progmune-runtime 3.7.7 → 3.7.9

package/dist/trust/engine.js

@@ -62,6 +62,11 @@ const api_semantic_mapper_1 = require("./api-semantic-mapper");
 const protocol_domain_validator_1 = require("./protocol-domain-validator");
 const annotation_suggest_1 = require("../annotation-suggest");
 const call_graph_propagator_1 = require("./call-graph-propagator");
+const fastapi_detector_1 = require("../frameworks/fastapi-detector");
+const django_detector_1 = require("../frameworks/django-detector");
+const flask_detector_1 = require("../frameworks/flask-detector");
+const fastify_detector_1 = require("../frameworks/fastify-detector");
+const nextjs_detector_1 = require("../frameworks/nextjs-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
@@ -92,6 +97,11 @@ async function evaluateTrust(ctx) {
     const expressResult = collectExpressViolations(ctx);
     const nestjsResult = collectNestJSViolations(ctx);
     const trpcResult = collectTRPCViolations(ctx);
+    const fastapiResult = collectFastapiViolations(ctx);
+    const djangoResult = collectDjangoViolations(ctx);
+    const flaskResult = collectFlaskViolations(ctx);
+    const fastifyResult = collectFastifyViolations(ctx);
+    const nextjsResult = collectNextjsViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -109,6 +119,11 @@ async function evaluateTrust(ctx) {
         ...expressViolations,
         ...nestjsResult.violations,
         ...trpcResult.violations,
+        ...fastapiResult.violations,
+        ...djangoResult.violations,
+        ...flaskResult.violations,
+        ...fastifyResult.violations,
+        ...nextjsResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -228,6 +243,51 @@ async function evaluateTrust(ctx) {
                     issuesFound: nestjsResult.violations.length,
                 }
                 : undefined,
+            /** FastAPI framework adapter coverage — route/auth-dependency analysis */
+            fastapiCoverage: fastapiResult.coverage.routes > 0
+                ? {
+                    appsDetected: fastapiResult.coverage.apps,
+                    totalRoutes: fastapiResult.coverage.routes,
+                    filesScanned: fastapiResult.coverage.filesScanned,
+                    issuesFound: fastapiResult.violations.length,
+                }
+                : undefined,
+            /** Django framework adapter coverage — urlconf/view/permission analysis */
+            djangoCoverage: djangoResult.coverage.routes > 0
+                ? {
+                    appsDetected: djangoResult.coverage.apps,
+                    totalRoutes: djangoResult.coverage.routes,
+                    filesScanned: djangoResult.coverage.filesScanned,
+                    issuesFound: djangoResult.violations.length,
+                }
+                : undefined,
+            /** Flask framework adapter coverage — route/auth-guard analysis */
+            flaskCoverage: flaskResult.coverage.routes > 0
+                ? {
+                    appsDetected: flaskResult.coverage.apps,
+                    totalRoutes: flaskResult.coverage.routes,
+                    filesScanned: flaskResult.coverage.filesScanned,
+                    issuesFound: flaskResult.violations.length,
+                }
+                : undefined,
+            /** Fastify framework adapter coverage — route/auth-hook analysis */
+            fastifyCoverage: fastifyResult.coverage.routes > 0
+                ? {
+                    appsDetected: fastifyResult.coverage.apps,
+                    totalRoutes: fastifyResult.coverage.routes,
+                    filesScanned: fastifyResult.coverage.filesScanned,
+                    issuesFound: fastifyResult.violations.length,
+                }
+                : undefined,
+            /** Next.js framework adapter coverage — App Router route handler analysis */
+            nextjsCoverage: nextjsResult.coverage.routes > 0
+                ? {
+                    appsDetected: nextjsResult.coverage.apps,
+                    totalRoutes: nextjsResult.coverage.routes,
+                    filesScanned: nextjsResult.coverage.filesScanned,
+                    issuesFound: nextjsResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -366,6 +426,225 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectNextjsViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const middlewareCode = (0, nextjs_detector_1.readNextMiddleware)(ctx.projectPath);
+        const analysis = (0, nextjs_detector_1.analyzeNextApp)(ctx.projectPath, middlewareCode);
+        if (!analysis.hasNext)
+            return { violations, coverage };
+        coverage.apps = 1;
+        coverage.routes = analysis.routeFiles.length;
+        coverage.filesScanned = analysis.routeFiles.length;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth check inside the route handler (e.g. getServerSession) or protect the app with auth middleware.`,
+                policy_ref: "framework-safety.nextjs",
+            });
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFastifyViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, fastify_detector_1.analyzeFastifyFile)(file);
+                    if (!analysis || !analysis.hasFastify)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add preHandler/preValidation auth to the route options, or register an auth addHook.`,
+                            policy_ref: "framework-safety.fastify",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFlaskViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    // 仅 Python 项目跑框架结构扫描
+    const lang = ctx.language || "typescript";
+    if (lang !== "python")
+        return { violations, coverage };
+    try {
+        const { execSync } = require("child_process");
+        const fs = require("fs");
+        const os = require("os");
+        // engine.js 位于 dist/trust/ → 仓库根 tools/ 需要两级向上
+        const scriptPath = path.resolve(__dirname, "..", "..", "tools", "extract_framework_flask.py");
+        const outPath = path.join(os.tmpdir(), `progmune-fwfl-${process.pid}-${Date.now()}.json`);
+        execSync(`python3 "${scriptPath}" "${ctx.projectPath}" "${outPath}"`, {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 60000,
+        });
+        if (!fs.existsSync(outPath))
+            return { violations, coverage };
+        const structure = JSON.parse(fs.readFileSync(outPath, "utf-8"));
+        fs.unlinkSync(outPath);
+        const analysis = (0, flask_detector_1.analyzeFlaskStructure)(structure);
+        if (!analysis.hasFlask)
+            return { violations, coverage };
+        coverage.apps = (structure.apps || []).length + (structure.blueprints || []).length;
+        coverage.routes = (structure.routes || []).length;
+        coverage.filesScanned = structure.filesScanned || 0;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: issue.handler || "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth decorator (@login_required or custom) to the route handler, or register an auth before_request guard.`,
+                policy_ref: "framework-safety.flask",
+            });
+        }
+    }
+    catch { /* best-effort — framework analysis must never break evaluation */ }
+    return { violations, coverage };
+}
+function collectDjangoViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    // 仅 Python 项目跑框架结构扫描
+    const lang = ctx.language || "typescript";
+    if (lang !== "python")
+        return { violations, coverage };
+    try {
+        const { execSync } = require("child_process");
+        const fs = require("fs");
+        const os = require("os");
+        // engine.js 位于 dist/trust/ → 仓库根 tools/ 需要两级向上
+        const scriptPath = path.resolve(__dirname, "..", "..", "tools", "extract_framework_django.py");
+        const outPath = path.join(os.tmpdir(), `progmune-fwdj-${process.pid}-${Date.now()}.json`);
+        execSync(`python3 "${scriptPath}" "${ctx.projectPath}" "${outPath}"`, {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 60000,
+        });
+        if (!fs.existsSync(outPath))
+            return { violations, coverage };
+        const structure = JSON.parse(fs.readFileSync(outPath, "utf-8"));
+        fs.unlinkSync(outPath);
+        const analysis = (0, django_detector_1.analyzeDjangoStructure)(structure);
+        if (!analysis.hasDjango)
+            return { violations, coverage };
+        coverage.apps = 1;
+        coverage.routes = (structure.routes || []).length;
+        coverage.filesScanned = structure.filesScanned || 0;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: issue.handler || "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: issue.rule === "DRF_PERMISSION_BYPASS"
+                    ? `Require authenticated permissions on write methods (e.g. permission_classes = (IsAuthenticated,)).`
+                    : `Add a login decorator (@login_required) or an auth mixin (LoginRequiredMixin) to the view.`,
+                policy_ref: "framework-safety.django",
+            });
+        }
+    }
+    catch { /* best-effort — framework analysis must never break evaluation */ }
+    return { violations, coverage };
+}
+function collectFastapiViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    // 仅 Python 项目跑框架结构扫描（避免 TS 项目无谓的 python3 子进程）
+    const lang = ctx.language || "typescript";
+    if (lang !== "python")
+        return { violations, coverage };
+    try {
+        const { execSync } = require("child_process");
+        const fs = require("fs");
+        const os = require("os");
+        // engine.js 位于 dist/trust/ → 仓库根 tools/ 需要两级向上
+        const scriptPath = path.resolve(__dirname, "..", "..", "tools", "extract_framework_py.py");
+        const outPath = path.join(os.tmpdir(), `progmune-fw-${process.pid}-${Date.now()}.json`);
+        execSync(`python3 "${scriptPath}" "${ctx.projectPath}" "${outPath}"`, {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 60000,
+        });
+        if (!fs.existsSync(outPath))
+            return { violations, coverage };
+        const structure = JSON.parse(fs.readFileSync(outPath, "utf-8"));
+        fs.unlinkSync(outPath);
+        const analysis = (0, fastapi_detector_1.analyzeFastapiStructure)(structure);
+        if (!analysis.hasFastAPI)
+            return { violations, coverage };
+        coverage.apps = (structure.apps || []).length + (structure.routers || []).length;
+        coverage.routes = (structure.routes || []).length;
+        coverage.filesScanned = structure.filesScanned || 0;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: issue.handler || "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: issue.rule === "FASTAPI_ROUTE_NO_AUTH"
+                    ? `Add an auth dependency to the route (Depends/Security of an authenticator) or move it behind authenticated middleware.`
+                    : `Reference the scheme from a route dependency or remove the unused scheme.`,
+                policy_ref: "framework-safety.fastapi",
+            });
+        }
+    }
+    catch { /* best-effort — framework analysis must never break evaluation */ }
+    return { violations, coverage };
+}
 function collectExpressViolations(ctx) {
     const violations = [];
     let expressApps = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.7",
+  "version": "3.7.9",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",