progmune-runtime 3.3.8 → 3.4.0

package/dist/patrol-cli.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Phase 12: Progmune 免疫巡逻 CLI — `progmune patrol`（形态 B 第一版）
+ *
+ * 扫描项目 → trust_check → 违规报告 + 建议补丁（绝不自动合并）。
+ * 支持 --watch 持续监听（文件变更 → 防抖 → 重新巡逻 → 刷新报告）。
+ *
+ * Usage:
+ *   npx ts-node src/patrol-cli.ts --project <dir> [options]
+ *   npm run patrol -- --project <dir> [options]
+ *
+ * Options:
+ *   --project <dir>   目标项目目录（默认 CWD）
+ *   --watch           持续监听模式（文件变更后自动重扫）
+ *   --json            JSON 输出（单次扫描）
+ *   --help, -h
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const agent_patrol_1 = require("./agent-patrol");
+const agent_perception_1 = require("./agent-perception");
+// 在 chdir 到项目目录之前按启动 CWD 加载 .env——
+// trust 引擎内部的 lazy require（语义映射 LLM 回退）发生在 chdir 之后，
+// 若不预载，LLM_API_KEY 不可用，映射降级会导致漏报。
+try {
+    require("dotenv/config");
+}
+catch { /* dotenv 可选 */ }
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+    console.log(`
+Progmune 免疫巡逻 (P4) — 监听/扫描 → trust_check → 报告 + 建议补丁（永不自动合并）
+
+Usage:
+  npx ts-node src/patrol-cli.ts --project <dir> [options]
+  npm run patrol -- --project <dir> [options]
+
+Options:
+  --project <dir>   目标项目目录（默认当前目录）
+  --watch           持续监听模式（源文件变更后自动重扫并刷新报告）
+  --json            JSON 输出（单次扫描）
+  --help, -h        显示帮助
+
+Example:
+  npm run patrol -- --project demo-patrol
+  npm run patrol -- --project demo-patrol --watch
+`);
+    process.exit(0);
+}
+const getFlag = (name) => {
+    const idx = args.indexOf(`--${name}`);
+    return idx >= 0 && idx + 1 < args.length ? args[idx + 1] : undefined;
+};
+const projectPath = path.resolve(getFlag("project") || process.cwd());
+const watch = args.includes("--watch");
+const json = args.includes("--json");
+async function scanOnce(label) {
+    try {
+        const report = await (0, agent_patrol_1.runPatrol)(projectPath);
+        const reportFile = (0, agent_patrol_1.writePatrolReport)(report, projectPath);
+        if (json && !watch) {
+            console.log(JSON.stringify(report, null, 2));
+        }
+        else {
+            console.log(`[${label}] ` + (0, agent_patrol_1.formatPatrolTerminal)(report).replace(/\n/g, "\n  "));
+            console.log(`   报告: ${reportFile}`);
+        }
+    }
+    catch (e) {
+        console.error(`❌ 巡逻失败: ${e?.message || e}`);
+    }
+}
+async function main() {
+    process.chdir(projectPath);
+    console.log(`🛡️  Progmune 免疫巡逻 (P4) — 项目: ${projectPath}${watch ? "（持续监听）" : ""}`);
+    if (!watch) {
+        await scanOnce("扫描");
+        process.exit(0);
+    }
+    // 持续监听：RepoWatcher 防抖触发重扫
+    await scanOnce("首次");
+    let scanning = false;
+    const watcher = new agent_perception_1.RepoWatcher(projectPath, async (file) => {
+        if (scanning)
+            return; // 扫描期间的新变更合并进下一轮
+        scanning = true;
+        console.log(`🔍 检测到变更: ${file}`);
+        await scanOnce("重扫");
+        scanning = false;
+    }, 1500);
+    watcher.start();
+    console.log("👂 监听中（Ctrl+C 退出）…");
+}
+main().catch((e) => {
+    console.error(`❌ 巡逻 CLI 异常: ${e?.message || e}`);
+    process.exit(1);
+});

package/dist/planner-prompts.js

@@ -40,6 +40,9 @@ exports.RETRY_HINT = `输出格式：紧凑 JSON 数组 [{"f":"函数名","to":"
 // ── Formatters ──
 /** Build a compact function list with parameter examples for LLM precision. */
 function buildCompactFuncList(funcs, allFuncs) {
+    // 语义 marker（__progmune_*，提取器注入供规则消费）不是真实可调用函数——
+    // 不出现在 LLM 可见函数列表中，防止被生成成真实调用导致编译失败
+    funcs = funcs.filter((f) => !String(f.name || "").startsWith("__progmune_"));
     // Example values for each type — helps LLM fill meaningful args
     function exampleValue(type, paramName) {
         const t = (type || "any").replace(/\[\]$/, "").toLowerCase();

package/dist/planner.js

@@ -900,6 +900,8 @@ ${planner_prompts_1.RETRY_HINT}
                 : await (0, llm_1.generate)(`你是程序合成助手。\n\n${currentPrompt}`);
         }
         catch (e) {
+            // 铁律：失败原因必须可见（不许静默绕过）——LLM 异常记录后继续重试/降级
+            console.error(`⚠️ LLM 调用失败 (attempt ${r + 1}/${maxRetries}): ${e?.message || e}`);
             continue;
         }
         if (!text)

package/dist/trust/engine.js

@@ -704,12 +704,53 @@ async function collectProtocolViolations(ctx, callGraph) {
     let ssgMatchedCalls = 0;
     let ssgViolationCount = 0;
     try {
+        // ── P4.5 校准：TS/JS 项目在 ir.json 缺失时先提取 IR ──
+        // 序列必须来自「函数体内真实调用」而非「文件内函数声明名单」——
+        // 声明顺序 ≠ 执行顺序：正则扫描会把声明当调用（auth.ts 误报），
+        // 也会因调用数不足阈值漏掉单调用违规文件（bad_flow 漏报）。
+        if (!ctx.language || ctx.language === "typescript" || ctx.language === "javascript") {
+            try {
+                const fs = require("fs");
+                if (!fs.existsSync(path.join(ctx.projectPath, "ir.json"))) {
+                    const { extractIR } = require("../extract-ir");
+                    const ir = extractIR(ctx.projectPath);
+                    fs.writeFileSync(path.join(ctx.projectPath, "ir.json"), JSON.stringify(ir, null, 2));
+                }
+            }
+            catch { /* best-effort — 回退正则扫描 */ }
+        }
         // ── Phase 1-5 Semantic Pipeline ──
         const callSequences = extractCallSequencesFromProject(ctx.projectPath, ctx.language);
         const flaggedCount = { value: 0 };
         const cleanCount = { value: 0 };
         // ── SSG State Machine: load protocol rules once ──
         protocolRulesData = (0, ssg_bridge_1.loadProtocolRules)(ctx.projectPath);
+        // ── P4.5: 合并项目 IR 注解协议（IR 优先，缺 namespace 继承内置 JSON） ──
+        // 内置 protocols.json 的规则是通用弱约束（如 generate_jwt pre=[]），
+        // 项目文件里的 @protocol 注解才是项目真实协议（如 pre=[PASSWORD_VERIFIED]）。
+        // planner 已用此合并语义，trust 引擎需对齐，否则项目级前置约束不生效。
+        if (protocolRulesData) {
+            try {
+                const fs = require("fs");
+                const irPath = path.join(ctx.projectPath, "ir.json");
+                if (fs.existsSync(irPath)) {
+                    const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+                    if (Array.isArray(ir)) {
+                        for (const f of ir) {
+                            if (!f.protocol)
+                                continue;
+                            const protocol = { ...f.protocol };
+                            const existing = protocolRulesData.rules.get(String(f.name));
+                            if (existing?.namespace && !protocol.namespace) {
+                                protocol.namespace = existing.namespace;
+                            }
+                            protocolRulesData.rules.set(String(f.name), protocol);
+                        }
+                    }
+                }
+            }
+            catch { /* best-effort */ }
+        }
         for (const seq of callSequences) {
             try {
                 const semantic = await (0, api_semantic_mapper_1.mapSequenceToSemanticWithLLM)(seq.calls);
@@ -864,6 +905,46 @@ async function collectProtocolViolations(ctx, callGraph) {
     };
 }
 function extractCallSequencesFromProject(projectPath, language) {
+    // P4.5: 优先 IR 精确序列（每个函数体内的真实调用，从各自入口验证）
+    const irSequences = extractCallSequencesFromIR(projectPath);
+    if (irSequences.length > 0)
+        return irSequences;
+    // 回退：正则扫描（C 等无 IR 语言保持原行为）
+    return extractCallSequencesRegex(projectPath, language);
+}
+/**
+ * P4.5: 从 ir.json 构建 per-function 调用序列。
+ * 每个函数体内的 calls[] 是一条独立序列（从协议初始状态起步验证）——
+ * 函数声明名单不再是验证对象；语义 marker（__progmune_*）供规则消费，不作真实调用。
+ */
+function extractCallSequencesFromIR(projectPath) {
+    try {
+        const fs = require("fs");
+        const irPath = path.join(projectPath, "ir.json");
+        if (!fs.existsSync(irPath))
+            return [];
+        const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+        if (!Array.isArray(ir))
+            return [];
+        const sequences = [];
+        for (const f of ir) {
+            const calls = (f.calls || []).filter((c) => typeof c === "string" && !c.startsWith("__progmune_"));
+            if (calls.length === 0)
+                continue;
+            sequences.push({
+                calls,
+                file: String(f.file || ""),
+                function: String(f.name || "unknown"),
+            });
+        }
+        return sequences;
+    }
+    catch {
+        return [];
+    }
+}
+/** 正则扫描回退路径（原实现）：按文件扫调用样 token，≥4 才成序列。 */
+function extractCallSequencesRegex(projectPath, language) {
     const sequences = [];
     try {
         const fs = require("fs");

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "progmune-runtime",
-  "version": "3.3.8",
+  "version": "3.4.0",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
     "protocols.json",
+    "CHANGELOG.md",
     "docs/Progmune_项目全解.html",
     "docs/Progmune_投资人白皮书_v2.0.html"
   ],
@@ -30,6 +31,8 @@
     "governance:json": "node dist/audit/cli.js --all --json",
     "governance:md": "node dist/audit/cli.js --all --markdown",
     "certify": "node dist/certify.js",
+    "agent": "node dist/agent-cli.js",
+    "patrol": "node dist/patrol-cli.js",
     "certify:html": "node dist/certify-html.js",
     "policy": "node dist/policy/cli.js check",
     "precision": "node dist/multi-repo-precision.js",