@hoanghainh/komagu 2.4.0 → 2.6.0

package/operate/simulate/scenarios.py

@@ -379,7 +379,7 @@ class IDCFrontierRansomwareScenario(BaseScenario):
             self.target_dir.mkdir(parents=True, exist_ok=True)
             test_file.write_text("Komagu Immutable WORM Backup - Read Only", encoding="utf-8")
             # Mark file read-only (simulating local WORM compliance mode)
-            os.chmod(str(test_file), 0o444)
+            os.chmod(str(test_file), 0o400)
         except Exception:
             pass
 
@@ -416,7 +416,7 @@ class IDCFrontierRansomwareScenario(BaseScenario):
 
         # Clean up
         try:
-            os.chmod(str(test_file), 0o666)
+            os.chmod(str(test_file), 0o600)
             test_file.unlink(missing_ok=True)
         except Exception:
             pass

package/operate/tests/mock_legacy_session_app.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Small session-based app that behaves like a JSP / Struts application.
+
+Used to rehearse ``komagu test`` on legacy behaviour:
+
+- login state lives in a ``JSESSIONID`` cookie;
+- writes are ``application/x-www-form-urlencoded`` and need a single-use Struts token;
+- a successful write answers 302 (post/redirect/get);
+- a denied request is a 200 Shift_JIS error page, a 302 to login, or a 404,
+  depending on ``server.denial``;
+- ``server.fixed`` is the ownership check being deployed.
+"""
+
+from __future__ import annotations
+
+import secrets
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Dict, List, NamedTuple, Optional, Tuple
+from urllib.parse import parse_qs, urlsplit
+
+ALICE_COOKIE = "JSESSIONID=sess-alice-0001"
+BOB_COOKIE = "JSESSIONID=sess-bob-0002"
+EXPIRED_COOKIE = "JSESSIONID=sess-expired-0003"
+TOKEN_FIELD = "org.apache.struts.taglib.html.TOKEN"
+DENIED_TEXT = "アクセス権限がありません"
+LOGIN_REDIRECT = "/login.do;jsessionid=sess-rewritten-url-9999"
+
+
+class Seen(NamedTuple):
+    method: str
+    path: str
+    cookie: Optional[str]
+    authorization: Optional[str]
+    content_type: Optional[str]
+    body: str
+
+
+class LegacyHandler(BaseHTTPRequestHandler):
+    server: "LegacyServer"
+
+    def log_message(self, format: str, *args: object) -> None:  # noqa: A002
+        pass
+
+    def _user(self) -> Optional[str]:
+        cookie = self.headers.get("Cookie", "")
+        pairs = dict(p.strip().split("=", 1) for p in cookie.split(";") if "=" in p)
+        return self.server.sessions.get(pairs.get("JSESSIONID", ""))
+
+    def _send(self, status: int, body: bytes = b"", charset: str = "UTF-8", location: Optional[str] = None) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", f"text/html; charset={charset}")
+        self.send_header("Content-Length", str(len(body)))
+        if location:
+            self.send_header("Location", location)
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _to_login(self) -> None:
+        self._send(302, location=LOGIN_REDIRECT)
+
+    def _deny(self) -> None:
+        if self.server.denial == "login_redirect":
+            self._to_login()
+        elif self.server.denial == "not_found":
+            self._send(404, b"<html>Not Found</html>")
+        else:
+            page = f"<html><body><p>{DENIED_TEXT}</p></body></html>"
+            self._send(200, page.encode("cp932"), charset="Windows-31J")
+
+    def _may_access(self, user: str, order_id: str) -> bool:
+        owner = self.server.orders.get(order_id)
+        if owner is None:
+            return False
+        return owner == user or not self.server.fixed
+
+    def _record(self, method: str, body: str = "") -> None:
+        self.server.seen.append(Seen(
+            method, self.path, self.headers.get("Cookie"), self.headers.get("Authorization"),
+            self.headers.get("Content-Type"), body,
+        ))
+
+    def do_GET(self) -> None:  # noqa: N802
+        self._record("GET")
+        url = urlsplit(self.path)
+        query = parse_qs(url.query)
+        if url.path == "/login.do":
+            self._send(200, b"<html>Please log in</html>")
+            return
+        user = self._user()
+        if user is None:
+            self._to_login()
+        elif url.path == "/home.do":
+            self._send(200, f"<html>Welcome {user}</html>".encode())
+        elif url.path == "/order/view.do":
+            self._view(user, query.get("id", [""])[0])
+        elif url.path == "/order/edit.do":
+            self._edit_form(user)
+        else:
+            self._send(404, b"<html>No such action</html>")
+
+    def _view(self, user: str, order_id: str) -> None:
+        if not self._may_access(user, order_id):
+            self._deny()
+            return
+        self._send(200, f"<html>Order detail {order_id}: secret-note</html>".encode())
+
+    def _edit_form(self, user: str) -> None:
+        if self.server.hide_token:
+            self._send(200, b"<html><form></form></html>")
+            return
+        token = secrets.token_hex(8)
+        self.server.tokens[user] = token
+        # value before name, as some tag libraries render it.
+        page = f'<html><form><input value="{token}" type="hidden" name="{TOKEN_FIELD}"></form></html>'
+        self._send(200, page.encode())
+
+    def do_POST(self) -> None:  # noqa: N802
+        length = int(self.headers.get("Content-Length") or 0)
+        raw = self.rfile.read(length).decode("utf-8", "replace")
+        self._record("POST", raw)
+        user = self._user()
+        if user is None:
+            self._to_login()
+            return
+        if self.headers.get("Content-Type", "").split(";")[0] != "application/x-www-form-urlencoded":
+            self._send(415, b"<html>Form post expected</html>")
+            return
+        form = parse_qs(raw)
+        if urlsplit(self.path).path != "/order/update.do":
+            self._send(404, b"<html>No such action</html>")
+            return
+        if form.get(TOKEN_FIELD, [""])[0] != self.server.tokens.pop(user, None):
+            self._send(400, b"<html>Invalid token</html>")
+            return
+        order_id = form.get("id", [""])[0]
+        if not self._may_access(user, order_id):
+            self._deny()
+            return
+        self.server.updates.append((user, order_id))
+        self._send(302, location="/order/list.do")
+
+
+class LegacyServer(HTTPServer):
+    def __init__(self) -> None:
+        super().__init__(("127.0.0.1", 0), LegacyHandler)
+        self.fixed = False
+        self.denial = "error_page"
+        self.hide_token = False
+        self.orders: Dict[str, str] = {"100": "alice", "200": "bob"}
+        self.sessions: Dict[str, str] = {"sess-alice-0001": "alice", "sess-bob-0002": "bob"}
+        self.tokens: Dict[str, str] = {}
+        self.updates: List[Tuple[str, str]] = []
+        self.seen: List[Seen] = []
+
+
+def start_legacy_app() -> Tuple[LegacyServer, str]:
+    server = LegacyServer()
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    return server, f"http://127.0.0.1:{server.server_port}"

package/operate/tests/test_ai_reasoning_effort.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""`--ai-reasoning-effort` reaches each /chat/completions request and ai-run-stats.json (#382)."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.client import LLMClient
+from operate.ai.runner import HeadlessAIRunner
+from operate.cli.commands.scan import register_subcommand
+
+MESSAGES = [{"role": "user", "content": "audit"}]
+
+
+class TestReasoningEffortPayload(unittest.TestCase):
+    def test_not_sent_by_default(self) -> None:
+        payload = LLMClient(model="m").build_payload(MESSAGES)
+        self.assertEqual(payload, {"model": "m", "messages": MESSAGES, "temperature": 0.1})
+
+    def test_sent_when_set(self) -> None:
+        payload = LLMClient(model="m", reasoning_effort="none").build_payload(MESSAGES, max_tokens=50)
+        self.assertEqual(payload["reasoning_effort"], "none")
+        self.assertEqual(payload["max_tokens"], 50)
+
+    def test_unknown_value_is_rejected(self) -> None:
+        with self.assertRaises(ValueError):
+            LLMClient(reasoning_effort="off")
+
+
+class TestReasoningEffortCli(unittest.TestCase):
+    def parse(self, *argv: str) -> argparse.Namespace:
+        parser = argparse.ArgumentParser()
+        register_subcommand(parser.add_subparsers(dest="command"))
+        return parser.parse_args(["scan", ".", *argv])
+
+    def test_flag_is_optional(self) -> None:
+        self.assertIsNone(self.parse().ai_reasoning_effort)
+        self.assertEqual(self.parse("--ai-reasoning-effort", "none").ai_reasoning_effort, "none")
+
+    def test_flag_rejects_unknown_values(self) -> None:
+        with self.assertRaises(SystemExit):
+            self.parse("--ai-reasoning-effort", "off")
+
+
+class TestReasoningEffortStats(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_effort_"))
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_value_is_recorded(self) -> None:
+        runner = HeadlessAIRunner(self.tmp, self.tmp / "out", LLMClient(model="m", reasoning_effort="low"))
+        (self.tmp / "out").mkdir(parents=True, exist_ok=True)
+        stats = json.loads(runner.write_run_stats().read_text(encoding="utf-8"))
+        self.assertEqual(stats["reasoning_effort"], "low")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_ai_route_inventory.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Route inventory built by the headless runner from Tier 1 route batches (#380)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.runner import HeadlessAIRunner
+
+
+class _NoCallClient:
+    model = "none"
+    endpoint = "test://"
+
+    def chat(self, messages, temperature=0.1):  # noqa: ANN001
+        raise AssertionError("route inventory must not call the model")
+
+
+class TestRouteInventory(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_inventory_"))
+        self.out = self.tmp / "out"
+        (self.out / "batches").mkdir(parents=True)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def inventory(self, candidates: list) -> list:
+        (self.out / "batches" / "routes-001.json").write_text(json.dumps({"candidates": candidates}), encoding="utf-8")
+        HeadlessAIRunner(self.tmp, self.out, _NoCallClient()).map_routes_inventory()
+        return json.loads((self.out / "routes" / "routes-001.json").read_text(encoding="utf-8"))["routes"]
+
+    def test_route_without_id_params_gets_no_invented_id(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["POST"], "path": "/register",
+                                  "handler": {"file": "app/Http/Controllers/AccountController.php", "line": 11},
+                                  "id_params": []}])
+        self.assertEqual(routes[0]["id_inputs"], [])
+
+    def test_detected_id_params_are_kept(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["GET"], "path": "/orders/{id}",
+                                  "handler": {"file": "routes/web.php", "line": 3},
+                                  "id_params": [{"name": "id", "source": "path", "is_id_like": True},
+                                                {"name": "orderId", "source": "query"}]}])
+        self.assertEqual(routes[0]["id_inputs"], [{"name": "id", "source": "path"},
+                                                  {"name": "orderId", "source": "query"}])
+
+
+if __name__ == "__main__":
+    unittest.main()