progmune-runtime 3.3.7 → 3.4.0

package/dist/agent-supervision.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * Phase 12: Agent 自监督层 (P3)
+ *
+ * 运行项目测试并提取失败信息 —— 失败注入下一次尝试的 prompt（失败→prompt 回路）。
+ * 设计文档 P3：编译/测试失败反馈注入重试。
+ *
+ * 自动探测顺序：
+ *   1. package.json 有 "test" script → npm test --silent
+ *   2. 存在 .py 文件 → python3 -m pytest -q
+ *   3. 都没有 → { ran: false }（调用方跳过该门）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runProjectTests = runProjectTests;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+// ── Helpers ──
+const FAILURE_PATTERN = /(FAIL|✕|×|failed|Error:|error TS|AssertionError|FAILED)/i;
+function extractFailures(output) {
+    return output
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0 && FAILURE_PATTERN.test(l))
+        .slice(0, 10);
+}
+function runCommand(cwd, command, timeoutMs) {
+    try {
+        const output = (0, child_process_1.execSync)(command, {
+            cwd,
+            timeout: timeoutMs,
+            encoding: "utf-8",
+            stdio: "pipe",
+        });
+        return { pass: true, output };
+    }
+    catch (e) {
+        // 非零退出或超时 → 捕获输出
+        const output = `${e.stdout || ""}\n${e.stderr || ""}`;
+        return { pass: false, output, error: e?.message || String(e) };
+    }
+}
+// ── Main ──
+/**
+ * 自动探测并运行项目测试。
+ *
+ * @requires PROJECT_PATH @produces TEST_RESULT
+ */
+function runProjectTests(projectPath, timeoutMs = 60000) {
+    // 1) npm test
+    const pkgPath = path.join(projectPath, "package.json");
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+            if (pkg.scripts?.test) {
+                const command = "npm test --silent";
+                const r = runCommand(projectPath, command, timeoutMs);
+                return {
+                    ran: true,
+                    pass: r.pass,
+                    failures: extractFailures(r.output),
+                    command,
+                    error: r.error,
+                };
+            }
+        }
+        catch { /* package.json 解析失败 → 继续探测 */ }
+    }
+    // 2) pytest
+    const hasPy = listQuickly(projectPath, (e) => e.endsWith(".py"));
+    if (hasPy) {
+        const command = "python3 -m pytest -q";
+        const r = runCommand(projectPath, command, timeoutMs);
+        if (r.error && /no module named pytest/i.test(r.error + r.output)) {
+            return { ran: false, pass: true, failures: [], command, error: "pytest 未安装" };
+        }
+        return {
+            ran: true,
+            pass: r.pass,
+            failures: extractFailures(r.output),
+            command,
+            error: r.error,
+        };
+    }
+    return { ran: false, pass: true, failures: [], command: "(无测试脚本)" };
+}
+/** 浅层探测是否存在匹配文件（不递归依赖目录）。 */
+function listQuickly(projectPath, match) {
+    const SKIP = new Set(["node_modules", "dist", "build", ".git", "__pycache__", "venv", ".venv"]);
+    const stack = [projectPath];
+    const seen = new Set();
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (seen.has(dir))
+            continue;
+        seen.add(dir);
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (e.isFile() && match(e.name))
+                return true;
+            if (e.isDirectory() && !SKIP.has(e.name) && !e.name.startsWith("."))
+                stack.push(path.join(dir, e.name));
+        }
+    }
+    return false;
+}

package/dist/agent-supervision.test.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Phase 12: 自监督层测试 (P3)
+ *
+ * runProjectTests 的探测逻辑与失败提取。全部 mock，不跑真实测试。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const child_process_1 = require("child_process");
+const agent_supervision_1 = require("./agent-supervision");
+vitest_1.vi.mock("child_process", () => ({
+    execSync: vitest_1.vi.fn(),
+}));
+const mockExecSync = vitest_1.vi.mocked(child_process_1.execSync);
+(0, vitest_1.beforeEach)(() => {
+    vitest_1.vi.clearAllMocks();
+});
+(0, vitest_1.describe)("agent-supervision", () => {
+    (0, vitest_1.it)("package.json 有 test script → npm test，失败时提取失败行", () => {
+        mockExecSync.mockImplementation(() => {
+            const err = new Error("Command failed");
+            err.stdout = "FAIL src/auth.test.ts\nAssertionError: token 无效\n  12 passing\n  1 failing\n";
+            err.stderr = "";
+            throw err;
+        });
+        // 真实 npm 项目路径下才能探测到 package.json —— 用临时脚本验证探测逻辑
+        const fs = require("fs");
+        const os = require("os");
+        const path = require("path");
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-test-"));
+        fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ scripts: { test: "vitest run" } }));
+        const r = (0, agent_supervision_1.runProjectTests)(dir, 5000);
+        (0, vitest_1.expect)(r.ran).toBe(true);
+        (0, vitest_1.expect)(r.pass).toBe(false);
+        (0, vitest_1.expect)(r.failures.length).toBeGreaterThan(0);
+        (0, vitest_1.expect)(r.failures.join(" ")).toContain("token 无效");
+        (0, vitest_1.expect)(r.command).toBe("npm test --silent");
+    });
+    (0, vitest_1.it)("测试通过时 pass=true 且 failures 为空", () => {
+        mockExecSync.mockReturnValue(" 12 passing (3s)");
+        const fs = require("fs");
+        const os = require("os");
+        const path = require("path");
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-test2-"));
+        fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ scripts: { test: "vitest run" } }));
+        const r = (0, agent_supervision_1.runProjectTests)(dir, 5000);
+        (0, vitest_1.expect)(r.ran).toBe(true);
+        (0, vitest_1.expect)(r.pass).toBe(true);
+        (0, vitest_1.expect)(r.failures).toHaveLength(0);
+    });
+    (0, vitest_1.it)("无测试脚本且无 python 文件 → ran=false（调用方跳过该门）", () => {
+        const fs = require("fs");
+        const os = require("os");
+        const path = require("path");
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-test3-"));
+        const r = (0, agent_supervision_1.runProjectTests)(dir, 5000);
+        (0, vitest_1.expect)(r.ran).toBe(false);
+        (0, vitest_1.expect)(mockExecSync).not.toHaveBeenCalled();
+    });
+});

package/dist/execute.js

@@ -225,6 +225,10 @@ async function execute(intent, projectPath, filePath) {
 /** @requires FILE_PATH @produces COMPILE_RESULT */
 /** @requires FILE_PATH @produces COMPILE_RESULT */
 function verifyCompiles(filePath) {
+    // tsc 报错行以「相对 tsconfig 的文件路径」开头（如 `login_flow.ts(7,13):`），
+    // 而调用方可能传绝对路径——两种形态都要匹配，否则编译门会静默漏报。
+    const base = path.basename(filePath);
+    const isMatch = (l) => l.includes(filePath) || l.startsWith(base + "(") || l.startsWith(base + ":");
     try {
         const { execSync } = require("child_process");
         const result = execSync(`npx tsc --noEmit --project tsconfig.json --pretty false 2>&1`, {
@@ -233,13 +237,13 @@ function verifyCompiles(filePath) {
             stdio: "pipe",
         });
         // tsc exits 0, check if our file is mentioned in output anyway (unlikely but safe)
-        const lines = result.split("\n").filter((l) => l.includes(filePath));
+        const lines = result.split("\n").filter(isMatch);
         return { pass: lines.length === 0, errors: lines };
     }
     catch (e) {
         // tsc exits non-zero — parse stderr/stdout for our file's errors
         const output = (e.stdout || "") + (e.stderr || "");
-        const lines = output.split("\n").filter((l) => l.includes(filePath));
+        const lines = output.split("\n").filter(isMatch);
         return { pass: lines.length === 0, errors: lines };
     }
 }

package/dist/extract-ir.js

@@ -121,8 +121,10 @@ function parseProtocolFromJSDoc(node) {
                 const preMatch = text.match(/pre_states\s*=\s*\[([^\]]*)\]/);
                 const postMatch = text.match(/post_states\s*=\s*\[([^\]]*)\]/);
                 const invMatch = text.match(/invalidate\s*=\s*\[([^\]]*)\]/);
+                // 非规则注解（如文件头文档正文中的 "@protocol" 字样被 ts-morph 解析为 tag）
+                // → 跳过继续找下一个 @protocol tag，而不是直接放弃
                 if (!preMatch || !postMatch)
-                    return undefined;
+                    continue;
                 const namespace = nsMatch ? nsMatch[1] : undefined;
                 const pre_states = preMatch[1].split(',').map((s) => s.trim().replace(/["']/g, '')).filter(Boolean);
                 const post_states = postMatch[1].split(',').map((s) => s.trim().replace(/["']/g, '')).filter(Boolean);

package/dist/patrol-cli.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Phase 12: Progmune 免疫巡逻 CLI — `progmune patrol`（形态 B 第一版）
+ *
+ * 扫描项目 → trust_check → 违规报告 + 建议补丁（绝不自动合并）。
+ * 支持 --watch 持续监听（文件变更 → 防抖 → 重新巡逻 → 刷新报告）。
+ *
+ * Usage:
+ *   npx ts-node src/patrol-cli.ts --project <dir> [options]
+ *   npm run patrol -- --project <dir> [options]
+ *
+ * Options:
+ *   --project <dir>   目标项目目录（默认 CWD）
+ *   --watch           持续监听模式（文件变更后自动重扫）
+ *   --json            JSON 输出（单次扫描）
+ *   --help, -h
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const agent_patrol_1 = require("./agent-patrol");
+const agent_perception_1 = require("./agent-perception");
+// 在 chdir 到项目目录之前按启动 CWD 加载 .env——
+// trust 引擎内部的 lazy require（语义映射 LLM 回退）发生在 chdir 之后，
+// 若不预载，LLM_API_KEY 不可用，映射降级会导致漏报。
+try {
+    require("dotenv/config");
+}
+catch { /* dotenv 可选 */ }
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+    console.log(`
+Progmune 免疫巡逻 (P4) — 监听/扫描 → trust_check → 报告 + 建议补丁（永不自动合并）
+
+Usage:
+  npx ts-node src/patrol-cli.ts --project <dir> [options]
+  npm run patrol -- --project <dir> [options]
+
+Options:
+  --project <dir>   目标项目目录（默认当前目录）
+  --watch           持续监听模式（源文件变更后自动重扫并刷新报告）
+  --json            JSON 输出（单次扫描）
+  --help, -h        显示帮助
+
+Example:
+  npm run patrol -- --project demo-patrol
+  npm run patrol -- --project demo-patrol --watch
+`);
+    process.exit(0);
+}
+const getFlag = (name) => {
+    const idx = args.indexOf(`--${name}`);
+    return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : undefined;
+};
+const projectPath = path.resolve(getFlag("project") || process.cwd());
+const watch = args.includes("--watch");
+const json = args.includes("--json");
+async function scanOnce(label) {
+    try {
+        const report = await (0, agent_patrol_1.runPatrol)(projectPath);
+        const reportFile = (0, agent_patrol_1.writePatrolReport)(report, projectPath);
+        if (json && !watch) {
+            console.log(JSON.stringify(report, null, 2));
+        }
+        else {
+            console.log(`[${label}] ` + (0, agent_patrol_1.formatPatrolTerminal)(report).replace(/\n/g, "\n  "));
+            console.log(`   报告: ${reportFile}`);
+        }
+    }
+    catch (e) {
+        console.error(`❌ 巡逻失败: ${e?.message || e}`);
+    }
+}
+async function main() {
+    process.chdir(projectPath);
+    console.log(`🛡️  Progmune 免疫巡逻 (P4) — 项目: ${projectPath}${watch ? "（持续监听）" : ""}`);
+    if (!watch) {
+        await scanOnce("扫描");
+        process.exit(0);
+    }
+    // 持续监听：RepoWatcher 防抖触发重扫
+    await scanOnce("首次");
+    let scanning = false;
+    const watcher = new agent_perception_1.RepoWatcher(projectPath, async (file) => {
+        if (scanning)
+            return; // 扫描期间的新变更合并进下一轮
+        scanning = true;
+        console.log(`🔍 检测到变更: ${file}`);
+        await scanOnce("重扫");
+        scanning = false;
+    }, 1500);
+    watcher.start();
+    console.log("👂 监听中（Ctrl+C 退出）…");
+}
+main().catch((e) => {
+    console.error(`❌ 巡逻 CLI 异常: ${e?.message || e}`);
+    process.exit(1);
+});

package/dist/planner-prompts.js

@@ -40,6 +40,9 @@ exports.RETRY_HINT = `输出格式：紧凑 JSON 数组 [{"f":"函数名","to":"
 // ── Formatters ──
 /** Build a compact function list with parameter examples for LLM precision. */
 function buildCompactFuncList(funcs, allFuncs) {
+    // 语义 marker（__progmune_*，提取器注入供规则消费）不是真实可调用函数——
+    // 不出现在 LLM 可见函数列表中，防止被生成成真实调用导致编译失败
+    funcs = funcs.filter((f) => !String(f.name || "").startsWith("__progmune_"));
     // Example values for each type — helps LLM fill meaningful args
     function exampleValue(type, paramName) {
         const t = (type || "any").replace(/\[\]$/, "").toLowerCase();

package/dist/planner.js

@@ -900,6 +900,8 @@ ${planner_prompts_1.RETRY_HINT}
                 : await (0, llm_1.generate)(`你是程序合成助手。\n\n${currentPrompt}`);
         }
         catch (e) {
+            // 铁律：失败原因必须可见（不许静默绕过）——LLM 异常记录后继续重试/降级
+            console.error(`⚠️ LLM 调用失败 (attempt ${r + 1}/${maxRetries}): ${e?.message || e}`);
             continue;
         }
         if (!text)

package/dist/trust/engine.js

@@ -704,12 +704,53 @@ async function collectProtocolViolations(ctx, callGraph) {
     let ssgMatchedCalls = 0;
     let ssgViolationCount = 0;
     try {
+        // ── P4.5 校准：TS/JS 项目在 ir.json 缺失时先提取 IR ──
+        // 序列必须来自「函数体内真实调用」而非「文件内函数声明名单」——
+        // 声明顺序 ≠ 执行顺序：正则扫描会把声明当调用（auth.ts 误报），
+        // 也会因调用数不足阈值漏掉单调用违规文件（bad_flow 漏报）。
+        if (!ctx.language || ctx.language === "typescript" || ctx.language === "javascript") {
+            try {
+                const fs = require("fs");
+                if (!fs.existsSync(path.join(ctx.projectPath, "ir.json"))) {
+                    const { extractIR } = require("../extract-ir");
+                    const ir = extractIR(ctx.projectPath);
+                    fs.writeFileSync(path.join(ctx.projectPath, "ir.json"), JSON.stringify(ir, null, 2));
+                }
+            }
+            catch { /* best-effort — 回退正则扫描 */ }
+        }
         // ── Phase 1-5 Semantic Pipeline ──
         const callSequences = extractCallSequencesFromProject(ctx.projectPath, ctx.language);
         const flaggedCount = { value: 0 };
         const cleanCount = { value: 0 };
         // ── SSG State Machine: load protocol rules once ──
         protocolRulesData = (0, ssg_bridge_1.loadProtocolRules)(ctx.projectPath);
+        // ── P4.5: 合并项目 IR 注解协议（IR 优先，缺 namespace 继承内置 JSON） ──
+        // 内置 protocols.json 的规则是通用弱约束（如 generate_jwt pre=[]），
+        // 项目文件里的 @protocol 注解才是项目真实协议（如 pre=[PASSWORD_VERIFIED]）。
+        // planner 已用此合并语义，trust 引擎需对齐，否则项目级前置约束不生效。
+        if (protocolRulesData) {
+            try {
+                const fs = require("fs");
+                const irPath = path.join(ctx.projectPath, "ir.json");
+                if (fs.existsSync(irPath)) {
+                    const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+                    if (Array.isArray(ir)) {
+                        for (const f of ir) {
+                            if (!f.protocol)
+                                continue;
+                            const protocol = { ...f.protocol };
+                            const existing = protocolRulesData.rules.get(String(f.name));
+                            if (existing?.namespace && !protocol.namespace) {
+                                protocol.namespace = existing.namespace;
+                            }
+                            protocolRulesData.rules.set(String(f.name), protocol);
+                        }
+                    }
+                }
+            }
+            catch { /* best-effort */ }
+        }
         for (const seq of callSequences) {
             try {
                 const semantic = await (0, api_semantic_mapper_1.mapSequenceToSemanticWithLLM)(seq.calls);
@@ -864,6 +905,46 @@ async function collectProtocolViolations(ctx, callGraph) {
     };
 }
 function extractCallSequencesFromProject(projectPath, language) {
+    // P4.5: 优先 IR 精确序列（每个函数体内的真实调用，从各自入口验证）
+    const irSequences = extractCallSequencesFromIR(projectPath);
+    if (irSequences.length > 0)
+        return irSequences;
+    // 回退：正则扫描（C 等无 IR 语言保持原行为）
+    return extractCallSequencesRegex(projectPath, language);
+}
+/**
+ * P4.5: 从 ir.json 构建 per-function 调用序列。
+ * 每个函数体内的 calls[] 是一条独立序列（从协议初始状态起步验证）——
+ * 函数声明名单不再是验证对象；语义 marker（__progmune_*）供规则消费，不作真实调用。
+ */
+function extractCallSequencesFromIR(projectPath) {
+    try {
+        const fs = require("fs");
+        const irPath = path.join(projectPath, "ir.json");
+        if (!fs.existsSync(irPath))
+            return [];
+        const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+        if (!Array.isArray(ir))
+            return [];
+        const sequences = [];
+        for (const f of ir) {
+            const calls = (f.calls || []).filter((c) => typeof c === "string" && !c.startsWith("__progmune_"));
+            if (calls.length === 0)
+                continue;
+            sequences.push({
+                calls,
+                file: String(f.file || ""),
+                function: String(f.name || "unknown"),
+            });
+        }
+        return sequences;
+    }
+    catch {
+        return [];
+    }
+}
+/** 正则扫描回退路径（原实现）：按文件扫调用样 token，≥4 才成序列。 */
+function extractCallSequencesRegex(projectPath, language) {
     const sequences = [];
     try {
         const fs = require("fs");

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "progmune-runtime",
-  "version": "3.3.7",
+  "version": "3.4.0",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
     "protocols.json",
+    "CHANGELOG.md",
     "docs/Progmune_项目全解.html",
     "docs/Progmune_投资人白皮书_v2.0.html"
   ],
@@ -30,6 +31,8 @@
     "governance:json": "node dist/audit/cli.js --all --json",
     "governance:md": "node dist/audit/cli.js --all --markdown",
     "certify": "node dist/certify.js",
+    "agent": "node dist/agent-cli.js",
+    "patrol": "node dist/patrol-cli.js",
     "certify:html": "node dist/certify-html.js",
     "policy": "node dist/policy/cli.js check",
     "precision": "node dist/multi-repo-precision.js",