progmune-runtime 2.1.6 → 3.2.0

package/dist/risk-model.js

@@ -0,0 +1,215 @@
+"use strict";
+/**
+ * Risk Model — Pattern × Severity × Policy
+ *
+ * Upgrades detection from boolean (valid/invalid) to structured risk assessment.
+ *
+ * Architecture:
+ *   Protocol → Concept → DetectionPattern → RiskObject → Policy → Decision
+ *
+ * Completeness becomes a knowledge-layer metric. Risk drives governance.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DETECTION_PATTERNS = void 0;
+exports.assessRisk = assessRisk;
+// ═══════════════════════════════════════════════════════════════
+// Detection Patterns (evidence-backed, weighted by severity)
+// ═══════════════════════════════════════════════════════════════
+exports.DETECTION_PATTERNS = [
+    // ── TLS Patterns ──
+    {
+        id: "TLS-MISSING-FINISHED",
+        name: "Missing Finished",
+        description: "TLS handshake started but Finished message not sent — handshake incomplete. Attacker may intercept before authentication completes.",
+        protocolName: "TLS Handshake",
+        conceptName: "Finished",
+        severity: "Critical",
+        confidence: 91,
+        evidenceSequences: 135,
+        detect: (calls) => {
+            const hasInit = calls.some(c => /\b(\w*ssl\w*init|\w*SSL\w*new|\w*tls\w*init)\b/i.test(c));
+            const hasConnect = calls.some(c => /\b(\w*ssl\w*connect|\w*ssl\w*handshake|\w*tls\w*connect)\b/i.test(c));
+            const hasFree = calls.some(c => /\b(\w*ssl\w*free|\w*SSL\w*cleanup|\w*SSL_CTX_free)\b/i.test(c));
+            return (hasInit || hasConnect) && !hasFree;
+        },
+        detail: "TLS handshake initiated but no Finished/free step detected. Connection may remain open or unverified.",
+    },
+    {
+        id: "TLS-NO-INIT",
+        name: "TLS Without Init",
+        description: "TLS connect or read without prior initialization — possible use of uninitialized SSL context.",
+        protocolName: "TLS Handshake",
+        conceptName: "ClientHello",
+        severity: "High",
+        confidence: 85,
+        evidenceSequences: 135,
+        detect: (calls) => {
+            const hasInit = calls.some(c => /\b(\w*ssl\w*init|\w*SSL\w*new|\w*tls\w*init)\b/i.test(c));
+            const hasConnect = calls.some(c => /\b(\w*ssl\w*connect|\w*ssl\w*handshake)\b/i.test(c));
+            return hasConnect && !hasInit;
+        },
+        detail: "SSL connect/handshake called without prior context initialization. Missing SSL_CTX_new or equivalent.",
+    },
+    {
+        id: "TLS-DOUBLE-FREE",
+        name: "TLS Double Free",
+        description: "SSL free called on same object twice, or free without matching init. Normal cleanup (SSL_free + SSL_CTX_free for SSL_new + SSL_CTX_new) is safe.",
+        protocolName: "TLS Handshake",
+        conceptName: "Finished",
+        severity: "Critical",
+        confidence: 88,
+        evidenceSequences: 135,
+        detect: (calls) => {
+            // Count distinct SSL object types freed (not just total free calls)
+            const sslFreeCount = calls.filter(c => /\bSSL_free\b/i.test(c)).length;
+            const ctxFreeCount = calls.filter(c => /\bSSL_CTX_free\b/i.test(c)).length;
+            const sslNewCount = calls.filter(c => /\bSSL_new\b/i.test(c)).length;
+            const ctxNewCount = calls.filter(c => /\bSSL_CTX_new\b/i.test(c)).length;
+            // Violation: more frees than news for the SAME object type
+            const sslDoubleFree = sslFreeCount > sslNewCount;
+            const ctxDoubleFree = ctxFreeCount > ctxNewCount;
+            return (sslDoubleFree || ctxDoubleFree) && (sslFreeCount + ctxFreeCount >= 2);
+        },
+        detail: "SSL_free or SSL_CTX_free called more times than their matching init. Normal cleanup (1 SSL_free + 1 SSL_CTX_free for 1 SSL_new + 1 SSL_CTX_new) is safe.",
+    },
+    // ── SSH Patterns ──
+    {
+        id: "SSH-NO-AUTH",
+        name: "SSH Without Auth",
+        description: "SSH connection established but no authentication step — possible unauthorized access.",
+        protocolName: "SSH Connection",
+        conceptName: "Authentication",
+        severity: "Critical",
+        confidence: 78,
+        evidenceSequences: 135,
+        detect: (calls) => {
+            const hasInit = calls.some(c => /\b(\w*ssh\w*init|ssh\w*setup)\b/i.test(c));
+            const hasAuth = calls.some(c => /\b(\w*ssh\w*auth|\w*ssh\w*login)\b/i.test(c));
+            return hasInit && !hasAuth;
+        },
+        detail: "SSH session initialized but no authentication step. Connection may be unauthenticated.",
+    },
+    {
+        id: "SSH-NO-CLEANUP",
+        name: "SSH Missing Cleanup",
+        description: "SSH session started but never properly closed — potential resource leak or session hijacking.",
+        protocolName: "SSH Connection",
+        conceptName: "Channel",
+        severity: "High",
+        confidence: 78,
+        evidenceSequences: 135,
+        detect: (calls) => {
+            const hasInit = calls.some(c => /\b(\w*ssh\w*init)\b/i.test(c));
+            const hasDone = calls.some(c => /\b(\w*ssh\w*done|\w*ssh\w*close|\w*ssh\w*free|\w*ssh\w*disconnect)\b/i.test(c));
+            return hasInit && !hasDone;
+        },
+        detail: "SSH session initialized but never closed. Resource leak or session fixation risk.",
+    },
+    // ── HTTP Patterns ──
+    {
+        id: "HTTP-NO-RESPONSE",
+        name: "HTTP Without Response",
+        description: "HTTP request sent but no response processed — possible incomplete request handling.",
+        protocolName: "HTTP Request",
+        conceptName: "Response",
+        severity: "Medium",
+        confidence: 80,
+        evidenceSequences: 150,
+        detect: (calls) => {
+            const hasInit = calls.some(c => /\b(\w*http\w*init|\w*http\w*handler)\b/i.test(c));
+            const hasSend = calls.some(c => /\b(\w*http\w*send|\w*http\w*process|ap_pass_brigade)\b/i.test(c));
+            return (hasInit || hasSend) && !calls.some(c => /\b(\w*http\w*cleanup|\w*http\w*finalize)\b/i.test(c));
+        },
+        detail: "HTTP request initiated but no cleanup/finalize step. Connection may hang.",
+    },
+    // ── Resource Patterns ──
+    {
+        id: "RES-ACQUIRE-NO-RELEASE",
+        name: "Resource Acquire Without Release",
+        description: "Resource acquired (malloc, open, SSL_new) but never released — definite resource leak.",
+        protocolName: "Resource Lifecycle",
+        severity: "Critical",
+        confidence: 98,
+        evidenceSequences: 250,
+        detect: (calls) => {
+            const acquireRe = /\b(malloc|calloc|SSL_CTX_new|SSL_new|BIO_new|open|fopen|socket)\b/i;
+            const releaseRe = /\b(free|SSL_CTX_free|SSL_free|BIO_free|close|fclose)\b/i;
+            const hasAcquire = calls.some(c => acquireRe.test(c) && !/\b(create|alloc|new|init)\w*\b/i.test(c));
+            const hasRelease = calls.some(c => releaseRe.test(c));
+            return hasAcquire && !hasRelease;
+        },
+        detail: "Resource acquired but no matching release call. Definite resource leak.",
+    },
+];
+// ═══════════════════════════════════════════════════════════════
+// Risk Assessment Engine
+// ═══════════════════════════════════════════════════════════════
+function assessRisk(calls, protocolName) {
+    const patterns = exports.DETECTION_PATTERNS.filter(p => {
+        if (protocolName && p.protocolName !== protocolName)
+            return false;
+        return p.detect(calls);
+    });
+    if (patterns.length === 0) {
+        return {
+            riskLevel: "Low",
+            patterns: [],
+            knowledgeUnit: { id: "", name: protocolName || "Unknown", version: "", rfc: undefined },
+            recommendation: "Allow",
+            summary: "No known risk patterns detected.",
+        };
+    }
+    // Highest severity pattern determines risk level
+    const severityOrder = ["Critical", "High", "Medium", "Low"];
+    const maxSeverity = patterns.reduce((max, p) => {
+        const i1 = severityOrder.indexOf(p.severity);
+        const i2 = severityOrder.indexOf(max);
+        return i1 < i2 ? p.severity : max;
+    }, "Low");
+    // Recommendation based on highest severity
+    let recommendation;
+    if (maxSeverity === "Critical")
+        recommendation = "Block";
+    else if (maxSeverity === "High")
+        recommendation = "Warn";
+    else
+        recommendation = "Allow";
+    // Look up Knowledge Unit
+    let unitId = "", unitVersion = "", unitRfc;
+    try {
+        const { buildKnowledgeBase } = require("./protocol-knowledge");
+        const kb = buildKnowledgeBase();
+        const unit = kb.units.find((u) => u.name === patterns[0].protocolName);
+        if (unit) {
+            unitId = unit.id;
+            unitVersion = unit.currentVersion;
+            unitRfc = unit.rfcReference;
+        }
+    }
+    catch { /* KB unavailable */ }
+    return {
+        riskLevel: maxSeverity,
+        patterns: patterns.map(p => ({
+            patternId: p.id,
+            patternName: p.name,
+            severity: p.severity,
+            confidence: p.confidence,
+            concept: p.conceptName,
+            detail: p.detail || p.description,
+        })),
+        knowledgeUnit: { id: unitId, name: patterns[0].protocolName, version: unitVersion, rfc: unitRfc },
+        recommendation,
+        summary: patterns.length === 1
+            ? `${patterns[0].name}: ${patterns[0].detail || patterns[0].description}`
+            : `${patterns.length} risk patterns detected. Highest: ${patterns[0].name} (${maxSeverity}).`,
+    };
+}
+// ═══════════════════════════════════════════════════════════════
+// CLI
+// ═══════════════════════════════════════════════════════════════
+if (require.main === module) {
+    const args = process.argv.slice(2);
+    const calls = args.length > 0 ? args : ["SSL_CTX_new", "SSL_connect"];
+    const risk = assessRisk(calls);
+    console.log(JSON.stringify(risk, null, 2));
+}

package/dist/rule-miner.js

@@ -1,10 +1,237 @@
 "use strict";
+/**
+ * Rule Miner — generates actionable protocol rules from failure patterns.
+ *
+ * Upgrades the passive diagnostic to an active rule generator:
+ *   1. Analyses the failure corpus for recurring SVL-4 violations
+ *   2. Generates FunctionProtocol entries from fix paths
+ *   3. Can merge rules into protocols.json (dry-run by default)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mineRules = mineRules;
+exports.toProtocolEntries = toProtocolEntries;
+exports.applyMinedRules = applyMinedRules;
+exports.mineAntibodiesV2 = mineAntibodiesV2;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const failure_corpus_1 = require("./failure-corpus");
-console.log("═══ 失败模式分析 ═══");
-const patterns = (0, failure_corpus_1.getTopFailurePatterns)(5);
-console.log("Top 5 失败模式:");
-patterns.forEach(p => console.log(`  ${p.pattern}: ${p.count} 次`));
-console.log("\n候选规则建议:");
-const rules = (0, failure_corpus_1.generateCandidateRules)();
-rules.forEach(r => console.log(`  - ${r}`));
+/**
+ * Mine protocol rules from failure patterns.
+ *
+ * Analyses SVL-4 protocol violations to infer state transitions
+ * that should be encoded as permanent protocol rules.
+ */
+function mineRules() {
+    const genome = (0, failure_corpus_1.getFailureGenome)();
+    const patterns = (0, failure_corpus_1.getTopFailurePatterns)(10);
+    const mined = [];
+    // Strategy 1: Convert common fix paths into protocol rules
+    const ssgFixes = genome.commonFixPaths.filter(f => f.violation === "SVL-4");
+    for (const fix of ssgFixes) {
+        if (fix.fixPath.length < 2)
+            continue;
+        for (let i = 0; i < fix.fixPath.length - 1; i++) {
+            const currentFn = fix.fixPath[i];
+            const nextFn = fix.fixPath[i + 1];
+            mined.push({
+                function: currentFn,
+                pre_states: [],
+                post_states: [`READY_FOR_${nextFn.toUpperCase()}`],
+                namespace: "_global",
+                reason: `Fix path ${fix.fixPath.join(" → ")} observed ${fix.count} times`,
+                confidence: fix.count,
+            });
+            mined.push({
+                function: nextFn,
+                pre_states: [`READY_FOR_${nextFn.toUpperCase()}`],
+                post_states: ["COMPLETED"],
+                namespace: "_global",
+                reason: `Fix path continuation: ${currentFn} → ${nextFn}`,
+                confidence: fix.count,
+            });
+        }
+    }
+    // Strategy 2: Pattern-based rules from top violations
+    const PATTERN_RULES = {
+        symbol_existence: { pre: [], post: ["IR_VALIDATED"], desc: "只使用 IR 中已导出的函数，禁止编造函数名" },
+        type_mismatch: { pre: [], post: ["TYPE_CHECKED"], desc: "检查参数类型与 IR 签名一致后再调用" },
+        dataflow: { pre: [], post: ["DATAFLOW_VALID"], desc: "变量必须先声明再使用，避免循环引用" },
+        protocol: { pre: ["INIT"], post: ["PROTOCOL_COMPLIANT"], desc: "严格遵循 SSG 协议状态顺序调用函数" },
+        missing_import: { pre: [], post: ["IMPORT_RESOLVED"], desc: "只从已导出的模块导入符号" },
+        params_undefined: { pre: [], post: ["PARAMS_SAFE"], desc: "调用 .map/.filter 前检查对象是否为数组，使用 (obj || [])" },
+    };
+    for (const p of patterns) {
+        // Extract constraint type from pattern (e.g. "SVL-1:symbol_existence" → "symbol_existence")
+        const constraintMatch = p.pattern.match(/SVL-\d:(.+)/);
+        if (!constraintMatch)
+            continue;
+        const constraintType = constraintMatch[1];
+        const rule = PATTERN_RULES[constraintType];
+        if (rule) {
+            mined.push({
+                function: constraintType,
+                pre_states: rule.pre,
+                post_states: rule.post,
+                namespace: "mined",
+                reason: `Pattern "${constraintType}" occurred ${p.count} times → ${rule.desc}`,
+                confidence: p.count,
+            });
+        }
+        else {
+            // Generic fallback for unknown patterns
+            mined.push({
+                function: constraintType,
+                pre_states: ["INIT"],
+                post_states: ["VALIDATED"],
+                namespace: "mined",
+                reason: `Unknown pattern "${constraintType}" occurred ${p.count} times`,
+                confidence: p.count,
+            });
+        }
+    }
+    // Deduplicate by function name (keep highest confidence)
+    const seen = new Map();
+    for (const rule of mined) {
+        const key = `${rule.function}:${rule.namespace}`;
+        if (!seen.has(key) || seen.get(key).confidence < rule.confidence) {
+            seen.set(key, rule);
+        }
+    }
+    return [...seen.values()].sort((a, b) => b.confidence - a.confidence);
+}
+/**
+ * Convert mined rules to FunctionProtocol format compatible with protocols.json.
+ */
+function toProtocolEntries(rules) {
+    const entries = {};
+    for (const r of rules) {
+        entries[r.function] = {
+            pre_states: r.pre_states,
+            post_states: r.post_states,
+            ...(r.invalidate && r.invalidate.length > 0 ? { invalidate: r.invalidate } : {}),
+            ...(r.namespace !== "_global" ? { namespace: r.namespace } : {}),
+            _mined: { reason: r.reason, confidence: r.confidence },
+        };
+    }
+    return entries;
+}
+/**
+ * Merge mined rules into protocols.json.
+ * Dry-run by default — set apply=true to write.
+ */
+function applyMinedRules(apply = false) {
+    const mined = mineRules();
+    const protocolsPath = path.resolve(__dirname, "..", "protocols.json");
+    let existing = {};
+    if (fs.existsSync(protocolsPath)) {
+        existing = JSON.parse(fs.readFileSync(protocolsPath, "utf-8"));
+    }
+    const newEntries = toProtocolEntries(mined);
+    let merged = 0;
+    let skipped = 0;
+    for (const [fn, rule] of Object.entries(newEntries)) {
+        if (existing[fn]) {
+            skipped++;
+            continue; // Don't overwrite existing rules
+        }
+        existing[fn] = rule;
+        merged++;
+    }
+    if (apply && merged > 0) {
+        // Backup original
+        const backup = protocolsPath + ".bak";
+        if (fs.existsSync(protocolsPath)) {
+            fs.copyFileSync(protocolsPath, backup);
+        }
+        fs.writeFileSync(protocolsPath, JSON.stringify(existing, null, 2));
+        console.error(`[规则挖掘] 已将 ${merged} 条规则写入 ${protocolsPath}（备份: ${backup}）`);
+    }
+    return { rules: mined, merged, skipped, dryRun: !apply };
+}
+/**
+ * Mine antibody candidates from Schema v2 failure records.
+ * Returns patterns that recurred >= minCount times.
+ */
+function mineAntibodiesV2(minCount = 3) {
+    const all = (0, failure_corpus_1.loadTrajectories)().filter(t => t.result === "violation");
+    if (all.length === 0)
+        return [];
+    const groups = {};
+    for (const t of all) {
+        const key = `${t.violation?.type || "other"}|${t.protocol}`;
+        if (!groups[key])
+            groups[key] = [];
+        groups[key].push(t);
+    }
+    const candidates = [];
+    for (const [key, records] of Object.entries(groups)) {
+        if (records.length < minCount)
+            continue;
+        const [violationType, protocol] = key.split("|");
+        const avgDepth = Math.round(records.reduce((s, t) => s + t.context.nestingDepth, 0) / records.length);
+        const fixPaths = [...new Set(records.flatMap(t => t.violation?.fixPath || []))];
+        const avgSuccess = records.length > 0
+            ? records.reduce((s, t) => s + t.successRate, 0) / records.length
+            : 0;
+        const timestamps = records.map(f => f.timestamp).sort();
+        candidates.push({
+            id: `ab2_${violationType}_${protocol}_${Date.now()}`,
+            violationType: violationType,
+            protocol,
+            contextPattern: { nestingDepth: avgDepth },
+            fixPath: fixPaths.slice(0, 5),
+            promoteToStatic: ["resource_leak", "protocol_violation", "illegal_state_transition"].includes(violationType),
+            occurrenceCount: records.length,
+            avgSuccessRate: avgSuccess,
+            firstSeen: timestamps[0] || "N/A",
+            lastSeen: timestamps[timestamps.length - 1] || "N/A",
+            minedAt: new Date().toISOString(),
+        });
+    }
+    return candidates.sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+}
+/** CLI entry point: print mined rules without applying. */
+if (require.main === module) {
+    const result = applyMinedRules(false);
+    console.log(`\n挖掘到 ${result.rules.length} 条候选规则（dry-run）:`);
+    for (const r of result.rules) {
+        console.log(`  ${r.function}: [${r.pre_states.join(",")}] → [${r.post_states.join(",")}] (置信度: ${r.confidence})`);
+        console.log(`    原因: ${r.reason}`);
+    }
+    if (result.rules.length > 0) {
+        console.log(`\n应用规则: node -e "require('./dist/rule-miner').applyMinedRules(true)"`);
+    }
+}