tewip-ai 0.70.14 → 0.70.15

package/dist/engine/release/channels.js

@@ -0,0 +1,67 @@
+// Is every place Tewip is published actually carrying this release?
+//
+// There is a standing rule on this project: check every distribution channel after every
+// improvement, because a stale channel looks exactly like a current one. It was being done by hand,
+// and by hand it failed twice in one day - not because the check was skipped, but because the
+// question was wrong. The MCP registry was asked `?search=<name>&limit=100`, which returns a capped
+// version history and came back without the two newest releases in it. It answered with a version
+// number, the version number looked plausible, and it would have looked just as plausible if
+// nothing were wrong.
+//
+// So the verdict here has three values, not two. `unverified` is the whole point of the file: a
+// channel nobody could read is not a channel that is up to date, and must never be rendered as one.
+/** Compares two dotted versions. Missing parts count as zero, so 0.70 is older than 0.70.1. */
+export function compareVersions(a, b) {
+    const parts = (v) => v.split('.').map((n) => Number.parseInt(n, 10) || 0);
+    const [x, y] = [parts(a), parts(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        const d = (x[i] ?? 0) - (y[i] ?? 0);
+        if (d !== 0)
+            return d < 0 ? -1 : 1;
+    }
+    return 0;
+}
+export function judge(reading) {
+    if (reading.actual === null) {
+        return {
+            ...reading,
+            verdict: 'unverified',
+            says: `could not be read${reading.problem ? `: ${reading.problem}` : ''}. This is not the same as being up to date - nothing here says whether ${reading.name} has ${reading.expected} or not.`,
+        };
+    }
+    const order = compareVersions(reading.actual, reading.expected);
+    if (order === 0)
+        return { ...reading, verdict: 'current', says: `has ${reading.actual}.` };
+    if (order < 0) {
+        return { ...reading, verdict: 'behind', says: `has ${reading.actual}, but this repository is at ${reading.expected}. The release did not reach it.` };
+    }
+    // Ahead is not an error on its own: the editor extension keeps its own version line, and a
+    // channel can legitimately carry something this checkout has not caught up with.
+    return { ...reading, verdict: 'ahead', says: `has ${reading.actual}, which is newer than this checkout's ${reading.expected}.` };
+}
+const MARK = { current: 'ok', behind: 'BEHIND', ahead: 'ahead', unverified: 'UNVERIFIED' };
+/** The whole answer, written so the two states that need a person are impossible to skim past. */
+export function renderChannels(readings) {
+    const judged = readings.map(judge);
+    const width = Math.max(...judged.map((c) => c.name.length), 12);
+    const lines = ['Where Tewip is published', ''];
+    for (const c of judged)
+        lines.push(`  ${MARK[c.verdict].padEnd(11)} ${c.name.padEnd(width)}  ${c.says}`);
+    const behind = judged.filter((c) => c.verdict === 'behind');
+    const unverified = judged.filter((c) => c.verdict === 'unverified');
+    lines.push('');
+    if (behind.length > 0) {
+        lines.push(`${behind.length} channel(s) did not get this release: ${behind.map((c) => c.name).join(', ')}.`, '');
+    }
+    if (unverified.length > 0) {
+        // Named separately from `behind` on purpose. Folding the two together is how an unanswered
+        // query becomes a clean report.
+        lines.push(`${unverified.length} channel(s) could not be checked at all: ${unverified.map((c) => c.name).join(', ')}. Nothing above says whether those are current.`, '');
+    }
+    if (behind.length === 0 && unverified.length === 0)
+        lines.push('Every channel answered, and every one has this release.', '');
+    lines.push('How each was asked:');
+    for (const c of judged)
+        lines.push(`  ${c.name}: ${c.asked}`);
+    return { text: lines.join(String.fromCharCode(10)), behind: behind.length, unverified: unverified.length };
+}

package/dist/engine/secure/secrets.js

@@ -71,10 +71,74 @@ const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\
  * there is, and a key pasted into an example file by accident is one of the commonest ways
  * credentials leak. That case is now shown as a template finding instead of being dismissed.
  */
-export function looksPlanted(value, line, file, before = '') {
+/**
+ * A URL-shaped credential whose destination cannot be a real system, or whose user and password
+ * are the same word.
+ *
+ * A credential matters because it is a way in to something. `postgres://saleor:saleor@localhost`
+ * is a way in to the machine it is already running on, and `user:password@example.com` points at
+ * a domain reserved by RFC 2606 precisely so that it cannot be anybody's system.
+ *
+ * Measured on Saleor at its pinned commit: six findings were reported as needing someone now, at
+ * high severity, each telling the team to "revoke it at the issuer first". Three were the Django
+ * local-development default in settings.py, one of them on a commented-out line, and the evidence
+ * offered was that the value "has the randomness of a real credential" - about the word `saleor`.
+ *
+ * Nothing is dropped. The finding becomes a placeholder finding, shown as noise with its reason
+ * attached. Suppressing a real secret is far worse than reporting a false one, so the two tests
+ * are narrow: a destination that provably reaches nobody, and a password identical to its own
+ * username, which nobody chooses for a credential that guards anything.
+ */
+/** Domains that exist so they cannot be anybody's system (RFC 2606, RFC 6761). */
+const RESERVED = /^(?:[\w-]+\.)*example\.(?:com|org|net)$|\.(?:invalid|test|localhost|local)$/i;
+/** Addresses that only ever mean the machine the code is running on. */
+const THIS_MACHINE = /^(?:localhost|127\.0\.0\.1|\[?::1\]?|0\.0\.0\.0)$/i;
+const CREDENTIALLED_URL = /[a-z][a-z0-9+.-]*:\/\/([^:/\s'\"]+):([^@\s'\"]+)@([^/\s'\"?#]+)/gi;
+/**
+ * A credential whose destination is the machine it runs on.
+ *
+ * This is deliberately not treated as a placeholder. A hardcoded password in settings.py is a real
+ * string that a person should see - an earlier phase decided exactly that, about this exact case -
+ * and calling it noise would hide it. What was wrong was only the urgency: Saleor's Django default
+ * was reported as needing someone now, at high severity, told to "revoke it at the issuer first".
+ * There is no issuer. It belongs in "real, but not reachable", which is the bucket for something
+ * true of the repository and not of what it runs.
+ */
+export function credentialGoesNowhere(value, line) {
+    for (const [, , password, hostport] of [...value.matchAll(CREDENTIALLED_URL), ...[...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value)]) {
+        if (password !== value && !value.includes(password))
+            continue;
+        const host = hostport.replace(/:\d+$/, '');
+        if (THIS_MACHINE.test(host))
+            return `the URL points at ${host}, so it reaches only the machine it runs on`;
+    }
+    return null;
+}
+export function urlCredentialIsHarmless(value, line) {
+    // The URL rules capture the whole URL as the value, not the password inside it - which is also
+    // why these pass the entropy gate at all, and why the report offered "the randomness of a real
+    // credential (3.82 bits per character)" as evidence about a string that is mostly the word
+    // `postgres` and a hostname. So the value is read as a URL first, and only then looked for inside
+    // the line, which is how the patterns that do capture a bare password arrive here.
+    const inValue = [...value.matchAll(CREDENTIALLED_URL)];
+    const inLine = [...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value);
+    for (const [, user, password, hostport] of [...inValue, ...inLine]) {
+        const host = hostport.replace(/:\d+$/, '');
+        if (RESERVED.test(host))
+            return `the URL points at ${host}, a domain reserved so that it cannot be anybody's system`;
+        if (user.toLowerCase() === password.toLowerCase())
+            return 'the user and the password are the same word, which is a stand-in rather than a credential';
+    }
+    return null;
+}
+export function looksPlanted(value, line, file, before = '', whole = value) {
     if (PLACEHOLDER_WORDS.test(value))
         return 'the value itself says it is an example';
-    if (PLACEHOLDER_WORDS.test(line))
+    // Only the words *around* the credential are commentary about it. A hostname or a database name
+    // inside the URL is part of the credential: a real password at db.acme-prod.example-corp.io was
+    // dismissed because "example" was in the line, and it was in the line because it was in the host.
+    const around = line.split(whole).join(' ');
+    if (PLACEHOLDER_WORDS.test(around))
         return 'the line around it says it is an example';
     // JSON and YAML put the key on its own line when the value is long, and an OpenAPI schema is all
     // long values. nocodb declares `"example":` and then the token underneath it, so reading only the
@@ -83,6 +147,9 @@ export function looksPlanted(value, line, file, before = '') {
         return 'the key above it says it is an example';
     if (/(.)\1{5,}/.test(value))
         return 'the value repeats one character, so it is a stand-in';
+    const harmless = urlCredentialIsHarmless(value, line);
+    if (harmless)
+        return harmless;
     return null;
 }
 /** True when only the file's name suggests a template, whatever the value itself looks like. */
@@ -150,7 +217,16 @@ export function scanSecrets(root, files = sourceFiles(root)) {
         for (const { kind, what, re, minEntropy } of PATTERNS) {
             for (const match of text.matchAll(re)) {
                 const value = match[1];
-                const entropy = entropyOf(value);
+                // Where a pattern captures the credential separately, that is what gets judged. The two
+                // URL rules capture the whole URL first and the password second, and judging the URL meant
+                // a hostname or a database name decided whether a password was real: a genuine credential
+                // at db.acme-prod.example-corp.io was dismissed because its host contains "example", and
+                // any connection string to a database called sample or demo would go the same way.
+                // Suppressing a real secret is the worst thing this scanner can do, and it was one word in
+                // an unrelated part of the string away. The whole match is still what gets redacted, so
+                // nothing of the URL is printed either way.
+                const secret = match[2] ?? value;
+                const entropy = entropyOf(secret);
                 if (entropy < (minEntropy ?? 3))
                     continue;
                 const index = match.index ?? 0;
@@ -170,7 +246,8 @@ export function scanSecrets(root, files = sourceFiles(root)) {
                     line,
                     evidence: redact(lines[line - 1] ?? '', value),
                     entropy: Number(entropy.toFixed(2)),
-                    placeholder: looksPlanted(value, lines[line - 1] ?? '', rel, lines[line - 2] ?? ''),
+                    placeholder: looksPlanted(secret, lines[line - 1] ?? '', rel, lines[line - 2] ?? '', value),
+                    localOnly: credentialGoesNowhere(value, lines[line - 1] ?? ''),
                     template: inATemplate(rel),
                 });
             }

package/dist/engine/secure/triage.js

@@ -63,6 +63,15 @@ export function triageSecret(finding, root, accepted) {
     if (finding.placeholder) {
         return { ...base, verdict: 'noise', severity: 'low', why: `${finding.placeholder}: ${finding.evidence}`, next: 'nothing: this is not a credential' };
     }
+    if (finding.localOnly) {
+        return {
+            ...base,
+            verdict: 'not-reachable',
+            severity: 'low',
+            why: `${finding.evidence} - ${finding.localOnly}`,
+            next: 'nothing to revoke, because nothing outside this machine accepts it. Worth replacing with a value read from the environment, on a normal schedule.',
+        };
+    }
     if (finding.template) {
         // Only the file's name says this is a template; the value itself looks like a real credential.
         // Dismissing it would hide the commonest accident there is - a working key pasted into an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.70.14",
+  "version": "0.70.15",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
@@ -65,6 +65,7 @@
     "prepack": "npm run build",
     "tewip": "node cli/tewip.ts",
     "version": "node scripts/sync-version.ts && git add server.json",
+    "channels": "node scripts/channels.ts",
     "corpus": "node scripts/corpus.ts"
   },
   "license": "Apache-2.0",