progmune-runtime 3.7.21 → 3.7.23

package/dist/extract-ir-java.js

@@ -96,6 +96,116 @@ function collectPrecedingComment(code, matchIndex) {
     }
     return pieces.join("\n");
 }
+/**
+ * 类名栈扫描：逐字符维护括号深度（字符串/注释感知），产出按字符位置
+ * 索引的当前类名表（null = 匿名类/方法体/块内）。'{' 前回溯 token：
+ * class|interface|enum|record Name → 命名类；new X(...) { 匿名类等 → null。
+ * 方法声明位置取栈顶为 className（嵌套类感知——JacksonCustomizations
+ * 内 DateTimeSerializer 等方法归属正确的嵌套类）。
+ */
+function buildClassStack(code) {
+    const stack = [null]; // 文件顶层
+    const at = new Array(code.length).fill(null);
+    let i = 0;
+    while (i < code.length) {
+        at[i] = stack[stack.length - 1];
+        const ch = code[i];
+        const next = code[i + 1];
+        if (ch === "/" && next === "/") {
+            i += 2;
+            while (i < code.length && code[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < code.length && !(code[i] === "*" && code[i + 1] === "/"))
+                i++;
+            i += 2;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            // 跳字符串/字符字面量（含转义）
+            const q = ch;
+            i++;
+            while (i < code.length) {
+                if (code[i] === "\\") {
+                    i += 2;
+                    continue;
+                }
+                if (code[i] === q) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        if (ch === "{") {
+            // 判定 '{' 打开什么：回溯最近类声明（允许 record Name(...) 组件形态）
+            const before = code.slice(Math.max(0, i - 200), i);
+            const clsM = before.match(/\b(class|interface|enum|record)\s+([A-Za-z_$]\w*)[^{]*$/);
+            stack.push(clsM ? clsM[2] : null);
+            i++;
+            continue;
+        }
+        if (ch === "}") {
+            if (stack.length > 1)
+                stack.pop();
+            i++;
+            continue;
+        }
+        i++;
+    }
+    return at;
+}
+/** 剔除行注释与块注释（字符串感知）——注释里的标识符不是调用 */
+function stripJavaComments(code) {
+    let out = "";
+    let i = 0;
+    while (i < code.length) {
+        const ch = code[i];
+        const next = code[i + 1];
+        if (ch === "/" && next === "/") {
+            i += 2;
+            while (i < code.length && code[i] !== "\n")
+                i++;
+            out += "\n";
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < code.length && !(code[i] === "*" && code[i + 1] === "/"))
+                i++;
+            i += 2;
+            out += " ";
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            const q = ch;
+            out += ch;
+            i++;
+            while (i < code.length) {
+                out += code[i];
+                if (code[i] === "\\") {
+                    i++;
+                    out += code[i];
+                    i++;
+                    continue;
+                }
+                if (code[i] === q) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
 /** 单文件提取 */
 function extractJavaFile(filePath) {
     const out = [];
@@ -106,42 +216,85 @@ function extractJavaFile(filePath) {
     catch {
         return out;
     }
-    // 方法声明：修饰符 + 返回类型 名字(参数) [throws ...] {
-    const re = /(?:\b(?:public|protected|private)\s+)?(?:(?:static|final|synchronized|abstract|default)\s+)*(?:[\w$<>\[\],.\s]+?)\s+([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?:throws\s+[^{]+?)?\{/g;
+    const classStack = buildClassStack(code);
+    // 方法声明：两分支——构造器（可见性 + Name(，无返回类型）与普通方法
+    // （修饰符 + 返回类型 Name(，返回类型含 '?' 通配符如 ResponseEntity<?>）。
+    // 匹配止于 '('；参数区用字符串感知平衡括号扫描（@PathVariable("slug")
+    // 等注解实参的内层括号不再截断参数列表）；throws 子句与 '{' 手扫确认。
+    const re = /(?:\b(public|protected|private)\s+([A-Za-z_$][\w$]*)\s*\(|(?:\b(?:public|protected|private)\s+)?(?:(?:static|final|synchronized|abstract|default)\s+)*(?:[\w$<>\[\],.?\s]+?)\s+([A-Za-z_$][\w$]*)\s*\()/g;
     let m;
     while ((m = re.exec(code)) !== null) {
-        const name = m[1];
+        const isCtor = m[1] !== undefined;
+        const name = isCtor ? m[2] : m[3];
         if (JAVA_KEYWORDS.has(name))
             continue;
+        const parenPos = m.index + m[0].length - 1; // 匹配止于 '('
         // 重叠守卫：匹配起点若早于参数 '(' 所在行（如从上一行注释/注解开吃
         // 吞掉真头）→ 从 '(' 行首重扫，避免方法被错配候选吞掉
-        const parenPos = code.indexOf("(", m.index + m[0].indexOf(name));
         const parenLineStart = code.lastIndexOf("\n", parenPos - 1) + 1;
         if (m.index < parenLineStart) {
             re.lastIndex = parenLineStart;
             continue;
         }
-        // 起点规则：'.' 前导 = 方法调用（如 adminService.act( 的 act）；
-        // 注解行起点（@RequestMapping…）非方法声明；容忍注释内起点——
-        // 其名字/参数/体边界本就正确（正则 type-part 可吞注释空白）
+        // 起点规则：'.' 前导 = 方法调用（如 adminService.act( 的 act）。
+        // 注：'@'/'='/'"' 不在 type-part 字符类内，注解文本本身不可能成为
+        // 匹配起点，无需旧版 @ 行守卫（@Autowired public UserService( 的
+        // 匹配起于 public，行首是 @——旧守卫会误杀同行注解构造器）
         const pre = code.slice(Math.max(0, m.index - 1), m.index);
         if (pre === ".")
             continue;
-        const lineStart = code.lastIndexOf("\n", m.index - 1) + 1;
-        const curLine = code.slice(lineStart, code.indexOf("\n", lineStart) === -1 ? code.length : code.indexOf("\n", lineStart)).trim();
-        if (curLine.startsWith("@") && !curLine.startsWith("@protocol") && !curLine.startsWith("@progmune"))
-            continue;
+        // 参数区：字符串感知平衡括号扫描
+        let pDepth = 1;
+        let k = parenPos + 1;
+        let quote = null;
+        while (k < code.length && pDepth > 0) {
+            const ch = code[k];
+            if (quote) {
+                if (ch === quote && code[k - 1] !== "\\")
+                    quote = null;
+            }
+            else if (ch === '"' || ch === "'") {
+                quote = ch;
+            }
+            else if (ch === "(") {
+                pDepth++;
+            }
+            else if (ch === ")") {
+                pDepth--;
+            }
+            k++;
+        }
+        if (pDepth !== 0)
+            continue; // 括号不闭合
+        const rawParams = code.slice(parenPos + 1, k - 1);
+        // throws 子句 + '{' 手扫确认（候选非方法声明时在此丢弃）
+        let t = k;
+        while (t < code.length && /\s/.test(code[t]))
+            t++;
+        let bodyStart;
+        if (code.slice(t, t + 6) === "throws" && !/[\w$]/.test(code[t + 6] || "")) {
+            const brace = code.indexOf("{", t);
+            if (brace === -1)
+                continue;
+            if (/;/.test(code.slice(t, brace)))
+                continue; // throws 到 { 之间有 ; = 调用行
+            bodyStart = brace + 1;
+        }
+        else {
+            if (code[t] !== "{")
+                continue;
+            bodyStart = t + 1;
+        }
         const head = code.slice(m.index, m.index + 40);
         const visM = head.match(/\b(public|protected|private)\b/);
         const exported = visM ? visM[1] !== "private" : /^interface\s/.test(code.slice(0, m.index).split("\n").pop() || "") ? true : undefined;
         const params = [];
-        const rawParams = m[2].trim();
-        if (rawParams.length > 0) {
+        if (rawParams.trim().length > 0) {
             for (const raw of rawParams.split(",")) {
-                const t = raw.trim();
-                if (!t)
+                const t2 = raw.trim();
+                if (!t2)
                     continue;
-                const parts = t.split(/\s+/);
+                const parts = t2.split(/\s+/);
                 const pname = parts.pop() || "";
                 const ptype = parts.join(" ") || "?";
                 if (/^[A-Za-z_$][\w$]*$/.test(pname) && pname !== "final") {
@@ -155,16 +308,14 @@ function extractJavaFile(filePath) {
         // '(' 位置定真实 header 行，避免注释归属串位）
         let protocol;
         {
-            const parenIdx = code.indexOf("(", m.index);
-            const joined = parenIdx === -1 ? "" : collectPrecedingComment(code, parenIdx);
+            const joined = collectPrecedingComment(code, parenPos);
             const lastAt = Math.max(joined.lastIndexOf("@protocol"), joined.lastIndexOf("@progmune"));
             if (lastAt !== -1) {
                 protocol = parseJavaProtocol(joined.slice(lastAt, Math.min(joined.length, lastAt + 300)));
             }
         }
-        // calls：方法体（自头正则消费的 '{' 起平衡到 '}'）内的方法调用
+        // calls：方法体（'{' 起平衡到 '}'）内的方法调用
         const calls = [];
-        const bodyStart = m.index + m[0].length; // 正则已含 '{'
         let depth = 1;
         let bodyEnd = bodyStart;
         while (bodyEnd < code.length && depth > 0) {
@@ -176,17 +327,28 @@ function extractJavaFile(filePath) {
             bodyEnd++;
         }
         const body = code.slice(bodyStart, Math.min(bodyEnd, bodyStart + 8000));
-        // 零宽后视：前导 '(' 等不被上一匹配吞掉（if (verifyToken(…) 中能收到 verifyToken）
-        const callRe = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g;
+        // 注释剔除：// 注释里的 setAllowCredentials(true) 不是调用（限定化后
+        // 与真实调用分流，注释噪声显形——REALWORLD 恢复率复测发现）
+        const cleanBody = stripJavaComments(body);
+        // 零宽后视：前导 '(' 等不被上一匹配吞掉（if (verifyToken(…) 中能收到 verifyToken）；
+        // <…> 可选类型实参：new HashMap<String, Object>() 的 HashMap 可见；
+        // 链原子容忍点两侧空白 + 泛型静态调用（DataFetcherResult.<T>newResult()）：
+        // 接收者限定匹配的前提——REALWORLD 恢复率复测 96.6%→100%
+        const callRe = /(?<=^|[^\w$])([A-Za-z_$][\w$]*(?:\s*\.\s*(?:<[^<>;]*>)?\s*[A-Za-z_$][\w$]*)*)\s*(?:<[^<>;]*(?:<[^<>;]*>[^<>;]*)*>)?\s*\(/g;
         let cm;
-        while ((cm = callRe.exec(body)) !== null) {
-            const seg = cm[1].split(".").pop() || "";
+        while ((cm = callRe.exec(cleanBody)) !== null) {
+            // 接收者限定输出（Class.method 匹配前提）：带点链保留完整、剥空白/
+            // 泛型实参与 this.
+            let full = cm[1].replace(/\s+/g, "").replace(/<[^<>]*>/g, "");
+            if (full.startsWith("this."))
+                full = full.slice(5);
+            const seg = full.split(".").pop() || "";
             if (JAVA_KEYWORDS.has(seg))
                 continue;
-            if (/^(if|for|while|switch|catch|new|return|case|do)$/.test(seg))
+            if (/^(if|for|while|switch|catch|new|return|case|do|super|this)$/.test(seg))
                 continue;
-            if (calls.length < 400 && !calls.includes(seg))
-                calls.push(seg);
+            if (calls.length < 400 && !calls.includes(full))
+                calls.push(full);
         }
         out.push({
             name,
@@ -196,6 +358,7 @@ function extractJavaFile(filePath) {
             exported,
             calls,
             protocol,
+            className: classStack[m.index] || undefined,
         });
     }
     return out;

package/dist/extract-ir-java.test.js

@@ -71,12 +71,15 @@ public class JwtTokenFilter extends OncePerRequestFilter {
         (0, vitest_1.expect)(fns.some((f) => f.name === "doFilterInternal")).toBe(true);
         (0, vitest_1.expect)(fns.some((f) => f.name === "getTokenString")).toBe(true);
     });
-    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见", () => {
+    (0, vitest_1.it)("方法调用边（calls）被提取——JWT 认证链可见（带接收者输出完整链）", () => {
         const fp = path.join(dir, "JwtTokenFilter.java");
         fs.writeFileSync(fp, SAMPLE);
         const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
         const filter = fns.find((f) => f.name === "doFilterInternal");
-        (0, vitest_1.expect)(filter.calls).toContain("getSubFromToken");
+        (0, vitest_1.expect)(filter.calls).toContain("jwtService.getSubFromToken");
+        // 链式调用按段输出：SecurityContextHolder.getContext() 输出第一段，
+        // 其返回值的 getAuthentication() 无文本接收者 → 裸名
+        (0, vitest_1.expect)(filter.calls).toContain("SecurityContextHolder.getContext");
         (0, vitest_1.expect)(filter.calls).toContain("getAuthentication");
         (0, vitest_1.expect)(filter.calls).toContain("setAuthentication");
         // 关键字不算调用
@@ -145,3 +148,161 @@ const MUT_FILTER = REAL_FILTER.replace("        .flatMap(token -> jwtService.get
         (0, vitest_1.expect)(tokenVerifyBeforeUse(calls).why).toContain("无 verify");
     });
 });
+// ── 恢复率裁决修复回归（spring-realworld AST 基准实测根因，2026-09-05）──
+(0, vitest_1.describe)("恢复率裁决修复回归（spring-realworld 实测三根因）", () => {
+    (0, vitest_1.it)("参数注解实参括号：@PathVariable(\"slug\") 不截断参数列表", () => {
+        const fp = path.join(dir, "ArticleApi.java");
+        fs.writeFileSync(fp, `package app;
+public class ArticleApi {
+  @DeleteMapping
+  public ResponseEntity deleteArticle(
+      @PathVariable("slug") String slug, @AuthenticationPrincipal User user) {
+    return articleRepository.findBySlug(slug);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const fn = fns.find((f) => f.name === "deleteArticle");
+        (0, vitest_1.expect)(fn).toBeTruthy();
+        (0, vitest_1.expect)(fn.params.map((p) => p.name)).toEqual(["slug", "user"]);
+    });
+    (0, vitest_1.it)("通配符泛型返回类型：ResponseEntity<?> 方法被提取", () => {
+        const fp = path.join(dir, "Wildcard.java");
+        fs.writeFileSync(fp, `package app;
+public class Wildcard {
+  public ResponseEntity<?> article(String slug) {
+    return ResponseEntity.ok(slug);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "article")).toBe(true);
+    });
+    (0, vitest_1.it)("构造器（无返回类型）：public Name(…) 被提取（含同行 @Autowired）", () => {
+        const fp = path.join(dir, "UserService.java");
+        fs.writeFileSync(fp, `package app;
+public class UserService {
+  @Autowired
+  public UserService(
+      UserRepository userRepository,
+      @Value("\${image.default}") String defaultImage) {
+    this.userRepository = userRepository;
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.some((f) => f.name === "UserService")).toBe(true);
+    });
+    (0, vitest_1.it)("泛型对象构造调用：new HashMap<String, Object>() 的 HashMap 可见", () => {
+        const fp = path.join(dir, "Resp.java");
+        fs.writeFileSync(fp, `package app;
+public class Resp {
+  public Map<?, ?> build() {
+    Map<String, Object> m = new HashMap<String, Object>();
+    return m;
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "build").calls;
+        (0, vitest_1.expect)(calls).toContain("HashMap");
+    });
+    (0, vitest_1.it)("super/this 构造调用不算调用边", () => {
+        const fp = path.join(dir, "Base.java");
+        fs.writeFileSync(fp, `package app;
+public class Base {
+  public Base(int config) {
+    super(config);
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const ctor = fns.find((f) => f.name === "Base");
+        (0, vitest_1.expect)(ctor).toBeTruthy();
+        (0, vitest_1.expect)(ctor.calls).not.toContain("super");
+    });
+});
+// ── 接收者限定名匹配（名碰撞根因修复，2026-09-06）──
+(0, vitest_1.describe)("接收者限定名匹配（className 捕获 + 限定调用输出）", () => {
+    (0, vitest_1.it)("className 捕获：顶层类与嵌套类归属正确", () => {
+        const fp = path.join(dir, "JacksonCustomizations.java");
+        fs.writeFileSync(fp, `package app;
+public class JacksonCustomizations {
+  public void outer() {}
+  public static class DateTimeSerializer {
+    public void serialize() {}
+    public static class Inner {
+      public void innermost() {}
+    }
+  }
+  public interface NestedIface {
+    default void ifaceMethod() {}
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const byName = new Map(fns.map((f) => [f.name, f]));
+        (0, vitest_1.expect)(byName.get("outer").className).toBe("JacksonCustomizations");
+        (0, vitest_1.expect)(byName.get("serialize").className).toBe("DateTimeSerializer");
+        (0, vitest_1.expect)(byName.get("innermost").className).toBe("Inner");
+        (0, vitest_1.expect)(byName.get("ifaceMethod").className).toBe("NestedIface");
+    });
+    (0, vitest_1.it)("匿名类内方法 className 为 undefined（按无类名处理）", () => {
+        const fp = path.join(dir, "Anon.java");
+        fs.writeFileSync(fp, `package app;
+public class Anon {
+  public void setup() {
+    Runnable r = new Runnable() {
+      public void run() {
+        doWork();
+      }
+    };
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "run").className).toBeUndefined();
+        (0, vitest_1.expect)(fns.find((f) => f.name === "setup").className).toBe("Anon");
+    });
+    (0, vitest_1.it)("record 声明形态：record Name(...) { 的类名被捕获", () => {
+        const fp = path.join(dir, "Point.java");
+        fs.writeFileSync(fp, `package app;
+public record Point(int x, int y) {
+  public int sum() { return x + y; }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "sum").className).toBe("Point");
+    });
+    (0, vitest_1.it)("this. 前缀剥离：this.foo() 输出裸名", () => {
+        const fp = path.join(dir, "Self.java");
+        fs.writeFileSync(fp, `package app;
+public class Self {
+  public void outer() {
+    this.inner();
+  }
+  public void inner() {}
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "outer").calls).toContain("inner");
+        (0, vitest_1.expect)(fns.find((f) => f.name === "outer").calls).not.toContain("this.inner");
+    });
+    (0, vitest_1.it)("限定串去重：a.open() 与 b.open() 是两条不同调用边", () => {
+        const fp = path.join(dir, "Multi.java");
+        fs.writeFileSync(fp, `package app;
+public class Multi {
+  public void go(A a, B b) {
+    a.open();
+    b.open();
+  }
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        const calls = fns.find((f) => f.name === "go").calls;
+        (0, vitest_1.expect)(calls).toContain("a.open");
+        (0, vitest_1.expect)(calls).toContain("b.open");
+    });
+    (0, vitest_1.it)("无接收者调用保持裸名（protocol 金标 exact-match 锁）", () => {
+        const fp = path.join(dir, "Bare.java");
+        fs.writeFileSync(fp, `package app;
+public class Bare {
+  public void caller() {
+    setAuthentication(id, request);
+  }
+  public void setAuthentication(String id, Object r) {}
+}`);
+        const fns = (0, extract_ir_java_1.extractJavaFile)(fp);
+        (0, vitest_1.expect)(fns.find((f) => f.name === "caller").calls).toContain("setAuthentication");
+    });
+});

package/dist/frameworks/spring-detector.js

@@ -65,7 +65,10 @@ const ACCESS_AUTH = new Set([
     "hasAuthority", "hasAnyAuthority", "rememberMe", "denyAll",
 ]);
 function isAuthEntryPath(p) {
-    return /\/?(login|signin|signup|sign_in|register|refresh)(\/|$)/i.test(p);
+    // 词段前缀 + [-/] 边界：refresh-token、authenticate、token 家族均豁免
+    // （ali-bouali 现代语料实测：/auth/authenticate、/auth/refresh-token
+    // 被白名单 permitAll 命中后误报——真实登录/刷新入口，词表缺口修复）
+    return /\/(login|signin|signup|sign_in|register|refresh|authenticate|token)([-/]|$)/i.test(p);
 }
 /** Spring ant 模式 → 正则（** → 任意段，* → 单段） */
 function antToRegex(pattern) {
@@ -76,6 +79,22 @@ function antToRegex(pattern) {
 function parseSecurityConfig(code) {
     const rules = [];
     let catchAll = null;
+    // String[] 常量数组声明（现代方言标配：private static final String[]
+    // WHITE_LIST_URL = {...}）——requestMatchers(NAME) 变量引用展开为字面量。
+    // 仅覆盖本文件内 String[] 形态；List.of/Set.of/跨文件常量待语料补充。
+    const arrayVars = new Map();
+    {
+        const arrRe = /(?:private\s+|public\s+|protected\s+)?static\s+final\s+String\[\]\s+([A-Za-z_]\w*)\s*=\s*\{/g;
+        let am;
+        while ((am = arrRe.exec(code)) !== null) {
+            const name = am[1];
+            const end = code.indexOf("};", am.index + am[0].length);
+            if (end === -1)
+                continue;
+            const literals = [...code.slice(am.index, end).matchAll(/"([^"]+)"/g)].map((x) => x[1]);
+            arrayVars.set(name, literals);
+        }
+    }
     // 逐个 .antMatchers/.requestMatchers(...) 与其后 .access() 配对
     // （旧 DSL antMatchers + 新式 SecurityFilterChain authorizeHttpRequests
     //   requestMatchers——2026-09-02 Spring 方言扩展）
@@ -98,8 +117,13 @@ function parseSecurityConfig(code) {
         for (const pm of rest.matchAll(/"([^"]+)"/g))
             patterns.push(pm[1]);
         if (patterns.length === 0) {
-            // 无引号模式（变量引用）→ 宽匹配不了，跳过（保守：不豁免）
-            continue;
+            // 无引号模式（变量引用）→ String[] 常量数组展开；
+            // 未知变量保守跳过（不豁免）
+            const varName = rest.match(/^([A-Za-z_]\w*)$/);
+            const arr = varName ? arrayVars.get(varName[1]) : undefined;
+            if (!arr)
+                continue;
+            patterns.push(...arr);
         }
         rules.push({ method, patterns, access: m[2] });
     }

package/dist/frameworks/spring-detector.test.js

@@ -168,4 +168,77 @@ public class AdminApi {
         const a = (0, spring_detector_1.analyzeSpringProject)(dir);
         (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /articles")).toBe(true);
     });
+    (0, vitest_1.it)("String[] 白名单变量展开：非 auth 词路径 permitAll mutation 被看见（修复前被兜底掩盖）", () => {
+        // 现代 Boot 3 教程标配形态：变量数组白名单（ali-bouali/spring-boot-3-jwt-security）。
+        // 展开后 /public/** 命中 permitAll 规则 → POST /public/files 公开 mutation 被报；
+        // 未展开时该规则被跳过、路由落到兜底 authenticated → 漏报（保守方向错误）。
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] WHITE_LIST_URL = {"/api/v1/auth/**", "/v3/api-docs", "/public/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/PublicApi.java", `${PKG}
+@RestController @RequestMapping("/public")
+public class PublicApi {
+  @PostMapping("/files") public Object up() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.route === "POST /public/files")).toBe(true);
+    });
+    (0, vitest_1.it)("auth 词段豁免：/auth/authenticate 与 /auth/refresh-token 公开 mutation 不报（词表缺口修复）", () => {
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] WHITE_LIST_URL = {"/api/v1/auth/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/AuthApi.java", `${PKG}
+@RestController @RequestMapping("/api/v1/auth")
+public class AuthApi {
+  @PostMapping("/authenticate") public Object login() { return null; }
+  @PostMapping("/refresh-token") public Object refresh() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("反证：白名单变量改名（展开失明）→ 路由落到兜底 authenticated，公开 mutation 漏报", () => {
+        const cfg = `${PKG}
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+@Configuration @EnableWebSecurity
+public class WebSecurityConfig {
+  private static final String[] RENAMED = {"/public/**"};
+  @Bean
+  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http.authorizeHttpRequests(req -> req
+      .requestMatchers(WHITE_LIST_URL).permitAll()
+      .anyRequest().authenticated());
+    return http.build();
+  }
+}`;
+        writeJava("sec/WebSecurityConfig.java", cfg);
+        writeJava("api/PublicApi.java", `${PKG}
+@RestController @RequestMapping("/public")
+public class PublicApi {
+  @PostMapping("/files") public Object up() { return null; }
+}`);
+        const a = (0, spring_detector_1.analyzeSpringProject)(dir);
+        (0, vitest_1.expect)(a.issues).toHaveLength(0);
+    });
 });

package/dist/mcp-server.mjs

@@ -1090,6 +1090,7 @@ ${result.code.split("\n").slice(0, 80).join("\n")}` }] };
                         degraded: cert.degraded,
                         sessionId: cert.sessionId,
                         file: cert.file,
+                        timestamp: cert.timestamp,
                     },
                     accountability: acct ? {
                         humanEvents: acct.humanEvents,

package/dist/policy/cli.js

@@ -69,7 +69,13 @@ catch {
 }
 // 3. Load policy (from project config or defaults)
 const projectDir = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
-const { rules, source } = (0, engine_1.loadPolicyConfig)(projectDir, policyPath);
+const { rules, source, configError } = (0, engine_1.loadPolicyConfig)(projectDir, policyPath);
+// 配置解析失败：拒绝静默评估（fail-closed 信号，审计修复 2026-09-06）
+if (configError) {
+    console.error(`❌ ${configError}`);
+    console.error(`   拒绝在损坏的策略配置下评估——请修复配置后重试。`);
+    process.exit(2);
+}
 // 4. Evaluate policy
 const ctx = {
     certificate: {
@@ -83,6 +89,7 @@ const ctx = {
         degraded: cert.degraded,
         sessionId: cert.sessionId,
         file: cert.file,
+        timestamp: cert.timestamp,
     },
     accountability: acct ? {
         humanEvents: acct.humanEvents,