tewip-ai 0.48.0 → 0.50.0

package/README.md

@@ -927,7 +927,7 @@ That last section is the part no SQL linter does: it searches your own code for
 away. "This drops `users.nickname`, and four files still read it" is a different sentence from "dropping a
 column is risky", and it is the one that stops the outage.
 
-It reads **SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase** migrations — which covers Prisma, Drizzle, Flyway
+It reads **SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and Liquibase** migrations — which covers Prisma, Drizzle, Flyway
 and golang-migrate too, since those all emit plain `.sql`. It judges **only the forward path** (a rollback step
 contains the mirror image of the change, so reading it says a migration that creates a table destroys
 one), and stays quiet when the team already did the safe thing — `atomic = False`, `algorithm:

package/dist/cli/help.js

@@ -167,7 +167,7 @@ Usage:
                                     that break the version still running during a deploy, destroy data,
                                     block writes while they run, or cannot be undone - and searches your
                                     code for what still uses the column it takes away. Reads SQL,
-                                    Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and
+                                    Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and
                                     Liquibase - so Prisma, Drizzle, Flyway and golang-migrate too,
                                     since those emit plain SQL - and says so when it cannot read one.
                                     It judges only the forward path, never the rollback. No cost.

package/dist/engine/access/markup.js

@@ -50,7 +50,23 @@ function withoutNonMarkup(source, jsLike) {
         .replace(/\{\/\*[\s\S]*?\*\/\}/g, blank)
         .replace(/<script\b[\s\S]*?<\/script\s*>/gi, blank)
         .replace(/<style\b[\s\S]*?<\/style\s*>/gi, blank);
-    return jsLike ? stripped.replace(/`(?:[^`\\]|\\[\s\S])*`/g, blank) : stripped;
+    // A template expression is code, not markup, and real templates put markup *inside* it: GOV.UK's
+    // own examples gallery passes `{{ govukLabel({ "text": "<h1> govuk-label--xl" }) }}`, and reading
+    // that `<h1>` as a heading poisoned the outline so badly that twelve heading skips were reported
+    // on a page whose headings are perfectly ordered - on the design system built by the UK
+    // government's accessibility specialists, which is as wrong as this check can be.
+    //
+    // The delimiters are kept and only the contents blanked, which matters: `<button>{{ label }}</button>`
+    // must still read as content this file cannot see, so the button is asked about rather than
+    // called empty, and `alt="{{ alt }}"` must still count as an alt attribute that is present.
+    const withoutExpressions = stripped
+        // A template comment is a comment: Jinja, Nunjucks and Twig write `{# ... #}`, and Django and
+        // Jinja also have a `{% comment %}` block. Neither renders, so neither is markup.
+        .replace(/\{#[\s\S]*?#\}/g, blank)
+        .replace(/\{%-?\s*comment\s*-?%\}[\s\S]*?\{%-?\s*endcomment\s*-?%\}/gi, blank)
+        .replace(/\{\{[\s\S]*?\}\}/g, (m) => `{{${m.slice(2, -2).replace(/[^\n]/g, ' ')}}}`)
+        .replace(/\{%[\s\S]*?%\}/g, (m) => `{%${m.slice(2, -2).replace(/[^\n]/g, ' ')}%}`);
+    return jsLike ? withoutExpressions.replace(/`(?:[^`\\]|\\[\s\S])*`/g, blank) : withoutExpressions;
 }
 /** Files whose markup is embedded in JavaScript, where a backtick string is not page markup. */
 export const JS_LIKE = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/i;

package/dist/engine/schema/dialect-rules.js

@@ -144,4 +144,51 @@ const ALEMBIC = [
 // empty on purpose and every finding comes from reading that SQL, which is the same reader the
 // `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
 // TypeORM migration silently producing no findings at all.
+/**
+ * Laravel. Found missing by running Tewip over firefly-iii, a real finance application with **61
+ * migrations Tewip could not read a word of** - and Laravel is one of the most used web frameworks
+ * there is, while `schema` advertised nine dialects.
+ *
+ * Structurally it is Knex's shape: the table is named by `Schema::table('accounts', ...)` and the
+ * operation happens inside the closure, so the two are matched together across the lines between.
+ */
+export const LARAVEL = [
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->dropColumn\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration. Eloquent caches the column list, so the running version keeps selecting it',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->renameColumn\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `Schema::drop(?:IfExists)?\(\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->index\(`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `builds an index on ${m[1]} while holding a lock that blocks writes to it`,
+        instead: 'build it with a raw CREATE INDEX CONCURRENTLY through DB::statement, or accept the lock if the table is small',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `Schema::(?:table|connection\(.*?\)->table)\(\s*${STR}[\s\S]{0,600}?->foreign\(`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `adds a foreign key to ${m[1]}, which checks every existing row under a lock on both tables`,
+        instead: 'add it NOT VALID and validate it afterwards, which takes a weaker lock',
+        table: (m) => m[1],
+    },
+];
 export { DJANGO, RAILS, ALEMBIC };

package/dist/engine/schema/frameworks.js

@@ -1,4 +1,4 @@
-import { ALEMBIC, DJANGO, RAILS } from './dialect-rules.js';
+import { ALEMBIC, DJANGO, LARAVEL, RAILS } from './dialect-rules.js';
 import { EFCORE, KNEX, LIQUIBASE, SEQUELIZE } from './dialect-rules-node.js';
 export function dialectOf(file, text) {
     const path = file.split('\\').join('/').toLowerCase();
@@ -17,6 +17,10 @@ export function dialectOf(file, text) {
     // strings passed to queryRunner.query(). The SQL is right there and perfectly readable; only the
     // wrapper was unfamiliar, so every TypeORM project was told Tewip could not read its migrations
     // at all - and on a Node backend that is most of them.
+    // Laravel, before the generic checks: its migrations are PHP and would otherwise fall through
+    // to 'unknown'. firefly-iii has 61 of them and Tewip could not read a word.
+    if (/Illuminate.Database.Migrations.Migration|\bSchema::(?:table|create|drop|dropIfExists|connection)\s*\(/.test(text))
+        return 'laravel';
     if (/\bMigrationInterface\b|\bqueryRunner\.query\s*\(/.test(text))
         return 'typeorm';
     if (/\bqueryInterface\.\w+\s*\(/.test(text))
@@ -40,6 +44,7 @@ const BY_DIALECT = {
     knex: KNEX,
     efcore: EFCORE,
     liquibase: LIQUIBASE,
+    laravel: LARAVEL,
 };
 /** Findings from a framework migration, with the line each one sits on. */
 export function readFramework(dialect, text) {
@@ -111,6 +116,8 @@ export function forwardOnly(dialect, text) {
             (dialect === 'sequelize' && /^\s*down\s*:/.test(line)) ||
             (dialect === 'knex' && /^\s*(?:exports\.down|module\.exports\.down)\s*=/.test(line)) ||
             (dialect === 'efcore' && /^\s*protected\s+override\s+void\s+Down\s*\(/.test(line)) ||
+            // Laravel's rollback, which in real files often comes *before* up().
+            (dialect === 'laravel' && /^\s*(?:public\s+)?function\s+down\s*\(/.test(line)) ||
             // Liquibase puts the reverse inside the change itself rather than in a second method.
             (dialect === 'liquibase' && /^\s*<rollback\b/.test(line));
         if (down) {

package/dist/engine/schema/schema-command.js

@@ -13,8 +13,12 @@ import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
 import { readSql } from './statements.js';
-const MIGRATION = /(^|\/)(migrations?|db\/migrate|prisma\/migrations|alembic|flyway|sql)\//i;
-const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|db\/migrate)\/.*\.(py|rb|js|ts)$/i;
+const MIGRATION = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|flyway|changelogs?|sql)\//i;
+// A changelog is often not in a directory that says so. OpenMRS keeps 44 Liquibase changelogs in
+// `api/src/main/resources/` named `liquibase-*.xml`, and the path filter saw none of them - so a
+// real healthcare system with 44 migration files was told it had none. The name counts too.
+const NAMED_MIGRATION = /(^|\/)(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i;
+const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate)\/.*\.(py|rb|js|ts|php|cs)$/i;
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
     const named = cmd.files !== undefined && cmd.files.length > 0;
@@ -24,7 +28,7 @@ export function schemaFiles(cmd) {
         // Asking for a file by name overrides the path filter: the filter exists to find migrations in
         // a diff of a hundred files, not to argue with somebody who pointed at one. A TypeORM migration
         // sitting outside a migrations/ directory was being answered with "no migration in this change".
-        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f) || NAMED_MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
 }
 /**
  * Tables this migration creates itself.
@@ -70,7 +74,7 @@ export function readMigration(root, file) {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and Liquibase migrations',
             irreversible: false,
         };
     }

package/dist/engine/start/start-command.js

@@ -37,6 +37,7 @@ export function lookAround(root, limit = 4000) {
         hasWorkflows: existsSync(join(root, '.github', 'workflows')),
         hasStandards: existsSync(join(root, '.tewip', 'standards')),
         filesSeen: false,
+        stoppedEarly: false,
     };
     let seen = 0;
     // A queue rather than recursion: every directory at one depth is read before any at the next.
@@ -53,8 +54,13 @@ export function lookAround(root, limit = 4000) {
             continue;
         }
         for (const entry of entries) {
-            if (seen >= limit)
+            // Out of budget with entries still unread in *this* directory. Checking only the queue was
+            // not enough: a project whose files sit in one flat directory empties the queue before the
+            // budget runs out, so the look stopped short and did not know it.
+            if (seen >= limit) {
+                found.stoppedEarly = true;
                 break;
+            }
             if (SKIP.has(entry) || (entry.startsWith('.') && entry !== '.github'))
                 continue;
             const full = join(dir, entry);
@@ -78,7 +84,10 @@ export function lookAround(root, limit = 4000) {
                 found.perfReports.push(rel);
             else if (/(k6|lighthouse|summary|lhr)[\w.-]*\.json$/i.test(entry) && info.size < 8_000_000)
                 found.perfReports.push(rel);
-            const inMigrations = /(^|\/)(migrations?|db\/migrate|changelog)\//i.test(rel);
+            // A changelog is often not in a directory that says so: OpenMRS keeps 44 Liquibase files in
+            // `api/src/main/resources/` named `liquibase-*.xml`. The name counts as well as the path.
+            const inMigrations = /(^|\/)(migrations?|migration|db\/migrate|changelogs?)\//i.test(rel) ||
+                /(^|\/)(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i.test(rel);
             // Reading a file is only worth it for the two questions a name cannot answer: is this a
             // test, and is this a migration. Both are cheap, and both are often wrong from the path.
             const language = languageOf(entry);
@@ -101,6 +110,8 @@ export function lookAround(root, limit = 4000) {
             }
         }
     }
+    if (seen >= limit && queue.length > 0)
+        found.stoppedEarly = true;
     return found;
 }
 const total = (counts) => [...counts.values()].reduce((a, b) => a + b, 0);
@@ -139,19 +150,19 @@ export function suggest(found) {
     if (tests > 0) {
         out.push({
             command: 'tewip vouch',
-            because: `${tests} test ${tests === 1 ? 'file' : 'files'} here (${named(found.tests)}). This reads them and names the ones that cannot fail - no model, a second or two.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${tests} test ${tests === 1 ? 'file' : 'files'} here (${named(found.tests)}). This reads them and names the ones that cannot fail - no model, a second or two.`,
         });
     }
     if (migrations > 0) {
         out.push({
             command: 'tewip schema --diff main...HEAD',
-            because: `${migrations} ${migrations === 1 ? 'migration' : 'migrations'} here (${named(found.migrations)}). This says what a change would do to a live database before it runs.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${migrations} ${migrations === 1 ? 'migration' : 'migrations'} here (${named(found.migrations)}). This says what a change would do to a live database before it runs.`,
         });
     }
     if (found.markup > 0) {
         out.push({
             command: 'tewip access',
-            because: `${found.markup} markup ${found.markup === 1 ? 'file' : 'files'} here. This names who cannot use the interface, against the WCAG criterion a regulator would cite.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${found.markup} markup ${found.markup === 1 ? 'file' : 'files'} here. This names who cannot use the interface, against the WCAG criterion a regulator would cite.`,
         });
     }
     for (const report of found.perfReports.slice(0, 1)) {
@@ -187,6 +198,11 @@ export function renderStart(found, root) {
     }
     lines.push('## What it will not do here', '');
     const cannot = [];
+    if (found.stoppedEarly) {
+        cannot.push('This project is larger than Tewip looks at from here, so the counts above are **at least** ' +
+            'that many rather than exactly. The commands themselves read everything; only this first ' +
+            'glance is bounded, so that it stays instant.');
+    }
     if (total(found.tests) === 0)
         cannot.push('No test files were found, so nothing can be said about whether your tests could fail or would catch a bug.');
     if (total(found.migrations) === 0)

package/dist/engine/vouch/vouch.js

@@ -216,9 +216,15 @@ const stripLines = (body, lines) => body
     .join(String.fromCharCode(10));
 /** The first line that does something, for the report to quote. */
 function firstRealLine(body) {
-    const line = body
+    const lines = body
         .split(String.fromCharCode(10))
         .map((l) => l.trim())
-        .find((l) => l !== '' && l !== '{' && l !== '}');
-    return (line ?? '').slice(0, 120);
+        .filter((l) => l !== '' && l !== '{' && l !== '}');
+    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
+    // quoted evidence for 166 real findings was the single character "#", which tells a reader
+    // nothing about the test it is accusing. The line that does something is the evidence.
+    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
+    // bracket. Evidence has to be something a reader can recognise as the test doing work.
+    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
+    return (code ?? lines[0] ?? '').slice(0, 120);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [