progmune-runtime 3.7.31 → 3.7.32

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [3.7.32] — 2026-09-19
+
+### IR 陈旧性判定（两次会话级误判的根因修复）
+
+- **断点**：trust 引擎自动提取是「缺才提取」——项目已有 ir.json 就以文件为准不重生成。源码改了、ir.json 没更新时静默吃旧 IR：fr-005 首扫报 0（`rm ir.json` 后才报出）、污点试点「标记注入但 trust 报 0」同源
+- **修复**（`src/ir-staleness.ts` + `src/trust/engine.ts` 集成）：mtime 比对——仅当有源码新于 ir.json 才重提，不做每次全量重提（skyvern 级项目 5-10 分钟成本）
+- **三档策略 `PROGMUNE_IR_REEXTRACT`**：auto（陈旧 + 遍历完整 + 源码 ≤5000 文件才自动重提，否则**只警告不重提**）／always（语料复测自担成本）／never（旧语义，但必须打「IR 可能陈旧」警告——**不接受静默**）
+- **双闸设计**：完整遍历（不做「找到就早退」——早退会抹掉 truncated 信号，本仓库 22k 源文件实测会把单测推过 30s 超时）+ evidenceComplete + 规模预算闸；stat 一次遍历的常量成本换可靠的 fresh 判定
+- **验收**：`src/ir-staleness.test.ts` 12 green + DSH 陷阱回归 + SSRF 死循环锁 35 passed；**TS 795 零漂移（3086 LOST 0/ADDED 0）**；build ✓
+
 ## [3.7.31] — 2026-09-18
 
 ### 提取器 SSRF 标记正则死循环修复（P0，真实工程可用性故障）

package/dist/extract-ir.js

@@ -385,21 +385,49 @@ const TS_FILE_SINK_NAMES = [
     "createWriteStream", "existsSync", "readdir", "readdirSync",
     "copyFile", "rename", "stat", "lstat", "rmdir", "truncate",
 ];
+// ═══════════════════════════════════════════════════════════════
+// 不可信入口根表 —— 污点数据流试点（2026-09-18）
+//
+// 此前整条污点链路只锚定 Express 形态的
+// `(?:req|request)\.(?:params|query|body|headers|cookies)`，
+// 即**根集合只有一种来源**。后果是 MCP 工具实参、CLI 参数、URL 解码产物
+// 等来源天然不可见：fr-012 的 `args.file_path`（← params.arguments）与
+// fr-015 的 `font.path`（← URL 解码）都因此 MISS。往 URL_PARAM_NAME 里加
+// 名字解决不了——那只是在已经认错了根的前提下扩充变量名清单（打地鼠）。
+//
+// 本表改为按**传输面**声明根：判定依据是值的来源性质，而不是变量叫什么。
+// 每条根必须窄且可解释，新增需附 `why`（closes #taint-pilot）。
+// ═══════════════════════════════════════════════════════════════
+const UNTRUSTED_ROOTS = [
+    {
+        id: "http_request",
+        expr: String.raw `\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?`,
+        why: "HTTP 请求对象字段，Express/Koa/Fastify/Nest 等通用形态",
+    },
+    {
+        id: "mcp_tool_args",
+        expr: String.raw `\bparams\.arguments\b[.[]?`,
+        why: "MCP CallToolRequest.params.arguments —— 工具调用实参，调用方可控（fr-012）",
+    },
+];
+/** 所有根的来源片段，供 **无标志** 的布尔探测正则使用 */
+const UNTRUSTED_ROOT_SRC = UNTRUSTED_ROOTS.map((r) => `(?:${r.expr})`).join("|");
+/** 既有的 request 根语义，改由根表统一提供 */
+function hasRequestRootedExpr(text) {
+    return new RegExp(UNTRUSTED_ROOT_SRC).test(text);
+}
 function tsSinkCallRegex() {
     return new RegExp(`(?:^|[^\\w.$])(?:await\\s+)?(?:[\\w$]+\\.)?(${TS_FILE_SINK_NAMES.join("|")})\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
 }
-/** request 根表达式：req.params / request.body / req.query['x'] … */
-function hasRequestRootedExpr(text) {
-    return /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.test(text);
-}
-/** 函数体内被 request 污染的局部名（含解构与单跳赋值，深度 ≤2） */
+/** 函数体内被不可信根污染的局部名（含解构与单跳赋值，深度 ≤2） */
 function collectTaintedNames(text) {
     const tainted = new Set();
     let m;
-    const direct = /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    const root = UNTRUSTED_ROOT_SRC;
+    const direct = new RegExp(`(?:const|let|var)\\s+([\\w$]+)\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = direct.exec(text)) !== null)
         tainted.add(m[1]);
-    const destr = /(?:const|let|var)\s*\{\s*([^}=]*?)\s*\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g;
+    const destr = new RegExp(`(?:const|let|var)\\s*\\{\\s*([^}=]*?)\\s*\\}\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = destr.exec(text)) !== null) {
         for (const part of m[1].split(",")) {
             const name = part.trim().split(":")[0].trim();
@@ -407,7 +435,7 @@ function collectTaintedNames(text) {
                 tainted.add(name);
         }
     }
-    const bareAssign = /(?:^|[^\w$.])([\w$]+)\s*=\s*(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/g;
+    const bareAssign = new RegExp(`(?:^|[^\\w$.])([\\w$]+)\\s*=\\s*(?:await\\s+)?(?:${root})`, "g");
     while ((m = bareAssign.exec(text)) !== null)
         tainted.add(m[1]);
     // 单跳传播（深度 ≤2）
@@ -429,9 +457,7 @@ function collectTaintedNames(text) {
     return tainted;
 }
 function taintPattern(tainted) {
-    const parts = [
-        /\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source,
-    ];
+    const parts = [UNTRUSTED_ROOT_SRC];
     if (tainted.size > 0) {
         parts.push(`\\b(?:${[...tainted].join("|")})\\b`);
     }
@@ -474,6 +500,27 @@ function splitArgWindow(win) {
 /** 项目方法名 → 方法体内流入文件 sink 的形参下标集合 */
 function methodSinkParamMap(project, absRoot) {
     const map = new Map();
+    const register = (keyName, fullName, text, relPath, params) => {
+        const sinkRe = tsSinkCallRegex();
+        let sm;
+        while ((sm = sinkRe.exec(text)) !== null) {
+            const win = sm[2] || "";
+            params.forEach((pname, idx) => {
+                if (!pname)
+                    return;
+                if (!new RegExp(`\\b${pname}\\b`).test(win))
+                    return;
+                if (!map.has(keyName)) {
+                    map.set(keyName, { idxs: new Set(), entries: [] });
+                }
+                const rec = map.get(keyName);
+                rec.idxs.add(idx);
+                if (!rec.entries.some((e) => e.name === fullName)) {
+                    rec.entries.push({ name: fullName, file: relPath });
+                }
+            });
+        }
+    };
     for (const sf of project.getSourceFiles()) {
         const relPath = path.relative(absRoot, sf.getFilePath());
         for (const cls of sf.getClasses()) {
@@ -484,27 +531,23 @@ function methodSinkParamMap(project, absRoot) {
                 const params = m.getParameters().map((p) => p.getName());
                 if (params.length === 0)
                     continue;
-                const text = m.getText();
-                const sinkRe = tsSinkCallRegex();
-                let sm;
-                while ((sm = sinkRe.exec(text)) !== null) {
-                    const win = sm[2] || "";
-                    params.forEach((pname, idx) => {
-                        if (new RegExp(`\\b${pname}\\b`).test(win)) {
-                            if (!map.has(m.getName())) {
-                                map.set(m.getName(), { idxs: new Set(), entries: [] });
-                            }
-                            const rec = map.get(m.getName());
-                            rec.idxs.add(idx);
-                            const fullName = `${cn}.${m.getName()}`;
-                            if (!rec.entries.some((e) => e.name === fullName)) {
-                                rec.entries.push({ name: fullName, file: relPath });
-                            }
-                        }
-                    });
-                }
+                register(m.getName(), `${cn}.${m.getName()}`, m.getText(), relPath, params);
             }
         }
+        // ── 污点数据流试点（2026-09-18）──
+        // 此前只登记**类方法**。真实 TS 工程大量使用顶层函数声明（MCP handler、
+        // Nuxt runtime binding、工具函数），跨函数一跳对它们完全不生效——fr-012 的
+        // `markdownUpload` 正是顶层函数，因此从未进入本表，即使上游 taint 已识别，
+        // 也无法传导到 sink。这里按同样的「形参 → 文件 sink」规则纳入函数声明。
+        for (const fn of sf.getFunctions()) {
+            const fnName = fn.getName();
+            if (!fnName)
+                continue;
+            const params = fn.getParameters().map((p) => p.getName());
+            if (params.length === 0)
+                continue;
+            register(fnName, fnName, fn.getText(), relPath, params);
+        }
     }
     return map;
 }
@@ -552,18 +595,26 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit) {
             }
             else {
                 const methodCallRe = new RegExp(`\\.([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
+                // ── 污点数据流试点（2026-09-18）──
+                // 此前只识别成员调用（`obj.sink(...)`）。顶层/模块内函数是真实 TS 工程
+                // 的主要形态（fr-012 的 `markdownUpload(...)` 就是裸调用），缺这一则
+                // 即使该函数的形参已登记为 sink 形参，taint 也无法传导过去。
+                const directCallRe = new RegExp(`(?:^|[^\\w$.])([\\w$]+)\\s*\\(([\\s\\S]{0,250}?)\\)`, "g");
                 const taint = taintPattern(tainted);
                 if (taint) {
-                    let m;
-                    while ((m = methodCallRe.exec(text)) !== null) {
-                        const rec = sinkParams.get(m[1]);
-                        if (!rec || rec.idxs.size === 0)
-                            continue;
-                        const args = splitArgWindow(m[2] || "");
-                        const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
-                        if (hit) {
-                            markers.push("__progmune_path_traversal__");
-                            onMethodHit(rec);
+                    for (const callRe of [methodCallRe, directCallRe]) {
+                        callRe.lastIndex = 0;
+                        let m;
+                        while ((m = callRe.exec(text)) !== null) {
+                            const rec = sinkParams.get(m[1]);
+                            if (!rec || rec.idxs.size === 0)
+                                continue;
+                            const args = splitArgWindow(m[2] || "");
+                            const hit = args.some((arg, i) => rec.idxs.has(i) && taint.test(arg));
+                            if (hit) {
+                                markers.push("__progmune_path_traversal__");
+                                onMethodHit(rec);
+                            }
                         }
                     }
                 }
@@ -580,7 +631,7 @@ function computeMarkerCalls(text, paramNames, sinkParams, onMethodHit) {
             taintParts.push(`\\b(?:${urlParams.join("|")})\\b`);
         if (reqTainted.size > 0)
             taintParts.push(`\\b(?:${[...reqTainted].join("|")})\\b`);
-        taintParts.push(/\b(?:req|request)\.(?:params|query|body|headers|cookies)\b[.[]?/.source);
+        taintParts.push(UNTRUSTED_ROOT_SRC);
         const taint = new RegExp(taintParts.join("|"));
         const fetchSinkIter = tsHttpFetchSinkIter();
         let m;

package/dist/ir-staleness.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectIrFreshness = inspectIrFreshness;
+exports.reextractMode = reextractMode;
+exports.reextractEnabled = reextractEnabled;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * ir.json 陈旧性判定（2026-09-19，独立于污点试点立项）。
+ *
+ * 背景（真实事故，两次会话级误判）：
+ * - trust 引擎的自动提取是「缺才提取」：项目已有 ir.json 就以文件为准、不重生成。
+ * - 该语义在【源码变了但 ir.json 没变】的场景下静默过期——
+ *   ① 分析器读的是旧调用序列（fix-regression 复测结论可能是哑值）；
+ *   ② P4.5 注解合并读同一个 ir.json，旧文件让新加的 @protocol 注解不生效。
+ * - fr-005 首扫报 0（`rm ir.json` 后才报出）、污点试点 V1 的「标记注入但 trust 报 0」
+ *   根因都是同一处。
+ *
+ * 政策：mtime 比对，不做「每次全量重提」。
+ * - 全量重提对 skyvern 级项目是 5–10 分钟量级成本，不能默认付；
+ * - 只在【存在源文件 mtime > ir.json mtime】时才重提，常量级开销（一次 stat 遍历）。
+ * 政策：mtime 比对，不做「每次全量重提」。
+ * - 全量重提对 skyvern 级项目是 5–10 分钟量级成本，不能默认付；对本仓库
+ *   （22k 源文件）足以触发单测 30s 超时——实测教训，见 tests/trust/engine.test.ts。
+ * - 只在【存在源文件 mtime > ir.json mtime】时才重提（一次 stat 遍历，恒定成本）。
+ * - 超大仓库（遍历被 MAX_STATS 截断）默认【只警告不重提】：此时 freshness 证据
+ *   不完整，自动重提会把 CLI 拖到分钟级。确需重提时显式 PROGMUNE_IR_REEXTRACT=always。
+ *
+ * 策略阀 `PROGMUNE_IR_REEXTRACT`：
+ * - 未设（auto）：遍历完整且陈旧 → 重提；遍历被截断 → 只警告
+ * - always      ：只要陈旧就重提（自担成本，用于批量语料复测）
+ * - never       ：回到旧语义（永不重提），但会打「IR 可能陈旧」警告——不允许静默。
+ */
+/** 会被提取器读取的源码后缀（跨语言；不在表内的文件不影响 IR 内容）。 */
+const SOURCE_EXT = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
+    ".py", ".c", ".h", ".cc", ".cpp", ".hpp",
+    ".go", ".java", ".rs", ".rb", ".php", ".cs", ".swift", ".kt", ".scala",
+]);
+/** 不可能是业务源码、且体量足以毁掉遍历成本的目录。 */
+const SKIP_DIRS = new Set([
+    "node_modules", ".git", "dist", "build", "out", "coverage", ".next",
+    ".nuxt", ".turbo", ".cache", "__pycache__", ".venv", "venv", "vendor",
+    "target", "bin", "obj", ".gradle", ".idea", ".vscode", ".workbuddy",
+]);
+/** 防御性上限：超大仓库不做无界遍历（宁可漏判也不卡死）。 */
+const MAX_STATS = 20000;
+const MAX_DEPTH = 12;
+/**
+ * auto 模式下愿意为「一次 IR 重提」买单的项目规模上限（源码文件数）。
+ * 超过则只警告不自动重提——重提成本随文件数超线性增长，本仓库（万级源文件）
+ * 实测足以把单测推过 30s 超时。
+ */
+const AUTO_REEXTRACT_FILE_BUDGET = 5000;
+/**
+ * 扫描项目目录，找出最新修改的源码文件。
+ *
+ * 必须【完整遍历】（不做「找到第一个更新的就早退」）：早退会在超大仓库上
+ * 把 truncated 信号抹掉——本仓库（22k 源文件）就是活例：早退后 evidenceComplete
+ * 误为真 → 自动全量重提 → 单测 30s 超时。stat 扫一遍的成本远低于一次 IR 提取，
+ * 换来的是可靠的 fresh 判定与可靠的大仓信号。
+ *
+ * @requires PROJECT_PATH @produces NEWEST_SOURCE
+ * @tags ir, staleness, mtime
+ */
+function newestSourceUnder(root, opts) {
+    const maxStats = opts.maxStats ?? MAX_STATS;
+    const maxDepth = opts.maxDepth ?? MAX_DEPTH;
+    let newestMs = null;
+    let newestFile = null;
+    let scanned = 0;
+    let truncated = false;
+    const walk = (dir, depth) => {
+        if (depth > maxDepth || truncated)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // 权限 / 竞态删除：跳过
+        }
+        for (const ent of entries) {
+            if (truncated)
+                return;
+            if (ent.isDirectory()) {
+                if (SKIP_DIRS.has(ent.name))
+                    continue;
+                if (ent.name.startsWith("."))
+                    continue; // 隐藏目录多为工具产物
+                walk(path.join(dir, ent.name), depth + 1);
+                continue;
+            }
+            if (!ent.isFile())
+                continue;
+            if (!SOURCE_EXT.has(path.extname(ent.name).toLowerCase()))
+                continue;
+            if (scanned >= maxStats) {
+                truncated = true;
+                return;
+            }
+            const full = path.join(dir, ent.name);
+            let st;
+            try {
+                st = fs.statSync(full, { throwIfNoEntry: false }) ?? undefined;
+            }
+            catch {
+                st = undefined;
+            }
+            if (!st)
+                continue;
+            scanned++;
+            if (newestMs === null || st.mtimeMs > newestMs) {
+                newestMs = st.mtimeMs;
+                newestFile = full;
+            }
+        }
+    };
+    walk(root, 0);
+    return { mtimeMs: newestMs, file: newestFile, scannedFiles: scanned, truncated };
+}
+/**
+ * 判定 ir.json 是否需要重新生成。
+ *
+ * - ir.json 不存在 → missing（需提取）
+ * - 存在源码 mtime > ir.json mtime → source-newer（需重提）
+ * - 其余 → fresh / no-sources（沿用磁盘文件）
+ *
+ * @requires PROJECT_PATH @produces IR_FRESHNESS
+ * @tags ir, staleness, mtime
+ * @useWhen evaluateTrust 决定是否自动提取 IR
+ */
+function inspectIrFreshness(projectPath, irPathOverride, opts = {}) {
+    const irPath = irPathOverride || path.join(projectPath, "ir.json");
+    let irStat;
+    try {
+        irStat = fs.statSync(irPath, { throwIfNoEntry: false }) ?? undefined;
+    }
+    catch {
+        irStat = undefined;
+    }
+    const irMtimeMs = irStat ? irStat.mtimeMs : null;
+    const src = newestSourceUnder(projectPath, opts);
+    const exceedsAutoBudget = src.scannedFiles > (opts.autoBudget ?? AUTO_REEXTRACT_FILE_BUDGET);
+    if (!irStat) {
+        return {
+            exists: false,
+            stale: true,
+            reason: "missing",
+            irMtimeMs: null,
+            newestSourceMtimeMs: src.mtimeMs,
+            newestSourcePath: src.file,
+            scannedFiles: src.scannedFiles,
+            truncated: src.truncated,
+            evidenceComplete: false, // 是否有证据都不影响：缺就必须提
+            exceedsAutoBudget,
+        };
+    }
+    if (src.mtimeMs === null) {
+        // 扫不到源码（目标目录不是真源码根，或全是跳过后缀）：无证据 → 保守沿用。
+        return {
+            exists: true,
+            stale: false,
+            reason: "no-sources",
+            irMtimeMs,
+            newestSourceMtimeMs: null,
+            newestSourcePath: null,
+            scannedFiles: 0,
+            truncated: src.truncated,
+            evidenceComplete: !src.truncated,
+            exceedsAutoBudget,
+        };
+    }
+    // 严格大于：ir.json 与源码同刻写出（写源码→随后写 ir.json 的常见顺序）
+    // 判为 fresh，避免把正常管线推入全量重提。
+    const stale = irMtimeMs !== null && src.mtimeMs > irMtimeMs;
+    return {
+        exists: true,
+        stale,
+        reason: stale ? "source-newer" : "fresh",
+        irMtimeMs,
+        newestSourceMtimeMs: src.mtimeMs,
+        newestSourcePath: src.file,
+        scannedFiles: src.scannedFiles,
+        truncated: src.truncated,
+        evidenceComplete: !src.truncated,
+        exceedsAutoBudget,
+    };
+}
+function reextractMode() {
+    const v = (process.env.PROGMUNE_IR_REEXTRACT || "").toLowerCase();
+    if (v === "always")
+        return "always";
+    if (v === "never" || v === "off" || v === "0" || v === "false")
+        return "never";
+    return "auto";
+}
+function reextractEnabled() {
+    return reextractMode() !== "never";
+}

package/dist/ir-staleness.test.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const ir_staleness_1 = require("./ir-staleness");
+/**
+ * ir.json 陈旧性判定的回归测试（2026-09-19）。
+ *
+ * 锁三件事：
+ * 1. ir.json 缺失 → missing（需提取）——保住原有的自动提取语义；
+ * 2. 源码比 ir.json 新 → source-newer（需重提）——本次新增的判别力；
+ * 3. ir.json 不早于源码 → fresh（沿用磁盘文件）——不做无谓的全量重提，
+ *    否则 skyvern 级项目每次扫描要多付分钟级成本。
+ */
+function tmpdir(tag) {
+    return fs.mkdtempSync(path.join(os.tmpdir(), `pm-ir-stale-${tag}-`));
+}
+/** 把文件的 mtime 显式钉到某个 epoch ms（避免同一毫秒内写完两文件的歧义）。 */
+function touch(file, content, mtimeMs) {
+    fs.writeFileSync(file, content);
+    fs.utimesSync(file, mtimeMs / 1000, mtimeMs / 1000);
+}
+(0, vitest_1.describe)("inspectIrFreshness", () => {
+    (0, vitest_1.it)("ir.json 缺失 → missing，stale=true（触发自动提取）", () => {
+        const dir = tmpdir("missing");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.exists).toBe(false);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("missing");
+            (0, vitest_1.expect)(r.irMtimeMs).toBeNull();
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("源码比 ir.json 新 → source-newer（本次修复的核心：原先会被静默沿用）", () => {
+        const dir = tmpdir("newer");
+        try {
+            const irFile = path.join(dir, "ir.json");
+            const srcFile = path.join(dir, "app.ts");
+            touch(irFile, "[]", 1700000000000);
+            touch(srcFile, "export const x = 1;", 1700000100000); // 晚 100s
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.exists).toBe(true);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("source-newer");
+            (0, vitest_1.expect)(r.newestSourcePath).toBe(srcFile);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("ir.json 比源码新 → fresh（不重提，避免分钟级全量重提）", () => {
+        const dir = tmpdir("fresh");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000100000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+            (0, vitest_1.expect)(r.scannedFiles).toBe(1);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("同刻写出（源码→ir.json 的常见顺序）→ fresh（不得推入全量重提）", () => {
+        const dir = tmpdir("same");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("子目录源码也算源码（只看根目录下的话会漏判）", () => {
+        const dir = tmpdir("nested");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            const nested = path.join(dir, "src", "deep");
+            fs.mkdirSync(nested, { recursive: true });
+            touch(path.join(nested, "handler.ts"), "export function handle() {}", 1700000500000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.newestSourcePath).toContain(path.join("src", "deep", "handler.ts"));
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("node_modules 等非源码目录被跳过（成本约束：不得遍历依赖树）", () => {
+        const dir = tmpdir("skip");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000500000);
+            const nm = path.join(dir, "node_modules", "pkg");
+            fs.mkdirSync(nm, { recursive: true });
+            touch(path.join(nm, "index.js"), "module.exports = 1;", 1700000900000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("no-sources");
+            (0, vitest_1.expect)(r.scannedFiles).toBe(0);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("非源码后缀（png/md/json）不影响判定", () => {
+        const dir = tmpdir("ext");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000500000);
+            touch(path.join(dir, "README.md"), "hello", 1700000900000);
+            touch(path.join(dir, "logo.png"), "x", 1700000900000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.stale).toBe(false);
+            (0, vitest_1.expect)(r.reason).toBe("no-sources");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("源码规模超预算 → exceedsAutoBudget（auto 模式只警告，不自动全量重提）", () => {
+        const dir = tmpdir("budget");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            for (let i = 0; i < 5; i++) {
+                touch(path.join(dir, `f${i}.ts`), "export const x = 1;", 1700000100000);
+            }
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir, undefined, { autoBudget: 3 });
+            (0, vitest_1.expect)(r.stale).toBe(true); // 陈旧判定不受预算影响
+            (0, vitest_1.expect)(r.exceedsAutoBudget).toBe(true);
+            (0, vitest_1.expect)(r.scannedFiles).toBe(5);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("遍历被上限截断时标记 evidenceComplete=false（超大仓库不得静默全量重提）", () => {
+        const dir = tmpdir("trunc");
+        try {
+            touch(path.join(dir, "ir.json"), "[]", 1700000000000);
+            for (let i = 0; i < 5; i++) {
+                touch(path.join(dir, `f${i}.ts`), "export const x = 1;", 1700000100000);
+            }
+            // maxStats=2：扫到 2 个就停 —— stale 仍为真（证据已经够），但 fresh 不可信
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir, undefined, { maxStats: 2 });
+            (0, vitest_1.expect)(r.stale).toBe(true);
+            (0, vitest_1.expect)(r.truncated).toBe(true);
+            (0, vitest_1.expect)(r.evidenceComplete).toBe(false);
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("正常仓库（未截断）fresh 判定证据完整", () => {
+        const dir = tmpdir("complete");
+        try {
+            touch(path.join(dir, "app.ts"), "export const x = 1;", 1700000000000);
+            touch(path.join(dir, "ir.json"), "[]", 1700000100000);
+            const r = (0, ir_staleness_1.inspectIrFreshness)(dir);
+            (0, vitest_1.expect)(r.evidenceComplete).toBe(true);
+            (0, vitest_1.expect)(r.reason).toBe("fresh");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    (0, vitest_1.it)("逃逸阀：默认 auto", () => {
+        const prev = process.env.PROGMUNE_IR_REEXTRACT;
+        delete process.env.PROGMUNE_IR_REEXTRACT;
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("auto");
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractEnabled)()).toBe(true);
+        if (prev !== undefined)
+            process.env.PROGMUNE_IR_REEXTRACT = prev;
+    });
+    (0, vitest_1.it)("逃生阀：always / never 语义", () => {
+        const prev = process.env.PROGMUNE_IR_REEXTRACT;
+        process.env.PROGMUNE_IR_REEXTRACT = "always";
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("always");
+        process.env.PROGMUNE_IR_REEXTRACT = "never";
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractMode)()).toBe("never");
+        (0, vitest_1.expect)((0, ir_staleness_1.reextractEnabled)()).toBe(false);
+        if (prev === undefined)
+            delete process.env.PROGMUNE_IR_REEXTRACT;
+        else
+            process.env.PROGMUNE_IR_REEXTRACT = prev;
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.30";
+exports.RUNTIME_VERSION = "3.7.32";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -62,6 +62,7 @@ const api_semantic_mapper_1 = require("./api-semantic-mapper");
 const protocol_domain_validator_1 = require("./protocol-domain-validator");
 const annotation_suggest_1 = require("../annotation-suggest");
 const call_graph_propagator_1 = require("./call-graph-propagator");
+const ir_staleness_1 = require("../ir-staleness");
 const fastapi_detector_1 = require("../frameworks/fastapi-detector");
 const django_detector_1 = require("../frameworks/django-detector");
 const flask_detector_1 = require("../frameworks/flask-detector");
@@ -87,7 +88,10 @@ const extract_ir_java_1 = require("../extract-ir-java");
  * C → extractIRC 合并形态 { typeMap, functions }）——注解合并（P4.5）依赖
  * ir.json，调用方【无需】手动 extractProjectIR/写盘（曾是对 C 注解静默
  * 失效的文档/API 陷阱，回归测试见 tests/trust/engine.test.ts「DSH 陷阱」）。
- * 若项目已有 ir.json，以现有文件为准（不覆盖）。
+ * 若项目已有 ir.json：原语义是「以现有文件为准（不覆盖）」——该语义会让
+ * 【源码已改、ir.json 未更新】的场景静默读旧 IR（2026-09-19 修正）：
+ * mtime 比对发现有源码新于 ir.json 时重提；否则沿用磁盘文件（不做无谓的全量重提）。
+ * 逃生阀 PROGMUNE_IR_REEXTRACT=never 可回到旧语义（会打「IR 可能陈旧」警告）。
  */
 async function evaluateTrust(ctx) {
     const engineVersion = "trust-runtime-v1.0.0";
@@ -1228,7 +1232,29 @@ async function collectProtocolViolations(ctx, callGraph) {
             if (extractFn) {
                 try {
                     const fs = require("fs");
-                    if (!fs.existsSync(path.join(ctx.projectPath, "ir.json"))) {
+                    // 陈旧性判定（2026-09-19）：原来只看 existsSync——源码改了、ir.json 没更新时
+                    // 引擎静默吃旧 IR（fr-005 首扫报 0、污点试点「标记注入但 trust 报 0」同源）。
+                    // 改为 mtime 比对：仅当有源码比 ir.json 新时才重提，避免全量重提的分钟级成本。
+                    const freshness = (0, ir_staleness_1.inspectIrFreshness)(ctx.projectPath);
+                    const mode = (0, ir_staleness_1.reextractMode)();
+                    // 陈旧的判定由 mtime 给出；是否【自动】重提还要过成本闸：
+                    // ① evidenceComplete 为假 → 遍历被截断，证据不可信；
+                    // ② exceedsAutoBudget → 源码规模超预算（万级源文件的本仓库实测把
+                    //    单次 evaluateTrust 推过 30s 超时），重提成本不该由默认路径承担。
+                    // 两种情况都改为显式警告；语料复测等场景用 PROGMUNE_IR_REEXTRACT=always 承担。
+                    const shouldExtract = !freshness.exists ||
+                        (freshness.stale &&
+                            (mode === "always" ||
+                                (mode === "auto" &&
+                                    freshness.evidenceComplete &&
+                                    !freshness.exceedsAutoBudget)));
+                    if (freshness.exists && freshness.stale && !shouldExtract) {
+                        console.warn(`[progmune] ⚠️ IR 可能陈旧：${freshness.newestSourcePath} 新于 ir.json` +
+                            `（mode=${mode}${freshness.exceedsAutoBudget ? "，源码超出重提预算" : ""}` +
+                            `${freshness.truncated ? "，遍历被截断" : ""}；` +
+                            `需重提取运行 PROGMUNE_IR_REEXTRACT=always 或删除 ir.json）`);
+                    }
+                    if (shouldExtract) {
                         const ir = extractFn();
                         // C 走合并形态（与 execute/MCP 写盘一致）；TS/Python 保持裸数组形态
                         const payload = lang === "c" ? { typeMap: {}, functions: ir } : ir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.31",
+  "version": "3.7.32",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",