progmune-runtime 3.7.10 → 3.7.11

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [3.7.11] — 2026-09-01
+
+### NestJS 补全——框架适配 8/13
+
+- **三缺口补全**（`src/frameworks/nestjs-detector.ts`）：
+  ①**全局 APP_GUARD 守卫识别**——@Module providers 的 `{ provide: APP_GUARD, useClass: X }`（装饰器参数与类属性两种形态）→ 全局认证守卫存在时 mutation 路由不再误报；
+  ②**@Public()/@SkipAuth()/@AllowAnon() 豁免装饰器**（类级+方法级）——全局守卫模式下的公开路由标记；**显式绕过全局守卫的 mutation 路由 → NESTJS_NO_AUTH**（消息注明绕过的是哪个全局守卫）；
+  ③**守卫名认证分类**——ThrottlerGuard/RateLimit/Logger 等非认证守卫不再算认证（限流≠认证，实测误报源）
+- **引擎接线升级**：collectNestJSViolations 从 per-file 切 **项目级一次装载**（analyzeNestJSProject）——全局守卫与 @Public 需要跨文件上下文，per-file 分析无法识别全局守卫（系统性误报根因）；coverage.filesScanned 口径改为分析单元=项目
+- **合成金标**（`generate-projects-nestjs.ts` + `scan-protocol-nestjs.ts`）：6 项目（类级守卫/全局 APP_GUARD+@Public login/无守卫/显式绕过/ThrottlerGuard 非认证/敏感 GET 公开）——**TP 12 / FP 0 / FN 0 → P=R=100%**
+- **验证**：6 个新单测（含 @Public login 在全局守卫下不报）；引擎冒烟 N2 APPROVED 87（全局守卫正确识别）、N4 BLOCKED（显式绕过 critical 拦截）；全套件 166/166；Python 盲测 v1.2 64 零漂移；C 演示不变
+- **文档**：NestJS ⚠️ 部分 → ✅ 结构分析（README 双语/覆盖矩阵双语/CLAUDE.md/落地页「8/13 专用检测器」口径）
+
 ## [3.7.10] — 2026-09-01
 
 ### 安装态 Python 全链路修复（npm 包正确性）

package/README.md

@@ -108,7 +108,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 7/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) have dedicated detectors; NestJS is partial. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 8/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) and NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +234,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS partial (7/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (8/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -108,7 +108,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：7/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）有专用检测器；NestJS 部分支持，Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：8/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）与 NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +233,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS 部分（7/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（8/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/frameworks/index.js

@@ -12,7 +12,7 @@
  * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -34,6 +34,9 @@ Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: fu
 var nextjs_detector_1 = require("./nextjs-detector");
 Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
 Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
+var nestjs_detector_1 = require("./nestjs-detector");
+Object.defineProperty(exports, "analyzeNestJSProject", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSProject; } });
+Object.defineProperty(exports, "analyzeNestJSFile", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSFile; } });
 // ── Framework Version-Aware Governance ──
 var version_awareness_1 = require("./version-awareness");
 Object.defineProperty(exports, "detectFrameworks", { enumerable: true, get: function () { return version_awareness_1.detectFrameworks; } });

package/dist/frameworks/nestjs-detector.js

@@ -36,14 +36,34 @@ function analyzeNestJSProject(projectRoot) {
             project.addSourceFilesAtPaths(`${projectRoot}/**/*.ts`);
         }
         catch {
-            return { controllers: [], routes: [], issues: [] };
+            return { controllers: [], routes: [], issues: [], globalAuthGuards: [] };
         }
     }
     const analysis = {
         controllers: [],
         routes: [],
         issues: [],
+        globalAuthGuards: [],
     };
+    // ── 第一遍：全局守卫（@Module providers 里的 APP_GUARD）──
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        if (/\.(test|spec)\.ts$/.test(file.getFilePath()))
+            continue;
+        for (const cls of file.getClasses()) {
+            const moduleDec = cls.getDecorator("Module");
+            if (!moduleDec)
+                continue;
+            const guardNames = extractAppGuardNames(moduleDec, cls);
+            for (const name of guardNames) {
+                if (isAuthGuardName(name) && !analysis.globalAuthGuards.includes(name)) {
+                    analysis.globalAuthGuards.push(name);
+                }
+            }
+        }
+    }
+    const hasGlobalAuthGuard = analysis.globalAuthGuards.length > 0;
     for (const file of project.getSourceFiles()) {
         // Skip node_modules and test files
         if (file.getFilePath().includes("node_modules"))
@@ -59,6 +79,9 @@ function analyzeNestJSProject(projectRoot) {
             const basePath = getStringArg(ctrlDec, 0) || "";
             const classGuards = extractGuardNames(cls.getDecorator("UseGuards"));
             const classPipes = extractGuardNames(cls.getDecorator("UsePipes"));
+            const classPublic = cls.getDecorator("Public") !== undefined
+                || cls.getDecorator("SkipAuth") !== undefined
+                || cls.getDecorator("AllowAnon") !== undefined;
             for (const method of cls.getMethods()) {
                 const httpMethod = getHttpMethod(method);
                 if (!httpMethod)
@@ -70,29 +93,41 @@ function analyzeNestJSProject(projectRoot) {
                 const methodPipes = extractGuardNames(method.getDecorator("UsePipes"));
                 const guards = methodGuards.length > 0 ? methodGuards : classGuards;
                 const pipes = methodPipes.length > 0 ? methodPipes : classPipes;
+                const isPublicDecorated = classPublic
+                    || method.getDecorator("Public") !== undefined
+                    || method.getDecorator("SkipAuth") !== undefined
+                    || method.getDecorator("AllowAnon") !== undefined;
+                // 认证守卫 = 认证名分类后的守卫（ThrottlerGuard 等限流守卫不算认证）
+                const authGuards = guards.filter(isAuthGuardName);
                 const route = {
                     method: httpMethod,
                     path: fullPath,
                     controller: controllerName,
                     handler: method.getName() || "unknown",
-                    hasAuthGuard: guards.length > 0,
+                    hasAuthGuard: authGuards.length > 0,
                     hasValidationPipe: pipes.length > 0,
                     guards,
                     pipes,
+                    isPublicDecorated,
                 };
                 analysis.routes.push(route);
+                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免）
+                const protectedByGlobal = hasGlobalAuthGuard && !isPublicDecorated;
                 // ── Security Checks ──
                 // POST/PUT/DELETE without auth guard
                 // Skip intentionally public routes (login, register, health, etc.)
                 if (["POST", "PUT", "DELETE", "PATCH"].includes(httpMethod) && !isPublicRoute(fullPath)) {
-                    if (!route.hasAuthGuard) {
+                    if (!route.hasAuthGuard && !protectedByGlobal) {
                         analysis.issues.push({
                             type: "NESTJS_NO_AUTH",
                             severity: "critical",
                             route: `${httpMethod} ${fullPath}`,
                             controller: controllerName,
-                            message: `Mutation route ${httpMethod} ${fullPath} has no @UseGuards. Anyone can call it.`,
-                            fix: `Add @UseGuards(AuthGuard) to the method or controller class.`,
+                            message: `Mutation route ${httpMethod} ${fullPath} has no auth guard and ` +
+                                (hasGlobalAuthGuard
+                                    ? `is explicitly marked public — it bypasses the global ${analysis.globalAuthGuards.join("/")}.`
+                                    : `no global APP_GUARD protects the app. Anyone can call it.`),
+                            fix: `Add @UseGuards(AuthGuard) to the method or controller class, or remove the @Public marker.`,
                         });
                     }
                     if (!route.hasValidationPipe) {
@@ -109,13 +144,14 @@ function analyzeNestJSProject(projectRoot) {
                 // Sensitive GET routes without auth
                 if (httpMethod === "GET") {
                     const sensitiveTerms = ["admin", "private", "secret", "manage"];
-                    if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t)) && !route.hasAuthGuard) {
+                    if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t))
+                        && !route.hasAuthGuard && !protectedByGlobal) {
                         analysis.issues.push({
                             type: "NESTJS_SENSITIVE_PUBLIC",
                             severity: "high",
                             route: `${httpMethod} ${fullPath}`,
                             controller: controllerName,
-                            message: `Sensitive GET route ${fullPath} is publicly accessible without @UseGuards.`,
+                            message: `Sensitive GET route ${fullPath} is publicly accessible without auth protection.`,
                             fix: `Add @UseGuards(AuthGuard) to protect this route.`,
                         });
                     }
@@ -126,6 +162,60 @@ function analyzeNestJSProject(projectRoot) {
     return analysis;
 }
 // ── Helpers ──
+/**
+ * 守卫名认证分类：auth/jwt/session/permission/role/access 等为认证守卫；
+ * throttler/rate/logger 等非认证守卫不算（限流≠认证——实测误报源）。
+ */
+function isAuthGuardName(name) {
+    const lower = name.toLowerCase();
+    if (/throttler|rate.?limit|logger|logging|cache/.test(lower))
+        return false;
+    return /auth|jwt|session|permission|role|access|apikey|api_key|token|login|passport/.test(lower);
+}
+/**
+ * 从 @Module 装饰器的 providers 提取 APP_GUARD 类名：
+ *   providers: [{ provide: APP_GUARD, useClass: AuthGuard }]
+ * 支持装饰器参数对象字面量与类属性 providers 两种形态。
+ */
+function extractAppGuardNames(moduleDec, cls) {
+    const names = [];
+    const scanProviders = (arg) => {
+        if (!arg)
+            return;
+        // @Module({ providers: [...] })
+        const obj = arg.asKind(ts_morph_1.SyntaxKind.ObjectLiteralExpression);
+        if (obj) {
+            const providersProp = obj.getProperty("providers");
+            if (providersProp) {
+                const initializer = providersProp.getInitializer?.();
+                if (initializer && initializer.asKind(ts_morph_1.SyntaxKind.ArrayLiteralExpression)) {
+                    for (const el of initializer.getElements()) {
+                        const elObj = el.asKind(ts_morph_1.SyntaxKind.ObjectLiteralExpression);
+                        if (!elObj)
+                            continue;
+                        const provideProp = elObj.getProperty("provide");
+                        const useClassProp = elObj.getProperty("useClass");
+                        const provideName = provideProp?.getInitializer?.()?.getText?.();
+                        const useClassName = useClassProp?.getInitializer?.()?.getText?.();
+                        if (provideName === "APP_GUARD" && useClassName) {
+                            names.push(useClassName);
+                        }
+                    }
+                }
+            }
+        }
+    };
+    // 装饰器参数形态
+    const decArg = moduleDec.getArguments()[0];
+    scanProviders(decArg);
+    // 类属性形态：providers = [...]
+    for (const prop of cls.getProperties()) {
+        if (prop.getName() === "providers") {
+            scanProviders(prop.getInitializer());
+        }
+    }
+    return names;
+}
 /** Check if a route is intentionally public (login, register, health, etc.). */
 function isPublicRoute(path) {
     // Normalize: ensure leading slash for consistent matching
@@ -200,6 +290,7 @@ function analyzeNestJSFile(filePath) {
         controllers: [],
         routes: [],
         issues: [],
+        globalAuthGuards: [], // 单文件分析无全局守卫上下文（项目级请用 analyzeNestJSProject）
     };
     for (const file of project.getSourceFiles()) {
         for (const cls of file.getClasses()) {
@@ -227,10 +318,11 @@ function analyzeNestJSFile(filePath) {
                     path: fullPath,
                     controller: controllerName,
                     handler: method.getName() || "unknown",
-                    hasAuthGuard: guards.length > 0,
+                    hasAuthGuard: guards.filter(isAuthGuardName).length > 0,
                     hasValidationPipe: pipes.length > 0,
                     guards,
                     pipes,
+                    isPublicDecorated: false, // 单文件分析不解析 @Public（项目级用 analyzeNestJSProject）
                 };
                 analysis.routes.push(route);
                 // Security checks

package/dist/frameworks/nestjs-detector.test.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * nestjs-detector.test.ts — NestJS 补全轮回归（文件系统夹具，临时目录）
+ *
+ * 锁定三缺口修复：全局 APP_GUARD 识别、@Public 豁免、守卫名认证分类
+ * （ThrottlerGuard ≠ 认证）。
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const nestjs_detector_1 = require("./nestjs-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "nestjs-det-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function write(rel, content) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+}
+const TSCONFIG = `{
+  "compilerOptions": { "target": "ES2020", "module": "commonjs",
+    "experimentalDecorators": true, "strict": false, "skipLibCheck": true },
+  "include": ["src/**/*"]
+}`;
+const GUARD = `
+import { CanActivate } from "@nestjs/common";
+export class AuthGuard implements CanActivate { canActivate(): boolean { return true; } }
+`;
+const CONTROLLER_BARE = `
+import { Controller, Post, Get } from "@nestjs/common";
+
+@Controller("api")
+export class ApiController {
+  @Post("transfer")
+  transfer() { return "done"; }
+}
+`;
+const MODULE_GLOBAL_GUARD = `
+import { Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
+import { AuthGuard } from "./auth.guard";
+
+@Module({ providers: [{ provide: APP_GUARD, useClass: AuthGuard }] })
+export class AppModule {}
+`;
+const MODULE_EMPTY = `
+import { Module } from "@nestjs/common";
+@Module({ providers: [] })
+export class AppModule {}
+`;
+(0, vitest_1.describe)("nestjs-detector 补全", () => {
+    (0, vitest_1.it)("全局 APP_GUARD：无类/方法守卫的 mutation 路由不报 NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE);
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { globalAuthGuards, issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(globalAuthGuards).toContain("AuthGuard");
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("@Public 绕过全局守卫 → NESTJS_NO_AUTH（显式绕过检出）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@Public()\n  @Post("transfer")'));
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("ThrottlerGuard 不是认证守卫 → 仍报 NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@UseGuards(ThrottlerGuard)\n  @Post("transfer")').replace('import { Controller, Post, Get } from "@nestjs/common";', 'import { Controller, Post, Get, UseGuards } from "@nestjs/common";\nimport { ThrottlerGuard } from "@nestjs/throttler";'));
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("无任何守卫且无全局守卫 → NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE);
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("类级 AuthGuard 保护 → 不报 NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Controller("api")', '@Controller("api")\n@UseGuards(AuthGuard)').replace('import { Controller, Post, Get } from "@nestjs/common";', 'import { Controller, Post, Get, UseGuards } from "@nestjs/common";\nimport { AuthGuard } from "./auth.guard";'));
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("@Public 登录入口在全局守卫下不报", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@Public()\n  @Post("login")').replace('transfer() { return "done"; }', 'login() { return "token"; }'));
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.10";
+exports.RUNTIME_VERSION = "3.7.11";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -840,50 +840,32 @@ function collectNestJSViolations(ctx) {
     let routes = 0;
     let filesScanned = 0;
     try {
-        const { analyzeNestJSFile } = require("../frameworks/nestjs-detector");
-        const fs = require("fs");
-        const candidateDirs = ["src", "server", "app", "api", "modules"];
-        const extensions = languageToExtensions(ctx.language);
-        for (const dir of candidateDirs) {
-            const dirPath = path.join(ctx.projectPath, dir);
-            if (!fs.existsSync(dirPath))
-                continue;
-            let files;
-            try {
-                files = walkDir(dirPath, extensions, 100);
-            }
-            catch {
-                continue;
-            }
-            for (const file of files) {
-                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
-                    continue;
-                filesScanned++;
-                try {
-                    const analysis = analyzeNestJSFile(file);
-                    if (!analysis || analysis.controllers.length === 0)
-                        continue;
-                    controllers += analysis.controllers.length;
-                    routes += analysis.routes.length;
-                    for (const issue of analysis.issues) {
-                        const severity = issue.severity === "critical" ? "critical" :
-                            issue.severity === "high" ? "high" :
-                                issue.severity === "medium" ? "medium" : "low";
-                        violations.push({
-                            severity,
-                            rule_id: issue.type,
-                            file: path.relative(ctx.projectPath, file),
-                            function: `${issue.controller}.${issue.route}`,
-                            message: issue.message,
-                            evidence: `NestJS route: ${issue.route} | Controller: ${issue.controller}`,
-                            why: `NestJS decorator analysis: ${issue.type}`,
-                            fix: issue.fix,
-                            policy_ref: "framework.nestjs",
-                        });
-                    }
-                }
-                catch { /* skip unreadable files */ }
-            }
+        // 项目级分析（一次 ts-morph Project 装载）：全局 APP_GUARD 守卫与
+        // @Public 豁免需要跨文件上下文——per-file 分析无法识别全局守卫，
+        // 会把受全局保护的 mutation 路由系统性误报（补全轮实测根因）。
+        const { analyzeNestJSProject } = require("../frameworks/nestjs-detector");
+        const analysis = analyzeNestJSProject(ctx.projectPath);
+        if (!analysis || analysis.controllers.length === 0) {
+            return { violations, coverage: { controllers, routes, filesScanned } };
+        }
+        controllers = analysis.controllers.length;
+        routes = analysis.routes.length;
+        filesScanned = 1; // 项目级单次装载（口径：分析单元 = 项目）
+        for (const issue of analysis.issues) {
+            const severity = issue.severity === "critical" ? "critical" :
+                issue.severity === "high" ? "high" :
+                    issue.severity === "medium" ? "medium" : "low";
+            violations.push({
+                severity,
+                rule_id: issue.type,
+                file: issue.controller || "",
+                function: `${issue.controller}.${issue.route}`,
+                message: issue.message,
+                evidence: `NestJS route: ${issue.route} | Controller: ${issue.controller}`,
+                why: `NestJS decorator analysis: ${issue.type}`,
+                fix: issue.fix,
+                policy_ref: "framework.nestjs",
+            });
         }
     }
     catch { /* best-effort */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.10",
+  "version": "3.7.11",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",