progmune-runtime 3.7.14 → 3.7.16

package/dist/frameworks/gin-detector.js

@@ -54,7 +54,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeGinApp = analyzeGinApp;
 exports.analyzeGinFile = analyzeGinFile;
+exports.ginFuncStarts = ginFuncStarts;
+exports.ginProtectedRegisterFns = ginProtectedRegisterFns;
+exports.ginEnclosingFunc = ginEnclosingFunc;
+exports.analyzeGinProject = analyzeGinProject;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -84,24 +89,28 @@ function analyzeGinApp(code) {
         return { hasGin: false, routes, authGroupMiddleware, issues };
     }
     // 组级认证中间件：r.Use(authMW) / r.Group("/api", authMW) / g.Use(authMW)
-    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    // 捕获支持点限定成员（users.AuthMiddleware）——修复旧版只捕限定符
+    // "users" 的缺陷（V7）。整名送词表判定（AuthMiddleware 含 auth ✓）
+    const useRe = /\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = useRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authGroupMiddleware.push(m[1]);
     }
-    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_][\w]*)/g;
+    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     while ((m = groupRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authGroupMiddleware.push(m[1]);
     }
     // 路由注册：r.POST("/x", mw1, mw2, handler)——Go 方法名大写（POST 惯例）
-    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    // 空路径 "..." 允许（realworld 惯用 POST("", ...) 双注册）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]*)"(\s*,\s*|\s*\))/gi;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase();
         const pathName = m[2];
-        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
-        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        // 认证窗口 = 本次调用边界内（括号感知），不跨路由（V7 缺陷修复）
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -109,15 +118,23 @@ function analyzeGinApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authGroupMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层，同 Koa）：有 <path>/login 姊妹佐证的
+    // 账户集合，其无认证 POST = 公开注册（gin realworld 用 POST "" /
+    // "/" + /login 双注册——路径豁免词表认不出）
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authGroupMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "GIN_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and no auth Use/Group middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -131,3 +148,99 @@ function analyzeGinFile(filePath) {
         return null;
     return analyzeGinApp(code);
 }
+/** 顶层函数头（行号 1-based）——排除接收者方法（method receiver） */
+function ginFuncStarts(text) {
+    const out = [];
+    const re = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        out.push({ name: m[1], line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+}
+/**
+ * 从 bootstrap 文本（含 gin.Default/New 的文件）推导：
+ * 哪些 Register 函数在「组已施加认证 Use 之后」被调用（其路由受保护）。
+ * 语句顺序敏感：Use 之前注册的（register/login）不算。
+ */
+function ginProtectedRegisterFns(bootstrapText) {
+    const state = new Map(); // 组变量 → 已认证
+    const protectedFns = new Map();
+    const re = /(\w+)\s*(?::=|=)\s*gin\.(Default|New)\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)(?:\s*\(\s*(true|false))?|(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(?:[\w.]*\.)?([A-Z][A-Za-z0-9_]*)\s*\(\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(/g;
+    let m;
+    // 组编号（按开括号序）：1,2 根组 | 3,4,5 Use | 6,7 子组 | 8,9 注册调用
+    while ((m = re.exec(bootstrapText)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], false); // 根组：gin.Default/New
+        }
+        else if (m[3] !== undefined) {
+            // 组.Use(认证)；首参字面 false = 可选认证（public 读通行）不视为
+            // 保护——否则删掉 required Use 后 mutations 仍被可选 Use 掩盖（FN）
+            if (isAuthFnName(m[4]) && m[5] !== "false")
+                state.set(m[3], true);
+        }
+        else if (m[6] !== undefined) {
+            state.set(m[6], !!state.get(m[7])); // 子组继承父组状态
+        }
+        else if (m[8] !== undefined) {
+            if (state.get(m[9]))
+                protectedFns.set(m[8], true); // 认证相位调用的 Register fn
+        }
+    }
+    return protectedFns;
+}
+/** routeLine 所在顶层函数名（按 func 头归属） */
+function ginEnclosingFunc(text, routeLine) {
+    let name = null;
+    for (const f of ginFuncStarts(text)) {
+        if (f.line <= routeLine)
+            name = f.name;
+        else
+            break;
+    }
+    return name;
+}
+/** 项目级分析：跨文件组认证传播 + 文件级判定兜底 */
+function analyzeGinProject(projectRoot) {
+    const files = [];
+    // 简易 walk（.go，跳过 _test/vendor/node_modules）
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            if (e.isDirectory()) {
+                if (["vendor", "node_modules", ".git"].includes(e.name))
+                    continue;
+                walk(`${d}/${e.name}`);
+            }
+            else if (e.name.endsWith(".go") && !e.name.endsWith("_test.go")) {
+                const fp = `${d}/${e.name}`;
+                try {
+                    files.push({ file: fp, text: fs.readFileSync(fp, "utf-8"), a: analyzeGinFile(fp) });
+                }
+                catch { /* skip unreadable */ }
+            }
+        }
+    };
+    if (fs.existsSync(projectRoot))
+        walk(projectRoot.replace(/\/$/, ""));
+    // bootstrap：含 gin.Default/gin.New 的文件（组认证相位在此推导）
+    const bootstrap = files.find((f) => /gin\.(Default|New)\s*\(/.test(f.text));
+    const protectedFns = bootstrap
+        ? ginProtectedRegisterFns(bootstrap.text)
+        : new Map();
+    const issues = [];
+    for (const { file, text, a } of files) {
+        if (!a || a.issues.length === 0)
+            continue;
+        for (const issue of a.issues) {
+            const fn = issue.line ? ginEnclosingFunc(text, issue.line) : null;
+            if (fn && protectedFns.get(fn))
+                continue; // 认证相位注册 → 受保护
+            issues.push({ ...issue, route: issue.route });
+        }
+    }
+    return {
+        filesScanned: files.length,
+        protectedFunctions: [...protectedFns.keys()].filter((k) => protectedFns.get(k)),
+        issues,
+    };
+}

package/dist/frameworks/gin-detector.test.js

@@ -1,10 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * gin-detector.test.ts — Gin 框架适配器规则回归（纯函数，无文件 I/O）
  */
 const vitest_1 = require("vitest");
 const gin_detector_1 = require("./gin-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, extra = "") => `
 import "github.com/gin-gonic/gin"
 
@@ -62,3 +98,150 @@ func main() {
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V7 修复轮回归：Use 点限定捕获 / 窗口边界 / 空路径 ──
+(0, vitest_1.describe)("gin-detector V7 修复回归", () => {
+    (0, vitest_1.it)("Use 点限定成员（users.AuthMiddleware）被识别为认证中间件（旧版只捕 'users'）", () => {
+        const { issues, authGroupMiddleware } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1 := r.Group("/api")
+	v1.Use(users.AuthMiddleware(true))
+	v1.POST("/pay", createPayment)
+`));
+        (0, vitest_1.expect)(authGroupMiddleware).toContain("users.AuthMiddleware");
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("窗口不跨路由串扰：后面路由的认证中间件不保护前面的公开路由", () => {
+        const { issues, routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/users", UsersRegistration)
+	v1.POST("/articles", AuthMiddleware(), ArticleCreate)
+`));
+        const reg = routes.find((x) => x.path === "/users");
+        const art = routes.find((x) => x.path === "/articles");
+        (0, vitest_1.expect)(reg.protected).toBe(false);
+        (0, vitest_1.expect)(art.protected).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("handler 名含 auth 词不误判为认证（UsersLogin 是 handler 不是中间件）", () => {
+        const { routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/login", UsersLogin)
+`));
+        const login = routes.find((x) => x.path === "/login");
+        (0, vitest_1.expect)(login.protected).toBe(false);
+    });
+    (0, vitest_1.it)("空路径注册可见（realworld 惯用 POST(\"\", ...)）", () => {
+        const { routes } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+`));
+        (0, vitest_1.expect)(routes.some((x) => x.path === "")).toBe(true);
+    });
+});
+// ── register 集合豁免（语义层）──
+(0, vitest_1.describe)("gin-detector register 集合豁免", () => {
+    (0, vitest_1.it)("有 /login 姊妹佐证：POST \"\"/\"/\"（公开注册双注册）不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+	v1.POST("/", UsersRegistration)
+	v1.POST("/login", UsersLogin)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST ");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /login");
+    });
+    (0, vitest_1.it)("POST-only：同根的 PUT 不豁免（user-update 类仍查）", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("", UsersRegistration)
+	v1.POST("/login", UsersLogin)
+	v1.PUT("", UserUpdate)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST ");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("PUT ");
+    });
+    (0, vitest_1.it)("无姊妹佐证：POST \"/users\" 仍报（管理员建用户不豁免）", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	v1.POST("/users", AdminCreateUser)
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST /users");
+    });
+});
+// ── V7 转正：组认证跨文件传播 ──
+const BOOTSTRAP = `package main
+import "github.com/gin-gonic/gin"
+func main() {
+	r := gin.Default()
+	v1 := r.Group("/api")
+	users.UsersRegister(v1.Group("/users"))            // Use 之前 → 公开
+	v1.Use(users.AuthMiddleware(false))                // 可选认证
+	tags.TagsRegister(v1.Group("/tags"))
+	v1.Use(users.AuthMiddleware(true))
+	users.UserRegister(v1.Group("/user"))
+	articles.ArticlesRegister(v1.Group("/articles"))
+}
+`;
+const ROUTERS = `package users
+import "github.com/gin-gonic/gin"
+func UsersRegister(router *gin.RouterGroup) {
+	router.POST("/login", UsersLogin)
+	router.POST("", UsersRegistration)
+}
+func UserRegister(router *gin.RouterGroup) {
+	router.PUT("", UserUpdate)
+	router.PUT("/", UserUpdate)
+}
+`;
+(0, vitest_1.describe)("ginProtectedRegisterFns 组认证相位推导", () => {
+    (0, vitest_1.it)("Use(true) 之后的 Register 调用受保护，Use 之前的公开", () => {
+        const p = (0, gin_detector_1.ginProtectedRegisterFns)(BOOTSTRAP);
+        (0, vitest_1.expect)(p.get("UserRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBe(true);
+        (0, vitest_1.expect)(p.get("UsersRegister")).toBeUndefined(); // Use 之前注册（register/login 公开）
+        (0, vitest_1.expect)(p.get("TagsRegister")).toBeUndefined(); // 仅可选 Use(false) 之下
+    });
+    (0, vitest_1.it)("可选认证 Use(false) 不视为保护（否则删 required 后被掩盖）", () => {
+        const p = (0, gin_detector_1.ginProtectedRegisterFns)(BOOTSTRAP.replace("v1.Use(users.AuthMiddleware(true))\n", ""));
+        (0, vitest_1.expect)(p.get("UserRegister")).toBeUndefined();
+        (0, vitest_1.expect)(p.get("ArticlesRegister")).toBeUndefined();
+    });
+});
+(0, vitest_1.describe)("ginEnclosingFunc 路由函数归属", () => {
+    (0, vitest_1.it)("按 func 头行号归属", () => {
+        const lines = ROUTERS.split("\n");
+        const lineNo = (i) => i + 1;
+        const fnAt = (text, ln) => (0, gin_detector_1.ginEnclosingFunc)(text, ln);
+        // ROUTERS：1 package / 2 import / 3 func UsersRegister … 7 func UserRegister
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(3))).toBe("UsersRegister");
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(7))).toBe("UserRegister");
+        (0, vitest_1.expect)(fnAt(ROUTERS, lineNo(1))).toBeNull(); // package 行无函数
+    });
+});
+(0, vitest_1.describe)("analyzeGinProject 跨文件传播", () => {
+    function makeProject(withRequiredUse) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "gin-proj-"));
+        const boot = withRequiredUse ? BOOTSTRAP : BOOTSTRAP.replace(/\tv1\.Use\(users\.AuthMiddleware\(true\)\)\n/, "");
+        fs.writeFileSync(path.join(dir, "hello.go"), boot);
+        fs.writeFileSync(path.join(dir, "routers.go"), ROUTERS);
+        return dir;
+    }
+    (0, vitest_1.it)("Use(true) 保护下：跨文件 mutation 不报", () => {
+        const dir = makeProject(true);
+        try {
+            const a = (0, gin_detector_1.analyzeGinProject)(dir);
+            // UserRegister 的 PUT 受组认证保护（跨文件传播）
+            (0, vitest_1.expect)(a.issues.filter((i) => i.rule === "GIN_ROUTE_NO_AUTH")).toHaveLength(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("删掉 Use(true)：mutation 重新被报（敏感性保留）", () => {
+        const dir = makeProject(false);
+        try {
+            const a = (0, gin_detector_1.analyzeGinProject)(dir);
+            const routes = a.issues.filter((i) => i.rule === "GIN_ROUTE_NO_AUTH").map((i) => i.route);
+            (0, vitest_1.expect)(routes).toContain("PUT ");
+            (0, vitest_1.expect)(routes).toContain("PUT /");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});

package/dist/frameworks/hapi-detector.js

@@ -56,6 +56,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeHapiApp = analyzeHapiApp;
 exports.analyzeHapiFile = analyzeHapiFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -66,11 +67,56 @@ function isAuthEntryPath(pathName) {
     return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
 }
 // ── Analysis（代码串级） ──
+/** 声明式 hapi 路由模块（V6 遗留缺口）：真实 hapi 应用（glue/pal/插件）
+ * 以数组声明路由——module.exports = (server) => [ { method, path,
+ *   config: { auth: 'jwt', ... }, handler }, ... ]，由框架注册；
+ * 文件本身无 require('hapi')、无 server.route 调用 */
+function isDeclarativeHapiModule(code) {
+    const hasRouteObject = /method\s*:\s*['"](GET|POST|PUT|PATCH|DELETE|get|post|put|patch|delete)['"]/.test(code) &&
+        /path\s*:\s*['"]/.test(code) &&
+        /\b(?:config|options)\s*:/.test(code);
+    if (!hasRouteObject)
+        return false;
+    return (/module\.exports\s*=\s*\(?\s*server\b/.test(code) ||
+        /module\.exports\s*=\s*function\s*\(\s*server\b/.test(code) ||
+        /return\s*\[/.test(code));
+}
+/** 自 routeObjStart('{') 取平衡块文本（含嵌套 config 对象；字符串感知） */
+function hapiBalancedBlock(code, openIdx) {
+    let depth = 1;
+    let end = openIdx + 1;
+    let quote = null;
+    while (end < code.length && depth > 0) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === "{") {
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+        }
+        end++;
+    }
+    return code.slice(openIdx + 1, Math.max(openIdx + 1, end - 1));
+}
+function hapiAuthOption(block) {
+    const authM = block.match(/\bauth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
+    if (!authM)
+        return null;
+    return authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null;
+}
 function analyzeHapiApp(code) {
     const issues = [];
     const routes = [];
     const strategies = [];
-    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b/.test(code);
+    // @hapi-scoped（v17+）、v16 require('hapi'），或声明式数组模块（V6 修复）
+    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b|require\(\s*['"]hapi['"]\s*\)|from\s+['"]hapi['"]/.test(code) || isDeclarativeHapiModule(code);
     if (!hasHapi) {
         return { hasHapi: false, routes, strategies, issues };
     }
@@ -80,43 +126,69 @@ function analyzeHapiApp(code) {
     while ((m = strategyRe.exec(code)) !== null) {
         strategies.push(m[1]);
     }
-    // 路由块：server.route({ ... }) —— 从 route( 向后截 500 字符窗口
-    const routeRe = /\.route\s*\(\s*\{/g;
-    while ((m = routeRe.exec(code)) !== null) {
-        const window = code.slice(m.index, m.index + 500);
-        const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
-        const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
-        const authM = window.match(/auth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
-        if (!methodM || !pathM)
+    const declarative = isDeclarativeHapiModule(code);
+    const lineAt = (idx) => code.slice(0, idx).split("\n").length;
+    if (!declarative) {
+        // 直连形态：server.route({ ... }) —— 500 字符窗口
+        const routeRe = /\.route\s*\(\s*\{/g;
+        while ((m = routeRe.exec(code)) !== null) {
+            const window = code.slice(m.index, m.index + 500);
+            const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
+            const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            if (!methodM || !pathM)
+                continue;
+            routes.push({
+                method: methodM[1].toLowerCase(),
+                path: pathM[1],
+                authOption: hapiAuthOption(window),
+                line: lineAt(m.index),
+            });
+        }
+    }
+    else {
+        // 声明式数组：每个 { method, path, config:{auth} } 路由对象
+        const verbRe = /method\s*:\s*['"](GET|POST|PUT|PATCH|DELETE|get|post|put|patch|delete)['"]/g;
+        while ((m = verbRe.exec(code)) !== null) {
+            const verb = m[1].toLowerCase();
+            const verbLine = lineAt(m.index);
+            const objStart = code.lastIndexOf("{", m.index);
+            if (objStart < 0)
+                continue;
+            const block = hapiBalancedBlock(code, objStart);
+            const pathM = block.match(/path\s*:\s*['"]([^'"]+)['"]/);
+            if (!pathM)
+                continue;
+            // 重复对象去重
+            if (routes.some((r) => r.line === verbLine && r.method === verb))
+                continue;
+            routes.push({
+                method: verb,
+                path: pathM[1],
+                authOption: hapiAuthOption(block),
+                line: verbLine,
+            });
+        }
+    }
+    // register 集合豁免（语义层，同其他框架）：users/login 姊妹 → POST users 公开
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (!MUTATION_METHODS.has(r.method))
             continue;
-        const method = methodM[1].toLowerCase();
-        const pathName = pathM[1];
-        // auth: false → 显式公开；无 auth 字段 → authM null
-        const authOption = authM
-            ? (authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null)
-            : null;
-        routes.push({
-            method,
-            path: pathName,
-            authOption,
-            line: code.slice(0, m.index).split("\n").length,
-        });
-        if (!MUTATION_METHODS.has(method))
+        if (isAuthEntryPath(r.path))
             continue;
-        if (isAuthEntryPath(pathName))
+        if (r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))
             continue;
-        // 无 auth 字段（authOption null 且非显式 false 已涵盖）或显式 false → 报
-        if (authOption === null || authOption === "false") {
+        if (r.authOption === null || r.authOption === "false") {
             issues.push({
                 severity: "medium",
                 rule: "HAPI_ROUTE_NO_AUTH",
-                message: authOption === "false"
-                    ? `Mutation route ${method.toUpperCase()} ${pathName} is explicitly ` +
+                message: r.authOption === "false"
+                    ? `Mutation route ${r.method.toUpperCase()} ${r.path} is explicitly ` +
                         `public (auth: false) — any caller can reach it.`
-                    : `Mutation route ${method.toUpperCase()} ${pathName} has no auth ` +
+                    : `Mutation route ${r.method.toUpperCase()} ${r.path} has no auth ` +
                         `option in its route config — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -126,7 +198,9 @@ function analyzeHapiFile(filePath) {
     if (!fs.existsSync(filePath))
         return null;
     const code = fs.readFileSync(filePath, "utf-8");
-    if (!/@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b/.test(code))
+    // gate：@hapi-scoped / v16 require('hapi') / 声明式数组模块
+    const marker = /@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b|require\(\s*['"]hapi['"]\s*\)|from\s+['"]hapi['"]/.test(code) || isDeclarativeHapiModule(code);
+    if (!marker)
         return null;
     return analyzeHapiApp(code);
 }

package/dist/frameworks/hapi-detector.test.js

@@ -58,3 +58,94 @@ server.route({ method: "POST", path: "/login", handler: () => "token" });
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V6 修复轮回归：v16 时代 require('hapi') gate 兼容 ──
+(0, vitest_1.describe)("hapi-detector V6 gate 修复回归", () => {
+    (0, vitest_1.it)("v16 形态 require('hapi') + server.route 可被分析（旧 gate 只认 @hapi-scoped）", () => {
+        const code = `
+const Hapi = require("hapi");
+const server = new Hapi.Server();
+server.connection({ port: 3000 });
+server.auth.strategy("jwt", "jwt", { key: "s" });
+server.route({ method: "POST", path: "/articles", config: { auth: "jwt" }, handler: (r, reply) => reply({}) });
+server.route({ method: "POST", path: "/payments", handler: (r, reply) => reply({}) });
+`;
+        const { hasHapi, strategies, routes, issues } = (0, hapi_detector_1.analyzeHapiApp)(code);
+        (0, vitest_1.expect)(hasHapi).toBe(true);
+        (0, vitest_1.expect)(strategies).toContain("jwt");
+        const articles = routes.find((r) => r.path === "/articles");
+        const payments = routes.find((r) => r.path === "/payments");
+        (0, vitest_1.expect)(articles).toBeDefined();
+        (0, vitest_1.expect)(articles.authOption).toBe("jwt"); // config.auth 嵌套亦被窗口文本捕获
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("gate 不误收 hapi-auth-jwt2（require('hapi') 需闭合引号紧随）", () => {
+        const { hasHapi } = (0, hapi_detector_1.analyzeHapiApp)(`
+const hapiAuth = require("hapi-auth-jwt2");
+module.exports = (server) => { return []; };
+`);
+        (0, vitest_1.expect)(hasHapi).toBe(false);
+    });
+});
+// ── V6 遗留缺口：声明式数组路由 + config.auth 嵌套 ──
+const DECLARATIVE = `
+module.exports = (server) => {
+  const handlers = require('./handlers')(server)
+  return [
+    // GET 公开
+    {
+      method: 'GET',
+      path: '/articles',
+      config: { description: 'list' },
+      handler: handlers.list
+    },
+    // mutation 受保护（config.auth 嵌套）
+    {
+      method: 'POST',
+      path: '/articles',
+      config: { auth: 'jwt', response: {} },
+      handler: handlers.create
+    },
+    // 无认证 mutation
+    {
+      method: 'POST',
+      path: '/payments',
+      config: {},
+      handler: handlers.pay
+    }
+  ]
+}
+`;
+const DECLARATIVE_USERS = `
+module.exports = (server) => {
+  return [
+    { method: 'POST', path: '/users/login', config: {}, handler: h },
+    { method: 'POST', path: '/users', config: {}, handler: h },
+    { method: 'PUT', path: '/user', config: { auth: 'jwt' }, handler: h }
+  ]
+}
+`;
+(0, vitest_1.describe)("hapi 声明式数组路由（V6 修复回归）", () => {
+    (0, vitest_1.it)("module.exports=(server)+数组路由对象被识别，config.auth 保护生效", () => {
+        const { hasHapi, routes, issues } = (0, hapi_detector_1.analyzeHapiApp)(DECLARATIVE);
+        (0, vitest_1.expect)(hasHapi).toBe(true);
+        (0, vitest_1.expect)(routes.length).toBe(3);
+        const create = routes.find((r) => r.method === "post" && r.path === "/articles");
+        (0, vitest_1.expect)(create.authOption).toBe("jwt");
+        const missing = issues.filter((i) => i.rule === "HAPI_ROUTE_NO_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).toContain("POST /payments");
+        (0, vitest_1.expect)(missing).not.toContain("POST /articles");
+    });
+    (0, vitest_1.it)("摘 config.auth → mutation 报（敏感性）", () => {
+        const stripped = DECLARATIVE.replace("config: { auth: 'jwt', response: {} }", "config: { response: {} }");
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(stripped);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "HAPI_ROUTE_NO_AUTH" && i.route === "POST /articles")).toBe(true);
+    });
+    (0, vitest_1.it)("register/login 公开：users/login + users（姊妹佐证）不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(DECLARATIVE_USERS);
+        const missing = issues.filter((i) => i.rule === "HAPI_ROUTE_NO_AUTH").map((i) => i.route);
+        (0, vitest_1.expect)(missing).not.toContain("POST /users/login");
+        (0, vitest_1.expect)(missing).not.toContain("POST /users");
+        (0, vitest_1.expect)(missing).not.toContain("PUT /user");
+    });
+});