progmune-runtime 3.7.11 → 3.7.13

package/dist/frameworks/koa-detector.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Koa Framework Adapter — Protocol Detection for Koa
+ *
+ * 第 9 个框架适配（TS/JS 第 5 个专用检测器，代码串级镜像 express-detector）：
+ *
+ *   app.use(authMiddleware)                    全局认证中间件
+ *   router.post('/x', authMW, handler)         路由级认证中间件链
+ *
+ * 规则：
+ *   KOA_ROUTE_NO_AUTH        mutation 路由注册（post/put/patch/delete/del）
+ *                            中间件链里没有认证名中间件，且文件内无认证
+ *                            全局 app.use——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/login/permission/token/session/
+ *     jwt/verify/guard）；自定义认证名不含词表漏判（保守方向=漏报）
+ *   - 文件级窗口（与 Express 检测器同款）：跨文件注册的全局中间件不可见
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeKoaApp = analyzeKoaApp;
+exports.analyzeKoaFile = analyzeKoaFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete", "del"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeKoaApp(code) {
+    const issues = [];
+    const routes = [];
+    const authGlobalMiddleware = [];
+    const hasKoa = /\bKoa\b|\bkoa\b/.test(code);
+    if (!hasKoa) {
+        return { hasKoa: false, routes, authGlobalMiddleware, issues };
+    }
+    // 全局认证中间件：app.use(authFn)
+    const useRe = /\.use\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGlobalMiddleware.push(m[1]);
+    }
+    // 路由注册：router.post('/x', mw1, mw2, handler) / .del()
+    const routeRe = /\.(get|post|put|patch|delete|del)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase() === "del" ? "delete" : m[1].toLowerCase();
+        const pathName = m[2];
+        // 从路径串向后截 300 字符窗口，收集中间件名（认证名判定）
+        const windowStart = m.index + m[0].length;
+        const window = code.slice(windowStart, windowStart + 300);
+        const mwNames = window.match(/[A-Za-z_$][\w$]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authGlobalMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "KOA_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and the app registers no auth middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasKoa: true, routes, authGlobalMiddleware, issues };
+}
+function analyzeKoaFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/from\s+['"]koa|require\(['"]koa/.test(code))
+        return null;
+    return analyzeKoaApp(code);
+}

package/dist/frameworks/koa-detector.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * koa-detector.test.ts — Koa 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const koa_detector_1 = require("./koa-detector");
+const app = (routes, extra = "") => `
+import Koa from "koa";
+import Router from "@koa/router";
+const app = new Koa();
+const router = new Router();
+${extra}
+${routes}
+app.use(router.routes());
+`;
+(0, vitest_1.describe)("koa-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → KOA_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", authenticate, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：全局 app.use 认证中间件保护不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`router.post("/transfer", async (ctx) => { ctx.body = "ok"; });`, `app.use(authenticate);`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件（日志）不视为保护", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/transfer", logger, async (ctx) => { ctx.body = "ok"; });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("KOA_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.get("/articles", async (ctx) => { ctx.body = []; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, koa_detector_1.analyzeKoaApp)(app(`
+router.post("/login", async (ctx) => { ctx.body = "token"; });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Koa 代码不产生任何问题", () => {
+        const { hasKoa, issues } = (0, koa_detector_1.analyzeKoaApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasKoa).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.11";
+exports.RUNTIME_VERSION = "3.7.13";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -67,11 +67,16 @@ const django_detector_1 = require("../frameworks/django-detector");
 const flask_detector_1 = require("../frameworks/flask-detector");
 const fastify_detector_1 = require("../frameworks/fastify-detector");
 const nextjs_detector_1 = require("../frameworks/nextjs-detector");
+const koa_detector_1 = require("../frameworks/koa-detector");
+const hapi_detector_1 = require("../frameworks/hapi-detector");
+const gin_detector_1 = require("../frameworks/gin-detector");
+const fiber_detector_1 = require("../frameworks/fiber-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
 const extract_ir_python_1 = require("../extract-ir-python");
 const extract_ir_c_1 = require("../extract-ir-c");
+const extract_ir_go_1 = require("../extract-ir-go");
 // ── Main Entry Point ──
 /**
  * Trust 决策主入口：收集 → 归一化 → 评分 → 决策 → 组装。
@@ -102,6 +107,10 @@ async function evaluateTrust(ctx) {
     const flaskResult = collectFlaskViolations(ctx);
     const fastifyResult = collectFastifyViolations(ctx);
     const nextjsResult = collectNextjsViolations(ctx);
+    const koaResult = collectKoaViolations(ctx);
+    const hapiResult = collectHapiViolations(ctx);
+    const ginResult = collectGinViolations(ctx);
+    const fiberResult = collectFiberViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -124,6 +133,10 @@ async function evaluateTrust(ctx) {
         ...flaskResult.violations,
         ...fastifyResult.violations,
         ...nextjsResult.violations,
+        ...koaResult.violations,
+        ...hapiResult.violations,
+        ...ginResult.violations,
+        ...fiberResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -288,6 +301,42 @@ async function evaluateTrust(ctx) {
                     issuesFound: nextjsResult.violations.length,
                 }
                 : undefined,
+            /** Koa framework adapter coverage — route/auth-middleware analysis */
+            koaCoverage: koaResult.coverage.routes > 0
+                ? {
+                    appsDetected: koaResult.coverage.apps,
+                    totalRoutes: koaResult.coverage.routes,
+                    filesScanned: koaResult.coverage.filesScanned,
+                    issuesFound: koaResult.violations.length,
+                }
+                : undefined,
+            /** Hapi framework adapter coverage — route-config auth analysis */
+            hapiCoverage: hapiResult.coverage.routes > 0
+                ? {
+                    appsDetected: hapiResult.coverage.apps,
+                    totalRoutes: hapiResult.coverage.routes,
+                    filesScanned: hapiResult.coverage.filesScanned,
+                    issuesFound: hapiResult.violations.length,
+                }
+                : undefined,
+            /** Gin framework adapter coverage — Go route/auth-middleware analysis */
+            ginCoverage: ginResult.coverage.routes > 0
+                ? {
+                    appsDetected: ginResult.coverage.apps,
+                    totalRoutes: ginResult.coverage.routes,
+                    filesScanned: ginResult.coverage.filesScanned,
+                    issuesFound: ginResult.violations.length,
+                }
+                : undefined,
+            /** Fiber framework adapter coverage — Go route/auth-middleware analysis */
+            fiberCoverage: fiberResult.coverage.routes > 0
+                ? {
+                    appsDetected: fiberResult.coverage.apps,
+                    totalRoutes: fiberResult.coverage.routes,
+                    filesScanned: fiberResult.coverage.filesScanned,
+                    issuesFound: fiberResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -426,6 +475,168 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectGoFrameworkViolations(ctx, analyzer, rulePrefix, fixText, policyRef) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        // Go 项目结构特殊：cmd/internal/pkg + 根目录 main.go 都要扫
+        const candidateDirs = ["cmd", "internal", "pkg", "src", "server", "app", "api", "routes", "lib", "handlers", "middleware"];
+        const extensions = languageToExtensions(ctx.language);
+        const files = [];
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            try {
+                files.push(...walkDir(dirPath, extensions, 100));
+            }
+            catch { /* skip */ }
+        }
+        try {
+            for (const entry of fs.readdirSync(ctx.projectPath)) {
+                const full = path.join(ctx.projectPath, entry);
+                if (!fs.statSync(full).isFile())
+                    continue;
+                if (extensions.some((ext) => entry.endsWith(ext)))
+                    files.push(full);
+            }
+        }
+        catch { /* best-effort */ }
+        for (const file of files) {
+            if (file.includes("_test."))
+                continue;
+            coverage.filesScanned++;
+            try {
+                const analysis = analyzer(file);
+                if (!analysis || !analysis[`has${rulePrefix}`])
+                    continue;
+                coverage.apps++;
+                coverage.routes += analysis.routes.length;
+                for (const issue of analysis.issues) {
+                    violations.push({
+                        severity: issue.severity === "low" ? "low" : issue.severity,
+                        rule_id: issue.rule,
+                        file: path.relative(ctx.projectPath, file),
+                        function: "unknown",
+                        message: issue.message,
+                        evidence: issue.route || "",
+                        why: `Framework structural analysis: ${issue.message}`,
+                        fix: fixText,
+                        policy_ref: policyRef,
+                    });
+                }
+            }
+            catch { /* skip unreadable files */ }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectGinViolations(ctx) {
+    return collectGoFrameworkViolations(ctx, gin_detector_1.analyzeGinFile, "Gin", "Add an auth middleware to the route registration, or register auth middleware with r.Use/r.Group.", "framework-safety.gin");
+}
+function collectFiberViolations(ctx) {
+    return collectGoFrameworkViolations(ctx, fiber_detector_1.analyzeFiberFile, "Fiber", "Add an auth middleware to the route registration, or register auth middleware with app.Use.", "framework-safety.fiber");
+}
+function collectKoaViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, koa_detector_1.analyzeKoaFile)(file);
+                    if (!analysis || !analysis.hasKoa)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth middleware to the route registration, or register an auth middleware globally with app.use.`,
+                            policy_ref: "framework-safety.koa",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectHapiViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, hapi_detector_1.analyzeHapiFile)(file);
+                    if (!analysis || !analysis.hasHapi)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add an auth strategy reference to the route options (auth: "<strategy>"), or remove the explicit auth: false.`,
+                            policy_ref: "framework-safety.hapi",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
 function collectNextjsViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };
@@ -999,6 +1210,7 @@ async function collectProtocolViolations(ctx, callGraph) {
                 javascript: () => (0, extract_ir_1.extractIR)(ctx.projectPath),
                 python: () => (0, extract_ir_python_1.extractIRPython)(ctx.projectPath),
                 c: () => (0, extract_ir_c_1.extractIRC)(ctx.projectPath),
+                go: () => (0, extract_ir_go_1.extractIRGo)(ctx.projectPath),
             };
             const extractFn = autoExtractor[lang];
             if (extractFn) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.11",
+  "version": "3.7.13",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",