progmune-runtime 3.7.17 → 3.7.18

package/dist/extract-ir-java.js

@@ -75,9 +75,10 @@ function extractJavaFile(filePath) {
         const name = m[1];
         if (JAVA_KEYWORDS.has(name))
             continue;
-        // 前置字符过滤：方法名不应紧跟 '.'（调用）或 '='（赋值）等
+        // 前置字符过滤：排除 '.'/'='/'( ' 前导（调用/赋值/子表达式误匹配）；
+        // '@' 允许——@Override protected void … 是注解修饰的合法方法
         const pre = code.slice(Math.max(0, m.index - 1), m.index);
-        if (/[.=@(]/.test(pre))
+        if (/[.=(]/.test(pre))
             continue;
         // 可见性（近似）：行内是否有 public/protected（或文件在接口里默认 public）
         const head = code.slice(m.index, m.index + 40);
@@ -101,12 +102,41 @@ function extractJavaFile(filePath) {
         }
         // 返回类型：方法名前的一段（简化取最近一个类型令牌）
         const returnType = "unknown";
+        // calls：方法体（自头正则消费的 '{' 起平衡到 '}'）内的方法调用
+        // （词法近似：标识符 + '('，过滤关键字；obj.method → 取末段）
+        const calls = [];
+        const bodyStart = m.index + m[0].length; // 正则已含 '{'
+        let depth = 1;
+        let bodyEnd = bodyStart;
+        while (bodyEnd < code.length && depth > 0) {
+            const ch = code[bodyEnd];
+            if (ch === "{")
+                depth++;
+            else if (ch === "}")
+                depth--;
+            bodyEnd++;
+        }
+        const body = code.slice(bodyStart, Math.min(bodyEnd, bodyStart + 8000));
+        const callRe = /(?:^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        let cm;
+        while ((cm = callRe.exec(body)) !== null) {
+            const full = cm[1];
+            const seg = full.split(".").pop() || "";
+            if (JAVA_KEYWORDS.has(seg))
+                continue;
+            if (/^(if|for|while|switch|catch|new|return|case|do)$/.test(seg))
+                continue;
+            // 排除声明后立即调用形态（如 new Foo( 里 Foo）——new 已过滤
+            if (calls.length < 400 && !calls.includes(seg))
+                calls.push(seg);
+        }
         out.push({
             name,
             params,
             returnType,
             file: filePath,
             exported,
+            calls,
         });
     }
     return out;

package/dist/extract-ir-java.test.js

@@ -0,0 +1,95 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * extract-ir-java.test.ts — Java 提取器回归（纯字符串 + 临时目录）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_java_1 = require("./extract-ir-java");
+let dir;
+(0, vitest_1.beforeEach)(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), "javair-")); });
+(0, vitest_1.afterEach)(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+const SAMPLE = `package app;
+public class JwtTokenFilter extends OncePerRequestFilter {
+  @Override
+  protected void doFilterInternal(
+      HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws ServletException, IOException {
+    getTokenString(request.getHeader("Authorization"))
+        .flatMap(token -> jwtService.getSubFromToken(token))
+        .ifPresent(id -> {
+          if (SecurityContextHolder.getContext().getAuthentication() == null) {
+            setAuthentication(id, request);
+          }
+        });
+  }
+  private Optional<String> getTokenString(String h) {
+    if (h == null) return Optional.empty();
+    return Optional.of(h.substring(7));
+  }
+}`;
+(0, vitest_1.describe)("extract-ir-java", () => {
+    (0, vitest_1.it)("@Override 注解方法被提取（不会被 @ 前导过滤误杀）", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, SAMPLE);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "doFilterInternal")).toBe(true);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "getTokenString")).toBe(true);
+    });
+    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, SAMPLE);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const filter = fns.find((f) => f.name === "doFilterInternal");
+        (0, vitest_1.expect)(filter.calls).toContain("getSubFromToken");
+        (0, vitest_1.expect)(filter.calls).toContain("getAuthentication");
+        (0, vitest_1.expect)(filter.calls).toContain("setAuthentication");
+        // 关键字不算调用
+        (0, vitest_1.expect)(filter.calls).not.toContain("if");
+    });
+    (0, vitest_1.it)("基础方法提取", () => {
+        const fp = path.join(dir, "Plain.java");
+        fs.writeFileSync(fp, `package app;
+public class Plain {
+  public Plain() {}
+  public int add(int a, int b) { return a + b; }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "add")).toBe(true);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.17";
+exports.RUNTIME_VERSION = "3.7.18";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.17",
+  "version": "3.7.18",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",