progmune-runtime 2.0.1 → 2.0.4

package/.progmune_memory/episodic.json

@@ -0,0 +1,186 @@
+[
+  {
+    "intent": "生成一个JWT令牌",
+    "actions": [
+      {
+        "kind": "assign",
+        "target": "payload",
+        "value": "user:123"
+      },
+      {
+        "kind": "call",
+        "function": "generate_jwt",
+        "args": [
+          {
+            "name": "payload",
+            "type": "UserPayload",
+            "value": "payload"
+          }
+        ],
+        "assignTo": "token"
+      },
+      {
+        "kind": "return",
+        "value": "token"
+      }
+    ],
+    "success": true,
+    "id": "ep_1778775611414",
+    "timestamp": "2026-05-14T16:20:11.414Z"
+  },
+  {
+    "intent": "生成一个JWT令牌",
+    "actions": [],
+    "success": false,
+    "id": "ep_1778775591074",
+    "timestamp": "2026-05-14T16:19:51.074Z"
+  },
+  {
+    "intent": "生成一个JWT令牌",
+    "actions": [
+      {
+        "kind": "assign",
+        "target": "payload",
+        "value": "user:123"
+      },
+      {
+        "kind": "call",
+        "function": "generate_jwt",
+        "args": [
+          {
+            "name": "payload",
+            "type": "UserPayload",
+            "value": "payload"
+          }
+        ],
+        "assignTo": "token"
+      },
+      {
+        "kind": "return",
+        "value": "token"
+      }
+    ],
+    "success": true,
+    "id": "ep_1778775315729",
+    "timestamp": "2026-05-14T16:15:15.729Z"
+  },
+  {
+    "intent": "生成一个JWT令牌",
+    "actions": [
+      {
+        "kind": "assign",
+        "target": "payload",
+        "value": "user:123"
+      },
+      {
+        "kind": "call",
+        "function": "generate_jwt",
+        "args": [
+          {
+            "name": "payload",
+            "type": "UserPayload",
+            "value": "payload"
+          }
+        ],
+        "assignTo": "token"
+      },
+      {
+        "kind": "return",
+        "value": "token"
+      }
+    ],
+    "success": true,
+    "id": "ep_1778775173516",
+    "timestamp": "2026-05-14T16:12:53.516Z"
+  },
+  {
+    "intent": "创建一个带令牌的会话",
+    "actions": [
+      {
+        "kind": "assign",
+        "target": "user_payload",
+        "value": "user:123"
+      },
+      {
+        "kind": "call",
+        "function": "query_data",
+        "args": [
+          {
+            "name": "key",
+            "type": "str",
+            "value": "user_payload"
+          }
+        ],
+        "assignTo": "user_data"
+      },
+      {
+        "kind": "assign",
+        "target": "plain_password",
+        "value": "password123"
+      },
+      {
+        "kind": "call",
+        "function": "verify_password",
+        "args": [
+          {
+            "name": "plain",
+            "type": "str",
+            "value": "plain_password"
+          },
+          {
+            "name": "hash",
+            "type": "PasswordHash",
+            "value": "user_data"
+          }
+        ],
+        "assignTo": "password_valid"
+      },
+      {
+        "kind": "call",
+        "function": "generate_jwt",
+        "args": [
+          {
+            "name": "payload",
+            "type": "UserPayload",
+            "value": "user_payload"
+          }
+        ],
+        "assignTo": "token"
+      },
+      {
+        "kind": "call",
+        "function": "create_session",
+        "args": [
+          {
+            "name": "user",
+            "type": "UserPayload",
+            "value": "user_payload"
+          },
+          {
+            "name": "token",
+            "type": "Token",
+            "value": "token"
+          }
+        ],
+        "assignTo": "session"
+      },
+      {
+        "kind": "return",
+        "value": "session"
+      },
+      {
+        "kind": "return",
+        "value": "error"
+      },
+      {
+        "kind": "if",
+        "condition": "password_valid",
+        "thenActions": [],
+        "elseActions": []
+      }
+    ],
+    "success": true,
+    "id": "ep_1778775082912",
+    "timestamp": "2026-05-14T16:11:22.919Z"
+  }
+]

package/dist/immune-reporter.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractFingerprints = extractFingerprints;
+exports.reportFingerprints = reportFingerprints;
+exports.previewFingerprints = previewFingerprints;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+const crypto = __importStar(require("crypto"));
+const REPORT_ENDPOINT = process.env.PROGMUNE_HUB || "http://localhost:3000/report";
+const FINGERPRINT_FILE = path.resolve(__dirname, "../.progmune_memory/fingerprints.json");
+function getInstanceId() {
+    const host = require("os").hostname();
+    const cwd = process.cwd();
+    return crypto.createHash("sha256").update(host + cwd).digest("hex").substring(0, 16);
+}
+function extractFingerprints() {
+    const corpusDir = path.resolve(__dirname, "../failure_corpus");
+    if (!fs.existsSync(corpusDir))
+        return [];
+    const fingerprints = [];
+    const instanceId = getInstanceId();
+    for (const dateDir of fs.readdirSync(corpusDir)) {
+        const datePath = path.join(corpusDir, dateDir);
+        if (!fs.statSync(datePath).isDirectory())
+            continue;
+        for (const file of fs.readdirSync(datePath)) {
+            if (!file.endsWith(".json"))
+                continue;
+            const record = JSON.parse(fs.readFileSync(path.join(datePath, file), "utf-8"));
+            const funcSeq = (record.actionSequence || [])
+                .filter((a) => a.kind === "call")
+                .map((a) => a.function);
+            fingerprints.push({
+                instance_id: instanceId,
+                timestamp: record.timestamp,
+                violatedSVL: record.violatedSVL,
+                constraintType: record.constraintType,
+                functionSequence: funcSeq,
+                preState: record.ssgState ? [record.ssgState] : undefined,
+                postState: undefined,
+                count: 1,
+            });
+        }
+    }
+    return fingerprints;
+}
+async function reportFingerprints() {
+    const fingerprints = extractFingerprints();
+    if (fingerprints.length === 0) {
+        return { success: true, message: "无新指纹需要上报" };
+    }
+    let reported = [];
+    if (fs.existsSync(FINGERPRINT_FILE)) {
+        reported = JSON.parse(fs.readFileSync(FINGERPRINT_FILE, "utf-8"));
+    }
+    const newFingerprints = fingerprints.filter(f => !reported.includes(f.functionSequence.join(",")));
+    if (newFingerprints.length === 0) {
+        return { success: true, message: "所有指纹已上报，无新增" };
+    }
+    const payload = JSON.stringify({ fingerprints: newFingerprints });
+    return new Promise((resolve) => {
+        const url = new URL(REPORT_ENDPOINT);
+        const transport = url.protocol === "https:" ? https : http;
+        const req = transport.request(REPORT_ENDPOINT, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+        }, (res) => {
+            let data = "";
+            res.on("data", (chunk) => data += chunk);
+            res.on("end", () => {
+                if (res.statusCode === 200) {
+                    const updated = [...reported, ...newFingerprints.map(f => f.functionSequence.join(","))];
+                    const dir = path.dirname(FINGERPRINT_FILE);
+                    if (!fs.existsSync(dir))
+                        fs.mkdirSync(dir, { recursive: true });
+                    fs.writeFileSync(FINGERPRINT_FILE, JSON.stringify(updated, null, 2));
+                    resolve({ success: true, message: `成功上报 ${newFingerprints.length} 条新指纹` });
+                }
+                else {
+                    resolve({ success: false, message: `上报失败: ${res.statusCode} ${data}` });
+                }
+            });
+        });
+        req.on("error", (e) => resolve({ success: false, message: `网络错误: ${e.message}` }));
+        req.write(payload);
+        req.end();
+    });
+}
+function previewFingerprints() {
+    return extractFingerprints();
+}

package/dist/mcp-server.mjs

@@ -10,15 +10,13 @@ import * as path from 'path';
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-// ========== 处理 opt-in 子命令 ==========
+// 处理命令行子命令
 const args = process.argv.slice(2);
 const OPT_IN_FILE = path.resolve(__dirname, '../.progmune_memory/opt_in.json');
-
 if (args[0] === 'opt-in') {
   const command = args[1] || 'status';
   const dir = path.dirname(OPT_IN_FILE);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-
   if (command === 'enable') {
     fs.writeFileSync(OPT_IN_FILE, JSON.stringify({ enabled: true, timestamp: new Date().toISOString() }, null, 2));
     console.log('✅ 已开启免疫网络上报。感谢您为全球免疫网络做出贡献！');
@@ -28,7 +26,6 @@ if (args[0] === 'opt-in') {
     if (fs.existsSync(OPT_IN_FILE)) fs.unlinkSync(OPT_IN_FILE);
     console.log('⛔ 已关闭免疫网络上报。Progmune 将以完全离线模式运行。');
   } else {
-    // 显示当前状态
     if (fs.existsSync(OPT_IN_FILE)) {
       console.log('免疫网络上报状态: 已开启');
       console.log('脱敏错误指纹将自动上报。');
@@ -43,12 +40,25 @@ if (args[0] === 'opt-in') {
   process.exit(0);
 }
 
-// ========== MCP 服务器部分 ==========
 const { plan } = require('./planner.js');
 const { extractIRPython } = require('./extract-ir-python.js');
 const { emitPython } = require('./python-emitter.js');
 const { recordRun } = require('./feedback.js');
 
+// 从独立的协议文件中加载协议，并注入到 IR 中
+function mergeProtocols(irArray) {
+  const protocolsFile = path.resolve(__dirname, '../protocols.json');
+  if (!fs.existsSync(protocolsFile)) return irArray;
+  
+  const protocols = JSON.parse(fs.readFileSync(protocolsFile, 'utf-8'));
+  return irArray.map(fn => {
+    if (protocols[fn.name]) {
+      return { ...fn, protocol: protocols[fn.name] };
+    }
+    return fn;
+  });
+}
+
 async function main() {
   const server = new Server({
     name: "progmune",
@@ -74,19 +84,19 @@ async function main() {
     if (request.params.name === "progmune_generate") {
       const { intent, projectPath } = request.params.arguments;
 
-      // 前置检查 LLM_API_KEY
       if (!process.env.LLM_API_KEY) {
         return { content: [{ type: "text", text: "❌ 未设置 LLM_API_KEY。请在终端执行：\nexport LLM_API_KEY='你的密钥'\n然后重启客户端。" }] };
       }
 
-      // 前置检查免疫网络配置
       if (!fs.existsSync(OPT_IN_FILE)) {
         return { content: [{ type: "text", text: "⚠️ 请先完成免疫网络配置。\n\n运行以下命令开启（推荐）：\n  npx progmune-runtime opt-in enable\n\n或运行以下命令以离线模式使用：\n  npx progmune-runtime opt-in disable\n\n配置完成后重启客户端即可使用。" }] };
       }
 
-      // 执行规划
       const fns = extractIRPython(projectPath);
-      fs.writeFileSync("ir.json", JSON.stringify(fns, null, 2));
+      // 关键步骤：将协议信息合并到 IR 中
+      const irWithProtocols = mergeProtocols(fns);
+      fs.writeFileSync("ir.json", JSON.stringify(irWithProtocols, null, 2));
+      
       const actions = await plan(intent);
       if (!actions || actions.length === 0) {
         return { content: [{ type: "text", text: "无法生成满足约束的代码。" }] };

package/dist/planner.js

@@ -42,6 +42,7 @@ const feedback_1 = require("./feedback");
 const utils_1 = require("./utils");
 const failure_corpus_1 = require("./failure-corpus");
 const memory_layer_1 = require("./memory-layer");
+const ssg_validator_1 = require("./ssg-validator");
 const fs = __importStar(require("fs"));
 function enrichActions(actions, ir) {
     return actions.map(a => {
@@ -87,17 +88,36 @@ function determineConstraintType(svl) {
         case "SVL-4": return "protocol";
     }
 }
+/** 加载 IR 中所有带 protocol 的函数为协议规则 */
+function loadProtocols(ir) {
+    return ir
+        .filter((f) => f.protocol)
+        .map((f) => ({ function: f.name, protocol: f.protocol }));
+}
+/** 验证动作序列的协议合法性 */
+function validateProtocol(actions, protocols, initialState) {
+    const ssv = new ssg_validator_1.StateMachineValidator(protocols, initialState);
+    for (let i = 0; i < actions.length; i++) {
+        const a = actions[i];
+        if (a.kind === "call" && a.function) {
+            const result = ssv.apply(a.function);
+            if (!result.valid) {
+                return { valid: false, error: result.error, index: i };
+            }
+        }
+    }
+    return { valid: true };
+}
 async function plan(userIntent) {
     (0, llm_1.resetCallCount)();
     const ir = JSON.parse(fs.readFileSync("ir.json", "utf-8"));
-    // ========== 语义模板快速通道 ==========
+    // 语义模板快速通道
     const cachedTemplate = (0, memory_layer_1.findSemanticTemplate)(userIntent);
     if (cachedTemplate && cachedTemplate.successRate >= 0.8 && cachedTemplate.useCount >= 2) {
         console.log("⚡ 命中语义模板，直接复用已验证序列");
         (0, memory_layer_1.recordEpisode)({ intent: userIntent, actions: cachedTemplate.actionSequence, success: true });
         return cachedTemplate.actionSequence;
     }
-    // ====================================
     const keywords = (0, utils_1.extractKeywords)(userIntent);
     const scored = ir.map((f) => {
         let score = 0;
@@ -159,6 +179,8 @@ ${userIntent}
 只输出代码。`;
     let finalActions = [];
     let currentPrompt = basePrompt;
+    // 加载协议规则，设定初始状态（例如未认证场景）
+    const protocols = loadProtocols(ir);
     for (let r = 0; r < 3; r++) {
         let text;
         try {
@@ -179,6 +201,7 @@ ${userIntent}
         }
         const enriched = enrichActions(rawActions, ir);
         const filtered = enriched.filter(a => !forbiddenFuncs.includes(a.function || ''));
+        // 1) 基础序列校验
         const seqResult = (0, validator_1.validateActionSequence)(filtered);
         if (!seqResult.valid) {
             const errorsFlat = seqResult.errors.flat();
@@ -196,6 +219,26 @@ ${userIntent}
             currentPrompt = basePrompt + `\n错误：${errorsFlat.join("；")}。请修正。`;
             continue;
         }
+        // 2) 协议状态机校验 (SSG)
+        if (protocols.length > 0) {
+            const protoResult = validateProtocol(filtered, protocols, "UNAUTHENTICATED");
+            if (!protoResult.valid) {
+                console.log("🛡️ SSG 协议违规:", protoResult.error);
+                (0, failure_corpus_1.recordFailure)({
+                    intent: userIntent,
+                    projectFunctions: ir.map((f) => f.name),
+                    violatedSVL: "SVL-4",
+                    constraintType: "protocol",
+                    actionSequence: filtered,
+                    errorDetail: protoResult.error,
+                });
+                (0, memory_layer_1.recordEpisode)({ intent: userIntent, actions: filtered, success: false, svlViolated: "SVL-4" });
+                currentPrompt = basePrompt + `\n协议错误：${protoResult.error}。请按照正确的业务顺序重新生成，确保先通过认证再签发令牌。`;
+                continue;
+                continue;
+            }
+        }
+        // 3) 语义合约校验
         const semResult = (0, semantic_validator_1.checkSemantic)(userIntent, filtered);
         if (!semResult.valid) {
             console.log("⚠️ 语义校验失败:", semResult.errors.join(", "));

package/dist/report.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const immune_reporter_1 = require("./immune-reporter");
+const args = process.argv.slice(2);
+const command = args[0] || "preview";
+async function main() {
+    switch (command) {
+        case "preview":
+            console.log("═══ 待上报的脱敏错误指纹 ═══");
+            const fps = (0, immune_reporter_1.previewFingerprints)();
+            if (fps.length === 0) {
+                console.log("（暂无新的失败案例）");
+            }
+            else {
+                fps.forEach((f, i) => {
+                    console.log(`${i + 1}. [${f.violatedSVL}:${f.constraintType}] ${f.functionSequence.join(" → ") || "(无函数调用)"}`);
+                });
+                console.log(`\n共 ${fps.length} 条脱敏指纹待上报`);
+            }
+            break;
+        case "report":
+            console.log("正在安全上报脱敏指纹...");
+            const result = await (0, immune_reporter_1.reportFingerprints)();
+            console.log(result.message);
+            break;
+        default:
+            console.log("用法: npx ts-node src/report.ts [preview|report]");
+            console.log("  preview  查看待上报的脱敏错误指纹");
+            console.log("  report   执行安全上报");
+    }
+}
+main().catch(console.error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "2.0.1",
+  "version": "2.0.4",
   "description": "Progmune Runtime — Program Immunology: Constraint-Guided Program Synthesis Runtime",
   "main": "dist/mcp-server.mjs",
   "bin": {

package/protocols.json

@@ -0,0 +1,16 @@
+{
+  "verify_password": {
+    "pre_states": ["UNAUTHENTICATED"],
+    "post_states": ["AUTHENTICATED"]
+  },
+  "generate_jwt": {
+    "pre_states": ["AUTHENTICATED"],
+    "post_states": ["TOKEN_ISSUED"],
+    "invalidate": ["AUTHENTICATED"]
+  },
+  "create_session": {
+    "pre_states": ["TOKEN_ISSUED"],
+    "post_states": ["SESSION_ACTIVE"],
+    "invalidate": ["TOKEN_ISSUED"]
+  }
+}

package/dist/mcp-server.js

@@ -1,55 +0,0 @@
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const fs = require('fs');
-
-const { plan } = require('./planner.js');
-const { extractIRPython } = require('./extract-ir-python.js');
-const { emitPython } = require('./python-emitter.js');
-const { recordRun } = require('./feedback.js');
-
-async function main() {
-  const server = new Server({
-    name: "progmune",
-    version: "2.0.0"
-  }, { capabilities: { tools: {} } });
-
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: [{
-      name: "generate_verified_code",
-      description: "生成类型安全的Python代码，仅使用项目中真实存在的函数。",
-      inputSchema: {
-        type: "object",
-        properties: {
-          intent: { type: "string", description: "编程意图" },
-          projectPath: { type: "string", description: "项目根目录绝对路径" }
-        },
-        required: ["intent", "projectPath"]
-      }
-    }]
-  }));
-
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    if (request.params.name === "generate_verified_code") {
-      const { intent, projectPath } = request.params.arguments;
-      const fns = extractIRPython(projectPath);
-      fs.writeFileSync("ir.json", JSON.stringify(fns, null, 2));
-      const actions = await plan(intent);
-      if (!actions || actions.length === 0) {
-        return { content: [{ type: "text", text: "无法生成满足约束的代码。" }] };
-      }
-      const code = emitPython(actions);
-      recordRun(intent, actions, true);
-      return { content: [{ type: "text", text: code }] };
-    }
-    throw new Error("未知工具");
-  });
-
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-}
-
-main().catch(console.error);