tewip-ai 0.75.0 → 0.76.0

package/README.md

@@ -1252,6 +1252,14 @@ offline, in CI, before anything runs.
   because that is the difference between a wrong answer and a tool call somebody else chose. On
   1,691 files of real agent code: **zero findings**, which is the precision claim; recall is
   measured against planted examples and said to be.
+- **What the coding agent installed here was permitted to do.** `.claude/settings.json` and
+  `.mcp.json` are committed, anybody with write access can change them, and neither turns up in a
+  review the way a source file does. Tewip names the approval gate switched off
+  (`"defaultMode": "bypassPermissions"`), an allow entry that grants a shell with no constraint on
+  the command, every tool server trusted without approval, a credential written into a committed
+  file - located, never printed - and a boundary widened past the project. A `PreToolUse` hook
+  counts as a real gate, because the harness enforces it on every call; a rule in a markdown file
+  is a request to the model and does not.
 - **What stands in the way**: a human approval gate, a dry run, a step budget, a tool allow-list -
   and says plainly when nothing anywhere in the project has one. A ceiling written as
   `max_iterations=None` is reported apart from no ceiling at all, because it reads as deliberate.

package/dist/engine/agent/agent-command.js

@@ -4,6 +4,7 @@ import { relative } from 'node:path';
 import { scanSourceFiles } from '../walk.js';
 import { CAPABILITY_MEANS, FRAMEWORKS_READ, IRREVERSIBLE, toolsIn, trifectaIn } from './tools.js';
 import { promptFlows } from './prompt-flow.js';
+import { configSection, scanConfig } from './claude-config.js';
 import { budgetSetToNothing, guardsIn, GUARD_MEANS, GUARD_PREVENTS } from './guards.js';
 const NL = String.fromCharCode(10);
 const AGENT_FILE = /\.(?:py|[cm]?[jt]sx?)$/i;
@@ -48,7 +49,7 @@ export function scanAgent(root) {
                 emptyBudget = { file: where, text: empty };
         }
     }
-    return { tools, injections, guards, filesRead, emptyBudget };
+    return { tools, injections, guards, filesRead, emptyBudget, config: scanConfig(root) };
 }
 const REACH_READS = {
     destructive: 'cannot be undone',
@@ -61,12 +62,13 @@ const REACH_READS = {
     'not-sure': '**not decided**',
 };
 export function renderAgent(scan, root) {
-    const { tools, injections, guards, filesRead, emptyBudget } = scan;
+    const { tools, injections, guards, filesRead, emptyBudget, config } = scan;
     const lines = ['# What this agent is allowed to do', ''];
     if (tools.length === 0) {
         return [
             '# What this agent is allowed to do',
             '',
+            ...configSection(config),
             `No tool definitions were found in ${filesRead} file(s).`,
             '',
             'That is a fact about what was looked for, not a finding that this agent has no tools. These',
@@ -80,6 +82,12 @@ export function renderAgent(scan, root) {
         ].join(NL);
     }
     const kinds = new Set(guards.map((g) => g.kind));
+    // A permission list is an allow-list, and a PreToolUse hook is enforced on every call - both are
+    // the real thing rather than a pattern someone wrote in a prompt.
+    if (config.hasAllowList)
+        kinds.add('tool-allow-list');
+    if (config.hasEnforcedHook)
+        kinds.add('asks-a-person');
     const risky = tools.filter((t) => IRREVERSIBLE.includes(t.reach));
     const undecided = tools.filter((t) => t.reach === 'not-sure');
     lines.push(`${tools.length} tool(s) in ${filesRead} file(s) read locally. No model was called and nothing left this machine.`, '');
@@ -138,6 +146,7 @@ export function renderAgent(scan, root) {
         lines.push(`- **${capability}** (${CAPABILITY_MEANS[capability]}): ${legTools.length === 0 ? 'nothing found' : legTools.slice(0, 6).map((t) => `\`${t.name}\``).join(', ') + (legTools.length > 6 ? `, and ${legTools.length - 6} more` : '')}`);
     }
     lines.push('');
+    lines.push(...configSection(config));
     lines.push('## What stands between them and the real world', '');
     for (const kind of ['asks-a-person', 'dry-run', 'step-budget', 'tool-allow-list']) {
         const found = guards.find((g) => g.kind === kind);

package/dist/engine/agent/claude-config.js

@@ -0,0 +1,166 @@
+// The permissions a coding agent was given in this repository, read from the files that grant them.
+//
+// `tools.ts` reads what an agent you wrote can call. This reads what an agent you *installed* was
+// allowed to do here - Claude Code's `.claude/settings.json` and the project's `.mcp.json`, both of
+// which are committed, both of which anybody with write access can change, and neither of which
+// turns up in a code review the way a source file does.
+//
+// Worth saying plainly, because it is the whole reason this is a separate check: a rule written in
+// a markdown file is a request to the model. A permission in settings.json is enforced by the
+// harness on every tool call. They look equally like configuration and they are not the same kind
+// of thing at all, and only one of them is a control an auditor can rely on.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+// Spelled with forward slashes, which is how every other path in a Tewip report is spelled and
+// how a reader will search for it. `join` gives a backslash on Windows and the report then names a
+// file that does not look like the one in the repository.
+const FILES = ['.claude/settings.json', '.claude/settings.local.json', '.mcp.json'];
+/**
+ * An allow entry that grants a shell with no constraint on the command.
+ *
+ * `Bash(npm run test:*)` is a decision somebody made. `Bash`, `Bash(*)` and `Bash(*:*)` are the
+ * absence of one: they permit `rm -rf`, `curl | sh` and anything else, and they are what people
+ * write when the prompts became annoying.
+ */
+const UNCONSTRAINED = /^(?:Bash|Execute|Shell|Run)(?:\(\s*\*?\s*(?::\s*\*\s*)?\))?$/i;
+/** A value written into a committed file that looks like a credential rather than a reference. */
+const LOOKS_SECRET = /(?:KEY|TOKEN|SECRET|PASSWORD|PASS|CREDENTIAL|API)/i;
+const read = (root, name) => {
+    const path = join(root, ...name.split('/'));
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const json = JSON.parse(raw);
+        return json && typeof json === 'object' ? { json, raw } : null;
+    }
+    catch {
+        // A file that does not parse is not a file that grants nothing, and saying so beats guessing.
+        return null;
+    }
+};
+const asList = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+export function scanConfig(root) {
+    const out = { read: [], findings: [], servers: [], hasAllowList: false, hasEnforcedHook: false };
+    for (const name of FILES.slice(0, 2)) {
+        const file = read(root, name);
+        if (!file)
+            continue;
+        out.read.push(name);
+        const permissions = (file.json.permissions ?? {});
+        const allow = asList(permissions.allow);
+        const deny = asList(permissions.deny);
+        if (allow.length > 0 || deny.length > 0)
+            out.hasAllowList = true;
+        // The gate switched off outright. Nothing else in this file matters as much.
+        if (permissions.defaultMode === 'bypassPermissions') {
+            out.findings.push({
+                rule: 'permissions-bypassed',
+                file: name,
+                what: '"defaultMode": "bypassPermissions"',
+                why: 'every tool call here runs without asking, including the ones that delete, pay or send. This is the approval gate being switched off in a committed file.',
+            });
+        }
+        if (permissions.defaultMode === 'acceptEdits') {
+            out.findings.push({
+                rule: 'edits-auto-accepted',
+                file: name,
+                what: '"defaultMode": "acceptEdits"',
+                why: 'file edits are applied without asking. Weaker than bypassing everything, and still a person out of the loop on every change to the working tree.',
+            });
+        }
+        for (const entry of allow) {
+            if (!UNCONSTRAINED.test(entry.trim()))
+                continue;
+            out.findings.push({
+                rule: 'shell-unconstrained',
+                file: name,
+                what: `"allow": [… "${entry}" …]`,
+                why: 'this permits any shell command, not a named one. `Bash(npm run test:*)` is a decision; this is the absence of one.',
+            });
+        }
+        if (file.json.enableAllProjectMcpServers === true) {
+            out.findings.push({
+                rule: 'mcp-auto-trusted',
+                file: name,
+                what: '"enableAllProjectMcpServers": true',
+                why: 'every server in .mcp.json is trusted without being approved, including any added later by anyone who can commit to this repository.',
+            });
+        }
+        const env = (file.json.env ?? {});
+        for (const [key, value] of Object.entries(env)) {
+            // A reference to a variable is fine; a literal is the secret itself, in a committed file.
+            if (!LOOKS_SECRET.test(key) || typeof value !== 'string' || value === '' || value.startsWith('$'))
+                continue;
+            out.findings.push({
+                rule: 'secret-in-settings',
+                file: name,
+                what: `"env": { "${key}": … }`,
+                why: 'a credential written into a file that is committed. Tewip does not print the value; the point is that it is there.',
+            });
+        }
+        const extra = asList(permissions.additionalDirectories);
+        if (extra.length > 0) {
+            out.findings.push({
+                rule: 'boundary-widened',
+                file: name,
+                what: `"additionalDirectories": [${extra.slice(0, 3).map((d) => `"${d}"`).join(', ')}]`,
+                why: 'the agent may read and write outside this project. Whatever is on the other end is inside the blast radius.',
+            });
+        }
+        const hooks = (file.json.hooks ?? {});
+        // PreToolUse is the one that can refuse a call. The others observe it after the fact.
+        if (Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0)
+            out.hasEnforcedHook = true;
+    }
+    const mcp = read(root, '.mcp.json');
+    if (mcp) {
+        out.read.push('.mcp.json');
+        const servers = (mcp.json.mcpServers ?? {});
+        for (const [name, spec] of Object.entries(servers)) {
+            const url = typeof spec?.url === 'string' ? spec.url : '';
+            const command = typeof spec?.command === 'string' ? spec.command : '';
+            const args = asList(spec?.args).join(' ');
+            out.servers.push(url
+                ? { name, where: 'somewhere else', detail: url.replace(/\/\/[^@]*@/, '//') }
+                : { name, where: 'this machine', detail: `${command} ${args}`.trim().slice(0, 90) });
+        }
+    }
+    return out;
+}
+/** What each rule stops, for a reader deciding which to act on first. */
+export const CONFIG_MEANS = {
+    'permissions-bypassed': 'nothing is asked before any tool call',
+    'edits-auto-accepted': 'file edits are applied without asking',
+    'shell-unconstrained': 'any shell command is permitted',
+    'mcp-auto-trusted': 'tool servers are trusted without approval',
+    'secret-in-settings': 'a credential is committed',
+    'boundary-widened': 'the agent may work outside this project',
+};
+/**
+ * What the coding agent installed here was permitted to do.
+ *
+ * Rendered whether or not any tools were found, because the two are independent: a repository with
+ * no agent code of its own can still hand Claude Code a shell with no constraint on the command,
+ * and that is a finding about this repository either way.
+ */
+export function configSection(config) {
+    if (config.read.length === 0)
+        return [];
+    const lines = ['## What the coding agent here is permitted to do', '', `Read: ${config.read.map((f) => `\`${f}\``).join(', ')}.`, ''];
+    if (config.servers.length > 0) {
+        lines.push('Tool servers wired into this project:', '');
+        for (const s of config.servers)
+            lines.push(`- \`${s.name}\` — runs ${s.where}: \`${s.detail}\``);
+        lines.push('');
+    }
+    if (config.findings.length === 0) {
+        lines.push('Nothing in these files switches off an approval, grants an unconstrained shell, trusts a', 'server without approval or commits a credential.', '');
+        return lines;
+    }
+    for (const f of config.findings) {
+        lines.push(`- **${f.rule}** — ${CONFIG_MEANS[f.rule] ?? ''}`, `  \`${f.what}\` in \`${f.file}\`. ${f.why}`);
+    }
+    lines.push('');
+    return lines;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.75.0",
+  "version": "0.76.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [