tewip-ai 0.74.0 → 0.76.0

package/README.md

@@ -1244,6 +1244,22 @@ offline, in CI, before anything runs.
   text the agent did not write can tell it to read the private thing and post it somewhere, and
   every step is a tool it was given on purpose. A system prompt is not a defence, because whoever
   writes the untrusted text writes the other half of the prompt. Tewip names the tools in each leg.
+- **Text somebody else wrote, glued into a prompt.** The trifecta above is an argument about what
+  *could* happen, from the tool list. This is what the code does: a value off a web page, a ticket,
+  an inbox or a retriever, written **into** the prompt string rather than passed beside it. A prompt
+  has no parameter binding to fall back on, so once the text is in the string the model cannot tell
+  your instruction from theirs. Reported apart when the same function also hands the model tools,
+  because that is the difference between a wrong answer and a tool call somebody else chose. On
+  1,691 files of real agent code: **zero findings**, which is the precision claim; recall is
+  measured against planted examples and said to be.
+- **What the coding agent installed here was permitted to do.** `.claude/settings.json` and
+  `.mcp.json` are committed, anybody with write access can change them, and neither turns up in a
+  review the way a source file does. Tewip names the approval gate switched off
+  (`"defaultMode": "bypassPermissions"`), an allow entry that grants a shell with no constraint on
+  the command, every tool server trusted without approval, a credential written into a committed
+  file - located, never printed - and a boundary widened past the project. A `PreToolUse` hook
+  counts as a real gate, because the harness enforces it on every call; a rule in a markdown file
+  is a request to the model and does not.
 - **What stands in the way**: a human approval gate, a dry run, a step budget, a tool allow-list -
   and says plainly when nothing anywhere in the project has one. A ceiling written as
   `max_iterations=None` is reported apart from no ceiling at all, because it reads as deliberate.

package/dist/engine/agent/agent-command.js

@@ -3,6 +3,8 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { relative } from 'node:path';
 import { scanSourceFiles } from '../walk.js';
 import { CAPABILITY_MEANS, FRAMEWORKS_READ, IRREVERSIBLE, toolsIn, trifectaIn } from './tools.js';
+import { promptFlows } from './prompt-flow.js';
+import { configSection, scanConfig } from './claude-config.js';
 import { budgetSetToNothing, guardsIn, GUARD_MEANS, GUARD_PREVENTS } from './guards.js';
 const NL = String.fromCharCode(10);
 const AGENT_FILE = /\.(?:py|[cm]?[jt]sx?)$/i;
@@ -22,6 +24,7 @@ const NOT_SHIPPED = /(?:^|[\\/])(?:tests?|[\w-]+[_-]tests?|__tests__|spec|e2e|ex
 export function scanAgent(root) {
     const scan = scanSourceFiles(root, 20_000, (f) => AGENT_FILE.test(f));
     const tools = [];
+    const injections = [];
     const guards = [];
     let emptyBudget = null;
     let filesRead = 0;
@@ -38,6 +41,7 @@ export function scanAgent(root) {
         }
         filesRead += 1;
         tools.push(...toolsIn(where, text));
+        injections.push(...promptFlows(where, text));
         guards.push(...guardsIn(where, text));
         if (!emptyBudget) {
             const empty = budgetSetToNothing(text);
@@ -45,7 +49,7 @@ export function scanAgent(root) {
                 emptyBudget = { file: where, text: empty };
         }
     }
-    return { tools, guards, filesRead, emptyBudget };
+    return { tools, injections, guards, filesRead, emptyBudget, config: scanConfig(root) };
 }
 const REACH_READS = {
     destructive: 'cannot be undone',
@@ -58,12 +62,13 @@ const REACH_READS = {
     'not-sure': '**not decided**',
 };
 export function renderAgent(scan, root) {
-    const { tools, guards, filesRead, emptyBudget } = scan;
+    const { tools, injections, guards, filesRead, emptyBudget, config } = scan;
     const lines = ['# What this agent is allowed to do', ''];
     if (tools.length === 0) {
         return [
             '# What this agent is allowed to do',
             '',
+            ...configSection(config),
             `No tool definitions were found in ${filesRead} file(s).`,
             '',
             'That is a fact about what was looked for, not a finding that this agent has no tools. These',
@@ -77,6 +82,12 @@ export function renderAgent(scan, root) {
         ].join(NL);
     }
     const kinds = new Set(guards.map((g) => g.kind));
+    // A permission list is an allow-list, and a PreToolUse hook is enforced on every call - both are
+    // the real thing rather than a pattern someone wrote in a prompt.
+    if (config.hasAllowList)
+        kinds.add('tool-allow-list');
+    if (config.hasEnforcedHook)
+        kinds.add('asks-a-person');
     const risky = tools.filter((t) => IRREVERSIBLE.includes(t.reach));
     const undecided = tools.filter((t) => t.reach === 'not-sure');
     lines.push(`${tools.length} tool(s) in ${filesRead} file(s) read locally. No model was called and nothing left this machine.`, '');
@@ -109,6 +120,19 @@ export function renderAgent(scan, root) {
     if (undecided.length > 0) {
         lines.push('## The ones this could not decide about', '', 'Read these yourself. They are listed here rather than counted as harmless, which is the only', 'honest thing to do with a tool whose name does not say what it touches.', '', ...undecided.map((t) => `- \`${t.name}\`${t.description ? ` — "${t.description.slice(0, 90)}"` : ''} — ${t.file}:${t.line}`), '');
     }
+    if (injections.length > 0) {
+        const armed = injections.filter((i) => i.withTools);
+        lines.push('## Text somebody else wrote, glued into a prompt', '', armed.length > 0
+            ? `${injections.length} place(s), and ${armed.length} of them in a function that also hands the model tools. A prompt has no parameter binding: once the text is in the string, the model cannot tell your instruction from theirs.`
+            : `${injections.length} place(s). None is in a function that also hands the model tools, so the worst case here is a wrong answer rather than a tool call somebody else chose.`, '');
+        for (const i of injections.slice(0, 20)) {
+            lines.push(`- ${i.file}:${i.line} — ${i.origin}, in by ${i.through}${i.withTools ? ' — **and this function has tools**' : ''}`);
+            lines.push(`  \`${i.evidence}\``);
+        }
+        if (injections.length > 20)
+            lines.push(`…and ${injections.length - 20} more`);
+        lines.push('');
+    }
     lines.push('## The lethal trifecta', '');
     if (trifecta.complete) {
         lines.push('All three legs are present. Breaking any one of them breaks the attack:', '');
@@ -122,6 +146,7 @@ export function renderAgent(scan, root) {
         lines.push(`- **${capability}** (${CAPABILITY_MEANS[capability]}): ${legTools.length === 0 ? 'nothing found' : legTools.slice(0, 6).map((t) => `\`${t.name}\``).join(', ') + (legTools.length > 6 ? `, and ${legTools.length - 6} more` : '')}`);
     }
     lines.push('');
+    lines.push(...configSection(config));
     lines.push('## What stands between them and the real world', '');
     for (const kind of ['asks-a-person', 'dry-run', 'step-budget', 'tool-allow-list']) {
         const found = guards.find((g) => g.kind === kind);
@@ -133,7 +158,7 @@ export function renderAgent(scan, root) {
     if (emptyBudget) {
         lines.push('### A ceiling that is written down and set to nothing', '', `\`${emptyBudget.text}\` in ${emptyBudget.file}. A budget removed this way reads as deliberate, and a check`, 'that only looked for the word would have called it a budget.', '');
     }
-    lines.push('## What this does not check', '', '- **Whether a gate that exists stands in front of these tools.** Finding `interrupt()` in a', '  project means somebody wrote one, not that the refund tool is behind it. That is a question', '  about the graph at run time, and reading the source does not answer it.', '- **Whether the agent is ever given these tools.** A tool can be defined and never passed to a', '  model. This lists what exists, not what is wired up.', '- **What the model will actually do with them.** No prompt was judged and nothing was run.', '- **Tools assembled at run time**, from a registry, a plugin folder or a config file.', '- **Frameworks not in the list above.** Silence about a framework is silence, not approval.', '', 'Every line here is re-derivable: run `tewip agent` in this directory and you get it back.', '');
+    lines.push('## What this does not check', '', '- **Whether a gate that exists stands in front of these tools.** Finding `interrupt()` in a', '  project means somebody wrote one, not that the refund tool is behind it. That is a question', '  about the graph at run time, and reading the source does not answer it.', '- **Whether the agent is ever given these tools.** A tool can be defined and never passed to a', '  model. This lists what exists, not what is wired up.', '- **What the model will actually do with them.** No prompt was judged and nothing was run.', '- **Untrusted text reaching a prompt through more than one step.** A value that passes through', '  two variables, another function or a different file is not followed, and is not reported.', '- **Tools assembled at run time**, from a registry, a plugin folder or a config file.', '- **Frameworks not in the list above.** Silence about a framework is silence, not approval.', '', 'Every line here is re-derivable: run `tewip agent` in this directory and you get it back.', '');
     return lines.join(NL);
 }
 const rank = (r) => (IRREVERSIBLE.includes(r) ? 0 : r === 'not-sure' ? 1 : r === 'writes' ? 2 : 3);

package/dist/engine/agent/claude-config.js

@@ -0,0 +1,166 @@
+// The permissions a coding agent was given in this repository, read from the files that grant them.
+//
+// `tools.ts` reads what an agent you wrote can call. This reads what an agent you *installed* was
+// allowed to do here - Claude Code's `.claude/settings.json` and the project's `.mcp.json`, both of
+// which are committed, both of which anybody with write access can change, and neither of which
+// turns up in a code review the way a source file does.
+//
+// Worth saying plainly, because it is the whole reason this is a separate check: a rule written in
+// a markdown file is a request to the model. A permission in settings.json is enforced by the
+// harness on every tool call. They look equally like configuration and they are not the same kind
+// of thing at all, and only one of them is a control an auditor can rely on.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+// Spelled with forward slashes, which is how every other path in a Tewip report is spelled and
+// how a reader will search for it. `join` gives a backslash on Windows and the report then names a
+// file that does not look like the one in the repository.
+const FILES = ['.claude/settings.json', '.claude/settings.local.json', '.mcp.json'];
+/**
+ * An allow entry that grants a shell with no constraint on the command.
+ *
+ * `Bash(npm run test:*)` is a decision somebody made. `Bash`, `Bash(*)` and `Bash(*:*)` are the
+ * absence of one: they permit `rm -rf`, `curl | sh` and anything else, and they are what people
+ * write when the prompts became annoying.
+ */
+const UNCONSTRAINED = /^(?:Bash|Execute|Shell|Run)(?:\(\s*\*?\s*(?::\s*\*\s*)?\))?$/i;
+/** A value written into a committed file that looks like a credential rather than a reference. */
+const LOOKS_SECRET = /(?:KEY|TOKEN|SECRET|PASSWORD|PASS|CREDENTIAL|API)/i;
+const read = (root, name) => {
+    const path = join(root, ...name.split('/'));
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const json = JSON.parse(raw);
+        return json && typeof json === 'object' ? { json, raw } : null;
+    }
+    catch {
+        // A file that does not parse is not a file that grants nothing, and saying so beats guessing.
+        return null;
+    }
+};
+const asList = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+export function scanConfig(root) {
+    const out = { read: [], findings: [], servers: [], hasAllowList: false, hasEnforcedHook: false };
+    for (const name of FILES.slice(0, 2)) {
+        const file = read(root, name);
+        if (!file)
+            continue;
+        out.read.push(name);
+        const permissions = (file.json.permissions ?? {});
+        const allow = asList(permissions.allow);
+        const deny = asList(permissions.deny);
+        if (allow.length > 0 || deny.length > 0)
+            out.hasAllowList = true;
+        // The gate switched off outright. Nothing else in this file matters as much.
+        if (permissions.defaultMode === 'bypassPermissions') {
+            out.findings.push({
+                rule: 'permissions-bypassed',
+                file: name,
+                what: '"defaultMode": "bypassPermissions"',
+                why: 'every tool call here runs without asking, including the ones that delete, pay or send. This is the approval gate being switched off in a committed file.',
+            });
+        }
+        if (permissions.defaultMode === 'acceptEdits') {
+            out.findings.push({
+                rule: 'edits-auto-accepted',
+                file: name,
+                what: '"defaultMode": "acceptEdits"',
+                why: 'file edits are applied without asking. Weaker than bypassing everything, and still a person out of the loop on every change to the working tree.',
+            });
+        }
+        for (const entry of allow) {
+            if (!UNCONSTRAINED.test(entry.trim()))
+                continue;
+            out.findings.push({
+                rule: 'shell-unconstrained',
+                file: name,
+                what: `"allow": [… "${entry}" …]`,
+                why: 'this permits any shell command, not a named one. `Bash(npm run test:*)` is a decision; this is the absence of one.',
+            });
+        }
+        if (file.json.enableAllProjectMcpServers === true) {
+            out.findings.push({
+                rule: 'mcp-auto-trusted',
+                file: name,
+                what: '"enableAllProjectMcpServers": true',
+                why: 'every server in .mcp.json is trusted without being approved, including any added later by anyone who can commit to this repository.',
+            });
+        }
+        const env = (file.json.env ?? {});
+        for (const [key, value] of Object.entries(env)) {
+            // A reference to a variable is fine; a literal is the secret itself, in a committed file.
+            if (!LOOKS_SECRET.test(key) || typeof value !== 'string' || value === '' || value.startsWith('$'))
+                continue;
+            out.findings.push({
+                rule: 'secret-in-settings',
+                file: name,
+                what: `"env": { "${key}": … }`,
+                why: 'a credential written into a file that is committed. Tewip does not print the value; the point is that it is there.',
+            });
+        }
+        const extra = asList(permissions.additionalDirectories);
+        if (extra.length > 0) {
+            out.findings.push({
+                rule: 'boundary-widened',
+                file: name,
+                what: `"additionalDirectories": [${extra.slice(0, 3).map((d) => `"${d}"`).join(', ')}]`,
+                why: 'the agent may read and write outside this project. Whatever is on the other end is inside the blast radius.',
+            });
+        }
+        const hooks = (file.json.hooks ?? {});
+        // PreToolUse is the one that can refuse a call. The others observe it after the fact.
+        if (Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0)
+            out.hasEnforcedHook = true;
+    }
+    const mcp = read(root, '.mcp.json');
+    if (mcp) {
+        out.read.push('.mcp.json');
+        const servers = (mcp.json.mcpServers ?? {});
+        for (const [name, spec] of Object.entries(servers)) {
+            const url = typeof spec?.url === 'string' ? spec.url : '';
+            const command = typeof spec?.command === 'string' ? spec.command : '';
+            const args = asList(spec?.args).join(' ');
+            out.servers.push(url
+                ? { name, where: 'somewhere else', detail: url.replace(/\/\/[^@]*@/, '//') }
+                : { name, where: 'this machine', detail: `${command} ${args}`.trim().slice(0, 90) });
+        }
+    }
+    return out;
+}
+/** What each rule stops, for a reader deciding which to act on first. */
+export const CONFIG_MEANS = {
+    'permissions-bypassed': 'nothing is asked before any tool call',
+    'edits-auto-accepted': 'file edits are applied without asking',
+    'shell-unconstrained': 'any shell command is permitted',
+    'mcp-auto-trusted': 'tool servers are trusted without approval',
+    'secret-in-settings': 'a credential is committed',
+    'boundary-widened': 'the agent may work outside this project',
+};
+/**
+ * What the coding agent installed here was permitted to do.
+ *
+ * Rendered whether or not any tools were found, because the two are independent: a repository with
+ * no agent code of its own can still hand Claude Code a shell with no constraint on the command,
+ * and that is a finding about this repository either way.
+ */
+export function configSection(config) {
+    if (config.read.length === 0)
+        return [];
+    const lines = ['## What the coding agent here is permitted to do', '', `Read: ${config.read.map((f) => `\`${f}\``).join(', ')}.`, ''];
+    if (config.servers.length > 0) {
+        lines.push('Tool servers wired into this project:', '');
+        for (const s of config.servers)
+            lines.push(`- \`${s.name}\` — runs ${s.where}: \`${s.detail}\``);
+        lines.push('');
+    }
+    if (config.findings.length === 0) {
+        lines.push('Nothing in these files switches off an approval, grants an unconstrained shell, trusts a', 'server without approval or commits a credential.', '');
+        return lines;
+    }
+    for (const f of config.findings) {
+        lines.push(`- **${f.rule}** — ${CONFIG_MEANS[f.rule] ?? ''}`, `  \`${f.what}\` in \`${f.file}\`. ${f.why}`);
+    }
+    lines.push('');
+    return lines;
+}

package/dist/engine/agent/prompt-flow.js

@@ -0,0 +1,145 @@
+// Text somebody else wrote, glued into a prompt, in a loop that holds tools.
+//
+// `tools.ts` answers this at the level of capability: does this agent have a tool that reads
+// untrusted text, a tool that reads private data, and a tool that sends data out. That is the
+// lethal trifecta and it is worth knowing. But it is an argument about what could happen.
+//
+// This is the same question one level down, about what the code actually does: is a value that
+// came off a web page, a ticket, an inbox or a retriever **glued into the prompt string itself**.
+// Glued, not passed beside it - the distinction that matters in SQL matters more here, because a
+// prompt has no parameter binding to fall back on. Once the text is in the prompt, the model cannot
+// tell the instruction you wrote from the instruction the attacker wrote, and no amount of "ignore
+// any instructions in the document below" changes that.
+//
+// The same refusal as the SQL checker next door: a source and a sink inside one function body,
+// directly or through one named variable. No call graph, no cross-file inference, no maybes. A
+// list of maybes gets switched off, and then somebody has written "we check for prompt injection"
+// on a form.
+import { gluedIn, sameBody } from '../taint/flow.js';
+const NL = String.fromCharCode(10);
+/**
+ * Where text somebody outside the building can write comes into an agent.
+ *
+ * Framework-specific on purpose, and short on purpose. Every entry here is a shape where the value
+ * is *text from elsewhere*, not a number or a flag: a fetched page, a retrieved document, the body
+ * of a ticket or a message. A general "anything from a function call" source would match the whole
+ * program and find nothing worth reading.
+ */
+const SOURCES = [
+    { re: String.raw `(?:requests|httpx|session)\s*\.\s*(?:get|post)\s*\([^)]*\)\s*\.\s*(?:text|content|json\(\))`, origin: 'a web page this agent fetched' },
+    { re: String.raw `(?:await\s+)?(?:fetch|axios\s*\.\s*get)\s*\([^)]*\)[^;\n]*?\.\s*(?:text|json|data)\s*\(?\)?`, origin: 'a web page this agent fetched' },
+    { re: String.raw `\w*(?:page|html|soup|article|scraped?)\w*\s*\.\s*(?:content|text|get_text|inner_text|innerText)\s*\(?\)?`, origin: 'a web page this agent fetched' },
+    { re: String.raw `\w*(?:retriever|vectorstore|index|store)\w*\s*\.\s*(?:invoke|search|similarity_search|get_relevant_documents|query)\s*\([^)]*\)`, origin: 'a document this agent retrieved' },
+    { re: String.raw `\w*(?:doc|document|chunk|result|passage)\w*\s*\.\s*(?:page_content|pageContent|text)\b`, origin: 'a document this agent retrieved' },
+    { re: String.raw `\w*(?:issue|ticket|comment|review|pr|pull_request)\w*\s*\.\s*(?:body|description|text)\b`, origin: 'a ticket or comment somebody else wrote' },
+    { re: String.raw `\w*(?:email|mail|message|msg)\w*\s*\.\s*(?:body|payload|text|content|get_payload\(\))`, origin: 'a message this agent received' },
+    { re: String.raw `\w*(?:tool_result|toolResult|observation|tool_output)\w*\b`, origin: 'the output of another tool' },
+];
+/** Where a prompt is built or sent. */
+const PROMPT = /\b(?:messages|prompt|system|instructions|user_message|userMessage|input|content|template)\s*[:=]|\b(?:SystemMessage|HumanMessage|ChatPromptTemplate|PromptTemplate)\s*(?:\.\s*from_\w+\s*)?\(|\.\s*(?:invoke|complete|create|generate|run|predict|chat)\s*\(/g;
+/** The same body also handing the model tools - which is what turns exposure into reach. */
+// `[:=,})]` and not just `[:=]`: `client.create({ tools, messages })` is the shorthand both the
+// Anthropic and Vercel SDKs are written in, and `tools` there is followed by a comma. Missing it
+// reported the commonest shape in JavaScript as a prompt with no tools behind it, which is exactly
+// the difference between exposure and reach.
+const TOOLS_HERE = /\btools\b\s*[:=,})]|\btool_choice\s*[:=]|\bbind_tools\s*\(|\.\s*with_tools\s*\(|\bToolNode\s*\(/;
+/** The statement a line sits in, which is the string a value is or is not glued into. */
+function statementAt(text, at) {
+    let start = at;
+    let depth = 0;
+    // Walk back to the start of the expression: a line break at bracket depth zero.
+    for (let i = at; i > 0 && at - i < 2000; i -= 1) {
+        const ch = text[i];
+        if (ch === ')' || ch === ']' || ch === '}')
+            depth += 1;
+        else if (ch === '(' || ch === '[' || ch === '{') {
+            if (depth === 0)
+                break;
+            depth -= 1;
+        }
+        else if (ch === NL && depth === 0) {
+            start = i + 1;
+            break;
+        }
+        start = i;
+    }
+    let end = at;
+    depth = 0;
+    for (let i = at; i < text.length && i - at < 2000; i += 1) {
+        const ch = text[i];
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth += 1;
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            if (depth === 0) {
+                end = i;
+                break;
+            }
+            depth -= 1;
+        }
+        else if ((ch === NL || ch === ';') && depth === 0) {
+            end = i;
+            break;
+        }
+        end = i + 1;
+    }
+    return text.slice(start, end);
+}
+export function promptFlows(file, text) {
+    const found = [];
+    const seen = new Set();
+    const assigned = [];
+    for (const { re, origin } of SOURCES) {
+        // `name = <source>` in Python, and `const name = <source>` in JavaScript.
+        for (const m of text.matchAll(new RegExp(String.raw `(?:(?:const|let|var)\s+)?(\w+)\s*=\s*[^=\n]*?(` + re + String.raw `)`, 'g'))) {
+            assigned.push({ name: m[1], at: m.index ?? 0, source: m[2], origin });
+        }
+    }
+    for (const prompt of text.matchAll(PROMPT)) {
+        const at = prompt.index ?? 0;
+        const statement = statementAt(text, at);
+        if (!statement.trim())
+            continue;
+        const line = text.slice(0, at).split(NL).length;
+        // Tools in the same body: looked for from the start of the enclosing function rather than the
+        // whole file, so a tool list in one handler does not arm a prompt built in another.
+        const withTools = TOOLS_HERE.test(text.slice(Math.max(0, at - 3000), at + 3000));
+        // Directly: the fetched value is written inside the prompt string itself.
+        for (const { re, origin } of SOURCES) {
+            const hit = new RegExp(re).exec(statement);
+            if (!hit)
+                continue;
+            const how = gluedIn(statement, hit[0]);
+            if (!how)
+                continue;
+            // One finding per untrusted value, not per place a prompt is mentioned: `messages=` and
+            // `.create(` both match the same statement, and reporting it twice reads as two problems.
+            const key = `direct:${hit[0]}:${statement.slice(0, 40)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({ file, line, source: hit[0].replace(/\s+/g, ' ').slice(0, 80), origin, through: how, withTools, evidence: statement.replace(/\s+/g, ' ').slice(0, 160) });
+        }
+        // Through one variable, assigned from an untrusted value earlier in the same body.
+        for (const a of assigned) {
+            if (a.at > at || !sameBody(text, a.at, at))
+                continue;
+            const how = gluedIn(statement, a.name);
+            if (!how)
+                continue;
+            const key = `via:${a.name}:${a.at}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            found.push({
+                file,
+                line,
+                source: a.source.replace(/\s+/g, ' ').slice(0, 80),
+                origin: a.origin,
+                through: `${how}, through \`${a.name}\``,
+                withTools,
+                evidence: statement.replace(/\s+/g, ' ').slice(0, 160),
+            });
+        }
+    }
+    return found;
+}

package/dist/engine/taint/flow.js

@@ -12,8 +12,14 @@ const SINKS = [
  * value bound as a parameter is never parsed as syntax, and an explicit escape says so.
  */
 const MADE_SAFE = /\b(?:parseInt|parseFloat|Number|encodeURIComponent|escape|escapeId|sqlstring\.escape)\s*\(/;
-/** A value is only dangerous here if it is glued into the string, not passed beside it. */
-function gluedIn(argument, expression) {
+/**
+ * A value is only dangerous here if it is glued into the string, not passed beside it.
+ *
+ * Exported because the agent checks need exactly this question about a different kind of string: a
+ * prompt. The Python shapes are here rather than in a second copy for the same reason - an f-string
+ * glues a value in exactly as a template literal does, and the difference is only spelling.
+ */
+export function gluedIn(argument, expression) {
     const e = expression.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     if (new RegExp(String.raw `\$\{[^}]*` + e, 's').test(argument))
         return 'a template literal';
@@ -21,6 +27,13 @@ function gluedIn(argument, expression) {
         return 'string concatenation';
     if (new RegExp(String.raw `\.concat\s*\([^)]*` + e).test(argument))
         return 'concat()';
+    // Python: an f-string, old-style %, and .format(), which glue a value in just as firmly.
+    if (new RegExp(String.raw `f["'][^"']*\{[^}]*` + e, 's').test(argument))
+        return 'an f-string';
+    if (new RegExp(String.raw `%\s*\(?[^)]*` + e).test(argument))
+        return '% formatting';
+    if (new RegExp(String.raw `\.format\s*\([^)]*` + e).test(argument))
+        return '.format()';
     return null;
 }
 /** The first argument of a call that starts at `from`, which is the one parsed as syntax. */
@@ -48,7 +61,7 @@ function firstArgument(text, from) {
  * joined. Crude - it finds the enclosing braces - and crude in the safe direction: a body it
  * cannot determine yields no finding at all.
  */
-function sameBody(text, a, b) {
+export function sameBody(text, a, b) {
     if (a > b)
         return false;
     let depth = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.74.0",
+  "version": "0.76.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [