progmune-runtime 3.3.8 → 3.4.1

package/dist/ssg-validator.js

@@ -308,10 +308,26 @@ function checkLedgerConsistency(ledger, namespaceInitialStates = new Map([["_glo
             running.set(ns, new Set());
         }
     }
-    // Normalize a snapshot: ensure all known namespaces are present
+    // Normalize a snapshot: 只比较 ledger 中实际出现过的命名空间。
+    // 历史 session 只记录其触及的命名空间（protocol-registry 包目录回退修复前，
+    // 无 protocols.json 的 cwd 下 nsInit 退化为仅 _global）——用全量 nsInit
+    // 重建时未记录的 ns 不应参与比较，否则旧数据 before-consistency 全量误报。
+    // 更严格一步：只记录"有过非空快照"的 ns——早期 session 对 file/db 等
+    // 记录空数组（键存在但无信息），空数组不携带可比较的状态信息。
+    const recordedNamespaces = new Set();
+    for (const t of ledger) {
+        for (const [ns, states] of Object.entries(t.statesBefore)) {
+            if ((states || []).length > 0)
+                recordedNamespaces.add(ns);
+        }
+        for (const [ns, states] of Object.entries(t.statesAfter)) {
+            if ((states || []).length > 0)
+                recordedNamespaces.add(ns);
+        }
+    }
     function normalizeSnap(snap) {
         const out = {};
-        for (const ns of allNamespaces) {
+        for (const ns of recordedNamespaces) {
             out[ns] = [...(snap[ns] || [])].sort();
         }
         return out;

package/dist/trust/engine.js

@@ -704,12 +704,53 @@ async function collectProtocolViolations(ctx, callGraph) {
     let ssgMatchedCalls = 0;
     let ssgViolationCount = 0;
     try {
+        // ── P4.5 校准：TS/JS 项目在 ir.json 缺失时先提取 IR ──
+        // 序列必须来自「函数体内真实调用」而非「文件内函数声明名单」——
+        // 声明顺序 ≠ 执行顺序：正则扫描会把声明当调用（auth.ts 误报），
+        // 也会因调用数不足阈值漏掉单调用违规文件（bad_flow 漏报）。
+        if (!ctx.language || ctx.language === "typescript" || ctx.language === "javascript") {
+            try {
+                const fs = require("fs");
+                if (!fs.existsSync(path.join(ctx.projectPath, "ir.json"))) {
+                    const { extractIR } = require("../extract-ir");
+                    const ir = extractIR(ctx.projectPath);
+                    fs.writeFileSync(path.join(ctx.projectPath, "ir.json"), JSON.stringify(ir, null, 2));
+                }
+            }
+            catch { /* best-effort — 回退正则扫描 */ }
+        }
         // ── Phase 1-5 Semantic Pipeline ──
         const callSequences = extractCallSequencesFromProject(ctx.projectPath, ctx.language);
         const flaggedCount = { value: 0 };
         const cleanCount = { value: 0 };
         // ── SSG State Machine: load protocol rules once ──
         protocolRulesData = (0, ssg_bridge_1.loadProtocolRules)(ctx.projectPath);
+        // ── P4.5: 合并项目 IR 注解协议（IR 优先，缺 namespace 继承内置 JSON） ──
+        // 内置 protocols.json 的规则是通用弱约束（如 generate_jwt pre=[]），
+        // 项目文件里的 @protocol 注解才是项目真实协议（如 pre=[PASSWORD_VERIFIED]）。
+        // planner 已用此合并语义，trust 引擎需对齐，否则项目级前置约束不生效。
+        if (protocolRulesData) {
+            try {
+                const fs = require("fs");
+                const irPath = path.join(ctx.projectPath, "ir.json");
+                if (fs.existsSync(irPath)) {
+                    const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+                    if (Array.isArray(ir)) {
+                        for (const f of ir) {
+                            if (!f.protocol)
+                                continue;
+                            const protocol = { ...f.protocol };
+                            const existing = protocolRulesData.rules.get(String(f.name));
+                            if (existing?.namespace && !protocol.namespace) {
+                                protocol.namespace = existing.namespace;
+                            }
+                            protocolRulesData.rules.set(String(f.name), protocol);
+                        }
+                    }
+                }
+            }
+            catch { /* best-effort */ }
+        }
         for (const seq of callSequences) {
             try {
                 const semantic = await (0, api_semantic_mapper_1.mapSequenceToSemanticWithLLM)(seq.calls);
@@ -864,6 +905,46 @@ async function collectProtocolViolations(ctx, callGraph) {
     };
 }
 function extractCallSequencesFromProject(projectPath, language) {
+    // P4.5: 优先 IR 精确序列（每个函数体内的真实调用，从各自入口验证）
+    const irSequences = extractCallSequencesFromIR(projectPath);
+    if (irSequences.length > 0)
+        return irSequences;
+    // 回退：正则扫描（C 等无 IR 语言保持原行为）
+    return extractCallSequencesRegex(projectPath, language);
+}
+/**
+ * P4.5: 从 ir.json 构建 per-function 调用序列。
+ * 每个函数体内的 calls[] 是一条独立序列（从协议初始状态起步验证）——
+ * 函数声明名单不再是验证对象；语义 marker（__progmune_*）供规则消费，不作真实调用。
+ */
+function extractCallSequencesFromIR(projectPath) {
+    try {
+        const fs = require("fs");
+        const irPath = path.join(projectPath, "ir.json");
+        if (!fs.existsSync(irPath))
+            return [];
+        const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+        if (!Array.isArray(ir))
+            return [];
+        const sequences = [];
+        for (const f of ir) {
+            const calls = (f.calls || []).filter((c) => typeof c === "string" && !c.startsWith("__progmune_"));
+            if (calls.length === 0)
+                continue;
+            sequences.push({
+                calls,
+                file: String(f.file || ""),
+                function: String(f.name || "unknown"),
+            });
+        }
+        return sequences;
+    }
+    catch {
+        return [];
+    }
+}
+/** 正则扫描回退路径（原实现）：按文件扫调用样 token，≥4 才成序列。 */
+function extractCallSequencesRegex(projectPath, language) {
     const sequences = [];
     try {
         const fs = require("fs");

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "progmune-runtime",
-  "version": "3.3.8",
+  "version": "3.4.1",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
     "protocols.json",
+    "CHANGELOG.md",
     "docs/Progmune_项目全解.html",
     "docs/Progmune_投资人白皮书_v2.0.html"
   ],
@@ -30,6 +31,8 @@
     "governance:json": "node dist/audit/cli.js --all --json",
     "governance:md": "node dist/audit/cli.js --all --markdown",
     "certify": "node dist/certify.js",
+    "agent": "node dist/agent-cli.js",
+    "patrol": "node dist/patrol-cli.js",
     "certify:html": "node dist/certify-html.js",
     "policy": "node dist/policy/cli.js check",
     "precision": "node dist/multi-repo-precision.js",