progmune-runtime 3.7.8 → 3.7.9

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [3.7.9] — 2026-08-28
+
+### Flask / Fastify / Next.js 框架结构适配（M4——框架适配 7/13）
+
+- **Flask（Python 第 3 个）**：`tools/extract_framework_flask.py`（@app.route/@bp.route + methods kwarg、认证装饰器、before_request 认证守卫、Blueprint）+ `src/frameworks/flask-detector.ts`（`FLASK_ROUTE_NO_AUTH`——mutation 路由无认证装饰器且无认证 before_request 守卫）——合成金标 4 项目 P=R=100%；vendored flask 库结构识别冒烟通过；修复 before_request 误放 Assign 节点（应为 Expr 表达式语句）
+- **Fastify（TS 第 3 个）**：`src/frameworks/fastify-detector.ts`（代码串级，镜像 express-detector——路由注册 + preHandler/preValidation 认证选项 + addHook 认证钩子；`FASTIFY_ROUTE_NO_AUTH`）；引擎冒烟：钩子保护正确识别（0 误报）；8 个单测
+- **Next.js（TS 第 4 个）**：`src/frameworks/nextjs-detector.ts`（App Router 文件级结构——route.ts 的 POST/PUT/PATCH/DELETE 导出 + next-auth/自定义认证调用 + 认证 middleware；`NEXT_ROUTE_NO_AUTH`）——7 个单测；pages/api 旧式 handler 方法不可静态区分（只计数如实）；修复注释内 `app/**/route.ts` 的 `*/` 提前终止块注释陷阱
+- **引擎接线**：collectFlaskViolations / collectFastifyViolations / collectNextjsViolations + overall 三个 coverage 字段——全部加性 best-effort；frameworks/index.ts barrel 补 5 个适配器导出
+- **验证**：新单测 21 个；全相关套件 160/160；Python 盲测 v1.2 64 零漂移；fastapi/django realworld 0 FP 保持；C 演示不变
+- **边界（如实）**：Flask 认证 before_request 按函数名词汇识别（自定义名漏判=漏报方向）；Fastify 代码串级（配置展开不可见）；Next.js 只盯 API 面（route.ts/pages-api，页面组件不检查）；npm 安装态 tools/ 不在包内→Python 框架扫描静默降级（既有遗留）
+
 ## [3.7.8] — 2026-08-28
 
 ### Django / DRF 框架结构适配（M2）——框架适配第 4 个

package/README.md

@@ -108,7 +108,7 @@ Progmune is honest about what it can and cannot verify.
 
 **Multi-language IR (registry-based).** TypeScript (ts-morph) and Python (AST) extractors are registered entries in one registry (`src/extract-project-ir.ts`); `extractProjectIR` merges every detected language into a single function IR shared by the agent loop, `execute()`, and the MCP server — the agent composes function-protocol chains across both languages. Adding a language (Go, Java, …) = register one extractor entry; callers don't change.
 
-**Framework adapters: 4/13.** Express ✅, tRPC ✅, FastAPI ✅ (route/auth-dependency structural analysis — every mutation route checked for auth dependencies, dead auth schemes flagged) and Django ✅ (urlconf/CBV/DRF structural analysis — unprotected mutation views and `AllowAny` write endpoints flagged) have dedicated detectors; Next.js has version-aware governance; NestJS is partial. Next.js/Fastify/Flask and 5 more remain — framework adaptation is the #1 product gap.
+**Framework adapters: 7/13.** Express ✅, tRPC ✅, FastAPI ✅, Django ✅ (structural route-level auth analysis — every mutation route checked for auth), Flask ✅ (route/before_request auth guard analysis), Fastify ✅ (route preHandler/hook auth analysis) and Next.js ✅ (App Router route-handler auth analysis) have dedicated detectors; NestJS is partial. Next.js version-aware governance also exists. Spring Boot/Go frameworks and a few TS frameworks remain — framework adaptation is the #1 product gap.
 
 ### What Progmune does NOT cover (honest boundaries)
 
@@ -234,7 +234,7 @@ High-impact contribution areas:
 - **Runtime Pipeline:** Detect → Explain → Repair → Validate (L1–L4)
 - **Trust Engine:** 4-dimension scoring with binary explainability gate
 - **MCP Tools:** 19 — `progmune_trust_check`, `progmune_score`, `progmune_policy_check`, `progmune_certify`, and more
-- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, NestJS partial (4/13)
+- **Framework Adapters:** Express ✅, tRPC ✅, FastAPI ✅, Django ✅, Flask ✅, Fastify ✅, Next.js ✅, NestJS partial (7/13)
 - **Knowledge Base:** 31 domains, 148 protocol rules, 22 detectors, 26 safeguards, PLSB 13/13 categories — plus 15 source-level detection rules (Python)
 - **Corpus:** 2,500+ trajectories across 6+ repositories; blind benchmarks 100 (TS) + 90 (Python) projects; real-world validation on 4 application repos
 - **Current focus:** Enterprise PoC validation + remaining framework-internal boundary FPs

package/README.zh-CN.md

@@ -108,7 +108,7 @@ Progmune 对能验证什么、不能验证什么保持诚实。
 
 **多语言 IR（注册表式）。** TypeScript（ts-morph）与 Python（AST）提取器是同一注册表（`src/extract-project-ir.ts`）中的注册项；`extractProjectIR` 把检测到的所有语言合并为一份函数 IR，由 agent loop、`execute()` 与 MCP server 共享——agent 可在两种语言上编排函数协议链。新增语言（Go、Java……）= 注册一条提取器，调用方零改动。
 
-**框架适配器：4/13。** Express ✅、tRPC ✅、FastAPI ✅（路由/认证依赖结构分析——逐条检查写操作路由的认证依赖、标记死认证方案）与 Django ✅（URL 配置/CBV/DRF 结构分析——标记无保护的写视图与 `AllowAny` 写端点）有专用检测器；Next.js 有版本感知治理；NestJS 部分支持。Next.js/Fastify/Flask 及另外 5 个待适配——框架适配是 #1 产品缺口。
+**框架适配器：7/13。** Express ✅、tRPC ✅、FastAPI ✅、Django ✅（结构级路由认证分析——逐条检查写操作入口的认证）、Flask ✅（路由/before_request 认证守卫分析）、Fastify ✅（路由 preHandler/钩子认证分析）与 Next.js ✅（App Router 路由处理器认证分析）有专用检测器；NestJS 部分支持，Next.js 另有版本感知治理。Spring Boot、Go 框架及少数 TS 框架待适配——框架适配是 #1 产品缺口。
 
 ### Progmune 不覆盖什么（诚实边界）
 
@@ -233,7 +233,7 @@ Progmune 建立在"**LLM 输出是统计表演而非推理**"这一前提上—
 - **运行时管线：** 检测 → 解释 → 修复 → 验证（L1–L4）
 - **信任引擎：** 四维评分 + 二元可解释性门
 - **MCP 工具：** 19 个——`progmune_trust_check`、`progmune_score`、`progmune_policy_check`、`progmune_certify` 等
-- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、NestJS 部分（4/13）
+- **框架适配器：** Express ✅、tRPC ✅、FastAPI ✅、Django ✅、Flask ✅、Fastify ✅、Next.js ✅、NestJS 部分（7/13）
 - **知识库：** 31 个域、148 条协议规则、22 个检测器、26 条防护规则、PLSB 13/13 类别——另加 15 条源码级检测规则（Python）
 - **语料：** 6+ 仓库 2,500+ 轨迹；盲测基准 100（TS）+ 90（Python）个项目；4 个应用仓库真实验证
 - **当前重点：** 企业 PoC 验证 + 剩余框架内部边界误报

package/dist/frameworks/fastify-detector.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Fastify Framework Adapter — Protocol Detection for Fastify
+ *
+ * 第 6 个框架适配（TS/JS 第 3 个专用检测器，镜像 express-detector 的
+ * 代码串分析风格）：
+ *
+ *   fastify.get('/x', { preHandler: [auth] }, handler)  路由级认证选项
+ *   fastify.addHook('preHandler', authFn)               全局认证钩子
+ *
+ * 规则：
+ *   FASTIFY_ROUTE_NO_AUTH        mutation 路由注册（post/put/patch/delete）
+ *                                无 preHandler/preValidation 认证选项，
+ *                                且文件中无认证 addHook——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 是读操作不检查（公开读是常见设计）
+ *   - 认证钩子函数按名字词表识别（auth/login/permission/token/session…）；
+ *     自定义认证函数若名字不含词表会漏判（保守方向是漏报不是误报）
+ *   - 认证入口路径按词汇豁免（login/regist/auth/token/health）
+ *   - 代码串级分析（与 Express 检测器同款）：装饰器/配置展开不可见
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFastifyApp = analyzeFastifyApp;
+exports.analyzeFastifyFile = analyzeFastifyFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级，镜像 express-detector） ──
+function analyzeFastifyApp(code) {
+    const issues = [];
+    const routes = [];
+    const authHooks = [];
+    const hasFastify = /\bFastify\b|\bfastify\b/.test(code);
+    if (!hasFastify) {
+        return { hasFastify: false, routes, authHooks, issues };
+    }
+    // 全局认证钩子：addHook('preHandler'|'preValidation'|'onRequest', authFn)
+    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*)/g;
+    let m;
+    while ((m = hookRe.exec(code)) !== null) {
+        if (isAuthFnName(m[2]))
+            authHooks.push(m[2]);
+    }
+    // 路由注册：fastify.post('/x', {...}, handler) —— 捕获到 options 窗口
+    const routeRe = /\.(get|post|put|patch|delete|route)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        // 从路由调用起点向后截取 400 字符窗口，查 preHandler/preValidation 选项
+        const windowStart = m.index;
+        const window = code.slice(windowStart, windowStart + 400);
+        const hasAuthOption = /\b(preHandler|preValidation)\s*:/g.test(window)
+            && (() => {
+                // 选项值里出现 auth-like 函数名才认（保守）
+                const optMatch = window.match(/\b(preHandler|preValidation)\s*:\s*\[([^\]]*)\]/);
+                if (!optMatch)
+                    return false;
+                return optMatch[2].split(",").some((name) => isAuthFnName(name.trim()));
+            })();
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthOption,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthOption
+            && authHooks.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "FASTIFY_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} is registered without ` +
+                    `preHandler/preValidation auth and the app has no auth hook — ` +
+                    `any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasFastify: true, routes, authHooks, issues };
+}
+function analyzeFastifyFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)/.test(code))
+        return null;
+    return analyzeFastifyApp(code);
+}

package/dist/frameworks/fastify-detector.test.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * fastify-detector.test.ts — Fastify 框架适配器规则回归（纯函数，无文件 I/O）
+ *
+ * 代码串级分析（镜像 express-detector）：路由注册 + preHandler/preValidation
+ * 认证选项 + addHook 认证钩子。
+ */
+const vitest_1 = require("vitest");
+const fastify_detector_1 = require("./fastify-detector");
+const app = (routes, hooks = "") => `
+import Fastify from "fastify";
+const fastify = Fastify();
+${routes}
+${hooks}
+`;
+(0, vitest_1.describe)("fastify-detector", () => {
+    (0, vitest_1.it)("R1：无保护 mutation 路由 → FASTIFY_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/transfer", async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTIFY_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：preHandler 认证选项保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/transfer", { preHandler: [authenticate] }, async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：preValidation 认证选项保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.put("/update", { preValidation: [checkToken] }, async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：addHook 认证钩子全局保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`fastify.post("/transfer", async (req, reply) => ({ ok: true }));`, `fastify.addHook("preHandler", authenticate);`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证 addHook（如日志）不视为保护", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`fastify.post("/transfer", async (req, reply) => ({ ok: true }));`, `fastify.addHook("onRequest", logRequest);`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTIFY_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.get("/articles", async (req, reply) => ({ items: [] }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/regist/token 认证入口路径不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/login", async (req, reply) => ({ token: "t" }));
+fastify.post("/register", async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Fastify 代码不产生任何问题", () => {
+        const { hasFastify, issues } = (0, fastify_detector_1.analyzeFastifyApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasFastify).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/flask-detector.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Flask Framework Adapter — Protocol Detection for Flask
+ *
+ * 第 5 个框架适配（Python 第 3 个）：结构扫描由 tools/extract_framework_flask.py
+ * （Python AST）完成——@app.route/@bp.route、methods kwarg、认证装饰器、
+ * before_request 认证守卫、Blueprint。
+ * 本模块消费结构 JSON 做规则判定：
+ *
+ *   FLASK_ROUTE_NO_AUTH         mutation 路由（methods 含 POST/PUT/PATCH/
+ *                               DELETE）无认证装饰器，且项目无认证
+ *                               before_request 守卫——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - @app.route 缺省 methods = GET only（Flask 语义）——公开读不检查
+ *   - 认证 before_request 按函数名词汇识别（auth/login/permission 等）；
+ *     自定义守卫函数若名字不含词表会漏判（保守方向是漏报不是误报）
+ *   - 认证入口端点按 处理器名+路径 词汇豁免（login/regist/token/health）
+ *   - Blueprint 内的 before_request 与 app 级同权重（项目内任一认证守卫
+ *     存在即视为全局保护信号）
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFlaskStructure = analyzeFlaskStructure;
+const MUTATION_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+function isAuthEntry(route) {
+    const haystack = `${route.handler} ${route.path}`.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => haystack.includes(w));
+}
+function analyzeFlaskStructure(data) {
+    if (!data.hasFlask || !Array.isArray(data.routes)) {
+        return { hasFlask: false, issues: [] };
+    }
+    const issues = [];
+    const hasGlobalAuthGuard = (data.beforeRequestAuth || []).length > 0;
+    for (const route of data.routes) {
+        const isMutation = (route.methods || []).some((m) => MUTATION_METHODS.has(m));
+        if (!isMutation)
+            continue;
+        const hasAuthDecorator = (route.authDecorators || []).length > 0;
+        if (hasAuthDecorator || hasGlobalAuthGuard)
+            continue;
+        if (isAuthEntry(route))
+            continue;
+        issues.push({
+            severity: "medium",
+            rule: "FLASK_ROUTE_NO_AUTH",
+            message: `Route ${(route.methods || []).join("/")} ${route.path || "(root)"} has no ` +
+                `auth decorator and the app has no auth before_request guard — any ` +
+                `visitor can invoke "${route.handler}".`,
+            route: `${(route.methods || []).join("/")} ${route.path || "(root)"}`,
+            handler: route.handler,
+            file: route.file,
+            line: route.line,
+        });
+    }
+    return { hasFlask: true, issues };
+}

package/dist/frameworks/flask-detector.test.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * flask-detector.test.ts — Flask 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const flask_detector_1 = require("./flask-detector");
+function structure(partial) {
+    return {
+        hasFlask: true,
+        apps: ["app"],
+        blueprints: [],
+        routes: [],
+        beforeRequestAuth: [],
+        filesScanned: 1,
+        ...partial,
+    };
+}
+const route = (p) => ({
+    methods: p.methods,
+    path: p.path || "",
+    handler: p.handler,
+    file: "app.py",
+    line: 1,
+    target: "app",
+    authDecorators: p.authDecorators || [],
+});
+(0, vitest_1.describe)("flask-detector", () => {
+    (0, vitest_1.it)("R1：无保护 mutation 路由 → FLASK_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({ methods: ["POST"], handler: "transfer_money" })],
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FLASK_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：@login_required 保护不报", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({
+                    methods: ["POST"], handler: "transfer_money",
+                    authDecorators: ["login_required"],
+                })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：before_request 认证守卫存在时不报（全局保护）", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            beforeRequestAuth: ["authenticate"],
+            routes: [route({ methods: ["POST"], handler: "transfer_money" })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：缺省 methods 的 GET 路由不报（Flask 缺省=GET only）", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({ methods: ["GET"], handler: "home" })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/regist 认证入口端点不报", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [
+                route({ methods: ["POST"], path: "/login", handler: "login" }),
+                route({ methods: ["POST"], path: "/register", handler: "register_user" }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Flask 结构不产生任何问题", () => {
+        const { hasFlask, issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({ hasFlask: false, routes: [] }));
+        (0, vitest_1.expect)(hasFlask).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -8,11 +8,11 @@
  * Each adapter knows the API surface of a specific framework:
  * middleware chains, route handlers, dependency injection, guards, etc.
  *
- * Current: Express.js (first adapter — broke the 0/13 gap)
- * Planned: Next.js, NestJS, Fastify, FastAPI, Django
+ * Adapters: Express, tRPC, NestJS(partial), FastAPI, Django, Flask, Fastify,
+ * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -22,6 +22,18 @@ Object.defineProperty(exports, "extractRoutes", { enumerable: true, get: functio
 Object.defineProperty(exports, "extractGlobalMiddleware", { enumerable: true, get: function () { return express_detector_1.extractGlobalMiddleware; } });
 Object.defineProperty(exports, "classifyMiddleware", { enumerable: true, get: function () { return express_detector_1.classifyMiddleware; } });
 Object.defineProperty(exports, "formatExpressReport", { enumerable: true, get: function () { return express_detector_1.formatExpressReport; } });
+var fastapi_detector_1 = require("./fastapi-detector");
+Object.defineProperty(exports, "analyzeFastapiStructure", { enumerable: true, get: function () { return fastapi_detector_1.analyzeFastapiStructure; } });
+var django_detector_1 = require("./django-detector");
+Object.defineProperty(exports, "analyzeDjangoStructure", { enumerable: true, get: function () { return django_detector_1.analyzeDjangoStructure; } });
+var flask_detector_1 = require("./flask-detector");
+Object.defineProperty(exports, "analyzeFlaskStructure", { enumerable: true, get: function () { return flask_detector_1.analyzeFlaskStructure; } });
+var fastify_detector_1 = require("./fastify-detector");
+Object.defineProperty(exports, "analyzeFastifyApp", { enumerable: true, get: function () { return fastify_detector_1.analyzeFastifyApp; } });
+Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: function () { return fastify_detector_1.analyzeFastifyFile; } });
+var nextjs_detector_1 = require("./nextjs-detector");
+Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
+Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
 // ── Framework Version-Aware Governance ──
 var version_awareness_1 = require("./version-awareness");
 Object.defineProperty(exports, "detectFrameworks", { enumerable: true, get: function () { return version_awareness_1.detectFrameworks; } });

package/dist/frameworks/nextjs-detector.js

@@ -0,0 +1,172 @@
+"use strict";
+/**
+ * Next.js Framework Adapter — App Router route handler analysis
+ *
+ * 第 7 个框架适配（TS/JS 第 4 个专用检测器）。Next.js 的「路由」是文件
+ * 而不是代码声明：app 下各段的 route.ts 每个导出 POST/PUT/PATCH/DELETE 的文件
+ * 就是一个对外写入口。本模块做文件级结构扫描：
+ *
+ *   mutation 导出       export function POST/PUT/PATCH/DELETE(...)
+ *   路由级认证信号      route.ts 内调用 next-auth（getServerSession/auth()）
+ *                       或自定义认证（requireAuth/verifyToken/getToken/
+ *                       withAuth/isAuthenticated 等）
+ *   全局认证信号        middleware.ts（项目根或 src/）内容命中认证词表
+ *
+ * 规则：
+ *   NEXT_ROUTE_NO_AUTH        mutation 路由文件无路由级认证调用，且项目
+ *                             无认证 middleware——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - GET 导出不检查（公开读是常见设计）
+ *   - 认证信号按词表识别；自定义认证名不含词表会漏判（保守方向是漏报）
+ *   - 认证入口路径按词汇豁免（login/regist/auth/token）
+ *   - Server Components / page.tsx 的非 API 页面不检查（只盯 route.ts
+ *     与 pages/api——对外 API 面）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeNextApp = analyzeNextApp;
+exports.readNextMiddleware = readNextMiddleware;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const MUTATION_EXPORTS = ["POST", "PUT", "PATCH", "DELETE"];
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate)\s*\(/;
+const AUTH_MIDDLEWARE_RE = /\b(getServerSession|requireAuth|verifyToken|getToken|withAuth|next-auth|authorization|authenticate)\b/;
+function isAuthEntryFile(relFile) {
+    const lower = relFile.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis ──
+/**
+ * 扫描 Next.js 项目的 API 路由文件（app 下各段的 route.ts + pages/api 下各段）。
+ * @param projectRoot — 项目根目录
+ * @param middlewareCode — middleware.ts 内容（调用方预读，可为空）
+ */
+function analyzeNextApp(projectRoot, middlewareCode) {
+    const routeFiles = [];
+    const issues = [];
+    let legacyApiFiles = 0; // pages/api 旧式 handler（方法不可静态区分，只计数）
+    const hasAuthMiddleware = !!middlewareCode && AUTH_MIDDLEWARE_RE.test(middlewareCode);
+    const candidates = [];
+    for (const base of ["app", "src/app"]) {
+        const dir = path.join(projectRoot, base);
+        if (fs.existsSync(dir)) {
+            collectRouteFiles(dir, candidates);
+        }
+    }
+    const pagesApi = path.join(projectRoot, "pages", "api");
+    if (fs.existsSync(pagesApi)) {
+        collectRouteFiles(pagesApi, candidates);
+    }
+    for (const file of candidates) {
+        let code;
+        try {
+            code = fs.readFileSync(file, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const mutations = [];
+        for (const m of MUTATION_EXPORTS) {
+            if (new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(code)) {
+                mutations.push(m);
+            }
+        }
+        if (mutations.length === 0) {
+            legacyApiFiles++;
+            continue;
+        }
+        const hasAuthCall = AUTH_CALL_RE.test(code);
+        const rel = path.relative(projectRoot, file);
+        routeFiles.push({ file: rel, mutations, hasAuthCall });
+        if (!hasAuthCall && !hasAuthMiddleware && !isAuthEntryFile(rel)) {
+            issues.push({
+                severity: "medium",
+                rule: "NEXT_ROUTE_NO_AUTH",
+                message: `API route ${rel} exports ${mutations.join("/")} without an auth ` +
+                    `check in the handler and the project has no auth middleware — ` +
+                    `any caller can reach it.`,
+                route: rel,
+                file: rel,
+            });
+        }
+    }
+    return {
+        hasNext: routeFiles.length > 0 || legacyApiFiles > 0 || !!middlewareCode,
+        routeFiles,
+        hasAuthMiddleware,
+        issues,
+    };
+}
+function collectRouteFiles(dir, out) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            collectRouteFiles(full, out);
+        }
+        else if (e.isFile() && e.name === "route.ts") {
+            out.push(full);
+        }
+        else if (e.isFile() && /\.(ts|js)$/.test(e.name) && dir.includes("pages" + path.sep + "api")) {
+            out.push(full);
+        }
+    }
+}
+/** 读取项目的 middleware 代码（根或 src/） */
+function readNextMiddleware(projectRoot) {
+    for (const rel of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
+        const p = path.join(projectRoot, rel);
+        if (fs.existsSync(p)) {
+            try {
+                return fs.readFileSync(p, "utf-8");
+            }
+            catch {
+                return undefined;
+            }
+        }
+    }
+    return undefined;
+}

package/dist/frameworks/nextjs-detector.test.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * nextjs-detector.test.ts — Next.js App Router 适配器规则回归（文件系统 I/O，
+ * 使用临时目录夹具——与 express-detector.test.ts 同款风格）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const nextjs_detector_1 = require("./nextjs-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "nextjs-det-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function writeRoute(rel, code) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, code);
+}
+const MUTATION_ROUTE = `export async function POST(req: Request) {
+  return Response.json({ ok: true });
+}
+`;
+const AUTHED_ROUTE = `import { getServerSession } from "next-auth";
+export async function POST(req: Request) {
+  const session = await getServerSession();
+  return Response.json({ ok: true });
+}
+`;
+const AUTH_MIDDLEWARE = `import { withAuth } from "next-auth/middleware";
+export default withAuth(function middleware(req) {});
+`;
+(0, vitest_1.describe)("nextjs-detector", () => {
+    (0, vitest_1.it)("R1：无认证 mutation 路由文件 → NEXT_ROUTE_NO_AUTH", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("NEXT_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由内 getServerSession 认证调用保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", AUTHED_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：认证 middleware 全局保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        writeRoute("middleware.ts", AUTH_MIDDLEWARE);
+        const mw = (0, nextjs_detector_1.readNextMiddleware)(dir);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir, mw);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：GET 导出不报（公开读）", () => {
+        writeRoute("app/api/articles/route.ts", `export async function GET() { return Response.json([]); }`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/auth 认证入口路径不报", () => {
+        writeRoute("app/api/auth/login/route.ts", MUTATION_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("pages/api 旧式路由同样覆盖", () => {
+        writeRoute("pages/api/transfer.ts", `export default function handler(req, res) { res.json({ok:true}); }`);
+        // 无 export function POST 的旧式 handler 不识别方法 → 无 flag（口径如实）
+        writeRoute("pages/api/transfer2.ts", `export default async function POST(req: Request) { return Response.json({}); }`);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        // transfer2 无 POST 导出匹配（default 导出非具名）——旧式页路由方法不可静态区分，如实
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("无 Next.js 结构的目录不产生问题", () => {
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.8";
+exports.RUNTIME_VERSION = "3.7.9";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/dist/trust/engine.js

@@ -64,6 +64,9 @@ const annotation_suggest_1 = require("../annotation-suggest");
 const call_graph_propagator_1 = require("./call-graph-propagator");
 const fastapi_detector_1 = require("../frameworks/fastapi-detector");
 const django_detector_1 = require("../frameworks/django-detector");
+const flask_detector_1 = require("../frameworks/flask-detector");
+const fastify_detector_1 = require("../frameworks/fastify-detector");
+const nextjs_detector_1 = require("../frameworks/nextjs-detector");
 const ssg_bridge_1 = require("./ssg-bridge");
 const call_sequence_1 = require("../call-sequence");
 const extract_ir_1 = require("../extract-ir");
@@ -96,6 +99,9 @@ async function evaluateTrust(ctx) {
     const trpcResult = collectTRPCViolations(ctx);
     const fastapiResult = collectFastapiViolations(ctx);
     const djangoResult = collectDjangoViolations(ctx);
+    const flaskResult = collectFlaskViolations(ctx);
+    const fastifyResult = collectFastifyViolations(ctx);
+    const nextjsResult = collectNextjsViolations(ctx);
     const coverageData = collectVerificationCoverage(ctx);
     const governanceDefects = collectGovernanceDefects(ctx);
     // ═══════════════════════════════════════
@@ -115,6 +121,9 @@ async function evaluateTrust(ctx) {
         ...trpcResult.violations,
         ...fastapiResult.violations,
         ...djangoResult.violations,
+        ...flaskResult.violations,
+        ...fastifyResult.violations,
+        ...nextjsResult.violations,
     ];
     // ═══════════════════════════════════════
     //  PHASE 3: SCORE
@@ -252,6 +261,33 @@ async function evaluateTrust(ctx) {
                     issuesFound: djangoResult.violations.length,
                 }
                 : undefined,
+            /** Flask framework adapter coverage — route/auth-guard analysis */
+            flaskCoverage: flaskResult.coverage.routes > 0
+                ? {
+                    appsDetected: flaskResult.coverage.apps,
+                    totalRoutes: flaskResult.coverage.routes,
+                    filesScanned: flaskResult.coverage.filesScanned,
+                    issuesFound: flaskResult.violations.length,
+                }
+                : undefined,
+            /** Fastify framework adapter coverage — route/auth-hook analysis */
+            fastifyCoverage: fastifyResult.coverage.routes > 0
+                ? {
+                    appsDetected: fastifyResult.coverage.apps,
+                    totalRoutes: fastifyResult.coverage.routes,
+                    filesScanned: fastifyResult.coverage.filesScanned,
+                    issuesFound: fastifyResult.violations.length,
+                }
+                : undefined,
+            /** Next.js framework adapter coverage — App Router route handler analysis */
+            nextjsCoverage: nextjsResult.coverage.routes > 0
+                ? {
+                    appsDetected: nextjsResult.coverage.apps,
+                    totalRoutes: nextjsResult.coverage.routes,
+                    filesScanned: nextjsResult.coverage.filesScanned,
+                    issuesFound: nextjsResult.violations.length,
+                }
+                : undefined,
         },
         dimensions: {
             policyCompliance: {
@@ -390,6 +426,129 @@ function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
  * Collect Express-specific security violations from the framework detector.
  * Maps ExpressSecurityIssue[] → TrustViolation[].
  */
+function collectNextjsViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const middlewareCode = (0, nextjs_detector_1.readNextMiddleware)(ctx.projectPath);
+        const analysis = (0, nextjs_detector_1.analyzeNextApp)(ctx.projectPath, middlewareCode);
+        if (!analysis.hasNext)
+            return { violations, coverage };
+        coverage.apps = 1;
+        coverage.routes = analysis.routeFiles.length;
+        coverage.filesScanned = analysis.routeFiles.length;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth check inside the route handler (e.g. getServerSession) or protect the app with auth middleware.`,
+                policy_ref: "framework-safety.nextjs",
+            });
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFastifyViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    try {
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "routes", "lib"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                coverage.filesScanned++;
+                try {
+                    const analysis = (0, fastify_detector_1.analyzeFastifyFile)(file);
+                    if (!analysis || !analysis.hasFastify)
+                        continue;
+                    coverage.apps++;
+                    coverage.routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        violations.push({
+                            severity: issue.severity === "low" ? "low" : issue.severity,
+                            rule_id: issue.rule,
+                            file: path.relative(ctx.projectPath, file),
+                            function: "unknown",
+                            message: issue.message,
+                            evidence: issue.route || "",
+                            why: `Framework structural analysis: ${issue.message}`,
+                            fix: `Add preHandler/preValidation auth to the route options, or register an auth addHook.`,
+                            policy_ref: "framework-safety.fastify",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage };
+}
+function collectFlaskViolations(ctx) {
+    const violations = [];
+    const coverage = { apps: 0, routes: 0, filesScanned: 0 };
+    // 仅 Python 项目跑框架结构扫描
+    const lang = ctx.language || "typescript";
+    if (lang !== "python")
+        return { violations, coverage };
+    try {
+        const { execSync } = require("child_process");
+        const fs = require("fs");
+        const os = require("os");
+        // engine.js 位于 dist/trust/ → 仓库根 tools/ 需要两级向上
+        const scriptPath = path.resolve(__dirname, "..", "..", "tools", "extract_framework_flask.py");
+        const outPath = path.join(os.tmpdir(), `progmune-fwfl-${process.pid}-${Date.now()}.json`);
+        execSync(`python3 "${scriptPath}" "${ctx.projectPath}" "${outPath}"`, {
+            encoding: "utf-8",
+            stdio: "pipe",
+            timeout: 60000,
+        });
+        if (!fs.existsSync(outPath))
+            return { violations, coverage };
+        const structure = JSON.parse(fs.readFileSync(outPath, "utf-8"));
+        fs.unlinkSync(outPath);
+        const analysis = (0, flask_detector_1.analyzeFlaskStructure)(structure);
+        if (!analysis.hasFlask)
+            return { violations, coverage };
+        coverage.apps = (structure.apps || []).length + (structure.blueprints || []).length;
+        coverage.routes = (structure.routes || []).length;
+        coverage.filesScanned = structure.filesScanned || 0;
+        for (const issue of analysis.issues) {
+            violations.push({
+                severity: issue.severity === "low" ? "low" : issue.severity,
+                rule_id: issue.rule,
+                file: issue.file || "",
+                function: issue.handler || "unknown",
+                message: issue.message,
+                evidence: issue.route || "",
+                why: `Framework structural analysis: ${issue.message}`,
+                fix: `Add an auth decorator (@login_required or custom) to the route handler, or register an auth before_request guard.`,
+                policy_ref: "framework-safety.flask",
+            });
+        }
+    }
+    catch { /* best-effort — framework analysis must never break evaluation */ }
+    return { violations, coverage };
+}
 function collectDjangoViolations(ctx) {
     const violations = [];
     const coverage = { apps: 0, routes: 0, filesScanned: 0 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.8",
+  "version": "3.7.9",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",