progmune-runtime 3.7.15 → 3.7.17

package/dist/extract-ir-java.js

@@ -0,0 +1,152 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJavaFile = extractJavaFile;
+exports.extractIRJava = extractIRJava;
+/**
+ * extract-ir-java.ts — Java 语言 IR 提取（纯 TS 词法，零工具链依赖）
+ *
+ * 与 C/Go 提取器同模式：逐 .java 文件扫描方法声明 → FunctionInfo 列表。
+ * Java 语言支持（3.7.17 里程碑 1）：注册表 LANGUAGE_EXTRACTORS 一项 +
+ * evaluateTrust/engine 语言分派；Spring Security 路由覆盖模型见
+ * src/frameworks/spring-detector.ts。
+ *
+ * 注意：提取为词法近似（方法签名正则）——注解驱动的协议金标建立后
+ * 再评估是否需 AST（JavaParser 等不引入，保持零依赖）。
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const JAVA_EXTENSIONS = new Set([".java"]);
+const SKIP_DIRS = new Set([
+    "build", "target", "out", "bin", "node_modules", ".git", ".gradle",
+    "generated", "test", "tests", "__pycache__",
+]);
+const JAVA_KEYWORDS = new Set([
+    "if", "for", "while", "switch", "catch", "synchronized", "return",
+    "new", "case", "do", "try", "else", "instanceof",
+]);
+const MODIFIERS = "(?:public|protected|private|static|final|synchronized|abstract|default|native|strictfp|transient|volatile|\\s)+";
+/** 单文件提取 */
+function extractJavaFile(filePath) {
+    const out = [];
+    let code;
+    try {
+        code = fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return out;
+    }
+    // 方法声明：修饰符 + 返回类型 名字(参数) [throws ...] {
+    const re = /(?:\b(?:public|protected|private)\s+)?(?:(?:static|final|synchronized|abstract|default)\s+)*(?:[\w$<>\[\],.\s]+?)\s+([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?:throws\s+[^{]+?)?\{/g;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+        const name = m[1];
+        if (JAVA_KEYWORDS.has(name))
+            continue;
+        // 前置字符过滤：方法名不应紧跟 '.'（调用）或 '='（赋值）等
+        const pre = code.slice(Math.max(0, m.index - 1), m.index);
+        if (/[.=@(]/.test(pre))
+            continue;
+        // 可见性（近似）：行内是否有 public/protected（或文件在接口里默认 public）
+        const head = code.slice(m.index, m.index + 40);
+        const visM = head.match(/\b(public|protected|private)\b/);
+        const exported = visM ? visM[1] !== "private" : /^interface\s/.test(code.slice(0, m.index).split("\n").pop() || "") ? true : undefined;
+        const params = [];
+        const rawParams = m[2].trim();
+        if (rawParams.length > 0) {
+            for (const raw of rawParams.split(",")) {
+                const t = raw.trim();
+                if (!t)
+                    continue;
+                // 最后一个词为参数名，其余为类型（含泛型/数组）
+                const parts = t.split(/\s+/);
+                const pname = parts.pop() || "";
+                const ptype = parts.join(" ") || "?";
+                if (/^[A-Za-z_$][\w$]*$/.test(pname) && pname !== "final") {
+                    params.push({ name: pname, type: ptype });
+                }
+            }
+        }
+        // 返回类型：方法名前的一段（简化取最近一个类型令牌）
+        const returnType = "unknown";
+        out.push({
+            name,
+            params,
+            returnType,
+            file: filePath,
+            exported,
+        });
+    }
+    return out;
+}
+function collectJavaFiles(root) {
+    const files = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.isSymbolicLink())
+                continue;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (SKIP_DIRS.has(e.name))
+                    continue;
+                walk(full);
+            }
+            else if (JAVA_EXTENSIONS.has(path.extname(e.name))) {
+                files.push(full);
+            }
+        }
+    };
+    walk(root);
+    return files;
+}
+/** 注册表入口 */
+function extractIRJava(projectRoot) {
+    const files = collectJavaFiles(projectRoot);
+    const all = [];
+    for (const file of files) {
+        for (const fn of extractJavaFile(file)) {
+            fn.file = path.relative(projectRoot, fn.file);
+            all.push(fn);
+        }
+    }
+    return all;
+}

package/dist/extract-project-ir.js

@@ -55,6 +55,7 @@ const extract_ir_1 = require("./extract-ir");
 const extract_ir_python_1 = require("./extract-ir-python");
 const extract_ir_c_1 = require("./extract-ir-c");
 const extract_ir_go_1 = require("./extract-ir-go");
+const extract_ir_java_1 = require("./extract-ir-java");
 const SKIP_DIRS = new Set([
     "node_modules", "dist", "build", ".git", ".progmune_corpus",
     "__pycache__", "venv", ".venv",
@@ -111,6 +112,11 @@ exports.LANGUAGE_EXTRACTORS = [
         detect: (p) => hasSourceFiles(p, new Set([".go"])),
         extract: (p) => (0, extract_ir_go_1.extractIRGo)(p),
     },
+    {
+        language: "java",
+        detect: (p) => hasSourceFiles(p, new Set([".java"])),
+        extract: (p) => (0, extract_ir_java_1.extractIRJava)(p),
+    },
 ];
 /** 项目检测到的语言列表（审计/标签用）。 */
 function detectLanguages(projectRoot) {

package/dist/frameworks/spring-detector.js

@@ -0,0 +1,280 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.antToRegex = antToRegex;
+exports.analyzeSpringProject = analyzeSpringProject;
+/**
+ * spring-detector.ts — Spring (Boot) Framework Adapter — 路由覆盖模型
+ *
+ * Java 语言支持里程碑 2。真实语料（gothinkster/spring-boot-realworld-
+ * example-app 1581★）证实 Spring 认证惯例 = **安全配置类集中声明**：
+ *
+ *   @Configuration @EnableWebSecurity
+ *   class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+ *     configure(HttpSecurity http) {
+ *       http...authorizeRequests()
+ *           .antMatchers(HttpMethod.POST, "/users", "/users/login").permitAll()
+ *           .antMatchers(HttpMethod.GET, "/articles/**", "/tags").permitAll()
+ *           .antMatchers(HttpMethod.GET, "/articles/feed").authenticated()
+ *           .anyRequest().authenticated();      // ← 兜底
+ *   }
+ *
+ * 路由保护 = Spring 规则序（首个匹配者胜）+ anyRequest 兜底。检测器
+ * 解析安全配置规则 → 控制器注解路由（@RestController + @*Mapping）→
+ * 判定 mutation 是否最终公开。代码串级 + ant 模式匹配（与 Gin/Fiber
+ * 项目级模型同族；注册在配置而非路由上——见 REALWORLD 系列根因②）。
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const route_window_1 = require("./route-window");
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const ACCESS_AUTH = new Set([
+    "authenticated", "fullyAuthenticated", "hasRole", "hasAnyRole",
+    "hasAuthority", "hasAnyAuthority", "rememberMe", "denyAll",
+]);
+function isAuthEntryPath(p) {
+    return /\/?(login|signin|signup|sign_in|register|refresh)(\/|$)/i.test(p);
+}
+/** Spring ant 模式 → 正则（** → 任意段，* → 单段） */
+function antToRegex(pattern) {
+    const esc = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    const re = esc.replace(/\*\*/g, "__DOUBLE__").replace(/\*/g, "[^/]*").replace(/__DOUBLE__/g, ".*");
+    return new RegExp("^" + re + "$");
+}
+function parseSecurityConfig(code) {
+    const rules = [];
+    let catchAll = null;
+    // 逐个 .antMatchers(...) 与其后 .access() 配对
+    const re = /\.antMatchers\(\s*([^)]*)\)\s*\.(\w+)\s*\(|\.anyRequest\(\)\s*\.(\w+)\s*\(/g;
+    let m;
+    while ((m = re.exec(code)) !== null) {
+        if (m[3] !== undefined) {
+            catchAll = m[3];
+            continue;
+        }
+        const argText = m[1];
+        let method;
+        let rest = argText.trim();
+        const hm = rest.match(/^HttpMethod\.(\w+)/);
+        if (hm) {
+            method = hm[1].toLowerCase();
+            rest = rest.slice(hm[0].length).replace(/^,/, "").trim();
+        }
+        const patterns = [];
+        for (const pm of rest.matchAll(/"([^"]+)"/g))
+            patterns.push(pm[1]);
+        if (patterns.length === 0) {
+            // 无引号模式（变量引用）→ 宽匹配不了，跳过（保守：不豁免）
+            continue;
+        }
+        rules.push({ method, patterns, access: m[2] });
+    }
+    return { rules, catchAll };
+}
+function parseControllers(root) {
+    const out = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (["build", "target", ".git", ".gradle"].includes(e.name))
+                    continue;
+                walk(full);
+            }
+            else if (e.name.endsWith(".java")) {
+                const code = fs.readFileSync(full, "utf-8");
+                const clsRe = /@(?:RestController|Controller)(?!\w)[\s\S]*?(?=class\s+([A-Za-z_]\w*))/g;
+                let cm;
+                while ((cm = clsRe.exec(code)) !== null) {
+                    const name = cm[1] || "Unknown";
+                    const clsAt = code.indexOf("class " + name, cm.index);
+                    if (clsAt < 0)
+                        continue;
+                    const header = code.slice(cm.index, clsAt); // 类声明头（类级注解区）
+                    const body = code.slice(clsAt); // 类体（方法注解区）
+                    out.push({ controller: name, header, body, path: full });
+                }
+            }
+        }
+    };
+    walk(root);
+    return out;
+}
+function methodAccessOf(ann) {
+    const lower = ann.toLowerCase().replace(/^@/, "");
+    const method = lower.startsWith("requestmapping")
+        ? (() => {
+            const mm = ann.match(/method\s*=\s*(?:RequestMethod\.)?(\w+)/);
+            return mm ? mm[1].toLowerCase() : "";
+        })()
+        : lower.replace(/mapping.*/, "").replace(/^@/, "").trim();
+    const pm = ann.match(/(?:path\s*=\s*)?["']([^"']*)["']/);
+    return { method, rpath: pm ? pm[1] : "" };
+}
+function analyzeSpringProject(projectRoot) {
+    const issues = [];
+    // 1) 安全配置（全仓找 WebSecurityConfigurerAdapter / SecurityFilterChain）
+    let secCode = "";
+    let hasSecurityConfig = false;
+    let catchAll = null;
+    let rules = [];
+    const collect = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (["build", "target", ".git", ".gradle", "node_modules"].includes(e.name))
+                    continue;
+                collect(full);
+            }
+            else if (e.name.endsWith(".java")) {
+                const code = fs.readFileSync(full, "utf-8");
+                if (/WebSecurityConfigurerAdapter|SecurityFilterChain/.test(code) && /authorizeRequests|authorizeHttpRequests/.test(code)) {
+                    hasSecurityConfig = true;
+                    secCode += code + "\n";
+                }
+            }
+        }
+    };
+    collect(projectRoot);
+    if (hasSecurityConfig) {
+        const parsed = parseSecurityConfig(secCode);
+        rules = parsed.rules;
+        catchAll = parsed.catchAll;
+    }
+    const registerRootsSet = new Set();
+    // 2) 控制器路由
+    const routes = [];
+    const allPaths = [];
+    const filesScanned = (() => {
+        let n = 0;
+        const cnt = (dir) => {
+            for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+                const full = path.join(dir, e.name);
+                if (e.isDirectory()) {
+                    if (["build", "target", ".git", ".gradle", "node_modules"].includes(e.name))
+                        continue;
+                    cnt(full);
+                }
+                else if (e.name.endsWith(".java"))
+                    n++;
+            }
+        };
+        cnt(projectRoot);
+        return n;
+    })();
+    for (const c of parseControllers(projectRoot)) {
+        // 类级 @RequestMapping 只认类声明头（方法级 @RequestMapping 不算前缀）
+        const clsReq = c.header.match(/@RequestMapping\s*\((?:path\s*=\s*)?["']([^"']*)["']/);
+        const prefix = clsReq ? clsReq[1].replace(/^\//, "") : "";
+        const annRe = /@(Get|Post|Put|Delete|Patch|Request)Mapping\s*(\([^)]*\))?/g;
+        let m;
+        while ((m = annRe.exec(c.body)) !== null) {
+            const ann = "@" + m[1] + "Mapping" + (m[2] || "()");
+            const { method, rpath } = methodAccessOf(ann);
+            if (!method)
+                continue;
+            const seg = rpath.replace(/^\//, "");
+            const fullPath = "/" + (prefix ? prefix + (seg ? "/" + seg : "") : seg);
+            // 找到该 handler 起始行（用于 line + 后续注解如 @PreAuthorize）
+            const line = c.body.slice(0, m.index).split("\n").length;
+            const window = c.body.slice(m.index, m.index + 600);
+            const preAuth = /@PreAuthorize/.test(window);
+            allPaths.push(fullPath);
+            routes.push({
+                method,
+                path: fullPath,
+                controller: c.controller,
+                access: preAuth ? "authenticated(@PreAuthorize)" : "",
+                protectedFlag: !!preAuth,
+                line,
+            });
+        }
+    }
+    // register 集合根（同文件/项目内 /login 姊妹）
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(allPaths);
+    // 3) 逐路由判定（Spring 序：首个匹配规则胜；无匹配 → 兜底）
+    for (const r of routes) {
+        let access = null;
+        for (const rule of rules) {
+            if (rule.method && rule.method !== r.method)
+                continue;
+            if (!rule.patterns.some((p) => antToRegex(p).test(r.path)))
+                continue;
+            access = rule.access; // 首个匹配
+            break;
+        }
+        const finalAccess = access ?? catchAll ?? (hasSecurityConfig ? "deny" : "public");
+        r.access = finalAccess;
+        r.protectedFlag = ACCESS_AUTH.has(finalAccess) || r.protectedFlag;
+        if (!MUTATION_METHODS.has(r.method))
+            continue;
+        if (r.protectedFlag)
+            continue;
+        if (isAuthEntryPath(r.path))
+            continue;
+        if (r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))
+            continue;
+        issues.push({
+            severity: "medium",
+            rule: "SPRING_ROUTE_NO_AUTH",
+            message: `Mutation route ${r.method.toUpperCase()} ${r.path} is reachable without ` +
+                `authentication (access=${finalAccess}) — any caller can invoke it.`,
+            route: `${r.method.toUpperCase()} ${r.path}`,
+            line: r.line,
+        });
+    }
+    return {
+        filesScanned,
+        hasSecurityConfig,
+        catchAll,
+        rules,
+        routes,
+        issues,
+    };
+}

package/dist/frameworks/spring-detector.test.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * spring-detector.test.ts — Spring 路由覆盖模型回归（纯函数 + 临时目录）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const spring_detector_1 = require("./spring-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), "spring-det-")); });
+(0, vitest_1.afterEach)(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+function writeJava(rel, content) {
+    const fp = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(fp), { recursive: true });
+    fs.writeFileSync(fp, content);
+}
+const PKG = "package app;\nimport org.springframework.web.bind.annotation.*;\n";
+const SEC = (catchAll) => `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+  @Override protected void configure(HttpSecurity http) throws Exception {
+    http.csrf().disable().authorizeRequests()
+      .antMatchers(HttpMethod.POST, "/users", "/users/login").permitAll()
+      .antMatchers(HttpMethod.GET, "/articles/**", "/tags").permitAll()
+      .antMatchers(HttpMethod.GET, "/articles/feed").authenticated()
+      .anyRequest().${catchAll}();
+    http.addFilterBefore(new JwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
+  }
+}`;
+const CTRL = `${PKG}
+@RestController @RequestMapping(path = "articles")
+public class ArticleApi {
+  @PostMapping public Object create() { return null; }
+  @PutMapping("/{slug}") public Object update() { return null; }
+  @GetMapping("/{slug}") public Object one() { return null; }
+  @DeleteMapping("/{slug}") public Object del() { return null; }
+}`;
+(0, vitest_1.describe)("antToRegex", () => {
+    (0, vitest_1.it)("ant 模式转正则", () => {
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/articles/**").test("/articles/abc")).toBe(true);
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/articles/**").test("/articles/abc/def")).toBe(true);
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/articles/*").test("/articles/abc")).toBe(true);
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/articles/*").test("/articles/abc/def")).toBe(false);
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/users").test("/users")).toBe(true);
+        (0, vitest_1.expect)((0, spring_detector_1.antToRegex)("/users").test("/users/x")).toBe(false);
+    });
+});
+(0, vitest_1.describe)("analyzeSpringProject", () => {
+    (0, vitest_1.it)("anyRequest().authenticated() 兜底：受保护 mutation 不报", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC("authenticated"));
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.hasSecurityConfig).toBe(true);
+        (0, vitest_1.expect)(a.catchAll).toBe("authenticated");
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+        const art = a.routes.find((r) => r.method === "post" && r.path === "/articles");
+        (0, vitest_1.expect)(art.access).toBe("authenticated");
+    });
+    (0, vitest_1.it)("翻兜底为 permitAll → mutation 重现（敏感性）", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC("permitAll"));
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        const flags = a.issues.map((i) => i.route);
+        (0, vitest_1.expect)(flags).toContain("POST /articles");
+        (0, vitest_1.expect)(flags).toContain("PUT /articles/{slug}");
+        (0, vitest_1.expect)(flags).toContain("DELETE /articles/{slug}");
+        // GET 读不查
+        (0, vitest_1.expect)(flags).not.toContain("GET /articles/{slug}");
+    });
+    (0, vitest_1.it)("register/login（permitAll + 姊妹佐证）不报", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC("authenticated"));
+        writeJava("api/UsersApi.java", `${PKG}
+@RestController public class UsersApi {
+  @RequestMapping(path = "/users", method = POST) public Object reg() { return null; }
+  @RequestMapping(path = "/users/login", method = POST) public Object login() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("无安全配置 → mutation 报（无认证裸奔）", () => {
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.hasSecurityConfig).toBe(false);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.15";
+exports.RUNTIME_VERSION = "3.7.17";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -77,6 +77,7 @@ const extract_ir_1 = require("../extract-ir");
 const extract_ir_python_1 = require("../extract-ir-python");
 const extract_ir_c_1 = require("../extract-ir-c");
 const extract_ir_go_1 = require("../extract-ir-go");
+const extract_ir_java_1 = require("../extract-ir-java");
 // ── Main Entry Point ──
 /**
  * Trust 决策主入口：收集 → 归一化 → 评分 → 决策 → 组装。
@@ -1211,6 +1212,7 @@ async function collectProtocolViolations(ctx, callGraph) {
                 python: () => (0, extract_ir_python_1.extractIRPython)(ctx.projectPath),
                 c: () => (0, extract_ir_c_1.extractIRC)(ctx.projectPath),
                 go: () => (0, extract_ir_go_1.extractIRGo)(ctx.projectPath),
+                java: () => (0, extract_ir_java_1.extractIRJava)(ctx.projectPath),
             };
             const extractFn = autoExtractor[lang];
             if (extractFn) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.15",
+  "version": "3.7.17",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -88,7 +88,8 @@
     "test:soak": "vitest run tests/soak/",
     "test:p7": "vitest run tests/p7-*/",
     "fetch:cves": "tsx scripts/fetch-cves.ts",
-    "test:cve": "vitest run src/cve-benchmark.test.ts"
+    "test:cve": "vitest run src/cve-benchmark.test.ts",
+    "audit:realworld": "node scripts/realworld-audit.js"
   },
   "keywords": [
     "program-synthesis",