tewip-ai 0.48.0 → 0.49.0

package/README.md

@@ -927,7 +927,7 @@ That last section is the part no SQL linter does: it searches your own code for
 away. "This drops `users.nickname`, and four files still read it" is a different sentence from "dropping a
 column is risky", and it is the one that stops the outage.
 
-It reads **SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase** migrations — which covers Prisma, Drizzle, Flyway
+It reads **SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and Liquibase** migrations — which covers Prisma, Drizzle, Flyway
 and golang-migrate too, since those all emit plain `.sql`. It judges **only the forward path** (a rollback step
 contains the mirror image of the change, so reading it says a migration that creates a table destroys
 one), and stays quiet when the team already did the safe thing — `atomic = False`, `algorithm:

package/dist/cli/help.js

@@ -167,7 +167,7 @@ Usage:
                                     that break the version still running during a deploy, destroy data,
                                     block writes while they run, or cannot be undone - and searches your
                                     code for what still uses the column it takes away. Reads SQL,
-                                    Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and
+                                    Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and
                                     Liquibase - so Prisma, Drizzle, Flyway and golang-migrate too,
                                     since those emit plain SQL - and says so when it cannot read one.
                                     It judges only the forward path, never the rollback. No cost.

package/dist/engine/access/markup.js

@@ -50,7 +50,23 @@ function withoutNonMarkup(source, jsLike) {
         .replace(/\{\/\*[\s\S]*?\*\/\}/g, blank)
         .replace(/<script\b[\s\S]*?<\/script\s*>/gi, blank)
         .replace(/<style\b[\s\S]*?<\/style\s*>/gi, blank);
-    return jsLike ? stripped.replace(/`(?:[^`\\]|\\[\s\S])*`/g, blank) : stripped;
+    // A template expression is code, not markup, and real templates put markup *inside* it: GOV.UK's
+    // own examples gallery passes `{{ govukLabel({ "text": "<h1> govuk-label--xl" }) }}`, and reading
+    // that `<h1>` as a heading poisoned the outline so badly that twelve heading skips were reported
+    // on a page whose headings are perfectly ordered - on the design system built by the UK
+    // government's accessibility specialists, which is as wrong as this check can be.
+    //
+    // The delimiters are kept and only the contents blanked, which matters: `<button>{{ label }}</button>`
+    // must still read as content this file cannot see, so the button is asked about rather than
+    // called empty, and `alt="{{ alt }}"` must still count as an alt attribute that is present.
+    const withoutExpressions = stripped
+        // A template comment is a comment: Jinja, Nunjucks and Twig write `{# ... #}`, and Django and
+        // Jinja also have a `{% comment %}` block. Neither renders, so neither is markup.
+        .replace(/\{#[\s\S]*?#\}/g, blank)
+        .replace(/\{%-?\s*comment\s*-?%\}[\s\S]*?\{%-?\s*endcomment\s*-?%\}/gi, blank)
+        .replace(/\{\{[\s\S]*?\}\}/g, (m) => `{{${m.slice(2, -2).replace(/[^\n]/g, ' ')}}}`)
+        .replace(/\{%[\s\S]*?%\}/g, (m) => `{%${m.slice(2, -2).replace(/[^\n]/g, ' ')}%}`);
+    return jsLike ? withoutExpressions.replace(/`(?:[^`\\]|\\[\s\S])*`/g, blank) : withoutExpressions;
 }
 /** Files whose markup is embedded in JavaScript, where a backtick string is not page markup. */
 export const JS_LIKE = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/i;

package/dist/engine/schema/dialect-rules.js

@@ -144,4 +144,51 @@ const ALEMBIC = [
 // empty on purpose and every finding comes from reading that SQL, which is the same reader the
 // `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
 // TypeORM migration silently producing no findings at all.
+/**
+ * Laravel. Found missing by running Tewip over firefly-iii, a real finance application with **61
+ * migrations Tewip could not read a word of** - and Laravel is one of the most used web frameworks
+ * there is, while `schema` advertised nine dialects.
+ *
+ * Structurally it is Knex's shape: the table is named by `Schema::table('accounts', ...)` and the
+ * operation happens inside the closure, so the two are matched together across the lines between.
+ */
+export const LARAVEL = [
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->dropColumn\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration. Eloquent caches the column list, so the running version keeps selecting it',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->renameColumn\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `Schema::drop(?:IfExists)?\(\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->index\(`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `builds an index on ${m[1]} while holding a lock that blocks writes to it`,
+        instead: 'build it with a raw CREATE INDEX CONCURRENTLY through DB::statement, or accept the lock if the table is small',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->foreign\(`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `adds a foreign key to ${m[1]}, which checks every existing row under a lock on both tables`,
+        instead: 'add it NOT VALID and validate it afterwards, which takes a weaker lock',
+        table: (m) => m[1],
+    },
+];
 export { DJANGO, RAILS, ALEMBIC };

package/dist/engine/schema/frameworks.js

@@ -1,4 +1,4 @@
-import { ALEMBIC, DJANGO, RAILS } from './dialect-rules.js';
+import { ALEMBIC, DJANGO, LARAVEL, RAILS } from './dialect-rules.js';
 import { EFCORE, KNEX, LIQUIBASE, SEQUELIZE } from './dialect-rules-node.js';
 export function dialectOf(file, text) {
     const path = file.split('\\').join('/').toLowerCase();
@@ -17,6 +17,10 @@ export function dialectOf(file, text) {
     // strings passed to queryRunner.query(). The SQL is right there and perfectly readable; only the
     // wrapper was unfamiliar, so every TypeORM project was told Tewip could not read its migrations
     // at all - and on a Node backend that is most of them.
+    // Laravel, before the generic checks: its migrations are PHP and would otherwise fall through
+    // to 'unknown'. firefly-iii has 61 of them and Tewip could not read a word.
+    if (/Illuminate.Database.Migrations.Migration|\bSchema::(?:table|create|drop|dropIfExists|connection)\s*\(/.test(text))
+        return 'laravel';
     if (/\bMigrationInterface\b|\bqueryRunner\.query\s*\(/.test(text))
         return 'typeorm';
     if (/\bqueryInterface\.\w+\s*\(/.test(text))
@@ -40,6 +44,7 @@ const BY_DIALECT = {
     knex: KNEX,
     efcore: EFCORE,
     liquibase: LIQUIBASE,
+    laravel: LARAVEL,
 };
 /** Findings from a framework migration, with the line each one sits on. */
 export function readFramework(dialect, text) {
@@ -111,6 +116,8 @@ export function forwardOnly(dialect, text) {
             (dialect === 'sequelize' && /^\s*down\s*:/.test(line)) ||
             (dialect === 'knex' && /^\s*(?:exports\.down|module\.exports\.down)\s*=/.test(line)) ||
             (dialect === 'efcore' && /^\s*protected\s+override\s+void\s+Down\s*\(/.test(line)) ||
+            // Laravel's rollback, which in real files often comes *before* up().
+            (dialect === 'laravel' && /^\s*(?:public\s+)?function\s+down\s*\(/.test(line)) ||
             // Liquibase puts the reverse inside the change itself rather than in a second method.
             (dialect === 'liquibase' && /^\s*<rollback\b/.test(line));
         if (down) {

package/dist/engine/schema/schema-command.js

@@ -70,7 +70,7 @@ export function readMigration(root, file) {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and Liquibase migrations',
             irreversible: false,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [