progmune-runtime 3.7.13 → 3.7.14

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [3.7.14] — 2026-09-02
+
+### Go 提取器修复 + 恢复率裁决 + 框架诚实分层 + 三语料实验
+
+- **提取器两处修复**：①无函数体声明行（`//go:linkname` 类）吞并下一个函数（Getuid/RoundTrip 漏检根因——与 C 3.7.4「# 行吞函数」同族）；②接收者方法 receiver 括号组误当参数组（returnType 取到整签名）——回归测试锁定
+- **恢复率裁决**（评审第 3 条落地）：tools/go-fn-list.go（go/parser 金标，同一文件集+只计有体函数）+ scan-go-recovery.ts——stdlib 四包 **2434/2434 = 100.0%** → **维持纯词法，go/parser 桥推迟**
+- **命名鸿沟测量**（孵化器理论核心数据）：词段可桥接 0-1.9%——Go stdlib 惯用命名无法桥接内置规则词汇（与 C 命名鸿沟同构）
+- **框架诚实分层**（评审第 5 条落地）：「12/13 结构级」→「**12 专用检测器 = 4 结构级（AST：NestJS/FastAPI/Django/Flask）+ 8 启发式（代码串：Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）**」；转正门槛 = 真实项目 FP 数据点；CLAUDE.md 矛盾行修复；落地页/矩阵/README 双语同步
+- **Go 三语料实验**（REALWORLD_GO_V1.md，评审第 4 条落地）：stdlib 4 FP 全 FP（readColonFile 词段桥接跨窗口类）；govwa（vendored benchmarks/go-apps/）B 路径 0 flags；**A 路径 demo-real-go-govwa**：真实代码 3 注解（loginAction=verify/SetSession=establish/AuthCheck=guard）→ 0 FP + 植入违规精确定位 + 3 注解/协议——**Go 定位维持注解驱动（Beta）**
+- **TS 795 完整复跑**（评审第 6 条落地）：recall 98.5%（有效 100%）/ precision 100% / FP 0——12 个框架探测器全上线后与历史基线一致
+- 验证：35 定向测试；Python 盲测 v1.2 64 零漂移；check 免疫正常
+
 ## [3.7.13] — 2026-09-02
 
 ### Go 语言支持 + Gin/Fiber 框架适配——12/13

package/README.md

@@ -109,7 +109,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 12/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 12 dedicated detectors (4 structural + 8 heuristic).** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -235,7 +235,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (12/13)
+- **Framework Adapters:** 12 dedicated detectors — 4 structural (NestJS/FastAPI/Django/Flask) + 8 heuristic (Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -109,7 +109,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：12/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：12 专用检测器（4 结构级 + 8 启发式）。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。结构级 = AST 解析（NestJS/FastAPI/Django/Flask——合成金标 P=R=100%）；启发式 = 代码串模式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber——单测覆盖，真实项目 FP 数据待补）。Spring Boot 待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -234,7 +234,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（12/13）
+- **框架适配器：** 12 专用检测器——4 结构级（NestJS/FastAPI/Django/Flask）+ 8 启发式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/extract-ir-go.js

@@ -230,11 +230,15 @@ function extractGoFile(filePath) {
         const name = plain ? plain[1] : receiver ? receiver[1] : null;
         if (!name)
             continue;
-        // 多行签名：从 func 起拼接直到找到 { 或 ;
+        // 多行签名：从 func 起拼接直到找到 { 或 ;——遇到下一个 func 行即停
+        // （无函数体声明行如 `func runtime_args() []string // in package runtime`
+        // 不能吞掉紧随其后的函数定义——proc.go::Getuid 漏检根因）
         let sigText = lines[i];
         let j = i;
         while (!sigText.includes("{") && !sigText.includes(";") && j < lines.length - 1) {
             j++;
+            if (/^\s*func\b/.test(lines[j]) && j > i)
+                break;
             sigText += "\n" + lines[j];
         }
         const braceIdx = sigText.indexOf("{");
@@ -274,15 +278,47 @@ function extractGoFile(filePath) {
         const requires = docTag(commentText, "requires")?.split(/[,\s]+/).filter(Boolean);
         const produces = docTag(commentText, "produces")?.split(/[,\s]+/).filter(Boolean);
         const useWhen = docTag(commentText, "useWhen")?.split(/[,\s]+/).filter(Boolean);
-        // 参数列表：签名中第一个 ( ... )
-        const openParen = signature.indexOf("(");
-        const closeParen = signature.indexOf(")", openParen);
+        // 参数列表：签名中第一个 ( ... )——接收者方法的 receiver 括号组要先跳过
+        // （bug 修复：func (s *Service) Login(...) 的 (s *Service) 曾被当作参数组，
+        // returnType 取到整个签名）
+        let sigAfterReceiver = signature;
+        if (receiver) {
+            let depth = 0;
+            for (let ci = signature.indexOf("("); ci < signature.length; ci++) {
+                if (signature[ci] === "(")
+                    depth++;
+                else if (signature[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        sigAfterReceiver = signature.slice(ci + 1);
+                        break;
+                    }
+                }
+            }
+        }
+        const openParen = sigAfterReceiver.indexOf("(");
+        let closeParen = -1;
+        if (openParen >= 0) {
+            // 平衡括号匹配（参数可含 func 类型嵌套括号）
+            let depth = 0;
+            for (let ci = openParen; ci < sigAfterReceiver.length; ci++) {
+                if (sigAfterReceiver[ci] === "(")
+                    depth++;
+                else if (sigAfterReceiver[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        closeParen = ci;
+                        break;
+                    }
+                }
+            }
+        }
         let params = [];
         if (openParen >= 0 && closeParen > openParen) {
-            params = splitTopLevelParams(signature.slice(openParen + 1, closeParen));
+            params = splitTopLevelParams(sigAfterReceiver.slice(openParen + 1, closeParen));
         }
         // 返回类型：签名尾部（剥除泛型括号）
-        const returnType = signature.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
+        const returnType = sigAfterReceiver.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
         // 函数体：从签名行（j）的 { 起逐行扫描到匹配 }（掩码后括号平衡，
         // 增量计数——每行只数一次，避免累积体重复计数）
         let body = "";

package/dist/extract-ir-go.test.js

@@ -85,6 +85,23 @@ func (r *Repo) SaveUser(u User) error {
         (0, vitest_1.expect)(ir.some((f) => f.name === "SaveUser")).toBe(true);
         (0, vitest_1.expect)(ir.find((f) => f.name === "SaveUser")?.exported).toBe(true);
     });
+    (0, vitest_1.it)("接收者方法 returnType 与参数正确（receiver 括号组不被误取——回归）", () => {
+        write("svc.go", `
+package main
+
+func (s *Service) Login(ctx Context, user, password string) (Token, error) {
+	return Token{}, nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "Login");
+        (0, vitest_1.expect)(fn?.returnType).toBe("(Token, error)");
+        // Go 语义：ctx / user / password 是 3 个参数（user 与 password 共享类型）
+        (0, vitest_1.expect)(fn?.params).toHaveLength(3);
+        (0, vitest_1.expect)(fn?.params[0].type).toContain("ctx");
+        (0, vitest_1.expect)(fn?.params[1].type).toContain("user");
+        (0, vitest_1.expect)(fn?.params[2].type).toContain("string");
+    });
     (0, vitest_1.it)("多行签名 + 返回类型", () => {
         write("multi.go", `
 package main

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.13";
+exports.RUNTIME_VERSION = "3.7.14";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.13",
+  "version": "3.7.14",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",