progmune-runtime 3.7.54 → 3.7.55

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [3.7.55] — 2026-09-29
+
+### 主路径（trust 判定）真实项目首测 + NestJS 失明误报修复（§50）
+
+**首次对产品判定路径做真实项目全量测量**（`blind-benchmark/REALWORLD_MAIN_PATH_V1.md`）：
+docmost（NestJS 5k★）修复前被主路径判 **BLOCKED（score 48，auth 0 分）**——132 条违规里
+126 条逐条核实为失明/语义误报，且同一批违规在 policyCompliance 与 protocolSafety
+**双维度重复扣分**。主路径与旁路（safeguard，§49 加权精确率 5.8%）同病：
+真实公告位置命中 0/18（fr-corpus 17 条交叉证实协议状态机 0 检出），
+但主路径把噪声直接变成产品级判定——**虚假 BLOCKED 比虚假告警伤害大**。
+
+**四刀修复（全部 src 接线层，判定核心不动）**：
+
+1. **E3 DTO 通道接入 NestJS 适配器**：`app.useGlobalPipes(...)` 全局管道识别 +
+   路由入参类型 ∈ 已校验 DTO 集合（复用 `validatedDtoClassNames`，加继承闭包与
+   `createZodDto` Zod 形态）⇒ 不报 NO_VALIDATION。`extract-ir.ts` 导出 E3 集合函数。
+2. **无结构化输入豁免**：入参无 @Body/@Query/@Param（仅 AuthUser/Req/Res/
+   UploadedFile）的路由不报 NO_VALIDATION——没有可校验的输入。
+3. **auth 端点豁免扩展**：+ password-reset / reset-password / verify-token /
+   verify / setup / init（docmost 实测 3 条 NO_AUTH 误报）。
+4. **双维度去重**：policyCompliance 只吃策略类违规（policy_ref 以
+   framework/protocol-safety 开头的已在 protocolSafety 计分）。
+
+**效果**：docmost **BLOCKED(48) → APPROVED(87)**，违规 132 → 6（NESTJS 误报
+126 → 0；残留 6 条含 1 条撞 CVE-2026-33193 攻击面的真实语义告警）；
+hedgedoc（Zod 校验体系 + public/private 双 API 面）47 → 32，剩余 19 条逐条定性
+为规则粒度边界（@Param 裸类型 / @Body('field') 单字段，真无校验，如实保留）。
+
+**踩坑**：`param.getType().getText()` 返回 `import("...").DtoName` 形态——取
+首个标识符会取到 `import` 关键字，改取全部标识符任一命中；测试断言 route
+格式无前导斜杠（`POST pages/create`），3 个测试曾因此"假通过"。
+
+**测试**：nestjs-detector 17/17（新增全局管道+DTO / Zod / 继承 / 无输入 7 条
+正反向）；trust 全家 95/95。
+
 ## [3.7.54] — 2026-09-27
 
 ### §47 签名级会话证据 + §48 输入校验族摸底（含两条判据被数据否决）

package/dist/extract-ir.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validatedDtoClassNames = validatedDtoClassNames;
 exports.extractIR = extractIR;
 exports.extractIRWithTypes = extractIRWithTypes;
 const ts_morph_1 = require("ts-morph");
@@ -493,6 +494,8 @@ function decoratorIsValidator(text) {
 /**
  * 全项目扫描：类自身或其属性上带校验装饰器的类名集合。
  * 只看类名（不做类型解析）—— 与污点管线口径一致，跨文件引用靠名字对上。
+ * 导出供框架适配器复用（2026-09-29：NestJS 检测器的 NO_VALIDATION
+ * 失明误报——路由 DTO 在别的文件带 class-validator 装饰器，检测器看不到）。
  */
 function validatedDtoClassNames(project) {
     const out = new Set();

package/dist/frameworks/nestjs-detector.js

@@ -21,6 +21,7 @@ exports.analyzeNestJSFile = analyzeNestJSFile;
 exports.formatNestJSReport = formatNestJSReport;
 const ts_morph_1 = require("ts-morph");
 const route_window_1 = require("./route-window");
+const extract_ir_1 = require("../extract-ir");
 // ── Core Analysis ──
 function analyzeNestJSProject(projectRoot) {
     let project;
@@ -65,6 +66,66 @@ function analyzeNestJSProject(projectRoot) {
         }
     }
     const hasGlobalAuthGuard = analysis.globalAuthGuards.length > 0;
+    // ── 全局校验管道（2026-09-29：docmost 123 条 NO_VALIDATION 失明误报的根因）──
+    // NestJS 标准做法是 bootstrap 里 app.useGlobalPipes(new ValidationPipe(...))，
+    // 路由本身不带 @UsePipes 装饰器 ⇒ 此前全部报 NO_VALIDATION。
+    // 检测方式：任意非 node_modules 源文件出现 .useGlobalPipes( 调用（参数不限——
+    // hedgedoc 形态是 useGlobalPipes(setupValidationPipe(logger))，管道经辅助函数
+    // 创建，字面 ValidationPipe 不在调用处）。
+    // 保守判定：全局管道只豁免「入参是已校验 DTO」的路由（见下），裸类型入参仍报。
+    let hasGlobalValidationPipe = false;
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        if (/\.(test|spec)\.ts$/.test(file.getFilePath()))
+            continue;
+        if (/\.useGlobalPipes\s*\(/.test(file.getText())) {
+            hasGlobalValidationPipe = true;
+            break;
+        }
+    }
+    // ── 已校验 DTO 类名集合（E3 通道同款实现，import 落地代码而非重写）──
+    const validatedDtos = hasGlobalValidationPipe
+        ? (0, extract_ir_1.validatedDtoClassNames)(project)
+        : new Set();
+    // ── 继承闭包（2026-09-29 docmost 实测：RemoveFavoriteDto extends AddFavoriteDto）──
+    // E3 集合只收「类自身带校验装饰器」的类，继承来的装饰器看不到。
+    // 只扩 detector 侧集合，不动 E3 函数（后者影响 safeguard 盲测基线）。
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        for (const cls of file.getClasses()) {
+            let base = cls.getBaseClass();
+            while (base) {
+                const baseName = base.getName();
+                if (baseName && validatedDtos.has(baseName)) {
+                    const clsName = cls.getName();
+                    if (clsName)
+                        validatedDtos.add(clsName);
+                    break;
+                }
+                base = base.getBaseClass();
+            }
+        }
+    }
+    // ── Zod 形态扩展（2026-09-29 hedgedoc 实测）──
+    // class LoginDto extends createZodDto(LoginSchema) {} —— nestjs-zod 的校验
+    // 体系不产 class-validator 装饰器，E3 通道看不见。extends 表达式文本
+    // 含 createZodDto( 即视为已校验 DTO。同样只扩 detector 侧集合。
+    for (const file of project.getSourceFiles()) {
+        if (file.getFilePath().includes("node_modules"))
+            continue;
+        for (const cls of file.getClasses()) {
+            const ext = cls.getExtends();
+            if (!ext)
+                continue;
+            if (/createZodDto\s*\(/.test(ext.getText())) {
+                const clsName = cls.getName();
+                if (clsName)
+                    validatedDtos.add(clsName);
+            }
+        }
+    }
     // ── 第二遍：模块级中间件保护（Nest 5 时代惯用法）──
     // class XxxModule implements NestModule { configure(consumer) {
     //   consumer.apply(AuthMiddleware).forRoutes({path, method}, ...) } }
@@ -154,6 +215,25 @@ function analyzeNestJSProject(projectRoot) {
                     || method.getDecorator("AllowAnon") !== undefined;
                 // 认证守卫 = 认证名分类后的守卫（ThrottlerGuard 等限流守卫不算认证）
                 const authGuards = guards.filter(isAuthGuardName);
+                // 入参是否指向已校验 DTO：@Body()/@Query()/@Param() 参数的
+                // 类型名 ∈ class-validator 装饰类集合（E3 通道语义）。
+                // ts-morph 的类型文本会带 import 前缀：import(".../page.dto").PageInfoDto
+                // 或泛型 Selectable<import("...").Users> —— 取全部标识符，
+                // 任一命中已校验 DTO 集合即豁免（联合类型/裸类型/数组皆可对上；
+                // db 类型 Users 等不在集合，不会误豁免）。
+                const hasValidatedDto = method.getParameters().some((param) => {
+                    const decNames = param.getDecorators().map((d) => d.getName());
+                    if (!decNames.some((n) => ["Body", "Query", "Param"].includes(n)))
+                        return false;
+                    const typeText = param.getType().getText();
+                    const ids = typeText.match(/[A-Za-z_$][\w$]*/g) || [];
+                    return ids.some((id) => validatedDtos.has(id));
+                });
+                // 无结构化输入：入参没有 @Body/@Query/@Param——只有 AuthUser/Req/Res/
+                // UploadedFile 等上下文注入或文件对象（2026-09-29 docmost 实测：
+                // auth/collab-token、auth/logout 等无 body 路由被误报 NO_VALIDATION）。
+                // 没有可校验的 DTO 输入，规则判定面不覆盖，不报。
+                const hasStructuredInput = method.getParameters().some((param) => param.getDecorators().some((d) => ["Body", "Query", "Param"].includes(d.getName())));
                 const route = {
                     method: httpMethod,
                     path: fullPath,
@@ -161,6 +241,7 @@ function analyzeNestJSProject(projectRoot) {
                     handler: method.getName() || "unknown",
                     hasAuthGuard: authGuards.length > 0,
                     hasValidationPipe: pipes.length > 0,
+                    hasValidatedDto,
                     guards,
                     pipes,
                     isPublicDecorated,
@@ -188,7 +269,12 @@ function analyzeNestJSProject(projectRoot) {
                             fix: `Add @UseGuards(AuthGuard) to the method or controller class, or remove the @Public marker.`,
                         });
                     }
-                    if (!route.hasValidationPipe) {
+                    // 豁免：@UsePipes 装饰器，或「全局 ValidationPipe + 入参是已校验 DTO」
+                    // （docmost 实测 123 条失明误报的修复——路由 DTO 在别的文件带
+                    // class-validator 装饰器，只看 @UsePipes 永远看不到），
+                    // 或路由无结构化输入（没有可校验的东西）
+                    const validatedByGlobalPipe = hasGlobalValidationPipe && route.hasValidatedDto;
+                    if (!route.hasValidationPipe && !validatedByGlobalPipe && hasStructuredInput) {
                         analysis.issues.push({
                             type: "NESTJS_NO_VALIDATION",
                             severity: "medium",
@@ -367,6 +453,12 @@ function isPublicRoute(path) {
         /\/auth\/register$/i, /\/register$/i, /\/signup$/i,
         /\/auth\/signup$/i, /\/auth\/signin$/i, /\/signin$/i,
         /\/auth\/refresh$/i, /\/auth\/forgot/i, /\/auth\/reset/i,
+        // auth 流程自身端点（2026-09-29 docmost 实测：auth/setup、
+        // auth/password-reset、auth/verify-token 被误报 NO_AUTH——
+        // 用户尚未登录，这些端点天生无认证；原 /auth/reset 匹配不了 password-reset）
+        /\/auth\/password-reset$/i, /\/auth\/reset-password$/i,
+        /\/auth\/verify-token$/i, /\/auth\/verify$/i,
+        /\/auth\/setup$/i, /\/auth\/init$/i,
         /\/health$/i, /\/healthcheck$/i, /\/ping$/i, /\/status$/i,
         /\/public\//i, /\/static\//i,
     ];
@@ -462,6 +554,7 @@ function analyzeNestJSFile(filePath) {
                     handler: method.getName() || "unknown",
                     hasAuthGuard: guards.filter(isAuthGuardName).length > 0,
                     hasValidationPipe: pipes.length > 0,
+                    hasValidatedDto: false, // 单文件分析无跨文件 DTO 上下文（项目级用 analyzeNestJSProject）
                     guards,
                     pipes,
                     isPublicDecorated: false, // 单文件分析不解析 @Public（项目级用 analyzeNestJSProject）

package/dist/frameworks/nestjs-detector.test.js

@@ -241,3 +241,180 @@ export class AdminController {
         (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_AUTH" && i.route === "POST /users")).toBe(true);
     });
 });
+// ═══════════════════════════════════════════════════════════
+// 全局 ValidationPipe + DTO 校验识别（2026-09-29 docmost 实测：
+// 123 条 NO_VALIDATION 失明误报的修复——路由 DTO 在别的文件带
+// class-validator 装饰器，只看 @UsePipes 永远看不到）
+// ═══════════════════════════════════════════════════════════
+(0, vitest_1.describe)("nestjs-detector 全局管道 + DTO 校验通道", () => {
+    function writeValidatedApp() {
+        write("tsconfig.json", TSCONFIG);
+        write("src/main.ts", `
+import { ValidationPipe } from "@nestjs/common";
+import { NestFactory } from "@nestjs/core";
+import { AppModule } from "./app.module";
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule);
+  app.useGlobalPipes(
+    new ValidationPipe({ whitelist: true, transform: true }),
+  );
+  await app.listen(3000);
+}
+`);
+        write("src/app.module.ts", `
+import { Module } from "@nestjs/common";
+import { PageController } from "./page.controller";
+@Module({ controllers: [PageController] })
+export class AppModule {}
+`);
+        write("src/create-page.dto.ts", `
+import { IsString, IsUUID, IsOptional } from "class-validator";
+export class CreatePageDto {
+  @IsOptional() @IsString() title?: string;
+  @IsUUID() spaceId: string;
+}
+`);
+        write("src/page.controller.ts", `
+import { Controller, Post, Body } from "@nestjs/common";
+import { CreatePageDto } from "./create-page.dto";
+@Controller("pages")
+export class PageController {
+  @Post("create")
+  create(@Body() dto: CreatePageDto) { return {}; }
+}
+`);
+    }
+    (0, vitest_1.it)("全局 ValidationPipe + 入参是已校验 DTO → 不报 NO_VALIDATION", () => {
+        writeValidatedApp();
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        const nv = a.issues.filter((i) => i.type === "NESTJS_NO_VALIDATION");
+        (0, vitest_1.expect)(nv).toEqual([]);
+    });
+    (0, vitest_1.it)("反向：DTO 摘掉 class-validator 装饰器 → 精确转红", () => {
+        writeValidatedApp();
+        write("src/create-page.dto.ts", `
+export class CreatePageDto {
+  title?: string;
+  spaceId: string;
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST pages/create")).toBe(true);
+    });
+    (0, vitest_1.it)("反向：摘掉全局管道 → 精确转红（无 @UsePipes 的路由失去豁免源）", () => {
+        writeValidatedApp();
+        write("src/main.ts", `
+async function bootstrap() { await (await import("@nestjs/core").then(m => m.NestFactory.create(Object))).listen(3000); }
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST pages/create")).toBe(true);
+    });
+    (0, vitest_1.it)("继承 DTO：子类 extends 已校验父类 → 不报（RemoveFavoriteDto 形态）", () => {
+        writeValidatedApp();
+        write("src/create-page.dto.ts", `
+import { IsString, IsUUID, IsOptional } from "class-validator";
+export class CreatePageDto {
+  @IsOptional() @IsString() title?: string;
+  @IsUUID() spaceId: string;
+}
+export class UpdatePageDto extends CreatePageDto {}
+`);
+        write("src/page.controller.ts", `
+import { Controller, Post, Body } from "@nestjs/common";
+import { UpdatePageDto } from "./create-page.dto";
+@Controller("pages")
+export class PageController {
+  @Post("update")
+  update(@Body() dto: UpdatePageDto) { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST pages/update")).toBe(false);
+    });
+    (0, vitest_1.it)("无结构化输入（仅 AuthUser/Req）→ 不报 NO_VALIDATION（collab-token/logout 形态）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/main.ts", `
+import { ValidationPipe } from "@nestjs/common";
+async function bootstrap() { (globalThis as any).app.useGlobalPipes(new ValidationPipe()); }
+`);
+        write("src/app.module.ts", `
+import { Module } from "@nestjs/common";
+import { AuthController } from "./auth.controller";
+@Module({ controllers: [AuthController] })
+export class AppModule {}
+`);
+        write("src/auth.controller.ts", `
+import { Controller, Post, Req } from "@nestjs/common";
+@Controller("auth")
+export class AuthController {
+  @Post("logout")
+  logout(@Req() req: any) { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST auth/logout")).toBe(false);
+    });
+    (0, vitest_1.it)("Zod 形态：class XDto extends createZodDto(schema) + 辅助函数全局管道 → 不报（hedgedoc 形态）", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/main.ts", `
+import { setupValidationPipe } from "./setup-pipes";
+async function bootstrap() { (globalThis as any).app.useGlobalPipes(setupValidationPipe()); }
+`);
+        write("src/setup-pipes.ts", `
+import { createZodValidationPipe } from "nestjs-zod";
+export function setupValidationPipe(): any { return new (createZodValidationPipe({}))(); }
+`);
+        write("src/app.module.ts", `
+import { Module } from "@nestjs/common";
+import { NotesController } from "./notes.controller";
+@Module({ controllers: [NotesController] })
+export class AppModule {}
+`);
+        write("src/login.dto.ts", `
+import { createZodDto } from "nestjs-zod";
+export class LoginDto extends createZodDto({}) {}
+`);
+        write("src/notes.controller.ts", `
+import { Controller, Post, Body } from "@nestjs/common";
+import { LoginDto } from "./login.dto";
+@Controller("notes")
+export class NotesController {
+  @Post("create")
+  create(@Body() dto: LoginDto) { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST notes/create")).toBe(false);
+    });
+    (0, vitest_1.it)("反向：Zod DTO 摘掉 createZodDto 继承 → 精确转红", () => {
+        write("tsconfig.json", TSCONFIG);
+        write("src/main.ts", `
+import { setupValidationPipe } from "./setup-pipes";
+async function bootstrap() { (globalThis as any).app.useGlobalPipes(setupValidationPipe()); }
+`);
+        write("src/setup-pipes.ts", `
+import { createZodValidationPipe } from "nestjs-zod";
+export function setupValidationPipe(): any { return new (createZodValidationPipe({}))(); }
+`);
+        write("src/app.module.ts", `
+import { Module } from "@nestjs/common";
+import { NotesController } from "./notes.controller";
+@Module({ controllers: [NotesController] })
+export class AppModule {}
+`);
+        write("src/login.dto.ts", `
+export class LoginDto {}
+`);
+        write("src/notes.controller.ts", `
+import { Controller, Post, Body } from "@nestjs/common";
+import { LoginDto } from "./login.dto";
+@Controller("notes")
+export class NotesController {
+  @Post("create")
+  create(@Body() dto: LoginDto) { return {}; }
+}
+`);
+        const a = (0, nestjs_detector_1.analyzeNestJSProject)(dir);
+        (0, vitest_1.expect)(a.issues.some((i) => i.type === "NESTJS_NO_VALIDATION" && i.route === "POST notes/create")).toBe(true);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.52";
+exports.RUNTIME_VERSION = "3.7.55";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -151,7 +151,14 @@ async function evaluateTrust(ctx) {
     writeTrustFailuresToCorpus(ctx, allViolations);
     //  PHASE 3: SCORE
     // ═══════════════════════════════════════
-    const policyResult = (0, score_calculator_1.scorePolicyCompliance)(allViolations);
+    // 企业策略维度只吃策略类违规——框架适配器（framework.*）与协议检测
+    // （protocol-safety.*）的违规在 protocolSafety 维度已计分，同池双计
+    // 会把失明误报放大成双倍扣分（2026-09-29 docmost 实测：132 条
+    // NestJS 违规双计，auth 0 分 + score 48 + BLOCKED，逐条核实 126 条为 FP）。
+    const policyViolations = allViolations.filter((v) => !v.policy_ref.startsWith("framework") &&
+        !v.policy_ref.startsWith("protocol-safety") &&
+        v.policy_ref !== "protocol");
+    const policyResult = (0, score_calculator_1.scorePolicyCompliance)(policyViolations);
     const protocolResult = (0, score_calculator_1.scoreProtocolSafety)(allViolations);
     const coverageResult = (0, score_calculator_1.scoreVerificationCoverage)(coverageData);
     const governanceResult = (0, score_calculator_1.scoreGovernanceIntegrity)(governanceDefects);
@@ -361,7 +368,7 @@ async function evaluateTrust(ctx) {
                 score: policyResult.score,
                 weight: types_1.DEFAULT_DIMENSION_WEIGHTS.policyCompliance,
                 confidence: policyResult.hasCritical ? "LOW" : "HIGH",
-                violations: allViolations.filter((v) => v.severity !== "low" || v.policy_ref !== "protocol"),
+                violations: policyViolations,
             },
             protocolSafety: protocolResult,
             verificationCoverage: coverageResult,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.54",
+  "version": "3.7.55",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",