progmune-runtime 3.7.30 → 3.7.32

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## [3.7.32] — 2026-09-19
+
+### IR 陈旧性判定（两次会话级误判的根因修复）
+
+- **断点**：trust 引擎自动提取是「缺才提取」——项目已有 ir.json 就以文件为准不重生成。源码改了、ir.json 没更新时静默吃旧 IR：fr-005 首扫报 0（`rm ir.json` 后才报出）、污点试点「标记注入但 trust 报 0」同源
+- **修复**（`src/ir-staleness.ts` + `src/trust/engine.ts` 集成）：mtime 比对——仅当有源码新于 ir.json 才重提，不做每次全量重提（skyvern 级项目 5-10 分钟成本）
+- **三档策略 `PROGMUNE_IR_REEXTRACT`**：auto（陈旧 + 遍历完整 + 源码 ≤5000 文件才自动重提，否则**只警告不重提**）／always（语料复测自担成本）／never（旧语义，但必须打「IR 可能陈旧」警告——**不接受静默**）
+- **双闸设计**：完整遍历（不做「找到就早退」——早退会抹掉 truncated 信号，本仓库 22k 源文件实测会把单测推过 30s 超时）+ evidenceComplete + 规模预算闸；stat 一次遍历的常量成本换可靠的 fresh 判定
+- **验收**：`src/ir-staleness.test.ts` 12 green + DSH 陷阱回归 + SSRF 死循环锁 35 passed；**TS 795 零漂移（3086 LOST 0/ADDED 0）**；build ✓
+
+## [3.7.31] — 2026-09-18
+
+### 提取器 SSRF 标记正则死循环修复（P0，真实工程可用性故障）
+
+- **现象**：IR 提取阶段对含 `fetch(` 的 TS 文件 100% CPU 挂死——一个 55 行的切片 >480s 未完成，而 108 KB / 5 文件的语料只需 35s。实测 **nuxt-modules/og-image、tinacms/tinacms、zereight/gitlab-mcp 三个独立仓库全部触发**
+- **定位**：对挂住进程做 CPU 采样（`sample`），**2193/2193 采样全部落在 `Builtins_RegExpPrototypeExec`**——确定为正则死循环，而非此前怀疑的 OOM / ts-morph 依赖解析
+- **根因**（`src/extract-ir.ts` SSRF 分支，3.7.28 引入）：`TS_HTTP_FETCH_SINK` 是**无 `g` 标志**的正则，却用于 `while ((m = TS_HTTP_FETCH_SINK.exec(text)) !== null)` 迭代。非全局正则的 `exec()` 忽略 `lastIndex` 并恒返回首个匹配；当首个 `fetch(` 后的 300 字符窗口不含污点时（真实代码里最常见的「良性 fetch」形态），循环无出口。同文件另 7 处 `while-exec` 循环均带 `g`，仅此一处遗漏
+- **修复**：新增 `tsHttpFetchSinkIter()`（同模式 `"g"` 版）专供迭代；布尔探测仍用无标志版本（带 `g` 的 `.test()` 会污染 `lastIndex`）。模式至少匹配 5 字符，不可能零宽匹配
+- **影响面**：任何含 `fetch(` 且函数体内无 SSRF 守卫词汇（`localhost|ssrf|hostname|…`）的 TS 工程都会挂死提取阶段——这是面向真实代码的普遍故障，不是基准内部的边缘情况
+- **验收**：og-image 480s+ → **48s**；tinacms 300s+ → **57s**；gitlab-mcp 切片 480s+ → **80s**；最小复现 70s+ → **18s**
+
+### 修复回归语料扩样至 17 条（fr-012 ~ fr-017）
+
+- **样本结构**：open-webui 占比 75% → **41%**，独立仓库 3 → **10**（gitlab-mcp ×2、mockoon、og-image、redocly-cli、tinacms）
+- **结果**：6 条新语料全部 MISS（pre/post 均 0 违规），全库 **DETECTED 4/17、MISS 13/17、PENDING 0**
+- **正向对照**：为排除「0 违规是哑值」，scan `demo-project/` 报出 1 条真实违规（`SSG_AUTH_STATE_VIOLATION`，`token_lifecycle_flow.ts::main`）——引擎是活的
+- **注册数据修正**：fr-013 的 parent SHA 末 4 位转置（codeload 404）且原 fix_commit 是纯 CHANGELOG 文档提交，经 PR #624 正文 link 定位到真修复 PR #571；fr-012 锚点错位（其「文件读取」半边由更早的 PR #482 修复）
+- **新根因类别**：fr-012（MCP 工具实参 `args.file_path`）、fr-015（`decodeURIComponent` 解码后的对象字段 `font.path`）暴露**污点源词汇表缺口**——与 skyvern/open-webui 已暴露的认证词表缺口同族，共同病灶是「标记管线靠名字识源，不靠数据流语义」
+- 详见 `blind-benchmark/REALWORLD_FIX_REGRESSION_V2.md`
+
+### 回归
+
+- 新增 `src/extract-ir-ssrf-loop.test.ts` 2 green ✓（①良性 fetch 必须正常返回——修复前永不返回；②URL 形参流入 fetch 仍必须注入 `__progmune_ssrf_user_url__`）/ build ✓
+
 ## [3.7.30] — 2026-09-17
 
 ### 提取器性能重构（3.7.28 引入的回归修复）

package/README.md

@@ -109,15 +109,18 @@ Progmune is honest about what it can and cannot verify.
 | **Python** | ✅ Production | Blind benchmark: **recall 100% / precision 100%** (729 gold findings, 90 projects); real-world validation: PyGoat (OWASP vulnerable-by-design Django app) **67 TP / 0 FP, 100% labeled precision**; three well-written apps (django/fastapi realworld, django-unicorn) with 0 false-positive true findings |
 | **C** | ✅ Annotation-driven (Beta) | IR extraction via the registry + SSG state machine; **annotate ~2-3 protocol primitives per protocol to get trusted verification** (gold 5/5 on real modules: redis ACL / libssh client / libssh server / libssh callback-dispatch / uftpd transfer-auth — all 0 FP with precise violation localization; app-level gold v2: **P=91.7% / R=100% / F1=95.7%**). Unannotated auto-detection stays out of scope (0 TP on real corpus — positioning decision recorded in the C Language Status doc); TLS-level coverage still absent. See [C Language Status](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/c-language-status.md). |
 | **Go** | ✅ Annotation-driven (Beta) | IR extraction via registry + SSG state machine; synthetic gold v1: **P=100% / R=100%** (clean×3 + violations×3); zero external toolchain (pure-TS lexical extractor — works from npm installs) |
-| **Java** | ❌ None | Planned |
+| **Java** | 🔶 Annotation-driven (Beta) | Two layers, verified on real corpora. **Framework layer ✅**: Spring adapter (`spring-detector.ts` — security rule ordering + ant patterns + controller annotation routes) on gothinkster/spring-boot-realworld (1581★): 19 routes / 12 mutations fully parsed, 0 issues, catch-all flip counter-proof ×10; Spring Boot 3 modern dialect re-verified (SecurityFilterChain bean + String[] allowlist expansion): 15 routes, 0 issues. **Core layer**: pure-TS lexical extractor (zero toolchain deps) at **100%/100% recovery vs a tree-sitter AST baseline (1216/1216)**; SSG annotation-driven protocol rows (token / auth-register / resource) engine-locked with a real-corpus closed loop (**1 real TP / 0 FP**). Unannotated auto-detection stays out of scope (same decision as C/Go). Production label pending enterprise PoC. See [Java Language Status](https://github.com/shenlian19831109/progmune-runtime/blob/main/docs/java-language-status.md). |
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 12 dedicated detectors (4 structural + 8 heuristic).** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) have dedicated detectors. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
+**Framework adapters: 13 dedicated detectors — 4 structural (AST-based) + 8 heuristic (code-string) + Spring Boot (security rule-ordering model); 13/13 now validated on real corpora.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis), NestJS ✅ (decorator route parsing + global APP_GUARD recognition + @Public exemption), Koa ✅, Hapi ✅ (route-config auth strategy analysis), Gin ✅ and Fiber ✅ (Go route/auth-middleware analysis) and Spring Boot ✅ (Spring Security rule ordering; Boot 2 + Boot 3 dialects) have dedicated detectors. Next.js version-aware governance also exists.
+
+**Evidence tiers** (adopted 2026-09-02): 🟡 synthetic → ✅ **real-corpus validated** (≥1 real production corpus at 0 protocol-level FP + guard-removal counter-proof) → 🏭 production (enterprise PoC/adoption — none yet). **All 13/13 are ✅.** Documented boundaries: Express `main.ts` retains a NO_HELMET hardening gap (not protocol-level); the NestJS corpus yields 1 real TP (`DELETE /users/:slug`); jiotv_go's 2 flags are capability-token shapes; gofiber recipes flags are demo-context noise (no auth intent). Remaining gap: a few TS frameworks and Go frameworks beyond Gin/Fiber.
 
 ### What Progmune does NOT cover (honest boundaries)
 
-- **TS-side taint-based injection flaws** — the source-level SQLi/XSS/SSRF detections ship for Python; the TypeScript extractor is name/call-based, so TS injection classes remain uncovered (documented, not hidden).
+- **TS-side taint-based injection flaws — partial.** Python ships source-level SQLi/XSS/SSRF. On the TypeScript side, **path traversal (3.7.26)** and **SSRF (3.7.28)** are covered: the extractor emits markers (request/param taint → fs or HTTP sink, one hop + one cross-function hop) and the engine consumes them at the IR layer — validated against real security fixes at their ground-truth sites (fr-007 openhop, fr-011 mcp-from-openapi). **SQLi and XSS remain uncovered**: the TS extractor is name/call-based, not a dataflow taint engine, so those classes stay out of scope (documented, not hidden).
+- **Missing-check (absence) vulnerabilities** — the dominant real-world fix shape. A protocol state machine proves "these calls happened in the wrong order"; it does not prove "a required check was never called." Authorisation-policy bypasses, allowlist-path omissions, and ownership checks missing on one route are the largest uncovered class — measured, not guessed: see the [real-fix regression corpus](https://github.com/shenlian19831109/progmune-runtime/blob/main/blind-benchmark/fix-regression-corpus.json).
 - **SCA / dependency vulnerabilities** — hallucinated package names, supply-chain issues. Separate tooling exists for this.
 - **Runtime behavior** — Progmune is static analysis only; no DAST/sandbox execution.
 - **Framework internals** — well-known framework dispatch/cache machinery (e.g. django-unicorn internals) can produce a small number of boundary false positives; they are documented per-corpus in the benchmark gold files.

package/dist/extract-ir-ssrf-loop.test.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * SSRF 标记提取的死循环回归（2026-09-18，P0）。
+ *
+ * 根因：computeMarkerCalls 的 SSRF 分支对一个**无 `g` 标志**的正则
+ * TS_HTTP_FETCH_SINK 做 while-exec 迭代。非全局正则的 exec() 忽略
+ * lastIndex 并恒返回首个匹配，因此只要首个 fetch 调用后的 300 字符窗口
+ * 内不含污点——真实代码里最常见的「良性 fetch」形态——循环就没有出口，
+ * 提取阶段 100% CPU 死循环。CPU 采样佐证：2193/2193 采样全部落在
+ * Builtins_RegExpPrototypeExec。
+ *
+ * 影响面：任何含 `fetch(` 且函数体内无 SSRF 守卫词汇的 TS 工程都会挂死
+ * 提取阶段（实测 nuxt og-image、tinacms、gitlab-mcp 三个独立仓库均触发）。
+ *
+ * 本文件锁定两端：
+ *   1. 良性 fetch 必须正常返回（修复前永不返回）；
+ *   2. 真正的 SSRF 污点仍必须注入 __progmune_ssrf_user_url__（修复不得削弱检出）。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const extract_ir_1 = require("./extract-ir");
+const TSCONFIG = JSON.stringify({
+    compilerOptions: {
+        target: "ES2020",
+        module: "commonjs",
+        moduleResolution: "node",
+        strict: false,
+        skipLibCheck: true,
+        noEmit: true,
+    },
+    include: ["**/*.ts"],
+});
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pm-ssrf-loop-"));
+    fs.writeFileSync(path.join(dir, "tsconfig.json"), TSCONFIG);
+    fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name: "fixture", version: "0.0.0", private: true }));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+(0, vitest_1.describe)("SSRF 标记提取：良性 fetch 不得使提取器死循环", () => {
+    (0, vitest_1.it)("无守卫词汇、无污点的 fetch 调用应正常完成提取", () => {
+        const dir = makeProject({
+            "api.ts": `
+export async function ping(): Promise<any> {
+  const response = await fetch("https://x.example/uploads", { method: "POST" });
+  return response.json();
+}
+
+export async function pong(): Promise<any> {
+  return fetch("https://x.example/other");
+}
+`,
+        });
+        try {
+            const fns = (0, extract_ir_1.extractIR)(dir);
+            const names = fns.map((f) => f.name);
+            (0, vitest_1.expect)(names).toContain("ping");
+            (0, vitest_1.expect)(names).toContain("pong");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    }, 150000);
+    (0, vitest_1.it)("URL 形参直接流入 fetch 仍应注入 __progmune_ssrf_user_url__", () => {
+        const dir = makeProject({
+            "proxy.ts": `
+export async function proxy(target: string): Promise<any> {
+  const response = await fetch(target);
+  return response;
+}
+`,
+        });
+        try {
+            const fns = (0, extract_ir_1.extractIR)(dir);
+            const proxy = fns.find((f) => f.name === "proxy");
+            (0, vitest_1.expect)(proxy).toBeDefined();
+            (0, vitest_1.expect)(proxy.calls ?? []).toContain("__progmune_ssrf_user_url__");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    }, 150000);
+});

package/dist/extract-ir.js

@@ -385,21 +385,49 @@ const TS_FILE_SINK_NAMES = [
     "createWriteStream", "existsSync", "readdir", "readdirSync",
     "copyFile", "rename", "stat", "lstat", "rmdir", "truncate",
 ];
+// ═══════════════════════════════════════════════════════════════
+// 不可信入口根表 —— 污点数据流试点（2026-09-18）
+//
+// 此前整条污点链路只锚定 Express 形态的
+// `(?:req|request)\.(?:params|query|body|headers|cookies)`，
+// 即**根集合只有一种来源**。后果是 MCP 工具实参、CLI 参数、URL 解码产物
+// 等来源天然不可见：fr-012 的 `args.file_path`（← params.arguments）与
+// fr-015 的 `font.path`（← URL 解码）都因此 MISS。往 URL_PARAM_NAME 里加
+// 名字解决不了——那只是在已经认错了根的前提下扩充变量名清单（打地鼠）。
+//
+// 本表改为按**传输面**声明根：判定依据是值的来源性质，而不是变量叫什么。
+// 每条根必须窄且可解释，新增需附 `why`（closes #taint-pilot）。
+// ═══════════════════════════════════════════════════════════════
+const UNTRUSTED_ROOTS = [
+    {
+        id: "http_request",
+        expr: String.raw `\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?`,
+        why: "HTTP 请求对象字段，Express/Koa/Fastify/Nest 等通用形态",
+    },
+    {
+        id: "mcp_tool_args",
+        expr: String.raw `\bparams\.arguments\b[.[]?`,
+        why: "MCP CallToolRequest.params.arguments —— 工具调用实参，调用方可控（fr-012）",
+    },
+];
+/** 所有根的来源片段，供 **无标志** 的布尔探测正则使用 */
+const UNTRUSTED_ROOT_SRC = UNTRUSTED_ROOTS.map((r) => `(?:${r.expr})`).join("|");
+/** 既有的 request 根语义，改由根表统一提供 */
+function hasRequestRootedExpr(text) {
+    return new RegExp(UNTRUSTED_ROOT_SRC).test(text);
+}
 function tsSinkCallRegex() {
     return new RegExp(`(?:^|[^\\w.$])(?:await\\s+)?(?:[\\w$]+\\.)?(${TS_FILE_SINK_NAMES.join("|")})\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
 }
-/** request 根表达式：req.params / request.body / req.query['x'] … */
-function hasRequestRootedExpr(text) {
-    return /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.test(text);
-}
-/** 函数体内被 request 污染的局部名（含解构与单跳赋值，深度 ≤2） */
+/** 函数体内被不可信根污染的局部名（含解构与单跳赋值，深度 ≤2） */
 function collectTaintedNames(text) {
     const tainted = new Set();
     let m;
-    const direct = /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    const root = UNTRUSTED_ROOT_SRC;
+    const direct = new RegExp(`(?:const|let|var)\\s+([\\w$]+)\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = direct.exec(text)) !== null)
         tainted.add(m[1]);
-    const destr = /(?:const|let|var)\s*\{\s*([^}=]*?)\s*\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g;
+    const destr = new RegExp(`(?:const|let|var)\\s*\\{\\s*([^}=]*?)\\s*\\}\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = destr.exec(text)) !== null) {
         for (const part of m[1].split(",")) {
             const name = part.trim().split(":")[0].trim();
@@ -407,7 +435,7 @@ function collectTaintedNames(text) {
                 tainted.add(name);
         }
     }
-    const bareAssign = /(?:^|[^\w$.])([\w$]+)\s*=\s*(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    const bareAssign = new RegExp(`(?:^|[^\\w$.])([\\w$]+)\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = bareAssign.exec(text)) !== null)
         tainted.add(m[1]);
     // 单跳传播（深度 ≤2）
@@ -429,9 +457,7 @@ function collectTaintedNames(text) {
     return tainted;
 }
 function taintPattern(tainted) {
-    const parts = [
-        /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source,
-    ];
+    const parts = [UNTRUSTED_ROOT_SRC];
     if (tainted.size > 0) {
         parts.push(`\\b(?:${[...tainted].join("|")})\\b`);
     }
@@ -474,6 +500,27 @@ function splitArgWindow(win) {
 /** 项目方法名 → 方法体内流入文件 sink 的形参下标集合 */
 function methodSinkParamMap(project, absRoot) {
     const map = new Map();
+    const register = (keyName, fullName, text, relPath, params) => {
+        const sinkRe = tsSinkCallRegex();
+        let sm;
+        while ((sm = sinkRe.exec(text)) !== null) {
+            const win = sm[2] || "";
+            params.forEach((pname, idx) => {
+                if (!pname)
+                    return;
+                if (!new RegExp(`\\b${pname}\\b`).test(win))
+                    return;
+                if (!map.has(keyName)) {
+                    map.set(keyName, { idxs: new Set(), entries: [] });
+                }
+                const rec = map.get(keyName);
+                rec.idxs.add(idx);
+                if (!rec.entries.some((e) => e.name === fullName)) {
+                    rec.entries.push({ name: fullName, file: relPath });
+                }
+            });
+        }
+    };
     for (const sf of project.getSourceFiles()) {
         const relPath = path.relative(absRoot, sf.getFilePath());
         for (const cls of sf.getClasses()) {
@@ -484,27 +531,23 @@ function methodSinkParamMap(project, absRoot) {
                 const params = m.getParameters().map((p) => p.getName());
                 if (params.length === 0)
                     continue;
-                const text = m.getText();
-                const sinkRe = tsSinkCallRegex();
-                let sm;
-                while ((sm = sinkRe.exec(text)) !== null) {
-                    const win = sm[2] || "";
-                    params.forEach((pname, idx) => {
-                        if (new RegExp(`\\b${pname}\\b`).test(win)) {
-                            if (!map.has(m.getName())) {
-                                map.set(m.getName(), { idxs: new Set(), entries: [] });
-                            }
-                            const rec = map.get(m.getName());
-                            rec.idxs.add(idx);
-                            const fullName = `${cn}.${m.getName()}`;
-                            if (!rec.entries.some((e) => e.name === fullName)) {
-                                rec.entries.push({ name: fullName, file: relPath });
-                            }
-                        }
-                    });
-                }
+                register(m.getName(), `${cn}.${m.getName()}`, m.getText(), relPath, params);
             }
         }
+        // ── 污点数据流试点（2026-09-18）──
+        // 此前只登记**类方法**。真实 TS 工程大量使用顶层函数声明（MCP handler、
+        // Nuxt runtime binding、工具函数），跨函数一跳对它们完全不生效——fr-012 的
+        // `markdownUpload` 正是顶层函数，因此从未进入本表，即使上游 taint 已识别，
+        // 也无法传导到 sink。这里按同样的「形参 → 文件 sink」规则纳入函数声明。
+        for (const fn of sf.getFunctions()) {
+            const fnName = fn.getName();
+            if (!fnName)
+                continue;
+            const params = fn.getParameters().map((p) => p.getName());
+            if (params.length === 0)
+                continue;
+            register(fnName, fnName, fn.getText(), relPath, params);
+        }
     }
     return map;
 }
@@ -516,6 +559,19 @@ function methodSinkParamMap(project, absRoot) {
 // Web 形态（req.params）共用同一标记；引擎 IR 层消费。
 // ═══════════════════════════════════════════════════════════════
 const TS_HTTP_FETCH_SINK = /\b(fetch|axios\.(?:get|post|put|delete|head|patch)|http\.request|https\.request|ky\.(?:get|post|put|delete|head|patch)|undici\.request|nodeFetch|got)\s*\(/;
+/**
+ * 同模式的**全局**版本，仅用于 while-exec 迭代。
+ *
+ * 2026-09-18 P0 修复：此前 while 循环直接对无 `g` 标志的 TS_HTTP_FETCH_SINK
+ * 反复调用 exec()。非全局正则的 exec() 会忽略 lastIndex 并恒返回首个匹配，
+ * 一旦首个匹配的 300 字符窗口内不含污点（真实代码里最常见的良性 fetch
+ * 形态），循环无出口 → 提取器 100% CPU 死循环。CPU 采样证实：
+ * 2193/2193 采样全部落在 Builtins_RegExpPrototypeExec。
+ * 该缺陷会使任何含 `fetch(` 且无 SSRF 守卫词汇的 TS 工程挂死提取阶段。
+ */
+function tsHttpFetchSinkIter() {
+    return new RegExp(TS_HTTP_FETCH_SINK.source, "g");
+}
 const SSRF_GUARD_EVIDENCE = /127\.0\.0\.1|0\.0\.0\.0|169\.254\.|::1|localhost|isPrivate|isLoopback|hostname|denylist|blocklist|ssrf|validateUrl|isSafeUrl|getAddresses|ipaddress|forbidden_host|private_ip/i;
 const URL_PARAM_NAME = /^(url|target|endpoint|link|href|webUrl|web_url|sourceUrl|source_url|remoteUrl|remote_url|fetchUrl|fetch_url|specUrl|spec_url|apiUrl|api_url|origin|baseUrl|base_url)$/i;
 function collectUrlParamNames(params) {
@@ -539,18 +595,26 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit) {
             }
             else {
                 const methodCallRe = new RegExp(`\\.([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+                // ── 污点数据流试点（2026-09-18）──
+                // 此前只识别成员调用（`obj.sink(...)`）。顶层/模块内函数是真实 TS 工程
+                // 的主要形态（fr-012 的 `markdownUpload(...)` 就是裸调用），缺这一则
+                // 即使该函数的形参已登记为 sink 形参，taint 也无法传导过去。
+                const directCallRe = new RegExp(`(?:^|[^\\w$.])([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
                 const taint = taintPattern(tainted);
                 if (taint) {
-                    let m;
-                    while ((m = methodCallRe.exec(text)) !== null) {
-                        const rec = sinkParams.get(m[1]);
-                        if (!rec || rec.idxs.size === 0)
-                            continue;
-                        const args = splitArgWindow(m[2] || "");
-                        const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
-                        if (hit) {
-                            markers.push("__progmune_path_traversal__");
-                            onMethodHit(rec);
+                    for (const callRe of [methodCallRe, directCallRe]) {
+                        callRe.lastIndex = 0;
+                        let m;
+                        while ((m = callRe.exec(text)) !== null) {
+                            const rec = sinkParams.get(m[1]);
+                            if (!rec || rec.idxs.size === 0)
+                                continue;
+                            const args = splitArgWindow(m[2] || "");
+                            const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
+                            if (hit) {
+                                markers.push("__progmune_path_traversal__");
+                                onMethodHit(rec);
+                            }
                         }
                     }
                 }
@@ -567,11 +631,11 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit) {
             taintParts.push(`\\b(?:${urlParams.join("|")})\\b`);
         if (reqTainted.size > 0)
             taintParts.push(`\\b(?:${[...reqTainted].join("|")})\\b`);
-        taintParts.push(/\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source);
+        taintParts.push(UNTRUSTED_ROOT_SRC);
         const taint = new RegExp(taintParts.join("|"));
-        TS_HTTP_FETCH_SINK.lastIndex = 0;
+        const fetchSinkIter = tsHttpFetchSinkIter();
         let m;
-        while ((m = TS_HTTP_FETCH_SINK.exec(text)) !== null) {
+        while ((m = fetchSinkIter.exec(text)) !== null) {
             const after = text.slice(m.index + m[0].length, m.index + m[0].length + 300);
             if (taint.test(after)) {
                 markers.push("__progmune_ssrf_user_url__");

package/dist/ir-staleness.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectIrFreshness = inspectIrFreshness;
+exports.reextractMode = reextractMode;
+exports.reextractEnabled = reextractEnabled;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * ir.json 陈旧性判定（2026-09-19，独立于污点试点立项）。
+ *
+ * 背景（真实事故，两次会话级误判）：
+ * - trust 引擎的自动提取是「缺才提取」：项目已有 ir.json 就以文件为准、不重生成。
+ * - 该语义在【源码变了但 ir.json 没变】的场景下静默过期——
+ *   ① 分析器读的是旧调用序列（fix-regression 复测结论可能是哑值）；
+ *   ② P4.5 注解合并读同一个 ir.json，旧文件让新加的 @protocol 注解不生效。
+ * - fr-005 首扫报 0（`rm ir.json` 后才报出）、污点试点 V1 的「标记注入但 trust 报 0」
+ *   根因都是同一处。
+ *
+ * 政策：mtime 比对，不做「每次全量重提」。
+ * - 全量重提对 skyvern 级项目是 5–10 分钟量级成本，不能默认付；
+ * - 只在【存在源文件 mtime > ir.json mtime】时才重提，常量级开销（一次 stat 遍历）。
+ * 政策：mtime 比对，不做「每次全量重提」。
+ * - 全量重提对 skyvern 级项目是 5–10 分钟量级成本，不能默认付；对本仓库
+ *   （22k 源文件）足以触发单测 30s 超时——实测教训，见 tests/trust/engine.test.ts。
+ * - 只在【存在源文件 mtime > ir.json mtime】时才重提（一次 stat 遍历，恒定成本）。
+ * - 超大仓库（遍历被 MAX_STATS 截断）默认【只警告不重提】：此时 freshness 证据
+ *   不完整，自动重提会把 CLI 拖到分钟级。确需重提时显式 PROGMUNE_IR_REEXTRACT=always。
+ *
+ * 策略阀 `PROGMUNE_IR_REEXTRACT`：
+ * - 未设（auto）：遍历完整且陈旧 → 重提；遍历被截断 → 只警告
+ * - always      ：只要陈旧就重提（自担成本，用于批量语料复测）
+ * - never       ：回到旧语义（永不重提），但会打「IR 可能陈旧」警告——不允许静默。
+ */
+/** 会被提取器读取的源码后缀（跨语言；不在表内的文件不影响 IR 内容）。 */
+const SOURCE_EXT = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
+    ".py", ".c", ".h", ".cc", ".cpp", ".hpp",
+    ".go", ".java", ".rs", ".rb", ".php", ".cs", ".swift", ".kt", ".scala",
+]);
+/** 不可能是业务源码、且体量足以毁掉遍历成本的目录。 */
+const SKIP_DIRS = new Set([
+    "node_modules", ".git", "dist", "build", "out", "coverage", ".next",
+    ".nuxt", ".turbo", ".cache", "__pycache__", ".venv", "venv", "vendor",
+    "target", "bin", "obj", ".gradle", ".idea", ".vscode", ".workbuddy",
+]);
+/** 防御性上限：超大仓库不做无界遍历（宁可漏判也不卡死）。 */
+const MAX_STATS = 20000;
+const MAX_DEPTH = 12;
+/**
+ * auto 模式下愿意为「一次 IR 重提」买单的项目规模上限（源码文件数）。
+ * 超过则只警告不自动重提——重提成本随文件数超线性增长，本仓库（万级源文件）
+ * 实测足以把单测推过 30s 超时。
+ */
+const AUTO_REEXTRACT_FILE_BUDGET = 5000;
+/**
+ * 扫描项目目录，找出最新修改的源码文件。
+ *
+ * 必须【完整遍历】（不做「找到第一个更新的就早退」）：早退会在超大仓库上
+ * 把 truncated 信号抹掉——本仓库（22k 源文件）就是活例：早退后 evidenceComplete
+ * 误为真 → 自动全量重提 → 单测 30s 超时。stat 扫一遍的成本远低于一次 IR 提取，
+ * 换来的是可靠的 fresh 判定与可靠的大仓信号。
+ *
+ * @requires PROJECT_PATH @produces NEWEST_SOURCE
+ * @tags ir, staleness, mtime
+ */
+function newestSourceUnder(root, opts) {
+    const maxStats = opts.maxStats ?? MAX_STATS;
+    const maxDepth = opts.maxDepth ?? MAX_DEPTH;
+    let newestMs = null;
+    let newestFile = null;
+    let scanned = 0;
+    let truncated = false;
+    const walk = (dir, depth) => {
+        if (depth > maxDepth || truncated)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // 权限 / 竞态删除：跳过
+        }
+        for (const ent of entries) {
+            if (truncated)
+                return;
+            if (ent.isDirectory()) {
+                if (SKIP_DIRS.has(ent.name))
+                    continue;
+                if (ent.name.startsWith("."))
+                    continue; // 隐藏目录多为工具产物
+                walk(path.join(dir, ent.name), depth + 1);
+                continue;
+            }
+            if (!ent.isFile())
+                continue;
+            if (!SOURCE_EXT.has(path.extname(ent.name).toLowerCase()))
+                continue;
+            if (scanned >= maxStats) {
+                truncated = true;
+                return;
+            }
+            const full = path.join(dir, ent.name);
+            let st;
+            try {
+                st = fs.statSync(full, { throwIfNoEntry: false }) ?? undefined;
+            }
+            catch {
+                st = undefined;
+            }
+            if (!st)
+                continue;
+            scanned++;
+            if (newestMs === null || st.mtimeMs > newestMs) {
+                newestMs = st.mtimeMs;
+                newestFile = full;
+            }
+        }
+    };
+    walk(root, 0);
+    return { mtimeMs: newestMs, file: newestFile, scannedFiles: scanned, truncated };
+}
+/**
+ * 判定 ir.json 是否需要重新生成。
+ *
+ * - ir.json 不存在 → missing（需提取）
+ * - 存在源码 mtime > ir.json mtime → source-newer（需重提）
+ * - 其余 → fresh / no-sources（沿用磁盘文件）
+ *
+ * @requires PROJECT_PATH @produces IR_FRESHNESS
+ * @tags ir, staleness, mtime
+ * @useWhen evaluateTrust 决定是否自动提取 IR
+ */
+function inspectIrFreshness(projectPath, irPathOverride, opts = {}) {
+    const irPath = irPathOverride || path.join(projectPath, "ir.json");
+    let irStat;
+    try {
+        irStat = fs.statSync(irPath, { throwIfNoEntry: false }) ?? undefined;
+    }
+    catch {
+        irStat = undefined;
+    }
+    const irMtimeMs = irStat ? irStat.mtimeMs : null;
+    const src = newestSourceUnder(projectPath, opts);
+    const exceedsAutoBudget = src.scannedFiles > (opts.autoBudget ?? AUTO_REEXTRACT_FILE_BUDGET);
+    if (!irStat) {
+        return {
+            exists: false,
+            stale: true,
+            reason: "missing",
+            irMtimeMs: null,
+            newestSourceMtimeMs: src.mtimeMs,
+            newestSourcePath: src.file,
+            scannedFiles: src.scannedFiles,
+            truncated: src.truncated,
+            evidenceComplete: false, // 是否有证据都不影响：缺就必须提
+            exceedsAutoBudget,
+        };
+    }
+    if (src.mtimeMs === null) {
+        // 扫不到源码（目标目录不是真源码根，或全是跳过后缀）：无证据 → 保守沿用。
+        return {
+            exists: true,
+            stale: false,
+            reason: "no-sources",
+            irMtimeMs,
+            newestSourceMtimeMs: null,
+            newestSourcePath: null,
+            scannedFiles: 0,
+            truncated: src.truncated,
+            evidenceComplete: !src.truncated,
+            exceedsAutoBudget,
+        };
+    }
+    // 严格大于：ir.json 与源码同刻写出（写源码→随后写 ir.json 的常见顺序）
+    // 判为 fresh，避免把正常管线推入全量重提。
+    const stale = irMtimeMs !== null && src.mtimeMs > irMtimeMs;
+    return {
+        exists: true,
+        stale,
+        reason: stale ? "source-newer" : "fresh",
+        irMtimeMs,
+        newestSourceMtimeMs: src.mtimeMs,
+        newestSourcePath: src.file,
+        scannedFiles: src.scannedFiles,
+        truncated: src.truncated,
+        evidenceComplete: !src.truncated,
+        exceedsAutoBudget,
+    };
+}
+function reextractMode() {
+    const v = (process.env.PROGMUNE_IR_REEXTRACT || "").toLowerCase();
+    if (v === "always")
+        return "always";
+    if (v === "never" || v === "off" || v === "0" || v === "false")
+        return "never";
+    return "auto";
+}
+function reextractEnabled() {
+    return reextractMode() !== "never";
+}

package/dist/ir-staleness.test.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const ir_staleness_1 = require("./ir-staleness");
+/**
+ * ir.json 陈旧性判定的回归测试（2026-09-19）。
+ *
+ * 锁三件事：
+ * 1. ir.json 缺失 → missing（需提取）——保住原有的自动提取语义；
+ * 2. 源码比 ir.json 新 → source-newer（需重提）——本次新增的判别力；
+ * 3. ir.json 不早于源码 → fresh（沿用磁盘文件）——不做无谓的全量重提，
+ *    否则 skyvern 级项目每次扫描要多付分钟级成本。
+ */
+function tmpdir(tag) {
+    return fs.mkdtempSync(path.join(os.tmpdir(), `pm-ir-stale-${tag}-`));
+}
+/** 把文件的 mtime 显式钉到某个 epoch ms（避免同一毫秒内写完两文件的歧义）。 */
+function touch(file, content, mtimeMs) {
+    fs.writeFileSync(file, content);
+    fs.utimesSync(file, mtimeMs / 1000, mtimeMs / 1000);
+}
+(0, vitest_1.describe)("inspectIrFreshness", () => {
+    (0, vitest_1.it)("ir.json 缺失 → missing，stale=true（触发自动提取）", () => {
+        const dir = tmpdir("missing");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.exists).toBe(false);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("missing");
+            (0, vitest_1.expect)(r.irMtimeMs).toBeNull();
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("源码比 ir.json 新 → source-newer（本次修复的核心：原先会被静默沿用）", () => {
+        const dir = tmpdir("newer");
+        try {
+            const irFile = path.join(dir, "ir.json");
+            const srcFile = path.join(dir, "app.ts");
+            touch(irFile, "[]", 1700000000000);
+            touch(srcFile, "export const x = 1;", 1700000100000); // 晚 100s
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.exists).toBe(true);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("source-newer");
+            (0, vitest_1.expect)(r.newestSourcePath).toBe(srcFile);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("ir.json 比源码新 → fresh（不重提，避免分钟级全量重提）", () => {
+        const dir = tmpdir("fresh");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000100000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+            (0, vitest_1.expect)(r.scannedFiles).toBe(1);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("同刻写出（源码→ir.json 的常见顺序）→ fresh（不得推入全量重提）", () => {
+        const dir = tmpdir("same");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("子目录源码也算源码（只看根目录下的话会漏判）", () => {
+        const dir = tmpdir("nested");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            const nested = path.join(dir, "src", "deep");
+            fs.mkdirSync(nested, { recursive: true });
+            touch(path.join(nested, "handler.ts"), "export function handle() {}", 1700000500000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.newestSourcePath).toContain(path.join("src", "deep", "handler.ts"));
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("node_modules 等非源码目录被跳过（成本约束：不得遍历依赖树）", () => {
+        const dir = tmpdir("skip");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000500000);
+            const nm = path.join(dir, "node_modules", "pkg");
+            fs.mkdirSync(nm, { recursive: true });
+            touch(path.join(nm, "index.js"), "module.exports = 1;", 1700000900000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("no-sources");
+            (0, vitest_1.expect)(r.scannedFiles).toBe(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("非源码后缀（png/md/json）不影响判定", () => {
+        const dir = tmpdir("ext");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000500000);
+            touch(path.join(dir, "README.md"), "hello", 1700000900000);
+            touch(path.join(dir, "logo.png"), "x", 1700000900000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("no-sources");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("源码规模超预算 → exceedsAutoBudget（auto 模式只警告，不自动全量重提）", () => {
+        const dir = tmpdir("budget");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            for (let i = 0; i < 5; i++) {
+                touch(path.join(dir, `f${i}.ts`), "export const x = 1;", 1700000100000);
+            }
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir, undefined, { autoBudget: 3 });
+            (0, vitest_1.expect)(r.stale).toBe(true); // 陈旧判定不受预算影响
+            (0, vitest_1.expect)(r.exceedsAutoBudget).toBe(true);
+            (0, vitest_1.expect)(r.scannedFiles).toBe(5);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("遍历被上限截断时标记 evidenceComplete=false（超大仓库不得静默全量重提）", () => {
+        const dir = tmpdir("trunc");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            for (let i = 0; i < 5; i++) {
+                touch(path.join(dir, `f${i}.ts`), "export const x = 1;", 1700000100000);
+            }
+            // maxStats=2：扫到 2 个就停 —— stale 仍为真（证据已经够），但 fresh 不可信
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir, undefined, { maxStats: 2 });
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.truncated).toBe(true);
+            (0, vitest_1.expect)(r.evidenceComplete).toBe(false);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("正常仓库（未截断）fresh 判定证据完整", () => {
+        const dir = tmpdir("complete");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000100000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.evidenceComplete).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("逃逸阀：默认 auto", () => {
+        const prev = process.env.PROGMUNE_IR_REEXTRACT;
+        delete process.env.PROGMUNE_IR_REEXTRACT;
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("auto");
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractEnabled)()).toBe(true);
+        if (prev !== undefined)
+            process.env.PROGMUNE_IR_REEXTRACT = prev;
+    });
+    (0, vitest_1.it)("逃生阀：always / never 语义", () => {
+        const prev = process.env.PROGMUNE_IR_REEXTRACT;
+        process.env.PROGMUNE_IR_REEXTRACT = "always";
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("always");
+        process.env.PROGMUNE_IR_REEXTRACT = "never";
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("never");
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractEnabled)()).toBe(false);
+        if (prev === undefined)
+            delete process.env.PROGMUNE_IR_REEXTRACT;
+        else
+            process.env.PROGMUNE_IR_REEXTRACT = prev;
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.30";
+exports.RUNTIME_VERSION = "3.7.32";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -62,6 +62,7 @@ const api_semantic_mapper_1 = require("./api-semantic-mapper");
 const protocol_domain_validator_1 = require("./protocol-domain-validator");
 const annotation_suggest_1 = require("../annotation-suggest");
 const call_graph_propagator_1 = require("./call-graph-propagator");
+const ir_staleness_1 = require("../ir-staleness");
 const fastapi_detector_1 = require("../frameworks/fastapi-detector");
 const django_detector_1 = require("../frameworks/django-detector");
 const flask_detector_1 = require("../frameworks/flask-detector");
@@ -87,7 +88,10 @@ const extract_ir_java_1 = require("../extract-ir-java");
  * C → extractIRC 合并形态 { typeMap, functions }）——注解合并（P4.5）依赖
  * ir.json，调用方【无需】手动 extractProjectIR/写盘（曾是对 C 注解静默
  * 失效的文档/API 陷阱，回归测试见 tests/trust/engine.test.ts「DSH 陷阱」）。
- * 若项目已有 ir.json，以现有文件为准（不覆盖）。
+ * 若项目已有 ir.json：原语义是「以现有文件为准（不覆盖）」——该语义会让
+ * 【源码已改、ir.json 未更新】的场景静默读旧 IR（2026-09-19 修正）：
+ * mtime 比对发现有源码新于 ir.json 时重提；否则沿用磁盘文件（不做无谓的全量重提）。
+ * 逃生阀 PROGMUNE_IR_REEXTRACT=never 可回到旧语义（会打「IR 可能陈旧」警告）。
  */
 async function evaluateTrust(ctx) {
     const engineVersion = "trust-runtime-v1.0.0";
@@ -1228,7 +1232,29 @@ async function collectProtocolViolations(ctx, callGraph) {
             if (extractFn) {
                 try {
                     const fs = require("fs");
-                    if (!fs.existsSync(path.join(ctx.projectPath, "ir.json"))) {
+                    // 陈旧性判定（2026-09-19）：原来只看 existsSync——源码改了、ir.json 没更新时
+                    // 引擎静默吃旧 IR（fr-005 首扫报 0、污点试点「标记注入但 trust 报 0」同源）。
+                    // 改为 mtime 比对：仅当有源码比 ir.json 新时才重提，避免全量重提的分钟级成本。
+                    const freshness = (0, ir_staleness_1.inspectIrFreshness)(ctx.projectPath);
+                    const mode = (0, ir_staleness_1.reextractMode)();
+                    // 陈旧的判定由 mtime 给出；是否【自动】重提还要过成本闸：
+                    // ① evidenceComplete 为假 → 遍历被截断，证据不可信；
+                    // ② exceedsAutoBudget → 源码规模超预算（万级源文件的本仓库实测把
+                    //    单次 evaluateTrust 推过 30s 超时），重提成本不该由默认路径承担。
+                    // 两种情况都改为显式警告；语料复测等场景用 PROGMUNE_IR_REEXTRACT=always 承担。
+                    const shouldExtract = !freshness.exists ||
+                        (freshness.stale &&
+                            (mode === "always" ||
+                                (mode === "auto" &&
+                                    freshness.evidenceComplete &&
+                                    !freshness.exceedsAutoBudget)));
+                    if (freshness.exists && freshness.stale && !shouldExtract) {
+                        console.warn(`[progmune] ⚠️ IR 可能陈旧：${freshness.newestSourcePath} 新于 ir.json` +
+                            `（mode=${mode}${freshness.exceedsAutoBudget ? "，源码超出重提预算" : ""}` +
+                            `${freshness.truncated ? "，遍历被截断" : ""}；` +
+                            `需重提取运行 PROGMUNE_IR_REEXTRACT=always 或删除 ir.json）`);
+                    }
+                    if (shouldExtract) {
                         const ir = extractFn();
                         // C 走合并形态（与 execute/MCP 写盘一致）；TS/Python 保持裸数组形态
                         const payload = lang === "c" ? { typeMap: {}, functions: ir } : ir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.30",
+  "version": "3.7.32",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",