tewip-ai 0.70.13 → 0.70.15

package/dist/engine/autofix/selector-source.js

@@ -62,7 +62,8 @@ function commonPrefix(a, b) {
 }
 const git = (root, args) => {
     try {
-        return execFileSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, timeout: 60_000 });
+        // Captured, not inherited: see the note in grounding.ts.
+        return execFileSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, timeout: 60_000, stdio: ['ignore', 'pipe', 'pipe'] });
     }
     catch {
         return '';

package/dist/engine/flaky/flaky-command.js

@@ -8,6 +8,9 @@ import { flakyTests, readyToRelease, weeklyCost } from './flaky.js';
 import { applyQuarantine, frameworkOf, quarantineFor } from './quarantine.js';
 import { loadVerdicts, saidByAPerson, verdictFor } from '../learn/verdicts.js';
 const DAY_MS = 24 * 60 * 60 * 1000;
+/** How many tests each group lists, and how many quarantine lines are written out in full. */
+const SHOW = 15;
+const SHOW_LINES = 5;
 const minutes = (ms) => `${(ms / 60_000).toFixed(1)} CI min`;
 function projects(root, only) {
     const dir = join(root, '.tewip', 'history');
@@ -50,7 +53,7 @@ export async function runFlaky(cmd) {
             if (chosen.length === 0)
                 return;
             lines.push(`### ${title} (${chosen.length})`, '', explain, '');
-            for (const test of chosen.slice(0, 15)) {
+            for (const test of chosen.slice(0, SHOW)) {
                 lines.push(`- **${test.title}**`);
                 lines.push(`  - ${test.failedRuns} of ${test.totalRuns} run(s), ${test.failedAttempts} failed attempt(s), ${minutes(test.wastedMs)} lost${test.recoveredOnRetry > 0 ? `, passed on a retry ${test.recoveredOnRetry} time(s)` : ''}`);
                 lines.push(`  - Tewip read them as: ${test.categories.map((c) => `${c.category} ×${c.count}`).join(', ')}`);
@@ -58,6 +61,10 @@ export async function runFlaky(cmd) {
                 if (test.file)
                     lines.push(`  - Where: ${test.file}`);
             }
+            // A heading that says 48 above a list of 15 is the defect this project keeps finding in
+            // itself: a true number beside a shorter answer, with nothing saying they differ.
+            if (chosen.length > SHOW)
+                lines.push(`_Showing the ${SHOW} costliest. The other ${chosen.length - SHOW} are not listed here._`);
             lines.push('');
         };
         group('quarantine', 'Quarantine these', 'Unreliable rather than wrong. Stop them blocking everyone, then fix them on purpose.');
@@ -82,6 +89,7 @@ export async function runFlaky(cmd) {
         lines.push(...applyAll(cmd.root, toQuarantine));
     else if (toQuarantine.length > 0)
         lines.push(...suggest(cmd.root, toQuarantine));
+    lines.push(...notChecked(all, cmd.days));
     const report = lines.join('\n');
     console.log(report);
     if (cmd.out) {
@@ -97,7 +105,7 @@ function readQuarantined(root) {
 }
 function suggest(root, tests) {
     const lines = ['### The line to add', ''];
-    for (const test of tests.slice(0, 5)) {
+    for (const test of tests.slice(0, SHOW_LINES)) {
         const path = testFile(root, test);
         const framework = path ? frameworkOf(path, readFileSync(path, 'utf8')) : null;
         if (!path || !framework) {
@@ -106,7 +114,10 @@ function suggest(root, tests) {
         }
         lines.push(`- ${test.title} (${test.file}):`, '```', quarantineFor(test, framework).line, '```');
     }
-    lines.push('', 'Run `tewip flaky --apply` to put these lines in, each with the evidence above it. Only the named tests are touched.', '');
+    const shown = Math.min(tests.length, SHOW_LINES);
+    lines.push('', shown < tests.length
+        ? `Showing ${shown} of ${tests.length}. \`tewip flaky --apply\` quarantines **all ${tests.length}**, not only the ${shown} printed here - each with its own evidence written above it. No test outside those ${tests.length} is touched.`
+        : 'Run `tewip flaky --apply` to put these lines in, each with the evidence above it. Only the named tests are touched.', '');
     return lines;
 }
 /** Writes the quarantine into the test files, and remembers which tests were quarantined. */
@@ -148,3 +159,28 @@ function applyAll(root, tests) {
     lines.push('', 'Nothing else in those files was changed. Review the diff before committing: a quarantined test is a decision, not a fix.', '');
     return lines;
 }
+/**
+ * What this report did not check.
+ *
+ * The quarantine rules in `decide` carry a rail: a test whose failures Tewip read as the
+ * application being wrong is never quarantined, because hiding it would hide the bug. That rail
+ * reads the diagnosed category of each failure - so on history where nothing has been diagnosed it
+ * has nothing to read and cannot fire, and the verdict rests on retry behaviour alone. On real
+ * history that is the normal case rather than the exception: of the 15 quarantine candidates this
+ * printed for WordPress/gutenberg, all 15 were UNKNOWN - every one. The recommendation is still the
+ * best reading of the evidence there is. What was missing was the sentence telling the person which
+ * of the two they were being shown.
+ */
+export function notChecked(tests, days) {
+    const quarantine = tests.filter((t) => t.verdict === 'quarantine');
+    const undiagnosed = quarantine.filter((t) => t.categories.every((c) => c.category === 'UNKNOWN'));
+    const lines = ['## What this did not check', ''];
+    lines.push(`- Any test that did not fail, and any run nobody put through \`tewip explain\` or \`tewip report\`. These numbers are read from kept history of the last ${days} day(s), and a suite nobody recorded looks exactly like a suite with no flaky tests.`);
+    if (undiagnosed.length > 0) {
+        lines.push(`- **${undiagnosed.length} of the ${quarantine.length} quarantine recommendation(s) rest on retry behaviour alone.** None of those failures had been diagnosed, so the rule that refuses to quarantine a test whose failures looked like the application being wrong had nothing to read and did not fire. A test that fails and then passes on a retry can also be a test correctly catching a race in the product - quarantine that one and the race is what you hide. Running \`tewip explain\` over those runs is what tells the two apart.`);
+    }
+    lines.push('- Whether a test is the only thing covering what it covers. Tewip does not know what stops being tested when you quarantine it.');
+    lines.push('- Whether a test is the same test. These are matched by name, so a renamed test looks like a new one and its history stays behind with the old name.');
+    lines.push('');
+    return lines;
+}

package/dist/engine/import/blob.js

@@ -161,5 +161,5 @@ function importShards(shards, meta, filesDir) {
         status: runStatus,
         attempts,
     };
-    return { records, summary, skippedShards };
+    return { records, summary, skippedShards, incomplete: skippedShards.map((shard) => `shard ${shard} could not be read, so its tests are missing from this run`) };
 }

package/dist/engine/import/junit.js

@@ -10,9 +10,10 @@
 // selector drift is not diagnosed from them. Every format below was checked against a report its
 // real runner wrote (fixtures/polyglot, run by .github/workflows/polyglot-fixtures.yml).
 import { readdirSync, readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { SCHEMA_VERSION } from '../../reporters/types.js';
 import { descendants, parseXml } from './xml.js';
+import { shortfall } from './shortfall.js';
 import { jmeterCases, jmeterCsvCases, k6Cases, looksLikeCsvJtl, looksLikeK6, robotCases, robotTime } from './other-formats.js';
 import { nunitCases, trxCases } from './dotnet.js';
 import { PASSED, failure } from './case.js';
@@ -161,6 +162,7 @@ export function importJunit(path, meta) {
     let startedAt = '';
     let anyFailed = false;
     const unread = [];
+    const incomplete = [];
     let parsedFiles = 0;
     for (const file of junitFiles(path)) {
         const raw = readFileSync(file, 'utf8');
@@ -199,6 +201,9 @@ export function importJunit(path, meta) {
         }
         else if (root.name === 'testsuites' || root.name === 'testsuite' || root.name === 'testrun') {
             cases = junitCases(root, meta.workspace);
+            const missing = shortfall(root);
+            if (missing)
+                incomplete.push(`${basename(file)}: ${missing}`);
             const stamp = root.attrs.timestamp ?? root.children.find((c) => c.name === 'testsuite')?.attrs.timestamp;
             if (stamp && (!startedAt || stamp < startedAt))
                 startedAt = stamp;
@@ -271,5 +276,5 @@ export function importJunit(path, meta) {
         }
         console.error(`[tewip] ignored ${unread.length} file(s) that are not a test report: ${list}`);
     }
-    return { records, summary, skippedShards: [] };
+    return { records, summary, skippedShards: [], incomplete };
 }

package/dist/engine/import/shortfall.js

@@ -0,0 +1,62 @@
+// Does a test report hold the run it says it holds?
+//
+// Kept apart from the importers because it asks nothing about any one format's shape: it compares a
+// report's own declared totals with what is actually inside it, which is the one check that catches
+// a file that parsed cleanly and is missing most of its contents.
+import { descendants } from './xml.js';
+/** A failing outcome, under either of the two names JUnit uses for one. */
+const FAILURE = new Set(['failure', 'error']);
+/**
+ * What the report says about itself, against what it actually contains.
+ *
+ * Every JUnit suite declares its own totals - `tests`, `failures`, `errors` - in the attributes of
+ * the element that holds the results. Nothing here ever read them, and a truncated upload is the
+ * commonest corruption there is: the runner dies, or the artifact is cut off mid-write, and what
+ * arrives is well-formed enough to parse and missing most of the run.
+ *
+ * Found by handing `tewip explain` a report whose header said `tests="500" failures="37"` and whose
+ * body held one passing testcase. The answer was **"All 1 test(s) passed. Nothing to explain."** The
+ * evidence that it was reading a fragment was in the file, two lines above the fragment.
+ *
+ * Only a shortfall is reported. A surplus is ordinary: rerun plugins write an entry per attempt
+ * while `tests` counts the test once, so finding more testcases than declared means a re-run, not a
+ * corrupt file.
+ */
+export function shortfall(root) {
+    // The one signal that does not depend on the report declaring anything. A streaming writer like
+    // node:test puts each suite's totals in its closing tag, so a report cut off in the middle loses
+    // the tests and the count of them together and has nothing left to disagree with itself about.
+    // What it cannot hide is the tag it never closed.
+    if (root.truncated) {
+        return 'the file ends in the middle of itself - an element is left open, so it was cut off while being written or uploaded. Whatever ran after that point is not in here, and Tewip cannot say how much that was.';
+    }
+    const num = (e, key) => {
+        const n = Number(e.attrs[key]);
+        return Number.isFinite(n) ? n : 0;
+    };
+    // Only the innermost suites are counted. PHPUnit wraps every suite in another suite carrying the
+    // same totals, and real PHPUnit output was read as half missing when both levels were added up -
+    // a false alarm on a perfectly good report, which is worse than the silence this replaces. A
+    // parent's totals already include its children's, so the leaves are the whole run exactly once.
+    const all = [...(root.name === 'testsuite' ? [root] : []), ...descendants(root, 'testsuite')];
+    const suites = all.filter((e) => descendants(e, 'testsuite').length === 0);
+    const totals = (key, fallback) => root.attrs[key] !== undefined
+        ? num(root, key)
+        : suites.reduce((sum, e) => sum + fallback.reduce((s, k) => s + num(e, k), 0), 0);
+    const declaredTests = totals('tests', ['tests']);
+    const declaredBad = root.attrs.failures !== undefined || root.attrs.errors !== undefined
+        ? num(root, 'failures') + num(root, 'errors')
+        : suites.reduce((sum, e) => sum + num(e, 'failures') + num(e, 'errors'), 0);
+    const cases = descendants(root, 'testcase');
+    const foundBad = cases.filter((c) => c.children.some((ch) => FAILURE.has(ch.name))).length;
+    const missingTests = declaredTests - cases.length;
+    const missingBad = declaredBad - foundBad;
+    if (missingTests <= 0 && missingBad <= 0)
+        return null;
+    const said = [];
+    if (missingTests > 0)
+        said.push(`${missingTests} of the ${declaredTests} test(s) it says it holds are not in it`);
+    if (missingBad > 0)
+        said.push(`${missingBad} of the ${declaredBad} failure(s) it reports are not in it`);
+    return `${said.join(', and ')}. This report is a fragment of its run - most likely cut off while being written or uploaded. Nothing below covers the missing part.`;
+}

package/dist/engine/import/xml.js

@@ -65,6 +65,10 @@ export function parseXml(source) {
     const first = root.children[0];
     if (!first)
         throw new Error('not an XML document: no root element');
+    // Anything still on the stack is an element nobody closed. Well-formed XML leaves only the
+    // document itself behind.
+    if (stack.length > 1)
+        first.truncated = true;
     return first;
 }
 function end(source, token, from) {

package/dist/engine/quality/grounding.js

@@ -115,7 +115,11 @@ export function relatedTestSources(root, feature, maxFiles = 4, maxChars = 8_000
 /** What a git range changed (e.g. "main...HEAD"); null outside a git checkout. */
 export function changeSummary(root, range, maxPatch = 12_000) {
     try {
-        const git = (args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        // `stdio` so git's own stderr is captured rather than inherited. `execFileSync` sends a child's
+        // stderr straight to the parent unless told not to, so a range that does not exist printed three
+        // lines of `fatal: ambiguous argument 'main...HEAD'` and a git usage hint **before** Tewip's own
+        // explanation of the same thing. The failure was always handled; it just looked like a crash.
+        const git = (args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
         const files = git(['diff', '--name-only', range]).split('\n').filter(Boolean);
         const patch = git(['diff', '--unified=2', range]);
         return { range, files, patch: patch.length > maxPatch ? `${patch.slice(0, maxPatch)}\n... (diff cut at ${maxPatch} characters)` : patch };

package/dist/engine/release/channels.js

@@ -0,0 +1,67 @@
+// Is every place Tewip is published actually carrying this release?
+//
+// There is a standing rule on this project: check every distribution channel after every
+// improvement, because a stale channel looks exactly like a current one. It was being done by hand,
+// and by hand it failed twice in one day - not because the check was skipped, but because the
+// question was wrong. The MCP registry was asked `?search=<name>&limit=100`, which returns a capped
+// version history and came back without the two newest releases in it. It answered with a version
+// number, the version number looked plausible, and it would have looked just as plausible if
+// nothing were wrong.
+//
+// So the verdict here has three values, not two. `unverified` is the whole point of the file: a
+// channel nobody could read is not a channel that is up to date, and must never be rendered as one.
+/** Compares two dotted versions. Missing parts count as zero, so 0.70 is older than 0.70.1. */
+export function compareVersions(a, b) {
+    const parts = (v) => v.split('.').map((n) => Number.parseInt(n, 10) || 0);
+    const [x, y] = [parts(a), parts(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        const d = (x[i] ?? 0) - (y[i] ?? 0);
+        if (d !== 0)
+            return d < 0 ? -1 : 1;
+    }
+    return 0;
+}
+export function judge(reading) {
+    if (reading.actual === null) {
+        return {
+            ...reading,
+            verdict: 'unverified',
+            says: `could not be read${reading.problem ? `: ${reading.problem}` : ''}. This is not the same as being up to date - nothing here says whether ${reading.name} has ${reading.expected} or not.`,
+        };
+    }
+    const order = compareVersions(reading.actual, reading.expected);
+    if (order === 0)
+        return { ...reading, verdict: 'current', says: `has ${reading.actual}.` };
+    if (order < 0) {
+        return { ...reading, verdict: 'behind', says: `has ${reading.actual}, but this repository is at ${reading.expected}. The release did not reach it.` };
+    }
+    // Ahead is not an error on its own: the editor extension keeps its own version line, and a
+    // channel can legitimately carry something this checkout has not caught up with.
+    return { ...reading, verdict: 'ahead', says: `has ${reading.actual}, which is newer than this checkout's ${reading.expected}.` };
+}
+const MARK = { current: 'ok', behind: 'BEHIND', ahead: 'ahead', unverified: 'UNVERIFIED' };
+/** The whole answer, written so the two states that need a person are impossible to skim past. */
+export function renderChannels(readings) {
+    const judged = readings.map(judge);
+    const width = Math.max(...judged.map((c) => c.name.length), 12);
+    const lines = ['Where Tewip is published', ''];
+    for (const c of judged)
+        lines.push(`  ${MARK[c.verdict].padEnd(11)} ${c.name.padEnd(width)}  ${c.says}`);
+    const behind = judged.filter((c) => c.verdict === 'behind');
+    const unverified = judged.filter((c) => c.verdict === 'unverified');
+    lines.push('');
+    if (behind.length > 0) {
+        lines.push(`${behind.length} channel(s) did not get this release: ${behind.map((c) => c.name).join(', ')}.`, '');
+    }
+    if (unverified.length > 0) {
+        // Named separately from `behind` on purpose. Folding the two together is how an unanswered
+        // query becomes a clean report.
+        lines.push(`${unverified.length} channel(s) could not be checked at all: ${unverified.map((c) => c.name).join(', ')}. Nothing above says whether those are current.`, '');
+    }
+    if (behind.length === 0 && unverified.length === 0)
+        lines.push('Every channel answered, and every one has this release.', '');
+    lines.push('How each was asked:');
+    for (const c of judged)
+        lines.push(`  ${c.name}: ${c.asked}`);
+    return { text: lines.join(String.fromCharCode(10)), behind: behind.length, unverified: unverified.length };
+}

package/dist/engine/review/agreements.js

@@ -92,7 +92,9 @@ function classify(file, before, after) {
 }
 function sourceDiff(root, range) {
     try {
-        return execFileSync('git', ['diff', '--unified=0', range, '--'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        // Captured, not inherited: see the note in grounding.ts - an unknown range printed git's own
+        // error before Tewip's.
+        return execFileSync('git', ['diff', '--unified=0', range, '--'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
     }
     catch {
         return '';

package/dist/engine/review/expectations.js

@@ -24,7 +24,8 @@ const title = (line) => /['"`]([^'"`]{4,120})['"`]/.exec(line)?.[1] ?? /\b(?:def
 /** The diff of test files only, which is all this looks at. */
 function testDiff(root, range) {
     try {
-        return execFileSync('git', ['diff', '--unified=0', range, '--'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+        // Captured, not inherited: see the note in grounding.ts.
+        return execFileSync('git', ['diff', '--unified=0', range, '--'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
     }
     catch {
         return '';

package/dist/engine/secure/deps.js

@@ -6,6 +6,48 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
 const NEWLINE = String.fromCharCode(10);
+/**
+ * A scanner's JSON, or `undefined` when it did not produce any.
+ *
+ * Empty output counts as no report rather than as an empty one. A scanner that printed nothing
+ * cannot be told apart from a scanner that crashed before it printed, and the two possible
+ * mistakes are not equally bad: calling a clean scan unreadable sends somebody to look, while
+ * calling an unreadable scan clean is the false all-clear this whole report exists to avoid.
+ */
+function readJson(out) {
+    if (!out.trim())
+        return undefined;
+    try {
+        return JSON.parse(out);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Did this scanner produce a report, or only exit?
+ *
+ * `key` is the field its report always carries, so JSON that parses but is not a scan result - a
+ * usage message, a progress object, an error body - is caught too. The exit code is deliberately
+ * not consulted: pip-audit and npm audit both exit non-zero precisely when they have found
+ * something, so treating that as failure would discard the findings that matter most.
+ */
+export function scanOutcome(tool, out, err, shape, read) {
+    const report = readJson(out);
+    if (report === undefined)
+        return { findings: [], problem: `${tool} did not return a report${firstLine(out, err)}` };
+    // Older pip-audit prints the dependency list unwrapped, so a bare array is a real report there
+    // and nowhere else. Accepting one everywhere would let a stray array pass for an empty scan.
+    const known = report?.[shape.key] !== undefined || (shape.orArray === true && Array.isArray(report));
+    if (!known)
+        return { findings: [], problem: `${tool} returned JSON that is not a scan report` };
+    return { findings: read(report), problem: null };
+}
+/** The first line a failing tool said, for the report - whichever stream it used. */
+function firstLine(out, err) {
+    const said = [err, out].map((x) => x.trim()).find(Boolean);
+    return said ? `: ${said.split(NEWLINE)[0].slice(0, 120)}` : '';
+}
 const run = (command, cwd, timeoutMs = 5 * 60_000) => {
     const r = spawnSync(command, { cwd, shell: true, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 40 * 1024 * 1024 });
     return { code: r.status ?? 1, out: `${r.stdout ?? ''}`, err: `${r.stderr ?? ''}` };
@@ -55,90 +97,94 @@ export function npmAudit(root) {
     }
     return { findings, problem: null };
 }
+/**
+ * What pip-audit found, given what it printed. Separated from running it so the shapes real
+ * pip-audit produces can be tested without the tool installed.
+ */
+export function pipFindings(report) {
+    const list = report?.dependencies ?? report;
+    return (Array.isArray(list) ? list : []).flatMap((dep) => (dep.vulns ?? []).map((v) => ({
+        package: String(dep.name ?? ''),
+        version: String(dep.version ?? ''),
+        severity: String(v.severity ?? 'unknown').toLowerCase(),
+        id: String(v.id ?? ''),
+        title: String(v.description ?? '').split('\n')[0].slice(0, 200),
+        fixedIn: (v.fix_versions ?? []).join(', '),
+        source: 'pip-audit',
+        dev: false,
+    })));
+}
 /** `pip-audit`, when the project is Python and the tool is installed. */
 export function pipAudit(root) {
     const python = ['requirements.txt', 'pyproject.toml', 'setup.py'].some((f) => existsSync(join(root, f)));
     if (!python || !has('pip-audit', root))
-        return [];
-    const { out } = run('pip-audit -f json --progress-spinner off', root);
-    try {
-        const report = JSON.parse(out);
-        const list = report.dependencies ?? report;
-        return (Array.isArray(list) ? list : []).flatMap((dep) => (dep.vulns ?? []).map((v) => ({
-            package: String(dep.name ?? ''),
-            version: String(dep.version ?? ''),
-            severity: String(v.severity ?? 'unknown').toLowerCase(),
-            id: String(v.id ?? ''),
-            title: String(v.description ?? '').split('\n')[0].slice(0, 200),
-            fixedIn: (v.fix_versions ?? []).join(', '),
-            source: 'pip-audit',
-            dev: false,
-        })));
-    }
-    catch {
-        return [];
+        return { findings: [], problem: null };
+    const { out, err } = run('pip-audit -f json --progress-spinner off', root);
+    return scanOutcome('pip-audit', out, err, { key: 'dependencies', orArray: true }, pipFindings);
+}
+/**
+ * What osv-scanner found, given what it printed. Separated from running it for the same reason as
+ * `pipFindings`: the parsing is what needs testing, and the tool is rarely installed.
+ */
+export function osvFindings(report) {
+    const findings = [];
+    for (const result of report?.results ?? []) {
+        for (const pkg of result.packages ?? []) {
+            for (const v of pkg.vulnerabilities ?? []) {
+                findings.push({
+                    package: String(pkg.package?.name ?? ''),
+                    version: String(pkg.package?.version ?? ''),
+                    severity: String(v.database_specific?.severity ?? v.severity?.[0]?.type ?? 'unknown').toLowerCase(),
+                    id: String(v.id ?? ''),
+                    title: String(v.summary ?? '').slice(0, 200),
+                    fixedIn: '',
+                    // osv-scanner's output says neither which version fixes it nor whether the project
+                    // declares the package, so neither is claimed.
+                    fixExists: false,
+                    direct: false,
+                    source: 'osv-scanner',
+                    dev: false,
+                });
+            }
+        }
     }
+    return findings;
 }
 /** OSV-Scanner, which covers Go, Rust, Java, Ruby, PHP and more, when it is installed. */
 export function osvScan(root) {
     if (!has('osv-scanner', root))
-        return [];
-    const { out } = run(`osv-scanner --format json --recursive "${root}"`, root);
-    try {
-        const report = JSON.parse(out);
-        const findings = [];
-        for (const result of report.results ?? []) {
-            for (const pkg of result.packages ?? []) {
-                for (const v of pkg.vulnerabilities ?? []) {
-                    findings.push({
-                        package: String(pkg.package?.name ?? ''),
-                        version: String(pkg.package?.version ?? ''),
-                        severity: String(v.database_specific?.severity ?? v.severity?.[0]?.type ?? 'unknown').toLowerCase(),
-                        id: String(v.id ?? ''),
-                        title: String(v.summary ?? '').slice(0, 200),
-                        fixedIn: '',
-                        // osv-scanner's output says neither which version fixes it nor whether the project
-                        // declares the package, so neither is claimed.
-                        fixExists: false,
-                        direct: false,
-                        source: 'osv-scanner',
-                        dev: false,
-                    });
-                }
-            }
-        }
-        return findings;
-    }
-    catch {
-        return [];
-    }
+        return { findings: [], problem: null };
+    const { out, err } = run(`osv-scanner --format json --recursive "${root}"`, root);
+    return scanOutcome('osv-scanner', out, err, { key: 'results' }, osvFindings);
 }
 export function auditDependencies(root) {
     const ran = [];
     const missing = [];
     const findings = [];
-    if (existsSync(join(root, 'package.json'))) {
-        const npm = npmAudit(root);
-        if (npm.problem)
-            missing.push(`npm audit could not run: ${npm.problem}`);
+    // `ran` used to be pushed before the scanner was called, so a pip-audit that was installed and
+    // failed left "Checked: pip-audit" standing above zero findings. Measured on a project pinning
+    // requests==2.19.1 and flask==0.12.2 - both long known vulnerable - with a pip-audit that exited
+    // without JSON: the report read "Checked: secrets in the working tree, pip-audit. 0 need someone
+    // now." A scanner is named as having run only once it has returned something readable.
+    const record = (tool, outcome) => {
+        if (outcome.problem)
+            missing.push(`${tool} could not run: ${outcome.problem}`);
         else
-            ran.push('npm audit');
-        findings.push(...npm.findings);
+            ran.push(tool);
+        findings.push(...outcome.findings);
+    };
+    if (existsSync(join(root, 'package.json'))) {
+        record('npm audit', npmAudit(root));
     }
     const python = ['requirements.txt', 'pyproject.toml', 'setup.py'].some((f) => existsSync(join(root, f)));
     if (python) {
-        if (has('pip-audit', root)) {
-            ran.push('pip-audit');
-            findings.push(...pipAudit(root));
-        }
-        else {
+        if (has('pip-audit', root))
+            record('pip-audit', pipAudit(root));
+        else
             missing.push('pip-audit (pip install pip-audit) for the Python dependencies');
-        }
-    }
-    if (has('osv-scanner', root)) {
-        ran.push('osv-scanner');
-        findings.push(...osvScan(root));
     }
+    if (has('osv-scanner', root))
+        record('osv-scanner', osvScan(root));
     else if (!existsSync(join(root, 'package.json')) && !python) {
         missing.push('osv-scanner (https://osv.dev) for this project\'s ecosystem');
     }

package/dist/engine/secure/secrets.js

@@ -71,10 +71,74 @@ const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\
  * there is, and a key pasted into an example file by accident is one of the commonest ways
  * credentials leak. That case is now shown as a template finding instead of being dismissed.
  */
-export function looksPlanted(value, line, file, before = '') {
+/**
+ * A URL-shaped credential whose destination cannot be a real system, or whose user and password
+ * are the same word.
+ *
+ * A credential matters because it is a way in to something. `postgres://saleor:saleor@localhost`
+ * is a way in to the machine it is already running on, and `user:password@example.com` points at
+ * a domain reserved by RFC 2606 precisely so that it cannot be anybody's system.
+ *
+ * Measured on Saleor at its pinned commit: six findings were reported as needing someone now, at
+ * high severity, each telling the team to "revoke it at the issuer first". Three were the Django
+ * local-development default in settings.py, one of them on a commented-out line, and the evidence
+ * offered was that the value "has the randomness of a real credential" - about the word `saleor`.
+ *
+ * Nothing is dropped. The finding becomes a placeholder finding, shown as noise with its reason
+ * attached. Suppressing a real secret is far worse than reporting a false one, so the two tests
+ * are narrow: a destination that provably reaches nobody, and a password identical to its own
+ * username, which nobody chooses for a credential that guards anything.
+ */
+/** Domains that exist so they cannot be anybody's system (RFC 2606, RFC 6761). */
+const RESERVED = /^(?:[\w-]+\.)*example\.(?:com|org|net)$|\.(?:invalid|test|localhost|local)$/i;
+/** Addresses that only ever mean the machine the code is running on. */
+const THIS_MACHINE = /^(?:localhost|127\.0\.0\.1|\[?::1\]?|0\.0\.0\.0)$/i;
+const CREDENTIALLED_URL = /[a-z][a-z0-9+.-]*:\/\/([^:/\s'\"]+):([^@\s'\"]+)@([^/\s'\"?#]+)/gi;
+/**
+ * A credential whose destination is the machine it runs on.
+ *
+ * This is deliberately not treated as a placeholder. A hardcoded password in settings.py is a real
+ * string that a person should see - an earlier phase decided exactly that, about this exact case -
+ * and calling it noise would hide it. What was wrong was only the urgency: Saleor's Django default
+ * was reported as needing someone now, at high severity, told to "revoke it at the issuer first".
+ * There is no issuer. It belongs in "real, but not reachable", which is the bucket for something
+ * true of the repository and not of what it runs.
+ */
+export function credentialGoesNowhere(value, line) {
+    for (const [, , password, hostport] of [...value.matchAll(CREDENTIALLED_URL), ...[...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value)]) {
+        if (password !== value && !value.includes(password))
+            continue;
+        const host = hostport.replace(/:\d+$/, '');
+        if (THIS_MACHINE.test(host))
+            return `the URL points at ${host}, so it reaches only the machine it runs on`;
+    }
+    return null;
+}
+export function urlCredentialIsHarmless(value, line) {
+    // The URL rules capture the whole URL as the value, not the password inside it - which is also
+    // why these pass the entropy gate at all, and why the report offered "the randomness of a real
+    // credential (3.82 bits per character)" as evidence about a string that is mostly the word
+    // `postgres` and a hostname. So the value is read as a URL first, and only then looked for inside
+    // the line, which is how the patterns that do capture a bare password arrive here.
+    const inValue = [...value.matchAll(CREDENTIALLED_URL)];
+    const inLine = [...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value);
+    for (const [, user, password, hostport] of [...inValue, ...inLine]) {
+        const host = hostport.replace(/:\d+$/, '');
+        if (RESERVED.test(host))
+            return `the URL points at ${host}, a domain reserved so that it cannot be anybody's system`;
+        if (user.toLowerCase() === password.toLowerCase())
+            return 'the user and the password are the same word, which is a stand-in rather than a credential';
+    }
+    return null;
+}
+export function looksPlanted(value, line, file, before = '', whole = value) {
     if (PLACEHOLDER_WORDS.test(value))
         return 'the value itself says it is an example';
-    if (PLACEHOLDER_WORDS.test(line))
+    // Only the words *around* the credential are commentary about it. A hostname or a database name
+    // inside the URL is part of the credential: a real password at db.acme-prod.example-corp.io was
+    // dismissed because "example" was in the line, and it was in the line because it was in the host.
+    const around = line.split(whole).join(' ');
+    if (PLACEHOLDER_WORDS.test(around))
         return 'the line around it says it is an example';
     // JSON and YAML put the key on its own line when the value is long, and an OpenAPI schema is all
     // long values. nocodb declares `"example":` and then the token underneath it, so reading only the
@@ -83,6 +147,9 @@ export function looksPlanted(value, line, file, before = '') {
         return 'the key above it says it is an example';
     if (/(.)\1{5,}/.test(value))
         return 'the value repeats one character, so it is a stand-in';
+    const harmless = urlCredentialIsHarmless(value, line);
+    if (harmless)
+        return harmless;
     return null;
 }
 /** True when only the file's name suggests a template, whatever the value itself looks like. */
@@ -150,7 +217,16 @@ export function scanSecrets(root, files = sourceFiles(root)) {
         for (const { kind, what, re, minEntropy } of PATTERNS) {
             for (const match of text.matchAll(re)) {
                 const value = match[1];
-                const entropy = entropyOf(value);
+                // Where a pattern captures the credential separately, that is what gets judged. The two
+                // URL rules capture the whole URL first and the password second, and judging the URL meant
+                // a hostname or a database name decided whether a password was real: a genuine credential
+                // at db.acme-prod.example-corp.io was dismissed because its host contains "example", and
+                // any connection string to a database called sample or demo would go the same way.
+                // Suppressing a real secret is the worst thing this scanner can do, and it was one word in
+                // an unrelated part of the string away. The whole match is still what gets redacted, so
+                // nothing of the URL is printed either way.
+                const secret = match[2] ?? value;
+                const entropy = entropyOf(secret);
                 if (entropy < (minEntropy ?? 3))
                     continue;
                 const index = match.index ?? 0;
@@ -170,7 +246,8 @@ export function scanSecrets(root, files = sourceFiles(root)) {
                     line,
                     evidence: redact(lines[line - 1] ?? '', value),
                     entropy: Number(entropy.toFixed(2)),
-                    placeholder: looksPlanted(value, lines[line - 1] ?? '', rel, lines[line - 2] ?? ''),
+                    placeholder: looksPlanted(secret, lines[line - 1] ?? '', rel, lines[line - 2] ?? '', value),
+                    localOnly: credentialGoesNowhere(value, lines[line - 1] ?? ''),
                     template: inATemplate(rel),
                 });
             }

package/dist/engine/secure/secure-command.js

@@ -92,8 +92,13 @@ export async function runSecure(cmd) {
     }
     if (cmd.zapReport) {
         const fromZap = readZapReport(resolve(cmd.zapReport));
-        checked.push(`an OWASP ZAP report (${fromZap.length} finding(s))`);
-        for (const finding of fromZap)
+        // Named as checked only once it has been read. "(0 finding(s))" above a file Tewip could not
+        // open is a measurement of nothing, and a mistyped path answered exactly like a clean scan.
+        if (fromZap.problem)
+            notChecked.push(`the ZAP report you asked for: ${fromZap.problem}`);
+        else
+            checked.push(`an OWASP ZAP report (${fromZap.findings.length} finding(s))`);
+        for (const finding of fromZap.findings)
             items.push(triageWeb(finding, accepted));
     }
     else if (cmd.url) {

package/dist/engine/secure/triage.js

@@ -63,6 +63,15 @@ export function triageSecret(finding, root, accepted) {
     if (finding.placeholder) {
         return { ...base, verdict: 'noise', severity: 'low', why: `${finding.placeholder}: ${finding.evidence}`, next: 'nothing: this is not a credential' };
     }
+    if (finding.localOnly) {
+        return {
+            ...base,
+            verdict: 'not-reachable',
+            severity: 'low',
+            why: `${finding.evidence} - ${finding.localOnly}`,
+            next: 'nothing to revoke, because nothing outside this machine accepts it. Worth replacing with a value read from the environment, on a normal schedule.',
+        };
+    }
     if (finding.template) {
         // Only the file's name says this is a template; the value itself looks like a real credential.
         // Dismissing it would hide the commonest accident there is - a working key pasted into an

package/dist/engine/secure/zap.js

@@ -10,17 +10,22 @@ const RISK = { High: 'high', Medium: 'medium', Low: 'low', Informational: 'low'
 /** Findings from a ZAP JSON report, in Tewip's own shape. */
 export function readZapReport(path) {
     if (!existsSync(path))
-        return [];
+        return { findings: [], problem: `there is no file at ${path}` };
     let report;
     try {
         report = JSON.parse(readFileSync(path, 'utf8'));
     }
     catch {
-        return [];
+        return { findings: [], problem: `${path} is not JSON, so it is not a ZAP report Tewip can read` };
+    }
+    // ZAP always writes `site`, one entry per host it scanned, even when it found nothing. Anything
+    // without it is some other tool's JSON, or ZAP's own error body.
+    if (!Array.isArray(report?.site)) {
+        return { findings: [], problem: `${path} is JSON but not a ZAP report: it has no "site" list` };
     }
     const alerts = (report.site ?? []).flatMap((site) => site.alerts ?? []);
     const strip = (html) => html.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
-    return alerts.map((alert) => {
+    const findings = alerts.map((alert) => {
         const risk = (alert.riskdesc ?? '').split(' ')[0];
         const first = (alert.instances ?? [])[0] ?? {};
         return {
@@ -32,6 +37,7 @@ export function readZapReport(path) {
             next: strip(alert.solution ?? '').slice(0, 300) || 'see the ZAP report for the recommended fix',
         };
     });
+    return { findings, problem: null };
 }
 /** Whether a ZAP baseline scan can be run from here at all. */
 export function zapAvailable(cwd) {

package/dist/engine/vouch/vouch-command.js

@@ -73,6 +73,30 @@ export function vouchAll(root, paths) {
 }
 const count = (all, verdict) => all.filter((j) => j.verdict === verdict).length;
 export function renderVouch(files) {
+    // No test file was read, so there is nothing to say about tests.
+    //
+    // This printed the ordinary summary - "0 test(s) read in 0 file(s). **0 cannot fail at all.**" -
+    // followed by the heading **"Nothing here is unable to fail"** and the line "Every test read can
+    // be broken by a change to the code". All true of nothing, and all of it reads as a pass, in the
+    // command whose entire job is to find tests that cannot fail.
+    //
+    // The comment in `testFilesUnder` above already diagnosed this in Phase 36, when three languages
+    // were missing from the extension list and a file named outright came back as "0 test(s) read in
+    // 0 file(s) - which reads like a clean answer and is not one". The cause was fixed; the report
+    // was not, so every other way of reading nothing still produced a pass: the wrong folder, a
+    // framework Tewip does not recognise, or a project that genuinely has no tests yet.
+    if (files.length === 0) {
+        return [
+            '# Which of these tests could fail?',
+            '',
+            '**No test file was read, so nothing here has been checked.** This is not a report that your tests are sound - it is a report that Tewip found none to look at.',
+            '',
+            'Three things usually explain it: the path given holds no tests, the tests are somewhere Tewip was not pointed at (`tewip vouch <path>`), or they are written in a language it cannot read yet.',
+            '',
+            'It reads JavaScript, TypeScript, Python, Java, Kotlin, Scala, Groovy, Go, C#, F#, Ruby, PHP and Rust.',
+            '',
+        ].join(String.fromCharCode(10));
+    }
     const all = files.flatMap((f) => f.judgements);
     const cannotFail = all.filter((j) => CANNOT_FAIL.includes(j.verdict));
     const crashOnly = count(all, 'crash-only');

package/dist/scripts/explain.js

@@ -50,8 +50,19 @@ async function main() {
     const index = new HistoryIndex([...pastRecords, ...imported.records], [...pastRuns, imported.summary]);
     const items = await buildItems(imported.records, index, { dataset: `local: ${name}`, llm: llmFromEnv(), corrections: loadCorrections(historyDir) });
     const tests = Object.keys(imported.summary.attempts).length;
-    if (items.length === 0)
-        console.log(`All ${tests} test(s) passed. Nothing to explain.`);
+    // A report missing part of itself is not a report that nothing went wrong. This goes first,
+    // above any board and in place of any all-clear, because it changes what everything below means.
+    if (imported.incomplete.length > 0) {
+        console.log('**This run is incomplete.**');
+        for (const why of imported.incomplete)
+            console.log(`- ${why}`);
+        console.log('');
+    }
+    if (items.length === 0) {
+        console.log(imported.incomplete.length > 0
+            ? `The ${tests} test(s) that did arrive all passed. That is not the same as the run passing, and Tewip cannot say whether the missing part did.`
+            : `All ${tests} test(s) passed. Nothing to explain.`);
+    }
     else
         console.log(sdetBoardView(items, runId, `local: ${name}`).markdown);
     // Keep this run as history for the next one, with its diagnoses.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.70.13",
+  "version": "0.70.15",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
@@ -65,6 +65,7 @@
     "prepack": "npm run build",
     "tewip": "node cli/tewip.ts",
     "version": "node scripts/sync-version.ts && git add server.json",
+    "channels": "node scripts/channels.ts",
     "corpus": "node scripts/corpus.ts"
   },
   "license": "Apache-2.0",