tewip-ai 0.18.4 → 0.18.6

package/dist/engine/secure/deps.js

@@ -5,6 +5,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+const NEWLINE = String.fromCharCode(10);
 const run = (command, cwd, timeoutMs = 5 * 60_000) => {
     const r = spawnSync(command, { cwd, shell: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 40 * 1024 * 1024 });
     return { code: r.status ?? 1, out: `${r.stdout ?? ''}`, err: `${r.stderr ?? ''}` };
@@ -15,14 +16,26 @@ export const bySeverity = (a, b) => SEVERITY_ORDER.indexOf(a.severity.toLowerCas
 /** `npm audit --json`, which needs no install and no account: every Node project already has it. */
 export function npmAudit(root) {
     if (!existsSync(join(root, 'package.json')))
-        return [];
-    const { out } = run('npm audit --json', root);
+        return { findings: [], problem: null };
+    const { out, err } = run('npm audit --json', root);
     let report;
     try {
         report = JSON.parse(out);
     }
     catch {
-        return [];
+        return { findings: [], problem: `npm audit did not return a report${err.trim() ? `: ${err.trim().split(NEWLINE)[0].slice(0, 120)}` : ''}` };
+    }
+    // npm reports a refusal inside the JSON and still exits 0: no lockfile, a registry that will not
+    // answer, a private registry needing credentials. None of those is "nothing found".
+    // Two shapes, both exiting 0. A refusal names itself - {"error":{"code":"ENOLOCK","summary":...}}
+    // - while a registry that cannot be reached leaves those fields empty and puts the reason in
+    // `message`. Reading summary with ?? kept the empty string, so an unreachable registry passed for
+    // a clean audit on a project with three known advisories.
+    const failure = report.error || (report.message && !report.vulnerabilities);
+    if (failure) {
+        const reason = [report.error?.summary, report.error?.code, report.message, 'npm audit could not run'].find((x) => typeof x === 'string' && x.trim());
+        const hint = report.error?.code === 'ENOLOCK' ? ' (run `npm i --package-lock-only` first)' : '';
+        return { findings: [], problem: `${String(reason).slice(0, 160)}${hint}` };
     }
     const findings = [];
     for (const [name, entry] of Object.entries(report.vulnerabilities ?? {})) {
@@ -40,7 +53,7 @@ export function npmAudit(root) {
             dev: Boolean(entry.isDirect === false ? false : entry.dev ?? false) || Boolean(entry.effects?.length === 0 && entry.dev),
         });
     }
-    return findings;
+    return { findings, problem: null };
 }
 /** `pip-audit`, when the project is Python and the tool is installed. */
 export function pipAudit(root) {
@@ -105,8 +118,12 @@ export function auditDependencies(root) {
     const missing = [];
     const findings = [];
     if (existsSync(join(root, 'package.json'))) {
-        ran.push('npm audit');
-        findings.push(...npmAudit(root));
+        const npm = npmAudit(root);
+        if (npm.problem)
+            missing.push(`npm audit could not run: ${npm.problem}`);
+        else
+            ran.push('npm audit');
+        findings.push(...npm.findings);
     }
     const python = ['requirements.txt', 'pyproject.toml', 'setup.py'].some((f) => existsSync(join(root, f)));
     if (python) {

package/dist/engine/secure/reconcile.js

@@ -0,0 +1,42 @@
+/** The path a web finding says is being served, e.g. "/.env" from "GET http://host/.env answered". */
+function servedPath(item) {
+    if (item.kind !== 'web')
+        return null;
+    // Take the whole address and ask the URL parser for the path. Pulling the path out with a regular
+    // expression captured "//127.0.0.1:3211/.env", host and all, and then matched nothing.
+    const found = /GET\s+(\S+)\s+answered/.exec(item.why);
+    if (!found)
+        return null;
+    try {
+        return new URL(found[1]).pathname;
+    }
+    catch {
+        return found[1].startsWith('/') ? found[1] : null;
+    }
+}
+/** The file a secret finding is in, from "a database URL with a password in it in .env:1". */
+const fileOf = (item) => (item.kind === 'secret' ? (item.where.split(':')[0] ?? '') : '');
+/**
+ * Where one check changes what another means. Today that is one case, and it is the one that
+ * matters most: a secret sitting in a file the application serves.
+ */
+export function reconcile(items) {
+    const served = new Set(items
+        .map(servedPath)
+        .filter((p) => Boolean(p))
+        .map((p) => p.replace(/^\//, '').toLowerCase()));
+    if (served.size === 0)
+        return items;
+    return items.map((item) => {
+        const file = fileOf(item).replace(/\\/g, '/').toLowerCase();
+        if (!file || !served.has(file) || item.verdict === 'accepted')
+            return item;
+        return {
+            ...item,
+            verdict: 'real-risk',
+            severity: 'critical',
+            why: `${item.why} - but the running application serves /${file} to anyone who asks, so this credential is public`,
+            next: `treat this credential as leaked and rotate it now, then stop serving /${file}`,
+        };
+    });
+}

package/dist/engine/secure/secure-command.js

@@ -9,6 +9,7 @@ import { auditDependencies } from './deps.js';
 import { scanSecrets, sourceFiles } from './secrets.js';
 import { readAccepted, triageDependency, triageSecret, triageWeb, worstFirst } from './triage.js';
 import { isLocal, scanWeb } from './web.js';
+import { reconcile } from './reconcile.js';
 import { loadVerdicts, saidByAPerson, verdictFor } from '../learn/verdicts.js';
 import { readZapReport, zapAvailable, zapInstructions } from './zap.js';
 const CODE = /\.(?:[cm]?[jt]sx?|py|rb|go|java|kt|cs|php|rs|vue|svelte)$/;
@@ -98,6 +99,11 @@ export async function runSecure(cmd) {
     else if (cmd.url) {
         notChecked.push(`a full web scan. Tewip's own check is passive; for the deep one: ${zapInstructions(cmd.url, zapAvailable(root))}`);
     }
+    // One check can change what another means: a secret in a file the application serves is not
+    // "never left the machine", whatever git says about it.
+    const joined = reconcile(items);
+    items.length = 0;
+    items.push(...joined);
     // A person's decision about a finding wins over Tewip's, and says whose it was.
     const corrections = loadVerdicts(root);
     const decided = items.map((item) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.18.4",
+  "version": "0.18.6",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",