progmune-runtime 2.1.6 → 3.2.0

package/dist/trust/call-graph-propagator.js

@@ -0,0 +1,225 @@
+"use strict";
+/**
+ * Phase 5: Cross-Function Call Graph Propagator
+ *
+ * Uses the project's IR (Intermediate Representation) to trace protocol
+ * operations across function boundaries. When function A calls function B,
+ * B's semantic domains are propagated up to enrich A's analysis window.
+ *
+ * This addresses the single-function window limitation:
+ *   Before: analyze only direct calls in function A
+ *   After:  analyze direct calls + propagated domains from callees
+ *
+ * Architecture:
+ *   IR (call graph) → Build propagation index → Enrich semantic sequences
+ *
+ * For C projects without IR, heuristic-based inference is used instead
+ * (see TLS_INFERRED_NO_CERT_VERIFY check in protocol-domain-validator.ts).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCallGraphFromIR = buildCallGraphFromIR;
+exports.propagateDomains = propagateDomains;
+exports.enrichWithPropagatedDomains = enrichWithPropagatedDomains;
+exports.annotateGraphWithDomains = annotateGraphWithDomains;
+exports.enrichSequence = enrichSequence;
+exports.inferDomainsFromFunctionName = inferDomainsFromFunctionName;
+const path = __importStar(require("path"));
+// ═══════════════════════════════════════════════════════════════
+// IR Loading & Call Graph Construction
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Build a call graph index from the project IR.
+ * The IR must have function definitions with callee information.
+ */
+function buildCallGraphFromIR(irPath) {
+    const nodes = new Map();
+    let totalEdges = 0;
+    try {
+        const fs = require("fs");
+        const resolvedPath = irPath || path.resolve(process.cwd(), "ir.json");
+        if (!fs.existsSync(resolvedPath)) {
+            return { nodes, totalFunctions: 0, totalEdges: 0 };
+        }
+        const raw = JSON.parse(fs.readFileSync(resolvedPath, "utf-8"));
+        const functions = Array.isArray(raw) ? raw : raw.functions || [];
+        for (const fn of functions) {
+            if (!fn.name)
+                continue;
+            const callees = [];
+            // Extract callees from various IR formats
+            if (Array.isArray(fn.calls)) {
+                callees.push(...fn.calls.map((c) => (typeof c === "string" ? c : c.name || c.function)));
+            }
+            if (Array.isArray(fn.callees)) {
+                callees.push(...fn.callees);
+            }
+            // Infer callees from call graph edges
+            if (Array.isArray(fn.edges)) {
+                callees.push(...fn.edges.map((e) => (typeof e === "string" ? e : e.to || e.target)));
+            }
+            totalEdges += callees.length;
+            nodes.set(fn.name, {
+                name: fn.name,
+                file: fn.file || "",
+                callees: [...new Set(callees)], // deduplicate
+                domains: [], // populated later by semantic mapper
+            });
+        }
+    }
+    catch {
+        // IR unavailable — return empty index
+    }
+    return { nodes, totalFunctions: nodes.size, totalEdges };
+}
+// ═══════════════════════════════════════════════════════════════
+// Domain Propagation
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Propagate semantic domains from callees to caller.
+ *
+ * Given a function name and a call graph index, returns the set of
+ * protocol domains from all reachable callees (up to maxDepth).
+ *
+ * This allows the Trust Engine to see protocol operations that happen
+ * inside called functions, not just in the immediate call sequence.
+ */
+function propagateDomains(functionName, graph, maxDepth = 3) {
+    if (graph.totalFunctions === 0)
+        return [];
+    const visited = new Set();
+    const domains = new Set();
+    function dfs(name, depth) {
+        if (depth > maxDepth || visited.has(name))
+            return;
+        visited.add(name);
+        const node = graph.nodes.get(name);
+        if (!node)
+            return;
+        // Add this node's domains
+        for (const d of node.domains) {
+            domains.add(d);
+        }
+        // Recurse into callees
+        for (const callee of node.callees) {
+            dfs(callee, depth + 1);
+        }
+    }
+    dfs(functionName, 0);
+    return [...domains];
+}
+/**
+ * Enrich a semantic step with propagated domains from callees.
+ * Returns additional domains that should be considered present
+ * in the analysis window.
+ */
+function enrichWithPropagatedDomains(step, graph) {
+    if (graph.totalFunctions === 0)
+        return [];
+    return propagateDomains(step.api, graph, 3);
+}
+/**
+ * Annotate call graph nodes with semantic domains extracted from
+ * their direct call sequences.
+ *
+ * This should be called after the semantic mapper has processed
+ * each function's call sequence.
+ */
+function annotateGraphWithDomains(graph, functionDomains) {
+    for (const [funcName, domains] of functionDomains) {
+        const node = graph.nodes.get(funcName);
+        if (node) {
+            node.domains = domains;
+        }
+    }
+}
+/**
+ * Enrich a call sequence with cross-function context.
+ *
+ * For each function call in the sequence, looks up its callees in the
+ * call graph and propagates their protocol domains into the analysis window.
+ */
+function enrichSequence(steps, graph) {
+    const propagatedDomains = new Set();
+    for (const step of steps) {
+        const calleeDomains = enrichWithPropagatedDomains(step, graph);
+        for (const d of calleeDomains) {
+            propagatedDomains.add(d);
+        }
+    }
+    return {
+        directSteps: steps,
+        propagatedDomains: [...propagatedDomains],
+        graphAvailable: graph.totalFunctions > 0,
+    };
+}
+// ═══════════════════════════════════════════════════════════════
+// Inference for C projects (no IR available)
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Heuristic domain propagation for C projects without IR.
+ * Uses function name patterns to infer what domains a called function
+ * likely contains.
+ */
+function inferDomainsFromFunctionName(functionName) {
+    const name = functionName.toLowerCase();
+    const domains = [];
+    // SSL/TLS connection functions internally perform handshake + cert verify
+    if (name.includes("ssl_connect") ||
+        name.includes("tls_connect") ||
+        name.includes("do_connect") ||
+        name.includes("ssl_cfilter") ||
+        name.includes("ssl_setup")) {
+        domains.push("tls_handshake", "tls_cert");
+    }
+    // SSL context creation functions
+    if (name.includes("ssl_ctx_new") ||
+        name.includes("ssl_new") ||
+        name.includes("ssl_init")) {
+        domains.push("tls_handshake");
+    }
+    // Certificate loading/verification functions
+    if (name.includes("ssl_verify") ||
+        name.includes("cert_verify") ||
+        name.includes("check_cert") ||
+        name.includes("x509_verify")) {
+        domains.push("tls_cert");
+    }
+    // Connection functions that internally do TLS
+    if (name.includes("_connect") && !name.includes("disconnect")) {
+        domains.push("tls_handshake");
+    }
+    return domains;
+}

package/dist/trust/cli.js

@@ -0,0 +1,122 @@
+"use strict";
+/**
+ * Phase 1: Trust CLI — `progmune trust` command
+ *
+ * Usage:
+ *   npx ts-node src/trust/cli.ts <projectPath> [options]
+ *
+ * Options:
+ *   --commit <sha>     Git commit SHA
+ *   --branch <name>    Git branch name
+ *   --policy <path>    Policy config file (default: .progmune-policy.json)
+ *   --language <lang>  Project language
+ *   --json             Output as JSON
+ *   --help, -h         Show help
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const engine_1 = require("./engine");
+const terminal_1 = require("./formatters/terminal");
+const json_1 = require("./formatters/json");
+const ci_1 = require("./formatters/ci");
+const args = process.argv.slice(2);
+async function main() {
+    // Help flag
+    if (args.includes("--help") || args.includes("-h")) {
+        console.log(`
+Progmune Trust CLI — AI Trust Decision Engine
+
+Usage:
+  npx ts-node src/trust/cli.ts <projectPath> [options]
+
+Options:
+  --commit <sha>      Git commit SHA for audit trail
+  --branch <name>     Git branch name
+  --policy <path>     Policy config file (default: .progmune-policy.json)
+  --language <lang>   Project language (typescript, python, etc.)
+  --json              Output machine-readable JSON
+  --help, -h          Show this help
+
+Example:
+  npx ts-node src/trust/cli.ts . --commit HEAD --json
+`);
+        process.exit(0);
+    }
+    // Extract positional arg (project path)
+    const positional = args.filter((a) => !a.startsWith("--"));
+    const projectPath = positional[0] || process.cwd();
+    // Parse flags
+    const getFlag = (name) => {
+        const idx = args.indexOf(`--${name}`);
+        if (idx >= 0 && idx + 1 < args.length) {
+            return args[idx + 1];
+        }
+        return undefined;
+    };
+    const isJson = args.includes("--json");
+    const isCi = args.includes("--ci");
+    const commit = getFlag("commit") || "unknown";
+    const branch = getFlag("branch");
+    const policy = getFlag("policy");
+    const language = getFlag("language");
+    const ctx = {
+        projectPath: path.resolve(projectPath),
+        projectName: path.basename(path.resolve(projectPath)),
+        commit,
+        branch,
+        policyName: policy,
+        language,
+    };
+    try {
+        const decision = await (0, engine_1.evaluateTrust)(ctx);
+        if (isJson) {
+            console.log((0, json_1.formatTrustJSON)(decision));
+        }
+        else if (isCi) {
+            console.log((0, ci_1.formatTrustCI)(decision));
+        }
+        else {
+            console.log((0, terminal_1.formatTrustTerminal)(decision));
+        }
+        // Exit code reflects decision
+        process.exit((0, ci_1.ciExitCode)(decision));
+    }
+    catch (e) {
+        console.error(`❌ Trust evaluation failed: ${e.message}`);
+        process.exit(3);
+    }
+}
+main();

package/dist/trust/compliance-scorer.js

@@ -0,0 +1,283 @@
+"use strict";
+/**
+ * Compliance Scoring Engine
+ *
+ * Upgrades Progmune's verification from binary (violation/clean) to
+ * multi-dimensional continuous scores (0-1 per protocol dimension).
+ *
+ * The insight: SSG rules already encode what "perfect compliance" looks like.
+ * We just need to measure distance from that perfect state, dimension by
+ * dimension, instead of returning a single pass/fail.
+ *
+ * This is the first step toward a reward model — proving that continuous
+ * compliance scores are actionable for AI code generators.
+ *
+ * No ML. Pure rule-based scoring using existing PROTOCOLS + SAFEGUARD_RULES.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreCompliance = scoreCompliance;
+exports.scoreFunction = scoreFunction;
+exports.formatComplianceReport = formatComplianceReport;
+/**
+ * Protocol dimensions — mirrors the SSG PROTOCOLS but expressed as
+ * scorable dimensions rather than binary checks.
+ */
+const DIMENSIONS = [
+    {
+        id: "auth",
+        label: "认证与授权",
+        weight: 0.30,
+        triggers: [
+            /login|register|signin|signup|authenticate|auth|token|session|password|credential/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(login|signin|authenticate|getSessionUser|requirePermission|verifyToken|validateSession)\b/i, label: "auth_check", description: "身份验证" },
+            { pattern: /\b(requirePermission|hasPermission|checkAccess|hasRole|adminCheck|isAuthorized)\b/i, label: "authz_check", description: "权限检查" },
+            { pattern: /\b(logout|destroySession|revokeToken|endSession|invalidate)\b/i, label: "auth_cleanup", description: "会话清理" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(bcrypt|argon2|scrypt|pbkdf2|hashPassword|compare)\b/i, label: "secure_hash", description: "安全哈希" },
+            { pattern: /\b(rateLimit|rate_limit|throttle|maxAttempts|loginLimiter)\b/i, label: "rate_limit", description: "速率限制" },
+            { pattern: /\b(2fa|twoFactor|mfa|otp|verifyCode|totp)\b/i, label: "mfa", description: "多因素认证" },
+        ],
+    },
+    {
+        id: "tls",
+        label: "TLS/加密",
+        weight: 0.15,
+        triggers: [
+            /ssl|tls|https|cert|certificate|encrypt|decrypt|createServer/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(ssl|tls|cert|https|createSecureContext|credentials)\b/i, label: "tls_config", description: "TLS 配置" },
+            { pattern: /\b(ssl.*free|ssl.*cleanup|close.*ssl|disconnect)\b/i, label: "tls_cleanup", description: "TLS 清理" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(helmet|csp|hsts|secure.*header)\b/i, label: "security_headers", description: "安全响应头" },
+        ],
+    },
+    {
+        id: "payment",
+        label: "支付安全",
+        weight: 0.20,
+        triggers: [
+            /payment|pay|checkout|refund|charge|transaction|order.*create|order.*process/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(verifyOrder|getOrder|checkOrder|findOrder|orderExists)\b/i, label: "order_check", description: "订单验证" },
+            { pattern: /\b(payment.*intent|pay.*create|create.*payment|initiate.*payment)\b/i, label: "pay_init", description: "支付发起" },
+            { pattern: /\b(verify.*sign|check.*sign|webhook.*secret|hmac|signature)\b/i, label: "sig_check", description: "签名验证" },
+            { pattern: /\b(capture.*payment|confirm.*order|payment.*done|payment.*success)\b/i, label: "pay_complete", description: "支付完成" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(idempotent|retry|rollback|compensat)\b/i, label: "idempotency", description: "幂等性" },
+        ],
+    },
+    {
+        id: "data_integrity",
+        label: "数据完整性",
+        weight: 0.15,
+        triggers: [
+            /create|update|delete|insert|modify|save|write|mutate/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(validate|sanitize|check|verify|schema|zod|yup|joi)\b/i, label: "input_check", description: "输入校验" },
+            { pattern: /\b(audit|log.*change|change.*log|track.*change|record.*mutation)\b/i, label: "audit_trail", description: "审计追踪" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(transaction|rollback|commit)\b/i, label: "transaction", description: "事务保护" },
+            { pattern: /\b(parameterize|prepared.*statement|%s|\$1)\b/i, label: "sql_safe", description: "SQL 安全" },
+        ],
+    },
+    {
+        id: "resource",
+        label: "资源管理",
+        weight: 0.10,
+        triggers: [
+            /file|socket|connection|pool|stream|buffer|handle|upload|download/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(open|create|init|connect|start)\b/i, label: "resource_init", description: "资源获取" },
+            { pattern: /\b(close|free|cleanup|destroy|disconnect|release|end)\b/i, label: "resource_free", description: "资源释放" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(try.*finally|defer|using|RAII)\b/i, label: "cleanup_guarantee", description: "清理保证" },
+        ],
+    },
+    {
+        id: "session",
+        label: "会话管理",
+        weight: 0.10,
+        triggers: [
+            /session|token|jwt|cookie|bearer/i,
+        ],
+        requiredSteps: [
+            { pattern: /\b(session.*create|create.*session|session.*init|token.*generate|jwt.*sign)\b/i, label: "sess_create", description: "会话创建" },
+            { pattern: /\b(session.*check|session.*valid|validate.*session|verify.*token|token.*check)\b/i, label: "sess_validate", description: "会话验证" },
+            { pattern: /\b(session.*destroy|session.*delete|token.*revoke|session.*expire|session.*timeout)\b/i, label: "sess_destroy", description: "会话销毁" },
+        ],
+        bonusPatterns: [
+            { pattern: /\b(httpOnly|secure.*cookie|sameSite|csrf)\b/i, label: "secure_cookie", description: "安全Cookie" },
+        ],
+    },
+];
+// ── Scoring Logic ──
+/**
+ * Score a function call sequence against all protocol dimensions.
+ *
+ * @param calls - Array of function call names in order
+ * @param functionPurpose - Optional function purpose for context (e.g., "退款处理", "用户注册")
+ * @returns ComplianceScore with per-dimension breakdown
+ */
+function scoreCompliance(calls, functionPurpose) {
+    const dimensions = [];
+    const allCallText = calls.join(" ");
+    const purposeText = functionPurpose || "";
+    for (const dim of DIMENSIONS) {
+        // Check if this dimension is relevant
+        const isRelevant = dim.triggers.some((t) => t.test(allCallText)) ||
+            dim.triggers.some((t) => t.test(purposeText));
+        if (!isRelevant && calls.length > 0) {
+            // Skip irrelevant dimensions — don't penalize what doesn't apply
+            dimensions.push({
+                dimension: dim.id,
+                score: 1.0,
+                maxScore: 1.0,
+                strengths: ["N/A — 不适用"],
+                gaps: [],
+                fixes: [],
+            });
+            continue;
+        }
+        // Score required steps: what % are present?
+        const requiredResults = dim.requiredSteps.map((step) => ({
+            ...step,
+            present: step.pattern.test(allCallText),
+        }));
+        const requiredScore = dim.requiredSteps.length > 0
+            ? requiredResults.filter((r) => r.present).length / dim.requiredSteps.length
+            : 1.0;
+        // Score bonus patterns: each present adds 0.1 to the ceiling
+        const bonusHits = dim.bonusPatterns.filter((b) => b.pattern.test(allCallText));
+        const bonusBoost = Math.min(bonusHits.length * 0.1, 0.2); // cap at +0.2
+        // Calculate strengths and gaps
+        const strengths = [
+            ...requiredResults.filter((r) => r.present).map((r) => r.description),
+            ...bonusHits.map((b) => b.description),
+        ];
+        const gaps = [
+            ...requiredResults.filter((r) => !r.present).map((r) => r.description),
+        ];
+        // Generate fixes for missing steps
+        const fixes = requiredResults
+            .filter((r) => !r.present)
+            .map((r) => `添加 ${r.label}: ${r.description}`);
+        // Final score: required completion + bonus boost, clamped to [0, 1]
+        const rawScore = Math.min(requiredScore + bonusBoost, 1.0);
+        dimensions.push({
+            dimension: dim.id,
+            score: Math.round(rawScore * 100) / 100,
+            maxScore: 1.0,
+            strengths: strengths.length > 0 ? strengths : ["无"],
+            gaps,
+            fixes,
+        });
+    }
+    // Calculate overall score (weighted average of relevant dimensions)
+    const relevantDims = dimensions.filter((d) => d.score < 1.0 || d.strengths[0] !== "N/A — 不适用");
+    const weights = DIMENSIONS.map((d) => d.weight);
+    const weightsMap = new Map(DIMENSIONS.map((d, i) => [d.id, weights[i] ?? 0]));
+    let overall = 0;
+    let totalWeight = 0;
+    for (const dim of dimensions) {
+        const w = weightsMap.get(dim.dimension) || 0.1;
+        // Only count relevant dimensions in the weighted average
+        if (dim.strengths[0] !== "N/A — 不适用") {
+            overall += dim.score * w;
+            totalWeight += w;
+        }
+    }
+    overall = totalWeight > 0 ? overall / totalWeight : 1.0;
+    overall = Math.round(overall * 100) / 100;
+    // Find weakest dimension
+    const scoredDims = dimensions.filter((d) => d.strengths[0] !== "N/A — 不适用");
+    const weakest = scoredDims.length > 0
+        ? scoredDims.reduce((min, d) => (d.score < min.score ? d : min), scoredDims[0])
+        : null;
+    // Find top fix (from the weakest dimension)
+    const topFix = weakest?.fixes[0] || "无需修复";
+    // Build suggested sequence: existing present calls + missing calls
+    const presentCalls = calls.filter((c) => {
+        for (const dim of DIMENSIONS) {
+            for (const step of dim.requiredSteps) {
+                if (step.pattern.test(c))
+                    return true;
+            }
+        }
+        return false;
+    });
+    const missingCalls = weakest?.fixes.map((f) => f.replace("添加 ", "")) || [];
+    return {
+        overall,
+        dimensions,
+        weakestDimension: weakest?.dimension || "all_clear",
+        topFix,
+        suggestedSequence: [
+            ...presentCalls,
+            ...missingCalls.map((m) => `[需添加] ${m}`),
+        ],
+        presentCalls,
+        missingCalls,
+    };
+}
+/**
+ * Score a specific function for compliance given its purpose.
+ * Convenience wrapper for scoring a single function context.
+ */
+function scoreFunction(functionName, calls, purpose) {
+    const allCalls = [functionName, ...calls];
+    return scoreCompliance(allCalls, purpose);
+}
+/**
+ * Format a compliance score as a human-readable report.
+ */
+function formatComplianceReport(score) {
+    const lines = [
+        "═══════════════════════════════════════",
+        "  Progmune Compliance Score",
+        "═══════════════════════════════════════",
+        "",
+        `  Overall: ${renderScoreBar(score.overall)} ${(score.overall * 100).toFixed(0)}%`,
+        `  Weakest: ${score.weakestDimension}`,
+        `  Top Fix: ${score.topFix}`,
+        "",
+        "  Dimensions:",
+    ];
+    for (const dim of score.dimensions) {
+        const bar = renderScoreBar(dim.score);
+        lines.push(`  ${bar} ${dim.dimension.padEnd(16)} ${(dim.score * 100).toFixed(0)}%`);
+        if (dim.gaps.length > 0) {
+            lines.push(`     ⚠️  缺失: ${dim.gaps.join(", ")}`);
+        }
+        if (dim.fixes.length > 0) {
+            lines.push(`     🔧 ${dim.fixes.join("; ")}`);
+        }
+    }
+    if (score.missingCalls.length > 0) {
+        lines.push("");
+        lines.push("  建议添加的调用:");
+        for (const c of score.missingCalls) {
+            lines.push(`    → ${c}`);
+        }
+    }
+    return lines.join("\n");
+}
+function renderScoreBar(score) {
+    if (score >= 0.9)
+        return "🟢";
+    if (score >= 0.7)
+        return "🟡";
+    if (score >= 0.5)
+        return "🟠";
+    return "🔴";
+}