tewip-ai 0.18.1 → 0.18.3

package/dist/engine/import/junit.js

@@ -116,6 +116,9 @@ function junitCases(root, workspace) {
         }
         out.push({ testId, file: file || (testcase.attrs.classname ?? '').trim(), duration: Number.isFinite(seconds) ? Math.round(seconds * 1000) : 0, attempts });
     };
+    // <testrun> is the root Eclipse's JUnit runner and Ant write; everything inside it is ordinary
+    // JUnit XML. A real report in that shape was rejected outright as "no test report Tewip can
+    // read", which is a poor answer to a file holding 36 perfectly readable results.
     walk(root, root.name === 'testsuite' ? root : undefined);
     // Attempts whose error the runner did not record borrow the final one's, when there is one.
     for (const c of out) {
@@ -249,7 +252,7 @@ export function importJunit(path, meta) {
             if (start && (!startedAt || start < startedAt))
                 startedAt = start;
         }
-        else if (root.name === 'testsuites' || root.name === 'testsuite') {
+        else if (root.name === 'testsuites' || root.name === 'testsuite' || root.name === 'testrun') {
             cases = junitCases(root, meta.workspace);
             const stamp = root.attrs.timestamp ?? root.children.find((c) => c.name === 'testsuite')?.attrs.timestamp;
             if (stamp && (!startedAt || stamp < startedAt))
@@ -317,7 +320,7 @@ export function importJunit(path, meta) {
     if (unread.length > 0) {
         const list = unread.slice(0, 5).join(', ');
         if (parsedFiles === 0) {
-            throw new Error(`no test report Tewip can read in ${path}: ${list}. It reads JUnit XML (<testsuites>/<testsuite>), NUnit 3 (<test-run>), .NET TRX (<TestRun>), ` +
+            throw new Error(`no test report Tewip can read in ${path}: ${list}. It reads JUnit XML (<testsuites>/<testsuite>/<testrun>), NUnit 3 (<test-run>), .NET TRX (<TestRun>), ` +
                 'Robot Framework output.xml (<robot>), JMeter .jtl (<testResults>) and a k6 summary (--summary-export). ' +
                 'Most runners can write JUnit XML; for TestNG use the Surefire report, and for NUnit use --result=x.xml.');
         }

package/dist/engine/secure/secrets.js

@@ -54,18 +54,26 @@ export function entropyOf(value) {
 const PLACEHOLDER_WORDS = /example|placeholder|dummy|sample|changeme|your[-_ ]?(?:key|token|secret|api)|xxxx|redacted|fake|notreal|test[-_]?key|<[^>]+>|\$\{|\{\{/i;
 /** Files whose whole purpose is to show the shape of a secret, not to hold one. */
 const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\\/]*\.(?:md|rst|txt|adoc)|[^\\/]*example[^\\/]*|[^\\/]*sample[^\\/]*)$/i;
-/** Why this match is probably not a live credential, or null when nothing says so. */
+/**
+ * Why this match is probably not a live credential, or null when nothing says so.
+ *
+ * The file's name is deliberately not enough on its own any more. A realistic AWS key placed in
+ * `src/config-sample.js` was dismissed as noise - "nothing: this is not a credential" - while the
+ * identical key in `src/settings.js` was reported as critical. A filename is the weakest evidence
+ * there is, and a key pasted into an example file by accident is one of the commonest ways
+ * credentials leak. That case is now shown as a template finding instead of being dismissed.
+ */
 export function looksPlanted(value, line, file) {
     if (PLACEHOLDER_WORDS.test(value))
         return 'the value itself says it is an example';
     if (PLACEHOLDER_WORDS.test(line))
         return 'the line around it says it is an example';
-    if (DOC_FILE.test(file))
-        return 'it is in a documentation or example file';
     if (/(.)\1{5,}/.test(value))
         return 'the value repeats one character, so it is a stand-in';
     return null;
 }
+/** True when only the file's name suggests a template, whatever the value itself looks like. */
+export const inATemplate = (file) => DOC_FILE.test(file);
 const SKIP_DIR = new Set(['node_modules', '.git', 'dist', 'build', 'out', 'coverage', 'target', 'vendor', '__pycache__', '.venv', 'venv', '.tewip', '.next', '.cache']);
 const BINARY = /\.(?:png|jpe?g|gif|webp|ico|svg|pdf|zip|gz|tar|exe|dll|so|dylib|woff2?|ttf|eot|mp4|mp3|wav|class|jar|pyc|lock)$/i;
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
@@ -150,6 +158,7 @@ export function scanSecrets(root, files = sourceFiles(root)) {
                     evidence: redact(lines[line - 1] ?? '', value),
                     entropy: Number(entropy.toFixed(2)),
                     placeholder: looksPlanted(value, lines[line - 1] ?? '', rel),
+                    template: inATemplate(rel),
                 });
             }
         }

package/dist/engine/secure/triage.js

@@ -60,6 +60,18 @@ export function triageSecret(finding, root, accepted) {
     if (finding.placeholder) {
         return { ...base, verdict: 'noise', severity: 'low', why: `${finding.placeholder}: ${finding.evidence}`, next: 'nothing: this is not a credential' };
     }
+    if (finding.template) {
+        // Only the file's name says this is a template; the value itself looks like a real credential.
+        // Dismissing it would hide the commonest accident there is - a working key pasted into an
+        // example file - so it is shown, below the ones that need acting on now.
+        return {
+            ...base,
+            verdict: 'not-reachable',
+            severity: 'medium',
+            why: `${finding.evidence} - the file is a template or documentation, but the value itself does not say it is an example`,
+            next: 'check whether this was ever a working credential; if it was, rotate it and replace it here with an obvious placeholder',
+        };
+    }
     const tracked = isTracked(root, finding.file);
     if (!tracked) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",