@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/scripts/map_routes.py

@@ -24,6 +24,7 @@ from java_routes import (build_class_index, collect_spring_beans, entry_method_l
                          struts_modules, xml_declared)
 from lsa_common import (JAVA_WEB_ROOT, KIT_VERSION, call_args, compile_id_patterns, is_id_name,  # noqa: E402
                         iter_source_files, line_of, load_config, read_text, split_top, write_json)
+from laravel_routes import resolve_laravel_handlers, route_action  # noqa: E402
 from nextjs_routes import middleware_note, nextjs_declared  # noqa: E402
 from privilege import annotate_privilege  # noqa: E402
 
@@ -268,7 +269,7 @@ def php_declared(c: Collector, rel: str, text: str, stacks: set) -> bool:
         end = text.find(";", m.end())
         stmt = text[m.start(): end if end > 0 else m.end() + 200]
         c.add(stack="php-laravel", kind="declared_route", method=[verb.upper()], path="/" + path.lstrip("/"),
-              handler={"file": rel, "line": line, "symbol": None}, id_params=c.path_params(path),
+              handler={"file": rel, "line": line, "symbol": route_action(stmt)}, id_params=c.path_params(path),
               guard_hints=c.guards(stmt, line) + c.guards(text[:m.start()][-3000:], 1)[:2],
               data_hints=[], notes="handler is in the controller named in this route")
         found = True
@@ -744,6 +745,8 @@ def map_routes(target: Path, config: Dict, stack_ids: Optional[set] = None, work
             it["id_params"] = c.inputs("java", t)
             it["guard_hints"] = it["guard_hints"] or c.guards(t)
             it["data_hints"] = it["data_hints"] or c.data_ops(t)
+    # post-pass 1b: Laravel route declarations -> the controller method they name (#380)
+    c.items = resolve_laravel_handlers(c.items, target, enc, c, [rel for _, rel in files])
     # post-pass 2: servlet classes without @WebServlet -> take the path from web.xml
     xml_paths: Dict[str, List[str]] = {}
     for it in c.items:

package/assess/lsa/tests/EVAL-RESULTS.md

@@ -333,3 +333,129 @@ and their tests still score against them.
 Run 5 rescored against the new ground truth (for comparison only; findings unchanged): BOLA 28 / 29
 (run A) and 16 / 29 (run B), precision 0.859 and 0.826, still no false positive on SAFE markers. Every
 new marker was already reported by both runs; Tier 1 lists all of them as BOLA route candidates.
+
+---
+
+## Run 6 — 2026-11-11, platform 2.5.0, kit 0.3.1 (#323 part 4: new harness, 121-item ground truth, redaction)
+
+Issue #323. First run on the harness from #334 (no code fields in 4a / 4b templates, quote repair,
+findings from flagged verdicts), the fixtures and ground truth from #336 (121 items: 29 BOLA, 34
+SQL/NoSQL injection, 10 BFLA, 15 mass assignment, 33 SAFE), and secret redaction of code sent to the
+model (v2.4.0). Outputs are archived in [`assess/lsa/examples/eval-run-6/`](../examples/eval-run-6/).
+Runs 4–5 are not directly comparable; the Run 5 rows below are the Run 5 findings rescored against the
+new ground truth.
+
+| Item | Value |
+|---|---|
+| Pipeline | `komagu scan <repo> --no-cache --headless-ai http://localhost:11434/v1 --model <model> --ai-timeout 3600` from `main` at v2.5.0 |
+| Hosting | Ollama 0.40.16 on the same Apple M4 Pro, 24 GB RAM, 100% GPU, local only; `gpt-oss:20b` on the llama.cpp runner with 32,768 context (as in Runs 4–5) |
+| Scoring | `tests/score_findings.py --verdicts` (tolerance 3 lines) |
+| Machine | No other heavy work while measuring; up to 5.7 GB swap in use during the `gpt-oss` runs |
+
+### Results after verification (`gpt-oss:20b`)
+
+| Run | BOLA | Injection | BFLA marker | Mass marker | BFLA verdict | Mass verdict | FP on safe code | Precision | Rejected | Retries · repaired · parse fail | From verdicts | Min · calls · tokens |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| Run 5 A, rescored | 28/29 | 34/34 | 10/10 | 10/15 | 10/10 | 15/15 | 0 | 0.859 | 2 | 0 · — · 0 | — | 83 · 32 · 328K |
+| Run 5 B, rescored | 16/29 | 32/34 | 9/10 | 14/15 | 10/10 | 15/15 | 0 | 0.826 | 3 | 1 · — · 1 | — | 86 · 31 · 369K |
+| **Run 6 A** | **26/29** | **34/34** | **10/10** | **14/15** | **10/10** | **15/15** | **1** | **0.813** | 2 | 0 · 0 · 0 | 9 (5 BOLA, 4 mass) | 40 · 33 · 315K |
+| **Run 6 B** | **26/29** | **34/34** | **10/10** | **14/15** | **10/10** | **14/15** | **1** | **0.787** | 1 | 1 · 0 · 0 | 14 (5 BOLA, 9 mass) | 56 · 34 · 373K |
+
+- **The two runs now agree.** BOLA is 26 / 29 in both (Run 5: 28 and 16). No batch was lost: no parse
+  failure, no call error, no batch needed the quote repair, and the one retry (B, `injection-001`)
+  succeeded. The `routes-001` batch that failed in Run 4 B and Run 5 B now parses.
+- **Mass assignment:** 14 / 15 as located findings in both runs (Run 5: 10 and 14). Findings written from
+  flagged verdicts closed the gap: the four candidates run A of Run 5 judged `vulnerable` without a
+  finding (`profile.php` ×2, `CustomerController.cs` ×2) are findings in both runs.
+  `php-plain/register.php:4` is still missed. In A the verifier rejected it because the INSERT "only"
+  writes `email`, `name` and `role`, missing that `extract($_POST)` can overwrite `$role` (the
+  fixture change in #336); in B the auditor did not flag it.
+- **BFLA:** 10 / 10 in both runs, located and by verdict.
+- **Misses:** `perl-cgi/cgi-bin/order.cgi:19` (both runs, missed since Run 4), `node-express/routes/orders.js:29`
+  (both), `java-legacy/.../OrderServlet.java:15` (A), `python-flask/app.py:12` (B).
+- **False positives on SAFE markers: 1 per run** (Run 5: 0), both injection:
+  - A: `classic-asp/shop/member.asp:6`. The `UPDATE` starts on line 6, whose `name` value is escaped;
+    the concatenated `member_id` is on line 7, which is also reported. The finding is anchored one line
+    early rather than describing a new flaw, but it is scored as a false positive.
+  - B: `python-flask/app.py:12`. `order_id` is an `<int:...>` path parameter, so the `%` formatting
+    cannot inject. The model reported the route's missing ownership check as SQL injection, so the
+    BOLA marker on the same line was missed.
+- **Precision 0.81 / 0.79.** Five of the unmatched findings per run come from verdicts: the BOLA
+  auditor flagged the Laravel routes `/register`, `/posts`, `/teams`, `/account/rename` and
+  `/account/profile`, and the generated findings point at their declarations in `routes/web.php`
+  (lines 6–10). The triage after Run 5 found these routes act on `$request->user()` or touch no
+  record, so they are likely false positives. Without them precision would be 0.85 / 0.83.
+- **Duration:** 40 and 56 minutes (Run 5: 83 and 86). The model wrote fewer tokens (84K and 118K
+  completion tokens against about 109K and 111K); the Ollama version also changed (0.40.13 → 0.40.16).
+- **`ai-raw/`** is written only for batches that needed a repair or failed to parse. None did, so neither
+  run has an `ai-raw/` folder.
+
+### Did redaction reduce recall?
+
+No, and on this repo it cannot. Running the redaction used for model context
+(`assess/lsa/scripts/redaction.py`, `redact_lines`) over every file of the eval repo changes **0 lines**:
+the fixtures contain no secrets in the patterns it covers. The prompts sent in Run 6 are therefore the
+same code as without redaction. The BOLA difference from Run 5 A (28 → 26) is run-to-run variance (the
+same model put 16 in Run 5 B). This also means the eval repo does not test whether redaction costs
+recall on code that does contain secrets; that is covered only by the unit tests
+(`operate/tests/test_ai_redaction.py`, `test_no_planted_secret_reaches_the_model`).
+
+### `qwen3.5:9b` with a 16K context (not completed)
+
+To fit the 24 GB machine, `qwen3.5:9b` was run with `num_ctx 16384` (a local tag built
+`FROM qwen3.5:9b` with `PARAMETER num_ctx 16384`, MLX runner), same command and timeout as above. It did
+not finish: the run was stopped by hand after 3 h 14 min, while the second injection batch was still
+running and before the privilege (4c) and verifier (5) phases. The partial output is archived as
+[`eval-run-6/qwen-16k-partial/`](../examples/eval-run-6/qwen-16k-partial/) (raw batch findings, the
+per-minute memory log, and an indicative score of the unverified findings).
+
+| Phase / batch | Time | Result |
+|---|---|---|
+| Stack detection | 2 min | done |
+| BOLA `routes-001` (15 routes) | 60 min | **timed out**, empty |
+| BOLA `routes-002` … `routes-004` | 5, 3 and 2 min | 8, 7 and 9 findings |
+| BOLA `routes-005` | 60 min | **timed out**, empty |
+| BOLA `routes-006` | 1 min | 1 finding |
+| Injection `injection-001` | 11 min | 20 findings |
+| Injection `injection-002` | 49 min+ | still running when stopped |
+
+- **Memory:** the runner used 8.1 GB for the first hour, then grew to 13, 18 and finally 20 GB (from about
+  10:55, after the first timeout). Swap rose from about 4 GB (other work on the machine) to 12.4 GB of
+  13.3 GB; the run was stopped there to keep the machine usable. `gpt-oss:20b` stayed under 5.7 GB of
+  swap on the same machine.
+- **Timeouts:** a batch that hits `--ai-timeout` is not retried (only empty or unparseable replies are),
+  so two of six BOLA batches were lost outright. The quick batches suggest the model can do the task;
+  the timed-out ones look like long reasoning that does not end within the context.
+- **Indicative score** (findings before verification, from the batches that finished): BOLA 12/29,
+  injection 22/34, BFLA and mass assignment not reached, precision 0.73, no finding on a SAFE marker.
+  These numbers are not comparable with the `gpt-oss` rows: two BOLA batches, half the injection
+  candidates and the verifier are missing.
+
+Thinking looks like the cause: on this 24 GB machine a 16K context with default reasoning is **not**
+a working setting. The run below with reasoning off is.
+
+### `qwen3.5:9b` with a 16K context and reasoning off (#382)
+
+Same tag, command and timeout, plus `--ai-reasoning-effort none` (#382), which sends
+`"reasoning_effort": "none"` with every request; Ollama's `/v1` endpoint ignores `think: false` but
+honours this field. One run, archived as [`eval-run-6/qwen-16k-nothink/`](../examples/eval-run-6/qwen-16k-nothink/)
+(with `ai-raw/` for the two repaired verifier replies and the per-minute memory log).
+
+| Run | BOLA (29) | Injection (34) | BFLA (10) | Mass (15) | BFLA verdict | Mass verdict | SAFE hit | Precision | Time |
+|---|---|---|---|---|---|---|---|---|---|
+| `gpt-oss:20b` A | 26 | 34 | 10 | 14 | 10 | 15 | 1 | 0.813 | 40 min |
+| `gpt-oss:20b` B | 26 | 34 | 10 | 14 | 10 | 14 | 1 | 0.787 | 56 min |
+| `qwen3.5:9b` 16K, reasoning off | 23 | 29 | 6 | 10 | 8 | 15 | 0 | 0.734 | 35 min |
+
+- **Completed:** all phases, 33 calls, no timeout, no parse failure or call error, no retry, all findings
+  anchored. Two verifier replies were repaired (`verified-1`, `verified-9`); 11 findings were generated
+  from flagged verdicts (2 BOLA, 2 BFLA, 7 mass assignment).
+- **Recall** is lower than `gpt-oss:20b` in every category: BFLA and mass assignment are mostly found as
+  verdicts (8/10, 15/15) but placed on the right line less often (6/10, 10/15).
+- **Precision 0.73:** no finding on a SAFE marker, but 25 unmatched findings (23 BOLA, 2 BFLA), not yet triaged;
+  none is on `php-laravel/routes/web.php`.
+- **Memory and time:** the runner stayed at 14–17 GB and swap peaked at 6.0 GB (about 3.7 GB before the
+  run, from other work), against 20 GB and 12.4 GB with reasoning on. 35 minutes in all, of which the
+  verifier took 17.
+- **Minimum to run it:** a 24 GB machine is enough with `num_ctx 16384` and `--ai-reasoning-effort none`.
+  With reasoning on it needs more; on this evidence at least 32 GB RAM.

package/assess/lsa/tests/test_eval_run_6.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+"""Keeps the archived Evaluation Run 6 numbers (Issue #323) in step with the scorer and EVAL-RESULTS.md."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).resolve().parent
+LSA_ROOT = TESTS_DIR.parent
+EVAL_RUN_6_DIR = LSA_ROOT / "examples" / "eval-run-6"
+GROUND_TRUTH = EVAL_RUN_6_DIR / "ground-truth.json"
+RUNS = ("gptoss-a", "gptoss-b", "qwen-16k-nothink")
+QWEN_PARTIAL = EVAL_RUN_6_DIR / "qwen-16k-partial"
+# (BOLA, injection, BFLA, mass assignment) found by location, then BFLA / mass found by auditor verdict
+EXPECTED = {
+    "gptoss-a": {"marker": (26, 34, 10, 14), "verdict": (10, 15)},
+    "gptoss-b": {"marker": (26, 34, 10, 14), "verdict": (10, 14)},
+    "qwen-16k-nothink": {"marker": (23, 29, 6, 10), "verdict": (8, 15)},
+}
+# Findings that land on a SAFE marker, by category (see EVAL-RESULTS.md, Run 6)
+SAFE_HITS = {
+    "gptoss-a": {"injection": ["classic-asp/shop/member.asp:6"]},
+    "gptoss-b": {"injection": ["python-flask/app.py:12"]},
+    "qwen-16k-nothink": {},
+}
+
+
+def score(run: str) -> dict:
+    proc = subprocess.run(
+        [sys.executable, str(TESTS_DIR / "score_findings.py"), "--verdicts", str(GROUND_TRUTH), str(EVAL_RUN_6_DIR / run)],
+        capture_output=True, text=True, check=True,
+    )
+    return json.loads(proc.stdout)
+
+
+class TestEvaluationRun6(unittest.TestCase):
+    def test_ground_truth_is_the_121_item_set(self) -> None:
+        items = json.loads(GROUND_TRUTH.read_text(encoding="utf-8"))["items"]
+        self.assertEqual(len(items), 121)
+
+    def test_artifacts_exist(self) -> None:
+        for run in RUNS:
+            for name in ("findings.json", "coverage.json", "score.json", "ai-run-stats.json"):
+                self.assertTrue((EVAL_RUN_6_DIR / run / name).is_file(), f"{run}/{name}")
+
+    def test_archived_scores_match_the_scorer(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                archived = json.loads((EVAL_RUN_6_DIR / run / "score.json").read_text(encoding="utf-8"))
+                self.assertEqual(score(run), archived)
+
+    def test_numbers_match_eval_results(self) -> None:
+        for run, want in EXPECTED.items():
+            with self.subTest(run=run):
+                report = score(run)
+                pc, vl = report["per_category"], report["verdict_level"]
+                got = tuple(pc[c]["found"] for c in ("bola", "injection", "bfla", "mass_assignment"))
+                self.assertEqual(got, want["marker"])
+                self.assertEqual((vl["bfla"]["found"], vl["mass_assignment"]["found"]), want["verdict"])
+
+    def test_safe_marker_hits_are_the_documented_ones(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                report = score(run)
+                for cat, row in report["per_category"].items():
+                    self.assertEqual(row["false_positive_on_safe_code"], SAFE_HITS[run].get(cat, []), cat)
+                for cat, row in report["verdict_level"].items():
+                    self.assertEqual(row["flagged_safe"], [], cat)
+
+    def test_no_batch_lost_to_parse_or_call_errors(self) -> None:
+        for run in RUNS:
+            with self.subTest(run=run):
+                stats = json.loads((EVAL_RUN_6_DIR / run / "ai-run-stats.json").read_text(encoding="utf-8"))
+                self.assertEqual(stats["parse_failures"], {})
+                self.assertEqual(stats["call_errors"], {})
+                self.assertEqual(stats["anchoring"]["unanchored"], [])
+
+    def test_qwen_partial_score_matches_eval_results(self) -> None:
+        """The stopped qwen3.5:9b 16K run: indicative score of its unverified findings (EVAL-RESULTS, Run 6)."""
+        with tempfile.TemporaryDirectory() as tmp:
+            shutil.copy(QWEN_PARTIAL / "findings.partial.json", Path(tmp) / "findings.json")
+            proc = subprocess.run(
+                [sys.executable, str(TESTS_DIR / "score_findings.py"), str(GROUND_TRUTH), tmp],
+                capture_output=True, text=True, check=True,
+            )
+        report = json.loads(proc.stdout)
+        archived = json.loads((QWEN_PARTIAL / "score.partial.json").read_text(encoding="utf-8"))
+        self.assertEqual(report, archived)
+        pc = report["per_category"]
+        got = tuple(pc[c]["found"] for c in ("bola", "injection", "bfla", "mass_assignment"))
+        self.assertEqual(got, (12, 22, 0, 0))
+        self.assertEqual(report["precision"], 0.733)
+        for row in pc.values():
+            self.assertEqual(row["false_positive_on_safe_code"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_laravel_routes.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Laravel routes map to the controller method they name, not to their declaration (#380)."""
+
+from __future__ import annotations
+
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+TESTS_DIR = Path(__file__).resolve().parent
+sys.path.insert(0, str(TESTS_DIR.parent / "scripts"))
+from laravel_routes import route_action  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+from map_routes import map_routes  # noqa: E402
+
+ROUTES = """<?php
+use App\\Http\\Controllers\\OrderController;
+use Illuminate\\Support\\Facades\\Route;
+
+Route::get('/orders/{id}', [OrderController::class, 'show']);
+Route::post('/orders', 'OrderController@store');
+Route::get('/missing', [GoneController::class, 'index']);
+Route::get('/ping', function () { return 'ok'; });
+"""
+
+CONTROLLER = """<?php
+namespace App\\Http\\Controllers;
+
+use App\\Models\\Order;
+use Illuminate\\Http\\Request;
+
+class OrderController extends Controller
+{
+    public function show($id)
+    {
+        return Order::find($id);
+    }
+
+    public function store(Request $request)
+    {
+        return Order::create(['customer_id' => $request->input('customer_id')]);
+    }
+}
+"""
+
+
+class TestRouteAction(unittest.TestCase):
+    def test_array_and_string_actions(self) -> None:
+        self.assertEqual(route_action("Route::get('/a', [OrderController::class, 'show'])"), "OrderController@show")
+        self.assertEqual(route_action("Route::get('/a', [\\App\\Http\\Controllers\\OrderController::class, 'show'])"),
+                         "OrderController@show")
+        self.assertEqual(route_action("Route::post('/a', 'App\\Http\\Controllers\\OrderController@store')"),
+                         "OrderController@store")
+        self.assertIsNone(route_action("Route::get('/a', function () { return 1; })"))
+
+
+class TestLaravelHandlers(unittest.TestCase):
+    def setUp(self) -> None:
+        self.root = Path(tempfile.mkdtemp(prefix="lsa_laravel_"))
+        (self.root / "routes").mkdir()
+        (self.root / "app/Http/Controllers").mkdir(parents=True)
+        (self.root / "routes/web.php").write_text(ROUTES, encoding="utf-8")
+        (self.root / "app/Http/Controllers/OrderController.php").write_text(CONTROLLER, encoding="utf-8")
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def routes(self) -> dict:
+        found = map_routes(self.root, load_config(None), {"php-laravel"}, workers=1)["candidates"]
+        return {r["path"]: r for r in found if r["stack"] == "php-laravel"}
+
+    def test_route_points_at_the_controller_method(self) -> None:
+        show = self.routes()["/orders/{id}"]
+        self.assertEqual(show["handler"], {"file": "app/Http/Controllers/OrderController.php", "line": 9,
+                                           "symbol": "OrderController@show"})
+        self.assertEqual(show["notes"], "declared in routes/web.php:5")
+        self.assertIn("id", [p["name"] for p in show["id_params"]])
+
+    def test_string_action_and_body_inputs(self) -> None:
+        store = self.routes()["/orders"]
+        self.assertEqual((store["handler"]["file"], store["handler"]["line"]),
+                         ("app/Http/Controllers/OrderController.php", 14))
+        self.assertIn("customer_id", [p["name"] for p in store["id_params"]])
+
+    def test_unresolved_routes_keep_their_declaration(self) -> None:
+        routes = self.routes()
+        self.assertEqual(routes["/missing"]["handler"], {"file": "routes/web.php", "line": 7,
+                                                         "symbol": "GoneController@index"})
+        self.assertEqual(routes["/ping"]["handler"]["file"], "routes/web.php")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/ai/client.py

@@ -12,6 +12,9 @@ import urllib.error
 import urllib.request
 from typing import Any, Dict, List, Optional, Tuple
 
+# OpenAI-compatible `reasoning_effort` values; Ollama's /v1 also accepts "none" to turn thinking off (#382)
+REASONING_EFFORTS = ("none", "low", "medium", "high")
+
 
 class LLMClient:
     """Standard-library client for OpenAI-compatible /chat/completions endpoints."""
@@ -22,7 +25,10 @@ class LLMClient:
         model: str = "llama3.1",
         api_key: Optional[str] = None,
         timeout: int = 120,
+        reasoning_effort: Optional[str] = None,
     ) -> None:
+        if reasoning_effort is not None and reasoning_effort not in REASONING_EFFORTS:
+            raise ValueError(f"reasoning_effort must be one of {', '.join(REASONING_EFFORTS)}")
         raw_endpoint = endpoint.rstrip("/")
         if not raw_endpoint.endswith("/chat/completions"):
             self.endpoint = f"{raw_endpoint}/chat/completions"
@@ -31,6 +37,7 @@ class LLMClient:
         self.model = model
         self.api_key = api_key or "ollama"
         self.timeout = timeout
+        self.reasoning_effort = reasoning_effort
         # Running totals across chat() calls, read by the runner for ai-run-stats.json
         self.usage: Dict[str, float] = {"calls": 0, "prompt_tokens": 0, "completion_tokens": 0, "seconds": 0.0}
 
@@ -41,15 +48,7 @@ class LLMClient:
         max_tokens: Optional[int] = None,
     ) -> str:
         """Send a chat completion request and return the assistant response content."""
-        payload: Dict[str, Any] = {
-            "model": self.model,
-            "messages": messages,
-            "temperature": temperature,
-        }
-        if max_tokens:
-            payload["max_tokens"] = max_tokens
-
-        data = json.dumps(payload).encode("utf-8")
+        data = json.dumps(self.build_payload(messages, temperature, max_tokens)).encode("utf-8")
         headers = {
             "Content-Type": "application/json",
             "Authorization": f"Bearer {self.api_key}",
@@ -74,6 +73,20 @@ class LLMClient:
         except urllib.error.URLError as e:
             raise RuntimeError(f"Failed to connect to LLM endpoint at {self.endpoint}: {e.reason}") from e
 
+    def build_payload(
+        self,
+        messages: List[Dict[str, str]],
+        temperature: float = 0.1,
+        max_tokens: Optional[int] = None,
+    ) -> Dict[str, Any]:
+        """Request body for /chat/completions; `reasoning_effort` is sent only when it was set."""
+        payload: Dict[str, Any] = {"model": self.model, "messages": messages, "temperature": temperature}
+        if max_tokens:
+            payload["max_tokens"] = max_tokens
+        if self.reasoning_effort:
+            payload["reasoning_effort"] = self.reasoning_effort
+        return payload
+
     def _record_usage(self, usage: Dict[str, Any], seconds: float) -> None:
         self.usage = {
             "calls": self.usage["calls"] + 1,

package/operate/ai/runner.py

@@ -167,6 +167,7 @@ class HeadlessAIRunner:
         stats = {
             "model": getattr(self.client, "model", None),
             "endpoint": getattr(self.client, "endpoint", None),
+            "reasoning_effort": getattr(self.client, "reasoning_effort", None),
             "phases": self.phase_stats,
             "totals": self._usage(),
             "parse_failures": self.parse_failures,
@@ -300,8 +301,9 @@ Output MUST be Markdown format adhering to Komagu auth-model.md specification.
                         {"name": p.get("name", "id"), "source": p.get("source", "path")}
                         for p in c.get("id_params", [])
                     ]
-                if not id_inputs:
-                    id_inputs = [{"name": "id", "source": "path"}]
+                # No detected id input stays empty: inventing a path `id` made the BOLA auditor
+                # flag routes that take no object id (#380)
+                id_inputs = id_inputs or []
 
                 mapped_routes.append({
                     "route_id": route_id,

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.5.0"  # x-release-please-version
+__version__ = "2.6.0"  # x-release-please-version

package/operate/cli/commands/scan.py

@@ -161,6 +161,12 @@ Examples:
         default=120,
         help="Timeout in seconds per LLM request (default: 120)",
     )
+    parser.add_argument(
+        "--ai-reasoning-effort",
+        choices=("none", "low", "medium", "high"),
+        default=None,
+        help="Send reasoning_effort with each LLM request; 'none' turns thinking off on Ollama (default: not sent)",
+    )
     parser.set_defaults(func=execute_scan)
 
 
@@ -284,7 +290,8 @@ def execute_scan(args: argparse.Namespace) -> int:
                 step_info(msg)
 
         try:
-            client = LLMClient(endpoint=endpoint, model=model, api_key=api_key, timeout=timeout)
+            client = LLMClient(endpoint=endpoint, model=model, api_key=api_key, timeout=timeout,
+                               reasoning_effort=getattr(args, "ai_reasoning_effort", None))
             runner = HeadlessAIRunner(target_path, out_dir, client, step_callback=_scan_callback)
             runner.run()
         except Exception as e:

package/operate/tests/test_ai_reasoning_effort.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""`--ai-reasoning-effort` reaches each /chat/completions request and ai-run-stats.json (#382)."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.client import LLMClient
+from operate.ai.runner import HeadlessAIRunner
+from operate.cli.commands.scan import register_subcommand
+
+MESSAGES = [{"role": "user", "content": "audit"}]
+
+
+class TestReasoningEffortPayload(unittest.TestCase):
+    def test_not_sent_by_default(self) -> None:
+        payload = LLMClient(model="m").build_payload(MESSAGES)
+        self.assertEqual(payload, {"model": "m", "messages": MESSAGES, "temperature": 0.1})
+
+    def test_sent_when_set(self) -> None:
+        payload = LLMClient(model="m", reasoning_effort="none").build_payload(MESSAGES, max_tokens=50)
+        self.assertEqual(payload["reasoning_effort"], "none")
+        self.assertEqual(payload["max_tokens"], 50)
+
+    def test_unknown_value_is_rejected(self) -> None:
+        with self.assertRaises(ValueError):
+            LLMClient(reasoning_effort="off")
+
+
+class TestReasoningEffortCli(unittest.TestCase):
+    def parse(self, *argv: str) -> argparse.Namespace:
+        parser = argparse.ArgumentParser()
+        register_subcommand(parser.add_subparsers(dest="command"))
+        return parser.parse_args(["scan", ".", *argv])
+
+    def test_flag_is_optional(self) -> None:
+        self.assertIsNone(self.parse().ai_reasoning_effort)
+        self.assertEqual(self.parse("--ai-reasoning-effort", "none").ai_reasoning_effort, "none")
+
+    def test_flag_rejects_unknown_values(self) -> None:
+        with self.assertRaises(SystemExit):
+            self.parse("--ai-reasoning-effort", "off")
+
+
+class TestReasoningEffortStats(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_effort_"))
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_value_is_recorded(self) -> None:
+        runner = HeadlessAIRunner(self.tmp, self.tmp / "out", LLMClient(model="m", reasoning_effort="low"))
+        (self.tmp / "out").mkdir(parents=True, exist_ok=True)
+        stats = json.loads(runner.write_run_stats().read_text(encoding="utf-8"))
+        self.assertEqual(stats["reasoning_effort"], "low")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_ai_route_inventory.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Route inventory built by the headless runner from Tier 1 route batches (#380)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.runner import HeadlessAIRunner
+
+
+class _NoCallClient:
+    model = "none"
+    endpoint = "test://"
+
+    def chat(self, messages, temperature=0.1):  # noqa: ANN001
+        raise AssertionError("route inventory must not call the model")
+
+
+class TestRouteInventory(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_inventory_"))
+        self.out = self.tmp / "out"
+        (self.out / "batches").mkdir(parents=True)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def inventory(self, candidates: list) -> list:
+        (self.out / "batches" / "routes-001.json").write_text(json.dumps({"candidates": candidates}), encoding="utf-8")
+        HeadlessAIRunner(self.tmp, self.out, _NoCallClient()).map_routes_inventory()
+        return json.loads((self.out / "routes" / "routes-001.json").read_text(encoding="utf-8"))["routes"]
+
+    def test_route_without_id_params_gets_no_invented_id(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["POST"], "path": "/register",
+                                  "handler": {"file": "app/Http/Controllers/AccountController.php", "line": 11},
+                                  "id_params": []}])
+        self.assertEqual(routes[0]["id_inputs"], [])
+
+    def test_detected_id_params_are_kept(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["GET"], "path": "/orders/{id}",
+                                  "handler": {"file": "routes/web.php", "line": 3},
+                                  "id_params": [{"name": "id", "source": "path", "is_id_like": True},
+                                                {"name": "orderId", "source": "query"}]}])
+        self.assertEqual(routes[0]["id_inputs"], [{"name": "id", "source": "path"},
+                                                  {"name": "orderId", "source": "query"}])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",