tewip-ai 0.59.0 → 0.61.0

package/dist/engine/pick/pick-command.js

@@ -115,8 +115,27 @@ function mentionsOf(root, file, tests) {
     return out;
 }
 /** Does anything at all in the project refer to this file? Used only to tell "unknown" from "unreachable". */
+/**
+ * Whether anything in the project refers to this file at all.
+ *
+ * This searched for the file name *with its extension*, which is a JavaScript habit: a JS import
+ * often writes `./sorting.js`, and nothing else does. Python writes `from ..utils.sorting import x`,
+ * Java writes `import com.x.Sorting`, C# writes `using X.Sorting`. In all of them the extension
+ * never appears, so the search found nothing and the file was taken to be referenced nowhere.
+ *
+ * That is the most dangerous answer this file can produce. "Nothing refers to it" is the one
+ * condition that lets selection proceed past a source file no test imports - and on saleor it let
+ * `pick` narrow 1,229 test files down to **one**, skipping every sorting test in the suite, for a
+ * change to the GraphQL sorting code that all of them run through. The command's own promise is to
+ * refuse to narrow when it cannot show the rest are unaffected, and here it could not.
+ *
+ * The extension comes off. A name like `utils` or `index` will now match half the repository, and
+ * that is the right direction to be wrong in: over-matching means "this is referenced", which stops
+ * the narrowing. Under-matching skips the tests that would have caught the change.
+ */
 function mentionedAnywhere(root, file) {
-    const named = file.split('/').pop() ?? '';
+    const base = file.split('/').pop() ?? '';
+    const named = base.replace(/\.[A-Za-z0-9]+$/, '') || base;
     const where = spawnSync('git', ['grep', '-l', '--', named], { cwd: root, encoding: 'utf8', timeout: 60_000 });
     const hits = (where.stdout ?? '')
         .split(String.fromCharCode(10))

package/dist/engine/secure/secrets.js

@@ -31,7 +31,11 @@ const PATTERNS = [
     { kind: 'sendgrid-key', what: 'a SendGrid key', re: /\b(SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,})\b/g },
     { kind: 'twilio-key', what: 'a Twilio key', re: /\b(SK[a-f0-9]{32})\b/g },
     { kind: 'digitalocean-token', what: 'a DigitalOcean token', re: /\b(dop_v1_[a-f0-9]{64})\b/g },
-    { kind: 'private-key', what: 'a private key', re: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----)/g, minEntropy: 0 },
+    // The header *and* some key after it. Matching the header alone made a constant that merely
+    // names the format into a leaked key: Keycloak's PemUtils.java declares
+    // `BEGIN_PRIVATE_KEY = "-----BEGIN PRIVATE KEY-----"` so that it can recognise one, and Tewip
+    // told Red Hat they had committed two private keys. There is no key on those lines at all.
+    { kind: 'private-key', what: 'a private key', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----[\r\n\s]+([A-Za-z0-9+/=]{20,})/g, minEntropy: 0 },
     { kind: 'connection-string', what: 'a database URL with a password in it', re: /\b((?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s'"]+:([^@\s'"]{6,})@[^\s'"]+)/g },
     { kind: 'jwt', what: 'a signed token (JWT)', re: /\b(eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})(?![A-Za-z0-9_-])/g },
     // A password in a web address leaks the same way a database URL does, and is easier to miss.
@@ -53,7 +57,11 @@ export function entropyOf(value) {
 }
 const PLACEHOLDER_WORDS = /example|placeholder|dummy|sample|changeme|your[-_ ]?(?:key|token|secret|api)|xxxx|redacted|fake|notreal|test[-_]?key|<[^>]+>|\$\{|\{\{/i;
 /** Files whose whole purpose is to show the shape of a secret, not to hold one. */
-const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\\/]*\.(?:md|rst|txt|adoc)|[^\\/]*example[^\\/]*|[^\\/]*sample[^\\/]*)$/i;
+// An OpenAPI schema is documentation of an API, and every credential in one is an example by
+// construction - nocodb's swagger.json nests them three deep under "Example 1", too far for a
+// one-line lookback to see. The file says what it is, which is a steadier signal than the shape
+// of the JSON around the value.
+const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\\/]*\.(?:md|rst|txt|adoc)|[^\\/]*example[^\\/]*|[^\\/]*sample[^\\/]*|(?:swagger|openapi)[\w.-]*\.(?:json|ya?ml))$/i;
 /**
  * Why this match is probably not a live credential, or null when nothing says so.
  *
@@ -63,11 +71,16 @@ const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\
  * there is, and a key pasted into an example file by accident is one of the commonest ways
  * credentials leak. That case is now shown as a template finding instead of being dismissed.
  */
-export function looksPlanted(value, line, file) {
+export function looksPlanted(value, line, file, before = '') {
     if (PLACEHOLDER_WORDS.test(value))
         return 'the value itself says it is an example';
     if (PLACEHOLDER_WORDS.test(line))
         return 'the line around it says it is an example';
+    // JSON and YAML put the key on its own line when the value is long, and an OpenAPI schema is all
+    // long values. nocodb declares `"example":` and then the token underneath it, so reading only the
+    // token's line found nothing and the sample JWTs in its API documentation were reported as real.
+    if (/"?(?:example|sample|placeholder|default|demo)"?\s*:\s*$/i.test(before.trim()))
+        return 'the key above it says it is an example';
     if (/(.)\1{5,}/.test(value))
         return 'the value repeats one character, so it is a stand-in';
     return null;
@@ -157,7 +170,7 @@ export function scanSecrets(root, files = sourceFiles(root)) {
                     line,
                     evidence: redact(lines[line - 1] ?? '', value),
                     entropy: Number(entropy.toFixed(2)),
-                    placeholder: looksPlanted(value, lines[line - 1] ?? '', rel),
+                    placeholder: looksPlanted(value, lines[line - 1] ?? '', rel, lines[line - 2] ?? ''),
                     template: inATemplate(rel),
                 });
             }

package/dist/engine/secure/secure-command.js

@@ -101,24 +101,29 @@ export async function runSecure(cmd) {
     }
     // One check can change what another means: a secret in a file the application serves is not
     // "never left the machine", whatever git says about it.
-    const joined = reconcile(items);
-    items.length = 0;
-    items.push(...joined);
+    //
+    // Assigned, not emptied and refilled. `reconcile` returns the array it was given when there is no
+    // web finding to reconcile against - which is every run without `--url`, so almost every run - and
+    // `items.length = 0` then emptied the very array the next line was about to copy back in. Every
+    // secret found was discarded between finding it and reporting it, and the report said "0 need
+    // someone now", which is what a clean repository says too.
+    //
+    // Found in Phase 51 by scanning Keycloak: 49 secrets located, 7 of them triaged as real risks, and
+    // a report that mentioned none of them.
+    let settled = reconcile([...items]);
     // A person's decision about a finding wins over Tewip's, and says whose it was.
     const corrections = loadVerdicts(root);
-    const decided = items.map((item) => {
+    settled = settled.map((item) => {
         const said = verdictFor('security', item.where, corrections) ?? verdictFor('security', item.title, corrections);
         return said ? { ...item, verdict: said.verdict, why: `${saidByAPerson(said)} (Tewip had said ${item.verdict})` } : item;
     });
-    items.length = 0;
-    items.push(...decided);
-    items.sort(worstFirst);
-    const report = renderSecurity(items, checked, notChecked, root);
+    settled.sort(worstFirst);
+    const report = renderSecurity(settled, checked, notChecked, root);
     console.log(report);
     if (cmd.out) {
         mkdirSync(dirname(resolve(cmd.out)), { recursive: true });
         writeFileSync(resolve(cmd.out), `${report}\n`, 'utf8');
         console.log(`\nWritten to ${cmd.out}`);
     }
-    return items;
+    return settled;
 }

package/dist/engine/secure/triage.js

@@ -45,6 +45,8 @@ const SECRET_SEVERITY = {
     'google-api-key': 'medium',
     'jwt': 'medium',
 };
+/** A path whose job is to hold test data. */
+const IN_A_TEST = /(^|\/)(tests?|spec|specs|__tests__|testsuite|e2e|fixtures?|testdata|mocks?)(\/|$)|[._-](test|spec)\.[a-z]+$|Tests?\.(java|kt|cs|scala)$|(^|\/)(test|spec|mock|fixture)[-_][\w-]*\.[a-z]+$/i;
 export function triageSecret(finding, root, accepted) {
     const where = `${finding.file}:${finding.line}`;
     const key = `secret ${where}`;
@@ -72,6 +74,21 @@ export function triageSecret(finding, root, accepted) {
             next: 'check whether this was ever a working credential; if it was, rotate it and replace it here with an obvious placeholder',
         };
     }
+    // A credential committed on purpose, in a file whose whole job is to hold one. Keycloak's
+    // PemUtilsTest.java carries three keypairs so that it can test reading keypairs, and calling those
+    // "needs someone now" buries the one finding that might not be a fixture under six that are.
+    //
+    // Shown rather than hidden, for the same reason a template is: the commonest accident there is, is
+    // a working key pasted where a fake one belonged. It sits below the ones that need acting on now.
+    if (IN_A_TEST.test(finding.file.split(String.fromCharCode(92)).join('/'))) {
+        return {
+            ...base,
+            verdict: 'not-reachable',
+            severity: 'medium',
+            why: `${finding.evidence} - this is a test file, so the value is probably a fixture put there on purpose`,
+            next: 'confirm it was never a working credential; if it was, rotate it and replace it here with a generated one',
+        };
+    }
     const tracked = isTracked(root, finding.file);
     if (!tracked) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [