progmune-runtime 3.7.24 → 3.7.26

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [3.7.26] — 2026-09-13
+
+### 精度修复批次（AI 生成项目验证 V2 + 真实修复回归驱动的引擎改动）
+
+- **FastAPI 认证词表补现代认证形态**（`tools/extract_framework_py.py`）：`current_org`/`current_caller`/`caller_context`（skyvern 146 条误报的根因词族）+ `verified_user`/`admin_user`（open-webui 142 条误报的根因词族）——每个新真实语料都暴露一批框架层词汇缺口；fastapi-realworld 0 FP 保持 + 摘保护反证精确触发
+- **词段匹配边界收紧**（`ssg-bridge.ts` Strategy 2）：规则词必须按序出现且首词@词位 0、末词@末位（此前仅要求全部出现即命中）——skyvern 35 条 SSG 误报消灭 16 条、nginx 3 FP→0；**Python 盲测 64/64 零漂移、TS 795 零漂移（3086 flags LOST 0 / ADDED 0）、C 金标 F1=95.7% 不变、Go 盲测 P=R=100%**
+- **一次性文件 API 原子化**（`protocols.json`）：`read_text`/`write_text`/`read_bytes`/`write_bytes`/`pathlib.*` 入 `read_file_atomic`/`write_file_atomic` 别名——Path.read_text 族内部完成 open→close，不再报裸读
+- **类方法提取修复**（`extract-ir.ts`）：类方法循环此前误置于变量声明循环内——无顶层变量声明的文件（openhop store.ts 复现）方法整体漏提取，有变量声明的文件重复 push；移至文件层 + `cls.isExported()`
+- **路径穿越检测 TS 化（A1，修复回归 fr-007 驱动）**：TS 提取器注入 `__progmune_path_traversal__`（request 污点→fs sink 单跳 + 跨函数一跳——调用点污点实参流入项目方法体内的文件 sink）；**引擎 IR 层直接消费标记**（call-sequence 构建过滤 `__progmune_` 前缀，标记到不了 specific-check——Python 标记此前在引擎管线中是死的，本版同时点亮两侧）；规则 `languages` 补 typescript/javascript；domain-validator 补 `PATH_TRAVERSAL` 检查
+
+### 真实安全修复回归 V1（决定性实验，回答「能力 vs 语料」）
+
+- **语料**：8 条真实修复（open-webui 6 Python / openhop 1 TS / SimpleWebAuthn 1 TS，全部 GHSA/CVE + 修复 commit + 真值文件清单），注册表 `blind-benchmark/fix-regression-corpus.json`
+- **基线 0/8 检出**——漏报根因七类逐条记录（查询语义 / 策略逻辑分支 / 凭据数据流 / 归属数据流 / 配置通道路由 / 语言面缺口 / 密码学协议语义），见 `blind-benchmark/REALWORLD_FIX_REGRESSION_V1.md`
+- **A1 后 fr-007（openhop Flow ID 路径穿越）转 DETECTED**：PATH_TRAVERSAL ×4 命中真值位置（routes.ts flowRoutes + store.ts FlowStore.save/get/delete）；fr-001~006/008 待对应能力扩展
+- **AI 生成项目验证 V2**（`blind-benchmark/REALWORLD_AI_GENERATED_V2.md`）：Skyvern ⭐22,971 生产管线扫描 181 条违规逐条人工标注全 FP——框架层认证词汇缺口 144 条 + 词段误报 35 条（其中 16 条把代码里的路径穿越防御/符号链接校验误报为协议违规）；修复后 181→22（剩余 19 条夹心形态词法不可区分 + 2 条 HMAC webhook + 1 条精确名碰撞，见报告 §3.2 与 §5）
+
+### 回归
+
+- 发布门：build ✓ / check 免疫正常 ✓ / Python 盲测 64 零漂移 ✓ / TS 795 零漂移 ✓ / C 金标 F1=95.7% ✓ / Go 盲测 P=R=100% ✓ / 定向 184 tests green（本地全量套件重负载 worker 崩溃为既有环境问题，以 CI 为准）
+
+## [3.7.25] — 2026-09-10
+
+### 失败语料上报链路修复（中央 hub 恢复数据流）
+
+- **诊断**：中央 hub 自 2026-05-18 起零新增（totalCount=12），npm 周下载 1000-2000 但数据全丢——两个断点：① `immune-reporter` 读废弃路径 `failure_corpus/`（语料已统一到 `.progmune_corpus/`）② 端点默认 `localhost:3000`，安装态用户到不了中央 hub
+- **修复**：数据源对齐 `.progmune_corpus/{date}/fail_*.json`（`PROGMUNE_PROJECT_DIR`/`PROGMUNE_CORPUS_DIR` 感知，损坏记录跳过）；端点默认 `https://progmune-runtime.fly.dev/report`；`PROGMUNE_HUB=off` 可关闭上报
+- **默认脱敏**：函数名 SHA-256 截 12 位（同名同哈希，模式聚合仍有效）；`PROGMUNE_FINGERPRINT_DETAIL=1` 才发送原文函数名；源码与变量值永不上传
+- **隐私口径如实披露**：README/落地页/privacy 页——「代码不上传」保持为真，「无遥测」表述改为如实披露脱敏指纹默认上报与关闭方式
+- **中央 hub 防护层上线**：字段白名单 + 类型校验（SVL-1~4、时间戳 ±窗口、序列长度上限）；请求体 512KB / 每请求 ≤500 条；实例+时间戳+模式指纹去重；每实例每 10 分钟 ≤5 次；每日 ≤10000 条；可选 `PROGMUNE_HUB_TOKEN` Bearer 认证（客户端 `PROGMUNE_HUB_TOKEN` 环境变量同步支持）
+- 回归 12 green；hub 冒烟六场景（正常/畸形/去重/超大/限流/认证）全过
+
 ## [3.7.24] — 2026-09-06
 
 ### 审计复检三项修复

package/README.md

@@ -6,6 +6,10 @@
 [![MCP](https://img.shields.io/badge/MCP-Compatible-blue)](https://modelcontextprotocol.io)
 [![TS Benchmark](https://img.shields.io/badge/TS%20R98.5%25%20P100%25-22c55e)]()
 [![Python Benchmark](https://img.shields.io/badge/Python%20R100%25%20P100%25-22c55e)]()
+[![npm version](https://img.shields.io/npm/v/progmune-runtime?color=cb3837)](https://www.npmjs.com/package/progmune-runtime)
+[![npm weekly downloads](https://img.shields.io/npm/dw/progmune-runtime?color=cb3837)](https://www.npmjs.com/package/progmune-runtime)
+[![GitHub stars](https://img.shields.io/github/stars/shenlian19831109/progmune-runtime?color=gold)](https://github.com/shenlian19831109/progmune-runtime)
+[![GitHub release](https://img.shields.io/github/v/release/shenlian19831109/progmune-runtime?color=gold)](https://github.com/shenlian19831109/progmune-runtime/releases)
 
 > [中文版](https://github.com/shenlian19831109/progmune-runtime/blob/main/README.zh-CN.md) · English Version
 

package/dist/extract-ir.js

@@ -369,6 +369,235 @@ function extractDirectCalls(func) {
     }
     return [...new Set(calls)];
 }
+// ═══════════════════════════════════════════════════════════════
+// Path traversal marker（2026-09-11，REALWORLD_FIX_REGRESSION_V1 fr-007）
+// 镜像 tools/extract_ir.py 的 request 污点 → 文件 sink 单跳追踪，另补
+// 跨函数一跳：调用点把污点实参传给项目方法，该方法体内对应参数流入
+// 文件 sink → 在调用方函数注入 __progmune_path_traversal__。
+// 消费方：protocol-domain-validator 的 PATH_TRAVERSAL 检查（引擎路径）
+// 与 protocol-detector 的同名规则（source-level benchmark 路径）。
+// ═══════════════════════════════════════════════════════════════
+const PATH_TRAVERSAL_MARKER = "__progmune_path_traversal__";
+const TS_FILE_SINK_NAMES = [
+    "readFile", "readFileSync", "writeFile", "writeFileSync",
+    "appendFile", "appendFileSync", "unlink", "unlinkSync", "rm", "rmSync",
+    "mkdir", "mkdirSync", "open", "openSync", "createReadStream",
+    "createWriteStream", "existsSync", "readdir", "readdirSync",
+    "copyFile", "rename", "stat", "lstat", "rmdir", "truncate",
+];
+function tsSinkCallRegex() {
+    return new RegExp(`(?:^|[^\\w.$])(?:await\\s+)?(?:[\\w$]+\\.)?(${TS_FILE_SINK_NAMES.join("|")})\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+}
+/** request 根表达式：req.params / request.body / req.query['x'] … */
+function hasRequestRootedExpr(text) {
+    return /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.test(text);
+}
+/** 函数体内被 request 污染的局部名（含解构与单跳赋值，深度 ≤2） */
+function collectTaintedNames(text) {
+    const tainted = new Set();
+    let m;
+    const direct = /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    while ((m = direct.exec(text)) !== null)
+        tainted.add(m[1]);
+    const destr = /(?:const|let|var)\s*\{\s*([^}=]*?)\s*\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g;
+    while ((m = destr.exec(text)) !== null) {
+        for (const part of m[1].split(",")) {
+            const name = part.trim().split(":")[0].trim();
+            if (/^[\w$]+$/.test(name))
+                tainted.add(name);
+        }
+    }
+    const bareAssign = /(?:^|[^\w$.])([\w$]+)\s*=\s*(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    while ((m = bareAssign.exec(text)) !== null)
+        tainted.add(m[1]);
+    // 单跳传播（深度 ≤2）
+    for (let depth = 0; depth < 2; depth++) {
+        if (tainted.size === 0)
+            break;
+        const names = [...tainted].join("|");
+        const hop = new RegExp(`(?:const|let|var)\\s+([\\w$]+)\\s*=\\s*\\b(?:${names})\\b`, "g");
+        let added = false;
+        while ((m = hop.exec(text)) !== null) {
+            if (!tainted.has(m[1])) {
+                tainted.add(m[1]);
+                added = true;
+            }
+        }
+        if (!added)
+            break;
+    }
+    return tainted;
+}
+function taintPattern(tainted) {
+    const parts = [
+        /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source,
+    ];
+    if (tainted.size > 0) {
+        parts.push(`\\b(?:${[...tainted].join("|")})\\b`);
+    }
+    return new RegExp(parts.join("|"));
+}
+/** 本函数体内：文件 sink 的实参窗口含 request 污点 → true */
+function hasTaintedSinkCall(text, tainted) {
+    const taint = taintPattern(tainted);
+    if (!taint)
+        return false;
+    const sinkRe = tsSinkCallRegex();
+    let m;
+    while ((m = sinkRe.exec(text)) !== null) {
+        if (taint.test(m[2] || ""))
+            return true;
+    }
+    return false;
+}
+/** 深度 0 逗号切分实参窗口（截断窗口内近似；首个参数位置常用于路径） */
+function splitArgWindow(win) {
+    const args = [];
+    let depth = 0;
+    let cur = "";
+    for (const ch of win) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            depth++;
+        else if (ch === ")" || ch === "]" || ch === "}")
+            depth--;
+        else if (ch === "," && depth === 0) {
+            args.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        args.push(cur);
+    return args;
+}
+/** 项目方法名 → 方法体内流入文件 sink 的形参下标集合 */
+function methodSinkParamMap(project, absRoot) {
+    const map = new Map();
+    for (const sf of project.getSourceFiles()) {
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        for (const cls of sf.getClasses()) {
+            const cn = cls.getName();
+            if (!cn)
+                continue;
+            for (const m of cls.getMethods()) {
+                const params = m.getParameters().map((p) => p.getName());
+                if (params.length === 0)
+                    continue;
+                const text = m.getText();
+                const sinkRe = tsSinkCallRegex();
+                let sm;
+                while ((sm = sinkRe.exec(text)) !== null) {
+                    const win = sm[2] || "";
+                    params.forEach((pname, idx) => {
+                        if (new RegExp(`\\b${pname}\\b`).test(win)) {
+                            if (!map.has(m.getName())) {
+                                map.set(m.getName(), { idxs: new Set(), entries: [] });
+                            }
+                            const rec = map.get(m.getName());
+                            rec.idxs.add(idx);
+                            const fullName = `${cn}.${m.getName()}`;
+                            if (!rec.entries.some((e) => e.name === fullName)) {
+                                rec.entries.push({ name: fullName, file: relPath });
+                            }
+                        }
+                    });
+                }
+            }
+        }
+    }
+    return map;
+}
+/**
+ * 注入路径穿越标记：
+ *  1) 本函数体内 sink 实参直接污点；
+ *  2) 跨函数一跳——调用项目方法且污点实参落在该方法的 sink 形参位置。
+ * 标记只进 funcs 中该函数的 calls（方法条目不单独标——违规归因到入口）。
+ */
+function augmentPathTraversalMarkers(project, funcs, absRoot) {
+    const sinkParams = methodSinkParamMap(project, absRoot);
+    const methodCallRe = new RegExp(`\\.([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+    const mark = (name, file) => {
+        const entry = funcs.find((x) => x.name === name && x.file === file);
+        if (!entry)
+            return;
+        entry.calls = entry.calls || [];
+        if (!entry.calls.includes(PATH_TRAVERSAL_MARKER)) {
+            entry.calls.push(PATH_TRAVERSAL_MARKER);
+        }
+    };
+    // 对每个函数式节点（函数声明/方法/箭头回调——fastify 路由回调是内联
+    // 箭头函数，不在 funcs 中）独立做污点分析。节点文本预过滤：
+    // 不含 request 访问也不含 sink 方法调用则跳过。
+    const sinkMethodNames = [...sinkParams.keys()];
+    const prefilter = new RegExp(`\\b(?:req|request)\\.(?:params|query|body|headers|cookies)\\b|` +
+        (sinkMethodNames.length > 0 ? `\\.(?:${sinkMethodNames.join("|")})\\s*\\(` : "a^"));
+    for (const sf of project.getSourceFiles()) {
+        if (sf.getFilePath().includes("node_modules"))
+            continue;
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        sf.forEachDescendant((node) => {
+            if (!ts_morph_1.Node.isFunctionDeclaration(node) &&
+                !ts_morph_1.Node.isArrowFunction(node) &&
+                !ts_morph_1.Node.isMethodDeclaration(node)) {
+                return;
+            }
+            const text = node.getText();
+            if (!prefilter.test(text))
+                return;
+            const tainted = collectTaintedNames(text);
+            if (tainted.size === 0)
+                return;
+            const taint = taintPattern(tainted);
+            if (!taint)
+                return;
+            // 1) 节点体内 sink 实参直接污点 → 标记该节点归属的 funcs 条目
+            if (hasTaintedSinkCall(text, tainted)) {
+                const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+                if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                    mark(nodeName, relPath);
+                }
+                else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                    const cls = node.getParent();
+                    if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                        mark(`${cls.getName()}.${nodeName}`, relPath);
+                    }
+                }
+                return;
+            }
+            // 2) 跨函数一跳：污点实参传入项目方法体的文件 sink。
+            //    标记调用方（若可归属）+ 被调方法条目——路由回调不可归属时，
+            //    方法条目是唯一可归因位置（openhop 形态）。
+            methodCallRe.lastIndex = 0;
+            let m;
+            while ((m = methodCallRe.exec(text)) !== null) {
+                const callee = m[1];
+                const rec = sinkParams.get(callee);
+                if (!rec || rec.idxs.size === 0)
+                    continue;
+                const win = m[2] || "";
+                const args = splitArgWindow(win);
+                const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
+                if (!hit)
+                    continue;
+                const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+                if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                    mark(nodeName, relPath);
+                }
+                else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                    const cls = node.getParent();
+                    if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                        mark(`${cls.getName()}.${nodeName}`, relPath);
+                    }
+                }
+                for (const me of rec.entries) {
+                    mark(me.name, me.file);
+                }
+                return;
+            }
+        });
+    }
+}
 /**
  * 从 TypeScript 项目提取 IR（函数签名、参数、返回值、协议注解）。
  * @protocol namespace=dev_pipeline pre_states=[] post_states=["IR_EXTRACTED"] invalidate=["IR_STALE"]
@@ -519,30 +748,43 @@ function _extractSingleProject(absRoot, tsconfigPath) {
                     }
                 }
             }
-            // Extract class methods: ts-morph getFunctions() excludes class members
-            for (const cls of sf.getClasses()) {
-                const cn = cls.getName();
-                if (!cn)
+        }
+        // Extract class methods: ts-morph getFunctions() excludes class members
+        // （2026-09-12 修复：此循环此前误置于 VariableDeclaration 循环内——
+        //   无顶层变量声明的文件（如 openhop store.ts）方法整体漏提取，
+        //   且有变量声明的文件会重复 push。移至 sf 层 + 去重语义。）
+        for (const cls of sf.getClasses()) {
+            const cn = cls.getName();
+            if (!cn)
+                continue;
+            for (const m of cls.getMethods()) {
+                const mn = m.getName();
+                if (!mn)
                     continue;
-                for (const m of cls.getMethods()) {
-                    const mn = m.getName();
-                    if (!mn)
-                        continue;
-                    funcs.push({
-                        name: `${cn}.${mn}`,
-                        params: m.getParameters().map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),
-                        returnType: m.getReturnTypeNode?.()?.getText?.() || "any",
-                        returnTypeDetail: m.getReturnTypeNode?.()?.getText?.() || "any",
-                        file: relPath,
-                        exported: vd.isExported(), calls: [],
-                        ...parseCapabilityFromJSDoc(m),
-                        protocol: parseProtocolFromJSDoc(m),
-                    });
-                }
+                funcs.push({
+                    name: `${cn}.${mn}`,
+                    params: m.getParameters().map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),
+                    returnType: m.getReturnTypeNode?.()?.getText?.() || "any",
+                    returnTypeDetail: m.getReturnTypeNode?.()?.getText?.() || "any",
+                    file: relPath,
+                    exported: cls.isExported(),
+                    calls: [],
+                    ...parseCapabilityFromJSDoc(m),
+                    protocol: parseProtocolFromJSDoc(m),
+                });
             }
         }
     }
     // ═══════════════════════════════════════════════════════════════
+    // Phase 4.5: Path traversal marker（2026-09-11，fr-007 openhop）
+    // 镜像 Python 提取器的 request 污点 → 文件 sink 单跳追踪，并补
+    // 跨函数一跳：调用点把污点参数传给项目方法，该方法体内该参数
+    // 流入文件 sink → 调用方函数注入 __progmune_path_traversal__。
+    // 消费方：protocol-domain-validator PATH_TRAVERSAL 检查（引擎）
+    // 与 protocol-detector 同名规则（source-level benchmark 路径）。
+    // ═══════════════════════════════════════════════════════════════
+    augmentPathTraversalMarkers(project, funcs, absRoot);
+    // ═══════════════════════════════════════════════════════════════
     // Phase 5: Dynamic external function resolution
     // Replaces hardcoded knownExternals
     //   includes: npm packages (.d.ts via ts.resolveModuleName), Node.js built-ins (@types/node)

package/dist/immune-reporter.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeaders = buildHeaders;
+exports.resolveEndpoint = resolveEndpoint;
+exports.maskFunctionName = maskFunctionName;
 exports.extractFingerprints = extractFingerprints;
 exports.reportFingerprints = reportFingerprints;
 exports.previewFingerprints = previewFingerprints;
@@ -41,8 +44,34 @@ const path = __importStar(require("path"));
 const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
-const REPORT_ENDPOINT = process.env.PROGMUNE_HUB || "http://localhost:3000/report";
-const CURSOR_FILE = path.resolve(__dirname, "../.progmune_memory/report_cursor.json");
+// ── 数据源（与 failure-corpus.ts 统一路径，项目级、可写） ──
+const PROJECT_DIR = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
+const CORPUS_DIR = process.env.PROGMUNE_CORPUS_DIR || path.resolve(PROJECT_DIR, ".progmune_corpus");
+const CURSOR_FILE = path.join(CORPUS_DIR, ".report_cursor.json");
+// ── 端点与开关 ──
+const HUB_ENV = process.env.PROGMUNE_HUB;
+const HUB_TOKEN = process.env.PROGMUNE_HUB_TOKEN;
+const DETAIL_ENABLED = process.env.PROGMUNE_FINGERPRINT_DETAIL === "1";
+const OFF_PATTERN = /^(off|0|false|no|disabled)$/i;
+/** 上报请求头：hub 设了 PROGMUNE_HUB_TOKEN 时需带 Bearer 认证。 */
+function buildHeaders(token = HUB_TOKEN) {
+    const headers = { "Content-Type": "application/json" };
+    if (token)
+        headers["Authorization"] = `Bearer ${token}`;
+    return headers;
+}
+/** 解析上报端点：显式关闭 → null；未设 → 中央 hub；其他 → 自定义 URL。 */
+function resolveEndpoint(env = HUB_ENV) {
+    if (env && OFF_PATTERN.test(env))
+        return null;
+    return env || "https://progmune-runtime.fly.dev/report";
+}
+/** 脱敏：默认哈希函数名；DETAIL 开关打开时保留原文。 */
+function maskFunctionName(name, detail = DETAIL_ENABLED) {
+    if (detail)
+        return name;
+    return "fn:" + crypto.createHash("sha256").update(name).digest("hex").substring(0, 12);
+}
 function getInstanceId() {
     const host = require("os").hostname();
     const cwd = process.cwd();
@@ -62,8 +91,8 @@ function saveReportCursor(timestamp, count) {
         fs.mkdirSync(dir, { recursive: true });
     fs.writeFileSync(CURSOR_FILE, JSON.stringify({ lastTimestamp: timestamp, reportedCount: count, updatedAt: new Date().toISOString() }, null, 2));
 }
-function extractFingerprints(cursor) {
-    const corpusDir = path.resolve(__dirname, "../failure_corpus");
+/** 收集语料目录中的新失败指纹（含脱敏处理）。corpusDir 参数便于测试注入。 */
+function extractFingerprints(cursor, corpusDir = CORPUS_DIR) {
     if (!fs.existsSync(corpusDir))
         return [];
     const fingerprints = [];
@@ -73,16 +102,22 @@ function extractFingerprints(cursor) {
         if (!fs.statSync(datePath).isDirectory())
             continue;
         for (const file of fs.readdirSync(datePath).sort()) {
-            if (!file.endsWith(".json"))
+            if (!file.endsWith(".json") || !file.startsWith("fail_"))
                 continue;
             const filePath = path.join(datePath, file);
-            const record = JSON.parse(fs.readFileSync(filePath, "utf-8"));
-            // 如果游标存在且该记录时间戳 <= 游标，跳过
-            if (cursor && cursor.lastTimestamp && record.timestamp <= cursor.lastTimestamp)
+            let record;
+            try {
+                record = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+            }
+            catch {
+                continue; /* 损坏记录跳过，best-effort */
+            }
+            // 游标存在且该记录时间戳 <= 游标，跳过
+            if (cursor && cursor.lastTimestamp && (record.timestamp || "") <= cursor.lastTimestamp)
                 continue;
             const funcSeq = (record.actionSequence || [])
                 .filter((a) => a.kind === "call")
-                .map((a) => a.function);
+                .map((a) => maskFunctionName(String(a.function)));
             fingerprints.push({
                 instance_id: instanceId,
                 timestamp: record.timestamp,
@@ -99,6 +134,10 @@ function extractFingerprints(cursor) {
 }
 /** @requires CORPUS @produces FINGERPRINT_REPORT */
 async function reportFingerprints() {
+    const endpoint = resolveEndpoint();
+    if (endpoint === null) {
+        return { success: true, message: "上报已禁用（PROGMUNE_HUB=off），跳过" };
+    }
     const cursor = getReportCursor();
     const fingerprints = extractFingerprints(cursor);
     if (fingerprints.length === 0) {
@@ -109,11 +148,11 @@ async function reportFingerprints() {
     const maxTimestamp = fingerprints[fingerprints.length - 1].timestamp;
     const payload = JSON.stringify({ fingerprints });
     return new Promise((resolve) => {
-        const url = new URL(REPORT_ENDPOINT);
+        const url = new URL(endpoint);
         const transport = url.protocol === "https:" ? https : http;
-        const req = transport.request(REPORT_ENDPOINT, {
+        const req = transport.request(endpoint, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: buildHeaders(),
         }, (res) => {
             let data = "";
             res.on("data", (chunk) => data += chunk);
@@ -128,6 +167,7 @@ async function reportFingerprints() {
                 }
             });
         });
+        req.setTimeout(8000, () => req.destroy(new Error("上报超时")));
         req.on("error", (e) => resolve({ success: false, message: `网络错误: ${e.message}` }));
         req.write(payload);
         req.end();

package/dist/immune-reporter.test.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const immune_reporter_1 = require("./immune-reporter");
+/**
+ * Immune Reporter 测试——2026-09 修复轮：
+ * 默认脱敏、PROGMUNE_HUB=off 开关、语料路径对齐 .progmune_corpus。
+ * 涉及文件系统的用例使用临时目录注入（corpusDir 参数），不触碰真实语料。
+ */
+let tmpDir;
+(0, vitest_1.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "progmune-reporter-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+(0, vitest_1.describe)("resolveEndpoint", () => {
+    (0, vitest_1.it)("未设置 PROGMUNE_HUB 时默认指向中央 hub", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)(undefined)).toBe("https://progmune-runtime.fly.dev/report");
+    });
+    (0, vitest_1.it)("PROGMUNE_HUB=off 及其变体（0/false/no/disabled）关闭上报", () => {
+        for (const v of ["off", "0", "false", "no", "disabled", "OFF"]) {
+            (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)(v)).toBeNull();
+        }
+    });
+    (0, vitest_1.it)("自定义 URL 原样生效", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.resolveEndpoint)("http://localhost:9999/report")).toBe("http://localhost:9999/report");
+    });
+});
+(0, vitest_1.describe)("maskFunctionName", () => {
+    (0, vitest_1.it)("默认脱敏：同名函数产生相同哈希（模式聚合保持有效）", () => {
+        const a = (0, immune_reporter_1.maskFunctionName)("generate_jwt", false);
+        const b = (0, immune_reporter_1.maskFunctionName)("generate_jwt", false);
+        (0, vitest_1.expect)(a).toBe(b);
+        (0, vitest_1.expect)(a).toMatch(/^fn:[0-9a-f]{12}$/);
+        (0, vitest_1.expect)(a).not.toContain("generate_jwt");
+    });
+    (0, vitest_1.it)("不同函数名产生不同哈希", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.maskFunctionName)("generate_jwt", false)).not.toBe((0, immune_reporter_1.maskFunctionName)("create_session", false));
+    });
+    (0, vitest_1.it)("PROGMUNE_FINGERPRINT_DETAIL=1 时保留原文", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.maskFunctionName)("generate_jwt", true)).toBe("generate_jwt");
+    });
+});
+(0, vitest_1.describe)("buildHeaders", () => {
+    (0, vitest_1.it)("无 token 时只带 Content-Type", () => {
+        (0, vitest_1.expect)((0, immune_reporter_1.buildHeaders)(undefined)).toEqual({ "Content-Type": "application/json" });
+    });
+    (0, vitest_1.it)("设置 PROGMUNE_HUB_TOKEN 时带 Bearer 认证头", () => {
+        const h = (0, immune_reporter_1.buildHeaders)("secret-token");
+        (0, vitest_1.expect)(h["Authorization"]).toBe("Bearer secret-token");
+        (0, vitest_1.expect)(h["Content-Type"]).toBe("application/json");
+    });
+});
+(0, vitest_1.describe)("extractFingerprints", () => {
+    function writeRecord(date, id, record) {
+        const dir = path.join(tmpDir, date);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, `fail_${id}.json`), JSON.stringify(record));
+    }
+    (0, vitest_1.it)("从 .progmune_corpus 路径读取并默认脱敏函数名", () => {
+        writeRecord("2026-09-09", "1", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [{ kind: "call", function: "generate_jwt" }],
+            ssgState: ["UNAUTHENTICATED"],
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].functionSequence[0]).toMatch(/^fn:[0-9a-f]{12}$/);
+        (0, vitest_1.expect)(fps[0].preState).toEqual([["UNAUTHENTICATED"]]);
+    });
+    (0, vitest_1.it)("游标之后的新记录才会上报，旧记录跳过", () => {
+        writeRecord("2026-09-01", "old", {
+            timestamp: "2026-09-01T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        writeRecord("2026-09-09", "new", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: "2026-09-05T00:00:00.000Z" }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].timestamp).toBe("2026-09-09T10:00:00.000Z");
+    });
+    (0, vitest_1.it)("非 fail_ 前缀文件与损坏 JSON 跳过，不中断", () => {
+        writeRecord("2026-09-09", "ok", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-4",
+            constraintType: "protocol",
+            actionSequence: [],
+        });
+        fs.writeFileSync(path.join(tmpDir, "2026-09-09", "trajectory_x.json"), "{}");
+        fs.writeFileSync(path.join(tmpDir, "2026-09-09", "fail_broken.json"), "{corrupted");
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+    });
+    (0, vitest_1.it)("无调用序列时 functionSequence 为空数组而非报错", () => {
+        writeRecord("2026-09-09", "empty", {
+            timestamp: "2026-09-09T10:00:00.000Z",
+            violatedSVL: "SVL-2",
+            constraintType: "types",
+        });
+        const fps = (0, immune_reporter_1.extractFingerprints)({ lastTimestamp: null }, tmpDir);
+        (0, vitest_1.expect)(fps.length).toBe(1);
+        (0, vitest_1.expect)(fps[0].functionSequence).toEqual([]);
+    });
+});

package/dist/protocol-detector.js

@@ -673,9 +673,12 @@ const SAFEGUARD_RULES = [
     {
         name: "Path Traversal (User-Controlled File Path)",
         category: "path_traversal",
-        languages: ["python"],
-        // Source-level detection: the Python extractor emits a synthetic marker
-        // call when a file sink (open / io.open / os.open / Path(...).read_text)
+        // 2026-09-11（fr-007）：TS 提取器（extract-ir.ts）自 2026-09-11 起同样
+        // 注入该标记（request 污点 → 文件 sink，含跨函数一跳）——语言面扩展。
+        languages: ["typescript", "javascript", "python"],
+        // Source-level detection: the language extractors emit a synthetic marker
+        // call when a file sink (open / io.open / os.open / Path(...).read_text;
+        // TS: readFile/writeFile/unlink/rm/mkdir/createReadStream 等 fs 族)
         // receives a path tainted by request-derived user input (directly or via
         // single-hop assignment — os.path.join chains resolve through assignment
         // tracking). No satisfier possible — the marker IS the violation evidence.

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.24";
+exports.RUNTIME_VERSION = "3.7.26";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1261,6 +1261,27 @@ async function collectProtocolViolations(ctx, callGraph) {
                         const n = String(f.name);
                         nameCounts.set(n, (nameCounts.get(n) || 0) + 1);
                     }
+                    // 2026-09-12（REALWORLD_FIX_REGRESSION_V1 fr-007）：路径穿越标记
+                    // 在 IR 层直接消费——call-sequence 构建会过滤 __progmune_ 前缀
+                    // （P4.5 历史），标记到不了 checkSpecificViolations；此前的 Python
+                    // 标记因此在引擎管线中一直是死的。此处同时点亮 Python 与 TS 两侧。
+                    for (const f of functions) {
+                        const calls = f.calls || [];
+                        if (calls.includes("__progmune_path_traversal__")) {
+                            violations.push({
+                                severity: "medium",
+                                rule_id: "PATH_TRAVERSAL",
+                                file: f.file,
+                                function: f.name || "unknown",
+                                message: "File operation receives a request-controlled path without visible validation — path traversal / arbitrary file access.",
+                                evidence: "__progmune_path_traversal__",
+                                why: "Extractor-verified taint flow: request-derived input reaches a file sink " +
+                                    "(directly or via one-hop project method).",
+                                fix: "Validate/sanitize the path (allowlist, basename normalization) before file operations.",
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
+                    }
                     for (const f of functions) {
                         if (!f.protocol)
                             continue;

package/dist/trust/protocol-domain-validator.js

@@ -641,6 +641,24 @@ exports.SPECIFIC_VIOLATION_CHECKS = [
     // ═══════════════════════════════════════════════════════
     // QUIC-001: Active migration disabled
     // ═══════════════════════════════════════════════════════
+    // 2026-09-11（REALWORLD_FIX_REGRESSION_V1 fr-007）：路径穿越引擎化。
+    // 标记由语言提取器注入（Python: tools/extract_ir.py 请求污点→文件
+    // sink 单跳追踪；TypeScript: src/extract-ir.ts 同款 + 跨函数一跳——
+    // 调用点污点参数流入项目方法体内的文件 sink）。此前 Python 标记在
+    // 引擎管线中无消费方（source-level 规则只活在 benchmark harness），
+    // 本检查同时点亮 Python 与 TS 两侧。
+    // ═══════════════════════════════════════════════════════
+    {
+        ruleId: "PATH_TRAVERSAL",
+        description: "A file operation receives a path derived from request-controlled input " +
+            "without visible validation — path traversal / arbitrary file access.",
+        languages: ["typescript", "javascript", "python"],
+        check: (steps) => {
+            return steps.some((s) => s.api === "__progmune_path_traversal__" ||
+                s.api.startsWith("__progmune_path_traversal"));
+        },
+    },
+    // ═══════════════════════════════════════════════════════
     {
         ruleId: "QUIC_DISABLE_ACTIVE_MIGRATION",
         description: "QUIC connection migration is disabled. This may impact privacy " +

package/dist/trust/ssg-bridge.js

@@ -287,14 +287,42 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
         if (projectFunctions && isDotted)
             continue; // 带点调用只走限定精确匹配（+别名/域提示）
         const ruleWords = ruleName.split("_");
-        const callWords = normalized.split("_");
         // Rule must have at least 2 words for this strategy (single-word rules
         // are too prone to false positives via substring)
         if (ruleWords.length < 2)
             continue;
-        // Every rule word must appear as a complete call word segment
-        const allWordsMatch = ruleWords.every((rw) => callWords.includes(rw));
-        if (allWordsMatch) {
+        // 2026-09-11（REALWORLD_AI_GENERATED_V2 / skyvern）：词段匹配加
+        // 「首词@首位 + 末词@末位」边界收紧。此前仅要求规则词全部出现——
+        // validate_local_file_path / _validate_file_stat / _session_create_data /
+        // _revoke_refresh_token_at_google / ngx_read_file 等真实语料 FP 均破坏
+        // 该边界；Python 盲测 S5 改名形态（verify_user_password /
+        // create_active_session / open_user_file）全部满足边界，TP 不受影响。
+        let callWords = normalized.split("_").filter((w) => w !== "");
+        if (callWords.length === 0)
+            callWords = normalized.split("_");
+        // Rule words must appear in order — first rule word at word index 0,
+        // last rule word at the final word index — not just anywhere in the set
+        let pos = 0;
+        const positions = [];
+        let ordered = true;
+        for (const rw of ruleWords) {
+            let found = -1;
+            for (let i = pos; i < callWords.length; i++) {
+                if (callWords[i] === rw) {
+                    found = i;
+                    break;
+                }
+            }
+            if (found === -1) {
+                ordered = false;
+                break;
+            }
+            positions.push(found);
+            pos = found + 1;
+        }
+        if (ordered &&
+            positions[0] === 0 &&
+            positions[positions.length - 1] === callWords.length - 1) {
             return ruleName;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.24",
+  "version": "3.7.26",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/protocols.json

@@ -2169,7 +2169,11 @@
         "fs.readFileSync",
         "fs.readFile",
         "fs.promises.readFile",
-        "fs.promises.readFileSync"
+        "fs.promises.readFileSync",
+        "read_text",
+        "read_bytes",
+        "pathlib.read_text",
+        "pathlib.read_bytes"
       ],
       "status": "confirmed"
     },
@@ -2182,9 +2186,13 @@
         "fs.writeFileSync",
         "fs.writeFile",
         "fs.promises.writeFile",
-        "fs.promises.writeFileSync"
+        "fs.promises.writeFileSync",
+        "write_text",
+        "write_bytes",
+        "pathlib.write_text",
+        "pathlib.write_bytes"
       ],
       "status": "confirmed"
     }
   }
-}
+}

package/tools/extract_framework_py.py

@@ -34,9 +34,20 @@ import sys
 # 依赖名含 user 会被误标认证（REALWORLD_STRUCTURAL_V2 假保护 FN）。
 # 真认证依赖用 current_user/authorizer 等强词识别（get_current_user
 # 含 current_user ✓）。
+# 2026-09-11（REALWORLD_AI_GENERATED_V2 / skyvern）：补 org-token 认证模型
+# 词族——get_current_org / get_current_caller_context 是 23k★ 生产 SaaS
+# 的主力认证依赖名，词表不认识 → 146 条 FASTAPI_ROUTE_NO_AUTH 误报。
+# current_org/current_caller/caller_context 与 current_user 同强度
+# （get_current_organization 误标风险与 get_current_user 同族，已接受）。
 AUTH_WORDS = (
     "auth", "login", "token", "credential", "session",
     "bearer", "permission", "current_user", "api_key", "oauth", "jwt",
+    "current_org", "current_caller", "caller_context",
+    # open-webui 真实语料（修复回归 fr-001 扫描，2026-09-11）：get_verified_user /
+    # get_admin_user 是其全路由主力认证依赖（session/JWT 校验），词表不认识 →
+    # 142 条 FASTAPI_ROUTE_NO_AUTH 误报。复合词窄口：verified_user/admin_user
+    # 是强认证词（区别于裸 "user" 的 DB 查询误标风险）。
+    "verified_user", "admin_user",
 )
 
 SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",