kryptheon 0.1.28 → 0.1.29

package/bin/kryptheon.js

@@ -2659,8 +2659,22 @@ function accept(name) {
 
   console.error('');
   if (result.reason === 'nothing-pending') {
-    console.error('  "' + titleOf(key) + '" has no new result waiting.');
-    console.error('  Nothing to accept - it last matched its saved result.');
+    // Said from the last run of this test, not assumed: a run that broke on
+    // a step is not one that matched (see baselines.nothingToAcceptLines).
+    const last = baselines.lastRunOf(store.pathsFor(USER_DIR).history, key);
+    baselines.nothingToAcceptLines(titleOf(key), last).forEach((paragraph, i) => {
+      if (i) console.error('');
+      let current = '';
+      for (const word of paragraph.split(' ')) {
+        if ((current + ' ' + word).trim().length > 72) {
+          console.error('  ' + current.trim());
+          current = word;
+        } else {
+          current = (current + ' ' + word).trim();
+        }
+      }
+      if (current) console.error('  ' + current);
+    });
   } else if (result.reason === 'no-entry') {
     console.error('  "' + titleOf(key) + '" has no saved result yet.');
   } else {

package/kryptheon-baselines.js

@@ -166,6 +166,60 @@ function pruneLines(dropped) {
   return lines;
 }
 
+/**
+ * The last run of one recorded test, from the run history: whether it
+ * passed, and where it broke if it did not. Null when it has never run.
+ */
+function lastRunOf(historyFile, key) {
+  let lines = [];
+  try {
+    lines = fs.readFileSync(historyFile, 'utf8').split('\n').filter(Boolean);
+  } catch (e) {
+    return null;
+  }
+  const spec = specOf(key);
+  const title = titleOf(key);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    let entry;
+    try {
+      entry = JSON.parse(lines[i]);
+    } catch (e) {
+      continue;
+    }
+    const test = (entry.tests || []).find((t) => t && t.title === title && specOf(t.specFile) === spec);
+    if (test) return { status: test.status, at: entry.runAt, failure: test.failure || null };
+  }
+  return null;
+}
+
+/**
+ * What accept says when there is nothing it can take, from the last run.
+ *
+ * Found on a blind test (HelixOps): a step was broken on purpose, and accept
+ * answered "it last matched its saved result" - the opposite of what had
+ * happened. accept only takes a run that went all the way through and ended
+ * on a different page; a step that no longer matches is a changed flow or a
+ * broken app, and neither is accepted.
+ */
+function nothingToAcceptLines(name, last) {
+  if (last && last.status === 'failed') {
+    const failure = last.failure || {};
+    const where = failure.line ? ' at line ' + failure.line + (failure.file ? ' of ' + specOf(failure.file) : '') : '';
+    const what = failure.plainLanguage ? ' (' + String(failure.plainLanguage).replace(/\.$/, '') + ')' : '';
+    return [
+      '"' + name + '" has nothing to accept: its last run broke' + where + ', before the end' + what + '.',
+      'accept only covers a run that went all the way through and finished on a different page - ' +
+        'a new address or a new title.',
+      'A step that no longer matches cannot be accepted. If the flow changed on purpose, record it ' +
+        'again (npx kryptheon record). If it did not, the app broke, and npx kryptheon check says what to fix.',
+    ];
+  }
+  if (last && last.status === 'passed') {
+    return ['"' + name + '" has no new result waiting.', 'Nothing to accept - its last run matched its saved result.'];
+  }
+  return ['"' + name + '" has no new result waiting.', 'Nothing to accept - no run has finished on a different page.'];
+}
+
 module.exports = {
   specOf: specOf,
   titleOf: titleOf,
@@ -173,4 +227,6 @@ module.exports = {
   classifyBaselines: classifyBaselines,
   pruneBaselines: pruneBaselines,
   pruneLines: pruneLines,
+  lastRunOf: lastRunOf,
+  nothingToAcceptLines: nothingToAcceptLines,
 };

package/kryptheon-code.js

@@ -412,7 +412,7 @@ function riskyParts(node, scope, code, aliases, out, depth) {
     }
   }
   const text = code.slice(node.start, node.end).replace(/\s+/g, ' ').slice(0, 80);
-  if (!out.some((p) => p.text === text)) out.push({ text: text, origin: origin });
+  if (!out.some((p) => p.text === text)) out.push({ text: text, origin: origin, line: node.loc ? node.loc.start.line : null });
 }
 
 function rootIdentifier(node) {
@@ -684,7 +684,89 @@ function checkedFirst(p, value, code) {
   return false;
 }
 
-function sinksIn(parser, code, file, lineOffset) {
+/**
+ * The helper a value is the result of: a call to a function this file
+ * declares, or one it imports from a file of the project. Its returns, each
+ * with its scope and its file's code, and the line where the first of them
+ * that is not plain text is built. Null for anything else - an import from a
+ * package, a default export, a function that cannot be found.
+ */
+function helperOf(value, scope, code, file, lineOffset, resolver) {
+  if (!value || !/CallExpression$/.test(value.type) || !value.callee || value.callee.type !== 'Identifier' || !scope) return null;
+  const name = value.callee.name;
+  let fnPath = localFunction(name, scope);
+  let helper = { code: code, file: null, lineOffset: lineOffset };
+  if (!fnPath) {
+    const binding = scope.getBinding(name);
+    const spec = binding && binding.kind === 'module' && binding.path && binding.path.node;
+    if (!spec || spec.type !== 'ImportSpecifier' || !resolver) return null;
+    const from = binding.path.parentPath && binding.path.parentPath.node.source && binding.path.parentPath.node.source.value;
+    const imported = spec.imported && (spec.imported.name || spec.imported.value);
+    const found = from && imported ? resolver(file, from, imported) : null;
+    if (!found) return null;
+    fnPath = found.fnPath;
+    helper = { code: found.code, file: found.file, lineOffset: 1 };
+  }
+  const returns = returnsOf(fnPath);
+  if (!returns.length) return null;
+  const risky = returns.find((r) => classify(r.node, r.scope, helper.code, 0) !== 'safe') || returns[0];
+  return {
+    fn: name,
+    file: helper.file,
+    line: (risky.node.loc ? risky.node.loc.start.line : 1) + helper.lineOffset - 1,
+    code: helper.code,
+    lineOffset: helper.lineOffset,
+    returns: returns,
+  };
+}
+
+/**
+ * Finds a function another file of the project exports, for helperOf. Parsed
+ * once a file; its functions are handed to the map() reader each time, since
+ * that table is rebuilt for every file read.
+ */
+function importResolver(parser, root) {
+  const parsed = new Map();
+  const EXTS = ['', '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '/index.js', '/index.ts'];
+  return (fromFile, source, name) => {
+    if (!/^\.\.?\//.test(source)) return null;
+    const base = path.resolve(path.dirname(fromFile), source);
+    const full = EXTS.map((ext) => base + ext).find((candidate) => {
+      try {
+        return fs.statSync(candidate).isFile() && CODE_EXT.test(candidate);
+      } catch (err) {
+        return false;
+      }
+    });
+    if (!full) return null;
+    if (!parsed.has(full)) {
+      let entry = null;
+      try {
+        if (fs.statSync(full).size <= MAX_BYTES) {
+          const code = fs.readFileSync(full, 'utf8');
+          const ast = parser.babelParse(code, full, true);
+          const fns = [];
+          let program = null;
+          parser.traverse(ast, {
+            Program(p) { program = p.scope; },
+            Function(p) { fns.push(p); },
+          });
+          entry = { code: code, program: program, fns: fns, file: path.relative(root, full).split(path.sep).join('/') };
+        }
+      } catch (err) {
+        entry = null;
+      }
+      parsed.set(full, entry);
+    }
+    const entry = parsed.get(full);
+    if (!entry || !entry.program) return null;
+    for (const p of entry.fns) FN_PATHS.set(p.node, p);
+    const fnPath = localFunction(name, entry.program);
+    return fnPath ? { fnPath: fnPath, code: entry.code, file: entry.file } : null;
+  };
+}
+
+function sinksIn(parser, code, file, lineOffset, resolver) {
   const found = [];
   const ast = parser.babelParse(code, file, true);
   const lineOf = (node) => (node.loc ? node.loc.start.line : 1) + lineOffset - 1;
@@ -704,6 +786,25 @@ function sinksIn(parser, code, file, lineOffset) {
       viaHelper.push({ node: node, sink: sink, value: value, scope: scope, param: param });
       return;
     }
+    // The HTML built by a helper - root.innerHTML = renderBoard(rows) - is
+    // judged by what the helper returns, in its own file, and the place it
+    // puts a value in is named. Found on a blind test (HelixOps): appShell(),
+    // a fixed string in ui.js, was reported as unknown, and renderBoard() was
+    // reported at its call with no word of ui.js:13, where the title goes in.
+    const built = helperOf(value, scope, code, file, lineOffset, resolver);
+    if (built) {
+      const origin = worst(built.returns.map((r) => classify(r.node, r.scope, built.code, 0)));
+      if (origin === 'safe') return;
+      const parts = [];
+      for (const r of built.returns) riskyParts(r.node, r.scope, built.code, undefined, parts, 0);
+      // The line of the first value that goes in, not of the return around it.
+      const first = parts.find((p) => p.line);
+      found.push({
+        line: lineOf(node), sink: sink, expression: textOf(value), origin: origin, parts: parts,
+        helper: { fn: built.fn, file: built.file, line: first ? first.line + built.lineOffset - 1 : built.line },
+      });
+      return;
+    }
     const origin = classify(value, scope, code, 0);
     if (origin === 'safe') return;
     found.push({ line: lineOf(node), sink: sink, expression: textOf(value), origin: origin, parts: partsOf(value, scope) });
@@ -834,6 +935,7 @@ function scanProject(root, options) {
     }
   }
   const loadedBy = keys.scriptsLoadedBy(pages);
+  const resolver = importResolver(parser, root);
   for (const full of files) {
     let size = 0;
     try {
@@ -852,7 +954,7 @@ function scanProject(root, options) {
     const pieces = PAGE_EXT.test(full) ? scriptsIn(source) : [{ code: source, line: 1 }];
     for (const piece of pieces) {
       try {
-        for (const f of sinksIn(parser, piece.code, full, piece.line)) findings.push(Object.assign({ file: rel }, f));
+        for (const f of sinksIn(parser, piece.code, full, piece.line, resolver)) findings.push(Object.assign({ file: rel }, f));
       } catch (err) {
         unreadable.push({ file: rel + (piece.line > 1 ? ':' + piece.line : ''), why: 'could not be parsed: ' + String(err.message).split('\n')[0].slice(0, 120) });
       }
@@ -931,9 +1033,14 @@ function describe(f) {
   if (f.kind === 'redirect') return describeRedirect(f);
   const severity = f.origin === 'unknown' ? 'MEDIUM' : 'HIGH';
   const how = f.sink === 'v-html' ? 'v-html' : f.sink;
+  // Where the helper builds it: its own file when it is another one.
+  const builtAt = f.helper ? (f.helper.file ? f.helper.file + ':' : 'line ') + f.helper.line : '';
   const where = f.via
     ? 'In ' + f.file + ' at line ' + f.line + ', this value is passed to ' + f.via.fn + '(), which puts ' +
       'what it is given into the page as HTML with ' + how + ' at line ' + f.via.line + ':'
+    : f.helper
+    ? 'In ' + f.file + ' at line ' + f.line + ', the HTML that ' + f.helper.fn + '() builds - at ' + builtAt +
+      ' - is put into the page with ' + how + ':'
     : 'In ' + f.file + ' at line ' + f.line + ', this value is put into the page as HTML with ' + how + ':';
   // The fix for a helper is different, and getting it wrong breaks the page:
   // switching the helper to textContent makes every other call - the ones
@@ -946,6 +1053,12 @@ function describe(f) {
         'this value before it is joined into the HTML (replace & < > " \' with their HTML entities), ' +
         'or pass it through a sanitizer such as DOMPurify if it must keep some formatting.',
     ]
+    : f.helper
+    ? [
+      'Fix it inside ' + f.helper.fn + '() at ' + builtAt + ', where the values are joined into the HTML: ' +
+        'escape each dynamic value there (replace & < > " \' with their HTML entities), or pass the ' +
+        'result through a sanitizer such as DOMPurify if it must keep some formatting.',
+    ]
     : [
       'Fix it so the value is always shown as text: set textContent instead of innerHTML for the ' +
         'dynamic part, or escape it before it is joined into HTML (replace & < > " \' with their ' +
@@ -993,9 +1106,11 @@ function describe(f) {
     origin: f.origin,
     parts: (f.parts || []).map((p) => ({ text: p.text, origin: p.origin })),
     via: f.via || null,
+    helper: f.helper || null,
     headline: 'Text ' + (f.origin === 'unknown' ? 'of unknown origin' : ORIGIN_WORDS[f.origin].split(',')[0]) +
       ' is inserted as HTML in ' + f.file + ':' + f.line +
-      (f.via ? ' (through ' + f.via.fn + '() at line ' + f.via.line + ')' : '') + '.',
+      (f.via ? ' (through ' + f.via.fn + '() at line ' + f.via.line + ')' : '') +
+      (f.helper ? ', built by ' + f.helper.fn + '() at ' + builtAt : '') + '.',
     fixPrompt: fixPrompt,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Record what you do in your app and get plain-language reports when it breaks.",
   "license": "MIT",
   "type": "commonjs",
@@ -51,7 +51,7 @@
     "@playwright/test": "^1.62.1"
   },
   "scripts": {
-    "check": "node kryptheon-store.check.js && node kryptheon-code.check.js && node kryptheon-keys.check.js && node kryptheon-dashboard.check.js && node kryptheon-changes.check.js && node kryptheon-look.check.js && node kryptheon-verify.check.js && node kryptheon-recheck.check.js && node kryptheon-reporter.check.js && node kryptheon-signature.check.js && node kryptheon-signature.stream.check.js && node kryptheon-signature.baseline.check.js && node kryptheon-signature.settle.check.js && node kryptheon-signature.number.check.js && node kryptheon-env.check.js && node kryptheon-watchdog.check.js && node kryptheon-record.check.js && node kryptheon-selectors.check.js && node kryptheon-recordings.check.js && node kryptheon-cleanup.check.js && node kryptheon-orphan.check.js && node kryptheon-project.check.js && node kryptheon-setup.check.js && node kryptheon-browser.check.js && node kryptheon-heal.check.js && node kryptheon-load.check.js && node kryptheon-package.check.js",
+    "check": "node kryptheon-store.check.js && node kryptheon-code.check.js && node kryptheon-accept.check.js && node kryptheon-keys.check.js && node kryptheon-dashboard.check.js && node kryptheon-changes.check.js && node kryptheon-look.check.js && node kryptheon-verify.check.js && node kryptheon-recheck.check.js && node kryptheon-reporter.check.js && node kryptheon-signature.check.js && node kryptheon-signature.stream.check.js && node kryptheon-signature.baseline.check.js && node kryptheon-signature.settle.check.js && node kryptheon-signature.number.check.js && node kryptheon-env.check.js && node kryptheon-watchdog.check.js && node kryptheon-record.check.js && node kryptheon-selectors.check.js && node kryptheon-recordings.check.js && node kryptheon-cleanup.check.js && node kryptheon-orphan.check.js && node kryptheon-project.check.js && node kryptheon-setup.check.js && node kryptheon-browser.check.js && node kryptheon-heal.check.js && node kryptheon-load.check.js && node kryptheon-package.check.js",
     "check:store": "node kryptheon-store.check.js",
     "check:code": "node kryptheon-code.check.js",
     "check:dashboard": "node kryptheon-dashboard.check.js",