tewip-ai 0.70.0 → 0.70.2

package/dist/engine/autofix/code-fix.js

@@ -28,6 +28,14 @@ export const MAX_CHANGED_LINES = 20;
 /** How many times the model may try before Tewip gives up and explains instead. */
 export const MAX_ATTEMPTS = 3;
 const CR = String.fromCharCode(13);
+/**
+ * Does this text come back as the same text after a trip through UTF-8?
+ *
+ * The caller hands over a string already decoded from disk, so a byte that was not valid UTF-8 is
+ * already a U+FFFD by the time it gets here - and that replacement character is the tell. Nothing
+ * legitimate in source code contains it.
+ */
+const roundTrips = (text) => !text.includes(String.fromCharCode(0xfffd));
 const NL = String.fromCharCode(10);
 /**
  * Which other tests a change broke, by name. A tail of runner output is mostly noise; the names of
@@ -132,6 +140,14 @@ async function tryFile(target, input, deps, { keep, result, alreadyFailing }) {
     // threw away four correct fixes in a real measurement, so both sides are read in LF here and the
     // file is written back in whatever it used.
     const raw = deps.readFile(target.file);
+    // A file whose text does not survive a round trip through UTF-8 cannot be written back as it was,
+    // and every failure path here writes `raw` back. A legacy latin-1 source file - `// caf\xe9`, which
+    // older codebases are full of - would be returned re-encoded, three bytes where one had been, the
+    // character destroyed and nothing reported. Refusing is the only honest option: a fix that cannot
+    // be undone is not a fix Tewip is willing to try.
+    if (!roundTrips(raw)) {
+        return stop('cannot-restore', `${rel} is not valid UTF-8, so Tewip cannot change it and put it back exactly as it was. Nothing was written. Convert the file to UTF-8 if you want it fixed here.`);
+    }
     const crlf = raw.includes(CR + NL);
     const asFile = (text) => (crlf ? text.split(NL).join(CR + NL) : text);
     const original = crlf ? raw.split(CR + NL).join(NL) : raw;

package/dist/engine/build/apply.js

@@ -7,6 +7,14 @@ import { mayChange } from '../autofix/code-target.js';
 import { changedLines } from '../autofix/code-fix.js';
 export class Workspace {
     root;
+    /**
+     * What each touched file held, as **bytes**.
+     *
+     * It was a utf8 string, and "put back byte for byte" was then only true of files that are valid
+     * UTF-8. A legacy latin-1 source file - `// caf\xe9`, which older codebases are full of - was
+     * decoded to U+FFFD and written back as three different bytes: 16 bytes in, 18 bytes out, the
+     * character destroyed, and nothing reported. Measured, not reasoned about.
+     */
     touched = new Map();
     constructor(root) {
         this.root = resolve(root);
@@ -15,7 +23,7 @@ export class Workspace {
     remember(path) {
         if (this.touched.has(path))
             return;
-        this.touched.set(path, existsSync(path) ? readFileSync(path, 'utf8') : null);
+        this.touched.set(path, existsSync(path) ? readFileSync(path) : null);
     }
     write(path, content) {
         this.remember(path);

package/dist/engine/prove/prove.js

@@ -53,7 +53,7 @@ function stillParses(full) {
  * same control the write gate uses: a check that cannot fail proves nothing, and neither does a test
  * that cannot see the code.
  */
-function testsLoadIt(root, full, original, test, framework, runMs) {
+function testsLoadIt(root, full, original, originalBytes, test, framework, runMs) {
     const control = /\.py$/i.test(full)
         ? `raise RuntimeError("tewip control")${String.fromCharCode(10)}${original}`
         : /\.(js|cjs|mjs|ts|tsx|mts|cts|jsx)$/i.test(full)
@@ -64,7 +64,7 @@ function testsLoadIt(root, full, original, test, framework, runMs) {
         return !runTest(framework, resolve(root, test), runMs).passed;
     }
     finally {
-        restore(full, original);
+        restore(full, originalBytes);
     }
 }
 export function proveFile(root, file, covering, framework, opts = {}) {
@@ -79,8 +79,21 @@ export function proveFile(root, file, covering, framework, opts = {}) {
         proof.blocked = 'no test imports this file, so no test could notice any change to it. That is the finding: this code is not covered by anything Tewip can name.';
         return finish(proof, started);
     }
-    const original = readFileSync(full, 'utf8');
-    const stopGuarding = guardAgainstBeingKilled(full, original);
+    // Bytes for putting it back, text for making the mutants - and a refusal when the two cannot be
+    // reconciled. Holding only the utf8 string meant a file that is not valid UTF-8 was written back
+    // re-encoded: a latin-1 `// caf\xe9` came back 18 bytes instead of 16, with the character
+    // destroyed. Worse, `restore` verified its own work by comparing the **decoded strings**, which
+    // were equally lossy on both sides, so it reported success every time. A check that cannot fail
+    // proves nothing - this project's own rule, inside the function written to enforce it.
+    const originalBytes = readFileSync(full);
+    const original = originalBytes.toString('utf8');
+    if (!Buffer.from(original, 'utf8').equals(originalBytes)) {
+        proof.blocked =
+            'this file is not valid UTF-8, so Tewip cannot change it and put it back exactly as it was. Nothing was written. ' +
+                'Convert the file to UTF-8 if you want it proved; a mutation Tewip cannot undo is not worth the answer.';
+        return finish(proof, started);
+    }
+    const stopGuarding = guardAgainstBeingKilled(full, originalBytes);
     // The whole set first, then the sample: `found` is what the file allows and `mutants` is what
     // there was time to ask about, and the report has to be able to tell the reader the difference.
     const candidates = candidateMutants(original);
@@ -114,7 +127,7 @@ export function proveFile(root, file, covering, framework, opts = {}) {
     // The control: break the file outright and check that a covering test notices. Without this, a file
     // the tests never load would produce a full report of things they "failed to catch".
     say('checking the tests really load this file');
-    if (!testsLoadIt(root, full, original, usable[0], framework, runMs)) {
+    if (!testsLoadIt(root, full, original, originalBytes, usable[0], framework, runMs)) {
         proof.blocked = `${usable[0]} passes even when this file is made unusable, so the tests are not loading the file that was edited - they are reading an installed copy or a build output. Nothing here can be proved until they run against this source (for a Python src layout, install it in editable mode: pip install -e .).`;
         return finish(proof, started, stopGuarding);
     }
@@ -157,7 +170,7 @@ export function proveFile(root, file, covering, framework, opts = {}) {
             noticedBy = error instanceof Error ? error.message.slice(0, 120) : '';
         }
         finally {
-            restore(full, original);
+            restore(full, originalBytes);
         }
         proof.tried.push({ mutant, fate, noticedBy, seconds: Math.round((Date.now() - at) / 100) / 10 });
     }
@@ -168,8 +181,8 @@ export function proveFile(root, file, covering, framework, opts = {}) {
  * leave somebody's source broken, which would make it unusable however good its answers were.
  */
 function restore(full, original) {
-    writeFileSync(full, original, 'utf8');
-    if (readFileSync(full, 'utf8') !== original) {
+    writeFileSync(full, original);
+    if (!readFileSync(full).equals(original)) {
         throw new Error(`${full} could not be put back as it was. Check it before doing anything else: git checkout -- "${full}"`);
     }
 }

package/dist/engine/secure/web.js

@@ -169,12 +169,54 @@ export async function scanWeb(url, { timeoutMs = 15_000, probeExposed = true, pa
     return { findings, requests, note: null };
 }
 /** Localhost, a private address, or a name only this machine resolves. */
+/** The four octets of a dotted IPv4 address, or null for anything else - including a name. */
+function ipv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return null;
+    const numbers = parts.map((p) => (/^\d{1,3}$/.test(p) ? Number(p) : -1));
+    return numbers.every((n) => n >= 0 && n <= 255) ? numbers : null;
+}
+/**
+ * Is this address the person's own machine or network?
+ *
+ * **This is a consent control, not a convenience.** `secure --url` refuses a non-local address
+ * without `--i-am-authorised`, because scanning a system you do not run is not Tewip's decision to
+ * make - so anything this returns `true` for is scanned with no questions asked.
+ *
+ * It was a prefix match, and five hostnames walked straight past it: `localhost.evil.example`,
+ * `localhostile.example`, `10.evil.example`, `127.0.0.1.evil.example` and `172.16.evil.example` were
+ * all "this machine", because each *starts with* something local-looking. `localhost.<anything>` is
+ * one of the oldest allowlist bypasses there is, and a careless paste reaches it as easily as a
+ * malicious one.
+ *
+ * So a name is local only if it **is** `localhost` or ends in a reserved local suffix, and an address
+ * is local only if its octets really fall in a private range. Link-local 169.254/16 is deliberately
+ * **not** local: `169.254.169.254` is the cloud metadata endpoint, and asking before touching it is
+ * exactly the point of this function.
+ */
 export function isLocal(url) {
+    let host;
     try {
-        const host = new URL(url).hostname;
-        return /^(?:localhost|127\.|0\.0\.0\.0|\[::1\]|::1|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.)/.test(host) || host.endsWith('.local') || host.endsWith('.localhost');
+        host = new URL(url).hostname.toLowerCase();
     }
     catch {
         return false;
     }
+    // `new URL('http://[::1]').hostname` is "[::1]" in Node, so both spellings are accepted.
+    if (host === 'localhost' || host === '::1' || host === '[::1]')
+        return true;
+    if (host.endsWith('.localhost') || host.endsWith('.local'))
+        return true;
+    const octets = ipv4(host);
+    if (!octets)
+        return false;
+    const [a, b] = octets;
+    if (a === 0 || a === 127)
+        return true; // 0.0.0.0 and the whole loopback range
+    if (a === 10)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    return a === 172 && b >= 16 && b <= 31;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.70.0",
+  "version": "0.70.2",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [