progmune-runtime 3.7.9 → 3.7.10

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [3.7.10] — 2026-09-01
+
+### 安装态 Python 全链路修复（npm 包正确性）
+
+- **修复**：`tools/extract_ir.py` + 三个框架扫描器（`extract_framework_py.py` / `extract_framework_django.py` / `extract_framework_flask.py`）加入 npm 包 `files` 白名单——**此前安装态（MCP 主产品形态）的 Python IR 提取与框架结构扫描全部静默失效**（脚本不在包内，execSync 失败被 best-effort 吞掉）。M1/M2 验证时发现的既有遗留，非 3.7.8/3.7.9 引入
+- **安装态端到端验证**（此前从未有过）：打包 tarball → 临时目录 npm install → 用安装态的 dist 跑 evaluateTrust——FastAPI 合成项目检出 `FASTAPI_ROUTE_NO_AUTH`（框架扫描生效）、Python 盲测项目检出 SSG 违规（IR 提取生效）、**安装态与仓库态 A/B 完全一致**；`tools/__pycache__` 未入包（files 精确文件路径）
+- **落地页**：语言覆盖现状更新入版（C 注解驱动 Beta 行 + 框架适配 7/13 行 + 双语 i18n + 证据链接）
+- 包体：377 文件（+4 个 .py，约 71.5KB）
+
 ## [3.7.9] — 2026-08-28
 
 ### Flask / Fastify / Next.js 框架结构适配（M4——框架适配 7/13）

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.9";
+exports.RUNTIME_VERSION = "3.7.10";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "progmune-runtime",
-  "version": "3.7.9",
+  "version": "3.7.10",
   "description": "Progmune — AI Trust Decision Engine. Verify AI-generated code before it reaches production. Outputs APPROVED / NEEDS_REVIEW / BLOCKED with evidence.",
   "files": [
     "dist/",
@@ -8,7 +8,11 @@
     "c-aliases.json",
     "CHANGELOG.md",
     "docs/Progmune_项目全解.html",
-    "docs/Progmune_投资人白皮书_v2.0.html"
+    "docs/Progmune_投资人白皮书_v2.0.html",
+    "tools/extract_ir.py",
+    "tools/extract_framework_py.py",
+    "tools/extract_framework_django.py",
+    "tools/extract_framework_flask.py"
   ],
   "main": "dist/mcp-server.mjs",
   "bin": {
@@ -110,4 +114,4 @@
     "tsx": "^4.22.4",
     "vitest": "^3.2.6"
   }
-}
+}

package/tools/extract_framework_django.py

@@ -0,0 +1,269 @@
+#!/usr/bin/env python3
+"""
+Django Framework Structure Extractor — 框架结构扫描（M2）
+
+从 Python AST 提取 Django 结构：
+  1) urlpatterns 解析：url()/path()/re_path() → 视图引用（FBV views.foo /
+     CBV Foo.as_view() / include('module.urls') 递归）
+  2) 视图注册表：
+     - FBV：函数装饰器（login_required/permission_required/staff_member_required/
+       user_passes_test/authentication_decorator 等 *auth* 名装饰器）
+     - CBV：基类（APIView/View/generics.*/LoginRequiredMixin/
+       PermissionRequiredMixin）、方法（get/post/put/patch/delete）、
+       @method_decorator、DRF permission_classes（AllowAny/IsAuthenticated/
+       IsAdminUser/其他类名）
+     - @api_view 装饰器：methods + permission_classes kwarg
+  3) 每个 urlpattern → 视图解析（按短名匹配注册表）
+
+输出 JSON：{hasDjango, routes:[{pattern,urlname,view,kind,file}],
+views:{name:{file,decorators,methods,permissionClasses,isDrf,isProtected}},
+filesScanned}
+
+用法：python3 extract_framework_django.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import re
+import sys
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs",
+             "staticfiles", "static"}
+
+AUTH_DECORATORS = {
+    "login_required", "permission_required", "staff_member_required",
+    "user_passes_test", "authentication_decorator", "login_required_decorator",
+    "require_http_methods",
+}
+
+AUTH_MIXINS = {"LoginRequiredMixin", "PermissionRequiredMixin",
+               "UserPassesTestMixin", "StaffMemberRequiredMixin"}
+
+DRF_BASES = {"APIView", "GenericAPIView", "RetrieveAPIView", "ListAPIView",
+             "CreateAPIView", "UpdateAPIView", "DestroyAPIView",
+             "RetrieveUpdateAPIView", "ListCreateAPIView",
+             "RetrieveUpdateDestroyAPIView", "ViewSet", "ModelViewSet",
+             "GenericViewSet", "ReadOnlyModelViewSet"}
+
+MUTATION_METHODS = {"post", "put", "patch", "delete"}
+
+VIEW_BASES = DRF_BASES | {"View", "TemplateView", "FormView", "CreateView",
+                          "UpdateView", "DeleteView", "ListView", "DetailView"}
+
+OPEN_PERMISSIONS = {"AllowAny"}
+
+
+def name_of(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def short_view_name(ref):
+    """views.auth_lab → auth_lab；Foo.as_view() → Foo"""
+    if isinstance(ref, ast.Attribute):
+        return ref.attr
+    if isinstance(ref, ast.Call) and isinstance(ref.func, ast.Attribute):
+        return ref.func.value.attr if isinstance(ref.func.value, ast.Attribute) \
+            else name_of(ref.func.value)
+    if isinstance(ref, ast.Name):
+        return ref.id
+    return None
+
+
+class ViewCollector(ast.NodeVisitor):
+    """收集全部函数/类的视图特征（与 urlpatterns 解耦）"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.fbvs = {}   # name -> {decorators, apiView: [methods]}
+        self.classes = {}  # name -> {bases, methods, decorators, permissionClasses, isDrf, protected}
+
+    def visit_FunctionDef(self, node):
+        self._scan_function(node, async_=False)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan_function(node, async_=True)
+        self.generic_visit(node)
+
+    def _scan_function(self, node, async_):
+        decorators = []
+        api_view_methods = None
+        permission_classes = []
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+                if dec.func.id == "api_view":
+                    if dec.args and isinstance(dec.args[0], (ast.List, ast.Tuple)):
+                        api_view_methods = [
+                            e.value.lower() for e in dec.args[0].elts
+                            if isinstance(e, ast.Constant)
+                        ]
+                    for kw in dec.keywords:
+                        if kw.arg == "permission_classes" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in kw.value.elts if name_of(e)]
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)  # django.views.decorators.login_required
+        self.fbvs[node.name] = {
+            "file": self.file,
+            "decorators": decorators,
+            "apiViewMethods": api_view_methods,
+            "permissionClasses": permission_classes,
+        }
+
+    def visit_ClassDef(self, node):
+        bases = [name_of(b) for b in node.bases if name_of(b)]
+        methods = []
+        permission_classes = []
+        decorators = []
+        for item in node.body:
+            if isinstance(item, ast.FunctionDef) and item.name in (
+                    "get", "post", "put", "patch", "delete", "create",
+                    "update", "destroy", "list", "retrieve"):
+                methods.append(item.name)
+            if isinstance(item, ast.Assign):
+                for t in item.targets:
+                    if isinstance(t, ast.Name) and t.id == "permission_classes":
+                        if isinstance(item.value, (ast.List, ast.Tuple)):
+                            permission_classes = [name_of(e) for e in item.value.elts if name_of(e)]
+                        elif isinstance(item.value, ast.Name):
+                            permission_classes = [item.value.id]
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Name):
+                decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                decorators.append(dec.func.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                decorators.append(dec.func.attr)
+        is_drf = any(b in DRF_BASES for b in bases)
+        has_mixin = any(b in AUTH_MIXINS for b in bases)
+        self.classes[node.name] = {
+            "file": self.file,
+            "bases": bases,
+            "methods": methods,
+            "decorators": decorators,
+            "permissionClasses": permission_classes,
+            "isDrf": is_drf,
+            "protectedByMixin": has_mixin,
+        }
+
+
+class UrlCollector(ast.NodeVisitor):
+    """收集 urlpatterns 列表里的视图引用"""
+
+    def __init__(self, filepath):
+        self.file = filepath
+        self.routes = []
+
+    def visit_Assign(self, node):
+        for t in node.targets:
+            if isinstance(t, ast.Name) and t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
+                for elt in node.value.elts:
+                    self._scan_entry(elt)
+        self.generic_visit(node)
+
+    def _scan_entry(self, elt):
+        if not isinstance(elt, ast.Call):
+            return
+        fn = name_of(elt.func)  # url / path / re_path
+        if fn not in ("url", "path", "re_path"):
+            return
+        pattern = ""
+        if elt.args and isinstance(elt.args[0], ast.Constant):
+            pattern = str(elt.args[0].value)
+        view_ref = elt.args[1] if len(elt.args) > 1 else None
+        if view_ref is None:
+            return
+        kind = "other"
+        view_name = None
+        if isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Attribute):
+            if view_ref.func.attr == "as_view":
+                kind = "cbv"
+                view_name = short_view_name(view_ref)
+            elif view_ref.func.id == "include" if isinstance(view_ref.func, ast.Name) else False:
+                kind = "include"
+        if view_name is None:
+            if isinstance(view_ref, ast.Name):
+                kind = "include" if False else "fbv"
+                view_name = view_ref.id
+            elif isinstance(view_ref, ast.Attribute):
+                kind = "fbv"
+                view_name = view_ref.attr
+            elif isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Name):
+                if view_ref.func.id == "include":
+                    kind = "include"
+                else:
+                    kind = "fbv"
+                    view_name = view_ref.func.id
+        urlname = ""
+        for kw in elt.keywords:
+            if kw.arg == "name" and isinstance(kw.value, ast.Constant):
+                urlname = str(kw.value)
+        self.routes.append({
+            "pattern": pattern,
+            "urlname": urlname,
+            "view": view_name,
+            "kind": kind,
+            "file": self.file,
+        })
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root, out = sys.argv[1], sys.argv[2]
+    views, routes, files_scanned = {}, [], 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        try:
+            with open(fp, "r", encoding="utf-8", errors="replace") as f:
+                tree = ast.parse(f.read(), filename=fp)
+        except (SyntaxError, UnicodeDecodeError, OSError):
+            continue
+        vc, uc = ViewCollector(fp), UrlCollector(fp)
+        vc.visit(tree)
+        uc.visit(tree)
+        for name, info in vc.fbvs.items():
+            info["kind"] = "fbv"
+            views[name] = info
+        for name, info in vc.classes.items():
+            info["kind"] = "cbv"
+            views[name] = info
+        routes.extend(uc.routes)
+
+    # 保护判定（扫描器只算事实，规则在 TS 检测器侧）
+    for name, info in views.items():
+        auth_dec = [d for d in info.get("decorators", [])
+                    if d in AUTH_DECORATORS or "auth" in d.lower() or "login" in d.lower()]
+        info["authDecorators"] = auth_dec
+        if info["kind"] == "cbv":
+            pc = info.get("permissionClasses") or []
+            info["openPermission"] = (len(pc) == 0) or all(
+                p in OPEN_PERMISSIONS for p in pc
+            )
+
+    result = {
+        "hasDjango": bool(routes),
+        "routes": routes,
+        "views": views,
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()

package/tools/extract_framework_flask.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""
+Flask Framework Structure Extractor — 框架结构扫描（第 5 个框架适配）
+
+从 Python AST 提取 Flask 结构：
+  1) 应用与蓝图：app = Flask(...) / bp = Blueprint(...) / register_blueprint
+  2) 路由：@app.route("/x", methods=[...]) / @bp.route(...) → handler 函数
+  3) 认证信号：
+     - handler 装饰器：login_required / permission_required / 自定义 *auth* 名
+     - 全局守卫：app.before_request(auth_fn) / bp.before_request(auth_fn)，
+       auth_fn 名命中认证词表
+  4) 路由方法：methods kwarg（缺省 = GET only）
+
+输出 JSON：{hasFlask, apps, blueprints, routes:[{method,path,handler,file,line,
+authDecorators}], beforeRequestAuth:[names], filesScanned}
+
+用法：python3 extract_framework_flask.py <projectRoot> <outJson>
+"""
+
+import ast
+import json
+import os
+import sys
+
+SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
+             ".git", "migrations", "__pycache__", "scripts", "docs",
+             "staticfiles", "static"}
+
+AUTH_WORDS = ("auth", "login", "permission", "token", "credential", "session",
+              "user")
+
+MUTATION_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+
+
+def name_of(node):
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return node.attr
+    return None
+
+
+def is_auth_like(name):
+    if not name:
+        return False
+    ln = name.lower()
+    return any(w in ln for w in AUTH_WORDS)
+
+
+class FlaskCollector(ast.NodeVisitor):
+    def __init__(self, filepath):
+        self.file = filepath
+        self.apps = []
+        self.blueprints = []
+        self.routes = []
+        self.before_requests = []  # 注册的 before_request 函数名
+
+    def visit_Assign(self, node):
+        if len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            v = node.value
+            if isinstance(v, ast.Call) and isinstance(v.func, ast.Name):
+                if v.func.id == "Flask":
+                    self.apps.append(node.targets[0].id)
+                elif v.func.id == "Blueprint":
+                    self.blueprints.append(node.targets[0].id)
+        self.generic_visit(node)
+
+    def visit_Expr(self, node):
+        # app.before_request(auth_fn) / app.register_blueprint(bp) 是表达式语句
+        v = node.value
+        if isinstance(v, ast.Call) and isinstance(v.func, ast.Attribute):
+            attr = v.func.attr
+            if attr == "before_request" and v.args:
+                fn_name = name_of(v.args[0])
+                if fn_name:
+                    self.before_requests.append(fn_name)
+            if attr == "register_blueprint" and v.args:
+                bp = name_of(v.args[0])
+                if bp and bp not in self.blueprints:
+                    self.blueprints.append(bp)
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node):
+        self._scan(node)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node):
+        self._scan(node)
+        self.generic_visit(node)
+
+    def _scan(self, node):
+        auth_decorators = []
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                # @app.route("/x", methods=["POST"]) / @bp.route(...)
+                if dec.func.attr == "route":
+                    target = name_of(dec.func.value)
+                    path = dec.args[0].value if dec.args and isinstance(dec.args[0], ast.Constant) else ""
+                    methods = ["GET"]
+                    for kw in dec.keywords:
+                        if kw.arg == "methods" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                            methods = [
+                                e.value.upper() for e in kw.value.elts
+                                if isinstance(e, ast.Constant)
+                            ]
+                    self.routes.append({
+                        "methods": methods,
+                        "path": path,
+                        "handler": node.name,
+                        "file": self.file,
+                        "line": node.lineno,
+                        "target": target,  # app / bp 变量名
+                    })
+            elif isinstance(dec, ast.Name):
+                if is_auth_like(dec.id):
+                    auth_decorators.append(dec.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Name):
+                if is_auth_like(dec.func.id):
+                    auth_decorators.append(dec.func.id)
+            elif isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                if is_auth_like(dec.func.attr):
+                    auth_decorators.append(dec.func.attr)
+        # 把装饰器信息挂到该函数名对应的 routes（同函数多装饰器顺序不定）
+        for r in self.routes:
+            if r["handler"] == node.name and r["file"] == self.file:
+                r["authDecorators"] = auth_decorators
+
+
+def walk_py_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for fn in filenames:
+            if fn.endswith(".py") and not fn.startswith("test_"):
+                yield os.path.join(dirpath, fn)
+
+
+def main():
+    root, out = sys.argv[1], sys.argv[2]
+    apps, blueprints, routes, before_requests, files_scanned = [], [], [], [], 0
+    for fp in walk_py_files(root):
+        files_scanned += 1
+        try:
+            with open(fp, "r", encoding="utf-8", errors="replace") as f:
+                tree = ast.parse(f.read(), filename=fp)
+        except (SyntaxError, UnicodeDecodeError, OSError):
+            continue
+        collector = FlaskCollector(fp)
+        collector.visit(tree)
+        apps.extend(collector.apps)
+        blueprints.extend(collector.blueprints)
+        routes.extend(collector.routes)
+        before_requests.extend(collector.before_requests)
+
+    result = {
+        "hasFlask": bool(apps or blueprints or routes),
+        "apps": sorted(set(apps)),
+        "blueprints": sorted(set(blueprints)),
+        "routes": routes,
+        "beforeRequestAuth": sorted(set(
+            fn for fn in before_requests if is_auth_like(fn)
+        )),
+        "filesScanned": files_scanned,
+    }
+    with open(out, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+
+
+if __name__ == "__main__":
+    main()