progmune-runtime 3.7.11 → 3.7.12

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [3.7.12] — 2026-09-01
+
+### Koa + Hapi 框架结构适配——10/13
+
+- **Koa（第 9 个）**：`src/frameworks/koa-detector.ts`（代码串级，镜像 express/koa 中间件模式）——`KOA_ROUTE_NO_AUTH`：mutation 路由注册中间件链无认证名中间件，且文件内无认证 `app.use` 全局中间件；认证名按词表分类（auth/login/permission/jwt/verify/guard…）；GET 读操作与认证入口路径豁免
+- **Hapi（第 10 个）**：`src/frameworks/hapi-detector.ts`（路由配置模式）——`HAPI_ROUTE_NO_AUTH`：mutation 路由 options 无 auth 字段或显式 `auth: false`（显式公开 mutation 检出）；`auth: 'strategy'` / `auth: { strategy: 'x' }` 两种形态均识别为受保护；`auth.strategy` 声明被记录
+- **引擎接线**：collectKoaViolations / collectHapiViolations + overall `koaCoverage`/`hapiCoverage`（加性 best-effort）；frameworks barrel 补全（11 个适配器模块）
+- **验证**：15 个新单测（koa 7 + hapi 8，含显式 auth:false 与 strategy 对象形态）；引擎冒烟：Koa 全局认证中间件 0 误报 APPROVED 90、Hapi 无 auth 路由检出 + login 豁免 APPROVED 87；全套件 **181/181**；Python 盲测 v1.2 64 零漂移
+- **文档**：10/13 口径（README 双语/覆盖矩阵双语/CLAUDE.md/落地页 + Koa/Hapi 矩阵行）
+- **边界（如实）**：文件级窗口（跨文件全局中间件不可见，与 Express 检测器同款）；认证中间件按名词语汇识别；Hapi 路由窗口 500 字符（超长配置截断）
+
 ## [3.7.11] — 2026-09-01
 
 ### NestJS 补全——框架适配 8/13

package/README.md

@@ -108,7 +108,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 8/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) and NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 10/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅ (route/auth-middleware chain analysis) and Hapi ✅ (route-config auth strategy analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +234,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (8/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (10/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -108,7 +108,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：8/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）与 NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：10/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅（路由/认证中间件链分析）与 Hapi ✅（路由配置认证策略分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +233,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（8/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（10/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/frameworks/hapi-detector.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Hapi Framework Adapter — Protocol Detection for Hapi
+ *
+ * 第 10 个框架适配（TS/JS 第 6 个专用检测器，代码串级）：
+ *
+ *   server.auth.strategy('jwt', 'jwt', {...})            认证策略声明
+ *   server.route({ method: 'POST', path: '/x',
+ *                  options: { auth: 'jwt' } })           路由级认证
+ *
+ * 规则：
+ *   HAPI_ROUTE_NO_AUTH        mutation 路由（method 含 POST/PUT/PATCH/
+ *                             DELETE）的 options 无 auth 字段，或显式
+ *                             auth: false——路由级 missing-auth / 显式公开
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 策略名本身不作为认证证明——必须出现在路由 options.auth
+ *     （auth: 'jwt' / auth: { strategy: 'jwt' } 均识别）
+ *   - auth: 'try'（可选认证）视为受保护（非公开）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeHapiApp = analyzeHapiApp;
+exports.analyzeHapiFile = analyzeHapiFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeHapiApp(code) {
+    const issues = [];
+    const routes = [];
+    const strategies = [];
+    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b/.test(code);
+    if (!hasHapi) {
+        return { hasHapi: false, routes, strategies, issues };
+    }
+    // 认证策略声明：server.auth.strategy('name', ...)
+    const strategyRe = /\.auth\.strategy\s*\(\s*['"]([^'"]+)['"]/g;
+    let m;
+    while ((m = strategyRe.exec(code)) !== null) {
+        strategies.push(m[1]);
+    }
+    // 路由块：server.route({ ... }) —— 从 route( 向后截 500 字符窗口
+    const routeRe = /\.route\s*\(\s*\{/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const window = code.slice(m.index, m.index + 500);
+        const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
+        const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
+        const authM = window.match(/auth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
+        if (!methodM || !pathM)
+            continue;
+        const method = methodM[1].toLowerCase();
+        const pathName = pathM[1];
+        // auth: false → 显式公开；无 auth 字段 → authM null
+        const authOption = authM
+            ? (authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null)
+            : null;
+        routes.push({
+            method,
+            path: pathName,
+            authOption,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (!MUTATION_METHODS.has(method))
+            continue;
+        if (isAuthEntryPath(pathName))
+            continue;
+        // 无 auth 字段（authOption null 且非显式 false 已涵盖）或显式 false → 报
+        if (authOption === null || authOption === "false") {
+            issues.push({
+                severity: "medium",
+                rule: "HAPI_ROUTE_NO_AUTH",
+                message: authOption === "false"
+                    ? `Mutation route ${method.toUpperCase()} ${pathName} is explicitly ` +
+                        `public (auth: false) — any caller can reach it.`
+                    : `Mutation route ${method.toUpperCase()} ${pathName} has no auth ` +
+                        `option in its route config — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasHapi: true, routes, strategies, issues };
+}
+function analyzeHapiFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b/.test(code))
+        return null;
+    return analyzeHapiApp(code);
+}

package/dist/frameworks/hapi-detector.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * hapi-detector.test.ts — Hapi 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const hapi_detector_1 = require("./hapi-detector");
+const app = (routes, extra = "") => `
+import Hapi from "@hapi/hapi";
+const server = Hapi.server({ port: 3000 });
+${extra}
+${routes}
+`;
+(0, vitest_1.describe)("hapi-detector", () => {
+    (0, vitest_1.it)("R1：无 auth 字段的 mutation 路由 → HAPI_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：options.auth 策略引用保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: "jwt" }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：auth 对象形态（strategy 字段）保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "PUT", path: "/update", options: { auth: { strategy: "jwt" } }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：显式 auth: false → 报（显式公开 mutation）", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: false }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "GET", path: "/articles", handler: () => [] });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/login", handler: () => "token" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("策略声明被记录（auth.strategy 提取）", () => {
+        const { strategies } = (0, hapi_detector_1.analyzeHapiApp)(app(`server.route({ method: "GET", path: "/me", options: { auth: "jwt" }, handler: () => "me" });`, `server.auth.strategy("jwt", "jwt", { keys: ["secret"] });`));
+        (0, vitest_1.expect)(strategies).toContain("jwt");
+    });
+    (0, vitest_1.it)("非 Hapi 代码不产生任何问题", () => {
+        const { hasHapi, issues } = (0, hapi_detector_1.analyzeHapiApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasHapi).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -12,7 +12,7 @@
  * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.analyzeHapiFile = exports.analyzeHapiApp = exports.analyzeKoaFile = exports.analyzeKoaApp = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -34,6 +34,12 @@ Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: fu
 var nextjs_detector_1 = require("./nextjs-detector");
 Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
 Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
+var koa_detector_1 = require("./koa-detector");
+Object.defineProperty(exports, "analyzeKoaApp", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaApp; } });
+Object.defineProperty(exports, "analyzeKoaFile", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaFile; } });
+var hapi_detector_1 = require("./hapi-detector");
+Object.defineProperty(exports, "analyzeHapiApp", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiApp; } });
+Object.defineProperty(exports, "analyzeHapiFile", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiFile; } });
 var nestjs_detector_1 = require("./nestjs-detector");
 Object.defineProperty(exports, "analyzeNestJSProject", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSProject; } });
 Object.defineProperty(exports, "analyzeNestJSFile", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSFile; } });

package/dist/frameworks/koa-detector.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Koa Framework Adapter — Protocol Detection for Koa
+ *
+ * 第 9 个框架适配（TS/JS 第 5 个专用检测器，代码串级镜像 express-detector）：
+ *
+ *   app.use(authMiddleware)                    全局认证中间件
+ *   router.post('/x', authMW, handler)         路由级认证中间件链
+ *
+ * 规则：
+ *   KOA_ROUTE_NO_AUTH        mutation 路由注册（post/put/patch/delete/del）
+ *                            中间件链里没有认证名中间件，且文件内无认证
+ *                            全局 app.use——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/login/permission/token/session/
+ *     jwt/verify/guard）；自定义认证名不含词表漏判（保守方向=漏报）
+ *   - 文件级窗口（与 Express 检测器同款）：跨文件注册的全局中间件不可见
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeKoaApp = analyzeKoaApp;
+exports.analyzeKoaFile = analyzeKoaFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete", "del"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeKoaApp(code) {
+    const issues = [];
+    const routes = [];
+    const authGlobalMiddleware = [];
+    const hasKoa = /\bKoa\b|\bkoa\b/.test(code);
+    if (!hasKoa) {
+        return { hasKoa: false, routes, authGlobalMiddleware, issues };
+    }
+    // 全局认证中间件：app.use(authFn)
+    const useRe = /\.use\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGlobalMiddleware.push(m[1]);
+    }
+    // 路由注册：router.post('/x', mw1, mw2, handler) / .del()
+    const routeRe = /\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase() === "del" ? "delete" : m[1].toLowerCase();
+        const pathName = m[2];
+        // 从路径串向后截 300 字符窗口，收集中间件名（认证名判定）
+        const windowStart = m.index + m[0].length;
+        const window = code.slice(windowStart, windowStart + 300);
+        const mwNames = window.match(/[A-Za-z_$][\w$]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authGlobalMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "KOA_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and the app registers no auth middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasKoa: true, routes, authGlobalMiddleware, issues };
+}
+function analyzeKoaFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/from\s+['"]koa|require\(['"]koa/.test(code))
+        return null;
+    return analyzeKoaApp(code);
+}

package/dist/frameworks/koa-detector.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * koa-detector.test.ts — Koa 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const koa_detector_1 = require("./koa-detector");
+const app = (routes, extra = "") => `
+import Koa from "koa";
+import Router from "@koa/router";
+const app = new Koa();
+const router = new Router();
+${extra}
+${routes}
+app.use(router.routes());
+`;
+(0, vitest_1.describe)("koa-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → KOA_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", authenticate, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：全局 app.use 认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`router.post("/transfer", async (ctx) => { ctx.body = "ok"; });`, `app.use(authenticate);`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件（日志）不视为保护", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", logger, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.get("/articles", async (ctx) => { ctx.body = []; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/login", async (ctx) => { ctx.body = "token"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Koa 代码不产生任何问题", () => {
+        const { hasKoa, issues } = (0, koa_detector_1.analyzeKoaApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasKoa).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.11";
+exports.RUNTIME_VERSION = "3.7.12";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -67,6 +67,8 @@ const django_detector_1 = require("../frameworks/django-detector");
 const flask_detector_1 = require("../frameworks/flask-detector");
 const fastify_detector_1 = require("../frameworks/fastify-detector");
 const nextjs_detector_1 = require("../frameworks/nextjs-detector");
+const koa_detector_1 = require("../frameworks/koa-detector");
+const hapi_detector_1 = require("../frameworks/hapi-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
@@ -102,6 +104,8 @@ async function evaluateTrust(ctx) {
     const flaskResult = collectFlaskViolations(ctx);
     const fastifyResult = collectFastifyViolations(ctx);
     const nextjsResult = collectNextjsViolations(ctx);
+    const koaResult = collectKoaViolations(ctx);
+    const hapiResult = collectHapiViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -124,6 +128,8 @@ async function evaluateTrust(ctx) {
         ...flaskResult.violations,
         ...fastifyResult.violations,
         ...nextjsResult.violations,
+        ...koaResult.violations,
+        ...hapiResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -288,6 +294,24 @@ async function evaluateTrust(ctx) {
                     issuesFound: nextjsResult.violations.length,
                 }
                 : undefined,
+            /** Koa framework adapter coverage — route/auth-middleware analysis */
+            koaCoverage: koaResult.coverage.routes > 0
+                ? {
+                    appsDetected: koaResult.coverage.apps,
+                    totalRoutes: koaResult.coverage.routes,
+                    filesScanned: koaResult.coverage.filesScanned,
+                    issuesFound: koaResult.violations.length,
+                }
+                : undefined,
+            /** Hapi framework adapter coverage — route-config auth analysis */
+            hapiCoverage: hapiResult.coverage.routes > 0
+                ? {
+                    appsDetected: hapiResult.coverage.apps,
+                    totalRoutes: hapiResult.coverage.routes,
+                    filesScanned: hapiResult.coverage.filesScanned,
+                    issuesFound: hapiResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -426,6 +450,104 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectKoaViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, koa_detector_1.analyzeKoaFile)(file);
+                    if (!analysis || !analysis.hasKoa)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth middleware to the route registration, or register an auth middleware globally with app.use.`,
+                            policy_ref: "framework-safety.koa",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectHapiViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, hapi_detector_1.analyzeHapiFile)(file);
+                    if (!analysis || !analysis.hasHapi)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth strategy reference to the route options (auth: "<strategy>"), or remove the explicit auth: false.`,
+                            policy_ref: "framework-safety.hapi",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
 function collectNextjsViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.11",
+  "version": "3.7.12",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",