tewip-ai 0.18.3 → 0.18.5

package/dist/engine/secure/deps.js

@@ -5,6 +5,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+const NEWLINE = String.fromCharCode(10);
 const run = (command, cwd, timeoutMs = 5 * 60_000) => {
     const r = spawnSync(command, { cwd, shell: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 40 * 1024 * 1024 });
     return { code: r.status ?? 1, out: `${r.stdout ?? ''}`, err: `${r.stderr ?? ''}` };
@@ -15,14 +16,26 @@ export const bySeverity = (a, b) => SEVERITY_ORDER.indexOf(a.severity.toLowerCas
 /** `npm audit --json`, which needs no install and no account: every Node project already has it. */
 export function npmAudit(root) {
     if (!existsSync(join(root, 'package.json')))
-        return [];
-    const { out } = run('npm audit --json', root);
+        return { findings: [], problem: null };
+    const { out, err } = run('npm audit --json', root);
     let report;
     try {
         report = JSON.parse(out);
     }
     catch {
-        return [];
+        return { findings: [], problem: `npm audit did not return a report${err.trim() ? `: ${err.trim().split(NEWLINE)[0].slice(0, 120)}` : ''}` };
+    }
+    // npm reports a refusal inside the JSON and still exits 0: no lockfile, a registry that will not
+    // answer, a private registry needing credentials. None of those is "nothing found".
+    // Two shapes, both exiting 0. A refusal names itself - {"error":{"code":"ENOLOCK","summary":...}}
+    // - while a registry that cannot be reached leaves those fields empty and puts the reason in
+    // `message`. Reading summary with ?? kept the empty string, so an unreachable registry passed for
+    // a clean audit on a project with three known advisories.
+    const failure = report.error || (report.message && !report.vulnerabilities);
+    if (failure) {
+        const reason = [report.error?.summary, report.error?.code, report.message, 'npm audit could not run'].find((x) => typeof x === 'string' && x.trim());
+        const hint = report.error?.code === 'ENOLOCK' ? ' (run `npm i --package-lock-only` first)' : '';
+        return { findings: [], problem: `${String(reason).slice(0, 160)}${hint}` };
     }
     const findings = [];
     for (const [name, entry] of Object.entries(report.vulnerabilities ?? {})) {
@@ -34,11 +47,13 @@ export function npmAudit(root) {
             id: String(via?.url?.split('/').pop() ?? via?.source ?? ''),
             title: String(via?.title ?? `${name} has a known vulnerability`),
             fixedIn: entry.fixAvailable && typeof entry.fixAvailable === 'object' ? String(entry.fixAvailable.version ?? '') : '',
+            fixExists: entry.fixAvailable === true || (entry.fixAvailable && typeof entry.fixAvailable === 'object'),
+            direct: entry.isDirect === true,
             source: 'npm audit',
             dev: Boolean(entry.isDirect === false ? false : entry.dev ?? false) || Boolean(entry.effects?.length === 0 && entry.dev),
         });
     }
-    return findings;
+    return { findings, problem: null };
 }
 /** `pip-audit`, when the project is Python and the tool is installed. */
 export function pipAudit(root) {
@@ -82,6 +97,10 @@ export function osvScan(root) {
                         id: String(v.id ?? ''),
                         title: String(v.summary ?? '').slice(0, 200),
                         fixedIn: '',
+                        // osv-scanner's output says neither which version fixes it nor whether the project
+                        // declares the package, so neither is claimed.
+                        fixExists: false,
+                        direct: false,
                         source: 'osv-scanner',
                         dev: false,
                     });
@@ -99,8 +118,12 @@ export function auditDependencies(root) {
     const missing = [];
     const findings = [];
     if (existsSync(join(root, 'package.json'))) {
-        ran.push('npm audit');
-        findings.push(...npmAudit(root));
+        const npm = npmAudit(root);
+        if (npm.problem)
+            missing.push(`npm audit could not run: ${npm.problem}`);
+        else
+            ran.push('npm audit');
+        findings.push(...npm.findings);
     }
     const python = ['requirements.txt', 'pyproject.toml', 'setup.py'].some((f) => existsSync(join(root, f)));
     if (python) {

package/dist/engine/secure/triage.js

@@ -116,7 +116,15 @@ export function triageDependency(finding, root, sources, accepted) {
         where,
         source: finding.source,
     };
-    const upgrade = finding.fixedIn ? `upgrade ${finding.package} to ${finding.fixedIn}` : `no fixed version is published yet: watch ${finding.id || 'the advisory'} and consider replacing the package`;
+    // npm answers `fixAvailable: true` when `npm audit fix` can resolve something without naming a
+    // version. Reading only the version form made Tewip say "no fixed version is published yet,
+    // consider replacing the package" about three packages npm could have fixed in one command -
+    // found by running this against real advisories for lodash, minimist and marked.
+    const upgrade = finding.fixedIn
+        ? `upgrade ${finding.package} to ${finding.fixedIn}`
+        : finding.fixExists
+            ? `a fix is available: run \`npm audit fix\` (the scanner did not name a version)`
+            : `no fixed version is published yet: watch ${finding.id || 'the advisory'} and consider replacing the package`;
     if (accepted.has(`dependency ${finding.package}`) || accepted.has(`dependency ${where}`)) {
         return { ...base, verdict: 'accepted', why: 'a person marked this one accepted in .tewip/security-accepted.txt', next: 'nothing: it was reviewed' };
     }
@@ -134,8 +142,12 @@ export function triageDependency(finding, root, sources, accepted) {
             ...base,
             verdict: 'not-reachable',
             severity: base.severity === 'critical' ? 'medium' : 'low',
-            why: `nothing in this project imports ${finding.package}: it is pulled in by another package, so the vulnerable code may never run here`,
-            next: `${upgrade}, or check which dependency requires it (npm why ${finding.package}) before spending time on it`,
+            why: finding.direct
+                ? `this project declares ${finding.package} but no file imports it, so the vulnerable code may never run here`
+                : `nothing in this project imports ${finding.package}: it is pulled in by another package, so the vulnerable code may never run here`,
+            next: finding.direct
+                ? `${upgrade}, or remove ${finding.package} from the project if nothing uses it any more`
+                : `${upgrade}, or check which dependency requires it (npm why ${finding.package}) before spending time on it`,
         };
     }
     return { ...base, verdict: 'real-risk', why: `this project imports ${finding.package} directly, and the advisory applies to the installed version`, next: upgrade };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",