progmune-runtime 3.7.17 → 3.7.19

package/dist/extract-ir-java.js

@@ -75,9 +75,10 @@ function extractJavaFile(filePath) {
         const name = m[1];
         if (JAVA_KEYWORDS.has(name))
             continue;
-        // 前置字符过滤：方法名不应紧跟 '.'（调用）或 '='（赋值）等
+        // 前置字符过滤：排除 '.'/'='/'( ' 前导（调用/赋值/子表达式误匹配）；
+        // '@' 允许——@Override protected void … 是注解修饰的合法方法
         const pre = code.slice(Math.max(0, m.index - 1), m.index);
-        if (/[.=@(]/.test(pre))
+        if (/[.=(]/.test(pre))
             continue;
         // 可见性（近似）：行内是否有 public/protected（或文件在接口里默认 public）
         const head = code.slice(m.index, m.index + 40);
@@ -101,12 +102,41 @@ function extractJavaFile(filePath) {
         }
         // 返回类型：方法名前的一段（简化取最近一个类型令牌）
         const returnType = "unknown";
+        // calls：方法体（自头正则消费的 '{' 起平衡到 '}'）内的方法调用
+        // （词法近似：标识符 + '('，过滤关键字；obj.method → 取末段）
+        const calls = [];
+        const bodyStart = m.index + m[0].length; // 正则已含 '{'
+        let depth = 1;
+        let bodyEnd = bodyStart;
+        while (bodyEnd < code.length && depth > 0) {
+            const ch = code[bodyEnd];
+            if (ch === "{")
+                depth++;
+            else if (ch === "}")
+                depth--;
+            bodyEnd++;
+        }
+        const body = code.slice(bodyStart, Math.min(bodyEnd, bodyStart + 8000));
+        const callRe = /(?:^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        let cm;
+        while ((cm = callRe.exec(body)) !== null) {
+            const full = cm[1];
+            const seg = full.split(".").pop() || "";
+            if (JAVA_KEYWORDS.has(seg))
+                continue;
+            if (/^(if|for|while|switch|catch|new|return|case|do)$/.test(seg))
+                continue;
+            // 排除声明后立即调用形态（如 new Foo( 里 Foo）——new 已过滤
+            if (calls.length < 400 && !calls.includes(seg))
+                calls.push(seg);
+        }
         out.push({
             name,
             params,
             returnType,
             file: filePath,
             exported,
+            calls,
         });
     }
     return out;

package/dist/extract-ir-java.test.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * extract-ir-java.test.ts — Java 提取器回归（纯字符串 + 临时目录）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_java_1 = require("./extract-ir-java");
+let dir;
+(0, vitest_1.beforeEach)(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), "javair-")); });
+(0, vitest_1.afterEach)(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+const SAMPLE = `package app;
+public class JwtTokenFilter extends OncePerRequestFilter {
+  @Override
+  protected void doFilterInternal(
+      HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws ServletException, IOException {
+    getTokenString(request.getHeader("Authorization"))
+        .flatMap(token -> jwtService.getSubFromToken(token))
+        .ifPresent(id -> {
+          if (SecurityContextHolder.getContext().getAuthentication() == null) {
+            setAuthentication(id, request);
+          }
+        });
+  }
+  private Optional<String> getTokenString(String h) {
+    if (h == null) return Optional.empty();
+    return Optional.of(h.substring(7));
+  }
+}`;
+(0, vitest_1.describe)("extract-ir-java", () => {
+    (0, vitest_1.it)("@Override 注解方法被提取（不会被 @ 前导过滤误杀）", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, SAMPLE);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "doFilterInternal")).toBe(true);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "getTokenString")).toBe(true);
+    });
+    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, SAMPLE);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const filter = fns.find((f) => f.name === "doFilterInternal");
+        (0, vitest_1.expect)(filter.calls).toContain("getSubFromToken");
+        (0, vitest_1.expect)(filter.calls).toContain("getAuthentication");
+        (0, vitest_1.expect)(filter.calls).toContain("setAuthentication");
+        // 关键字不算调用
+        (0, vitest_1.expect)(filter.calls).not.toContain("if");
+    });
+    (0, vitest_1.it)("基础方法提取", () => {
+        const fp = path.join(dir, "Plain.java");
+        fs.writeFileSync(fp, `package app;
+public class Plain {
+  public Plain() {}
+  public int add(int a, int b) { return a + b; }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "add")).toBe(true);
+    });
+});
+// ── 协议行金标 v1：token 生命周期（verify 先于 use，2026-09-02）──
+/** 真实语料 token 链的 verify-before-use 判定（金标规则 v1）：
+ *  doFilterInternal 的调用序须满足 getSubFromToken（verify）先于
+ *  setAuthentication（use/信任）。 */
+function tokenVerifyBeforeUse(calls) {
+    if (!calls)
+        return { ok: false, why: "无调用边" };
+    const verifyIdx = calls.findIndex((c) => /getSubFromToken|verify/.test(c));
+    const useIdx = calls.findIndex((c) => c === "setAuthentication");
+    if (useIdx === -1)
+        return { ok: true, why: "无 use（本链不消费认证）" };
+    if (verifyIdx === -1)
+        return { ok: false, why: "use(setAuthentication) 之前无 verify" };
+    return verifyIdx < useIdx
+        ? { ok: true, why: "verify→use 序正确" }
+        : { ok: false, why: "use 先于 verify" };
+}
+const REAL_FILTER = `package io.spring.api.security;
+public class JwtTokenFilter {
+  @Override
+  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws Exception {
+    getTokenString(request.getHeader(header))
+        .flatMap(token -> jwtService.getSubFromToken(token))
+        .ifPresent(id -> {
+          if (SecurityContextHolder.getContext().getAuthentication() == null) {
+            setAuthentication(id, request);   // use：信任已验 token
+          }
+        });
+    chain.doFilter(request, response);
+  }
+}`;
+// 变异：删掉 verify（真实违规：未验 token 直接信任）
+const MUT_FILTER = REAL_FILTER.replace("        .flatMap(token -> jwtService.getSubFromToken(token))", "        .map(id -> id)");
+(0, vitest_1.describe)("协议行金标 v1 — token 生命周期（verify-before-use）", () => {
+    (0, vitest_1.it)("原文链：verify 先于 use → 合规", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, REAL_FILTER);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "doFilterInternal").calls;
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).ok).toBe(true);
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("verify→use");
+    });
+    (0, vitest_1.it)("变异（摘 verify）：use 前无 verify → 违规被判定（0-FP 语义负例）", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, MUT_FILTER);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "doFilterInternal").calls;
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).ok).toBe(false);
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("无 verify");
+    });
+});

package/dist/frameworks/spring-detector.js

@@ -76,8 +76,10 @@ function antToRegex(pattern) {
 function parseSecurityConfig(code) {
     const rules = [];
     let catchAll = null;
-    // 逐个 .antMatchers(...) 与其后 .access() 配对
-    const re = /\.antMatchers\(\s*([^)]*)\)\s*\.(\w+)\s*\(|\.anyRequest\(\)\s*\.(\w+)\s*\(/g;
+    // 逐个 .antMatchers/.requestMatchers(...) 与其后 .access() 配对
+    // （旧 DSL antMatchers + 新式 SecurityFilterChain authorizeHttpRequests
+    //   requestMatchers——2026-09-02 Spring 方言扩展）
+    const re = /\.(?:antMatchers|requestMatchers)\s*\(\s*([^)]*)\)\s*\.(\w+)\s*\(|\.anyRequest\(\)\s*\.(\w+)\s*\(/g;
     let m;
     while ((m = re.exec(code)) !== null) {
         if (m[3] !== undefined) {
@@ -212,6 +214,8 @@ function analyzeSpringProject(projectRoot) {
         // 类级 @RequestMapping 只认类声明头（方法级 @RequestMapping 不算前缀）
         const clsReq = c.header.match(/@RequestMapping\s*\((?:path\s*=\s*)?["']([^"']*)["']/);
         const prefix = clsReq ? clsReq[1].replace(/^\//, "") : "";
+        // 类级方法安全：@PreAuthorize/@Secured 于类声明头 → 全部方法受保护
+        const classPreAuth = /@PreAuthorize|@Secured/.test(c.header);
         const annRe = /@(Get|Post|Put|Delete|Patch|Request)Mapping\s*(\([^)]*\))?/g;
         let m;
         while ((m = annRe.exec(c.body)) !== null) {
@@ -224,7 +228,7 @@ function analyzeSpringProject(projectRoot) {
             // 找到该 handler 起始行（用于 line + 后续注解如 @PreAuthorize）
             const line = c.body.slice(0, m.index).split("\n").length;
             const window = c.body.slice(m.index, m.index + 600);
-            const preAuth = /@PreAuthorize/.test(window);
+            const preAuth = classPreAuth || /@PreAuthorize|@Secured/.test(window);
             allPaths.push(fullPath);
             routes.push({
                 method,

package/dist/frameworks/spring-detector.test.js

@@ -120,3 +120,52 @@ public class ArticleApi {
         (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
     });
 });
+// ── Spring 方言扩展：SecurityFilterChain bean + requestMatchers + @PreAuthorize ──
+const SEC_BEAN = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.csrf().disable().authorizeHttpRequests(auth -> auth
+      .requestMatchers(HttpMethod.POST, "/users", "/users/login").permitAll()
+      .requestMatchers(HttpMethod.GET, "/articles/**", "/tags").permitAll()
+      .requestMatchers(HttpMethod.GET, "/articles/feed").authenticated()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+const ADMIN_CTRL = `${PKG}
+@RestController @RequestMapping(path = "admin")
+@PreAuthorize("hasRole('ADMIN')")
+public class AdminApi {
+  @DeleteMapping("/users/{id}") public Object ban() { return null; }
+  @PostMapping("/reset") public Object reset() { return null; }
+}`;
+(0, vitest_1.describe)("spring 方言扩展（2026-09-02）", () => {
+    (0, vitest_1.it)("SecurityFilterChain bean + authorizeHttpRequests + requestMatchers 解析", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC_BEAN);
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.hasSecurityConfig).toBe(true);
+        (0, vitest_1.expect)(a.catchAll).toBe("authenticated");
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+        const post = a.routes.find((r) => r.method === "post" && r.path === "/articles");
+        (0, vitest_1.expect)(post.access).toBe("authenticated");
+    });
+    (0, vitest_1.it)("类级 @PreAuthorize → 该类 mutation 全部受保护（不报）", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC("permitAll")); // 兜底全公开
+        writeJava("api/AdminApi.java", ADMIN_CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        // 兜底 permitAll 下，无注解类会报；@PreAuthorize 类不报
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "DELETE /admin/users/{id}")).toBe(false);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /admin/reset")).toBe(false);
+    });
+    (0, vitest_1.it)("方言反证：requestMatchers permitAll 的 mutation 公开（register 豁免外仍查）", () => {
+        const cfg = SEC_BEAN.replace(".requestMatchers(HttpMethod.GET, \"/articles/**\", \"/tags\").permitAll()", ".requestMatchers(HttpMethod.GET, \"/articles/**\", \"/tags\", \"/payments\").permitAll()").replace(/\.anyRequest\(\)\.authenticated\(\)/, ".anyRequest().permitAll()");
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.17";
+exports.RUNTIME_VERSION = "3.7.19";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.17",
+  "version": "3.7.19",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",