progmune-runtime 3.7.14 → 3.7.16

package/dist/frameworks/trpc-detector.js

@@ -26,7 +26,9 @@ exports.extractRouterNames = extractRouterNames;
 exports.extractProcedures = extractProcedures;
 exports.analyzeTRPCFile = analyzeTRPCFile;
 // ── Detection Patterns ──
-const PROCEDURE_TYPE_PATTERN = /\b(publicProcedure|protectedProcedure|adminProcedure)\b/g;
+// 注意：detect 用途不带 /g——带 /g 的 test() 会跨文件泄漏 lastIndex，
+// 导致逐文件扫描结果随顺序漂移（实测 4/19 vs 7/19）
+const PROCEDURE_TYPE_PATTERN = /\b(publicProcedure|protectedProcedure|adminProcedure)\b/;
 const DB_WRITE_PATTERN = /\b(db\.(insert|update|delete|create|upsert|execute)|prisma\.\w+\.(create|update|delete|upsert|createMany|updateMany|deleteMany)|drizzle\.(insert|update|delete)|\.(insert|update|delete|create|upsert)\s*\()/i;
 /**
  * Detect whether this file contains tRPC definitions.
@@ -57,30 +59,94 @@ function extractRouterNames(code) {
  */
 function extractProcedures(code) {
     const procedures = [];
-    // Match: name: <procedureType>.input(...).<kind>( or name: <procedureType>.<kind>(
-    const procRe = /([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(publicProcedure|protectedProcedure|adminProcedure)((?:\.\w+\s*\([^()]*\))*)\.(query|mutation)\s*\(/g;
+    // 过程起点：name: <procedureType>（不含链）——v11 惯用法 t.procedure
+    // （V4 遗留缺口：只认 XxxProcedure 命名包装，内联 t.procedure 不可见）
+    const procStartRe = /([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(t\s*\.\s*procedure|publicProcedure|protectedProcedure|adminProcedure)\b/g;
     let m;
-    while ((m = procRe.exec(code)) !== null) {
+    while ((m = procStartRe.exec(code)) !== null) {
         const name = m[1];
-        const procType = m[2].replace(/Procedure$/, "");
-        const chain = m[3] || "";
-        const kind = m[4];
-        const hasInputSchema = /\.input\s*\(/.test(chain);
-        // Extract body until matching closing paren of the query/mutation call.
-        // Heuristic: scan forward for the closing paren matching the one after
-        // the .query( / .mutation( token.
-        const openIdx = procRe.lastIndex - 1; // index of '(' after query/mutation
+        // t.procedure = v11 基础构造器（无包装 → 默认公开语义）；命名包装去掉后缀
+        const procType = (m[2].includes(".") ? "public" : m[2].replace(/Procedure$/, ""));
+        // ── 链扫描（括号感知）──
+        // 自 procedure 类型后逐个解析 .method(balancedArgs)，容忍嵌套括号与
+        // 多行（.input(z.object({...})) 等标准形态），直至 .query(/.mutation(
+        // 或链中断。旧实现用 (?:\.\w+\([^()]*\))* 不跨嵌套括号 → 标准
+        // zod input 链整体失明（V4 缺陷）。
+        let pos = procStartRe.lastIndex;
+        let hasInputSchema = false;
+        let kind = null;
+        let kindOpenIdx = -1; // .query( 或 .mutation( 的 '(' 下标
+        const skipWs = () => {
+            while (pos < code.length && /\s/.test(code[pos]))
+                pos++;
+        };
+        const consumeBalanced = (open, close) => {
+            let depth = 1;
+            let quote = null;
+            pos++; // 跳过 open
+            while (pos < code.length && depth > 0) {
+                const ch = code[pos];
+                if (quote) {
+                    if (ch === quote && code[pos - 1] !== "\\")
+                        quote = null;
+                }
+                else if (ch === '"' || ch === "'" || ch === "`") {
+                    quote = ch;
+                }
+                else if (ch === open) {
+                    depth++;
+                }
+                else if (ch === close) {
+                    depth--;
+                }
+                pos++;
+            }
+        };
+        for (let step = 0; step < 100; step++) {
+            skipWs();
+            if (code[pos] !== ".")
+                break;
+            pos++;
+            const methStart = pos;
+            while (pos < code.length && /[A-Za-z0-9_$]/.test(code[pos]))
+                pos++;
+            const method = code.slice(methStart, pos);
+            skipWs();
+            if (code[pos] !== "(")
+                break;
+            if (method === "query" || method === "mutation") {
+                kind = method;
+                kindOpenIdx = pos; // '(' 位置
+                break;
+            }
+            if (method === "input")
+                hasInputSchema = true;
+            consumeBalanced("(", ")");
+        }
+        if (kind === null || kindOpenIdx < 0)
+            continue; // 非完整过程定义
+        // ── body：自 kind 的 '(' 后到匹配闭合括号（字符串感知）──
         let depth = 1;
-        let closeIdx = openIdx + 1;
+        let closeIdx = kindOpenIdx + 1;
+        let quote = null;
         while (closeIdx < code.length && depth > 0) {
             const ch = code[closeIdx];
-            if (ch === "(")
+            if (quote) {
+                if (ch === quote && code[closeIdx - 1] !== "\\")
+                    quote = null;
+            }
+            else if (ch === '"' || ch === "'" || ch === "`") {
+                quote = ch;
+            }
+            else if (ch === "(") {
                 depth++;
-            else if (ch === ")")
+            }
+            else if (ch === ")") {
                 depth--;
+            }
             closeIdx++;
         }
-        const body = code.slice(openIdx + 1, Math.min(closeIdx - 1, openIdx + 2000));
+        const body = code.slice(kindOpenIdx + 1, Math.min(closeIdx - 1, kindOpenIdx + 2000));
         const usesInputInBody = /input\s*\./.test(body) || /\binput\b/.test(body);
         const doesDbWrite = DB_WRITE_PATTERN.test(body);
         procedures.push({

package/dist/frameworks/trpc-detector.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * trpc-detector.test.ts — tRPC 检测器回归（纯函数，无文件 I/O）
+ *
+ * 覆盖 V4 真实语料（netflx-web）暴露的两项缺陷：
+ *  1. 链匹配正则不跨嵌套括号 → 标准 .input(z.object({...})) 过程失明
+ *  2. PROCEDURE_TYPE_PATTERN /g lastIndex 泄漏 → 逐文件扫描漂移
+ */
+const vitest_1 = require("vitest");
+const trpc_detector_1 = require("./trpc-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ── 修复 1：标准 .input 链（嵌套括号/多行）必须可见 ──
+const ROUTER_WITH_INPUT = `
+const t = initTRPC.context<{ db: Db }>().create();
+export const postRouter = t.router({
+  addComment: protectedProcedure
+    .input(
+      z.object({
+        articleId: z.string(),
+        body: z.string().min(1),
+      })
+    )
+    .mutation(async ({ ctx, input }) => {
+      await ctx.db.comment.create({ data: { articleId: input.articleId } });
+    }),
+  list: publicProcedure.query(async ({ ctx }) => ctx.db.comment.findMany()),
+});`;
+const ROUTER_WITH_BARE_MUTATION = `
+export const appRouter = t.router({
+  deleteAll: publicProcedure.mutation(async ({ ctx, input }) => {
+    await ctx.prisma.post.deleteMany();
+  }),
+});`;
+(0, vitest_1.describe)("trpc extractProcedures — 括号感知链", () => {
+    (0, vitest_1.it)("标准多行 .input(z.object({...})) mutation 可见且有 input schema（V4 缺陷回归）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_INPUT);
+        const add = procs.find((p) => p.name === "addComment");
+        (0, vitest_1.expect)(add).toBeDefined();
+        (0, vitest_1.expect)(add.kind).toBe("mutation");
+        (0, vitest_1.expect)(add.procedureType).toBe("protected");
+        (0, vitest_1.expect)(add.hasInputSchema).toBe(true);
+        // 无 schema 的 query 也照常可见
+        (0, vitest_1.expect)(procs.some((p) => p.name === "list" && p.hasInputSchema === false)).toBe(true);
+    });
+    (0, vitest_1.it)("单行 .input(z.string()) 链可见", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+export const r = t.router({
+  getOne: protectedProcedure.input(z.string()).query(async ({ ctx, input }) => {
+    return ctx.db.get(input);
+  }),
+});`);
+        const p = procs.find((x) => x.name === "getOne");
+        (0, vitest_1.expect)(p).toBeDefined();
+        (0, vitest_1.expect)(p.hasInputSchema).toBe(true);
+    });
+    (0, vitest_1.it)("裸链 mutation（无 input）仍可见并可触发规则", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_BARE_MUTATION);
+        const del = procs.find((p) => p.name === "deleteAll");
+        (0, vitest_1.expect)(del).toBeDefined();
+        (0, vitest_1.expect)(del.kind).toBe("mutation");
+        (0, vitest_1.expect)(del.hasInputSchema).toBe(false);
+        (0, vitest_1.expect)(del.doesDbWrite).toBe(true);
+    });
+    (0, vitest_1.it)("完整分析：合规 router 0 issues，裸 public mutation 报 TRPC_PUBLIC_MUTATION", () => {
+        const tmp = path.join(os.tmpdir(), "trpc-good-router.ts");
+        fs.writeFileSync(tmp, ROUTER_WITH_INPUT);
+        try {
+            const good = (0, trpc_detector_1.analyzeTRPCFile)(tmp);
+            (0, vitest_1.expect)(good.issues).toHaveLength(0);
+            (0, vitest_1.expect)(good.procedures.length).toBe(2);
+        }
+        finally {
+            fs.unlinkSync(tmp);
+        }
+        const tmp2 = path.join(os.tmpdir(), "trpc-bad-router.ts");
+        fs.writeFileSync(tmp2, ROUTER_WITH_BARE_MUTATION);
+        try {
+            const bad = (0, trpc_detector_1.analyzeTRPCFile)(tmp2);
+            (0, vitest_1.expect)(bad.issues.map((i) => i.rule)).toContain("TRPC_PUBLIC_MUTATION");
+            (0, vitest_1.expect)(bad.issues.map((i) => i.rule)).toContain("TRPC_MUTATION_WITHOUT_INPUT_SCHEMA");
+        }
+        finally {
+            fs.unlinkSync(tmp2);
+        }
+    });
+});
+// ── 修复 2：lastIndex 泄漏回归 ──
+(0, vitest_1.describe)("detectTRPCApp — 无 /g lastIndex 泄漏", () => {
+    (0, vitest_1.it)("连续多次调用结果稳定（旧 /g 实现会漂移）", () => {
+        const trpcCode = `const t = initTRPC.create(); export const r = t.router({ a: publicProcedure.query(() => 1) });`;
+        const plainCode = `export const sum = (a: number, b: number) => a + b;`;
+        // 交替调用多次：泄漏时第二次起结果不稳定
+        const results = [];
+        for (let i = 0; i < 6; i++) {
+            results.push((0, trpc_detector_1.detectTRPCApp)(trpcCode)); // 应为 true
+            results.push((0, trpc_detector_1.detectTRPCApp)(plainCode)); // 应为 false
+        }
+        (0, vitest_1.expect)(results.filter(Boolean)).toHaveLength(6); // 恰好 6 个 true
+        (0, vitest_1.expect)(results).toEqual([
+            true, false, true, false, true, false, true, false, true, false, true, false,
+        ]);
+    });
+});
+// ── tRPC v11：内联 t.procedure 形态（V4 遗留缺口）──
+(0, vitest_1.describe)("trpc v11 t.procedure 支持", () => {
+    (0, vitest_1.it)("t.procedure.input(z.object).mutation 可见且视为公开（默认语义）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+import { initTRPC } from "@trpc/server";
+const t = initTRPC.create();
+export const r = t.router({
+  ping: t.procedure
+    .input(z.object({ msg: z.string() }))
+    .mutation(async ({ ctx, input }) => {
+      await ctx.prisma.log.create({ data: { msg: input.msg } });
+    }),
+  list: t.procedure.query(async () => []),
+});`);
+        const ping = procs.find((p) => p.name === "ping");
+        (0, vitest_1.expect)(ping).toBeDefined();
+        (0, vitest_1.expect)(ping.kind).toBe("mutation");
+        (0, vitest_1.expect)(ping.procedureType).toBe("public");
+        (0, vitest_1.expect)(ping.hasInputSchema).toBe(true);
+        (0, vitest_1.expect)(procs.some((p) => p.name === "list")).toBe(true);
+    });
+    (0, vitest_1.it)("裸 t.procedure mutation（无 input）触发规则（敏感性与命名包装一致）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(`
+export const r = t.router({
+  nuke: t.procedure.mutation(async ({ ctx }) => {
+    await ctx.prisma.post.deleteMany();
+  }),
+});`);
+        const nuke = procs.find((p) => p.name === "nuke");
+        (0, vitest_1.expect)(nuke).toBeDefined();
+        (0, vitest_1.expect)(nuke.hasInputSchema).toBe(false);
+        (0, vitest_1.expect)(nuke.doesDbWrite).toBe(true);
+    });
+    (0, vitest_1.it)("netflx v10 命名包装形态不受影响（19/19 保持）", () => {
+        const procs = (0, trpc_detector_1.extractProcedures)(ROUTER_WITH_INPUT);
+        (0, vitest_1.expect)(procs.length).toBe(2);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.14";
+exports.RUNTIME_VERSION = "3.7.16";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.14",
+  "version": "3.7.16",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -88,7 +88,8 @@
     "test:soak": "vitest run tests/soak/",
     "test:p7": "vitest run tests/p7-*/",
     "fetch:cves": "tsx scripts/fetch-cves.ts",
-    "test:cve": "vitest run src/cve-benchmark.test.ts"
+    "test:cve": "vitest run src/cve-benchmark.test.ts",
+    "audit:realworld": "node scripts/realworld-audit.js"
   },
   "keywords": [
     "program-synthesis",
@@ -114,4 +115,4 @@
     "tsx": "^4.22.4",
     "vitest": "^3.2.6"
   }
-}
+}

package/tools/extract_framework_django.py

@@ -161,14 +161,68 @@ class UrlCollector(ast.NodeVisitor):
     def __init__(self, filepath):
         self.file = filepath
         self.routes = []
+        # DRF ViewSet/DefaultRouter（REALWORLD_STRUCTURAL_V3：router.register
+        # + include(router.urls) 的路由由运行时生成，urlpatterns 解析不可见）
+        self.router_regs = {}    # router 变量 -> [(prefix, viewName)]
+        self.router_slash = {}   # router 变量 -> trailing_slash
+        self.router_uses = []    # (prefixBase, routerVar) urlpatterns 里的 include
 
     def visit_Assign(self, node):
         for t in node.targets:
-            if isinstance(t, ast.Name) and t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
+            if not isinstance(t, ast.Name):
+                continue
+            # DefaultRouter 定义（trailing_slash 关键字，默认 True）
+            if isinstance(node.value, ast.Call) and isinstance(node.value.func, ast.Name) \
+                    and node.value.func.id == "DefaultRouter":
+                slash = True
+                for kw in node.value.keywords:
+                    if kw.arg == "trailing_slash" and isinstance(kw.value, ast.Constant):
+                        slash = bool(kw.value.value)
+                self.router_slash[t.id] = slash
+                self.router_regs.setdefault(t.id, [])
+            # urlpatterns：扫描直连条目，并展开 include(router.urls) 的 ViewSet
+            if t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
                 for elt in node.value.elts:
                     self._scan_entry(elt)
+                for (prefix, var) in self.router_uses:
+                    self._expand_router_routes(prefix, var)
         self.generic_visit(node)
 
+    def visit_Expr(self, node):
+        # router.register(r'articles', ArticleViewSet, ...) 语句
+        call = node.value
+        if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute) \
+                and call.func.attr == "register":
+            var = name_of(call.func.value)
+            if not var or var not in self.router_regs:
+                return
+            prefix = ""
+            if call.args and isinstance(call.args[0], ast.Constant):
+                prefix = str(call.args[0].value)
+            view = None
+            if len(call.args) > 1:
+                a1 = call.args[1]
+                if isinstance(a1, ast.Name):
+                    view = a1.id
+                elif isinstance(a1, ast.Attribute):
+                    view = a1.attr
+            if view:
+                self.router_regs.setdefault(var, []).append((prefix, view))
+        self.generic_visit(node)
+
+    def _expand_router_routes(self, prefix_base, var):
+        # 本工具不做 include 前缀传播（urlconf 各文件 pattern 独立）——
+        # prefix_base 仅作路由存在性触发，不拼进 pattern
+        for (prefix, view) in self.router_regs.get(var, []):
+            base = "^" + prefix
+            # DRF 默认 action 路由：list/create 集合级、retrieve/update/
+            # destroy 详情级（权限由 views 表判定，规则在 TS 检测器侧）
+            for pat in (base + "/?$", base + "/(?P<pk>[^/.]+)/?$"):
+                self.routes.append({
+                    "pattern": pat, "urlname": "", "view": view, "kind": "cbv",
+                    "file": self.file, "viewset": True,
+                })
+
     def _scan_entry(self, elt):
         if not isinstance(elt, ast.Call):
             return
@@ -199,6 +253,13 @@ class UrlCollector(ast.NodeVisitor):
             elif isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Name):
                 if view_ref.func.id == "include":
                     kind = "include"
+                    # include(router.urls)：记录 router 变量（同一文件的
+                    # router.register 展开见 _expand_router_routes）
+                    if view_ref.args and isinstance(view_ref.args[0], ast.Attribute) \
+                            and view_ref.args[0].attr == "urls":
+                        rvar = name_of(view_ref.args[0].value)
+                        if rvar:
+                            self.router_uses.append((pattern, rvar))
                 else:
                     kind = "fbv"
                     view_name = view_ref.func.id

package/tools/extract_framework_flask.py

@@ -26,8 +26,10 @@ SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
              ".git", "migrations", "__pycache__", "scripts", "docs",
              "staticfiles", "static"}
 
+# jwt 必在词表：flask_jwt_extended 的 @jwt_required 是生态头号认证装饰器
+# （REALWORLD_STRUCTURAL_V4：缺 "jwt" → 10 个受保护 mutation 全误报 FP）
 AUTH_WORDS = ("auth", "login", "permission", "token", "credential", "session",
-              "user")
+              "user", "jwt")
 
 MUTATION_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
 

package/tools/extract_framework_py.py

@@ -30,9 +30,13 @@ import sys
 
 # 认证词表（依赖函数名命中即视为 auth-like；与 TS 侧 annotation-suggest 词表同源）
 # 注意：扫描器只做「结构提取」，规则判定（豁免词/方法门控）在 TS 检测器侧。
+# 注意：不含裸 "user"——get_profile_by_username_from_path 等 DB 查询
+# 依赖名含 user 会被误标认证（REALWORLD_STRUCTURAL_V2 假保护 FN）。
+# 真认证依赖用 current_user/authorizer 等强词识别（get_current_user
+# 含 current_user ✓）。
 AUTH_WORDS = (
-    "auth", "login", "token", "user", "credential", "session",
-    "bearer", "permission", "current_user", "api_key", "oauth",
+    "auth", "login", "token", "credential", "session",
+    "bearer", "permission", "current_user", "api_key", "oauth", "jwt",
 )
 
 SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",