tewip-ai 0.49.0 → 0.51.0

package/dist/engine/access/checks.js

@@ -6,57 +6,9 @@
 // div that only answers to a mouse. The ones that need a rendered page (contrast, focus order,
 // whether alt text is any good) are not attempted here and are listed in NOT_CHECKED instead.
 import { inside, labelledBy } from './markup.js';
-/** Elements that already answer to the keyboard and already carry a role. */
-const INTERACTIVE = new Set(['a', 'button', 'input', 'select', 'textarea', 'summary', 'details']);
-/** `role="presentation"` and friends: the author has said this is decoration. */
-function decorative(t) {
-    return t.attrs['aria-hidden'] === 'true' || t.attrs.role === 'presentation' || t.attrs.role === 'none';
-}
-function show(t) {
-    const keep = ['src', 'href', 'type', 'name', 'id', 'class', 'role'];
-    const shown = keep
-        .filter((k) => typeof t.attrs[k] === 'string' && t.attrs[k] !== '')
-        .slice(0, 2)
-        .map((k) => ` ${k}="${t.attrs[k].slice(0, 40)}"`)
-        .join('');
-    return `<${t.name}${shown}${t.spread ? ' {...}' : ''}>`;
-}
-function at(t, file) {
-    return { file, line: t.line, element: show(t) };
-}
-/** Every real `aria-*` attribute. A name outside this set is a typo, and a typo does nothing at all. */
-const ARIA = new Set([
-    'aria-activedescendant', 'aria-atomic', 'aria-autocomplete', 'aria-braillelabel', 'aria-brailleroledescription',
-    'aria-busy', 'aria-checked', 'aria-colcount', 'aria-colindex', 'aria-colindextext', 'aria-colspan',
-    'aria-controls', 'aria-current', 'aria-describedby', 'aria-description', 'aria-details', 'aria-disabled',
-    'aria-dropeffect', 'aria-errormessage', 'aria-expanded', 'aria-flowto', 'aria-grabbed', 'aria-haspopup',
-    'aria-hidden', 'aria-invalid', 'aria-keyshortcuts', 'aria-label', 'aria-labelledby', 'aria-level', 'aria-live',
-    'aria-modal', 'aria-multiline', 'aria-multiselectable', 'aria-orientation', 'aria-owns', 'aria-placeholder',
-    'aria-posinset', 'aria-pressed', 'aria-readonly', 'aria-relevant', 'aria-required', 'aria-roledescription',
-    'aria-rowcount', 'aria-rowindex', 'aria-rowindextext', 'aria-rowspan', 'aria-selected', 'aria-setsize',
-    'aria-sort', 'aria-valuemax', 'aria-valuemin', 'aria-valuenow', 'aria-valuetext',
-]);
-/** A click handler, in any of the four dialects this scanner reads. */
-function clickHandler(t) {
-    return ['onclick', '@click', 'v-on:click', 'on:click'].some((a) => a in t.attrs || t.dynamic.has(a));
-}
-function keyHandler(t) {
-    return Object.keys(t.attrs).concat([...t.dynamic]).some((a) => /key(down|up|press)/i.test(a));
-}
-function tabIndexOf(t) {
-    const raw = t.attrs.tabindex ?? t.attrs.tabIndex;
-    if (raw === undefined)
-        return null;
-    const n = Number(raw);
-    return Number.isFinite(n) ? n : null;
-}
-/**
- * Fields that take typing, and therefore need a label. Buttons and hidden fields are excluded: a
- * submit button is named by its value, and a hidden field is not announced at all.
- */
-const UNLABELLED_TYPES = new Set(['hidden', 'submit', 'reset', 'button', 'image']);
+import { ARIA, INTERACTIVE, UNLABELLED_TYPES, at, clickHandler, decorative, hiddenFromEveryone, keyHandler, show, tabIndexOf } from './element.js';
 /** Checks that look at one element at a time. */
-function perElement(t, file, labelFor, openLabels, ancestorKey) {
+function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent = new Set()) {
     const out = [];
     const place = at(t, file);
     const name = labelledBy(t);
@@ -78,16 +30,33 @@ function perElement(t, file, labelFor, openLabels, ancestorKey) {
                 next: 'add alt="..." describing what the image conveys, or alt="" if it conveys nothing' });
         }
     }
-    if (t.name === 'input' && !UNLABELLED_TYPES.has(t.attrs.type ?? 'text')) {
+    // A <select> and a <textarea> need a name exactly as much as an <input> does, and this checked
+    // only <input>. A screen reader announces an unnamed select as "combo box" and stops - the user is
+    // told there is a choice to make and nothing about what it decides. Found in Phase 43 by putting a
+    // deliberately broken React component in front of the scanner: it caught the bare <img>, <input>,
+    // <button>, <a> and click-only <div>, and walked straight past <select>. `select-name` was already
+    // in the axe rule table and already in INTERACTIVE; only this line had never been widened.
+    const NEEDS_NAME = { input: 'input-label', select: 'select-name', textarea: 'label' };
+    const nameRule = NEEDS_NAME[t.name];
+    // `!t.component` matters as much as the element name. React names its components with a capital,
+    // so PatternFly's `<Select>` and `<Input>` lowercase to the same string as the HTML elements - and
+    // this check, unlike `image-alt` beside it, never asked. Keycloak's admin UI is built on PatternFly
+    // and `<Select onOpenChange={...}>` was reported as an unnamed combo box; what that component
+    // renders, and whether it labels itself, is not in this file and cannot be read from it.
+    if (nameRule && !t.component && !hiddenFromEveryone(t) && (t.name !== 'input' || !UNLABELLED_TYPES.has(t.attrs.type ?? 'text'))) {
         const linked = typeof t.attrs.id === 'string' && labelFor.has(t.attrs.id);
         if (!name.named && !linked && openLabels === 0) {
-            if (name.unknown || t.dynamic.has('id')) {
-                out.push({ rule: 'input-label', confidence: 'ask-a-person', ...place,
-                    why: 'no label, aria-label or wrapping <label> can be read here, and part of the element is an expression',
+            if (name.unknown || t.dynamic.has('id') || t.dynamic.has('style') || (typeof t.attrs.id === 'string' && namedByComponent.has(t.attrs.id))) {
+                out.push({ rule: nameRule, confidence: 'ask-a-person', ...place,
+                    why: typeof t.attrs.id === 'string' && namedByComponent.has(t.attrs.id)
+                        ? `no <label for> is written here, but a component in this file names id="${t.attrs.id}" in one of its props, so the label may be rendered there`
+                        : t.dynamic.has('style')
+                            ? 'no label can be read here, and its style is an expression, so whether this is displayed at all cannot be read from the markup'
+                            : 'no label, aria-label or wrapping <label> can be read here, and part of the element is an expression',
                     next: 'confirm the field is labelled at runtime; if not, add aria-label or a <label for>' });
             }
             else {
-                out.push({ rule: 'input-label', confidence: 'barrier', ...place,
+                out.push({ rule: nameRule, confidence: 'barrier', ...place,
                     why: 'no aria-label, no title, no id matching a <label for>, and not inside a <label>',
                     next: 'wrap it in a <label>, or give it an id and point a <label for> at it' });
             }
@@ -152,6 +121,20 @@ function perElement(t, file, labelFor, openLabels, ancestorKey) {
 export function checkFile(source, all, file, isDocument = false) {
     const out = [];
     const labelFor = new Set(all.filter((t) => t.name === 'label' && t.attrs.for).map((t) => t.attrs.for));
+    // Ids that a *component* names in one of its props. A design system labels a field by being told
+    // which field it is for - PatternFly's `<FormGroup label={...} fieldId="x">` renders `<label for="x">`
+    // around its children - and that label exists only in the component's own source, not here.
+    // Keycloak's admin UI is built this way throughout, so a control inside one is not an unnamed
+    // control; it is a control this file cannot answer for, which is a different verdict.
+    const namedByComponent = new Set();
+    for (const t of all) {
+        if (!t.component)
+            continue;
+        for (const [key, value] of Object.entries(t.attrs)) {
+            if (typeof value === 'string' && value !== '' && /(^|[a-z])(id|for)$/i.test(key))
+                namedByComponent.add(value);
+        }
+    }
     const seenIds = new Set();
     let openLabels = 0;
     let interactiveDepth = 0;
@@ -170,7 +153,7 @@ export function checkFile(source, all, file, isDocument = false) {
                 open.length = from;
             continue;
         }
-        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys)));
+        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys), namedByComponent));
         if (!t.selfClosing)
             open.push({ name: t.name, keys: keyHandler(t) });
         const id = t.attrs.id;

package/dist/engine/access/element.js

@@ -0,0 +1,68 @@
+/** Elements that already answer to the keyboard and already carry a role. */
+export const INTERACTIVE = new Set(['a', 'button', 'input', 'select', 'textarea', 'summary', 'details']);
+/** `role="presentation"` and friends: the author has said this is decoration. */
+export function decorative(t) {
+    return t.attrs['aria-hidden'] === 'true' || t.attrs.role === 'presentation' || t.attrs.role === 'none';
+}
+export function show(t) {
+    const keep = ['src', 'href', 'type', 'name', 'id', 'class', 'role'];
+    const shown = keep
+        .filter((k) => typeof t.attrs[k] === 'string' && t.attrs[k] !== '')
+        .slice(0, 2)
+        .map((k) => ` ${k}="${t.attrs[k].slice(0, 40)}"`)
+        .join('');
+    return `<${t.name}${shown}${t.spread ? ' {...}' : ''}>`;
+}
+export function at(t, file) {
+    return { file, line: t.line, element: show(t) };
+}
+/** Every real `aria-*` attribute. A name outside this set is a typo, and a typo does nothing at all. */
+export const ARIA = new Set([
+    'aria-activedescendant', 'aria-atomic', 'aria-autocomplete', 'aria-braillelabel', 'aria-brailleroledescription',
+    'aria-busy', 'aria-checked', 'aria-colcount', 'aria-colindex', 'aria-colindextext', 'aria-colspan',
+    'aria-controls', 'aria-current', 'aria-describedby', 'aria-description', 'aria-details', 'aria-disabled',
+    'aria-dropeffect', 'aria-errormessage', 'aria-expanded', 'aria-flowto', 'aria-grabbed', 'aria-haspopup',
+    'aria-hidden', 'aria-invalid', 'aria-keyshortcuts', 'aria-label', 'aria-labelledby', 'aria-level', 'aria-live',
+    'aria-modal', 'aria-multiline', 'aria-multiselectable', 'aria-orientation', 'aria-owns', 'aria-placeholder',
+    'aria-posinset', 'aria-pressed', 'aria-readonly', 'aria-relevant', 'aria-required', 'aria-roledescription',
+    'aria-rowcount', 'aria-rowindex', 'aria-rowindextext', 'aria-rowspan', 'aria-selected', 'aria-setsize',
+    'aria-sort', 'aria-valuemax', 'aria-valuemin', 'aria-valuenow', 'aria-valuetext',
+]);
+/** A click handler, in any of the four dialects this scanner reads. */
+export function clickHandler(t) {
+    return ['onclick', '@click', 'v-on:click', 'on:click'].some((a) => a in t.attrs || t.dynamic.has(a));
+}
+export function keyHandler(t) {
+    return Object.keys(t.attrs).concat([...t.dynamic]).some((a) => /key(down|up|press)/i.test(a));
+}
+export function tabIndexOf(t) {
+    const raw = t.attrs.tabindex ?? t.attrs.tabIndex;
+    if (raw === undefined)
+        return null;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : null;
+}
+/**
+ * Fields that take typing, and therefore need a label. Buttons and hidden fields are excluded: a
+ * submit button is named by its value, and a hidden field is not announced at all.
+ */
+export const UNLABELLED_TYPES = new Set(['hidden', 'submit', 'reset', 'button', 'image']);
+/**
+ * Hidden from everybody, so no name is needed and none is missing.
+ *
+ * A file picker styled out of sight and clicked by a button beside it is the standard way to build
+ * an upload control, and Keycloak's `<input id="jarUpload" type="file" style={{display:"none"}}>` is
+ * exactly that. `display:none` takes an element out of the accessibility tree altogether: it is
+ * announced to nobody, so "it has no label" stops nobody either.
+ *
+ * When the style is a JSX expression its text is not kept, so whether it hides the element cannot be
+ * read. That is not a reason to call it a certain barrier - it is a reason to say so.
+ */
+export function hiddenFromEveryone(t) {
+    if ('hidden' in t.attrs && t.attrs.hidden !== 'false')
+        return true;
+    if (t.attrs['aria-hidden'] === 'true')
+        return true;
+    const style = typeof t.attrs.style === 'string' ? t.attrs.style : '';
+    return /display\s*:\s*none|visibility\s*:\s*hidden/i.test(style);
+}

package/dist/engine/access/wcag.js

@@ -19,6 +19,21 @@ export const RULES = {
         severity: 'blocker',
         stops: 'a screen reader announces "edit text" with no way to know what to type',
     },
+    // A select and a textarea are form controls like any other, and both were missing here. A rule the
+    // scanner can raise but this table does not describe renders as "WCAG 2.2, unrated" with no line
+    // saying who it stops - which is most of what makes an accessibility finding worth acting on.
+    'select-name': {
+        criterion: '4.1.2 Name, Role, Value',
+        level: 'A',
+        severity: 'blocker',
+        stops: 'a screen reader announces "combo box" and nothing else, so the user is told there is a choice but not what it decides',
+    },
+    'label': {
+        criterion: '3.3.2 Labels or Instructions',
+        level: 'A',
+        severity: 'blocker',
+        stops: 'a screen reader announces "edit text, multi line" with no way to know what to type',
+    },
     'button-name': {
         criterion: '4.1.2 Name, Role, Value',
         level: 'A',

package/dist/engine/schema/dialect-rules-node.js

@@ -142,14 +142,31 @@ const EFCORE = [
  */
 const XML_TABLE = String.raw `tableName\s*=\s*["']([\w.]+)["']`;
 const LIQUIBASE = [
-    {
-        find: new RegExp(String.raw `<dropColumn[^>]*${XML_TABLE}[\s\S]{0,300}?<column[^>]*name\s*=\s*["']([\w.]+)["']`, 'i'),
+    // Liquibase writes a dropped column two ways, and both of these rules are needed. The order they
+    // are tried in does not matter now that neither can match the other's shape.
+    //
+    // The nested form, where the columns are children of the element:
+    //   <dropColumn tableName="CLIENT">
+    //     <column name="ALLOWED_CLAIMS_MASK"/>
+    //   </dropColumn>
+    //
+    // `(?:(?!\/>)[^>])*>` is the important part: it matches the opening tag only when that tag is not
+    // self-closing. Without it the rule matched a self-closing `<dropColumn ... />` and then went on
+    // looking for a `<column name=` for up to 300 characters, which in Keycloak's changelog found one
+    // three lines later inside an unrelated `<createTable>`. Tewip reported "drops CLIENT.REALM_ID"
+    // while quoting a line that says `columnName="ALLOWED_CLAIMS_MASK"` - a headline contradicted by
+    // its own evidence, and the wrong column to go looking for.
+    {
+        find: new RegExp(String.raw `<dropColumn(?:(?!\/>)[^>])*${XML_TABLE}(?:(?!\/>)[^>])*>[\s\S]{0,300}?<column[^>]*name\s*=\s*["']([\w.]+)["']`, 'i'),
         risk: 'breaks-old-code',
         what: (m) => `drops ${m[1]}.${m[2]}`,
         instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
         table: (m) => m[1],
         column: (m) => m[2],
     },
+    // The attribute form. Both orders, because XML attributes have no required order and Keycloak
+    // writes `tableName` first - which the old rule, demanding `columnName` first, could never match.
+    // Sixty-seven dropped columns in that repository and this is the spelling nearly all of them use.
     {
         find: new RegExp(String.raw `<dropColumn[^>]*columnName\s*=\s*["']([\w.]+)["'][^>]*${XML_TABLE}`, 'i'),
         risk: 'breaks-old-code',
@@ -158,6 +175,14 @@ const LIQUIBASE = [
         table: (m) => m[2],
         column: (m) => m[1],
     },
+    {
+        find: new RegExp(String.raw `<dropColumn[^>]*${XML_TABLE}[^>]*columnName\s*=\s*["']([\w.]+)["']`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
     {
         find: new RegExp(String.raw `<dropTable[^>]*${XML_TABLE}`, 'i'),
         risk: 'destroys-data',

package/dist/engine/schema/frameworks.js

@@ -46,29 +46,51 @@ const BY_DIALECT = {
     liquibase: LIQUIBASE,
     laravel: LARAVEL,
 };
-/** Findings from a framework migration, with the line each one sits on. */
+/**
+ * Findings from a framework migration, with the line each one sits on.
+ *
+ * Every occurrence, not the first. `find.exec(text)` returns a single match, so a migration that
+ * dropped five tables reported one of them - and the other four were not mentioned anywhere, not
+ * even as "and more". Keycloak's `jpa-changelog-26.0.0.xml` drops **eight** tables; Tewip named one.
+ * Under-reporting a destructive change is the worst direction to be wrong in, because the reader
+ * sees a finding, deals with it, and reasonably concludes that was all of them.
+ *
+ * Found in Phase 43 and it was never dialect-specific: Django, Rails, Alembic, Laravel, Sequelize,
+ * Knex and EF Core all ran through this same loop.
+ */
 export function readFramework(dialect, text) {
     const lines = text.split(String.fromCharCode(10));
     const out = [];
+    // One line can only hold one finding of a given kind, and two rules often describe the same
+    // statement - Liquibase writes `dropColumn` in an attribute form and a nested form, and both
+    // rules exist to read it. Keyed by line and risk so the same drop is not reported twice.
+    const seen = new Set();
     for (const operation of BY_DIALECT[dialect]) {
-        const hit = operation.find.exec(text);
-        if (!hit)
-            continue;
         if (operation.unless?.test(text))
             continue;
-        // The line the match starts on, so the reader can go straight to it.
-        const before = text.slice(0, hit.index ?? 0).split(String.fromCharCode(10)).length;
-        out.push({
-            statement: (lines[before - 1] ?? hit[0]).trim().slice(0, 300),
-            line: before,
-            risk: operation.risk,
-            what: operation.what(hit),
-            instead: operation.instead,
-            table: operation.table?.(hit) ?? '',
-            column: operation.column?.(hit) ?? '',
-        });
+        // A fresh global copy: the rules are shared module-level objects, and a global regex carries
+        // `lastIndex` between calls, so reusing one would start the next file mid-way through.
+        const all = new RegExp(operation.find.source, operation.find.flags.replace('g', '') + 'g');
+        for (const hit of text.matchAll(all)) {
+            // The line the match starts on, so the reader can go straight to it.
+            const before = text.slice(0, hit.index ?? 0).split(String.fromCharCode(10)).length;
+            const key = `${before}:${operation.risk}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({
+                statement: (lines[before - 1] ?? hit[0]).trim().slice(0, 300),
+                line: before,
+                risk: operation.risk,
+                what: operation.what(hit),
+                instead: operation.instead,
+                table: operation.table?.(hit) ?? '',
+                column: operation.column?.(hit) ?? '',
+            });
+        }
     }
-    return out;
+    // In file order, because a reader works down the file rather than down a list of rules.
+    return out.sort((a, b) => a.line - b.line);
 }
 /** A migration that cannot be rolled back by running its own down step. */
 export function irreversible(dialect, text) {

package/dist/engine/schema/schema-command.js

@@ -13,8 +13,18 @@ import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
 import { readSql } from './statements.js';
-const MIGRATION = /(^|\/)(migrations?|db\/migrate|prisma\/migrations|alembic|flyway|sql)\//i;
-const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|db\/migrate)\/.*\.(py|rb|js|ts)$/i;
+const MIGRATION = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|flyway|changelogs?|sql)\//i;
+// A changelog is often not in a directory that says so. OpenMRS keeps 44 Liquibase changelogs in
+// `api/src/main/resources/` named `liquibase-*.xml`, and the path filter saw none of them - so a
+// real healthcare system with 44 migration files was told it had none. The name counts too.
+// A changelog is named for what it is, but hardly ever *only* that. Phase 42 taught this filter to
+// read `liquibase-update-to-latest.xml` and it still missed Keycloak's 83 files, every one of them
+// called `jpa-changelog-<version>.xml`: the name was required to *begin* with the word. Prefixes are
+// the norm - a project with more than one database names each changelog after its module. So the
+// word may sit anywhere in the name. Letting a release-notes `CHANGELOG.xml` through costs nothing,
+// because `dialectOf` still has to find `<databaseChangeLog` in it before it is read as a migration.
+const NAMED_MIGRATION = /(^|\/)[\w.-]*(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i;
+const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate)\/.*\.(py|rb|js|ts|php|cs)$/i;
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
     const named = cmd.files !== undefined && cmd.files.length > 0;
@@ -24,7 +34,7 @@ export function schemaFiles(cmd) {
         // Asking for a file by name overrides the path filter: the filter exists to find migrations in
         // a diff of a hundred files, not to argue with somebody who pointed at one. A TypeORM migration
         // sitting outside a migrations/ directory was being answered with "no migration in this change".
-        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
+        .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f) || NAMED_MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
 }
 /**
  * Tables this migration creates itself.

package/dist/engine/start/start-command.js

@@ -37,6 +37,7 @@ export function lookAround(root, limit = 4000) {
         hasWorkflows: existsSync(join(root, '.github', 'workflows')),
         hasStandards: existsSync(join(root, '.tewip', 'standards')),
         filesSeen: false,
+        stoppedEarly: false,
     };
     let seen = 0;
     // A queue rather than recursion: every directory at one depth is read before any at the next.
@@ -53,8 +54,13 @@ export function lookAround(root, limit = 4000) {
             continue;
         }
         for (const entry of entries) {
-            if (seen >= limit)
+            // Out of budget with entries still unread in *this* directory. Checking only the queue was
+            // not enough: a project whose files sit in one flat directory empties the queue before the
+            // budget runs out, so the look stopped short and did not know it.
+            if (seen >= limit) {
+                found.stoppedEarly = true;
                 break;
+            }
             if (SKIP.has(entry) || (entry.startsWith('.') && entry !== '.github'))
                 continue;
             const full = join(dir, entry);
@@ -78,7 +84,11 @@ export function lookAround(root, limit = 4000) {
                 found.perfReports.push(rel);
             else if (/(k6|lighthouse|summary|lhr)[\w.-]*\.json$/i.test(entry) && info.size < 8_000_000)
                 found.perfReports.push(rel);
-            const inMigrations = /(^|\/)(migrations?|db\/migrate|changelog)\//i.test(rel);
+            // A changelog is often not in a directory that says so: OpenMRS keeps 44 Liquibase files in
+            // `api/src/main/resources/` named `liquibase-*.xml`. The name counts as well as the path - and
+            // the word may sit anywhere in it, because Keycloak's 83 are `jpa-changelog-<version>.xml`.
+            const inMigrations = /(^|\/)(migrations?|migration|db\/migrate|changelogs?)\//i.test(rel) ||
+                /(^|\/)[\w.-]*(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i.test(rel);
             // Reading a file is only worth it for the two questions a name cannot answer: is this a
             // test, and is this a migration. Both are cheap, and both are often wrong from the path.
             const language = languageOf(entry);
@@ -101,6 +111,8 @@ export function lookAround(root, limit = 4000) {
             }
         }
     }
+    if (seen >= limit && queue.length > 0)
+        found.stoppedEarly = true;
     return found;
 }
 const total = (counts) => [...counts.values()].reduce((a, b) => a + b, 0);
@@ -139,19 +151,19 @@ export function suggest(found) {
     if (tests > 0) {
         out.push({
             command: 'tewip vouch',
-            because: `${tests} test ${tests === 1 ? 'file' : 'files'} here (${named(found.tests)}). This reads them and names the ones that cannot fail - no model, a second or two.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${tests} test ${tests === 1 ? 'file' : 'files'} here (${named(found.tests)}). This reads them and names the ones that cannot fail - no model, a second or two.`,
         });
     }
     if (migrations > 0) {
         out.push({
             command: 'tewip schema --diff main...HEAD',
-            because: `${migrations} ${migrations === 1 ? 'migration' : 'migrations'} here (${named(found.migrations)}). This says what a change would do to a live database before it runs.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${migrations} ${migrations === 1 ? 'migration' : 'migrations'} here (${named(found.migrations)}). This says what a change would do to a live database before it runs.`,
         });
     }
     if (found.markup > 0) {
         out.push({
             command: 'tewip access',
-            because: `${found.markup} markup ${found.markup === 1 ? 'file' : 'files'} here. This names who cannot use the interface, against the WCAG criterion a regulator would cite.`,
+            because: `${found.stoppedEarly ? 'At least ' : ''}${found.markup} markup ${found.markup === 1 ? 'file' : 'files'} here. This names who cannot use the interface, against the WCAG criterion a regulator would cite.`,
         });
     }
     for (const report of found.perfReports.slice(0, 1)) {
@@ -187,6 +199,11 @@ export function renderStart(found, root) {
     }
     lines.push('## What it will not do here', '');
     const cannot = [];
+    if (found.stoppedEarly) {
+        cannot.push('This project is larger than Tewip looks at from here, so the counts above are **at least** ' +
+            'that many rather than exactly. The commands themselves read everything; only this first ' +
+            'glance is bounded, so that it stays instant.');
+    }
     if (total(found.tests) === 0)
         cannot.push('No test files were found, so nothing can be said about whether your tests could fail or would catch a bug.');
     if (total(found.migrations) === 0)

package/dist/engine/vouch/vouch.js

@@ -50,12 +50,12 @@ export function vouchFile(file, text) {
     const focus = [...text.matchAll(/\b(it|test|describe)\s*\.\s*only\s*\(|\bfdescribe\s*\(|\bfit\s*\(/g)].find((hit) => !ranges.some(([from, to]) => (hit.index ?? 0) > from && (hit.index ?? 0) < to));
     return {
         file,
-        judgements: tests.map((test) => judge(file, test, helpers)),
+        judgements: tests.map((test) => judge(file, test, helpers, language)),
         unread: '',
         focused: focus ? `${focus[0].trim()}…) is focused, so the rest of this file does not run` : '',
     };
 }
-function judge(file, test, helpers) {
+function judge(file, test, helpers, language) {
     const at = { file, name: test.name, line: test.line };
     if (test.skipped)
         return { ...at, verdict: 'never-runs', evidence: test.name, why: MEANS['never-runs'] };
@@ -76,7 +76,7 @@ function judge(file, test, helpers) {
     if (unfinished.length > 0 && !checksSomething(stripLines(body, unfinished))) {
         return { ...at, verdict: 'unfinished-expectation', evidence: unfinished[0], why: MEANS['unfinished-expectation'] };
     }
-    const swallowed = swallowsFailure(body, checks);
+    const swallowed = swallowsFailure(body, checks, language);
     if (swallowed)
         return { ...at, verdict: 'swallows-failure', evidence: swallowed, why: MEANS['swallows-failure'] };
     if (checks)
@@ -129,15 +129,44 @@ function withoutText(body) {
     }
     return out;
 }
+/**
+ * On the JVM, the only catches that can swallow a failing assertion.
+ *
+ * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
+ * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
+ * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
+ *
+ * This is not a detail. It is the difference between the standard Java way of writing "I expect this
+ * to throw" -
+ *
+ *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
+ *
+ * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
+ * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
+ * tests worthless**, every one of them this idiom. Telling a developer their working test is
+ * worthless is the one failure this project cannot afford, so the caught type is now read.
+ *
+ * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
+ * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
+ */
+const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
 /**
  * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
  * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
  * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
  */
-function swallowsFailure(body, checks) {
+function swallowsFailure(body, checks, language) {
     if (!checks)
         return ''; // nothing to swallow; judged as no-assertion instead
     for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
+        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
+        if (language === 'jvm') {
+            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
+            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
+            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
+            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
+                continue;
+        }
         const open = body.indexOf('{', hit.index ?? 0);
         const handler = balanced(body, open);
         if (handler === null)
@@ -216,9 +245,15 @@ const stripLines = (body, lines) => body
     .join(String.fromCharCode(10));
 /** The first line that does something, for the report to quote. */
 function firstRealLine(body) {
-    const line = body
+    const lines = body
         .split(String.fromCharCode(10))
         .map((l) => l.trim())
-        .find((l) => l !== '' && l !== '{' && l !== '}');
-    return (line ?? '').slice(0, 120);
+        .filter((l) => l !== '' && l !== '{' && l !== '}');
+    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
+    // quoted evidence for 166 real findings was the single character "#", which tells a reader
+    // nothing about the test it is accusing. The line that does something is the evidence.
+    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
+    // bracket. Evidence has to be something a reader can recognise as the test doing work.
+    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
+    return (code ?? lines[0] ?? '').slice(0, 120);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [