tewip-ai 0.18.5 → 0.18.6

package/dist/engine/secure/reconcile.js

@@ -0,0 +1,42 @@
+/** The path a web finding says is being served, e.g. "/.env" from "GET http://host/.env answered". */
+function servedPath(item) {
+    if (item.kind !== 'web')
+        return null;
+    // Take the whole address and ask the URL parser for the path. Pulling the path out with a regular
+    // expression captured "//127.0.0.1:3211/.env", host and all, and then matched nothing.
+    const found = /GET\s+(\S+)\s+answered/.exec(item.why);
+    if (!found)
+        return null;
+    try {
+        return new URL(found[1]).pathname;
+    }
+    catch {
+        return found[1].startsWith('/') ? found[1] : null;
+    }
+}
+/** The file a secret finding is in, from "a database URL with a password in it in .env:1". */
+const fileOf = (item) => (item.kind === 'secret' ? (item.where.split(':')[0] ?? '') : '');
+/**
+ * Where one check changes what another means. Today that is one case, and it is the one that
+ * matters most: a secret sitting in a file the application serves.
+ */
+export function reconcile(items) {
+    const served = new Set(items
+        .map(servedPath)
+        .filter((p) => Boolean(p))
+        .map((p) => p.replace(/^\//, '').toLowerCase()));
+    if (served.size === 0)
+        return items;
+    return items.map((item) => {
+        const file = fileOf(item).replace(/\\/g, '/').toLowerCase();
+        if (!file || !served.has(file) || item.verdict === 'accepted')
+            return item;
+        return {
+            ...item,
+            verdict: 'real-risk',
+            severity: 'critical',
+            why: `${item.why} - but the running application serves /${file} to anyone who asks, so this credential is public`,
+            next: `treat this credential as leaked and rotate it now, then stop serving /${file}`,
+        };
+    });
+}

package/dist/engine/secure/secure-command.js

@@ -9,6 +9,7 @@ import { auditDependencies } from './deps.js';
 import { scanSecrets, sourceFiles } from './secrets.js';
 import { readAccepted, triageDependency, triageSecret, triageWeb, worstFirst } from './triage.js';
 import { isLocal, scanWeb } from './web.js';
+import { reconcile } from './reconcile.js';
 import { loadVerdicts, saidByAPerson, verdictFor } from '../learn/verdicts.js';
 import { readZapReport, zapAvailable, zapInstructions } from './zap.js';
 const CODE = /\.(?:[cm]?[jt]sx?|py|rb|go|java|kt|cs|php|rs|vue|svelte)$/;
@@ -98,6 +99,11 @@ export async function runSecure(cmd) {
     else if (cmd.url) {
         notChecked.push(`a full web scan. Tewip's own check is passive; for the deep one: ${zapInstructions(cmd.url, zapAvailable(root))}`);
     }
+    // One check can change what another means: a secret in a file the application serves is not
+    // "never left the machine", whatever git says about it.
+    const joined = reconcile(items);
+    items.length = 0;
+    items.push(...joined);
     // A person's decision about a finding wins over Tewip's, and says whose it was.
     const corrections = loadVerdicts(root);
     const decided = items.map((item) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
     "test-failures",