progmune-runtime 3.7.14 → 3.7.15

package/dist/frameworks/django-detector.js

@@ -60,6 +60,9 @@ function analyzeDjangoStructure(data) {
         return { hasDjango: false, issues: [] };
     }
     const issues = [];
+    // ViewSet 经 DefaultRouter 展开为多条路由（集合+详情）——同一视图的
+    // DRF_PERMISSION_BYPASS 只报一次（变异形状是视图级的）
+    const reportedDrfBypass = new Set();
     for (const route of data.routes) {
         if (route.kind !== "fbv" && route.kind !== "cbv")
             continue;
@@ -101,6 +104,9 @@ function analyzeDjangoStructure(data) {
             if (!hasMutationMethod(view))
                 continue;
             if (view.openPermission) {
+                if (reportedDrfBypass.has(viewName))
+                    continue;
+                reportedDrfBypass.add(viewName);
                 issues.push({
                     severity: "medium",
                     rule: "DRF_PERMISSION_BYPASS",

package/dist/frameworks/django-detector.test.js

@@ -134,3 +134,32 @@ const cbv = (name, extra = {}) => ({
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+(0, vitest_1.describe)("django-detector ViewSet 展开回归", () => {
+    (0, vitest_1.it)("同一 ViewSet 多条展开路由（集合+详情）DRF_PERMISSION_BYPASS 只报一次", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [
+                { pattern: "^articles/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" },
+                { pattern: "^articles/(?P<pk>[^/.]+)/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" },
+            ],
+            views: {
+                ArticleViewSet: cbv("ArticleViewSet", {
+                    isDrf: true, methods: ["create", "list", "retrieve", "update"],
+                    permissionClasses: ["AllowAny"], openPermission: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues.filter((i) => i.rule === "DRF_PERMISSION_BYPASS")).toHaveLength(1);
+    });
+    (0, vitest_1.it)("受保护 ViewSet（IsAuthenticatedOrReadOnly）不报——写面现在被真正检查", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "^articles/?$", urlname: "", view: "ArticleViewSet", kind: "cbv", file: "urls.py" }],
+            views: {
+                ArticleViewSet: cbv("ArticleViewSet", {
+                    isDrf: true, methods: ["create", "list", "retrieve", "update"],
+                    permissionClasses: ["IsAuthenticatedOrReadOnly"], openPermission: false,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/express-detector.js

@@ -59,6 +59,7 @@ exports.analyzeExpressFile = analyzeExpressFile;
 exports.analyzeExpressProject = analyzeExpressProject;
 exports.formatExpressReport = formatExpressReport;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 // ── Known auth/security middleware patterns ──
 const AUTH_MIDDLEWARE_PATTERNS = [
     /\bpassport\.initialize\b/,
@@ -79,6 +80,10 @@ const AUTH_MIDDLEWARE_PATTERNS = [
     /\bcheckAuth\b/,
     /\bprotect\b/,
     /\bauthenticateRequest\b/,
+    // realworld 惯用法：const auth = require('../middleware/auth') →
+    // router.get('/x', auth.required, ...)（V1 根因：点成员 auth.required 不可见）
+    /\bauth\s*\.\s*(required|optional)\b/i,
+    /\bauth\s*\./i,
     // Variable references — common Express convention (e.g., const auth = passport.authenticate(...))
     // These are standalone identifiers in middleware position
     /^auth$/i,
@@ -112,8 +117,6 @@ const VALIDATION_MIDDLEWARE_PATTERNS = [
 ];
 const SECURITY_HEADER_PATTERNS = [
     /\bhelmet\b/,
-    /\bcors\s*\(/,
-    /\bcors\b/,
     /\bcsp\b/,
     /\bcontentSecurityPolicy\b/,
     /\bhsts\b/,
@@ -150,10 +153,15 @@ function detectExpressApp(code) {
 function extractRoutes(code, appName) {
     const routes = [];
     const methods = ["get", "post", "put", "delete", "patch", "all", "use"];
+    // 接收者：真 app（appName）或路由对象（router/Router/*Router）——
+    // 真实 Express 应用把路由注册在 Router 实例上（V1 只提取 1/20+ 根因）
+    const receivers = appName && appName !== "app"
+        ? `(?:${appName}|router|Router|[A-Za-z_$][\\w$]*[Rr]outer)`
+        : `(?:router|Router|[A-Za-z_$][\\w$]*[Rr]outer|app)`;
     for (const method of methods) {
         // Pattern: app.get('/path', middleware1, middleware2, handler)
         // or: router.post('/path', handler)
-        const routeRegex = new RegExp(`${appName}\\.${method}\\s*\\(\\s*['\"]([^'\"]+)['\"]\\s*,([^;]+)\\)`, "gi");
+        const routeRegex = new RegExp(`\\b${receivers}\\.${method}\\s*\\(\\s*['\"]([^'\"]+)['\"]\\s*,([^;]+)\\)`, "gi");
         let match;
         while ((match = routeRegex.exec(code)) !== null) {
             const rawArgs = match[2].trim();
@@ -240,9 +248,18 @@ function analyzeExpressApp(code) {
     const routes = extractRoutes(code, appName);
     const globalMiddleware = extractGlobalMiddleware(code, appName);
     const issues = [];
+    // 真 app：代码里实例化了 express()（route 模块只建 Router 不算 app——
+    // V1 per-file 计数虚高：6 个路由模块被当作独立 app 各报一遍）
+    const appIsCreator = /(?:const|let|var)\s+\w+\s*=\s*express\s*\(|require\(\s*['"]express['"]\s*\)\s*\(/.test(code);
+    // register 集合豁免（语义层）：users/login 姊妹 → POST users 公开注册
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    const routeHasAuth = (r) => r.middlewares.some((mm) => AUTH_MIDDLEWARE_PATTERNS.some((pp) => pp.test(mm)));
+    const isMutation = (r) => ["post", "put", "patch", "delete"].includes(r.method);
+    const nonPublicMutation = (r) => isMutation(r) && !isPublicRoute(r.path)
+        && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots));
     // Check 1: Does the app have any auth middleware at all?
     const hasGlobalAuth = globalMiddleware.some(m => m.type === "auth");
-    const hasAnyAuth = hasGlobalAuth || routes.some(r => r.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m))));
+    const hasAnyAuth = hasGlobalAuth || routes.some(routeHasAuth);
     // Check 2: Does the app have rate limiting on auth routes?
     const hasRateLimit = globalMiddleware.some(m => m.type === "rate_limit");
     const authRoutes = routes.filter(r => /\b(login|signin|signup|register|auth|token|password)\b/i.test(r.path));
@@ -256,7 +273,10 @@ function analyzeExpressApp(code) {
     // Check 6: Does the app have session management?
     const hasSession = globalMiddleware.some(m => m.type === "session") || /\bsession\s*\(/.test(code);
     // ── Generate Issues ──
-    if (!hasAnyAuth) {
+    // 整 app 无认证：仅真 app（实例化 express()）且自身有非公开 mutation
+    // 路由时报——main.ts 只挂载路由模块（真实认证在 controllers 内）不算裸
+    const hasNakedMutation = routes.some(nonPublicMutation);
+    if (!hasAnyAuth && appIsCreator && hasNakedMutation) {
         issues.push({
             severity: "critical",
             rule: "EXPRESS_NO_AUTH_MIDDLEWARE",
@@ -265,31 +285,33 @@ function analyzeExpressApp(code) {
             fix: "Add an auth middleware (e.g., passport.authenticate('jwt'), express-jwt, or a custom auth middleware) to protect routes.",
         });
     }
-    // Check for routes without auth middleware (when auth middleware exists globally)
+    // 逐路由缺失认证：文件里已有认证（全局或路由级）时，未保护的非公开
+    // mutation 路由单独报——真实 Express 认证惯例是每路由 auth.required
+    // （V1 根因：检测器只认全局 app.use）
     if (hasAnyAuth) {
         for (const route of routes) {
             if (["use", "all"].includes(route.method))
                 continue; // skip middleware registrations
-            const routeHasAuth = route.middlewares.some(m => AUTH_MIDDLEWARE_PATTERNS.some(p => p.test(m)));
-            if (!routeHasAuth && !hasGlobalAuth) {
-                // Route has no auth middleware AND no global auth → each route needs its own
-                // (already reported as EXPRESS_NO_AUTH_MIDDLEWARE above)
+            if (!isMutation(route))
+                continue; // 读操作不查（公开读常见）
+            if (routeHasAuth(route))
                 continue;
-            }
-            if (!routeHasAuth && hasGlobalAuth && !isPublicRoute(route.path)) {
-                issues.push({
-                    severity: "high",
-                    rule: "EXPRESS_ROUTE_MISSING_AUTH",
-                    message: `Route ${route.method.toUpperCase()} ${route.path} has no auth middleware. It may be inadvertently public.`,
-                    route: `${route.method.toUpperCase()} ${route.path}`,
-                    line: route.line,
-                    fix: `Add auth middleware to the route: app.${route.method}('${route.path}', authMiddleware, ${route.handler})`,
-                });
-            }
+            if (isPublicRoute(route.path))
+                continue;
+            if (route.method === "post" && (0, route_window_1.isRegisterRoot)(route.path, registerRoots))
+                continue;
+            issues.push({
+                severity: "high",
+                rule: "EXPRESS_ROUTE_MISSING_AUTH",
+                message: `Route ${route.method.toUpperCase()} ${route.path} has no auth middleware. It may be inadvertently public.`,
+                route: `${route.method.toUpperCase()} ${route.path}`,
+                line: route.line,
+                fix: `Add auth middleware to the route: app.${route.method}('${route.path}', authMiddleware, ${route.handler})`,
+            });
         }
     }
-    // Auth routes without rate limiting
-    if (authRoutes.length > 0 && !hasRateLimit) {
+    // Auth routes without rate limiting —— 仅真 app
+    if (appIsCreator && authRoutes.length > 0 && !hasRateLimit) {
         for (const route of authRoutes) {
             issues.push({
                 severity: "high",
@@ -301,8 +323,8 @@ function analyzeExpressApp(code) {
             });
         }
     }
-    // Missing security headers
-    if (!hasHelmet) {
+    // Missing security headers —— 仅真 app（route 模块不重复报，V1 ×7 虚高）
+    if (appIsCreator && !hasHelmet) {
         issues.push({
             severity: "medium",
             rule: "EXPRESS_NO_HELMET",
@@ -311,9 +333,9 @@ function analyzeExpressApp(code) {
             fix: "Add helmet middleware: app.use(helmet())",
         });
     }
-    // POST/PUT routes without validation
-    const mutationRoutes = routes.filter(r => ["post", "put", "patch"].includes(r.method));
-    if (mutationRoutes.length > 0 && !hasValidation) {
+    // POST/PUT routes without validation —— 仅真 app
+    const mutationRoutes = routes.filter(r => isMutation(r) && r.method !== "delete");
+    if (appIsCreator && mutationRoutes.length > 0 && !hasValidation) {
         issues.push({
             severity: "medium",
             rule: "EXPRESS_NO_INPUT_VALIDATION",
@@ -322,8 +344,8 @@ function analyzeExpressApp(code) {
             fix: "Add express-validator or zod validation to mutation routes.",
         });
     }
-    // Missing CORS configuration
-    if (!hasCors) {
+    // Missing CORS configuration —— 仅真 app
+    if (appIsCreator && !hasCors) {
         issues.push({
             severity: "low",
             rule: "EXPRESS_NO_CORS_CONFIG",
@@ -332,8 +354,8 @@ function analyzeExpressApp(code) {
             fix: "Add explicit CORS configuration: app.use(cors({ origin: 'https://your-domain.com' }))",
         });
     }
-    // Session without secure settings (if present)
-    if (hasSession) {
+    // Session without secure settings (if present) —— 仅真 app
+    if (appIsCreator && hasSession) {
         const sessionSecure = /secure\s*:\s*true/.test(code) && /httpOnly\s*:\s*true/.test(code) && /sameSite\s*:\s*['"](?:strict|lax)['"]/.test(code);
         if (!sessionSecure) {
             issues.push({
@@ -368,6 +390,11 @@ function isPublicRoute(path) {
         /^\/robots\.txt/i,
         /^\/$/,
     ];
+    // 尾段认证入口：/users/login、/api/register 等带前缀的真实 world 形态
+    // （V1 时代只认 ^/login 精确匹配——前缀登录入口被误报）
+    if (/\/?(login|signin|signup|sign_in|register|refresh)(\/|$)/i.test(path)) {
+        return true;
+    }
     return publicPatterns.some(p => p.test(path));
 }
 /**

package/dist/frameworks/express-detector.test.js

@@ -125,6 +125,11 @@ app.listen(3000);
     (0, vitest_1.it)("should classify helmet as security_header", () => {
         (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "helmet()")).toBe("security_header");
     });
+    (0, vitest_1.it)("should classify cors() as cors, NOT security_header (regression: SECURITY_HEADER_PATTERNS 曾含 cors 模式致 cors 恒被误分类 → 用 cors 的应用 NO_HELMET 漏报)", () => {
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors()")).toBe("cors");
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors({ origin: 'https://example.com' })")).toBe("cors");
+        (0, vitest_1.expect)((0, express_detector_1.classifyMiddleware)("", "cors(")).toBe("cors");
+    });
 });
 (0, vitest_1.describe)("extractGlobalMiddleware", () => {
     (0, vitest_1.it)("should extract app.use middleware", () => {
@@ -157,6 +162,22 @@ app.listen(3000);
         const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
         (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_HELMET")).toBe(true);
     });
+    (0, vitest_1.it)("should still flag NO_HELMET when app uses cors() but no helmet (regression: cors 曾误分类为 security_header → hasHelmet 误真 → FN)", () => {
+        const corsNoHelmet = `
+      const express = require('express');
+      const cors = require('cors');
+      const app = express();
+      app.use(cors());
+      app.get('/', (req, res) => { res.send('ok'); });
+      app.listen(3000);
+    `;
+        const result = (0, express_detector_1.analyzeExpressApp)(corsNoHelmet);
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_HELMET")).toBe(true);
+        // cors IS recognized — no NO_CORS_CONFIG flag on this app
+        (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_CORS_CONFIG")).toBe(false);
+        // cors() must be typed cors, so engine cross-file suppression works
+        (0, vitest_1.expect)(result.globalMiddleware.some(m => m.type === "cors")).toBe(true);
+    });
     (0, vitest_1.it)("should detect missing CORS", () => {
         const result = (0, express_detector_1.analyzeExpressApp)(INSECURE_APP);
         (0, vitest_1.expect)(result.issues.some(i => i.rule === "EXPRESS_NO_CORS_CONFIG")).toBe(true);
@@ -204,3 +225,51 @@ app.listen(3000);
         (0, vitest_1.expect)(report).toContain("Security Issues:");
     });
 });
+// ── V1 转正回归：接收者路由 / 路由级 auth / 逐路由缺失 / 真 app 门 / 前缀入口 ──
+const ROUTER_MODULE = `
+const express = require('express');
+const router = express.Router();
+const auth = require('../middleware/auth');
+router.get('/articles', async (req, res) => { res.json([]); });
+router.post('/articles', auth.required, async (req, res) => { res.json({}); });
+router.post('/payments', async (req, res) => { res.json({}); });
+module.exports = router;
+`;
+const ROUTER_WITH_LOGIN = `
+const express = require('express');
+const router = express.Router();
+const auth = require('../middleware/auth');
+router.post('/users/login', async (req, res) => { res.json({}); });   // 公开登录
+router.post('/users', async (req, res) => { res.json({}); });          // 公开注册（有 login 姊妹）
+router.put('/user', auth.required, async (req, res) => { res.json({}); });
+module.exports = router;
+`;
+(0, vitest_1.describe)("express V1 转正回归", () => {
+    (0, vitest_1.it)("router 接收者路由可提取（旧版只认 app.——20+ 路由只提取 1 条）", () => {
+        const { routes } = (0, express_detector_1.analyzeExpressApp)(ROUTER_MODULE);
+        (0, vitest_1.expect)(routes.some((r) => r.method === "post" && r.path === "/articles")).toBe(true);
+    });
+    (0, vitest_1.it)("路由级 auth.required 保护不报；同文件其他无认证 mutation 报 ROUTE_MISSING_AUTH", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ROUTER_MODULE);
+        const missing = issues.filter((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /articles");
+        (0, vitest_1.expect)(missing).toContain("POST /payments");
+        // 路由模块不是 app：NO_AUTH/NO_HELMET/NO_CORS 不报（V1 per-file 计数虚高修复）
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_NO_AUTH_MIDDLEWARE")).toBe(false);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_NO_HELMET")).toBe(false);
+    });
+    (0, vitest_1.it)("前缀登录/注册入口豁免：/users/login 与 /users（姊妹佐证）不报", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ROUTER_WITH_LOGIN);
+        const missing = issues.filter((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(missing).not.toContain("POST /users");
+        (0, vitest_1.expect)(missing).not.toContain("PUT /user");
+    });
+    (0, vitest_1.it)("摘掉某条 auth.required（其余仍受保护）→ 该 mutation 报 ROUTE_MISSING_AUTH（敏感性）", () => {
+        const twoProtected = ROUTER_MODULE.replace("router.post('/payments', async", "router.put('/admin', auth.required, async");
+        const stripped = twoProtected.replace("router.post('/articles', auth.required,", "router.post('/articles',");
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(stripped);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "POST /articles")).toBe(true);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "PUT /admin")).toBe(false);
+    });
+});

package/dist/frameworks/fastify-detector.js

@@ -57,6 +57,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeFastifyApp = analyzeFastifyApp;
 exports.analyzeFastifyFile = analyzeFastifyFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -74,7 +75,50 @@ function isAuthFnName(name) {
     const lower = name.toLowerCase();
     return AUTH_FN_WORDS.some((w) => lower.includes(w));
 }
-// ── Analysis（代码串级，镜像 express-detector） ──
+// ── Analysis（代码串级） ──
+/** 自 openIdx（'{' 或 '('）取平衡块内文本（字符串感知） */
+function balancedBlock(code, openIdx) {
+    const open = code[openIdx];
+    const close = open === "{" ? "}" : ")";
+    let depth = 1;
+    let end = openIdx + 1;
+    let quote = null;
+    while (end < code.length && depth > 0) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === open) {
+            depth++;
+        }
+        else if (ch === close) {
+            depth--;
+        }
+        end++;
+    }
+    return code.slice(openIdx + 1, Math.max(openIdx + 1, end - 1));
+}
+/** 认证选项名：位置形态（options 对象）与 object-form 路由均可出现 */
+const AUTH_OPTION_NAMES = ["onRequest", "preHandler", "preValidation"];
+/** 选项数组里是否有 auth-like 名（支持点限定 server.authenticate） */
+function optionListHasAuth(listText) {
+    return listText.split(",").some((name) => isAuthFnName(name.trim()));
+}
+function hasAuthOptionInBlock(block) {
+    for (const opt of AUTH_OPTION_NAMES) {
+        const re = new RegExp(`\\b${opt}\\s*:\\s*\\[([^\\]]*)\\]`, "g");
+        let mm;
+        while ((mm = re.exec(block)) !== null) {
+            if (optionListHasAuth(mm[1]))
+                return true;
+        }
+    }
+    return false;
+}
 function analyzeFastifyApp(code) {
     const issues = [];
     const routes = [];
@@ -84,44 +128,60 @@ function analyzeFastifyApp(code) {
         return { hasFastify: false, routes, authHooks, issues };
     }
     // 全局认证钩子：addHook('preHandler'|'preValidation'|'onRequest', authFn)
-    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*)/g;
+    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = hookRe.exec(code)) !== null) {
         if (isAuthFnName(m[2]))
             authHooks.push(m[2]);
     }
-    // 路由注册：fastify.post('/x', {...}, handler) —— 捕获到 options 窗口
-    const routeRe = /\.(get|post|put|patch|delete|route)\s*\(\s*['"]([^'"]+)['"]/g;
-    while ((m = routeRe.exec(code)) !== null) {
-        const method = m[1].toLowerCase();
-        const pathName = m[2];
-        // 从路由调用起点向后截取 400 字符窗口，查 preHandler/preValidation 选项
-        const windowStart = m.index;
-        const window = code.slice(windowStart, windowStart + 400);
-        const hasAuthOption = /\b(preHandler|preValidation)\s*:/g.test(window)
-            && (() => {
-                // 选项值里出现 auth-like 函数名才认（保守）
-                const optMatch = window.match(/\b(preHandler|preValidation)\s*:\s*\[([^\]]*)\]/);
-                if (!optMatch)
-                    return false;
-                return optMatch[2].split(",").some((name) => isAuthFnName(name.trim()));
-            })();
+    const pushRoute = (method, pathName, protected_, at) => {
         routes.push({
             method,
             path: pathName,
-            protected: hasAuthOption,
-            line: code.slice(0, m.index).split("\n").length,
+            protected: protected_,
+            line: code.slice(0, at).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthOption
-            && authHooks.length === 0 && !isAuthEntryPath(pathName)) {
+    };
+    // ── object-form 路由：server.route({ method, path, onRequest:[auth], ... })
+    //    （fastify-realworld 20/20 用此形态——V2 recall 失明根因）
+    const objRe = /\.route\s*\(\s*\{/g;
+    while ((m = objRe.exec(code)) !== null) {
+        const block = balancedBlock(code, m.index + m[0].length - 1); // 自 '{'
+        const methodM = block.match(/method\s*:\s*['"]([^'"]+)['"]/);
+        if (!methodM)
+            continue;
+        const method = methodM[1].toLowerCase();
+        // path 可能是拼接 options.prefix + 'users/login'——取首个引号字面量
+        const pathM = block.match(/path\s*:\s*[^,'"\n]*['"]([^'"]+)['"]/);
+        const pathName = pathM ? pathM[1] : "";
+        const protected_ = hasAuthOptionInBlock(block);
+        pushRoute(method, pathName, protected_, m.index);
+    }
+    // ── 位置形态：fastify.post('/x', { preHandler: [auth] }, handler) ──
+    const posRe = /\.(get|post|put|patch|delete)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = posRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index, m.index + 400);
+        const protected_ = hasAuthOptionInBlock(window);
+        pushRoute(method, pathName, protected_, m.index);
+    }
+    // register 集合豁免（语义层，同 Koa/Gin）：有 <path>/login 姊妹佐证的
+    // 账户集合，其无认证 POST = 公开注册
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authHooks.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "FASTIFY_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} is registered without ` +
-                    `preHandler/preValidation auth and the app has no auth hook — ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} is registered without ` +
+                    `onRequest/preHandler/preValidation auth and the app has no auth hook — ` +
                     `any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -131,7 +191,11 @@ function analyzeFastifyFile(filePath) {
     if (!fs.existsSync(filePath))
         return null;
     const code = fs.readFileSync(filePath, "utf-8");
-    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)/.test(code))
+    // 门：直接 import fastify（应用入口）或 fastify-plugin（真实插件模块——
+    // fastify-realworld 的路由模块是 fp(plugin) 包裹、接收 server 实例；
+    // 旧门只认 require('fastify') → 0/38 文件进门）
+    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)|fastify-plugin/.test(code)) {
         return null;
+    }
     return analyzeFastifyApp(code);
 }

package/dist/frameworks/fastify-detector.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * fastify-detector.test.ts — Fastify 框架适配器规则回归（纯函数，无文件 I/O）
@@ -8,6 +41,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const vitest_1 = require("vitest");
 const fastify_detector_1 = require("./fastify-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, hooks = "") => `
 import Fastify from "fastify";
 const fastify = Fastify();
@@ -60,3 +96,66 @@ fastify.post("/register", async (req, reply) => ({ ok: true }));
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V2 结构性重写回归：object-form / onRequest / plugin 门 / register 豁免 ──
+(0, vitest_1.describe)("fastify-detector object-form 路由（V2 修复回归）", () => {
+    (0, vitest_1.it)("server.route({method,path,onRequest:[server.authenticate]}) 受保护不报", () => {
+        const { issues, routes } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({
+  method: 'POST',
+  path: options.prefix + 'articles',
+  onRequest: [server.authenticate],
+  handler: onCreate
+});
+`));
+        (0, vitest_1.expect)(routes.find((r) => r.path === "articles").protected).toBe(true);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("object-form 无认证 mutation → 报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({
+  method: 'POST',
+  path: options.prefix + 'payments',
+  handler: onPay
+});
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST payments");
+    });
+    (0, vitest_1.it)("点限定 server.authenticate 在 onRequest 数组被识别（词表含 auth）", () => {
+        const { routes } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({ method: 'DELETE', path: 'x', onRequest: [server.authenticate], handler: h });
+`));
+        (0, vitest_1.expect)(routes[0].protected).toBe(true);
+    });
+    (0, vitest_1.it)("register 集合豁免：POST users（有 users/login 姊妹）不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({ method: 'POST', path: options.prefix + 'users/login', handler: onLogin });
+server.route({ method: 'POST', path: options.prefix + 'users', handler: onRegister });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST users/login");
+    });
+});
+(0, vitest_1.describe)("fastify-detector plugin 门（V2 修复回归）", () => {
+    (0, vitest_1.it)("fastify-plugin 模块（fp(plugin) 路由文件）现可被分析", () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fastify-det-"));
+        try {
+            const fp = path.join(dir, "routes-users.js");
+            fs.writeFileSync(fp, `
+const fp = require('fastify-plugin')
+async function users (server, options, done) {
+  server.route({ method: 'POST', path: 'articles', onRequest: [server.authenticate], handler: h })
+  server.route({ method: 'POST', path: 'open', handler: h })
+}
+module.exports = fp(users)
+`);
+            const a = (0, fastify_detector_1.analyzeFastifyFile)(fp);
+            (0, vitest_1.expect)(a).not.toBeNull();
+            (0, vitest_1.expect)(a.routes.length).toBe(2);
+            (0, vitest_1.expect)(a.issues.map((i) => i.route)).toContain("POST open");
+            (0, vitest_1.expect)(a.issues.map((i) => i.route)).not.toContain("POST articles");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});