progmune-runtime 3.7.18 → 3.7.19

package/dist/extract-ir-java.test.js

@@ -93,3 +93,55 @@ public class Plain {
         (0, vitest_1.expect)(fns.some((f) => f.name === "add")).toBe(true);
     });
 });
+// ── 协议行金标 v1：token 生命周期（verify 先于 use，2026-09-02）──
+/** 真实语料 token 链的 verify-before-use 判定（金标规则 v1）：
+ *  doFilterInternal 的调用序须满足 getSubFromToken（verify）先于
+ *  setAuthentication（use/信任）。 */
+function tokenVerifyBeforeUse(calls) {
+    if (!calls)
+        return { ok: false, why: "无调用边" };
+    const verifyIdx = calls.findIndex((c) => /getSubFromToken|verify/.test(c));
+    const useIdx = calls.findIndex((c) => c === "setAuthentication");
+    if (useIdx === -1)
+        return { ok: true, why: "无 use（本链不消费认证）" };
+    if (verifyIdx === -1)
+        return { ok: false, why: "use(setAuthentication) 之前无 verify" };
+    return verifyIdx < useIdx
+        ? { ok: true, why: "verify→use 序正确" }
+        : { ok: false, why: "use 先于 verify" };
+}
+const REAL_FILTER = `package io.spring.api.security;
+public class JwtTokenFilter {
+  @Override
+  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws Exception {
+    getTokenString(request.getHeader(header))
+        .flatMap(token -> jwtService.getSubFromToken(token))
+        .ifPresent(id -> {
+          if (SecurityContextHolder.getContext().getAuthentication() == null) {
+            setAuthentication(id, request);   // use：信任已验 token
+          }
+        });
+    chain.doFilter(request, response);
+  }
+}`;
+// 变异：删掉 verify（真实违规：未验 token 直接信任）
+const MUT_FILTER = REAL_FILTER.replace("        .flatMap(token -> jwtService.getSubFromToken(token))", "        .map(id -> id)");
+(0, vitest_1.describe)("协议行金标 v1 — token 生命周期（verify-before-use）", () => {
+    (0, vitest_1.it)("原文链：verify 先于 use → 合规", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, REAL_FILTER);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "doFilterInternal").calls;
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).ok).toBe(true);
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("verify→use");
+    });
+    (0, vitest_1.it)("变异（摘 verify）：use 前无 verify → 违规被判定（0-FP 语义负例）", () => {
+        const fp = path.join(dir, "JwtTokenFilter.java");
+        fs.writeFileSync(fp, MUT_FILTER);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "doFilterInternal").calls;
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).ok).toBe(false);
+        (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("无 verify");
+    });
+});

package/dist/frameworks/spring-detector.js

@@ -76,8 +76,10 @@ function antToRegex(pattern) {
 function parseSecurityConfig(code) {
     const rules = [];
     let catchAll = null;
-    // 逐个 .antMatchers(...) 与其后 .access() 配对
-    const re = /\.antMatchers\(\s*([^)]*)\)\s*\.(\w+)\s*\(|\.anyRequest\(\)\s*\.(\w+)\s*\(/g;
+    // 逐个 .antMatchers/.requestMatchers(...) 与其后 .access() 配对
+    // （旧 DSL antMatchers + 新式 SecurityFilterChain authorizeHttpRequests
+    //   requestMatchers——2026-09-02 Spring 方言扩展）
+    const re = /\.(?:antMatchers|requestMatchers)\s*\(\s*([^)]*)\)\s*\.(\w+)\s*\(|\.anyRequest\(\)\s*\.(\w+)\s*\(/g;
     let m;
     while ((m = re.exec(code)) !== null) {
         if (m[3] !== undefined) {
@@ -212,6 +214,8 @@ function analyzeSpringProject(projectRoot) {
         // 类级 @RequestMapping 只认类声明头（方法级 @RequestMapping 不算前缀）
         const clsReq = c.header.match(/@RequestMapping\s*\((?:path\s*=\s*)?["']([^"']*)["']/);
         const prefix = clsReq ? clsReq[1].replace(/^\//, "") : "";
+        // 类级方法安全：@PreAuthorize/@Secured 于类声明头 → 全部方法受保护
+        const classPreAuth = /@PreAuthorize|@Secured/.test(c.header);
         const annRe = /@(Get|Post|Put|Delete|Patch|Request)Mapping\s*(\([^)]*\))?/g;
         let m;
         while ((m = annRe.exec(c.body)) !== null) {
@@ -224,7 +228,7 @@ function analyzeSpringProject(projectRoot) {
             // 找到该 handler 起始行（用于 line + 后续注解如 @PreAuthorize）
             const line = c.body.slice(0, m.index).split("\n").length;
             const window = c.body.slice(m.index, m.index + 600);
-            const preAuth = /@PreAuthorize/.test(window);
+            const preAuth = classPreAuth || /@PreAuthorize|@Secured/.test(window);
             allPaths.push(fullPath);
             routes.push({
                 method,

package/dist/frameworks/spring-detector.test.js

@@ -120,3 +120,52 @@ public class ArticleApi {
         (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
     });
 });
+// ── Spring 方言扩展：SecurityFilterChain bean + requestMatchers + @PreAuthorize ──
+const SEC_BEAN = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.csrf().disable().authorizeHttpRequests(auth -> auth
+      .requestMatchers(HttpMethod.POST, "/users", "/users/login").permitAll()
+      .requestMatchers(HttpMethod.GET, "/articles/**", "/tags").permitAll()
+      .requestMatchers(HttpMethod.GET, "/articles/feed").authenticated()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+const ADMIN_CTRL = `${PKG}
+@RestController @RequestMapping(path = "admin")
+@PreAuthorize("hasRole('ADMIN')")
+public class AdminApi {
+  @DeleteMapping("/users/{id}") public Object ban() { return null; }
+  @PostMapping("/reset") public Object reset() { return null; }
+}`;
+(0, vitest_1.describe)("spring 方言扩展（2026-09-02）", () => {
+    (0, vitest_1.it)("SecurityFilterChain bean + authorizeHttpRequests + requestMatchers 解析", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC_BEAN);
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.hasSecurityConfig).toBe(true);
+        (0, vitest_1.expect)(a.catchAll).toBe("authenticated");
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+        const post = a.routes.find((r) => r.method === "post" && r.path === "/articles");
+        (0, vitest_1.expect)(post.access).toBe("authenticated");
+    });
+    (0, vitest_1.it)("类级 @PreAuthorize → 该类 mutation 全部受保护（不报）", () => {
+        writeJava("sec/WebSecurityConfig.java", SEC("permitAll")); // 兜底全公开
+        writeJava("api/AdminApi.java", ADMIN_CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        // 兜底 permitAll 下，无注解类会报；@PreAuthorize 类不报
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "DELETE /admin/users/{id}")).toBe(false);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /admin/reset")).toBe(false);
+    });
+    (0, vitest_1.it)("方言反证：requestMatchers permitAll 的 mutation 公开（register 豁免外仍查）", () => {
+        const cfg = SEC_BEAN.replace(".requestMatchers(HttpMethod.GET, \"/articles/**\", \"/tags\").permitAll()", ".requestMatchers(HttpMethod.GET, \"/articles/**\", \"/tags\", \"/payments\").permitAll()").replace(/\.anyRequest\(\)\.authenticated\(\)/, ".anyRequest().permitAll()");
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/ArticleApi.java", CTRL);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.18";
+exports.RUNTIME_VERSION = "3.7.19";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.18",
+  "version": "3.7.19",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",