progmune-runtime 3.7.11 → 3.7.13

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [3.7.13] — 2026-09-02
+
+### Go 语言支持 + Gin/Fiber 框架适配——12/13
+
+- **Go IR 提取器**（`src/extract-ir-go.ts`，纯 TS 词法——与 C 提取器同哲学：零外部工具链，npm 安装态可用，不重蹈 Python 桥的安装态覆辙）：func 签名（多行/接收者方法）、调用提取（obj.Method() 取 Method）、注释注解 `// @progmune(...)` + 文档标签、exported=首字母大写、vendor/testdata/*_test.go 表面过滤、Go 关键字排除、反引号 raw string 掩码；8 个单测
+- **注册表接入**：LANGUAGE_EXTRACTORS 第 4 语言（detect .go → extractIRGo）→ extractProjectIR/evaluateTrust 全链路自动生效；**引擎 autoExtractor 补 go**（修复 Go 项目静默走正则回退的同类陷阱——首轮金标全错暴露）
+- **Go 协议盲测 v1**（`scan-protocol-golang.ts`，自包含生成+扫描）：3 干净（直连/方法/helper）× 3 植入违规（missing_auth/read_without_open/leak）——**TP 5 / FP 0 / FN 0 → P=100% / R=100%**
+- **Gin（第 11 个）**：`gin-detector.ts`——GIN_ROUTE_NO_AUTH（r.POST 中间件链 + Use/Group 组级认证）；Go 方法名大写（r.POST）正则 i 标志修复；"middleware" 词误撞修复（loggerMiddleware 类工具中间件≠认证）
+- **Fiber（第 12 个）**：`fiber-detector.ts`——FIBER_ROUTE_NO_AUTH（app.Post 中间件链 + Use）；同款修复
+- **引擎**：collectGinViolations/collectFiberViolations（Go 目录结构特殊：cmd/internal/pkg + 根目录 main.go）+ ginCoverage/fiberCoverage
+- **文档**：Go 语言行 ❌→✅ 注解驱动（Beta）（README 双语/矩阵双语/CLAUDE.md/落地页 + i18n）；框架 **12/13** 口径（剩余 Spring Boot 需 Java 支持先行）
+- **验证**：23 个新单测（Go 提取器 8 + Gin 8 + Fiber 7）；全套件 **204/204**；Python 盲测 v1.2 64 零漂移；C 演示不变；check 免疫正常
+
+## [3.7.12] — 2026-09-01
+
+### Koa + Hapi 框架结构适配——10/13
+
+- **Koa（第 9 个）**：`src/frameworks/koa-detector.ts`（代码串级，镜像 express/koa 中间件模式）——`KOA_ROUTE_NO_AUTH`：mutation 路由注册中间件链无认证名中间件，且文件内无认证 `app.use` 全局中间件；认证名按词表分类（auth/login/permission/jwt/verify/guard…）；GET 读操作与认证入口路径豁免
+- **Hapi（第 10 个）**：`src/frameworks/hapi-detector.ts`（路由配置模式）——`HAPI_ROUTE_NO_AUTH`：mutation 路由 options 无 auth 字段或显式 `auth: false`（显式公开 mutation 检出）；`auth: 'strategy'` / `auth: { strategy: 'x' }` 两种形态均识别为受保护；`auth.strategy` 声明被记录
+- **引擎接线**：collectKoaViolations / collectHapiViolations + overall `koaCoverage`/`hapiCoverage`（加性 best-effort）；frameworks barrel 补全（11 个适配器模块）
+- **验证**：15 个新单测（koa 7 + hapi 8，含显式 auth:false 与 strategy 对象形态）；引擎冒烟：Koa 全局认证中间件 0 误报 APPROVED 90、Hapi 无 auth 路由检出 + login 豁免 APPROVED 87；全套件 **181/181**；Python 盲测 v1.2 64 零漂移
+- **文档**：10/13 口径（README 双语/覆盖矩阵双语/CLAUDE.md/落地页 + Koa/Hapi 矩阵行）
+- **边界（如实）**：文件级窗口（跨文件全局中间件不可见，与 Express 检测器同款）；认证中间件按名词语汇识别；Hapi 路由窗口 500 字符（超长配置截断）
+
 ## [3.7.11] — 2026-09-01
 
 ### NestJS 补全——框架适配 8/13

package/README.md

@@ -104,11 +104,12 @@ Progmune is honest about what it can and cannot verify.
 | **TypeScript / JavaScript** | ✅ Production | Blind benchmark: **recall 98.5% / precision 100%** (795 gold findings, 100 projects) |
 | **Python** | ✅ Production | Blind benchmark: **recall 100% / precision 100%** (729 gold findings, 90 projects); real-world validation: PyGoat (OWASP vulnerable-by-design Django app) **67 TP / 0 FP, 100% labeled precision**; three well-written apps (django/fastapi realworld, django-unicorn) with 0 false-positive true findings |
 | **C** | ✅ Annotation-driven (Beta) | IR extraction via the registry + SSG state machine; **annotate ~2-3 protocol primitives per protocol to get trusted verification** (gold 5/5 on real modules: redis ACL / libssh client / libssh server / libssh callback-dispatch / uftpd transfer-auth — all 0 FP with precise violation localization; app-level gold v2: **P=91.7% / R=100% / F1=95.7%**). Unannotated auto-detection stays out of scope (0 TP on real corpus — positioning decision recorded in the C Language Status doc); TLS-level coverage still absent. See [C Language Status](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/c-language-status.md). |
-| **Go, Java** | ❌ None | Planned |
+| **Go** | ✅ Annotation-driven (Beta) | IR extraction via registry + SSG state machine; synthetic gold v1: **P=100% / R=100%** (clean×3 + violations×3); zero external toolchain (pure-TS lexical extractor — works from npm installs) |
+| **Java** | ❌ None | Planned |
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 8/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) and NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 12/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +235,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (8/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (12/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -104,11 +104,12 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 | **TypeScript / JavaScript** | ✅ 生产 | 盲测基准：**召回 98.5% / 精确率 100%**（795 条 gold finding，100 个项目） |
 | **Python** | ✅ 生产 | 盲测基准：**召回 100% / 精确率 100%**（729 条 gold finding，90 个项目）；真实应用验证：PyGoat（OWASP 故意脆弱 Django 应用）**67 TP / 0 FP，标记精确率 100%**；三个良构应用（django/fastapi realworld、django-unicorn）0 误报真阳性 |
 | **C** | ✅ 注解驱动（Beta） | IR 提取接入注册表 + SSG 状态机；**每协议标注 ~2-3 个原语即获得可信验证**（真实模块金标 5/5：redis ACL / libssh 客户端 / libssh 服务端 / libssh 回调分发 / uftpd 传送授权——全部 0 误报 + 违规精确定位；应用级金标 v2：**P=91.7% / R=100% / F1=95.7%**）。未注解自动检测不在范围（真实语料 0 TP——定位决议见 C 语言状态文档）；TLS 级覆盖仍无。见 [C 语言状态](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/c-language-status.md)。 |
-| **Go, Java** | ❌ 无 | 规划中 |
+| **Go** | ✅ 注解驱动（Beta） | IR 提取接入注册表 + SSG 状态机；合成金标 v1：**P=100% / R=100%**（3 干净 × 3 植入违规）；零外部工具链（纯 TS 词法提取，npm 安装态可用） |
+| **Java** | ❌ 无 | 规划中 |
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：8/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）与 NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：12/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +234,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（8/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（12/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/extract-ir-go.js

@@ -0,0 +1,383 @@
+"use strict";
+/**
+ * Go IR Extractor — pure-TS function extraction for the merged multi-language
+ * registry (extract-project-ir.ts LANGUAGE_EXTRACTORS)。无子进程、无 Go
+ * 工具链依赖（npm 安装态可用——与 C 提取器同哲学，区别于 Python 桥）。
+ *
+ * Route: the registry "go" entry calls extractIRGo; the result merges into
+ * the same FunctionInfo list as TypeScript/Python/C and flows into
+ * call-sequence (P4.6), SSG validation and the agent loop with no rewiring.
+ *
+ * Extraction is a best-effort lexical parse of Go definitions:
+ *   - func Name(params) returns { ... }       普通函数
+ *   - func (r *Repo) Name(params) returns { } 接收者方法（方法名=Name）
+ *   - 多行签名（平衡括号）、返回值类型 best-effort 记录
+ *   - 直接调用提取（obj.Method() 取 Method——与 C 成员调用同规则）
+ *   - 注释注解：// @progmune(namespace=..., pre=[...], post=[...])
+ *     + @purpose/@tags/@requires/@produces/@useWhen/@inputs/@outputs 文档标签
+ *   - exported = 首字母大写（Go 语言约定）
+ *
+ * Known limits（如实）:
+ *   - 接口方法/函数值分发静态不可见（interface 与 func 变量同 L3 边界）
+ *   - 泛型类型参数（func F[T any](...)）best-effort 剥除，不做完整解析
+ *   - 无数据流/指针分析——与 C 的 L3/L4 结论同源
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractIRGo = extractIRGo;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ── Constants ──
+const GO_EXTENSIONS = new Set([".go"]);
+/** Walk skip set（生产表面守卫，与 C/Python 提取器口径一致）。 */
+const SKIP_DIRS = new Set([
+    "vendor", "testdata", "test", "tests", "examples", "example", "docs",
+    "doc", "third_party", "node_modules", ".git", "scripts", "tools",
+]);
+/** Go 关键字/内置（调用提取时排除）。 */
+const GO_KEYWORDS = new Set([
+    "break", "case", "chan", "const", "continue", "default", "defer", "else",
+    "fallthrough", "for", "func", "go", "goto", "if", "import", "interface",
+    "map", "package", "range", "return", "select", "struct", "switch", "type",
+    "var", "append", "cap", "close", "complex", "copy", "delete", "imag",
+    "len", "make", "new", "panic", "print", "println", "real", "recover",
+]);
+function isTestFilename(name) {
+    return name.endsWith("_test.go");
+}
+function maskLine(line, state) {
+    let out = "";
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        const next = line[i + 1];
+        if (state.inBlock) {
+            if (ch === "*" && next === "/") {
+                state.inBlock = false;
+                i++;
+            }
+            out += " ";
+        }
+        else if (state.inString) {
+            if (ch === "\\") {
+                out += "  ";
+                i++;
+            }
+            else if (ch === '"') {
+                state.inString = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else if (state.inRaw) {
+            if (ch === "`") {
+                state.inRaw = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else if (state.inRune) {
+            if (ch === "\\") {
+                out += "  ";
+                i++;
+            }
+            else if (ch === "'") {
+                state.inRune = false;
+                out += " ";
+            }
+            else
+                out += " ";
+        }
+        else {
+            if (ch === "/" && next === "*") {
+                state.inBlock = true;
+                i++;
+                out += "  ";
+            }
+            else if (ch === "/" && next === "/") {
+                out += "  ";
+                break;
+            }
+            else if (ch === '"') {
+                state.inString = true;
+                out += " ";
+            }
+            else if (ch === "`") {
+                state.inRaw = true;
+                out += " ";
+            }
+            else if (ch === "'") {
+                state.inRune = true;
+                out += " ";
+            }
+            else
+                out += ch;
+        }
+    }
+    return out;
+}
+function parseGoAnnotation(text) {
+    const m = text.match(/@progmune\s*\(\s*([^)]*)\)/);
+    if (!m)
+        return null;
+    const body = m[1];
+    const ann = { pre_states: [], post_states: [] };
+    const ns = body.match(/namespace\s*=\s*"([^"]+)"/);
+    if (ns)
+        ann.namespace = ns[1];
+    const states = (key) => {
+        const mm = body.match(new RegExp(`${key}\\s*=\\s*\\[([^\\]]*)\\]`));
+        if (!mm)
+            return [];
+        const vals = mm[1].match(/"([^"]+)"/g) || [];
+        return vals.map((v) => v.slice(1, -1));
+    };
+    ann.pre_states = states("pre");
+    ann.post_states = states("post");
+    const inv = states("invalidate");
+    if (inv.length > 0)
+        ann.invalidate = inv;
+    return ann;
+}
+function docTag(text, tag) {
+    const m = text.match(new RegExp(`@${tag}\\s+([^\\n*]+)`));
+    return m ? m[1].trim() : undefined;
+}
+// ── 调用提取 ──
+function extractCallsFromBody(body) {
+    const calls = new Set();
+    const re = /([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(body)) !== null) {
+        const name = m[1];
+        if (GO_KEYWORDS.has(name))
+            continue;
+        if (GO_KEYWORDS.has(name))
+            continue;
+        calls.add(name);
+    }
+    return Array.from(calls);
+}
+// ── 顶层参数切分 ──
+function splitTopLevelParams(s) {
+    const parts = [];
+    let depth = 0;
+    let cur = "";
+    for (const ch of s) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            depth++;
+        if (ch === ")" || ch === "]" || ch === "}")
+            depth--;
+        if (ch === "," && depth === 0) {
+            parts.push(cur.trim());
+            cur = "";
+        }
+        else
+            cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur.trim());
+    return parts.filter(Boolean);
+}
+// ── 单文件提取 ──
+function extractGoFile(filePath) {
+    let content;
+    try {
+        content = fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const lines = content.split("\n");
+    const functions = [];
+    for (let i = 0; i < lines.length; i++) {
+        // 函数定义行：func Name( 或 func (receiver) Name(
+        const plain = lines[i].match(/^\s*func\s+([A-Za-z_][A-Za-z0-9_]*)/);
+        const receiver = lines[i].match(/^\s*func\s*\([^)]*\)\s*([A-Za-z_][A-Za-z0-9_]*)/);
+        const name = plain ? plain[1] : receiver ? receiver[1] : null;
+        if (!name)
+            continue;
+        // 多行签名：从 func 起拼接直到找到 { 或 ;
+        let sigText = lines[i];
+        let j = i;
+        while (!sigText.includes("{") && !sigText.includes(";") && j < lines.length - 1) {
+            j++;
+            sigText += "\n" + lines[j];
+        }
+        const braceIdx = sigText.indexOf("{");
+        if (braceIdx < 0)
+            continue; // 接口方法声明（无函数体）
+        const signature = sigText.slice(0, braceIdx);
+        // 注释块注解：函数定义行上方的连续注释（// 与 /* */）
+        const commentLines = [];
+        for (let k = i - 1; k >= 0; k--) {
+            const t = lines[k].trim();
+            if (t.startsWith("//") || t.startsWith("/*") || t.startsWith("*")) {
+                commentLines.unshift(t);
+            }
+            else if (t === "") {
+                if (commentLines.length === 0)
+                    continue;
+                break;
+            }
+            else {
+                break;
+            }
+        }
+        const commentText = commentLines.join("\n");
+        // 注解解析
+        let protocol;
+        const ann = parseGoAnnotation(commentText);
+        if (ann) {
+            protocol = {
+                pre_states: ann.pre_states,
+                post_states: ann.post_states,
+                ...(ann.invalidate ? { invalidate: ann.invalidate } : {}),
+                ...(ann.namespace ? { namespace: ann.namespace } : {}),
+            };
+        }
+        const purpose = docTag(commentText, "purpose");
+        const tags = docTag(commentText, "tags")?.split(/[,\s]+/).filter(Boolean);
+        const requires = docTag(commentText, "requires")?.split(/[,\s]+/).filter(Boolean);
+        const produces = docTag(commentText, "produces")?.split(/[,\s]+/).filter(Boolean);
+        const useWhen = docTag(commentText, "useWhen")?.split(/[,\s]+/).filter(Boolean);
+        // 参数列表：签名中第一个 ( ... )
+        const openParen = signature.indexOf("(");
+        const closeParen = signature.indexOf(")", openParen);
+        let params = [];
+        if (openParen >= 0 && closeParen > openParen) {
+            params = splitTopLevelParams(signature.slice(openParen + 1, closeParen));
+        }
+        // 返回类型：签名尾部（剥除泛型括号）
+        const returnType = signature.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
+        // 函数体：从签名行（j）的 { 起逐行扫描到匹配 }（掩码后括号平衡，
+        // 增量计数——每行只数一次，避免累积体重复计数）
+        let body = "";
+        let depth = 0;
+        let started = false;
+        let endLine = j;
+        const bodyMask = { inBlock: false, inString: false, inRaw: false, inRune: false };
+        for (let li = j; li < lines.length; li++) {
+            const maskedLine = maskLine(lines[li], bodyMask);
+            if (!started) {
+                const b = maskedLine.indexOf("{");
+                if (b < 0)
+                    continue; // 多行签名的后续行还没到 {
+                started = true;
+                for (const ch of maskedLine.slice(b)) {
+                    if (ch === "{")
+                        depth++;
+                    else if (ch === "}")
+                        depth--;
+                }
+            }
+            else {
+                for (const ch of maskedLine) {
+                    if (ch === "{")
+                        depth++;
+                    else if (ch === "}")
+                        depth--;
+                }
+            }
+            body += lines[li] + "\n";
+            if (depth === 0) {
+                endLine = li;
+                break;
+            }
+        }
+        if (!started || depth !== 0)
+            continue;
+        // 调用提取（掩码态重置后重扫完整函数体）
+        const resetMask = { inBlock: false, inString: false, inRaw: false, inRune: false };
+        const maskedBody = body.split("\n").map((l) => maskLine(l, resetMask)).join("\n");
+        const calls = extractCallsFromBody(maskedBody).filter((c) => c !== name);
+        functions.push({
+            name,
+            file: filePath,
+            params: params.map((p) => ({ name: p.split(/[\s\[\]]/)[0] || p, type: p })),
+            returnType: returnType || "unknown",
+            calls,
+            exported: /^[A-Z]/.test(name),
+            tags: tags && tags.length > 0 ? tags : undefined,
+            ...(purpose ? { purpose } : {}),
+            ...(requires && requires.length > 0 ? { requires } : {}),
+            ...(produces && produces.length > 0 ? { produces } : {}),
+            ...(useWhen && useWhen.length > 0 ? { useWhen } : {}),
+            ...(protocol ? { protocol } : {}),
+        });
+        i = endLine; // 跳过已消费的行
+    }
+    return functions;
+}
+// ── 项目级入口（注册表调用） ──
+function collectGoFiles(root) {
+    const files = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.isSymbolicLink())
+                continue;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (SKIP_DIRS.has(e.name))
+                    continue;
+                walk(full);
+            }
+            else if (GO_EXTENSIONS.has(path.extname(e.name)) && !isTestFilename(e.name)) {
+                files.push(full);
+            }
+        }
+    };
+    walk(root);
+    return files;
+}
+function extractIRGo(projectRoot) {
+    const files = collectGoFiles(projectRoot);
+    const all = [];
+    for (const file of files) {
+        for (const fn of extractGoFile(file)) {
+            fn.file = path.relative(projectRoot, fn.file);
+            all.push(fn);
+        }
+    }
+    return all;
+}

package/dist/extract-ir-go.test.js

@@ -0,0 +1,179 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * extract-ir-go.test.ts — Go IR 提取器回归（临时目录夹具）
+ *
+ * 纯 TS 词法提取（与 C 提取器同哲学）：函数签名（多行/接收者方法）、
+ * 调用（obj.Method() 取 Method）、注释注解 @progmune + 文档标签、
+ * exported=首字母大写、非生产表面过滤。
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_go_1 = require("./extract-ir-go");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "go-ir-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function write(rel, content) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, content);
+}
+(0, vitest_1.describe)("extract-ir-go", () => {
+    (0, vitest_1.it)("普通函数 + 调用提取（含 obj.Method() 成员调用）", () => {
+        write("main.go", `
+package main
+
+func doWork() {
+	helper()
+	obj.Save()
+}
+
+func helper() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const doWork = ir.find((f) => f.name === "doWork");
+        (0, vitest_1.expect)(doWork?.calls).toEqual(vitest_1.expect.arrayContaining(["helper", "Save"]));
+    });
+    (0, vitest_1.it)("接收者方法（func (r *Repo) Name）", () => {
+        write("repo.go", `
+package main
+
+func (r *Repo) SaveUser(u User) error {
+	return nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.some((f) => f.name === "SaveUser")).toBe(true);
+        (0, vitest_1.expect)(ir.find((f) => f.name === "SaveUser")?.exported).toBe(true);
+    });
+    (0, vitest_1.it)("多行签名 + 返回类型", () => {
+        write("multi.go", `
+package main
+
+func Process(
+	name string,
+	count int,
+) (string, error) {
+	return name, nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "Process");
+        (0, vitest_1.expect)(fn).toBeTruthy();
+        (0, vitest_1.expect)(fn?.returnType).toContain("string");
+    });
+    (0, vitest_1.it)("注释注解 @progmune + 文档标签", () => {
+        write("auth.go", `
+package main
+
+// @progmune(namespace="auth", pre=["UNAUTHENTICATED"], post=["PASSWORD_VERIFIED"])
+// @purpose 凭证比对
+// @tags auth
+func VerifyPassword(user, password string) bool {
+	return password == "secret"
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "VerifyPassword");
+        (0, vitest_1.expect)(fn?.protocol?.pre_states).toEqual(["UNAUTHENTICATED"]);
+        (0, vitest_1.expect)(fn?.protocol?.post_states).toEqual(["PASSWORD_VERIFIED"]);
+        (0, vitest_1.expect)(fn?.protocol?.namespace).toBe("auth");
+        (0, vitest_1.expect)(fn?.purpose).toBe("凭证比对");
+        (0, vitest_1.expect)(fn?.tags).toContain("auth");
+        (0, vitest_1.expect)(fn?.exported).toBe(true);
+    });
+    (0, vitest_1.it)("接口方法声明（无函数体）不提取", () => {
+        write("iface.go", `
+package main
+
+type Store interface {
+	Save(u User) error
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.some((f) => f.name === "Save")).toBe(false);
+    });
+    (0, vitest_1.it)("字符串/注释里的伪调用不提取", () => {
+        write("str.go", `
+package main
+
+func tricky() {
+	s := "notAFunction() inside string"
+	// notAFunction() in comment
+	realCall()
+}
+
+func realCall() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "tricky");
+        (0, vitest_1.expect)(fn?.calls).toContain("realCall");
+        (0, vitest_1.expect)(fn?.calls).not.toContain("notAFunction");
+    });
+    (0, vitest_1.it)("非生产表面过滤：vendor/testdata/测试文件跳过", () => {
+        write("main.go", `package main\nfunc Keep() {}\n`);
+        write("vendor/dep.go", `package dep\nfunc SkipVendor() {}\n`);
+        write("testdata/sample.go", `package sample\nfunc SkipTestdata() {}\n`);
+        write("x_test.go", `package main\nfunc SkipTest() {}\n`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        (0, vitest_1.expect)(ir.map((f) => f.name)).toEqual(["Keep"]);
+    });
+    (0, vitest_1.it)("Go 关键字不提取为调用（for/if/go/defer 等）", () => {
+        write("ctrl.go", `
+package main
+
+func run() {
+	for i := 0; i < 3; i++ {
+		go step(i)
+		defer cleanup()
+	}
+}
+
+func step(i int) {}
+func cleanup() {}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "run");
+        (0, vitest_1.expect)(fn?.calls).toEqual(vitest_1.expect.arrayContaining(["step", "cleanup"]));
+        (0, vitest_1.expect)(fn?.calls).not.toEqual(vitest_1.expect.arrayContaining(["for", "go", "defer", "if"]));
+    });
+});

package/dist/extract-project-ir.js

@@ -54,6 +54,7 @@ const path = __importStar(require("path"));
 const extract_ir_1 = require("./extract-ir");
 const extract_ir_python_1 = require("./extract-ir-python");
 const extract_ir_c_1 = require("./extract-ir-c");
+const extract_ir_go_1 = require("./extract-ir-go");
 const SKIP_DIRS = new Set([
     "node_modules", "dist", "build", ".git", ".progmune_corpus",
     "__pycache__", "venv", ".venv",
@@ -105,6 +106,11 @@ exports.LANGUAGE_EXTRACTORS = [
         detect: (p) => hasSourceFiles(p, new Set([".c", ".h"])),
         extract: (p) => (0, extract_ir_c_1.extractIRC)(p),
     },
+    {
+        language: "go",
+        detect: (p) => hasSourceFiles(p, new Set([".go"])),
+        extract: (p) => (0, extract_ir_go_1.extractIRGo)(p),
+    },
 ];
 /** 项目检测到的语言列表（审计/标签用）。 */
 function detectLanguages(projectRoot) {