret in planted:
+            self.assertNotIn(secret, sent)
+
     def test_unparseable_verifier_reply_leaves_findings_unverified(self) -> None:
         """A broken verifier reply must not confirm findings (#286)."""
         self.server.server_close()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",