progmune-runtime 3.7.27 → 3.7.29

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [3.7.29] — 2026-09-14
+
+### 失败语料沉淀接通（知识网络入口修复）
+
+- **断点**：信任引擎（trust CLI/agent/patrol/MCP）检出的违规从不写入失败语料库——此前只有 agent-loop 的 planner 失败会入 `.progmune_corpus`，引擎找到的真东西不进库，知识网络永远不喂新数据
+- **修复**（`src/trust/engine.ts` `writeTrustFailuresToCorpus`）：每次 evaluateTrust 的违规（cap 50/扫描）经 `recordFailure` 沉淀——intent=`trust-scan:<project>`、severity→SVL 阶梯映射（critical→SVL-4…low→SVL-1）、项目函数名快照（cap 300，语料挖掘词段门控输入）
+- **去重**：同日同（项目+规则+函数）sidecar 去重——反复扫描不重复沉淀
+- **噪声排除**：`PROTOCOL_CROSS_DOMAIN`/`PLAINTEXT_AUTH_WITHOUT_TLS`（已知高 FP、LLM 域映射抖动的 specific-check）不入语料；真实检出面（PATH_TRAVERSAL/SSRF/AUTHZ_CROSS_USER_WRITE/框架层/SSG）照常沉淀
+- **测试隔离**：VITEST/NODE_ENV=test 跳过——单测不污染语料
+- **首批入库验证**：本周 10 条真实检出全部入库存（openhop PATH_TRAVERSAL×4 + FASTIFY×1、open-webui SSRF×3 + AUTHZ_CROSS_USER_WRITE×1、mcp-from-openapi SSRF×1）——其中 open-webui 3 条 SSRF 命中的正是 fr-009 修复补丁加固的 web 加载器函数族，交叉验证 A3 扩展
+- 语料经 immune-reporter 既有管线脱敏上传 hub（默认脱敏口径不变）
+
+### 回归
+
+- build ✓ / 引擎测试 21 green ✓ / 语料写入全部 best-effort（永不打断扫描）
+
+## [3.7.28] — 2026-09-14
+
+### SSRF 检测 TS 化 + Python 形参污点扩展（A3，修复回归 fr-009/010/011 驱动）
+
+- **TS 提取器 SSRF 标记**（`extract-ir.ts`）：URL 形参/request 污点 → HTTP fetch sink（fetch/axios.*/http.request/ky.*/undici.request/nodeFetch/got），函数内无 SSRF 守卫词汇（private-IP/loopback/denylist/hostname 校验）→ `__progmune_ssrf_user_url__`
+- **Python 形参污点扩展**（`extract_ir.py`）：URL 形参（url/target/endpoint/spec_url…）作为污点源（库形态，如 from_url(url)）；守卫抑制词汇（validate_url/safe_http/is_blocked_hostname 等；**不含裸 "ssrf"**——PyGoat 实验模板名 ssrf_lab2.html 会被误抑制）；**is_request_rooted 收紧**：裸名 "request" 仅当它是函数形参才算请求根——此前局部变量命名为 request 会被误判（skyvern _fetch_discovery FP 根因）
+- **引擎 IR 层消费**：SSRF 违规直接报出（同 PATH_TRAVERSAL/AUTHZ_CROSS_USER_WRITE 模式）——Python 侧 SSRF 标记此前在引擎管线中是死的，本版点亮
+- **修复回归战绩 4/11**：fr-011（mcp-from-openapi TS，引擎级：修复前 SSRF ×1 @ fromURL 真值位置/修复后 0）✅、fr-010（unstructured Python，提取器级：修复前 2 标记命中 partition_md/file_and_type_from_url/修复后 0；整仓 tarball 网络截断，mini 语料验证如实记录）✅、PyGoat ssrf_lab2 引擎级 TP 恢复 ✅；fr-009（open-webui DNS 重绑定）为「守卫存在但不足」类，标记模型边界如实不覆盖
+- **skyvern 精化**：_fetch_discovery FP 消除；_download_screenshot 为弱 TP（scheme 校验≠SSRF 防护，如实标注）
+
+### 回归
+
+- TS 795 零漂移（3086 LOST 0/ADDED 0）✓ / Python 盲测 64/64 ✓ / Python 源级金标 SSRF 0 命中 ✓ / open-seo 10 无漂移 ✓ / 引擎测试 73 green ✓ / build ✓ / check 免疫正常 ✓
+
 ## [3.7.27] — 2026-09-13
 
 ### 归属校验 Python 化（A2，修复回归 fr-005 驱动）

package/dist/extract-ir.js

@@ -598,6 +598,96 @@ function augmentPathTraversalMarkers(project, funcs, absRoot) {
         });
     }
 }
+// ═══════════════════════════════════════════════════════════════
+// SSRF marker（2026-09-14，REALWORLD_FIX_REGRESSION fr-011/fr-010）
+// URL 形参/request 污点 → HTTP fetch sink，函数内无 SSRF 守卫证据
+// （private-IP/loopback/denylist/hostname 校验词汇）→ 注入
+// __progmune_ssrf_user_url__。库形态（mcp-from-openapi fromURL）与
+// Web 形态（req.params）共用同一标记；引擎 IR 层消费。
+// ═══════════════════════════════════════════════════════════════
+const TS_HTTP_FETCH_SINK = /\b(fetch|axios\.(?:get|post|put|delete|head|patch)|http\.request|https\.request|ky\.(?:get|post|put|delete|head|patch)|undici\.request|nodeFetch|got)\s*\(/;
+const SSRF_GUARD_EVIDENCE = /127\.0\.0\.1|0\.0\.0\.0|169\.254\.|::1|localhost|isPrivate|isLoopback|hostname|denylist|blocklist|ssrf|validateUrl|isSafeUrl|getAddresses|ipaddress|forbidden_host|private_ip/i;
+const URL_PARAM_NAME = /^(url|target|endpoint|link|href|webUrl|web_url|sourceUrl|source_url|remoteUrl|remote_url|fetchUrl|fetch_url|specUrl|spec_url|apiUrl|api_url|origin|baseUrl|base_url)$/i;
+function collectUrlParamNames(params) {
+    return params.map((p) => p.name).filter((n) => URL_PARAM_NAME.test(n));
+}
+function augmentSsfrMarkers(project, funcs, absRoot) {
+    const sinkRe = TS_HTTP_FETCH_SINK;
+    for (const sf of project.getSourceFiles()) {
+        if (sf.getFilePath().includes("node_modules"))
+            continue;
+        const relPath = path.relative(absRoot, sf.getFilePath());
+        sf.forEachDescendant((node) => {
+            if (!ts_morph_1.Node.isFunctionDeclaration(node) &&
+                !ts_morph_1.Node.isArrowFunction(node) &&
+                !ts_morph_1.Node.isMethodDeclaration(node)) {
+                return;
+            }
+            const text = node.getText();
+            if (text.length > 12000)
+                return; // 巨型函数跳过（性能 + 噪声）
+            // 预过滤：必须有 fetch sink
+            sinkRe.lastIndex = 0;
+            if (!sinkRe.test(text))
+                return;
+            // 守卫证据：函数内有 SSRF 防护词汇 → 抑制
+            if (SSRF_GUARD_EVIDENCE.test(text))
+                return;
+            // URL 形参污点
+            const urlParams = ts_morph_1.Node.isArrowFunction(node)
+                ? []
+                : collectUrlParamNames(node.getParameters().map((p) => ({ name: p.getName() })));
+            // request 污点（Web 形态）
+            const reqTainted = collectTaintedNames(text);
+            const taintParts = [];
+            if (urlParams.length > 0)
+                taintParts.push(`\\b(?:${urlParams.join("|")})\\b`);
+            if (reqTainted.size > 0)
+                taintParts.push(`\\b(?:${[...reqTainted].join("|")})\\b`);
+            taintParts.push(/\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source);
+            const taint = new RegExp(taintParts.join("|"));
+            if (taintParts.length <= 1) {
+                // 只有 request 根模式而无实际污点名——仍需检查 sink 实参
+            }
+            // sink 实参窗口含污点 → 标记
+            let flagged = false;
+            sinkRe.lastIndex = 0;
+            let m;
+            while ((m = sinkRe.exec(text)) !== null) {
+                // 取调用后 300 字符窗口（URL 是首个实参）
+                const after = text.slice(m.index + m[0].length, m.index + m[0].length + 300);
+                if (taint.test(after)) {
+                    flagged = true;
+                    break;
+                }
+            }
+            if (!flagged)
+                return;
+            const nodeName = ts_morph_1.Node.isArrowFunction(node) ? undefined : node.getName();
+            if (ts_morph_1.Node.isFunctionDeclaration(node) && nodeName) {
+                const entry = funcs.find((x) => x.name === nodeName && x.file === relPath);
+                if (entry) {
+                    entry.calls = entry.calls || [];
+                    if (!entry.calls.includes("__progmune_ssrf_user_url__")) {
+                        entry.calls.push("__progmune_ssrf_user_url__");
+                    }
+                }
+            }
+            else if (ts_morph_1.Node.isMethodDeclaration(node) && nodeName) {
+                const cls = node.getParent();
+                if (ts_morph_1.Node.isClassDeclaration(cls) && cls.getName()) {
+                    const entry = funcs.find((x) => x.name === `${cls.getName()}.${nodeName}` && x.file === relPath);
+                    if (entry) {
+                        entry.calls = entry.calls || [];
+                        if (!entry.calls.includes("__progmune_ssrf_user_url__")) {
+                            entry.calls.push("__progmune_ssrf_user_url__");
+                        }
+                    }
+                }
+            }
+        });
+    }
+}
 /**
  * 从 TypeScript 项目提取 IR（函数签名、参数、返回值、协议注解）。
  * @protocol namespace=dev_pipeline pre_states=[] post_states=["IR_EXTRACTED"] invalidate=["IR_STALE"]
@@ -784,6 +874,7 @@ function _extractSingleProject(absRoot, tsconfigPath) {
     // 与 protocol-detector 同名规则（source-level benchmark 路径）。
     // ═══════════════════════════════════════════════════════════════
     augmentPathTraversalMarkers(project, funcs, absRoot);
+    augmentSsfrMarkers(project, funcs, absRoot);
     // ═══════════════════════════════════════════════════════════════
     // Phase 5: Dynamic external function resolution
     // Replaces hardcoded knownExternals

package/dist/protocol-detector.js

@@ -658,12 +658,17 @@ const SAFEGUARD_RULES = [
     {
         name: "SSRF (User-Controlled URL Fetch)",
         category: "ssrf",
-        languages: ["python"],
-        // Source-level detection: the Python extractor emits a synthetic marker
-        // call when an HTTP fetch (requests.*/urllib.*/httpx.*/aiohttp.*/urlopen)
-        // receives a URL tainted by request-derived user input (directly or via
-        // single-hop assignment). No satisfier possible — the marker IS the
-        // violation evidence.
+        // 2026-09-14（A3 fr-011/fr-010）：TS 提取器（extract-ir.ts）自 2026-09-14
+        // 起同样注入该标记（URL 形参/request 污点 → HTTP fetch sink，无 SSRF
+        // 守卫），Python 侧同版扩展形参污点——语言面扩展。
+        languages: ["typescript", "javascript", "python"],
+        // Source-level detection: the language extractors emit a synthetic marker
+        // call when an HTTP fetch (requests.*/urllib.*/httpx.*/aiohttp.*/urlopen;
+        // TS: fetch/axios.*/http.request/ky.*/got/undici.request) receives a URL
+        // tainted by request-derived user input or a URL-shaped function parameter
+        // (directly or via single-hop assignment) with no SSRF guard in the
+        // function (private-IP/loopback/denylist/hostname validation evidence).
+        // No satisfier possible — the marker IS the violation evidence.
         trigger: /\b(__progmune_ssrf_user_url__)\b/,
         safeguards: [],
         violationMessage: "HTTP fetch whose URL derives from user-controlled request input — server-side request forgery.",

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.27";
+exports.RUNTIME_VERSION = "3.7.29";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -140,6 +140,11 @@ async function evaluateTrust(ctx) {
         ...fiberResult.violations,
     ];
     // ═══════════════════════════════════════
+    // ── 失败语料沉淀（2026-09-14）：信任引擎检出的违规写入本地语料库 ——
+    //    知识网络的入口。此前只有 agent-loop 的 planner 失败会入语料，
+    //    trust 扫描（CLI/agent/patrol/MCP）检出的真违规不沉淀。
+    //    测试环境跳过；同日同（项目+规则+函数）去重；语料写入永不打断扫描。
+    writeTrustFailuresToCorpus(ctx, allViolations);
     //  PHASE 3: SCORE
     // ═══════════════════════════════════════
     const policyResult = (0, score_calculator_1.scorePolicyCompliance)(allViolations);
@@ -1282,6 +1287,20 @@ async function collectProtocolViolations(ctx, callGraph) {
                                 policy_ref: "protocol-safety.specific",
                             });
                         }
+                        if (calls.includes("__progmune_ssrf_user_url__")) {
+                            violations.push({
+                                severity: "medium",
+                                rule_id: "SSRF",
+                                file: f.file,
+                                function: f.name || "unknown",
+                                message: "HTTP fetch whose URL derives from user-controlled input or a URL-shaped function parameter with no SSRF guard — server-side request forgery.",
+                                evidence: "__progmune_ssrf_user_url__",
+                                why: "Extractor-verified: fetch sink receives request-tainted or URL-parameter input " +
+                                    "with no private-IP/loopback/denylist/hostname validation evidence in the function.",
+                                fix: "Validate the URL (scheme allowlist, private-IP/loopback block, DNS pinning) before fetching.",
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
                         if (calls.includes("__progmune_cross_user_write__")) {
                             violations.push({
                                 severity: "medium",
@@ -1800,6 +1819,97 @@ function mapRiskSeverity(severity) {
         default: return "low";
     }
 }
+// ═══════════════════════════════════════════════════════════════
+// 失败语料沉淀（2026-09-14）：信任引擎违规 → .progmune_corpus
+// ═══════════════════════════════════════════════════════════════
+const SEVERITY_TO_SVL = {
+    critical: "SVL-4",
+    high: "SVL-3",
+    medium: "SVL-2",
+    low: "SVL-1",
+};
+/** 与 failure-corpus.ts 相同的语料目录解析（模块加载时定死 cwd 的语义） */
+function trustCorpusDir() {
+    if (process.env.PROGMUNE_CORPUS_DIR)
+        return process.env.PROGMUNE_CORPUS_DIR;
+    const projectDir = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
+    return path.join(projectDir, ".progmune_corpus");
+}
+/**
+ * 把本次扫描检出的违规写入失败语料库（知识网络的入口）。
+ * - 测试环境（VITEST/NODE_ENV=test）跳过——单测不得污染语料
+ * - 同日同（项目+规则+函数）去重——反复扫描不重复沉淀
+ * - 全部 best-effort：语料写入失败绝不打断扫描主流程
+ */
+function writeTrustFailuresToCorpus(ctx, violations) {
+    if (process.env.VITEST === "true" || process.env.NODE_ENV === "test")
+        return;
+    if (violations.length === 0)
+        return;
+    try {
+        const { recordFailure } = require("../failure-corpus");
+        const fs = require("fs");
+        const corpusDir = trustCorpusDir();
+        const date = new Date().toISOString().slice(0, 10);
+        const dedupFile = path.join(corpusDir, `.trust-dedup-${date}.json`);
+        let seen = {};
+        try {
+            seen = JSON.parse(fs.readFileSync(dedupFile, "utf-8"));
+        }
+        catch { /* fresh day */ }
+        // 项目函数名快照（语料挖掘的词段门控输入），cap 300
+        let projectFunctions = [];
+        try {
+            const irPath = path.join(ctx.projectPath, "ir.json");
+            if (fs.existsSync(irPath)) {
+                const ir = JSON.parse(fs.readFileSync(irPath, "utf-8"));
+                const funcs = Array.isArray(ir) ? ir : (ir.functions || []);
+                projectFunctions = funcs
+                    .map((f) => String(f.name))
+                    .filter((n) => n && !n.startsWith("__progmune_"))
+                    .slice(0, 300);
+            }
+        }
+        catch { /* best-effort */ }
+        let added = 0;
+        for (const v of violations.slice(0, 50)) {
+            // 已知高 FP 的 specific-check 规则不入语料——它们以 LLM 域映射
+            // 抖动为主（open-webui 单次扫描 36 条 CROSS_DOMAIN），对语料挖掘
+            // 是纯噪声。真实检出面（PATH_TRAVERSAL/SSRF/CROSS_USER_WRITE/
+            // 框架层/SSG）照常沉淀。
+            if (v.rule_id === "PROTOCOL_CROSS_DOMAIN" || v.rule_id === "PLAINTEXT_AUTH_WITHOUT_TLS")
+                continue;
+            const key = `${ctx.projectName}:${v.rule_id}:${v.function || ""}`;
+            if (seen[key])
+                continue;
+            recordFailure({
+                intent: `trust-scan:${ctx.projectName}`,
+                projectFunctions,
+                violatedSVL: (SEVERITY_TO_SVL[v.severity] || "SVL-2"),
+                constraintType: v.rule_id,
+                actionSequence: [
+                    {
+                        kind: "violation",
+                        function: v.function || "unknown",
+                        file: v.file,
+                        rule: v.rule_id,
+                    },
+                ],
+                errorDetail: (v.message || v.why || "").slice(0, 500),
+            });
+            seen[key] = true;
+            added++;
+        }
+        if (added > 0) {
+            try {
+                fs.mkdirSync(corpusDir, { recursive: true });
+                fs.writeFileSync(dedupFile, JSON.stringify(seen, null, 2));
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    catch { /* corpus write must never crash the scan */ }
+}
 function extractFunctionName(text) {
     if (!text)
         return "unknown";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.27",
+  "version": "3.7.29",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",

package/tools/extract_ir.py

@@ -105,40 +105,50 @@ SSRF_MARKER = "__progmune_ssrf_user_url__"
 HTTP_FETCH_RECEIVERS = ("requests", "httpx", "urllib", "urllib2", "aiohttp", "http")
 
 
-def is_request_rooted(node):
+def is_request_rooted(node, request_params=None):
     """True if the expression derives from the request object
-    (request.POST.get(...), request.GET['x'], request.body ...)."""
+    (request.POST.get(...), request.GET['x'], request.body ...).
+    2026-09-14 收紧：裸名 "request" 仅当它是函数形参（Web 处理器签名）
+    时才算 request 根——此前任何局部变量命名为 request 都被误判
+    （skyvern _fetch_discovery：request = urllib.request.Request(url)，
+    局部变量撞词 → SSRF 误报）。request_params=None 保持旧行为。"""
     if isinstance(node, ast.Name):
-        return node.id == "request"
+        if node.id != "request":
+            return False
+        return request_params is None or "request" in request_params
     if isinstance(node, ast.Attribute):
-        return is_request_rooted(node.value)
+        return is_request_rooted(node.value, request_params)
     if isinstance(node, ast.Subscript):
-        return is_request_rooted(node.value)
+        return is_request_rooted(node.value, request_params)
     if isinstance(node, ast.Call):
-        return (is_request_rooted(node.func)
-                or any(is_request_rooted(a) for a in node.args)
-                or any(is_request_rooted(k.value) for k in node.keywords))
+        return (is_request_rooted(node.func, request_params)
+                or any(is_request_rooted(a, request_params) for a in node.args)
+                or any(is_request_rooted(k.value, request_params) for k in node.keywords))
     return False
 
 
-def is_tainted(node, assigns, depth=0):
+def _func_param_names(node):
+    return {a.arg for a in node.args.args + node.args.posonlyargs + node.args.kwonlyargs}
+
+
+def is_tainted(node, assigns, depth=0, request_params=None):
     """Single-hop taint: request-rooted, variable assigned from a tainted
     value, or dynamic formatting containing tainted parts."""
     if node is None or depth > 2:
         return False
-    if is_request_rooted(node):
+    if is_request_rooted(node, request_params):
         return True
     if isinstance(node, ast.Name):
-        return is_tainted(assigns.get(node.id), assigns, depth + 1)
+        return is_tainted(assigns.get(node.id), assigns, depth + 1, request_params)
     if isinstance(node, ast.JoinedStr):
-        return any(is_tainted(v.value, assigns, depth + 1)
+        return any(is_tainted(v.value, assigns, depth + 1, request_params)
                    for v in node.values if isinstance(v, ast.FormattedValue))
     if isinstance(node, ast.BinOp):
-        return (is_tainted(node.left, assigns, depth)
-                or is_tainted(node.right, assigns, depth))
+        return (is_tainted(node.left, assigns, depth, request_params)
+                or is_tainted(node.right, assigns, depth, request_params))
     if isinstance(node, ast.Call):
-        return (any(is_tainted(a, assigns, depth) for a in node.args)
-                or any(is_tainted(k.value, assigns, depth) for k in node.keywords))
+        return (any(is_tainted(a, assigns, depth, request_params) for a in node.args)
+                or any(is_tainted(k.value, assigns, depth, request_params) for k in node.keywords))
     return False
 
 
@@ -162,15 +172,57 @@ def is_http_fetch_call(node):
     return False
 
 
+URL_PARAM_NAMES = re.compile(
+    r"^(url|target|endpoint|link|href|web_url|source_url|remote_url|"
+    r"fetch_url|spec_url|api_url|base_url|origin)$",
+    re.I,
+)
+
+SSRF_GUARD_EVIDENCE = re.compile(
+    r"127\.0\.0\.1|0\.0\.0\.0|169\.254\.|::1|localhost|is_private|"
+    r"is_loopback|hostname|deny_?list|block_?list|validate_url|"
+    r"is_safe_url|get_addresses|ipaddress|forbidden_host|private_ip|"
+    r"safe_http|get_ssrf_safe|assert_url_safe|is_blocked_hostname|"
+    r"is_blocked_address|blocked_hostnames",
+    re.I,
+)
+
+
 def has_ssrf(node):
     """SSRF check: an HTTP fetch call whose URL argument is tainted by
-    request-derived user input (directly or via single-hop assignment)."""
+    request-derived user input (directly or via single-hop assignment)
+    or references a URL-shaped function parameter (library form, e.g.
+    from_url(url)) — with no SSRF guard evidence in the function
+    (private-IP/loopback/denylist/hostname validation vocabulary).
+    2026-09-14 扩展（fr-010/fr-011）：形参污点 + 守卫抑制。"""
+    # 守卫证据：函数体内有 SSRF 防护词汇 → 不报（fr-009 证明
+    # 「守卫存在但不足」的 DNS 重绑定类是标记模型的边界，如实不覆盖）
+    try:
+        text = ast.unparse(node)
+    except Exception:
+        text = ""
+    if text and SSRF_GUARD_EVIDENCE.search(text):
+        return False
     assigns = collect_assignments(node)
+    request_params = _func_param_names(node)
+    url_params = {
+        a for a in request_params if URL_PARAM_NAMES.match(a or "")
+    }
+
+    def refs_url_param(n):
+        if isinstance(n, ast.Name):
+            return n.id in url_params
+        if isinstance(n, (ast.Attribute, ast.Subscript)):
+            return refs_url_param(n.value)
+        return False
+
     for child in ast.walk(node):
         if isinstance(child, ast.Call) and is_http_fetch_call(child):
-            if any(is_tainted(a, assigns) for a in child.args):
+            if any(is_tainted(a, assigns, request_params=request_params) for a in child.args):
+                return True
+            if any(is_tainted(k.value, assigns, request_params=request_params) for k in child.keywords):
                 return True
-            if any(is_tainted(k.value, assigns) for k in child.keywords):
+            if any(refs_url_param(a) for a in child.args):
                 return True
     return False
 
@@ -827,12 +879,13 @@ def has_path_traversal(node):
     request-derived user input (directly or via single-hop assignment —
     os.path.join chains resolve through assignment tracking)."""
     assigns = collect_assignments(node)
+    request_params = _func_param_names(node)
     for child in ast.walk(node):
         if not isinstance(child, ast.Call) or not is_file_sink_call(child):
             continue
-        if any(is_tainted(a, assigns) for a in child.args):
+        if any(is_tainted(a, assigns, request_params=request_params) for a in child.args):
             return True
-        if any(is_tainted(k.value, assigns) for k in child.keywords):
+        if any(is_tainted(k.value, assigns, request_params=request_params) for k in child.keywords):
             return True
         # Path(...).read_text(): the tainted path lives in the receiver —
         # either the direct call or a variable assigned from a Path(...) call.