progmune-runtime 3.7.25 → 3.7.26

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [3.7.26] — 2026-09-13
+
+### 精度修复批次（AI 生成项目验证 V2 + 真实修复回归驱动的引擎改动）
+
+- **FastAPI 认证词表补现代认证形态**（`tools/extract_framework_py.py`）：`current_org`/`current_caller`/`caller_context`（skyvern 146 条误报的根因词族）+ `verified_user`/`admin_user`（open-webui 142 条误报的根因词族）——每个新真实语料都暴露一批框架层词汇缺口；fastapi-realworld 0 FP 保持 + 摘保护反证精确触发
+- **词段匹配边界收紧**（`ssg-bridge.ts` Strategy 2）：规则词必须按序出现且首词@词位 0、末词@末位（此前仅要求全部出现即命中）——skyvern 35 条 SSG 误报消灭 16 条、nginx 3 FP→0；**Python 盲测 64/64 零漂移、TS 795 零漂移（3086 flags LOST 0 / ADDED 0）、C 金标 F1=95.7% 不变、Go 盲测 P=R=100%**
+- **一次性文件 API 原子化**（`protocols.json`）：`read_text`/`write_text`/`read_bytes`/`write_bytes`/`pathlib.*` 入 `read_file_atomic`/`write_file_atomic` 别名——Path.read_text 族内部完成 open→close，不再报裸读
+- **类方法提取修复**（`extract-ir.ts`）：类方法循环此前误置于变量声明循环内——无顶层变量声明的文件（openhop store.ts 复现）方法整体漏提取，有变量声明的文件重复 push；移至文件层 + `cls.isExported()`
+- **路径穿越检测 TS 化（A1，修复回归 fr-007 驱动）**：TS 提取器注入 `__progmune_path_traversal__`（request 污点→fs sink 单跳 + 跨函数一跳——调用点污点实参流入项目方法体内的文件 sink）；**引擎 IR 层直接消费标记**（call-sequence 构建过滤 `__progmune_` 前缀，标记到不了 specific-check——Python 标记此前在引擎管线中是死的，本版同时点亮两侧）；规则 `languages` 补 typescript/javascript；domain-validator 补 `PATH_TRAVERSAL` 检查
+
+### 真实安全修复回归 V1（决定性实验，回答「能力 vs 语料」）
+
+- **语料**：8 条真实修复（open-webui 6 Python / openhop 1 TS / SimpleWebAuthn 1 TS，全部 GHSA/CVE + 修复 commit + 真值文件清单），注册表 `blind-benchmark/fix-regression-corpus.json`
+- **基线 0/8 检出**——漏报根因七类逐条记录（查询语义 / 策略逻辑分支 / 凭据数据流 / 归属数据流 / 配置通道路由 / 语言面缺口 / 密码学协议语义），见 `blind-benchmark/REALWORLD_FIX_REGRESSION_V1.md`
+- **A1 后 fr-007（openhop Flow ID 路径穿越）转 DETECTED**：PATH_TRAVERSAL ×4 命中真值位置（routes.ts flowRoutes + store.ts FlowStore.save/get/delete）；fr-001~006/008 待对应能力扩展
+- **AI 生成项目验证 V2**（`blind-benchmark/REALWORLD_AI_GENERATED_V2.md`）：Skyvern ⭐22,971 生产管线扫描 181 条违规逐条人工标注全 FP——框架层认证词汇缺口 144 条 + 词段误报 35 条（其中 16 条把代码里的路径穿越防御/符号链接校验误报为协议违规）；修复后 181→22（剩余 19 条夹心形态词法不可区分 + 2 条 HMAC webhook + 1 条精确名碰撞，见报告 §3.2 与 §5）
+
+### 回归
+
+- 发布门：build ✓ / check 免疫正常 ✓ / Python 盲测 64 零漂移 ✓ / TS 795 零漂移 ✓ / C 金标 F1=95.7% ✓ / Go 盲测 P=R=100% ✓ / 定向 184 tests green（本地全量套件重负载 worker 崩溃为既有环境问题，以 CI 为准）
+
 ## [3.7.25] — 2026-09-10
 
 ### 失败语料上报链路修复（中央 hub 恢复数据流）

package/dist/extract-ir.js

@@ -369,6 +369,235 @@ function extractDirectCalls(func) {
     }
     return [...new Set(calls)];
 }
+// ═══════════════════════════════════════════════════════════════
+// Path traversal marker（2026-09-11，REALWORLD_FIX_REGRESSION_V1 fr-007）
+// 镜像 tools/extract_ir.py 的 request 污点 → 文件 sink 单跳追踪，另补
+// 跨函数一跳：调用点把污点实参传给项目方法，该方法体内对应参数流入
+// 文件 sink → 在调用方函数注入 __progmune_path_traversal__。
+// 消费方：protocol-domain-validator 的 PATH_TRAVERSAL 检查（引擎路径）
+// 与 protocol-detector 的同名规则（source-level benchmark 路径）。
+// ═══════════════════════════════════════════════════════════════
+const PATH_TRAVERSAL_MARKER = "__progmune_path_traversal__";
+const TS_FILE_SINK_NAMES = [
+    "readFile", "readFileSync", "writeFile", "writeFileSync",
+    "appendFile", "appendFileSync", "unlink", "unlinkSync", "rm", "rmSync",
+    "mkdir", "mkdirSync", "open", "openSync", "createReadStream",
+    "createWriteStream", "existsSync", "readdir", "readdirSync",
+    "copyFile", "rename", "stat", "lstat", "rmdir", "truncate",
+];
+function tsSinkCallRegex() {
+    return new RegExp(`(?:^|[^\\w.$])(?:await\\s+)?(?:[\\w$]+\\.)?(${TS_FILE_SINK_NAMES.join("|")})\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+}
+/** request 根表达式：req.params / request.body / req.query['x'] … */
+function hasRequestRootedExpr(text) {
+    return /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.test(text);
+}
+/** 函数体内被 request 污染的局部名（含解构与单跳赋值，深度 ≤2） */
+function collectTaintedNames(text) {
+    const tainted = new Set();
+    let m;
+    const direct = /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    while ((m = direct.exec(text)) !== null)
+        tainted.add(m[1]);
+    const destr = /(?:const|let|var)\s*\{\s*([^}=]*?)\s*\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g;
+    while ((m = destr.exec(text)) !== null) {
+        for (const part of m[1].split(",")) {
+            const name = part.trim().split(":")[0].trim();
+            if (/^[\w$]+$/.test(name))
+                tainted.add(name);
+        }
+    }
+    const bareAssign = /(?:^|[^\w$.])([\w$]+)\s*=\s*(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    while ((m = bareAssign.exec(text)) !== null)
+        tainted.add(m[1]);
+    // 单跳传播（深度 ≤2）
+    for (let depth = 0; depth < 2; depth++) {
+        if (tainted.size === 0)
+            break;
+        const names = [...tainted].join("|");
+        const hop = new RegExp(`(?:const|let|var)\\s+([\\w$]+)\\s*=\\s*\\b(?:${names})\\b`, "g");
+        let added = false;
+        while ((m = hop.exec(text)) !== null) {
+            if (!tainted.has(m[1])) {
+                tainted.add(m[1]);
+                added = true;
+            }
+        }
+        if (!added)
+            break;
+    }
+    return tainted;
+}
+function taintPattern(tainted) {
+    const parts = [
+        /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source,
+    ];
+    if (tainted.size > 0) {
+        parts.push(`\\b(?:${[...tainted].join("|")})\\b`);
+    }
+    return new RegExp(parts.join("|"));
+}
+/** 本函数体内：文件 sink 的实参窗口含 request 污点 → true */
+function hasTaintedSinkCall(text, tainted) {
+    const taint = taintPattern(tainted);
+    if (!taint)
+        return false;
+    const sinkRe = tsSinkCallRegex();
+    let m;
+    while ((m = sinkRe.exec(text)) !== null) {
+        if (taint.test(m[2] || ""))
+            return true;
+    }
+    return false;
+}
+/** 深度 0 逗号切分实参窗口（截断窗口内近似；首个参数位置常用于路径） */
+function splitArgWindow(win) {
+    const args = [];
+    let depth = 0;
+    let cur = "";
+    for (const ch of win) {
+        if (ch === "(" || ch === "[" || ch === "{")
+            depth++;
+        else if (ch === ")" || ch === "]" || ch === "}")
+            depth--;
+        else if (ch === "," && depth === 0) {
+            args.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        args.push(cur);
+    return args;
+}
+/** 项目方法名 → 方法体内流入文件 sink 的形参下标集合 */
+function methodSinkParamMap(project, absRoot) {
+    const map = new Map();
+    for (const sf of project.getSourceFiles()) {
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        for (const cls of sf.getClasses()) {
+            const cn = cls.getName();
+            if (!cn)
+                continue;
+            for (const m of cls.getMethods()) {
+                const params = m.getParameters().map((p) => p.getName());
+                if (params.length === 0)
+                    continue;
+                const text = m.getText();
+                const sinkRe = tsSinkCallRegex();
+                let sm;
+                while ((sm = sinkRe.exec(text)) !== null) {
+                    const win = sm[2] || "";
+                    params.forEach((pname, idx) => {
+                        if (new RegExp(`\\b${pname}\\b`).test(win)) {
+                            if (!map.has(m.getName())) {
+                                map.set(m.getName(), { idxs: new Set(), entries: [] });
+                            }
+                            const rec = map.get(m.getName());
+                            rec.idxs.add(idx);
+                            const fullName = `${cn}.${m.getName()}`;
+                            if (!rec.entries.some((e) => e.name === fullName)) {
+                                rec.entries.push({ name: fullName, file: relPath });
+                            }
+                        }
+                    });
+                }
+            }
+        }
+    }
+    return map;
+}
+/**
+ * 注入路径穿越标记：
+ *  1) 本函数体内 sink 实参直接污点；
+ *  2) 跨函数一跳——调用项目方法且污点实参落在该方法的 sink 形参位置。
+ * 标记只进 funcs 中该函数的 calls（方法条目不单独标——违规归因到入口）。
+ */
+function augmentPathTraversalMarkers(project, funcs, absRoot) {
+    const sinkParams = methodSinkParamMap(project, absRoot);
+    const methodCallRe = new RegExp(`\\.([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+    const mark = (name, file) => {
+        const entry = funcs.find((x) => x.name === name && x.file === file);
+        if (!entry)
+            return;
+        entry.calls = entry.calls || [];
+        if (!entry.calls.includes(PATH_TRAVERSAL_MARKER)) {
+            entry.calls.push(PATH_TRAVERSAL_MARKER);
+        }
+    };
+    // 对每个函数式节点（函数声明/方法/箭头回调——fastify 路由回调是内联
+    // 箭头函数，不在 funcs 中）独立做污点分析。节点文本预过滤：
+    // 不含 request 访问也不含 sink 方法调用则跳过。
+    const sinkMethodNames = [...sinkParams.keys()];
+    const prefilter = new RegExp(`\\b(?:req|request)\\.(?:params|query|body|headers|cookies)\\b|` +
+        (sinkMethodNames.length > 0 ? `\\.(?:${sinkMethodNames.join("|")})\\s*\\(` : "a^"));
+    for (const sf of project.getSourceFiles()) {
+        if (sf.getFilePath().includes("node_modules"))
+            continue;
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        sf.forEachDescendant((node) => {
+            if (!ts_morph_1.Node.isFunctionDeclaration(node) &&
+                !ts_morph_1.Node.isArrowFunction(node) &&
+                !ts_morph_1.Node.isMethodDeclaration(node)) {
+                return;
+            }
+            const text = node.getText();
+            if (!prefilter.test(text))
+                return;
+            const tainted = collectTaintedNames(text);
+            if (tainted.size === 0)
+                return;
+            const taint = taintPattern(tainted);
+            if (!taint)
+                return;
+            // 1) 节点体内 sink 实参直接污点 → 标记该节点归属的 funcs 条目
+            if (hasTaintedSinkCall(text, tainted)) {
+                const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+                if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                    mark(nodeName, relPath);
+                }
+                else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                    const cls = node.getParent();
+                    if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                        mark(`${cls.getName()}.${nodeName}`, relPath);
+                    }
+                }
+                return;
+            }
+            // 2) 跨函数一跳：污点实参传入项目方法体的文件 sink。
+            //    标记调用方（若可归属）+ 被调方法条目——路由回调不可归属时，
+            //    方法条目是唯一可归因位置（openhop 形态）。
+            methodCallRe.lastIndex = 0;
+            let m;
+            while ((m = methodCallRe.exec(text)) !== null) {
+                const callee = m[1];
+                const rec = sinkParams.get(callee);
+                if (!rec || rec.idxs.size === 0)
+                    continue;
+                const win = m[2] || "";
+                const args = splitArgWindow(win);
+                const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
+                if (!hit)
+                    continue;
+                const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+                if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                    mark(nodeName, relPath);
+                }
+                else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                    const cls = node.getParent();
+                    if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                        mark(`${cls.getName()}.${nodeName}`, relPath);
+                    }
+                }
+                for (const me of rec.entries) {
+                    mark(me.name, me.file);
+                }
+                return;
+            }
+        });
+    }
+}
 /**
  * 从 TypeScript 项目提取 IR（函数签名、参数、返回值、协议注解）。
  * @protocol namespace=dev_pipeline pre_states=[] post_states=["IR_EXTRACTED"] invalidate=["IR_STALE"]
@@ -519,30 +748,43 @@ function _extractSingleProject(absRoot, tsconfigPath) {
                     }
                 }
             }
-            // Extract class methods: ts-morph getFunctions() excludes class members
-            for (const cls of sf.getClasses()) {
-                const cn = cls.getName();
-                if (!cn)
+        }
+        // Extract class methods: ts-morph getFunctions() excludes class members
+        // （2026-09-12 修复：此循环此前误置于 VariableDeclaration 循环内——
+        //   无顶层变量声明的文件（如 openhop store.ts）方法整体漏提取，
+        //   且有变量声明的文件会重复 push。移至 sf 层 + 去重语义。）
+        for (const cls of sf.getClasses()) {
+            const cn = cls.getName();
+            if (!cn)
+                continue;
+            for (const m of cls.getMethods()) {
+                const mn = m.getName();
+                if (!mn)
                     continue;
-                for (const m of cls.getMethods()) {
-                    const mn = m.getName();
-                    if (!mn)
-                        continue;
-                    funcs.push({
-                        name: `${cn}.${mn}`,
-                        params: m.getParameters().map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),
-                        returnType: m.getReturnTypeNode?.()?.getText?.() || "any",
-                        returnTypeDetail: m.getReturnTypeNode?.()?.getText?.() || "any",
-                        file: relPath,
-                        exported: vd.isExported(), calls: [],
-                        ...parseCapabilityFromJSDoc(m),
-                        protocol: parseProtocolFromJSDoc(m),
-                    });
-                }
+                funcs.push({
+                    name: `${cn}.${mn}`,
+                    params: m.getParameters().map((p) => ({ name: p.getName(), type: getParamType(p), typeDetail: getParamTypeDetail(p) })),
+                    returnType: m.getReturnTypeNode?.()?.getText?.() || "any",
+                    returnTypeDetail: m.getReturnTypeNode?.()?.getText?.() || "any",
+                    file: relPath,
+                    exported: cls.isExported(),
+                    calls: [],
+                    ...parseCapabilityFromJSDoc(m),
+                    protocol: parseProtocolFromJSDoc(m),
+                });
             }
         }
     }
     // ═══════════════════════════════════════════════════════════════
+    // Phase 4.5: Path traversal marker（2026-09-11，fr-007 openhop）
+    // 镜像 Python 提取器的 request 污点 → 文件 sink 单跳追踪，并补
+    // 跨函数一跳：调用点把污点参数传给项目方法，该方法体内该参数
+    // 流入文件 sink → 调用方函数注入 __progmune_path_traversal__。
+    // 消费方：protocol-domain-validator PATH_TRAVERSAL 检查（引擎）
+    // 与 protocol-detector 同名规则（source-level benchmark 路径）。
+    // ═══════════════════════════════════════════════════════════════
+    augmentPathTraversalMarkers(project, funcs, absRoot);
+    // ═══════════════════════════════════════════════════════════════
     // Phase 5: Dynamic external function resolution
     // Replaces hardcoded knownExternals
     //   includes: npm packages (.d.ts via ts.resolveModuleName), Node.js built-ins (@types/node)

package/dist/protocol-detector.js

@@ -673,9 +673,12 @@ const SAFEGUARD_RULES = [
     {
         name: "Path Traversal (User-Controlled File Path)",
         category: "path_traversal",
-        languages: ["python"],
-        // Source-level detection: the Python extractor emits a synthetic marker
-        // call when a file sink (open / io.open / os.open / Path(...).read_text)
+        // 2026-09-11（fr-007）：TS 提取器（extract-ir.ts）自 2026-09-11 起同样
+        // 注入该标记（request 污点 → 文件 sink，含跨函数一跳）——语言面扩展。
+        languages: ["typescript", "javascript", "python"],
+        // Source-level detection: the language extractors emit a synthetic marker
+        // call when a file sink (open / io.open / os.open / Path(...).read_text;
+        // TS: readFile/writeFile/unlink/rm/mkdir/createReadStream 等 fs 族)
         // receives a path tainted by request-derived user input (directly or via
         // single-hop assignment — os.path.join chains resolve through assignment
         // tracking). No satisfier possible — the marker IS the violation evidence.

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.25";
+exports.RUNTIME_VERSION = "3.7.26";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -1261,6 +1261,27 @@ async function collectProtocolViolations(ctx, callGraph) {
                         const n = String(f.name);
                         nameCounts.set(n, (nameCounts.get(n) || 0) + 1);
                     }
+                    // 2026-09-12（REALWORLD_FIX_REGRESSION_V1 fr-007）：路径穿越标记
+                    // 在 IR 层直接消费——call-sequence 构建会过滤 __progmune_ 前缀
+                    // （P4.5 历史），标记到不了 checkSpecificViolations；此前的 Python
+                    // 标记因此在引擎管线中一直是死的。此处同时点亮 Python 与 TS 两侧。
+                    for (const f of functions) {
+                        const calls = f.calls || [];
+                        if (calls.includes("__progmune_path_traversal__")) {
+                            violations.push({
+                                severity: "medium",
+                                rule_id: "PATH_TRAVERSAL",
+                                file: f.file,
+                                function: f.name || "unknown",
+                                message: "File operation receives a request-controlled path without visible validation — path traversal / arbitrary file access.",
+                                evidence: "__progmune_path_traversal__",
+                                why: "Extractor-verified taint flow: request-derived input reaches a file sink " +
+                                    "(directly or via one-hop project method).",
+                                fix: "Validate/sanitize the path (allowlist, basename normalization) before file operations.",
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
+                    }
                     for (const f of functions) {
                         if (!f.protocol)
                             continue;

package/dist/trust/protocol-domain-validator.js

@@ -641,6 +641,24 @@ exports.SPECIFIC_VIOLATION_CHECKS = [
     // ═══════════════════════════════════════════════════════
     // QUIC-001: Active migration disabled
     // ═══════════════════════════════════════════════════════
+    // 2026-09-11（REALWORLD_FIX_REGRESSION_V1 fr-007）：路径穿越引擎化。
+    // 标记由语言提取器注入（Python: tools/extract_ir.py 请求污点→文件
+    // sink 单跳追踪；TypeScript: src/extract-ir.ts 同款 + 跨函数一跳——
+    // 调用点污点参数流入项目方法体内的文件 sink）。此前 Python 标记在
+    // 引擎管线中无消费方（source-level 规则只活在 benchmark harness），
+    // 本检查同时点亮 Python 与 TS 两侧。
+    // ═══════════════════════════════════════════════════════
+    {
+        ruleId: "PATH_TRAVERSAL",
+        description: "A file operation receives a path derived from request-controlled input " +
+            "without visible validation — path traversal / arbitrary file access.",
+        languages: ["typescript", "javascript", "python"],
+        check: (steps) => {
+            return steps.some((s) => s.api === "__progmune_path_traversal__" ||
+                s.api.startsWith("__progmune_path_traversal"));
+        },
+    },
+    // ═══════════════════════════════════════════════════════
     {
         ruleId: "QUIC_DISABLE_ACTIVE_MIGRATION",
         description: "QUIC connection migration is disabled. This may impact privacy " +

package/dist/trust/ssg-bridge.js

@@ -287,14 +287,42 @@ function inferRuleName(apiName, domain, description, ruleNames, namespace, alias
         if (projectFunctions && isDotted)
             continue; // 带点调用只走限定精确匹配（+别名/域提示）
         const ruleWords = ruleName.split("_");
-        const callWords = normalized.split("_");
         // Rule must have at least 2 words for this strategy (single-word rules
         // are too prone to false positives via substring)
         if (ruleWords.length < 2)
             continue;
-        // Every rule word must appear as a complete call word segment
-        const allWordsMatch = ruleWords.every((rw) => callWords.includes(rw));
-        if (allWordsMatch) {
+        // 2026-09-11（REALWORLD_AI_GENERATED_V2 / skyvern）：词段匹配加
+        // 「首词@首位 + 末词@末位」边界收紧。此前仅要求规则词全部出现——
+        // validate_local_file_path / _validate_file_stat / _session_create_data /
+        // _revoke_refresh_token_at_google / ngx_read_file 等真实语料 FP 均破坏
+        // 该边界；Python 盲测 S5 改名形态（verify_user_password /
+        // create_active_session / open_user_file）全部满足边界，TP 不受影响。
+        let callWords = normalized.split("_").filter((w) => w !== "");
+        if (callWords.length === 0)
+            callWords = normalized.split("_");
+        // Rule words must appear in order — first rule word at word index 0,
+        // last rule word at the final word index — not just anywhere in the set
+        let pos = 0;
+        const positions = [];
+        let ordered = true;
+        for (const rw of ruleWords) {
+            let found = -1;
+            for (let i = pos; i < callWords.length; i++) {
+                if (callWords[i] === rw) {
+                    found = i;
+                    break;
+                }
+            }
+            if (found === -1) {
+                ordered = false;
+                break;
+            }
+            positions.push(found);
+            pos = found + 1;
+        }
+        if (ordered &&
+            positions[0] === 0 &&
+            positions[positions.length - 1] === callWords.length - 1) {
             return ruleName;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.25",
+  "version": "3.7.26",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/protocols.json

@@ -2169,7 +2169,11 @@
         "fs.readFileSync",
         "fs.readFile",
         "fs.promises.readFile",
-        "fs.promises.readFileSync"
+        "fs.promises.readFileSync",
+        "read_text",
+        "read_bytes",
+        "pathlib.read_text",
+        "pathlib.read_bytes"
       ],
       "status": "confirmed"
     },
@@ -2182,9 +2186,13 @@
         "fs.writeFileSync",
         "fs.writeFile",
         "fs.promises.writeFile",
-        "fs.promises.writeFileSync"
+        "fs.promises.writeFileSync",
+        "write_text",
+        "write_bytes",
+        "pathlib.write_text",
+        "pathlib.write_bytes"
       ],
       "status": "confirmed"
     }
   }
-}
+}

package/tools/extract_framework_py.py

@@ -34,9 +34,20 @@ import sys
 # 依赖名含 user 会被误标认证（REALWORLD_STRUCTURAL_V2 假保护 FN）。
 # 真认证依赖用 current_user/authorizer 等强词识别（get_current_user
 # 含 current_user ✓）。
+# 2026-09-11（REALWORLD_AI_GENERATED_V2 / skyvern）：补 org-token 认证模型
+# 词族——get_current_org / get_current_caller_context 是 23k★ 生产 SaaS
+# 的主力认证依赖名，词表不认识 → 146 条 FASTAPI_ROUTE_NO_AUTH 误报。
+# current_org/current_caller/caller_context 与 current_user 同强度
+# （get_current_organization 误标风险与 get_current_user 同族，已接受）。
 AUTH_WORDS = (
     "auth", "login", "token", "credential", "session",
     "bearer", "permission", "current_user", "api_key", "oauth", "jwt",
+    "current_org", "current_caller", "caller_context",
+    # open-webui 真实语料（修复回归 fr-001 扫描，2026-09-11）：get_verified_user /
+    # get_admin_user 是其全路由主力认证依赖（session/JWT 校验），词表不认识 →
+    # 142 条 FASTAPI_ROUTE_NO_AUTH 误报。复合词窄口：verified_user/admin_user
+    # 是强认证词（区别于裸 "user" 的 DB 查询误标风险）。
+    "verified_user", "admin_user",
 )
 
 SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",