tewip-ai 0.39.0 → 0.40.0

package/README.md

@@ -836,7 +836,8 @@ That last section is the part no SQL linter does: it searches your own code for
 away. "This drops `users.nickname`, and four files still read it" is a different sentence from "dropping a
 column is risky", and it is the one that stops the outage.
 
-It reads **SQL, Django, Rails and Alembic** migrations, judges **only the forward path** (a rollback step
+It reads **SQL, Django, Rails, Alembic and TypeORM** migrations — which covers Prisma, Drizzle, Flyway
+and golang-migrate too, since those all emit plain `.sql`. It judges **only the forward path** (a rollback step
 contains the mirror image of the change, so reading it says a migration that creates a table destroys
 one), and stays quiet when the team already did the safe thing — `atomic = False`, `algorithm:
 :concurrently`, `NOT VALID`, `postgresql_concurrently=True`. When it cannot read a migration it says so

package/dist/engine/schema/frameworks.js

@@ -11,6 +11,12 @@ export function dialectOf(file, text) {
         return 'rails';
     if (/\bop\.(?:drop_column|add_column|create_index|alter_column|drop_table|rename_table|execute)\b/.test(text))
         return 'alembic';
+    // TypeORM writes a migration as a class with up() and down(), and puts the real DDL in template
+    // strings passed to queryRunner.query(). The SQL is right there and perfectly readable; only the
+    // wrapper was unfamiliar, so every TypeORM project was told Tewip could not read its migrations
+    // at all - and on a Node backend that is most of them.
+    if (/\bMigrationInterface\b|\bqueryRunner\.query\s*\(/.test(text))
+        return 'typeorm';
     if (/(^|\/)(migrations?|db\/migrate)\//.test(path))
         return 'unknown';
     return 'unknown';
@@ -157,7 +163,12 @@ const ALEMBIC = [
         table: (m) => m[1],
     },
 ];
-const BY_DIALECT = { django: DJANGO, rails: RAILS, alembic: ALEMBIC };
+// TypeORM has no operations of its own: unlike Django's `RemoveField` or Rails's `remove_column`,
+// a TypeORM migration contains SQL and nothing else, handed to queryRunner.query(). So its list is
+// empty on purpose and every finding comes from reading that SQL, which is the same reader the
+// `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
+// TypeORM migration silently producing no findings at all.
+const BY_DIALECT = { django: DJANGO, rails: RAILS, alembic: ALEMBIC, typeorm: [] };
 /** Findings from a framework migration, with the line each one sits on. */
 export function readFramework(dialect, text) {
     const lines = text.split(String.fromCharCode(10));
@@ -216,7 +227,10 @@ export function forwardOnly(dialect, text) {
         const line = lines[i];
         const down = (dialect === 'rails' && /^\s*def\s+down\b/.test(line)) ||
             (dialect === 'alembic' && /^\s*def\s+downgrade\s*\(/.test(line)) ||
-            (dialect === 'sql' && /^\s*--\s*(?:\+migrate\s+Down|\+goose\s+Down|\/\/@UNDO|Down\b)/i.test(line));
+            (dialect === 'sql' && /^\s*--\s*(?:\+migrate\s+Down|\+goose\s+Down|\/\/@UNDO|Down\b)/i.test(line)) ||
+            // TypeORM's rollback is `public async down(queryRunner: QueryRunner)`. Reading it as part of
+            // the change would report a migration that adds a column as one that drops it.
+            (dialect === 'typeorm' && /^\s*(?:public\s+)?async\s+down\s*\(/.test(line));
         if (down) {
             // To the end of the block: the next line at the same indentation or less that starts something new.
             blankFrom(i, (l, indent) => l.trim() !== '' && indentOf(l) <= indent && !/^\s*(end|\})\s*$/.test(l), indentOf(line));

package/dist/engine/schema/schema-command.js

@@ -17,10 +17,39 @@ const MIGRATION = /(^|\/)(migrations?|db\/migrate|prisma\/migrations|alembic|fly
 const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|db\/migrate)\/.*\.(py|rb|js|ts)$/i;
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
-    const given = cmd.files && cmd.files.length > 0 ? cmd.files : (changeSummary(cmd.root, cmd.diff)?.files ?? []);
+    const named = cmd.files !== undefined && cmd.files.length > 0;
+    const given = named ? cmd.files : (changeSummary(cmd.root, cmd.diff)?.files ?? []);
     return given
         .map((f) => f.split('\\').join('/'))
-        .filter((f) => (SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+        // Asking for a file by name overrides the path filter: the filter exists to find migrations in
+        // a diff of a hundred files, not to argue with somebody who pointed at one. A TypeORM migration
+        // sitting outside a migrations/ directory was being answered with "no migration in this change".
+        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+}
+/**
+ * Tables this migration creates itself.
+ *
+ * A lock is only expensive because of the rows it holds up, and a table created three statements
+ * earlier has none. This matters enormously on the tools that generate their SQL: a Prisma project
+ * emits `CREATE TABLE` followed by an `ADD CONSTRAINT ... FOREIGN KEY` for every relation, so
+ * documenso's 165 real migrations produced 275 "blocks writes while it runs" findings - 1.7 per
+ * migration, nearly all of them about tables that did not exist a moment before. That is the volume
+ * at which a team stops reading the report, which costs more than the warnings are worth.
+ */
+function createdHere(text) {
+    const names = new Set();
+    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?"?([\w$.]+)"?/gi)) {
+        names.add(m[1].toLowerCase().replace(/^.*\./, ''));
+    }
+    return names;
+}
+/** Risks that are only risks because rows already exist. */
+const ONLY_HURTS_EXISTING_ROWS = new Set(['locks-writes', 'slow']);
+export function droppingWhatIsNew(findings, text) {
+    const fresh = createdHere(text);
+    if (fresh.size === 0)
+        return findings;
+    return findings.filter((f) => !(ONLY_HURTS_EXISTING_ROWS.has(f.risk) && fresh.has(f.table.toLowerCase().replace(/^.*\./, ''))));
 }
 export function readMigration(root, file) {
     let text = '';
@@ -35,13 +64,13 @@ export function readMigration(root, file) {
     // part of the change says a migration that creates a table destroys one.
     const forward = forwardOnly(dialect, text);
     if (dialect === 'sql')
-        return { file, dialect, findings: readSql(forward), unread: '', irreversible: false };
+        return { file, dialect, findings: droppingWhatIsNew(readSql(forward), forward), unread: '', irreversible: false };
     if (dialect === 'unknown') {
         return {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails and Alembic migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic and TypeORM migrations',
             irreversible: false,
         };
     }
@@ -49,10 +78,12 @@ export function readMigration(root, file) {
     // A migration that only runs raw SQL through the framework is still readable: the SQL is the migration.
     // Raw SQL, however it reaches the database: through the framework, or through a cursor inside a data
     // migration, which is where most large projects put the dangerous parts.
-    const raw = [...forward.matchAll(/(?:RunSQL|op\.execute|execute|cursor\.execute)\(\s*(?:r?["'`]{1,3})([\s\S]*?)["'`]{1,3}\s*[,)]/g)].map((m) => m[1]).join(';');
+    // `queryRunner.query` is TypeORM's, and is the whole of a TypeORM migration rather than an
+    // escape hatch inside one: the class is a wrapper and every statement arrives this way.
+    const raw = [...forward.matchAll(/(?:RunSQL|op\.execute|queryRunner\.query|execute|cursor\.execute)\(\s*(?:r?["'`]{1,3})([\s\S]*?)["'`]{1,3}\s*[,)]/g)].map((m) => m[1]).join(';');
     if (raw.trim())
         findings.push(...readSql(raw));
-    return { file, dialect, findings, unread: '', irreversible: irreversible(dialect, text) };
+    return { file, dialect, findings: droppingWhatIsNew(findings, forward), unread: '', irreversible: irreversible(dialect, text) };
 }
 /**
  * Code outside the migrations that still names a table or column this change takes away.

package/dist/engine/schema/statements.js

@@ -20,7 +20,12 @@ const RULES = [
         table: (m) => bare(m[1]),
     },
     {
-        find: new RegExp(String.raw `\bALTER\s+TABLE\s+(${NAME})[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?:IF\s+EXISTS\s+)?(${NAME})`, 'i'),
+        // The word COLUMN is optional in SQL, so the name after DROP has to be checked against the
+        // other things an ALTER TABLE can drop. Without the lookahead, Prisma's own
+        // `ALTER TABLE "Share" DROP CONSTRAINT "Share_userId_fkey"` - which every Prisma project is full
+        // of - was read as dropping a column called CONSTRAINT, and reported as breaking the running
+        // version, which dropping a foreign key does not do. Found on documenso's real migrations.
+        find: new RegExp(String.raw `\bALTER\s+TABLE\s+(${NAME})[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?:IF\s+EXISTS\s+)?(?!CONSTRAINT\b|INDEX\b|DEFAULT\b|NOT\s+NULL\b|PRIMARY\b|FOREIGN\b|CHECK\b|UNIQUE\b|PARTITION\b)(${NAME})`, 'i'),
         risk: 'breaks-old-code',
         what: (m) => `drops the column ${bare(m[2])} from ${bare(m[1])}`,
         instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration. During a rolling deploy the old version is still running and will fail on a column that is gone',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [