progmune-runtime 3.7.10 → 3.7.12

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [3.7.12] — 2026-09-01
+
+### Koa + Hapi 框架结构适配——10/13
+
+- **Koa（第 9 个）**：`src/frameworks/koa-detector.ts`（代码串级，镜像 express/koa 中间件模式）——`KOA_ROUTE_NO_AUTH`：mutation 路由注册中间件链无认证名中间件，且文件内无认证 `app.use` 全局中间件；认证名按词表分类（auth/login/permission/jwt/verify/guard…）；GET 读操作与认证入口路径豁免
+- **Hapi（第 10 个）**：`src/frameworks/hapi-detector.ts`（路由配置模式）——`HAPI_ROUTE_NO_AUTH`：mutation 路由 options 无 auth 字段或显式 `auth: false`（显式公开 mutation 检出）；`auth: 'strategy'` / `auth: { strategy: 'x' }` 两种形态均识别为受保护；`auth.strategy` 声明被记录
+- **引擎接线**：collectKoaViolations / collectHapiViolations + overall `koaCoverage`/`hapiCoverage`（加性 best-effort）；frameworks barrel 补全（11 个适配器模块）
+- **验证**：15 个新单测（koa 7 + hapi 8，含显式 auth:false 与 strategy 对象形态）；引擎冒烟：Koa 全局认证中间件 0 误报 APPROVED 90、Hapi 无 auth 路由检出 + login 豁免 APPROVED 87；全套件 **181/181**；Python 盲测 v1.2 64 零漂移
+- **文档**：10/13 口径（README 双语/覆盖矩阵双语/CLAUDE.md/落地页 + Koa/Hapi 矩阵行）
+- **边界（如实）**：文件级窗口（跨文件全局中间件不可见，与 Express 检测器同款）；认证中间件按名词语汇识别；Hapi 路由窗口 500 字符（超长配置截断）
+
+## [3.7.11] — 2026-09-01
+
+### NestJS 补全——框架适配 8/13
+
+- **三缺口补全**（`src/frameworks/nestjs-detector.ts`）：
+  ①**全局 APP_GUARD 守卫识别**——@Module providers 的 `{ provide: APP_GUARD, useClass: X }`（装饰器参数与类属性两种形态）→ 全局认证守卫存在时 mutation 路由不再误报；
+  ②**@Public()/@SkipAuth()/@AllowAnon() 豁免装饰器**（类级+方法级）——全局守卫模式下的公开路由标记；**显式绕过全局守卫的 mutation 路由 → NESTJS_NO_AUTH**（消息注明绕过的是哪个全局守卫）；
+  ③**守卫名认证分类**——ThrottlerGuard/RateLimit/Logger 等非认证守卫不再算认证（限流≠认证，实测误报源）
+- **引擎接线升级**：collectNestJSViolations 从 per-file 切 **项目级一次装载**（analyzeNestJSProject）——全局守卫与 @Public 需要跨文件上下文，per-file 分析无法识别全局守卫（系统性误报根因）；coverage.filesScanned 口径改为分析单元=项目
+- **合成金标**（`generate-projects-nestjs.ts` + `scan-protocol-nestjs.ts`）：6 项目（类级守卫/全局 APP_GUARD+@Public login/无守卫/显式绕过/ThrottlerGuard 非认证/敏感 GET 公开）——**TP 12 / FP 0 / FN 0 → P=R=100%**
+- **验证**：6 个新单测（含 @Public login 在全局守卫下不报）；引擎冒烟 N2 APPROVED 87（全局守卫正确识别）、N4 BLOCKED（显式绕过 critical 拦截）；全套件 166/166；Python 盲测 v1.2 64 零漂移；C 演示不变
+- **文档**：NestJS ⚠️ 部分 → ✅ 结构分析（README 双语/覆盖矩阵双语/CLAUDE.md/落地页「8/13 专用检测器」口径）
+
 ## [3.7.10] — 2026-09-01
 
 ### 安装态 Python 全链路修复（npm 包正确性）

package/README.md

@@ -108,7 +108,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 7/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) have dedicated detectors; NestJS is partial. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 10/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅ (route/auth-middleware chain analysis) and Hapi ✅ (route-config auth strategy analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +234,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS partial (7/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (10/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -108,7 +108,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：7/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）有专用检测器；NestJS 部分支持，Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：10/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅（路由/认证中间件链分析）与 Hapi ✅（路由配置认证策略分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +233,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS 部分（7/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（10/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/frameworks/hapi-detector.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Hapi Framework Adapter — Protocol Detection for Hapi
+ *
+ * 第 10 个框架适配（TS/JS 第 6 个专用检测器，代码串级）：
+ *
+ *   server.auth.strategy('jwt', 'jwt', {...})            认证策略声明
+ *   server.route({ method: 'POST', path: '/x',
+ *                  options: { auth: 'jwt' } })           路由级认证
+ *
+ * 规则：
+ *   HAPI_ROUTE_NO_AUTH        mutation 路由（method 含 POST/PUT/PATCH/
+ *                             DELETE）的 options 无 auth 字段，或显式
+ *                             auth: false——路由级 missing-auth / 显式公开
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 策略名本身不作为认证证明——必须出现在路由 options.auth
+ *     （auth: 'jwt' / auth: { strategy: 'jwt' } 均识别）
+ *   - auth: 'try'（可选认证）视为受保护（非公开）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeHapiApp = analyzeHapiApp;
+exports.analyzeHapiFile = analyzeHapiFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeHapiApp(code) {
+    const issues = [];
+    const routes = [];
+    const strategies = [];
+    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b/.test(code);
+    if (!hasHapi) {
+        return { hasHapi: false, routes, strategies, issues };
+    }
+    // 认证策略声明：server.auth.strategy('name', ...)
+    const strategyRe = /\.auth\.strategy\s*\(\s*['"]([^'"]+)['"]/g;
+    let m;
+    while ((m = strategyRe.exec(code)) !== null) {
+        strategies.push(m[1]);
+    }
+    // 路由块：server.route({ ... }) —— 从 route( 向后截 500 字符窗口
+    const routeRe = /\.route\s*\(\s*\{/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const window = code.slice(m.index, m.index + 500);
+        const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
+        const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
+        const authM = window.match(/auth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
+        if (!methodM || !pathM)
+            continue;
+        const method = methodM[1].toLowerCase();
+        const pathName = pathM[1];
+        // auth: false → 显式公开；无 auth 字段 → authM null
+        const authOption = authM
+            ? (authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null)
+            : null;
+        routes.push({
+            method,
+            path: pathName,
+            authOption,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (!MUTATION_METHODS.has(method))
+            continue;
+        if (isAuthEntryPath(pathName))
+            continue;
+        // 无 auth 字段（authOption null 且非显式 false 已涵盖）或显式 false → 报
+        if (authOption === null || authOption === "false") {
+            issues.push({
+                severity: "medium",
+                rule: "HAPI_ROUTE_NO_AUTH",
+                message: authOption === "false"
+                    ? `Mutation route ${method.toUpperCase()} ${pathName} is explicitly ` +
+                        `public (auth: false) — any caller can reach it.`
+                    : `Mutation route ${method.toUpperCase()} ${pathName} has no auth ` +
+                        `option in its route config — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasHapi: true, routes, strategies, issues };
+}
+function analyzeHapiFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b/.test(code))
+        return null;
+    return analyzeHapiApp(code);
+}

package/dist/frameworks/hapi-detector.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * hapi-detector.test.ts — Hapi 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const hapi_detector_1 = require("./hapi-detector");
+const app = (routes, extra = "") => `
+import Hapi from "@hapi/hapi";
+const server = Hapi.server({ port: 3000 });
+${extra}
+${routes}
+`;
+(0, vitest_1.describe)("hapi-detector", () => {
+    (0, vitest_1.it)("R1：无 auth 字段的 mutation 路由 → HAPI_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：options.auth 策略引用保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: "jwt" }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：auth 对象形态（strategy 字段）保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "PUT", path: "/update", options: { auth: { strategy: "jwt" } }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：显式 auth: false → 报（显式公开 mutation）", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: false }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "GET", path: "/articles", handler: () => [] });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/login", handler: () => "token" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("策略声明被记录（auth.strategy 提取）", () => {
+        const { strategies } = (0, hapi_detector_1.analyzeHapiApp)(app(`server.route({ method: "GET", path: "/me", options: { auth: "jwt" }, handler: () => "me" });`, `server.auth.strategy("jwt", "jwt", { keys: ["secret"] });`));
+        (0, vitest_1.expect)(strategies).toContain("jwt");
+    });
+    (0, vitest_1.it)("非 Hapi 代码不产生任何问题", () => {
+        const { hasHapi, issues } = (0, hapi_detector_1.analyzeHapiApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasHapi).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -12,7 +12,7 @@
  * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.analyzeHapiFile = exports.analyzeHapiApp = exports.analyzeKoaFile = exports.analyzeKoaApp = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -34,6 +34,15 @@ Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: fu
 var nextjs_detector_1 = require("./nextjs-detector");
 Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
 Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
+var koa_detector_1 = require("./koa-detector");
+Object.defineProperty(exports, "analyzeKoaApp", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaApp; } });
+Object.defineProperty(exports, "analyzeKoaFile", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaFile; } });
+var hapi_detector_1 = require("./hapi-detector");
+Object.defineProperty(exports, "analyzeHapiApp", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiApp; } });
+Object.defineProperty(exports, "analyzeHapiFile", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiFile; } });
+var nestjs_detector_1 = require("./nestjs-detector");
+Object.defineProperty(exports, "analyzeNestJSProject", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSProject; } });
+Object.defineProperty(exports, "analyzeNestJSFile", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSFile; } });
 // ── Framework Version-Aware Governance ──
 var version_awareness_1 = require("./version-awareness");
 Object.defineProperty(exports, "detectFrameworks", { enumerable: true, get: function () { return version_awareness_1.detectFrameworks; } });

package/dist/frameworks/koa-detector.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Koa Framework Adapter — Protocol Detection for Koa
+ *
+ * 第 9 个框架适配（TS/JS 第 5 个专用检测器，代码串级镜像 express-detector）：
+ *
+ *   app.use(authMiddleware)                    全局认证中间件
+ *   router.post('/x', authMW, handler)         路由级认证中间件链
+ *
+ * 规则：
+ *   KOA_ROUTE_NO_AUTH        mutation 路由注册（post/put/patch/delete/del）
+ *                            中间件链里没有认证名中间件，且文件内无认证
+ *                            全局 app.use——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/login/permission/token/session/
+ *     jwt/verify/guard）；自定义认证名不含词表漏判（保守方向=漏报）
+ *   - 文件级窗口（与 Express 检测器同款）：跨文件注册的全局中间件不可见
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeKoaApp = analyzeKoaApp;
+exports.analyzeKoaFile = analyzeKoaFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete", "del"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeKoaApp(code) {
+    const issues = [];
+    const routes = [];
+    const authGlobalMiddleware = [];
+    const hasKoa = /\bKoa\b|\bkoa\b/.test(code);
+    if (!hasKoa) {
+        return { hasKoa: false, routes, authGlobalMiddleware, issues };
+    }
+    // 全局认证中间件：app.use(authFn)
+    const useRe = /\.use\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGlobalMiddleware.push(m[1]);
+    }
+    // 路由注册：router.post('/x', mw1, mw2, handler) / .del()
+    const routeRe = /\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase() === "del" ? "delete" : m[1].toLowerCase();
+        const pathName = m[2];
+        // 从路径串向后截 300 字符窗口，收集中间件名（认证名判定）
+        const windowStart = m.index + m[0].length;
+        const window = code.slice(windowStart, windowStart + 300);
+        const mwNames = window.match(/[A-Za-z_$][\w$]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authGlobalMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "KOA_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and the app registers no auth middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasKoa: true, routes, authGlobalMiddleware, issues };
+}
+function analyzeKoaFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/from\s+['"]koa|require\(['"]koa/.test(code))
+        return null;
+    return analyzeKoaApp(code);
+}

package/dist/frameworks/koa-detector.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * koa-detector.test.ts — Koa 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const koa_detector_1 = require("./koa-detector");
+const app = (routes, extra = "") => `
+import Koa from "koa";
+import Router from "@koa/router";
+const app = new Koa();
+const router = new Router();
+${extra}
+${routes}
+app.use(router.routes());
+`;
+(0, vitest_1.describe)("koa-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → KOA_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", authenticate, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：全局 app.use 认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`router.post("/transfer", async (ctx) => { ctx.body = "ok"; });`, `app.use(authenticate);`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件（日志）不视为保护", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", logger, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.get("/articles", async (ctx) => { ctx.body = []; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/login", async (ctx) => { ctx.body = "token"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Koa 代码不产生任何问题", () => {
+        const { hasKoa, issues } = (0, koa_detector_1.analyzeKoaApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasKoa).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/nestjs-detector.js

@@ -36,14 +36,34 @@ function analyzeNestJSProject(projectRoot) {
             project.addSourceFilesAtPaths(`${projectRoot}/**/*.ts`);
         }
         catch {
-            return { controllers: [], routes: [], issues: [] };
+            return { controllers: [], routes: [], issues: [], globalAuthGuards: [] };
         }
     }
     const analysis = {
         controllers: [],
         routes: [],
         issues: [],
+        globalAuthGuards: [],
     };
+    // ── 第一遍：全局守卫（@Module providers 里的 APP_GUARD）──
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        if (/\.(test|spec)\.ts$/.test(file.getFilePath()))
+            continue;
+        for (const cls of file.getClasses()) {
+            const moduleDec = cls.getDecorator("Module");
+            if (!moduleDec)
+                continue;
+            const guardNames = extractAppGuardNames(moduleDec, cls);
+            for (const name of guardNames) {
+                if (isAuthGuardName(name) && !analysis.globalAuthGuards.includes(name)) {
+                    analysis.globalAuthGuards.push(name);
+                }
+            }
+        }
+    }
+    const hasGlobalAuthGuard = analysis.globalAuthGuards.length > 0;
     for (const file of project.getSourceFiles()) {
         // Skip node_modules and test files
         if (file.getFilePath().includes("node_modules"))
@@ -59,6 +79,9 @@ function analyzeNestJSProject(projectRoot) {
             const basePath = getStringArg(ctrlDec, 0) || "";
             const classGuards = extractGuardNames(cls.getDecorator("UseGuards"));
             const classPipes = extractGuardNames(cls.getDecorator("UsePipes"));
+            const classPublic = cls.getDecorator("Public") !== undefined
+                || cls.getDecorator("SkipAuth") !== undefined
+                || cls.getDecorator("AllowAnon") !== undefined;
             for (const method of cls.getMethods()) {
                 const httpMethod = getHttpMethod(method);
                 if (!httpMethod)
@@ -70,29 +93,41 @@ function analyzeNestJSProject(projectRoot) {
                 const methodPipes = extractGuardNames(method.getDecorator("UsePipes"));
                 const guards = methodGuards.length > 0 ? methodGuards : classGuards;
                 const pipes = methodPipes.length > 0 ? methodPipes : classPipes;
+                const isPublicDecorated = classPublic
+                    || method.getDecorator("Public") !== undefined
+                    || method.getDecorator("SkipAuth") !== undefined
+                    || method.getDecorator("AllowAnon") !== undefined;
+                // 认证守卫 = 认证名分类后的守卫（ThrottlerGuard 等限流守卫不算认证）
+                const authGuards = guards.filter(isAuthGuardName);
                 const route = {
                     method: httpMethod,
                     path: fullPath,
                     controller: controllerName,
                     handler: method.getName() || "unknown",
-                    hasAuthGuard: guards.length > 0,
+                    hasAuthGuard: authGuards.length > 0,
                     hasValidationPipe: pipes.length > 0,
                     guards,
                     pipes,
+                    isPublicDecorated,
                 };
                 analysis.routes.push(route);
+                // 路由级保护判定：类/方法认证守卫，或全局 APP_GUARD（除非 @Public 豁免）
+                const protectedByGlobal = hasGlobalAuthGuard && !isPublicDecorated;
                 // ── Security Checks ──
                 // POST/PUT/DELETE without auth guard
                 // Skip intentionally public routes (login, register, health, etc.)
                 if (["POST", "PUT", "DELETE", "PATCH"].includes(httpMethod) && !isPublicRoute(fullPath)) {
-                    if (!route.hasAuthGuard) {
+                    if (!route.hasAuthGuard && !protectedByGlobal) {
                         analysis.issues.push({
                             type: "NESTJS_NO_AUTH",
                             severity: "critical",
                             route: `${httpMethod} ${fullPath}`,
                             controller: controllerName,
-                            message: `Mutation route ${httpMethod} ${fullPath} has no @UseGuards. Anyone can call it.`,
-                            fix: `Add @UseGuards(AuthGuard) to the method or controller class.`,
+                            message: `Mutation route ${httpMethod} ${fullPath} has no auth guard and ` +
+                                (hasGlobalAuthGuard
+                                    ? `is explicitly marked public — it bypasses the global ${analysis.globalAuthGuards.join("/")}.`
+                                    : `no global APP_GUARD protects the app. Anyone can call it.`),
+                            fix: `Add @UseGuards(AuthGuard) to the method or controller class, or remove the @Public marker.`,
                         });
                     }
                     if (!route.hasValidationPipe) {
@@ -109,13 +144,14 @@ function analyzeNestJSProject(projectRoot) {
                 // Sensitive GET routes without auth
                 if (httpMethod === "GET") {
                     const sensitiveTerms = ["admin", "private", "secret", "manage"];
-                    if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t)) && !route.hasAuthGuard) {
+                    if (sensitiveTerms.some(t => fullPath.toLowerCase().includes(t))
+                        && !route.hasAuthGuard && !protectedByGlobal) {
                         analysis.issues.push({
                             type: "NESTJS_SENSITIVE_PUBLIC",
                             severity: "high",
                             route: `${httpMethod} ${fullPath}`,
                             controller: controllerName,
-                            message: `Sensitive GET route ${fullPath} is publicly accessible without @UseGuards.`,
+                            message: `Sensitive GET route ${fullPath} is publicly accessible without auth protection.`,
                             fix: `Add @UseGuards(AuthGuard) to protect this route.`,
                         });
                     }
@@ -126,6 +162,60 @@ function analyzeNestJSProject(projectRoot) {
     return analysis;
 }
 // ── Helpers ──
+/**
+ * 守卫名认证分类：auth/jwt/session/permission/role/access 等为认证守卫；
+ * throttler/rate/logger 等非认证守卫不算（限流≠认证——实测误报源）。
+ */
+function isAuthGuardName(name) {
+    const lower = name.toLowerCase();
+    if (/throttler|rate.?limit|logger|logging|cache/.test(lower))
+        return false;
+    return /auth|jwt|session|permission|role|access|apikey|api_key|token|login|passport/.test(lower);
+}
+/**
+ * 从 @Module 装饰器的 providers 提取 APP_GUARD 类名：
+ *   providers: [{ provide: APP_GUARD, useClass: AuthGuard }]
+ * 支持装饰器参数对象字面量与类属性 providers 两种形态。
+ */
+function extractAppGuardNames(moduleDec, cls) {
+    const names = [];
+    const scanProviders = (arg) => {
+        if (!arg)
+            return;
+        // @Module({ providers: [...] })
+        const obj = arg.asKind(ts_morph_1.SyntaxKind.ObjectLiteralExpression);
+        if (obj) {
+            const providersProp = obj.getProperty("providers");
+            if (providersProp) {
+                const initializer = providersProp.getInitializer?.();
+                if (initializer && initializer.asKind(ts_morph_1.SyntaxKind.ArrayLiteralExpression)) {
+                    for (const el of initializer.getElements()) {
+                        const elObj = el.asKind(ts_morph_1.SyntaxKind.ObjectLiteralExpression);
+                        if (!elObj)
+                            continue;
+                        const provideProp = elObj.getProperty("provide");
+                        const useClassProp = elObj.getProperty("useClass");
+                        const provideName = provideProp?.getInitializer?.()?.getText?.();
+                        const useClassName = useClassProp?.getInitializer?.()?.getText?.();
+                        if (provideName === "APP_GUARD" && useClassName) {
+                            names.push(useClassName);
+                        }
+                    }
+                }
+            }
+        }
+    };
+    // 装饰器参数形态
+    const decArg = moduleDec.getArguments()[0];
+    scanProviders(decArg);
+    // 类属性形态：providers = [...]
+    for (const prop of cls.getProperties()) {
+        if (prop.getName() === "providers") {
+            scanProviders(prop.getInitializer());
+        }
+    }
+    return names;
+}
 /** Check if a route is intentionally public (login, register, health, etc.). */
 function isPublicRoute(path) {
     // Normalize: ensure leading slash for consistent matching
@@ -200,6 +290,7 @@ function analyzeNestJSFile(filePath) {
         controllers: [],
         routes: [],
         issues: [],
+        globalAuthGuards: [], // 单文件分析无全局守卫上下文（项目级请用 analyzeNestJSProject）
     };
     for (const file of project.getSourceFiles()) {
         for (const cls of file.getClasses()) {
@@ -227,10 +318,11 @@ function analyzeNestJSFile(filePath) {
                     path: fullPath,
                     controller: controllerName,
                     handler: method.getName() || "unknown",
-                    hasAuthGuard: guards.length > 0,
+                    hasAuthGuard: guards.filter(isAuthGuardName).length > 0,
                     hasValidationPipe: pipes.length > 0,
                     guards,
                     pipes,
+                    isPublicDecorated: false, // 单文件分析不解析 @Public（项目级用 analyzeNestJSProject）
                 };
                 analysis.routes.push(route);
                 // Security checks

package/dist/frameworks/nestjs-detector.test.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * nestjs-detector.test.ts — NestJS 补全轮回归（文件系统夹具，临时目录）
+ *
+ * 锁定三缺口修复：全局 APP_GUARD 识别、@Public 豁免、守卫名认证分类
+ * （ThrottlerGuard ≠ 认证）。
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const nestjs_detector_1 = require("./nestjs-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "nestjs-det-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function write(rel, content) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+}
+const TSCONFIG = `{
+  "compilerOptions": { "target": "ES2020", "module": "commonjs",
+    "experimentalDecorators": true, "strict": false, "skipLibCheck": true },
+  "include": ["src/**/*"]
+}`;
+const GUARD = `
+import { CanActivate } from "@nestjs/common";
+export class AuthGuard implements CanActivate { canActivate(): boolean { return true; } }
+`;
+const CONTROLLER_BARE = `
+import { Controller, Post, Get } from "@nestjs/common";
+
+@Controller("api")
+export class ApiController {
+  @Post("transfer")
+  transfer() { return "done"; }
+}
+`;
+const MODULE_GLOBAL_GUARD = `
+import { Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
+import { AuthGuard } from "./auth.guard";
+
+@Module({ providers: [{ provide: APP_GUARD, useClass: AuthGuard }] })
+export class AppModule {}
+`;
+const MODULE_EMPTY = `
+import { Module } from "@nestjs/common";
+@Module({ providers: [] })
+export class AppModule {}
+`;
+(0, vitest_1.describe)("nestjs-detector 补全", () => {
+    (0, vitest_1.it)("全局 APP_GUARD：无类/方法守卫的 mutation 路由不报 NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE);
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { globalAuthGuards, issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(globalAuthGuards).toContain("AuthGuard");
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("@Public 绕过全局守卫 → NESTJS_NO_AUTH（显式绕过检出）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@Public()\n  @Post("transfer")'));
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("ThrottlerGuard 不是认证守卫 → 仍报 NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@UseGuards(ThrottlerGuard)\n  @Post("transfer")').replace('import { Controller, Post, Get } from "@nestjs/common";', 'import { Controller, Post, Get, UseGuards } from "@nestjs/common";\nimport { ThrottlerGuard } from "@nestjs/throttler";'));
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("无任何守卫且无全局守卫 → NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE);
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("类级 AuthGuard 保护 → 不报 NESTJS_NO_AUTH", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Controller("api")', '@Controller("api")\n@UseGuards(AuthGuard)').replace('import { Controller, Post, Get } from "@nestjs/common";', 'import { Controller, Post, Get, UseGuards } from "@nestjs/common";\nimport { AuthGuard } from "./auth.guard";'));
+        write("src/app.module.ts", MODULE_EMPTY);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+    (0, vitest_1.it)("@Public 登录入口在全局守卫下不报", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/auth.guard.ts", GUARD);
+        write("src/api.controller.ts", CONTROLLER_BARE.replace('@Post("transfer")', '@Public()\n  @Post("login")').replace('transfer() { return "done"; }', 'login() { return "token"; }'));
+        write("src/app.module.ts", MODULE_GLOBAL_GUARD);
+        const { issues } = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.10";
+exports.RUNTIME_VERSION = "3.7.12";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -67,6 +67,8 @@ const django_detector_1 = require("../frameworks/django-detector");
 const flask_detector_1 = require("../frameworks/flask-detector");
 const fastify_detector_1 = require("../frameworks/fastify-detector");
 const nextjs_detector_1 = require("../frameworks/nextjs-detector");
+const koa_detector_1 = require("../frameworks/koa-detector");
+const hapi_detector_1 = require("../frameworks/hapi-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
@@ -102,6 +104,8 @@ async function evaluateTrust(ctx) {
     const flaskResult = collectFlaskViolations(ctx);
     const fastifyResult = collectFastifyViolations(ctx);
     const nextjsResult = collectNextjsViolations(ctx);
+    const koaResult = collectKoaViolations(ctx);
+    const hapiResult = collectHapiViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -124,6 +128,8 @@ async function evaluateTrust(ctx) {
         ...flaskResult.violations,
         ...fastifyResult.violations,
         ...nextjsResult.violations,
+        ...koaResult.violations,
+        ...hapiResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -288,6 +294,24 @@ async function evaluateTrust(ctx) {
                     issuesFound: nextjsResult.violations.length,
                 }
                 : undefined,
+            /** Koa framework adapter coverage — route/auth-middleware analysis */
+            koaCoverage: koaResult.coverage.routes > 0
+                ? {
+                    appsDetected: koaResult.coverage.apps,
+                    totalRoutes: koaResult.coverage.routes,
+                    filesScanned: koaResult.coverage.filesScanned,
+                    issuesFound: koaResult.violations.length,
+                }
+                : undefined,
+            /** Hapi framework adapter coverage — route-config auth analysis */
+            hapiCoverage: hapiResult.coverage.routes > 0
+                ? {
+                    appsDetected: hapiResult.coverage.apps,
+                    totalRoutes: hapiResult.coverage.routes,
+                    filesScanned: hapiResult.coverage.filesScanned,
+                    issuesFound: hapiResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -426,6 +450,104 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectKoaViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, koa_detector_1.analyzeKoaFile)(file);
+                    if (!analysis || !analysis.hasKoa)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth middleware to the route registration, or register an auth middleware globally with app.use.`,
+                            policy_ref: "framework-safety.koa",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectHapiViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, hapi_detector_1.analyzeHapiFile)(file);
+                    if (!analysis || !analysis.hasHapi)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth strategy reference to the route options (auth: "<strategy>"), or remove the explicit auth: false.`,
+                            policy_ref: "framework-safety.hapi",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
 function collectNextjsViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };
@@ -840,50 +962,32 @@ function collectNestJSViolations(ctx) {
     let routes = 0;
     let filesScanned = 0;
     try {
-        const { analyzeNestJSFile } = require("../frameworks/nestjs-detector");
-        const fs = require("fs");
-        const candidateDirs = ["src", "server", "app", "api", "modules"];
-        const extensions = languageToExtensions(ctx.language);
-        for (const dir of candidateDirs) {
-            const dirPath = path.join(ctx.projectPath, dir);
-            if (!fs.existsSync(dirPath))
-                continue;
-            let files;
-            try {
-                files = walkDir(dirPath, extensions, 100);
-            }
-            catch {
-                continue;
-            }
-            for (const file of files) {
-                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
-                    continue;
-                filesScanned++;
-                try {
-                    const analysis = analyzeNestJSFile(file);
-                    if (!analysis || analysis.controllers.length === 0)
-                        continue;
-                    controllers += analysis.controllers.length;
-                    routes += analysis.routes.length;
-                    for (const issue of analysis.issues) {
-                        const severity = issue.severity === "critical" ? "critical" :
-                            issue.severity === "high" ? "high" :
-                                issue.severity === "medium" ? "medium" : "low";
-                        violations.push({
-                            severity,
-                            rule_id: issue.type,
-                            file: path.relative(ctx.projectPath, file),
-                            function: `${issue.controller}.${issue.route}`,
-                            message: issue.message,
-                            evidence: `NestJS route: ${issue.route} | Controller: ${issue.controller}`,
-                            why: `NestJS decorator analysis: ${issue.type}`,
-                            fix: issue.fix,
-                            policy_ref: "framework.nestjs",
-                        });
-                    }
-                }
-                catch { /* skip unreadable files */ }
-            }
+        // 项目级分析（一次 ts-morph Project 装载）：全局 APP_GUARD 守卫与
+        // @Public 豁免需要跨文件上下文——per-file 分析无法识别全局守卫，
+        // 会把受全局保护的 mutation 路由系统性误报（补全轮实测根因）。
+        const { analyzeNestJSProject } = require("../frameworks/nestjs-detector");
+        const analysis = analyzeNestJSProject(ctx.projectPath);
+        if (!analysis || analysis.controllers.length === 0) {
+            return { violations, coverage: { controllers, routes, filesScanned } };
+        }
+        controllers = analysis.controllers.length;
+        routes = analysis.routes.length;
+        filesScanned = 1; // 项目级单次装载（口径：分析单元 = 项目）
+        for (const issue of analysis.issues) {
+            const severity = issue.severity === "critical" ? "critical" :
+                issue.severity === "high" ? "high" :
+                    issue.severity === "medium" ? "medium" : "low";
+            violations.push({
+                severity,
+                rule_id: issue.type,
+                file: issue.controller || "",
+                function: `${issue.controller}.${issue.route}`,
+                message: issue.message,
+                evidence: `NestJS route: ${issue.route} | Controller: ${issue.controller}`,
+                why: `NestJS decorator analysis: ${issue.type}`,
+                fix: issue.fix,
+                policy_ref: "framework.nestjs",
+            });
         }
     }
     catch { /* best-effort */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.10",
+  "version": "3.7.12",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",