progmune-runtime 3.7.13 → 3.7.15

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [3.7.14] — 2026-09-02
+
+### Go 提取器修复 + 恢复率裁决 + 框架诚实分层 + 三语料实验
+
+- **提取器两处修复**：①无函数体声明行（`//go:linkname` 类）吞并下一个函数（Getuid/RoundTrip 漏检根因——与 C 3.7.4「# 行吞函数」同族）；②接收者方法 receiver 括号组误当参数组（returnType 取到整签名）——回归测试锁定
+- **恢复率裁决**（评审第 3 条落地）：tools/go-fn-list.go（go/parser 金标，同一文件集+只计有体函数）+ scan-go-recovery.ts——stdlib 四包 **2434/2434 = 100.0%** → **维持纯词法，go/parser 桥推迟**
+- **命名鸿沟测量**（孵化器理论核心数据）：词段可桥接 0-1.9%——Go stdlib 惯用命名无法桥接内置规则词汇（与 C 命名鸿沟同构）
+- **框架诚实分层**（评审第 5 条落地）：「12/13 结构级」→「**12 专用检测器 = 4 结构级（AST：NestJS/FastAPI/Django/Flask）+ 8 启发式（代码串：Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）**」；转正门槛 = 真实项目 FP 数据点；CLAUDE.md 矛盾行修复；落地页/矩阵/README 双语同步
+- **Go 三语料实验**（REALWORLD_GO_V1.md，评审第 4 条落地）：stdlib 4 FP 全 FP（readColonFile 词段桥接跨窗口类）；govwa（vendored benchmarks/go-apps/）B 路径 0 flags；**A 路径 demo-real-go-govwa**：真实代码 3 注解（loginAction=verify/SetSession=establish/AuthCheck=guard）→ 0 FP + 植入违规精确定位 + 3 注解/协议——**Go 定位维持注解驱动（Beta）**
+- **TS 795 完整复跑**（评审第 6 条落地）：recall 98.5%（有效 100%）/ precision 100% / FP 0——12 个框架探测器全上线后与历史基线一致
+- 验证：35 定向测试；Python 盲测 v1.2 64 零漂移；check 免疫正常
+
 ## [3.7.13] — 2026-09-02
 
 ### Go 语言支持 + Gin/Fiber 框架适配——12/13

package/README.md

@@ -109,7 +109,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 12/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 12 dedicated detectors (4 structural + 8 heuristic).** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -235,7 +235,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS ✅ (12/13)
+- **Framework Adapters:** 12 dedicated detectors — 4 structural (NestJS/FastAPI/Django/Flask) + 8 heuristic (Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -109,7 +109,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：12/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
+**框架适配器：12 专用检测器（4 结构级 + 8 启发式）。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）、NestJS ✅（装饰器路由解析 + 全局 APP_GUARD 守卫识别 + @Public 豁免）、Koa ✅、Hapi ✅（路由配置认证策略分析）、Gin ✅ 与 Fiber ✅（Go 路由/认证中间件分析）有专用检测器；Next.js 另有版本感知治理。结构级 = AST 解析（NestJS/FastAPI/Django/Flask——合成金标 P=R=100%）；启发式 = 代码串模式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber——单测覆盖，真实项目 FP 数据待补）。Spring Boot 待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -234,7 +234,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS ✅（12/13）
+- **框架适配器：** 12 专用检测器——4 结构级（NestJS/FastAPI/Django/Flask）+ 8 启发式（Express/tRPC/Fastify/Next.js/Koa/Hapi/Gin/Fiber）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/extract-ir-go.js

@@ -230,11 +230,15 @@ function extractGoFile(filePath) {
         const name = plain ? plain[1] : receiver ? receiver[1] : null;
         if (!name)
             continue;
-        // 多行签名：从 func 起拼接直到找到 { 或 ;
+        // 多行签名：从 func 起拼接直到找到 { 或 ;——遇到下一个 func 行即停
+        // （无函数体声明行如 `func runtime_args() []string // in package runtime`
+        // 不能吞掉紧随其后的函数定义——proc.go::Getuid 漏检根因）
         let sigText = lines[i];
         let j = i;
         while (!sigText.includes("{") && !sigText.includes(";") && j < lines.length - 1) {
             j++;
+            if (/^\s*func\b/.test(lines[j]) && j > i)
+                break;
             sigText += "\n" + lines[j];
         }
         const braceIdx = sigText.indexOf("{");
@@ -274,15 +278,47 @@ function extractGoFile(filePath) {
         const requires = docTag(commentText, "requires")?.split(/[,\s]+/).filter(Boolean);
         const produces = docTag(commentText, "produces")?.split(/[,\s]+/).filter(Boolean);
         const useWhen = docTag(commentText, "useWhen")?.split(/[,\s]+/).filter(Boolean);
-        // 参数列表：签名中第一个 ( ... )
-        const openParen = signature.indexOf("(");
-        const closeParen = signature.indexOf(")", openParen);
+        // 参数列表：签名中第一个 ( ... )——接收者方法的 receiver 括号组要先跳过
+        // （bug 修复：func (s *Service) Login(...) 的 (s *Service) 曾被当作参数组，
+        // returnType 取到整个签名）
+        let sigAfterReceiver = signature;
+        if (receiver) {
+            let depth = 0;
+            for (let ci = signature.indexOf("("); ci < signature.length; ci++) {
+                if (signature[ci] === "(")
+                    depth++;
+                else if (signature[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        sigAfterReceiver = signature.slice(ci + 1);
+                        break;
+                    }
+                }
+            }
+        }
+        const openParen = sigAfterReceiver.indexOf("(");
+        let closeParen = -1;
+        if (openParen >= 0) {
+            // 平衡括号匹配（参数可含 func 类型嵌套括号）
+            let depth = 0;
+            for (let ci = openParen; ci < sigAfterReceiver.length; ci++) {
+                if (sigAfterReceiver[ci] === "(")
+                    depth++;
+                else if (sigAfterReceiver[ci] === ")") {
+                    depth--;
+                    if (depth === 0) {
+                        closeParen = ci;
+                        break;
+                    }
+                }
+            }
+        }
         let params = [];
         if (openParen >= 0 && closeParen > openParen) {
-            params = splitTopLevelParams(signature.slice(openParen + 1, closeParen));
+            params = splitTopLevelParams(sigAfterReceiver.slice(openParen + 1, closeParen));
         }
         // 返回类型：签名尾部（剥除泛型括号）
-        const returnType = signature.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
+        const returnType = sigAfterReceiver.slice(closeParen + 1).replace(/\[[^\]]*\]/g, "").trim();
         // 函数体：从签名行（j）的 { 起逐行扫描到匹配 }（掩码后括号平衡，
         // 增量计数——每行只数一次，避免累积体重复计数）
         let body = "";

package/dist/extract-ir-go.test.js

@@ -85,6 +85,23 @@ func (r *Repo) SaveUser(u User) error {
         (0, vitest_1.expect)(ir.some((f) => f.name === "SaveUser")).toBe(true);
         (0, vitest_1.expect)(ir.find((f) => f.name === "SaveUser")?.exported).toBe(true);
     });
+    (0, vitest_1.it)("接收者方法 returnType 与参数正确（receiver 括号组不被误取——回归）", () => {
+        write("svc.go", `
+package main
+
+func (s *Service) Login(ctx Context, user, password string) (Token, error) {
+	return Token{}, nil
+}
+`);
+        const ir = (0, extract_ir_go_1.extractIRGo)(dir);
+        const fn = ir.find((f) => f.name === "Login");
+        (0, vitest_1.expect)(fn?.returnType).toBe("(Token, error)");
+        // Go 语义：ctx / user / password 是 3 个参数（user 与 password 共享类型）
+        (0, vitest_1.expect)(fn?.params).toHaveLength(3);
+        (0, vitest_1.expect)(fn?.params[0].type).toContain("ctx");
+        (0, vitest_1.expect)(fn?.params[1].type).toContain("user");
+        (0, vitest_1.expect)(fn?.params[2].type).toContain("string");
+    });
     (0, vitest_1.it)("多行签名 + 返回类型", () => {
         write("multi.go", `
 package main

package/dist/frameworks/django-detector.js

@@ -60,6 +60,9 @@ function analyzeDjangoStructure(data) {
         return { hasDjango: false, issues: [] };
     }
     const issues = [];
+    // ViewSet 经 DefaultRouter 展开为多条路由（集合+详情）——同一视图的
+    // DRF_PERMISSION_BYPASS 只报一次（变异形状是视图级的）
+    const reportedDrfBypass = new Set();
     for (const route of data.routes) {
         if (route.kind !== "fbv" && route.kind !== "cbv")
             continue;
@@ -101,6 +104,9 @@ function analyzeDjangoStructure(data) {
             if (!hasMutationMethod(view))
                 continue;
             if (view.openPermission) {
+                if (reportedDrfBypass.has(viewName))
+                    continue;
+                reportedDrfBypass.add(viewName);
                 issues.push({
                     severity: "medium",
                     rule: "DRF_PERMISSION_BYPASS",

package/dist/frameworks/django-detector.test.js

@@ -134,3 +134,32 @@ const cbv = (name, extra = {}) => ({
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+(0, vitest_1.describe)("django-detector ViewSet 展开回归", () => {
+    (0, vitest_1.it)("同一 ViewSet 多条展开路由（集合+详情）DRF_PERMISSION_BYPASS 只报一次", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [
+                { pattern: "^articles/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" },
+                { pattern: "^articles/(?P<pk>[^/.]+)/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" },
+            ],
+            views: {
+                ArticleViewSet: cbv("ArticleViewSet", {
+                    isDrf: true, methods: ["create", "list", "retrieve", "update"],
+                    permissionClasses: ["AllowAny"], openPermission: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues.filter((i) => i.rule === "DRF_PERMISSION_BYPASS")).toHaveLength(1);
+    });
+    (0, vitest_1.it)("受保护 ViewSet（IsAuthenticatedOrReadOnly）不报——写面现在被真正检查", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "^articles/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" }],
+            views: {
+                ArticleViewSet: cbv("ArticleViewSet", {
+                    isDrf: true, methods: ["create", "list", "retrieve", "update"],
+                    permissionClasses: ["IsAuthenticatedOrReadOnly"], openPermission: false,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/express-detector.js

@@ -59,6 +59,7 @@ exports.analyzeExpressFile = analyzeExpressFile;
 exports.analyzeExpressProject = analyzeExpressProject;
 exports.formatExpressReport = formatExpressReport;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 // ── Known auth/security middleware patterns ──
 const AUTH_MIDDLEWARE_PATTERNS = [
     /\bpassport\.initialize\b/,
@@ -79,6 +80,10 @@ const AUTH_MIDDLEWARE_PATTERNS = [
     /\bcheckAuth\b/,
     /\bprotect\b/,
     /\bauthenticateRequest\b/,
+    // realworld 惯用法：const auth = require('../middleware/auth') →
+    // router.get('/x', auth.required, ...)（V1 根因：点成员 auth.required 不可见）
+    /\bauth\s*\.\s*(required|optional)\b/i,
+    /\bauth\s*\./i,
     // Variable references — common Express convention (e.g., const auth = passport.authenticate(...))
     // These are standalone identifiers in middleware position
     /^auth$/i,
@@ -112,8 +117,6 @@ const VALIDATION_MIDDLEWARE_PATTERNS = [
 ];
 const SECURITY_HEADER_PATTERNS = [
     /\bhelmet\b/,
-    /\bcors\s*\(/,
-    /\bcors\b/,
     /\bcsp\b/,
     /\bcontentSecurityPolicy\b/,
     /\bhsts\b/,
@@ -150,10 +153,15 @@ function detectExpressApp(code) {
 function extractRoutes(code, appName) {
     const routes = [];
     const methods = ["get", "post", "put", "delete", "patch", "all", "use"];
+    // 接收者：真 app（appName）或路由对象（router/Router/*Router）——
+    // 真实 Express 应用把路由注册在 Router 实例上（V1 只提取 1/20+ 根因）
+    const receivers = appName && appName !== "app"
+        ? `(?:${appName}|router|Router|[A-Za-z_$][\\w$]*[Rr]outer)`
+        : `(?:router|Router|[A-Za-z_$][\\w$]*[Rr]outer|app)`;
     for (const method of methods) {
         // Pattern: app.get('/path', middleware1, middleware2, handler)
         // or: router.post('/path', handler)
-        const routeRegex = new RegExp(`${appName}\\.${method}\\s*\\(\\s*['\"]([^'\"]+)['\"]\\s*,([^;]+)\\)`, "gi");
+        const routeRegex = new RegExp(`\\b${receivers}\\.${method}\\s*\\(\\s*['\"]([^'\"]+)['\"]\\s*,([^;]+)\\)`, "gi");
         let match;
         while ((match = routeRegex.exec(code)) !== null) {
             const rawArgs = match[2].trim();
@@ -240,9 +248,18 @@ function analyzeExpressApp(code) {
     const routes = extractRoutes(code, appName);
     const globalMiddleware = extractGlobalMiddleware(code, appName);
     const issues = [];
+    // 真 app：代码里实例化了 express()（route 模块只建 Router 不算 app——
+    // V1 per-file 计数虚高：6 个路由模块被当作独立 app 各报一遍）
+    const appIsCreator = /(?:const|let|var)\s+\w+\s*=\s*express\s*\(|require\(\s*['"]express['"]\s*\)\s*\(/.test(code);
+    // register 集合豁免（语义层）：users/login 姊妹 → POST users 公开注册
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    const routeHasAuth = (r) => r.middlewares.some((mm) => AUTH_MIDDLEWARE_PATTERNS.some((pp) => pp.test(mm)));
+    const isMutation = (r) => ["post", "put", "patch", "delete"].includes(r.method);
+    const nonPublicMutation = (r) => isMutation(r) && !isPublicRoute(r.path)
+        && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots));
     // Check 1: Does the app have any auth middleware at all?
     const hasGlobalAuth = globalMiddleware.some(m => m.type === "auth");
-    const hasAnyAuth = hasGlobalAuth || routes.some(r => r.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m))));
+    const hasAnyAuth = hasGlobalAuth || routes.some(routeHasAuth);
     // Check 2: Does the app have rate limiting on auth routes?
     const hasRateLimit = globalMiddleware.some(m => m.type === "rate_limit");
     const authRoutes = routes.filter(r => /\b(login|signin|signup|register|auth|token|password)\b/i.test(r.path));
@@ -256,7 +273,10 @@ function analyzeExpressApp(code) {
     // Check 6: Does the app have session management?
     const hasSession = globalMiddleware.some(m => m.type === "session") || /\bsession\s*\(/.test(code);
     // ── Generate Issues ──
-    if (!hasAnyAuth) {
+    // 整 app 无认证：仅真 app（实例化 express()）且自身有非公开 mutation
+    // 路由时报——main.ts 只挂载路由模块（真实认证在 controllers 内）不算裸
+    const hasNakedMutation = routes.some(nonPublicMutation);
+    if (!hasAnyAuth && appIsCreator && hasNakedMutation) {
         issues.push({
             severity: "critical",
             rule: "EXPRESS_NO_AUTH_MIDDLEWARE",
@@ -265,31 +285,33 @@ function analyzeExpressApp(code) {
             fix: "Add an auth middleware (e.g., passport.authenticate('jwt'), express-jwt, or a custom auth middleware) to protect routes.",
         });
     }
-    // Check for routes without auth middleware (when auth middleware exists globally)
+    // 逐路由缺失认证：文件里已有认证（全局或路由级）时，未保护的非公开
+    // mutation 路由单独报——真实 Express 认证惯例是每路由 auth.required
+    // （V1 根因：检测器只认全局 app.use）
     if (hasAnyAuth) {
         for (const route of routes) {
             if (["use", "all"].includes(route.method))
                 continue; // skip middleware registrations
-            const routeHasAuth = route.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m)));
-            if (!routeHasAuth && !hasGlobalAuth) {
-                // Route has no auth middleware AND no global auth → each route needs its own
-                // (already reported as EXPRESS_NO_AUTH_MIDDLEWARE above)
+            if (!isMutation(route))
+                continue; // 读操作不查（公开读常见）
+            if (routeHasAuth(route))
                 continue;
-            }
-            if (!routeHasAuth && hasGlobalAuth && !isPublicRoute(route.path)) {
-                issues.push({
-                    severity: "high",
-                    rule: "EXPRESS_ROUTE_MISSING_AUTH",
-                    message: `Route ${route.method.toUpperCase()} ${route.path} has no auth middleware. It may be inadvertently public.`,
-                    route: `${route.method.toUpperCase()} ${route.path}`,
-                    line: route.line,
-                    fix: `Add auth middleware to the route: app.${route.method}('${route.path}', authMiddleware, ${route.handler})`,
-                });
-            }
+            if (isPublicRoute(route.path))
+                continue;
+            if (route.method === "post" && (0, route_window_1.isRegisterRoot)(route.path, registerRoots))
+                continue;
+            issues.push({
+                severity: "high",
+                rule: "EXPRESS_ROUTE_MISSING_AUTH",
+                message: `Route ${route.method.toUpperCase()} ${route.path} has no auth middleware. It may be inadvertently public.`,
+                route: `${route.method.toUpperCase()} ${route.path}`,
+                line: route.line,
+                fix: `Add auth middleware to the route: app.${route.method}('${route.path}', authMiddleware, ${route.handler})`,
+            });
         }
     }
-    // Auth routes without rate limiting
-    if (authRoutes.length > 0 && !hasRateLimit) {
+    // Auth routes without rate limiting —— 仅真 app
+    if (appIsCreator && authRoutes.length > 0 && !hasRateLimit) {
         for (const route of authRoutes) {
             issues.push({
                 severity: "high",
@@ -301,8 +323,8 @@ function analyzeExpressApp(code) {
             });
         }
     }
-    // Missing security headers
-    if (!hasHelmet) {
+    // Missing security headers —— 仅真 app（route 模块不重复报，V1 ×7 虚高）
+    if (appIsCreator && !hasHelmet) {
         issues.push({
             severity: "medium",
             rule: "EXPRESS_NO_HELMET",
@@ -311,9 +333,9 @@ function analyzeExpressApp(code) {
             fix: "Add helmet middleware: app.use(helmet())",
         });
     }
-    // POST/PUT routes without validation
-    const mutationRoutes = routes.filter(r => ["post", "put", "patch"].includes(r.method));
-    if (mutationRoutes.length > 0 && !hasValidation) {
+    // POST/PUT routes without validation —— 仅真 app
+    const mutationRoutes = routes.filter(r => isMutation(r) && r.method !== "delete");
+    if (appIsCreator && mutationRoutes.length > 0 && !hasValidation) {
         issues.push({
             severity: "medium",
             rule: "EXPRESS_NO_INPUT_VALIDATION",
@@ -322,8 +344,8 @@ function analyzeExpressApp(code) {
             fix: "Add express-validator or zod validation to mutation routes.",
         });
     }
-    // Missing CORS configuration
-    if (!hasCors) {
+    // Missing CORS configuration —— 仅真 app
+    if (appIsCreator && !hasCors) {
         issues.push({
             severity: "low",
             rule: "EXPRESS_NO_CORS_CONFIG",
@@ -332,8 +354,8 @@ function analyzeExpressApp(code) {
             fix: "Add explicit CORS configuration: app.use(cors({ origin: 'https://your-domain.com' }))",
         });
     }
-    // Session without secure settings (if present)
-    if (hasSession) {
+    // Session without secure settings (if present) —— 仅真 app
+    if (appIsCreator && hasSession) {
         const sessionSecure = /secure\s*:\s*true/.test(code) && /httpOnly\s*:\s*true/.test(code) && /sameSite\s*:\s*['"](?:strict|lax)['"]/.test(code);
         if (!sessionSecure) {
             issues.push({
@@ -368,6 +390,11 @@ function isPublicRoute(path) {
         /^\/robots\.txt/i,
         /^\/$/,
     ];
+    // 尾段认证入口：/users/login、/api/register 等带前缀的真实 world 形态
+    // （V1 时代只认 ^/login 精确匹配——前缀登录入口被误报）
+    if (/\/?(login|signin|signup|sign_in|register|refresh)(\/|$)/i.test(path)) {
+        return true;
+    }
     return publicPatterns.some(p => p.test(path));
 }
 /**

package/dist/frameworks/express-detector.test.js

@@ -125,6 +125,11 @@ app.listen(3000);
     (0, vitest_1.it)("should classify helmet as security_header", () => {
         (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "helmet()")).toBe("security_header");
     });
+    (0, vitest_1.it)("should classify cors() as cors, NOT security_header (regression: SECURITY_HEADER_PATTERNS 曾含 cors 模式致 cors 恒被误分类 → 用 cors 的应用 NO_HELMET 漏报)", () => {
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors()")).toBe("cors");
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors({ origin: 'https://example.com' })")).toBe("cors");
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors(")).toBe("cors");
+    });
 });
 (0, vitest_1.describe)("extractGlobalMiddleware", () => {
     (0, vitest_1.it)("should extract app.use middleware", () => {
@@ -157,6 +162,22 @@ app.listen(3000);
         const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
         (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_HELMET")).toBe(true);
     });
+    (0, vitest_1.it)("should still flag NO_HELMET when app uses cors() but no helmet (regression: cors 曾误分类为 security_header → hasHelmet 误真 → FN)", () => {
+        const corsNoHelmet = `
+      const express = require('express');
+      const cors = require('cors');
+      const app = express();
+      app.use(cors());
+      app.get('/', (req, res) => { res.send('ok'); });
+      app.listen(3000);
+    `;
+        const result = (0, express_detector_1.analyzeExpressApp)(corsNoHelmet);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_HELMET")).toBe(true);
+        // cors IS recognized — no NO_CORS_CONFIG flag on this app
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_CORS_CONFIG")).toBe(false);
+        // cors() must be typed cors, so engine cross-file suppression works
+        (0, vitest_1.expect)(result.globalMiddleware.some(m => m.type === "cors")).toBe(true);
+    });
     (0, vitest_1.it)("should detect missing CORS", () => {
         const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
         (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_CORS_CONFIG")).toBe(true);
@@ -204,3 +225,51 @@ app.listen(3000);
         (0, vitest_1.expect)(report).toContain("Security Issues:");
     });
 });
+// ── V1 转正回归：接收者路由 / 路由级 auth / 逐路由缺失 / 真 app 门 / 前缀入口 ──
+const ROUTER_MODULE = `
+const express = require('express');
+const router = express.Router();
+const auth = require('../middleware/auth');
+router.get('/articles', async (req, res) => { res.json([]); });
+router.post('/articles', auth.required, async (req, res) => { res.json({}); });
+router.post('/payments', async (req, res) => { res.json({}); });
+module.exports = router;
+`;
+const ROUTER_WITH_LOGIN = `
+const express = require('express');
+const router = express.Router();
+const auth = require('../middleware/auth');
+router.post('/users/login', async (req, res) => { res.json({}); });   // 公开登录
+router.post('/users', async (req, res) => { res.json({}); });          // 公开注册（有 login 姊妹）
+router.put('/user', auth.required, async (req, res) => { res.json({}); });
+module.exports = router;
+`;
+(0, vitest_1.describe)("express V1 转正回归", () => {
+    (0, vitest_1.it)("router 接收者路由可提取（旧版只认 app.——20+ 路由只提取 1 条）", () => {
+        const { routes } = (0, express_detector_1.analyzeExpressApp)(ROUTER_MODULE);
+        (0, vitest_1.expect)(routes.some((r) => r.method === "post" && r.path === "/articles")).toBe(true);
+    });
+    (0, vitest_1.it)("路由级 auth.required 保护不报；同文件其他无认证 mutation 报 ROUTE_MISSING_AUTH", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ROUTER_MODULE);
+        const missing = issues.filter((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /articles");
+        (0, vitest_1.expect)(missing).toContain("POST /payments");
+        // 路由模块不是 app：NO_AUTH/NO_HELMET/NO_CORS 不报（V1 per-file 计数虚高修复）
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_NO_AUTH_MIDDLEWARE")).toBe(false);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_NO_HELMET")).toBe(false);
+    });
+    (0, vitest_1.it)("前缀登录/注册入口豁免：/users/login 与 /users（姊妹佐证）不报", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ROUTER_WITH_LOGIN);
+        const missing = issues.filter((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(missing).not.toContain("POST /users");
+        (0, vitest_1.expect)(missing).not.toContain("PUT /user");
+    });
+    (0, vitest_1.it)("摘掉某条 auth.required（其余仍受保护）→ 该 mutation 报 ROUTE_MISSING_AUTH（敏感性）", () => {
+        const twoProtected = ROUTER_MODULE.replace("router.post('/payments', async", "router.put('/admin', auth.required, async");
+        const stripped = twoProtected.replace("router.post('/articles', auth.required,", "router.post('/articles',");
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(stripped);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "POST /articles")).toBe(true);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "PUT /admin")).toBe(false);
+    });
+});