progmune-runtime 3.7.8 → 3.7.10

package/dist/frameworks/nextjs-detector.test.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * nextjs-detector.test.ts — Next.js App Router 适配器规则回归（文件系统 I/O，
+ * 使用临时目录夹具——与 express-detector.test.ts 同款风格）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const nextjs_detector_1 = require("./nextjs-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "nextjs-det-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function writeRoute(rel, code) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, code);
+}
+const MUTATION_ROUTE = `export async function POST(req: Request) {
+  return Response.json({ ok: true });
+}
+`;
+const AUTHED_ROUTE = `import { getServerSession } from "next-auth";
+export async function POST(req: Request) {
+  const session = await getServerSession();
+  return Response.json({ ok: true });
+}
+`;
+const AUTH_MIDDLEWARE = `import { withAuth } from "next-auth/middleware";
+export default withAuth(function middleware(req) {});
+`;
+(0, vitest_1.describe)("nextjs-detector", () => {
+    (0, vitest_1.it)("R1：无认证 mutation 路由文件 → NEXT_ROUTE_NO_AUTH", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("NEXT_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由内 getServerSession 认证调用保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", AUTHED_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：认证 middleware 全局保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        writeRoute("middleware.ts", AUTH_MIDDLEWARE);
+        const mw = (0, nextjs_detector_1.readNextMiddleware)(dir);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir, mw);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：GET 导出不报（公开读）", () => {
+        writeRoute("app/api/articles/route.ts", `export async function GET() { return Response.json([]); }`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/auth 认证入口路径不报", () => {
+        writeRoute("app/api/auth/login/route.ts", MUTATION_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("pages/api 旧式路由同样覆盖", () => {
+        writeRoute("pages/api/transfer.ts", `export default function handler(req, res) { res.json({ok:true}); }`);
+        // 无 export function POST 的旧式 handler 不识别方法 → 无 flag（口径如实）
+        writeRoute("pages/api/transfer2.ts", `export default async function POST(req: Request) { return Response.json({}); }`);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        // transfer2 无 POST 导出匹配（default 导出非具名）——旧式页路由方法不可静态区分，如实
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("无 Next.js 结构的目录不产生问题", () => {
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.8";
+exports.RUNTIME_VERSION = "3.7.10";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -64,6 +64,9 @@ const annotation_suggest_1 = require("../annotation-suggest");
 const call_graph_propagator_1 = require("./call-graph-propagator");
 const fastapi_detector_1 = require("../frameworks/fastapi-detector");
 const django_detector_1 = require("../frameworks/django-detector");
+const flask_detector_1 = require("../frameworks/flask-detector");
+const fastify_detector_1 = require("../frameworks/fastify-detector");
+const nextjs_detector_1 = require("../frameworks/nextjs-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
@@ -96,6 +99,9 @@ async function evaluateTrust(ctx) {
     const trpcResult = collectTRPCViolations(ctx);
     const fastapiResult = collectFastapiViolations(ctx);
     const djangoResult = collectDjangoViolations(ctx);
+    const flaskResult = collectFlaskViolations(ctx);
+    const fastifyResult = collectFastifyViolations(ctx);
+    const nextjsResult = collectNextjsViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -115,6 +121,9 @@ async function evaluateTrust(ctx) {
         ...trpcResult.violations,
         ...fastapiResult.violations,
         ...djangoResult.violations,
+        ...flaskResult.violations,
+        ...fastifyResult.violations,
+        ...nextjsResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -252,6 +261,33 @@ async function evaluateTrust(ctx) {
                     issuesFound: djangoResult.violations.length,
                 }
                 : undefined,
+            /** Flask framework adapter coverage — route/auth-guard analysis */
+            flaskCoverage: flaskResult.coverage.routes > 0
+                ? {
+                    appsDetected: flaskResult.coverage.apps,
+                    totalRoutes: flaskResult.coverage.routes,
+                    filesScanned: flaskResult.coverage.filesScanned,
+                    issuesFound: flaskResult.violations.length,
+                }
+                : undefined,
+            /** Fastify framework adapter coverage — route/auth-hook analysis */
+            fastifyCoverage: fastifyResult.coverage.routes > 0
+                ? {
+                    appsDetected: fastifyResult.coverage.apps,
+                    totalRoutes: fastifyResult.coverage.routes,
+                    filesScanned: fastifyResult.coverage.filesScanned,
+                    issuesFound: fastifyResult.violations.length,
+                }
+                : undefined,
+            /** Next.js framework adapter coverage — App Router route handler analysis */
+            nextjsCoverage: nextjsResult.coverage.routes > 0
+                ? {
+                    appsDetected: nextjsResult.coverage.apps,
+                    totalRoutes: nextjsResult.coverage.routes,
+                    filesScanned: nextjsResult.coverage.filesScanned,
+                    issuesFound: nextjsResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -390,6 +426,129 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectNextjsViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const middlewareCode = (0, nextjs_detector_1.readNextMiddleware)(ctx.projectPath);
+        const analysis = (0, nextjs_detector_1.analyzeNextApp)(ctx.projectPath, middlewareCode);
+        if (!analysis.hasNext)
+            return { violations, coverage };
+        coverage.apps = 1;
+        coverage.routes = analysis.routeFiles.length;
+        coverage.filesScanned = analysis.routeFiles.length;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth check inside the route handler (e.g. getServerSession) or protect the app with auth middleware.`,
+                policy_ref: "framework-safety.nextjs",
+            });
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFastifyViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, fastify_detector_1.analyzeFastifyFile)(file);
+                    if (!analysis || !analysis.hasFastify)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add preHandler/preValidation auth to the route options, or register an auth addHook.`,
+                            policy_ref: "framework-safety.fastify",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFlaskViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    // 仅 Python 项目跑框架结构扫描
+    const lang = ctx.language || "typescript";
+    if (lang !== "python")
+        return { violations, coverage };
+    try {
+        const { execSync } = require("child_process");
+        const fs = require("fs");
+        const os = require("os");
+        // engine.js 位于 dist/trust/ → 仓库根 tools/ 需要两级向上
+        const scriptPath = path.resolve(__dirname, "..", "..", "tools", "extract_framework_flask.py");
+        const outPath = path.join(os.tmpdir(), `progmune-fwfl-${process.pid}-${Date.now()}.json`);
+        execSync(`python3 "${scriptPath}" "${ctx.projectPath}" "${outPath}"`, {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 60000,
+        });
+        if (!fs.existsSync(outPath))
+            return { violations, coverage };
+        const structure = JSON.parse(fs.readFileSync(outPath, "utf-8"));
+        fs.unlinkSync(outPath);
+        const analysis = (0, flask_detector_1.analyzeFlaskStructure)(structure);
+        if (!analysis.hasFlask)
+            return { violations, coverage };
+        coverage.apps = (structure.apps || []).length + (structure.blueprints || []).length;
+        coverage.routes = (structure.routes || []).length;
+        coverage.filesScanned = structure.filesScanned || 0;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: issue.handler || "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth decorator (@login_required or custom) to the route handler, or register an auth before_request guard.`,
+                policy_ref: "framework-safety.flask",
+            });
+        }
+    }
+    catch { /* best-effort — framework analysis must never break evaluation */ }
+    return { violations, coverage };
+}
 function collectDjangoViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.8",
+  "version": "3.7.10",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -8,7 +8,11 @@
     "c-aliases.json",
     "CHANGELOG.md",
     "docs/Progmune_项目全解.html",
-    "docs/Progmune_投资人白皮书_v2.0.html"
+    "docs/Progmune_投资人白皮书_v2.0.html",
+    "tools/extract_ir.py",
+    "tools/extract_framework_py.py",
+    "tools/extract_framework_django.py",
+    "tools/extract_framework_flask.py"
   ],
   "main": "dist/mcp-server.mjs",
   "bin": {
@@ -110,4 +114,4 @@
     "tsx": "^4.22.4",
     "vitest": "^3.2.6"
   }
-}
+}

package/tools/extract_framework_django.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""
+Django Framework Structure Extractor — 框架结构扫描（M2）
+
+从 Python AST 提取 Django 结构：
+  1) urlpatterns 解析：url()/path()/re_path() → 视图引用（FBV views.foo /
+     CBV Foo.as_view() / include('module.urls') 递归）
+  2) 视图注册表：
+     - FBV：函数装饰器（login_required/permission_required/staff_member_required/
+       user_passes_test/authentication_decorator 等 *auth* 名装饰器）
+     - CBV：基类（APIView/View/generics.*/LoginRequiredMixin/
+       PermissionRequiredMixin）、方法（get/post/put/patch/delete）、
+       @method_decorator、DRF permission_classes（AllowAny/IsAuthenticated/
+       IsAdminUser/其他类名）
+     - @api_view 装饰器：methods + permission_classes kwarg
+  3) 每个 urlpattern → 视图解析（按短名匹配注册表）
+
+输出 JSON：{hasDjango, routes:[{pattern,urlname,view,kind,file}],
+views:{name:{file,decorators,methods,permissionClasses,isDrf,isProtected}},
+filesScanned}
+
+用法：python3 extract_framework_django.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import re
+import sys
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs",
+             "staticfiles", "static"}
+
+AUTH_DECORATORS = {
+    "login_required", "permission_required", "staff_member_required",
+    "user_passes_test", "authentication_decorator", "login_required_decorator",
+    "require_http_methods",
+}
+
+AUTH_MIXINS = {"LoginRequiredMixin", "PermissionRequiredMixin",
+               "UserPassesTestMixin", "StaffMemberRequiredMixin"}
+
+DRF_BASES = {"APIView", "GenericAPIView", "RetrieveAPIView", "ListAPIView",
+             "CreateAPIView", "UpdateAPIView", "DestroyAPIView",
+             "RetrieveUpdateAPIView", "ListCreateAPIView",
+             "RetrieveUpdateDestroyAPIView", "ViewSet", "ModelViewSet",
+             "GenericViewSet", "ReadOnlyModelViewSet"}
+
+MUTATION_METHODS = {"post", "put", "patch", "delete"}
+
+VIEW_BASES = DRF_BASES | {"View", "TemplateView", "FormView", "CreateView",
+                          "UpdateView", "DeleteView", "ListView", "DetailView"}
+
+OPEN_PERMISSIONS = {"AllowAny"}
+
+
+def name_of(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def short_view_name(ref):
+    """views.auth_lab → auth_lab；Foo.as_view() → Foo"""
+    if isinstance(ref, ast.Attribute):
+        return ref.attr
+    if isinstance(ref, ast.Call) and isinstance(ref.func, ast.Attribute):
+        return ref.func.value.attr if isinstance(ref.func.value, ast.Attribute) \
+            else name_of(ref.func.value)
+    if isinstance(ref, ast.Name):
+        return ref.id
+    return None
+
+
+class ViewCollector(ast.NodeVisitor):
+    """收集全部函数/类的视图特征（与 urlpatterns 解耦）"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.fbvs = {}   # name -> {decorators, apiView: [methods]}
+        self.classes = {}  # name -> {bases, methods, decorators, permissionClasses, isDrf, protected}
+
+    def visit_FunctionDef(self, node):
+        self._scan_function(node, async_=False)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan_function(node, async_=True)
+        self.generic_visit(node)
+
+    def _scan_function(self, node, async_):
+        decorators = []
+        api_view_methods = None
+        permission_classes = []
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+                if dec.func.id == "api_view":
+                    if dec.args and isinstance(dec.args[0], (ast.List, ast.Tuple)):
+                        api_view_methods = [
+                            e.value.lower() for e in dec.args[0].elts
+                            if isinstance(e, ast.Constant)
+                        ]
+                    for kw in dec.keywords:
+                        if kw.arg == "permission_classes" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in kw.value.elts if name_of(e)]
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)  # django.views.decorators.login_required
+        self.fbvs[node.name] = {
+            "file": self.file,
+            "decorators": decorators,
+            "apiViewMethods": api_view_methods,
+            "permissionClasses": permission_classes,
+        }
+
+    def visit_ClassDef(self, node):
+        bases = [name_of(b) for b in node.bases if name_of(b)]
+        methods = []
+        permission_classes = []
+        decorators = []
+        for item in node.body:
+            if isinstance(item, ast.FunctionDef) and item.name in (
+                    "get", "post", "put", "patch", "delete", "create",
+                    "update", "destroy", "list", "retrieve"):
+                methods.append(item.name)
+            if isinstance(item, ast.Assign):
+                for t in item.targets:
+                    if isinstance(t, ast.Name) and t.id == "permission_classes":
+                        if isinstance(item.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in item.value.elts if name_of(e)]
+                        elif isinstance(item.value, ast.Name):
+                            permission_classes = [item.value.id]
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)
+        is_drf = any(b in DRF_BASES for b in bases)
+        has_mixin = any(b in AUTH_MIXINS for b in bases)
+        self.classes[node.name] = {
+            "file": self.file,
+            "bases": bases,
+            "methods": methods,
+            "decorators": decorators,
+            "permissionClasses": permission_classes,
+            "isDrf": is_drf,
+            "protectedByMixin": has_mixin,
+        }
+
+
+class UrlCollector(ast.NodeVisitor):
+    """收集 urlpatterns 列表里的视图引用"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.routes = []
+
+    def visit_Assign(self, node):
+        for t in node.targets:
+            if isinstance(t, ast.Name) and t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
+                for elt in node.value.elts:
+                    self._scan_entry(elt)
+        self.generic_visit(node)
+
+    def _scan_entry(self, elt):
+        if not isinstance(elt, ast.Call):
+            return
+        fn = name_of(elt.func)  # url / path / re_path
+        if fn not in ("url", "path", "re_path"):
+            return
+        pattern = ""
+        if elt.args and isinstance(elt.args[0], ast.Constant):
+            pattern = str(elt.args[0].value)
+        view_ref = elt.args[1] if len(elt.args) > 1 else None
+        if view_ref is None:
+            return
+        kind = "other"
+        view_name = None
+        if isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Attribute):
+            if view_ref.func.attr == "as_view":
+                kind = "cbv"
+                view_name = short_view_name(view_ref)
+            elif view_ref.func.id == "include" if isinstance(view_ref.func, ast.Name) else False:
+                kind = "include"
+        if view_name is None:
+            if isinstance(view_ref, ast.Name):
+                kind = "include" if False else "fbv"
+                view_name = view_ref.id
+            elif isinstance(view_ref, ast.Attribute):
+                kind = "fbv"
+                view_name = view_ref.attr
+            elif isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Name):
+                if view_ref.func.id == "include":
+                    kind = "include"
+                else:
+                    kind = "fbv"
+                    view_name = view_ref.func.id
+        urlname = ""
+        for kw in elt.keywords:
+            if kw.arg == "name" and isinstance(kw.value, ast.Constant):
+                urlname = str(kw.value)
+        self.routes.append({
+            "pattern": pattern,
+            "urlname": urlname,
+            "view": view_name,
+            "kind": kind,
+            "file": self.file,
+        })
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root, out = sys.argv[1], sys.argv[2]
+    views, routes, files_scanned = {}, [], 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        try:
+            with open(fp, "r", encoding="utf-8", errors="replace") as f:
+                tree = ast.parse(f.read(), filename=fp)
+        except (SyntaxError, UnicodeDecodeError, OSError):
+            continue
+        vc, uc = ViewCollector(fp), UrlCollector(fp)
+        vc.visit(tree)
+        uc.visit(tree)
+        for name, info in vc.fbvs.items():
+            info["kind"] = "fbv"
+            views[name] = info
+        for name, info in vc.classes.items():
+            info["kind"] = "cbv"
+            views[name] = info
+        routes.extend(uc.routes)
+
+    # 保护判定（扫描器只算事实，规则在 TS 检测器侧）
+    for name, info in views.items():
+        auth_dec = [d for d in info.get("decorators", [])
+                    if d in AUTH_DECORATORS or "auth" in d.lower() or "login" in d.lower()]
+        info["authDecorators"] = auth_dec
+        if info["kind"] == "cbv":
+            pc = info.get("permissionClasses") or []
+            info["openPermission"] = (len(pc) == 0) or all(
+                p in OPEN_PERMISSIONS for p in pc
+            )
+
+    result = {
+        "hasDjango": bool(routes),
+        "routes": routes,
+        "views": views,
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()