cuke-dedup 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,98 @@ All notable changes to CukeDedup are documented in this file. The project follow
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-18
+
+### Added
+
+- `assertionModules` names module specifiers whose `expect` export is a trusted assertion factory.
+  Use it for a local module that re-exports `expect`, or for a runner this build does not recognise
+  by name. Both `import` and `require` spellings honour the setting, including
+  `import * as fixtures from "./fixtures"` and `import fixtures = require("./fixtures")`. An
+  undeclared module stays untrusted, and a facade inferred from registration re-exports is not
+  trusted for assertions.
+
+### Changed
+
+- `vitest`, `chai` and `bun:test` join the recognised assertion factories. Importing `expect` from
+  one of them was previously *less* trusted than relying on an injected global, so explicit imports
+  were penalised: expected values did not count as behaviour and two steps asserting different
+  values could be offered as a `parameterization-candidate`. Chain recognition is shape-based, so
+  Chai's `expect(x).to.equal(y)` is read exactly as `expect(x).toBe(y)` is. **Reports can lose those
+  spurious findings on upgrade.**
+- A module-scoped constant now reaches the handler fingerprint, so two handlers reading the same
+  value through differently named constants are recognised as the same handler. A mutable `let`
+  stays unproven, a handler-local binding of the same name shadows the module constant, and a
+  constant declared inside another declaration's initializer is out of scope and never substituted.
+  A name captured from an enclosing scope is nearer than the module's, so a module constant never
+  substitutes over it. **Reports can gain findings on upgrade.**
+
+### Fixed
+
+- A function declared in a handler and then called contributes its assertions to that handler, so
+  conflicting expected values inside it keep the handlers apart instead of surfacing as a
+  `parameterization-candidate`. Expansion is single level and terminates on recursion. It is
+  declined when the name is bound by anything else in the handler — another declaration, a variable,
+  a parameter, a catch binding, a `class`, an `enum`, or a reassignment — because a name-keyed lookup
+  cannot tell which body a shadowed call reaches, and expanding the wrong one would attribute
+  assertions the handler never runs. A transparent wrapper such as `(check)()` resolves the same
+  declaration a bare call does.
+
+### Known limitations
+
+- A module-scoped constant reaches the handler fingerprint only when it is declared **before** the
+  registrations that read it. Two handlers reading the same value through constants declared after
+  the `Given`/`When`/`Then` calls are not recognised as the same handler, so the duplicate is
+  missed. Moving the declarations above the registrations restores the finding.
+- A handler passed as a call expression, such as `Given("...", makeHandler())`, cannot be resolved
+  to a body and takes no part in the handler rules; it is reported as `dynamic or unsupported step
+  handler cannot be compared statically`. A handler reached through a member expression, such as
+  `Given("...", steps.run)`, is not compared either, and that case is silent. Inline functions —
+  arrow, `async`, `function` and generator — and a reference to a local function declaration are
+  all compared normally.
+- Step definitions registered through a default import or TypeScript's `import x = require(...)`
+  and called as a member, such as `cucumber.Given("...")`, are not discovered, so those files
+  contribute no definitions to any rule. Named imports, namespace imports (`import * as cucumber`),
+  renamed named imports and `require` destructuring are all recognised.
+
+## [0.5.0] - 2026-09-16
+
+### Added
+
+- Interactive terminal reports show the tool version, selective color, a finding-count footer, and detection time. `NO_COLOR` disables ANSI styling; redirected output remains plain text.
+
+### Changed
+
+- Terminal findings have a blank line after each rule heading and between findings instead of divider lines.
+- `obj['name']` and `obj.name` read the same property, so two handlers that differ only in that
+  spelling are now recognised as the same handler. This applies to every property access in a
+  handler, not only assertions: `page['locator']('x')` matches `page.locator('x')`. Only a static
+  string literal whose decoded value is a valid identifier is folded — a dynamic key, a template
+  literal, or a name with no dot spelling such as `['not.resolves']` keeps its own identity.
+  Optional access is preserved, so `a?.['b']` matches `a?.b` and neither matches `a.b`.
+  **Reports can gain findings on upgrade**, because pairs that were previously distinguished only
+  by access spelling are now duplicates.
+
+### Fixed
+
+- The regular-expression `v` flag is part of a matcher's identity. It enables Unicode set notation
+  and changes character-class semantics, so `/^a gauge$/v` and `/^a gauge$/` match different inputs
+  and are no longer reported as `normalized-matcher`. Flags that only affect how a match is executed
+  — `g`, `y` and `d` — are still ignored for identity, and two matchers carrying `v` still compare
+  as the same matcher.
+- Replacing the assertion factory through a second `require()` of the same module now revokes
+  assertion trust. Two `require()` calls for one module return the same cached object, so
+  `other.expect = replacement` replaces the factory that a separate `api.expect(...)` call uses.
+  Previously only a local alias (`const other = api`) propagated, so handlers relying on a factory
+  replaced through the second binding were still reported as duplicates.
+- A `for (const x of xs)` or `for (const x in xs)` head binds `x` for the loop, so a reference to
+  `x` in the body is the loop variable rather than an outer constant of the same name. The binding
+  was not registered, so the outer constant's value was substituted into the loop body. This was
+  wrong in both directions: identical loop handlers with different unrelated outer constants were
+  reported as distinct, and different loop bodies sharing an outer constant could be reported as
+  duplicates. `class`, `function`, `catch` and classic `for (let i = …)` bindings were already
+  handled.
+
 ## [0.4.0] - 2026-09-15
 
 ### Changed
@@ -185,6 +277,8 @@ Initial public release.
 - Native Cargo and npm distributions for eight supported targets.
 - A checksum-verified GitHub Action and an agent-oriented CukeDedup skill.
 
+[0.6.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.0...v0.2.1

package/README.md

@@ -136,7 +136,7 @@ steps:
     with:
       fetch-depth: 0
       persist-credentials: false
-  - uses: figueiredoluiz/cuke-dedup@v0.4.0
+  - uses: figueiredoluiz/cuke-dedup@v0.6.0
     with:
       path: .
       threshold: 5

package/docs/ci-and-baselines.md

@@ -18,7 +18,7 @@ steps:
       fetch-depth: 0
       persist-credentials: false
 
-  - uses: figueiredoluiz/cuke-dedup@v0.4.0
+  - uses: figueiredoluiz/cuke-dedup@v0.6.0
     id: cuke-dedup
     with:
       path: .

package/docs/configuration.md

@@ -134,6 +134,39 @@ Nested, asynchronous, generator, conditional, multi-statement, reordered, rewrit
 dynamically constructed wrappers cannot be inferred safely. Declare those names when they still
 take the matcher first and handler second.
 
+## Trusted assertion modules
+
+`assertionModules` names module specifiers whose `expect` export is a real assertion factory.
+
+CukeDedup recognizes `@playwright/test`, `playwright/test`, `@jest/globals`, `expect`, `vitest`,
+`chai`, and `bun:test` without configuration, and it also trusts the ambient `expect` that Jest,
+Vitest, and Playwright inject. Chain recognition is shape-based, so Chai's `expect(x).to.equal(y)`
+is understood exactly as Jest's `expect(x).toBe(y)` is; only the origin of the factory is listed.
+
+Declare a module when the factory reaches your steps another way:
+
+```json
+{
+  "assertionModules": ["./support/fixtures"]
+}
+```
+
+A local module that re-exports `expect` is the common case:
+
+```ts
+// support/fixtures.ts
+export { expect } from "@playwright/test";
+```
+
+Without the declaration, `expect` is untrusted, because the analyzer does not follow a local
+re-export back to its origin. An untrusted factory is not an error: its expected values simply stop
+counting as behaviour, so two steps asserting genuinely different values can be offered as a
+`parameterization-candidate`. Declaring the module restores the distinction. Both `import` and
+`require` spellings honour the setting.
+
+Trust only modules that really do expose an assertion factory. Declaring an unrelated module makes
+its call arguments semantically load-bearing and can manufacture similarity evidence.
+
 ## Custom parameter types
 
 `parameterTypes` maps a project-defined Cucumber Expression parameter type to the regular

package/docs/reports.md

@@ -17,6 +17,10 @@ file-only run prints the generated paths to stdout.
 Terminal and JSONL both own stdout and cannot be selected together. JSONL can be combined with
 file reporters without contaminating the stream.
 
+The terminal report shows the tool version, leaves a blank line after each rule heading and between findings, and ends with the total number of active findings and detection time. Timing covers discovery, parsing, and analysis; `--no-metrics` omits it.
+
+Rule headings are bold cyan, paths are blue, error/warning labels are red/yellow, and footer details are gray only when stdout is a terminal. Set `NO_COLOR` to a nonempty value to disable color. Piped output and the other report formats contain no ANSI color codes.
+
 ## JSON and HTML
 
 JSON schema version `2` contains:

package/docs/safety-and-limitations.md

@@ -25,6 +25,16 @@ resource limits keep failures visible and bound the work performed.
   overlap witnesses.
 - Bounded fuzzy indexes preserve a deterministic sample in highly repetitive vocabularies but do
   not promise every possible pair after a work limit is reached.
+- A module-scoped constant declared *after* the registrations that read it is not resolved, even
+  though the handler body runs later and the value is initialized by then. Declaration order is the
+  conservative rule shared with handler-local constants, where a reference before the declaration is
+  a temporal-dead-zone error. The effect is a missed duplicate, never an invented one.
+- A handler produced by calling a generator function, such as
+  `Given('a step', (function* () { … })())`, is not compared. Calling a generator returns a
+  suspended object and never runs the body, so the registered handler is that object rather than a
+  function and its assertions never execute. Treating the suspended body as the handler's behaviour
+  would invent meaning the code does not have, so each such registration warns that the handler
+  cannot be compared statically and is excluded from handler rules.
 
 When analysis is incomplete, existing findings remain valid but the absence of a finding proves
 nothing. Machine reports expose the incomplete or truncated status. Pass `--fail-on-incomplete`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cuke-dedup",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Static analysis for duplicate and reusable Cucumber step definitions",
   "type": "module",
   "bin": {
@@ -47,13 +47,13 @@
     "npm/platforms/*"
   ],
   "optionalDependencies": {
-    "cuke-dedup-darwin-arm64": "0.4.0",
-    "cuke-dedup-darwin-x64": "0.4.0",
-    "cuke-dedup-linux-arm64-gnu": "0.4.0",
-    "cuke-dedup-linux-arm64-musl": "0.4.0",
-    "cuke-dedup-linux-x64-gnu": "0.4.0",
-    "cuke-dedup-linux-x64-musl": "0.4.0",
-    "cuke-dedup-windows-arm64-msvc": "0.4.0",
-    "cuke-dedup-windows-x64-msvc": "0.4.0"
+    "cuke-dedup-darwin-arm64": "0.6.0",
+    "cuke-dedup-darwin-x64": "0.6.0",
+    "cuke-dedup-linux-arm64-gnu": "0.6.0",
+    "cuke-dedup-linux-arm64-musl": "0.6.0",
+    "cuke-dedup-linux-x64-gnu": "0.6.0",
+    "cuke-dedup-linux-x64-musl": "0.6.0",
+    "cuke-dedup-windows-arm64-msvc": "0.6.0",
+    "cuke-dedup-windows-x64-msvc": "0.6.0"
   }
 }