progmune-runtime 3.7.70 → 3.7.71

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [3.7.71] — 2026-10-18
+
+### Express 匿名中间件函数体鉴权证据（fr-014 残留归零）
+
+**根因**：旧 `extractGlobalMiddleware` 用 `[^)]+` 捕获 `app.use(...)`
+实参——匿名中间件函数体的鉴权证据（`app.use(\`${prefix}*\`,
+(req,res,next) => { extractBearerToken(...) ... })`）被截断在第一个
+`）` 处（`(req,res,next)` 的右括号），`classifyMiddleware` 永远看不
+到函数体 ⇒ `hasAnyAuth` 恒 false ⇒ mockoon 管理 API 修复版本
+（CVE-2026-59148 / GHSA-rqx4-3f6q-3x2v）仍残留 1 条
+EXPRESS_NO_AUTH_MIDDLEWARE critical。
+
+- **顶层实参解析（parseUseArgs）**：括号/花括号/字符串/注释感知的
+  顶层逗号切分——匿名中间件函数体完整进入 classifyMiddleware，
+  函数体内的 extractBearerToken/timingSafeEqual 等强证据词命中
+  auth 分类。边界如实记录：模板串按无嵌套 ${} 处理；正则字面量
+  不特殊处理（与检测器其他文本级判定同口径）
+- **模板串路径归属边界**：动态路径路由（`${prefix}/x`）跳过逐路由
+  EXPRESS_ROUTE_MISSING_AUTH 检查——全局守卫挂载路径同样是变量
+  拼接，检测器无法证明「该路由不在守卫覆盖内」，逐路由告警是不
+  可归属的噪声（mockoon 修复形态实测 12 条全 FP）。保守边界：整
+  app 无认证的 critical 不受影响（动态路径照常进 hasNakedMutation
+  计数，修复前形态照报 critical）
+- **fr-014 三态复测（mini 语料，真值文件 raw 直链）**：修复前
+  admin-api.ts 报 critical + server.ts 3 条加固建议类（两版本一致）；
+  修复后 0 critical + 同 3 条建议类——**注册表升级为干净 DETECTED**
+  （fr-corpus 有效 11/17 的 with-boundary 项收窄）
+- **回归锁定**：express 检测器 33/33（+6 例：函数体证据/三态/嵌套
+  实参不切碎/字面量路由照报/注释括号）；框架全族 188/188；引擎 +
+  检测器族 245/245；express-realworld 20 路由 0 协议级 FP 保持
+  （仅已知 NO_HELMET 加固建议边界）
+
 ## [3.7.70] — 2026-10-18
 
 ### 裸名族兜底传播豁免（修冤枉第十一刀）

package/dist/frameworks/express-detector.js

@@ -223,23 +223,124 @@ function classifyMiddleware(code, name) {
         return "logging";
     return "unknown";
 }
+/**
+ * 解析 app.use(...) 的实参列表（2026-10-18，fr-014 残留根因修复）：
+ * 顶层逗号切分 + 括号/花括号/字符串/注释感知。
+ *
+ * 根因：旧实现用 `[^)]+` 捕获实参——匿名中间件函数体的鉴权证据
+ * （app.use(`${prefix}*`, (req,res,next) => { extractBearerToken(...)
+ * ... })）被截断在第一个 `)` 处（(req,res,next) 的右括号），
+ * classifyMiddleware 永远看不到函数体 ⇒ hasAnyAuth 恒 false。
+ *
+ * 边界（如实记录）：模板串按无嵌套 ${} 处理（路径字面量形态；
+ * ${} 内含反引号/顶层括号的极端形态会错切）；正则字面量不特殊
+ * 处理（检测器不做语法树，与其他文本级判定同口径）。
+ */
+function parseUseArgs(code, openParenIndex) {
+    const args = [];
+    let i = openParenIndex + 1;
+    let paren = 1; // app.use( 的实参层
+    let brace = 0;
+    let argStart = i;
+    let quote = null;
+    let lineComment = false;
+    let blockComment = false;
+    while (i < code.length) {
+        const ch = code[i];
+        if (lineComment) {
+            if (ch === "\n")
+                lineComment = false;
+            i++;
+            continue;
+        }
+        if (blockComment) {
+            if (ch === "*" && code[i + 1] === "/") {
+                blockComment = false;
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (quote) {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === quote)
+                quote = null;
+            i++;
+            continue;
+        }
+        if (ch === "'" || ch === '"' || ch === "`") {
+            quote = ch;
+            i++;
+            continue;
+        }
+        if (ch === "/" && code[i + 1] === "/") {
+            lineComment = true;
+            i += 2;
+            continue;
+        }
+        if (ch === "/" && code[i + 1] === "*") {
+            blockComment = true;
+            i += 2;
+            continue;
+        }
+        if (ch === "(") {
+            paren++;
+            i++;
+            continue;
+        }
+        if (ch === ")") {
+            paren--;
+            if (paren === 0) {
+                const text = code.slice(argStart, i).trim();
+                if (text)
+                    args.push({ text, start: argStart });
+                return args;
+            }
+            i++;
+            continue;
+        }
+        if (ch === "{") {
+            brace++;
+            i++;
+            continue;
+        }
+        if (ch === "}") {
+            brace = Math.max(0, brace - 1);
+            i++;
+            continue;
+        }
+        if (ch === "," && paren === 1 && brace === 0) {
+            const text = code.slice(argStart, i).trim();
+            if (text)
+                args.push({ text, start: argStart });
+            argStart = i + 1;
+        }
+        i++;
+    }
+    return args;
+}
 /**
  * Extract global middleware registrations (app.use(fn)).
  */
 function extractGlobalMiddleware(code, appName) {
     const middleware = [];
-    const useRegex = new RegExp(`${appName}\\.use\\s*\\(([^)]+)\\)`, "gi");
+    const useRegex = new RegExp(`${appName}\\.use\\s*\\(`, "gi");
     let match;
     while ((match = useRegex.exec(code)) !== null) {
-        const args = match[1].split(",").map(a => a.trim());
-        for (const arg of args) {
-            if (arg.startsWith("'") || arg.startsWith('"'))
+        const openParen = match.index + match[0].length - 1;
+        for (const arg of parseUseArgs(code, openParen)) {
+            const t = arg.text;
+            if (/^['"`]/.test(t))
                 continue; // skip path strings
-            if (/^(express|router|Router)\./.test(arg))
+            if (/^(express|router|Router)\./.test(t))
                 continue; // skip sub-routers (handled separately)
             middleware.push({
-                name: arg,
-                type: classifyMiddleware(code, arg),
+                name: t,
+                type: classifyMiddleware(code, t),
                 registeredAt: code.slice(0, match.index).split("\n").length,
             });
         }
@@ -311,6 +412,14 @@ function analyzeExpressApp(code) {
                 continue; // 读操作不查（公开读常见）
             if (routeHasAuth(route))
                 continue;
+            // 模板串路径（如 `${adminApiPrefix}/env-vars`）不可静态归属——
+            // 全局守卫挂载路径同样是变量拼接（app.use(`${prefix}*`, auth)），
+            // 检测器无法证明「该路由不在守卫覆盖内」，逐路由告警是不可归属的
+            // 噪声（fr-014 mockoon 修复形态实测 12 条全 FP）。保守边界：动态
+            // 路径跳过逐路由检查；整 app 无认证的 critical 检查不受影响
+            // （动态路径照常进入 hasNakedMutation 计数）。
+            if (route.path.includes("${"))
+                continue;
             if (isPublicRoute(route.path))
                 continue;
             if (route.method === "post" && (0, route_window_1.isRegisterRoot)(route.path, registerRoots))

package/dist/frameworks/express-detector.test.js

@@ -273,3 +273,93 @@ module.exports = router;
         (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "PUT /admin")).toBe(false);
     });
 });
+// ═══════════════════════════════════════════════════════════════
+// fr-014 残留修复（2026-10-18）：匿名中间件函数体鉴权证据 + 模板
+// 串路径归属边界（mockoon admin-api 修复形态）
+//
+// 根因：extractGlobalMiddleware 旧实现 [^)]+ 把 app.use(`${prefix}*`,
+// (req,res,next) => { ...extractBearerToken... }) 截断在第一个 `)`，
+// 函数体证据永远不可见 ⇒ hasAnyAuth 恒 false ⇒ 修复后仍报 critical。
+// 修复：顶层实参解析（括号/花括号/字符串感知）+ 模板串路径跳过
+// 逐路由检查（动态路径不可静态归属，12 条实测全 FP）。
+// ═══════════════════════════════════════════════════════════════
+(0, vitest_1.describe)("express-detector：匿名中间件函数体鉴权证据（fr-014 残留）", () => {
+    const ADMIN_API_FIX_SHAPE = `
+const express = require('express');
+const { timingSafeEqual } = require('node:crypto');
+const setupAdminApi = (app: Express) => {
+  const adminApiPrefix = '/mockoon-admin';
+  const hasValidAdminApiToken = (token: string) => timingSafeEqual(Buffer.from('x'), Buffer.from(token));
+
+  app.use(\`\${adminApiPrefix}*\`, (req, res, next) => {
+    const bearerToken = extractBearerToken(req.get('authorization'));
+    if (!bearerToken || !hasValidAdminApiToken(bearerToken)) {
+      res.status(401).send({ message: 'Unauthorized' });
+      return;
+    }
+    next();
+  });
+
+  app.post(\`\${adminApiPrefix}/env-vars\`, setEnvVarHandler);
+  app.put(\`\${adminApiPrefix}/env-vars\`, setEnvVarHandler);
+};
+
+export { setupAdminApi };
+`;
+    const ADMIN_API_PRE_SHAPE = ADMIN_API_FIX_SHAPE.replace(`  app.use(\`\${adminApiPrefix}*\`, (req, res, next) => {
+    const bearerToken = extractBearerToken(req.get('authorization'));
+    if (!bearerToken || !hasValidAdminApiToken(bearerToken)) {
+      res.status(401).send({ message: 'Unauthorized' });
+      return;
+    }
+    next();
+  });
+
+`, "");
+    (0, vitest_1.it)("匿名中间件函数体内的 bearer 证据 ⇒ 分类为 auth（修复形态）", () => {
+        const mw = (0, express_detector_1.extractGlobalMiddleware)(ADMIN_API_FIX_SHAPE, "app");
+        const auth = mw.find((m) => m.type === "auth");
+        (0, vitest_1.expect)(auth).toBeDefined();
+        (0, vitest_1.expect)(auth.name).toContain("extractBearerToken");
+    });
+    (0, vitest_1.it)("修复形态（全局匿名 auth + 模板串 mutation 路由）⇒ 0 issues", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ADMIN_API_FIX_SHAPE);
+        (0, vitest_1.expect)(issues).toEqual([]);
+    });
+    (0, vitest_1.it)("修复前形态（无任何鉴权证据 + 模板串 mutation 路由）⇒ critical 照报", () => {
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(ADMIN_API_PRE_SHAPE);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_NO_AUTH_MIDDLEWARE")).toBe(true);
+    });
+    (0, vitest_1.it)("嵌套调用实参不被切碎（app.use(cors({origin:'x,y'})) 分类 cors）", () => {
+        const code = `
+const app = require('express')();
+app.use(cors({ origin: 'a,b', methods: ['GET','POST'] }));
+app.post('/x', handler);
+`;
+        const mw = (0, express_detector_1.extractGlobalMiddleware)(code, "app");
+        (0, vitest_1.expect)(mw.some((m) => m.type === "cors")).toBe(true);
+        // 逗号在字符串/嵌套括号内不产生碎实参
+        (0, vitest_1.expect)(mw.length).toBe(1);
+    });
+    (0, vitest_1.it)("字面量路径 mutation 路由在 hasAnyAuth 下仍逐路由报（回归锁定）", () => {
+        const code = `
+const app = require('express')();
+app.use(passport.initialize());
+app.post('/admin/secret', handler);
+`;
+        const { issues } = (0, express_detector_1.analyzeExpressApp)(code);
+        (0, vitest_1.expect)(issues.some((i) => i.rule === "EXPRESS_ROUTE_MISSING_AUTH" && i.route === "POST /admin/secret")).toBe(true);
+    });
+    (0, vitest_1.it)("注释内的括号/花括号不破坏实参解析", () => {
+        const code = `
+const app = require('express')();
+app.use(
+  // (注释里的括号) 与 /* 块注释 { } */
+  (req, res, next) => { /* } */ if (req.url) { next(); } }
+);
+app.post('/x', handler);
+`;
+        const mw = (0, express_detector_1.extractGlobalMiddleware)(code, "app");
+        (0, vitest_1.expect)(mw.length).toBe(1);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.70";
+exports.RUNTIME_VERSION = "3.7.71";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.70",
+  "version": "3.7.71",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",