progmune-runtime 3.7.7 → 3.7.9

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [3.7.9] — 2026-08-28
+
+### Flask / Fastify / Next.js 框架结构适配（M4——框架适配 7/13）
+
+- **Flask（Python 第 3 个）**：`tools/extract_framework_flask.py`（@app.route/@bp.route + methods kwarg、认证装饰器、before_request 认证守卫、Blueprint）+ `src/frameworks/flask-detector.ts`（`FLASK_ROUTE_NO_AUTH`——mutation 路由无认证装饰器且无认证 before_request 守卫）——合成金标 4 项目 P=R=100%；vendored flask 库结构识别冒烟通过；修复 before_request 误放 Assign 节点（应为 Expr 表达式语句）
+- **Fastify（TS 第 3 个）**：`src/frameworks/fastify-detector.ts`（代码串级，镜像 express-detector——路由注册 + preHandler/preValidation 认证选项 + addHook 认证钩子；`FASTIFY_ROUTE_NO_AUTH`）；引擎冒烟：钩子保护正确识别（0 误报）；8 个单测
+- **Next.js（TS 第 4 个）**：`src/frameworks/nextjs-detector.ts`（App Router 文件级结构——route.ts 的 POST/PUT/PATCH/DELETE 导出 + next-auth/自定义认证调用 + 认证 middleware；`NEXT_ROUTE_NO_AUTH`）——7 个单测；pages/api 旧式 handler 方法不可静态区分（只计数如实）；修复注释内 `app/**/route.ts` 的 `*/` 提前终止块注释陷阱
+- **引擎接线**：collectFlaskViolations / collectFastifyViolations / collectNextjsViolations + overall 三个 coverage 字段——全部加性 best-effort；frameworks/index.ts barrel 补 5 个适配器导出
+- **验证**：新单测 21 个；全相关套件 160/160；Python 盲测 v1.2 64 零漂移；fastapi/django realworld 0 FP 保持；C 演示不变
+- **边界（如实）**：Flask 认证 before_request 按函数名词汇识别（自定义名漏判=漏报方向）；Fastify 代码串级（配置展开不可见）；Next.js 只盯 API 面（route.ts/pages-api，页面组件不检查）；npm 安装态 tools/ 不在包内→Python 框架扫描静默降级（既有遗留）
+
+## [3.7.8] — 2026-08-28
+
+### Django / DRF 框架结构适配（M2）——框架适配第 4 个
+
+- **结构提取（Python AST）**：`tools/extract_framework_django.py`（与 extract_ir.py / extract_framework_py.py 解耦）——urlpatterns 解析（url()/path()/re_path() → FBV / CBV .as_view() / include）、FBV 登录装饰器（login_required/permission_required/staff_member_required/user_passes_test + 自定义 *auth* 装饰器）、CBV 基类与方法（View/generics + LoginRequiredMixin 等混入）、DRF permission_classes（AllowAny/IsAuthenticated/其他类名）与 @api_view（methods + permission_classes kwarg）
+- **检测规则**（`src/frameworks/django-detector.ts`）：
+  - `DJANGO_VIEW_NO_AUTH`——mutation 视图无保护：FBV 按动词名门控（add/create/update/delete/transfer 等——信息页 home/robots/error 不报）；CBV 按方法含写操作（post/put/patch/delete/create/update/destroy）+ 无认证装饰器/无 LoginRequiredMixin
+  - `DRF_PERMISSION_BYPASS`——DRF 视图写方法 + 显式 AllowAny / 空权限类（非认证入口端点）
+  - 认证入口词汇豁免（login/signin/regist/token/health 等，视图名+URL 名+pattern）
+- **引擎接线**：`collectDjangoViolations`（仅 Python，best-effort）+ `overall.djangoCoverage`——加性零漂移
+- **合成金标**（`generate-projects-django.ts` + `scan-protocol-django.ts`）：FBV/CBV/DRF × clean/V1/V2/V2b/V1V2 = 8 项目——**TP 6 / FP 0 / FN 0 → Precision 100% / Recall 100%**
+- **真实应用验证**：django-realworld（15 路由结构全识别：DRF generics + permission_classes 接线、RegistrationAPIView/LoginAPIView AllowAny 正确豁免）——**0 FP**；PyGoat 133 路由结构全识别，适配器 2 条 flags 均为故意脆弱 lab（csrf_transfer_monei_api / DoItFast）——如实记录；fastapi-realworld 0 FP 保持
+- **修复（子串陷阱）**：`registration` 不含 `register` 子串、`register` 不含 `registr` 子串——认证入口词干统一为 `regist`（FastAPI/Django 两检测器同步）+ 回归测试锁定
+- **验证**：19 个新单元测试（django-detector 10 + fastapi 豁免回归）；套件 139/139；Python 盲测 v1.2 64 零漂移；C 演示 SSG 结果不变
+- **边界（如实）**：FBV 无法静态区分 HTTP 方法（动词名门控口径，非方法级）；include() 递归不展开（被 include 的应用 urls.py 单独成文件时已覆盖）；自定义 permission 类视为保护（保守）
+
+### FastAPI 框架结构适配（M1）——框架适配第 3 个
+
+- **结构提取（Python AST）**：`tools/extract_framework_py.py`（与 extract_ir.py 解耦，零风险）——路由（@app.get/@router.post/@r.api_route）、依赖注入（Depends()/Security()，含 Annotated[...] 订阅、嵌套调用解析、**装饰器级 dependencies=[...]**（realworld 风格）、认证方案声明（OAuth2PasswordBearer/HTTPBearer/APIKeyHeader 等 8 类）、全局中间件；跳过 tests/deps/venv 等非生产目录
+- **检测规则**（`src/frameworks/fastapi-detector.ts`，结构提取与规则判定解耦）：
+  - `FASTAPI_ROUTE_NO_AUTH`——写操作路由（post/put/patch/delete）无认证依赖且非认证入口端点（login/register/token/health 词汇豁免）→「每个 API 入口都有门禁」的精确形态；公开读（GET）不检查（realworld 的 tags/文章列表就是公开 GET——只盯 mutation 面把误报压到最低）
+  - `FASTAPI_DEAD_AUTH_SCHEME`——声明了认证方案但没有任何路由引用（认证设施是死的，装饰性声明）
+- **引擎接线**：`collectFastapiViolations`（仅 Python 项目跑 python3 扫描；best-effort 永不阻断评估）+ `overall.fastapiCoverage`（apps/routes/filesScanned/issuesFound）——加性零漂移
+- **合成金标**（`generate-projects-fastapi.ts` + `scan-protocol-fastapi.ts`，镜像 generate-projects-python 方法论）：3 结构风格（直连/APIRouter/认证方案）× 4 违规变体（clean/V1 无认证写路由/V2 死方案/V1V2）= 12 项目——**TP 13 / FP 0 / FN 0 → Precision 100% / Recall 100%**
+- **真实应用验证**：fastapi-realworld（19 路由全结构识别：签名 Depends 与装饰器 dependencies= 两种认证接线风格）——**0 FP**；django-realworld/django-unicorn 无 FastAPI 结构 → 适配器静默直通（结果不变）
+- **零漂移**：Python 盲测 v1.2 64 违规零漂移；C 演示 SSG 结果不变；相关套件 128/128（含 fastapi-detector 9 个新回归）
+- **边界（如实）**：全局中间件不视为认证（add_middleware 通常是 CORS；自定义认证中间件结构不可见）；Depends 目标按 auth-like 词表+方案引用判定（无数据流分析）；npm 安装态下 tools/ 不在包内 → 框架扫描与既有 Python IR 提取一样静默降级（安装态 Python 全链路为既有遗留问题，不随本版引入新差异）
+
 ## [3.7.7] — 2026-08-28
 
 ### C 注解采纳体验（采纳生死线工具）

package/README.md

@@ -108,7 +108,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 2/13.** Express ✅ and tRPC ✅ have dedicated detectors; Next.js has version-aware governance; NestJS is partial. Django, FastAPI and 8 more remain — framework adaptation is the #1 product gap.
+**Framework adapters: 7/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) have dedicated detectors; NestJS is partial. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +234,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, NestJS partial (2/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS partial (7/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -108,7 +108,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：2/13。** Express ✅ 与 tRPC ✅ 有专用检测器；Next.js 有版本感知治理；NestJS 部分支持。Django、FastAPI 及另外 8 个待适配——框架适配是 #1 产品缺口。
+**框架适配器：7/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）有专用检测器；NestJS 部分支持，Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +233,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、NestJS 部分（2/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS 部分（7/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/frameworks/django-detector.js

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * Django Framework Adapter — Protocol Detection for Django / DRF
+ *
+ * 框架适配 M2：结构扫描由 tools/extract_framework_django.py（Python AST）
+ * 完成——urlpatterns 解析（FBV/CBV/DRF）、登录装饰器、DRF permission_classes。
+ * 本模块消费结构 JSON 做规则判定：
+ *
+ *   DJANGO_VIEW_NO_AUTH          mutation 视图（FBV 动词名门控 / CBV 方法
+ *                                含写操作）无登录装饰器、无权限类、无
+ *                                LoginRequiredMixin 等保护——路由级
+ *                                missing-auth 的精确形态
+ *   DRF_PERMISSION_BYPASS        DRF 视图 mutation 方法 + 显式 AllowAny /
+ *                                空权限类——显式绕过（非认证入口端点）
+ *
+ * 口径（如实）：
+ *   - FBV 无法静态区分 HTTP 方法——按视图名动词门控（add/create/update/
+ *     delete/transfer 等），信息页（home/robots/error）不报；@api_view
+ *     声明的 methods 按真实方法判定
+ *   - DRF 写方法 = post/put/patch/delete/create/update/destroy（generics
+ *     命名）；read-only（list/retrieve/feed）不检查——公开读是常见设计
+ *   - 认证入口端点按 视图名+URL 名 词汇豁免（login/register/signup/token/
+ *     health/auth）
+ *   - include() 递归与 admin.site.urls 等无法解析的引用跳过
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeDjangoStructure = analyzeDjangoStructure;
+// ── Rule vocabulary ──
+/** DRF 写方法（generics 命名 + HTTP 方法） */
+const DRF_MUTATION_METHODS = new Set([
+    "post", "put", "patch", "delete", "create", "update", "destroy",
+]);
+/** FBV 动词名门控（信息页不报——home/robots/error 等是公开设计） */
+const FBV_MUTATION_VERBS = [
+    "add", "create", "update", "delete", "remove", "transfer", "upload",
+    "submit", "edit", "change", "save", "write", "send", "post", "pay",
+    "checkout", "purchase", "reset", "revoke", "register_device",
+];
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+function isAuthEntry(route, viewName) {
+    const haystack = `${viewName || ""} ${route.urlname} ${route.pattern}`.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => haystack.includes(w));
+}
+function hasMutationMethod(view) {
+    if (view.apiViewMethods && view.apiViewMethods.length > 0) {
+        return view.apiViewMethods.some((m) => DRF_MUTATION_METHODS.has(m.toLowerCase()));
+    }
+    return (view.methods || []).some((m) => DRF_MUTATION_METHODS.has(m.toLowerCase()));
+}
+function fbvNameHasMutationVerb(name) {
+    const lower = name.toLowerCase();
+    return FBV_MUTATION_VERBS.some((v) => lower.includes(v));
+}
+// ── Analysis ──
+function analyzeDjangoStructure(data) {
+    if (!data.hasDjango || !Array.isArray(data.routes)) {
+        return { hasDjango: false, issues: [] };
+    }
+    const issues = [];
+    for (const route of data.routes) {
+        if (route.kind !== "fbv" && route.kind !== "cbv")
+            continue;
+        const viewName = route.view;
+        if (!viewName)
+            continue;
+        const view = data.views[viewName];
+        if (!view)
+            continue; // 无法解析的引用（admin.site.urls 等）跳过
+        if (isAuthEntry(route, viewName))
+            continue;
+        if (view.kind === "fbv") {
+            const hasAuthDecorator = (view.authDecorators || []).length > 0;
+            if (hasAuthDecorator)
+                continue;
+            const protectedByApiView = (view.apiViewMethods || []).length > 0
+                && (view.permissionClasses || []).length > 0
+                && !(view.permissionClasses || []).every((p) => p === "AllowAny");
+            const isMutation = view.apiViewMethods && view.apiViewMethods.length > 0
+                ? hasMutationMethod(view)
+                : fbvNameHasMutationVerb(viewName);
+            if (!isMutation)
+                continue;
+            if (protectedByApiView)
+                continue;
+            issues.push({
+                severity: "medium",
+                rule: "DJANGO_VIEW_NO_AUTH",
+                message: `View "${viewName}" (${route.pattern}) has no login decorator or ` +
+                    `permission protection — any visitor can reach it.`,
+                route: route.pattern,
+                handler: viewName,
+                file: view.file,
+            });
+            continue;
+        }
+        // CBV
+        if (view.isDrf) {
+            if (!hasMutationMethod(view))
+                continue;
+            if (view.openPermission) {
+                issues.push({
+                    severity: "medium",
+                    rule: "DRF_PERMISSION_BYPASS",
+                    message: `DRF view "${viewName}" (${route.pattern}) accepts write methods ` +
+                        `with permission_classes allowing any caller.`,
+                    route: route.pattern,
+                    handler: viewName,
+                    file: view.file,
+                });
+            }
+            continue;
+        }
+        // 非 DRF CBV：写方法 + 无 method_decorator 认证 + 无 LoginRequiredMixin
+        if (!hasMutationMethod(view))
+            continue;
+        const authDecorators = (view.authDecorators || []).length > 0;
+        if (authDecorators || view.protectedByMixin)
+            continue;
+        issues.push({
+            severity: "medium",
+            rule: "DJANGO_VIEW_NO_AUTH",
+            message: `View "${viewName}" (${route.pattern}) has write methods without ` +
+                `login decorators or auth mixins.`,
+            route: route.pattern,
+            handler: viewName,
+            file: view.file,
+        });
+    }
+    return { hasDjango: true, issues };
+}

package/dist/frameworks/django-detector.test.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * django-detector.test.ts — Django 框架适配器规则回归（纯函数，无文件 I/O）
+ *
+ * 规则判定与结构提取解耦：扫描器（tools/extract_framework_django.py）只做
+ * 结构，本模块消费结构 JSON 做 DJANGO_VIEW_NO_AUTH / DRF_PERMISSION_BYPASS。
+ */
+const vitest_1 = require("vitest");
+const django_detector_1 = require("./django-detector");
+function structure(partial) {
+    return {
+        hasDjango: true,
+        routes: [],
+        views: {},
+        filesScanned: 1,
+        ...partial,
+    };
+}
+const fbv = (name, extra = {}) => ({
+    file: "views.py", kind: "fbv", decorators: [], authDecorators: [],
+    apiViewMethods: null, permissionClasses: [],
+    ...extra,
+});
+const cbv = (name, extra = {}) => ({
+    file: "views.py", kind: "cbv", decorators: [], authDecorators: [],
+    apiViewMethods: null, permissionClasses: [], bases: [], methods: [],
+    isDrf: false, protectedByMixin: false, openPermission: false,
+    ...extra,
+});
+(0, vitest_1.describe)("django-detector", () => {
+    (0, vitest_1.it)("R1：无保护的 FBV 动词名视图 → DJANGO_VIEW_NO_AUTH", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "transfer", urlname: "", view: "transfer_money", kind: "fbv", file: "urls.py" }],
+            views: { transfer_money: fbv("transfer_money") },
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("DJANGO_VIEW_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1 识别 @login_required 保护", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "transfer", urlname: "", view: "transfer_money", kind: "fbv", file: "urls.py" }],
+            views: { transfer_money: fbv("transfer_money", { authDecorators: ["login_required"] }) },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：home/robots/error 等信息页动词门控不报", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [
+                { pattern: "", urlname: "", view: "home", kind: "fbv", file: "urls.py" },
+                { pattern: "robots.txt", urlname: "", view: "robots", kind: "fbv", file: "urls.py" },
+            ],
+            views: { home: fbv("home"), robots: fbv("robots") },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：registration 词干（不含 register 子串的陷阱回归）", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "^users/?$", urlname: "", view: "RegistrationAPIView", kind: "cbv", file: "urls.py" }],
+            views: {
+                RegistrationAPIView: cbv("RegistrationAPIView", {
+                    isDrf: true, methods: ["post"],
+                    permissionClasses: ["AllowAny"], openPermission: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R2：DRF 写方法 + AllowAny → DRF_PERMISSION_BYPASS", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "send", urlname: "", view: "SendMoneyAPIView", kind: "cbv", file: "urls.py" }],
+            views: {
+                SendMoneyAPIView: cbv("SendMoneyAPIView", {
+                    isDrf: true, methods: ["post"],
+                    permissionClasses: ["AllowAny"], openPermission: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("DRF_PERMISSION_BYPASS");
+    });
+    (0, vitest_1.it)("R2：IsAuthenticated 保护不报；只读视图（list/retrieve）不报", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [
+                { pattern: "send", urlname: "", view: "SendMoneyAPIView", kind: "cbv", file: "urls.py" },
+                { pattern: "tags", urlname: "", view: "TagListAPIView", kind: "cbv", file: "urls.py" },
+            ],
+            views: {
+                SendMoneyAPIView: cbv("SendMoneyAPIView", {
+                    isDrf: true, methods: ["post"],
+                    permissionClasses: ["IsAuthenticated"], openPermission: false,
+                }),
+                TagListAPIView: cbv("TagListAPIView", {
+                    isDrf: true, methods: ["list"],
+                    permissionClasses: ["AllowAny"], openPermission: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 DRF CBV：写方法 + LoginRequiredMixin → 不报", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "edit", urlname: "", view: "EditView", kind: "cbv", file: "urls.py" }],
+            views: {
+                EditView: cbv("EditView", {
+                    isDrf: false, methods: ["post"], protectedByMixin: true,
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("@api_view 写方法 + permission_classes 保护 → 不报", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [{ pattern: "api", urlname: "", view: "api_transfer", kind: "fbv", file: "urls.py" }],
+            views: {
+                api_transfer: fbv("api_transfer", {
+                    apiViewMethods: ["post"], permissionClasses: ["IsAuthenticated"],
+                }),
+            },
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("include 与无法解析的引用（admin.site.urls）不报", () => {
+        const { issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({
+            routes: [
+                { pattern: "^admin/", urlname: "", view: "urls", kind: "fbv", file: "urls.py" },
+                { pattern: "^api/", urlname: "", view: null, kind: "include", file: "urls.py" },
+            ],
+            views: {},
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Django 结构不产生任何问题", () => {
+        const { hasDjango, issues } = (0, django_detector_1.analyzeDjangoStructure)(structure({ hasDjango: false, routes: [] }));
+        (0, vitest_1.expect)(hasDjango).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/fastapi-detector.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * FastAPI Framework Adapter — Protocol Detection for FastAPI
+ *
+ * 框架适配 M1（Python 侧结构提取 + TS 侧规则判定）：
+ * 结构扫描由 tools/extract_framework_py.py（Python AST）完成——路由
+ * （@app.get/@router.post）、依赖注入（Depends()/Security()，含
+ * Annotated[...] 与装饰器级 dependencies=[...]）、认证方案声明
+ * （OAuth2PasswordBearer/HTTPBearer/APIKeyHeader 等）、全局中间件。
+ * 本模块消费结构 JSON 做规则判定：
+ *
+ *   FASTAPI_ROUTE_NO_AUTH        写操作路由（post/put/patch/delete）无
+ *                                认证依赖，且不是认证入口端点（login/
+ *                                register/token 等）——「每个 API 入口
+ *                                都有门禁」的精确形态
+ *   FASTAPI_DEAD_AUTH_SCHEME     声明了认证方案但没有任何路由引用——
+ *                                认证设施是死的（装饰性声明，防御性价值为零）
+ *
+ * 边界（如实）：
+ *   - 读操作（GET）不检查——公开读是常见设计（realworld 的 tags/文章
+ *     列表就是公开 GET），只盯写操作把误报压到最低（实测 realworld 0 FP）
+ *   - 认证入口端点按 处理器名+路径 词汇豁免——登录/注册本身不能要求已认证
+ *   - 不做数据流分析：Depends 目标是 auth-like 名或声明的方案即视为认证
+ *   - 全局中间件不视为认证（add_middleware 通常是 CORS 等；认证中间件
+ *     是自定义 BaseHTTPMiddleware 且结构不可见——如实不认）
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFastapiStructure = analyzeFastapiStructure;
+// ── Rule vocabulary ──
+/** 写操作方法——公开读是常见设计，只盯 mutation 面 */
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+/** 认证入口端点豁免词（登录/注册/token 签发本身不能要求已认证） */
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+/** 认证方案类型——引用即视为认证依赖 */
+const SCHEME_TYPES = new Set([
+    "OAuth2PasswordBearer", "OAuth2AuthorizationCodeBearer", "HTTPBearer",
+    "HTTPBasic", "HTTPDigest", "APIKeyHeader", "APIKeyQuery", "APIKeyCookie",
+    "OpenIdConnect",
+]);
+function isAuthEntryRoute(route) {
+    const haystack = `${route.handler} ${route.path}`.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => haystack.includes(w));
+}
+/** 路由是否引用了某个认证方案（Depends(oauth2_scheme) 形态） */
+function referencesScheme(route, schemeNames) {
+    return route.dependencies.some((d) => d.name !== null && schemeNames.has(d.name));
+}
+// ── Analysis ──
+function analyzeFastapiStructure(data) {
+    if (!data.hasFastAPI || !Array.isArray(data.routes)) {
+        return { hasFastAPI: false, issues: [] };
+    }
+    const issues = [];
+    const schemeNames = new Set((data.authSchemes || []).map((s) => s.name));
+    // R1：无认证写操作路由
+    for (const route of data.routes) {
+        if (!MUTATION_METHODS.has(route.method.toLowerCase()))
+            continue;
+        const hasAuthDep = route.dependencies.some((d) => d.authLike);
+        if (hasAuthDep)
+            continue;
+        if (isAuthEntryRoute(route))
+            continue;
+        issues.push({
+            severity: "medium",
+            rule: "FASTAPI_ROUTE_NO_AUTH",
+            message: `Route ${route.method.toUpperCase()} ${route.path || "(root)"} has no ` +
+                `authentication dependency — any caller can invoke "${route.handler}" ` +
+                `without credentials.`,
+            route: `${route.method.toUpperCase()} ${route.path || "(root)"}`,
+            handler: route.handler,
+            file: route.file,
+            line: route.line,
+        });
+    }
+    // R2：声明了认证方案但没有路由引用（死设施）
+    for (const scheme of data.authSchemes || []) {
+        if (!SCHEME_TYPES.has(scheme.type))
+            continue; // 非认证方案类跳过
+        const used = data.routes.some((r) => referencesScheme(r, schemeNames));
+        if (!used) {
+            issues.push({
+                severity: "medium",
+                rule: "FASTAPI_DEAD_AUTH_SCHEME",
+                message: `Auth scheme "${scheme.name}" (${scheme.type}) is declared but no ` +
+                    `route references it — the scheme does not protect any endpoint.`,
+            });
+        }
+    }
+    return { hasFastAPI: true, issues };
+}

package/dist/frameworks/fastapi-detector.test.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * fastapi-detector.test.ts — FastAPI 框架适配器规则回归（纯函数，无文件 I/O）
+ *
+ * 规则判定与结构提取解耦：扫描器（tools/extract_framework_py.py）只做结构，
+ * 本模块消费结构 JSON 做 R1（无认证写操作路由）/ R2（死认证方案）。
+ */
+const vitest_1 = require("vitest");
+const fastapi_detector_1 = require("./fastapi-detector");
+function structure(partial) {
+    return {
+        hasFastAPI: true,
+        apps: ["app"],
+        routers: [],
+        authSchemes: [],
+        globalAuthMiddleware: [],
+        routes: [],
+        filesScanned: 1,
+        ...partial,
+    };
+}
+const route = (p) => ({
+    method: p.method,
+    path: p.path || "",
+    handler: p.handler,
+    file: "main.py",
+    line: 1,
+    dependencies: p.deps || [],
+});
+(0, vitest_1.describe)("fastapi-detector", () => {
+    (0, vitest_1.it)("R1：无认证写操作路由 → FASTAPI_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            routes: [route({ method: "post", handler: "create_article" })],
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1 豁免：登录/注册/token 认证入口端点不报", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            routes: [
+                route({ method: "post", path: "/login", handler: "login" }),
+                route({ method: "post", path: "/register", handler: "register_user" }),
+                route({ method: "post", path: "/token", handler: "issue_token" }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：registration 词干（不含 register 子串的陷阱回归）", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            routes: [
+                route({ method: "post", path: "/users", handler: "registration_api_view" }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：GET 读操作不报（公开读是常见设计）", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            routes: [route({ method: "get", path: "/articles", handler: "list_articles" })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 识别 Security/Depends 认证依赖（authLike 名）", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            routes: [
+                route({
+                    method: "put", path: "/users/me", handler: "update_me",
+                    deps: [{ name: "get_current_user_authorizer", via: "Security", authLike: true }],
+                }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 识别声明的认证方案引用（Depends(oauth2_scheme)）", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            authSchemes: [{ name: "oauth2_scheme", type: "OAuth2PasswordBearer" }],
+            routes: [
+                route({
+                    method: "get", path: "/me", handler: "read_me",
+                    deps: [{ name: "oauth2_scheme", via: "Depends", authLike: true }],
+                }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R2：声明认证方案但无路由引用 → FASTAPI_DEAD_AUTH_SCHEME", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            authSchemes: [{ name: "oauth2_scheme", type: "OAuth2PasswordBearer" }],
+            routes: [route({ method: "get", handler: "list_things" })],
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTAPI_DEAD_AUTH_SCHEME");
+    });
+    (0, vitest_1.it)("R2：方案被路由引用时不报", () => {
+        const { issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({
+            authSchemes: [{ name: "oauth2_scheme", type: "OAuth2PasswordBearer" }],
+            routes: [
+                route({
+                    method: "get", handler: "read_me",
+                    deps: [{ name: "oauth2_scheme", via: "Depends", authLike: true }],
+                }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 FastAPI 结构不产生任何问题", () => {
+        const { hasFastAPI, issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure({ hasFastAPI: false, routes: [] }));
+        (0, vitest_1.expect)(hasFastAPI).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("realworld 快照：19 路由 0 问题（0 FP 回归锁）", () => {
+        const snapshot = {
+            hasFastAPI: true,
+            apps: ["application"],
+            routers: ["router"],
+            authSchemes: [],
+            globalAuthMiddleware: ["CORSMiddleware"],
+            routes: [
+                route({ method: "get", path: "", handler: "get_all_tags" }),
+                route({
+                    method: "get", path: "", handler: "retrieve_current_user",
+                    deps: [{ name: "get_current_user_authorizer", via: "Depends", authLike: true }],
+                }),
+                route({
+                    method: "put", path: "", handler: "update_current_user",
+                    deps: [{ name: "get_current_user_authorizer", via: "Depends", authLike: true }],
+                }),
+                route({ method: "post", path: "/login", handler: "login" }),
+                route({ method: "post", path: "", handler: "register" }),
+                route({
+                    method: "post", path: "/{slug}/comments", handler: "create_comment",
+                    deps: [{ name: "get_current_user_authorizer", via: "Security", authLike: true }],
+                }),
+                route({ method: "get", path: "/{slug}", handler: "retrieve_article_by_slug" }),
+                route({
+                    method: "put", path: "/{slug}", handler: "update_article_by_slug",
+                    deps: [{ name: "check_article_modification_permissions", via: "Depends", authLike: true }],
+                }),
+            ],
+            filesScanned: 70,
+        };
+        const { hasFastAPI, issues } = (0, fastapi_detector_1.analyzeFastapiStructure)(structure(snapshot));
+        (0, vitest_1.expect)(hasFastAPI).toBe(true);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});