progmune-runtime 3.7.13 → 3.7.15

package/dist/frameworks/nestjs-detector.test.js

@@ -138,3 +138,106 @@ export class AppModule {}
         (0, vitest_1.expect)(issues.map((i) => i.type)).not.toContain("NESTJS_NO_AUTH");
     });
 });
+(0, vitest_1.describe)("nestjs-detector 模块中间件覆盖（V1 修复回归）", () => {
+    (0, vitest_1.it)("NestModule configure/forRoutes 保护的 mutation 不报（Nest 5 惯用法）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/app.module.ts", `
+import { Module, NestModule, MiddlewareConsumer, RequestMethod } from "@nestjs/common";
+import { AuthMiddleware } from "./auth.middleware";
+import { ApiController } from "./api.controller";
+
+@Module({ controllers: [ApiController] })
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer
+      .apply(AuthMiddleware)
+      .forRoutes(
+        { path: "api/transfer", method: RequestMethod.POST },
+        { path: "api/items/:id", method: RequestMethod.ALL },
+      );
+  }
+}
+`);
+        write("src/api.controller.ts", `
+import { Controller, Post, Delete, Get } from "@nestjs/common";
+@Controller("api")
+export class ApiController {
+  @Post("transfer") transfer() { return {}; }
+  @Delete("items/:id") deleteItem() { return {}; }
+  @Post("public") publicCreate() { return {}; }
+}
+`);
+        write("src/auth.middleware.ts", `
+import { NestMiddleware } from "@nestjs/common";
+export class AuthMiddleware implements NestMiddleware { use() {} }
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        const noAuth = a.issues.filter((i) => i.type === "NESTJS_NO_AUTH");
+        // transfer 与 items/:id 受 forRoutes 中间件保护 → 不报
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST api/transfer");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("DELETE api/items/:id");
+        // 未覆盖的 public 写路由仍报（保留敏感性）
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).toContain("POST api/public");
+    });
+    (0, vitest_1.it)("摘除 forRoutes 中间件覆盖后 mutation 重新被报（无感修复回归）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/app.module.ts", `
+import { Module, NestModule, MiddlewareConsumer, RequestMethod } from "@nestjs/common";
+import { ApiController } from "./api.controller";
+@Module({ controllers: [ApiController] })
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(AuthMiddleware).forRoutes(); // 覆盖被摘空
+  }
+}
+`);
+        write("src/api.controller.ts", `
+import { Controller, Post } from "@nestjs/common";
+@Controller("api")
+export class ApiController {
+  @Post("transfer") transfer() { return {}; }
+}
+`);
+        write("src/auth.middleware.ts", `
+import { NestMiddleware } from "@nestjs/common";
+export class AuthMiddleware implements NestMiddleware { use() {} }
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_AUTH" && i.route === "POST api/transfer")).toBe(true);
+    });
+});
+(0, vitest_1.describe)("nestjs-detector register 集合豁免（语义层）", () => {
+    function writeUserApp() {
+        write("tsconfig.json", TSCONFIG);
+        write("src/user.controller.ts", `
+import { Controller, Post, Get, Delete } from "@nestjs/common";
+@Controller()
+export class UserController {
+  @Post("users/login") login() { return {}; }
+  @Post("users") register() { return {}; }            // 公开注册
+  @Delete("users/:slug") deleteUser() { return {}; }  // 真实无保护
+}
+`);
+    }
+    (0, vitest_1.it)("有 users/login 姊妹佐证：POST users（公开注册）不报", () => {
+        writeUserApp();
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        const noAuth = a.issues.filter((i) => i.type === "NESTJS_NO_AUTH");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST /users");
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).not.toContain("POST /users/login");
+        // 真实无保护的 DELETE 仍报（豁免不误伤）
+        (0, vitest_1.expect)(noAuth.map((i) => i.route)).toContain("DELETE /users/:slug");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST users 仍报（管理员建用户不豁免）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/admin.controller.ts", `
+import { Controller, Post } from "@nestjs/common";
+@Controller()
+export class AdminController {
+  @Post("users") adminCreateUser() { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_AUTH" && i.route === "POST /users")).toBe(true);
+    });
+});

package/dist/frameworks/nextjs-detector.js

@@ -66,7 +66,10 @@ const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
     "token", "auth", "health",
 ];
-const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate)\s*\(/;
+// 路由级认证信号：会话式（getServerSession/next-auth v5 auth()/clerk
+// currentUser）+ webhook 载荷签名校验（Stripe constructEvent 等——
+// V5 真实语料证明 webhook 端点的标准保护是签名校验而非会话）
+const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate|auth|currentUser)\s*\(|\b(constructEvent|verifyWebhook|verifySignature|verifyWebhookSignature|validateWebhook|validateSignature)\s*\(/;
 const AUTH_MIDDLEWARE_RE = /\b(getServerSession|requireAuth|verifyToken|getToken|withAuth|next-auth|authorization|authenticate)\b/;
 function isAuthEntryFile(relFile) {
     const lower = relFile.toLowerCase();

package/dist/frameworks/nextjs-detector.test.js

@@ -110,4 +110,39 @@ export default withAuth(function middleware(req) {});
         (0, vitest_1.expect)(hasNext).toBe(false);
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
+    (0, vitest_1.it)("V5 修复回归：Stripe webhook 签名校验（constructEvent）视为端点认证——不报", () => {
+        writeRoute("app/api/webhooks/stripe/route.ts", `
+import { stripe } from "@/lib/stripe";
+export async function POST(req: Request) {
+  const body = await req.text();
+  const signature = req.headers.get("stripe-signature") as string;
+  const event = stripe.webhooks.constructEvent(body, signature, process.env.SECRET!);
+  return Response.json({ received: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("V5 修复回归：webhook 无签名校验仍报（保留对真缺失认证的敏感性）", () => {
+        writeRoute("app/api/webhooks/stripe/route.ts", `
+export async function POST(req: Request) {
+  const body = await req.text();
+  return Response.json({ received: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("NEXT_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("V5 修复回归：next-auth v5 / clerk 裸 auth() 调用视为认证——不报", () => {
+        writeRoute("app/api/transfer/route.ts", `
+import { auth } from "@/auth";
+export async function POST(req: Request) {
+  const session = await auth();
+  if (!session?.user) return new Response(null, { status: 403 });
+  return Response.json({ ok: true });
+}
+`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
 });

package/dist/frameworks/route-window.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * route-window.ts — 路由调用窗口共享工具（Koa/Gin/Fiber 代码串检测器共用）
+ *
+ * 背景：初代实现用「路径串后固定 300 字符窗口」收集认证中间件名 →
+ * 跨路由串扰（bleed）：后面路由的 auth 名污染前面公开路由的保护判定
+ * （V3 Koa / V7 Gin / V8 Fiber 同款缺陷）。
+ *
+ * 修复思路：
+ *  1. routeCallWindow —— 窗口 = 本次路由调用边界内（括号深度感知到闭合
+ *     `)`），不跨路由、容忍内联 handler 的多层括号
+ *  2. middlewareNamesFromWindow —— koa-router/gin/fiber 语义一致：
+ *     `(path, ...middleware, handler)`，最后一个纯函数引用参数是
+ *     handler（如 ctrl.login / UsersLogin），排除——handler 名含 auth
+ *     词不再被误判为认证中间件
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routeCallWindow = routeCallWindow;
+exports.middlewareNamesFromWindow = middlewareNamesFromWindow;
+exports.normPath = normPath;
+exports.collectRegisterRoots = collectRegisterRoots;
+exports.isRegisterRoot = isRegisterRoot;
+/**
+ * 自路由调用起点（路径串刚结束处）扫描到本次调用的闭合括号。
+ * @param code  源码
+ * @param from  路径串结束位置（调用括号深度已为 1——方法名的 `(` 已消费）
+ * @returns 窗口内容（含闭合 `)`）
+ */
+function routeCallWindow(code, from) {
+    let depth = 1;
+    let end = from;
+    let quote = null;
+    const MAX = 4000;
+    while (end < code.length && end - from < MAX) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0)
+                break;
+        }
+        end++;
+    }
+    return code.slice(from, end + 1);
+}
+/** 纯函数引用：auth / ctrl.login / users.AuthMiddleware */
+function isPlainFnRef(s) {
+    return /^[A-Za-z_$][\w$]*(\.[A-Za-z_$][\w$]*)*$/.test(s.trim());
+}
+/**
+ * 从路由调用参数窗口提取中间件候选名。
+ * 顶层逗号切分（深度感知）→ 末参若为纯函数引用则视为 handler 排除 →
+ * 其余参数内的标识符即中间件候选。
+ */
+function middlewareNamesFromWindow(window) {
+    const names = [];
+    const body = window.replace(/\)\s*$/, "");
+    const parts = [];
+    let cur = "";
+    let d = 0;
+    for (const ch of body) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            d++;
+        else if (ch === ")" || ch === "]" || ch === "}")
+            d--;
+        if (ch === "," && d === 0) {
+            parts.push(cur);
+            cur = "";
+        }
+        else {
+            cur += ch;
+        }
+    }
+    if (cur.trim().length > 0)
+        parts.push(cur);
+    const mwParts = isPlainFnRef(parts[parts.length - 1] ?? "")
+        ? parts.slice(0, -1)
+        : parts;
+    for (const p of mwParts) {
+        const found = p.match(/[A-Za-z_$][\w$]*/g) || [];
+        names.push(...found);
+    }
+    return names;
+}
+// ── register 集合豁免（语义层，Koa/Gin/Fiber/NestJS 共用）──
+/** 账户集合根判定词：路径以这些后缀结尾的路由是账户入口（login 等） */
+const ACCOUNT_ENTRY_SUFFIXES = [
+    "/login", "/signin", "/sign_in", "/register", "/signup", "/sign_up",
+];
+/** 规范化路径：去首尾斜杠 */
+function normPath(p) {
+    return p.replace(/^\/+|\/+$/g, "");
+}
+/**
+ * 收集「账户集合根」：对每条路径，若以账户入口后缀结尾（如 /users/login），
+ * 剥掉后缀得集合根（/users）。该集合的无认证 POST = 公开注册（豁免）。
+ * 佐证式豁免——无 login/register 姊妹的写集合不豁免（管理员建用户等仍查）。
+ */
+function collectRegisterRoots(paths) {
+    const roots = new Set();
+    for (const p of paths) {
+        const lower = p.toLowerCase();
+        for (const suffix of ACCOUNT_ENTRY_SUFFIXES) {
+            if (lower.endsWith(suffix)) {
+                roots.add(normPath(p.slice(0, -suffix.length)));
+                break;
+            }
+        }
+    }
+    return roots;
+}
+/** routePath 是否命中账户集合根（规范化比较） */
+function isRegisterRoot(routePath, roots) {
+    return roots.has(normPath(routePath));
+}

package/dist/frameworks/trpc-detector.js

@@ -26,7 +26,9 @@ exports.extractRouterNames = extractRouterNames;
 exports.extractProcedures = extractProcedures;
 exports.analyzeTRPCFile = analyzeTRPCFile;
 // ── Detection Patterns ──
-const PROCEDURE_TYPE_PATTERN = /\b(publicProcedure|protectedProcedure|adminProcedure)\b/g;
+// 注意：detect 用途不带 /g——带 /g 的 test() 会跨文件泄漏 lastIndex，
+// 导致逐文件扫描结果随顺序漂移（实测 4/19 vs 7/19）
+const PROCEDURE_TYPE_PATTERN = /\b(publicProcedure|protectedProcedure|adminProcedure)\b/;
 const DB_WRITE_PATTERN = /\b(db\.(insert|update|delete|create|upsert|execute)|prisma\.\w+\.(create|update|delete|upsert|createMany|updateMany|deleteMany)|drizzle\.(insert|update|delete)|\.(insert|update|delete|create|upsert)\s*\()/i;
 /**
  * Detect whether this file contains tRPC definitions.
@@ -57,30 +59,94 @@ function extractRouterNames(code) {
  */
 function extractProcedures(code) {
     const procedures = [];
-    // Match: name: <procedureType>.input(...).<kind>( or name: <procedureType>.<kind>(
-    const procRe = /([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(publicProcedure|protectedProcedure|adminProcedure)((?:\.\w+\s*\([^()]*\))*)\.(query|mutation)\s*\(/g;
+    // 过程起点：name: <procedureType>（不含链）——v11 惯用法 t.procedure
+    // （V4 遗留缺口：只认 XxxProcedure 命名包装，内联 t.procedure 不可见）
+    const procStartRe = /([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(t\s*\.\s*procedure|publicProcedure|protectedProcedure|adminProcedure)\b/g;
     let m;
-    while ((m = procRe.exec(code)) !== null) {
+    while ((m = procStartRe.exec(code)) !== null) {
         const name = m[1];
-        const procType = m[2].replace(/Procedure$/, "");
-        const chain = m[3] || "";
-        const kind = m[4];
-        const hasInputSchema = /\.input\s*\(/.test(chain);
-        // Extract body until matching closing paren of the query/mutation call.
-        // Heuristic: scan forward for the closing paren matching the one after
-        // the .query( / .mutation( token.
-        const openIdx = procRe.lastIndex - 1; // index of '(' after query/mutation
+        // t.procedure = v11 基础构造器（无包装 → 默认公开语义）；命名包装去掉后缀
+        const procType = (m[2].includes(".") ? "public" : m[2].replace(/Procedure$/, ""));
+        // ── 链扫描（括号感知）──
+        // 自 procedure 类型后逐个解析 .method(balancedArgs)，容忍嵌套括号与
+        // 多行（.input(z.object({...})) 等标准形态），直至 .query(/.mutation(
+        // 或链中断。旧实现用 (?:\.\w+\([^()]*\))* 不跨嵌套括号 → 标准
+        // zod input 链整体失明（V4 缺陷）。
+        let pos = procStartRe.lastIndex;
+        let hasInputSchema = false;
+        let kind = null;
+        let kindOpenIdx = -1; // .query( 或 .mutation( 的 '(' 下标
+        const skipWs = () => {
+            while (pos < code.length && /\s/.test(code[pos]))
+                pos++;
+        };
+        const consumeBalanced = (open, close) => {
+            let depth = 1;
+            let quote = null;
+            pos++; // 跳过 open
+            while (pos < code.length && depth > 0) {
+                const ch = code[pos];
+                if (quote) {
+                    if (ch === quote && code[pos - 1] !== "\\")
+                        quote = null;
+                }
+                else if (ch === '"' || ch === "'" || ch === "`") {
+                    quote = ch;
+                }
+                else if (ch === open) {
+                    depth++;
+                }
+                else if (ch === close) {
+                    depth--;
+                }
+                pos++;
+            }
+        };
+        for (let step = 0; step < 100; step++) {
+            skipWs();
+            if (code[pos] !== ".")
+                break;
+            pos++;
+            const methStart = pos;
+            while (pos < code.length && /[A-Za-z0-9_$]/.test(code[pos]))
+                pos++;
+            const method = code.slice(methStart, pos);
+            skipWs();
+            if (code[pos] !== "(")
+                break;
+            if (method === "query" || method === "mutation") {
+                kind = method;
+                kindOpenIdx = pos; // '(' 位置
+                break;
+            }
+            if (method === "input")
+                hasInputSchema = true;
+            consumeBalanced("(", ")");
+        }
+        if (kind === null || kindOpenIdx < 0)
+            continue; // 非完整过程定义
+        // ── body：自 kind 的 '(' 后到匹配闭合括号（字符串感知）──
         let depth = 1;
-        let closeIdx = openIdx + 1;
+        let closeIdx = kindOpenIdx + 1;
+        let quote = null;
         while (closeIdx < code.length && depth > 0) {
             const ch = code[closeIdx];
-            if (ch === "(")
+            if (quote) {
+                if (ch === quote && code[closeIdx - 1] !== "\\")
+                    quote = null;
+            }
+            else if (ch === '"' || ch === "'" || ch === "`") {
+                quote = ch;
+            }
+            else if (ch === "(") {
                 depth++;
-            else if (ch === ")")
+            }
+            else if (ch === ")") {
                 depth--;
+            }
             closeIdx++;
         }
-        const body = code.slice(openIdx + 1, Math.min(closeIdx - 1, openIdx + 2000));
+        const body = code.slice(kindOpenIdx + 1, Math.min(closeIdx - 1, kindOpenIdx + 2000));
         const usesInputInBody = /input\s*\./.test(body) || /\binput\b/.test(body);
         const doesDbWrite = DB_WRITE_PATTERN.test(body);
         procedures.push({

package/dist/frameworks/trpc-detector.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * trpc-detector.test.ts — tRPC 检测器回归（纯函数，无文件 I/O）
+ *
+ * 覆盖 V4 真实语料（netflx-web）暴露的两项缺陷：
+ *  1. 链匹配正则不跨嵌套括号 → 标准 .input(z.object({...})) 过程失明
+ *  2. PROCEDURE_TYPE_PATTERN /g lastIndex 泄漏 → 逐文件扫描漂移
+ */
+const vitest_1 = require("vitest");
+const trpc_detector_1 = require("./trpc-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ── 修复 1：标准 .input 链（嵌套括号/多行）必须可见 ──
+const ROUTER_WITH_INPUT = `
+const t = initTRPC.context<{ db: Db }>().create();
+export const postRouter = t.router({
+  addComment: protectedProcedure
+    .input(
+      z.object({
+        articleId: z.string(),
+        body: z.string().min(1),
+      })
+    )
+    .mutation(async ({ ctx, input }) => {
+      await ctx.db.comment.create({ data: { articleId: input.articleId } });
+    }),
+  list: publicProcedure.query(async ({ ctx }) => ctx.db.comment.findMany()),
+});`;
+const ROUTER_WITH_BARE_MUTATION = `
+export const appRouter = t.router({
+  deleteAll: publicProcedure.mutation(async ({ ctx, input }) => {
+    await ctx.prisma.post.deleteMany();
+  }),
+});`;
+(0, vitest_1.describe)("trpc extractProcedures — 括号感知链", () => {
+    (0, vitest_1.it)("标准多行 .input(z.object({...})) mutation 可见且有 input schema（V4 缺陷回归）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_INPUT);
+        const add = procs.find((p) => p.name === "addComment");
+        (0, vitest_1.expect)(add).toBeDefined();
+        (0, vitest_1.expect)(add.kind).toBe("mutation");
+        (0, vitest_1.expect)(add.procedureType).toBe("protected");
+        (0, vitest_1.expect)(add.hasInputSchema).toBe(true);
+        // 无 schema 的 query 也照常可见
+        (0, vitest_1.expect)(procs.some((p) => p.name === "list" && p.hasInputSchema === false)).toBe(true);
+    });
+    (0, vitest_1.it)("单行 .input(z.string()) 链可见", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+export const r = t.router({
+  getOne: protectedProcedure.input(z.string()).query(async ({ ctx, input }) => {
+    return ctx.db.get(input);
+  }),
+});`);
+        const p = procs.find((x) => x.name === "getOne");
+        (0, vitest_1.expect)(p).toBeDefined();
+        (0, vitest_1.expect)(p.hasInputSchema).toBe(true);
+    });
+    (0, vitest_1.it)("裸链 mutation（无 input）仍可见并可触发规则", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_BARE_MUTATION);
+        const del = procs.find((p) => p.name === "deleteAll");
+        (0, vitest_1.expect)(del).toBeDefined();
+        (0, vitest_1.expect)(del.kind).toBe("mutation");
+        (0, vitest_1.expect)(del.hasInputSchema).toBe(false);
+        (0, vitest_1.expect)(del.doesDbWrite).toBe(true);
+    });
+    (0, vitest_1.it)("完整分析：合规 router 0 issues，裸 public mutation 报 TRPC_PUBLIC_MUTATION", () => {
+        const tmp = path.join(os.tmpdir(), "trpc-good-router.ts");
+        fs.writeFileSync(tmp, ROUTER_WITH_INPUT);
+        try {
+            const good = (0, trpc_detector_1.analyzeTRPCFile)(tmp);
+            (0, vitest_1.expect)(good.issues).toHaveLength(0);
+            (0, vitest_1.expect)(good.procedures.length).toBe(2);
+        }
+        finally {
+            fs.unlinkSync(tmp);
+        }
+        const tmp2 = path.join(os.tmpdir(), "trpc-bad-router.ts");
+        fs.writeFileSync(tmp2, ROUTER_WITH_BARE_MUTATION);
+        try {
+            const bad = (0, trpc_detector_1.analyzeTRPCFile)(tmp2);
+            (0, vitest_1.expect)(bad.issues.map((i) => i.rule)).toContain("TRPC_PUBLIC_MUTATION");
+            (0, vitest_1.expect)(bad.issues.map((i) => i.rule)).toContain("TRPC_MUTATION_WITHOUT_INPUT_SCHEMA");
+        }
+        finally {
+            fs.unlinkSync(tmp2);
+        }
+    });
+});
+// ── 修复 2：lastIndex 泄漏回归 ──
+(0, vitest_1.describe)("detectTRPCApp — 无 /g lastIndex 泄漏", () => {
+    (0, vitest_1.it)("连续多次调用结果稳定（旧 /g 实现会漂移）", () => {
+        const trpcCode = `const t = initTRPC.create(); export const r = t.router({ a: publicProcedure.query(() => 1) });`;
+        const plainCode = `export const sum = (a: number, b: number) => a + b;`;
+        // 交替调用多次：泄漏时第二次起结果不稳定
+        const results = [];
+        for (let i = 0; i < 6; i++) {
+            results.push((0, trpc_detector_1.detectTRPCApp)(trpcCode)); // 应为 true
+            results.push((0, trpc_detector_1.detectTRPCApp)(plainCode)); // 应为 false
+        }
+        (0, vitest_1.expect)(results.filter(Boolean)).toHaveLength(6); // 恰好 6 个 true
+        (0, vitest_1.expect)(results).toEqual([
+            true, false, true, false, true, false, true, false, true, false, true, false,
+        ]);
+    });
+});
+// ── tRPC v11：内联 t.procedure 形态（V4 遗留缺口）──
+(0, vitest_1.describe)("trpc v11 t.procedure 支持", () => {
+    (0, vitest_1.it)("t.procedure.input(z.object).mutation 可见且视为公开（默认语义）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+import { initTRPC } from "@trpc/server";
+const t = initTRPC.create();
+export const r = t.router({
+  ping: t.procedure
+    .input(z.object({ msg: z.string() }))
+    .mutation(async ({ ctx, input }) => {
+      await ctx.prisma.log.create({ data: { msg: input.msg } });
+    }),
+  list: t.procedure.query(async () => []),
+});`);
+        const ping = procs.find((p) => p.name === "ping");
+        (0, vitest_1.expect)(ping).toBeDefined();
+        (0, vitest_1.expect)(ping.kind).toBe("mutation");
+        (0, vitest_1.expect)(ping.procedureType).toBe("public");
+        (0, vitest_1.expect)(ping.hasInputSchema).toBe(true);
+        (0, vitest_1.expect)(procs.some((p) => p.name === "list")).toBe(true);
+    });
+    (0, vitest_1.it)("裸 t.procedure mutation（无 input）触发规则（敏感性与命名包装一致）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+export const r = t.router({
+  nuke: t.procedure.mutation(async ({ ctx }) => {
+    await ctx.prisma.post.deleteMany();
+  }),
+});`);
+        const nuke = procs.find((p) => p.name === "nuke");
+        (0, vitest_1.expect)(nuke).toBeDefined();
+        (0, vitest_1.expect)(nuke.hasInputSchema).toBe(false);
+        (0, vitest_1.expect)(nuke.doesDbWrite).toBe(true);
+    });
+    (0, vitest_1.it)("netflx v10 命名包装形态不受影响（19/19 保持）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_INPUT);
+        (0, vitest_1.expect)(procs.length).toBe(2);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.13";
+exports.RUNTIME_VERSION = "3.7.15";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.13",
+  "version": "3.7.15",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -114,4 +114,4 @@
     "tsx": "^4.22.4",
     "vitest": "^3.2.6"
   }
-}
+}