tewip-ai 0.50.0 → 0.52.0

package/dist/engine/access/checks.js

@@ -6,57 +6,9 @@
 // div that only answers to a mouse. The ones that need a rendered page (contrast, focus order,
 // whether alt text is any good) are not attempted here and are listed in NOT_CHECKED instead.
 import { inside, labelledBy } from './markup.js';
-/** Elements that already answer to the keyboard and already carry a role. */
-const INTERACTIVE = new Set(['a', 'button', 'input', 'select', 'textarea', 'summary', 'details']);
-/** `role="presentation"` and friends: the author has said this is decoration. */
-function decorative(t) {
-    return t.attrs['aria-hidden'] === 'true' || t.attrs.role === 'presentation' || t.attrs.role === 'none';
-}
-function show(t) {
-    const keep = ['src', 'href', 'type', 'name', 'id', 'class', 'role'];
-    const shown = keep
-        .filter((k) => typeof t.attrs[k] === 'string' && t.attrs[k] !== '')
-        .slice(0, 2)
-        .map((k) => ` ${k}="${t.attrs[k].slice(0, 40)}"`)
-        .join('');
-    return `<${t.name}${shown}${t.spread ? ' {...}' : ''}>`;
-}
-function at(t, file) {
-    return { file, line: t.line, element: show(t) };
-}
-/** Every real `aria-*` attribute. A name outside this set is a typo, and a typo does nothing at all. */
-const ARIA = new Set([
-    'aria-activedescendant', 'aria-atomic', 'aria-autocomplete', 'aria-braillelabel', 'aria-brailleroledescription',
-    'aria-busy', 'aria-checked', 'aria-colcount', 'aria-colindex', 'aria-colindextext', 'aria-colspan',
-    'aria-controls', 'aria-current', 'aria-describedby', 'aria-description', 'aria-details', 'aria-disabled',
-    'aria-dropeffect', 'aria-errormessage', 'aria-expanded', 'aria-flowto', 'aria-grabbed', 'aria-haspopup',
-    'aria-hidden', 'aria-invalid', 'aria-keyshortcuts', 'aria-label', 'aria-labelledby', 'aria-level', 'aria-live',
-    'aria-modal', 'aria-multiline', 'aria-multiselectable', 'aria-orientation', 'aria-owns', 'aria-placeholder',
-    'aria-posinset', 'aria-pressed', 'aria-readonly', 'aria-relevant', 'aria-required', 'aria-roledescription',
-    'aria-rowcount', 'aria-rowindex', 'aria-rowindextext', 'aria-rowspan', 'aria-selected', 'aria-setsize',
-    'aria-sort', 'aria-valuemax', 'aria-valuemin', 'aria-valuenow', 'aria-valuetext',
-]);
-/** A click handler, in any of the four dialects this scanner reads. */
-function clickHandler(t) {
-    return ['onclick', '@click', 'v-on:click', 'on:click'].some((a) => a in t.attrs || t.dynamic.has(a));
-}
-function keyHandler(t) {
-    return Object.keys(t.attrs).concat([...t.dynamic]).some((a) => /key(down|up|press)/i.test(a));
-}
-function tabIndexOf(t) {
-    const raw = t.attrs.tabindex ?? t.attrs.tabIndex;
-    if (raw === undefined)
-        return null;
-    const n = Number(raw);
-    return Number.isFinite(n) ? n : null;
-}
-/**
- * Fields that take typing, and therefore need a label. Buttons and hidden fields are excluded: a
- * submit button is named by its value, and a hidden field is not announced at all.
- */
-const UNLABELLED_TYPES = new Set(['hidden', 'submit', 'reset', 'button', 'image']);
+import { ARIA, INTERACTIVE, UNLABELLED_TYPES, at, clickHandler, decorative, hiddenFromEveryone, keyHandler, show, tabIndexOf } from './element.js';
 /** Checks that look at one element at a time. */
-function perElement(t, file, labelFor, openLabels, ancestorKey) {
+function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent = new Set()) {
     const out = [];
     const place = at(t, file);
     const name = labelledBy(t);
@@ -78,16 +30,33 @@ function perElement(t, file, labelFor, openLabels, ancestorKey) {
                 next: 'add alt="..." describing what the image conveys, or alt="" if it conveys nothing' });
         }
     }
-    if (t.name === 'input' && !UNLABELLED_TYPES.has(t.attrs.type ?? 'text')) {
+    // A <select> and a <textarea> need a name exactly as much as an <input> does, and this checked
+    // only <input>. A screen reader announces an unnamed select as "combo box" and stops - the user is
+    // told there is a choice to make and nothing about what it decides. Found in Phase 43 by putting a
+    // deliberately broken React component in front of the scanner: it caught the bare <img>, <input>,
+    // <button>, <a> and click-only <div>, and walked straight past <select>. `select-name` was already
+    // in the axe rule table and already in INTERACTIVE; only this line had never been widened.
+    const NEEDS_NAME = { input: 'input-label', select: 'select-name', textarea: 'label' };
+    const nameRule = NEEDS_NAME[t.name];
+    // `!t.component` matters as much as the element name. React names its components with a capital,
+    // so PatternFly's `<Select>` and `<Input>` lowercase to the same string as the HTML elements - and
+    // this check, unlike `image-alt` beside it, never asked. Keycloak's admin UI is built on PatternFly
+    // and `<Select onOpenChange={...}>` was reported as an unnamed combo box; what that component
+    // renders, and whether it labels itself, is not in this file and cannot be read from it.
+    if (nameRule && !t.component && !hiddenFromEveryone(t) && (t.name !== 'input' || !UNLABELLED_TYPES.has(t.attrs.type ?? 'text'))) {
         const linked = typeof t.attrs.id === 'string' && labelFor.has(t.attrs.id);
         if (!name.named && !linked && openLabels === 0) {
-            if (name.unknown || t.dynamic.has('id')) {
-                out.push({ rule: 'input-label', confidence: 'ask-a-person', ...place,
-                    why: 'no label, aria-label or wrapping <label> can be read here, and part of the element is an expression',
+            if (name.unknown || t.dynamic.has('id') || t.dynamic.has('style') || (typeof t.attrs.id === 'string' && namedByComponent.has(t.attrs.id))) {
+                out.push({ rule: nameRule, confidence: 'ask-a-person', ...place,
+                    why: typeof t.attrs.id === 'string' && namedByComponent.has(t.attrs.id)
+                        ? `no <label for> is written here, but a component in this file names id="${t.attrs.id}" in one of its props, so the label may be rendered there`
+                        : t.dynamic.has('style')
+                            ? 'no label can be read here, and its style is an expression, so whether this is displayed at all cannot be read from the markup'
+                            : 'no label, aria-label or wrapping <label> can be read here, and part of the element is an expression',
                     next: 'confirm the field is labelled at runtime; if not, add aria-label or a <label for>' });
             }
             else {
-                out.push({ rule: 'input-label', confidence: 'barrier', ...place,
+                out.push({ rule: nameRule, confidence: 'barrier', ...place,
                     why: 'no aria-label, no title, no id matching a <label for>, and not inside a <label>',
                     next: 'wrap it in a <label>, or give it an id and point a <label for> at it' });
             }
@@ -152,6 +121,20 @@ function perElement(t, file, labelFor, openLabels, ancestorKey) {
 export function checkFile(source, all, file, isDocument = false) {
     const out = [];
     const labelFor = new Set(all.filter((t) => t.name === 'label' && t.attrs.for).map((t) => t.attrs.for));
+    // Ids that a *component* names in one of its props. A design system labels a field by being told
+    // which field it is for - PatternFly's `<FormGroup label={...} fieldId="x">` renders `<label for="x">`
+    // around its children - and that label exists only in the component's own source, not here.
+    // Keycloak's admin UI is built this way throughout, so a control inside one is not an unnamed
+    // control; it is a control this file cannot answer for, which is a different verdict.
+    const namedByComponent = new Set();
+    for (const t of all) {
+        if (!t.component)
+            continue;
+        for (const [key, value] of Object.entries(t.attrs)) {
+            if (typeof value === 'string' && value !== '' && /(^|[a-z])(id|for)$/i.test(key))
+                namedByComponent.add(value);
+        }
+    }
     const seenIds = new Set();
     let openLabels = 0;
     let interactiveDepth = 0;
@@ -170,7 +153,7 @@ export function checkFile(source, all, file, isDocument = false) {
                 open.length = from;
             continue;
         }
-        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys)));
+        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys), namedByComponent));
         if (!t.selfClosing)
             open.push({ name: t.name, keys: keyHandler(t) });
         const id = t.attrs.id;

package/dist/engine/access/element.js

@@ -0,0 +1,68 @@
+/** Elements that already answer to the keyboard and already carry a role. */
+export const INTERACTIVE = new Set(['a', 'button', 'input', 'select', 'textarea', 'summary', 'details']);
+/** `role="presentation"` and friends: the author has said this is decoration. */
+export function decorative(t) {
+    return t.attrs['aria-hidden'] === 'true' || t.attrs.role === 'presentation' || t.attrs.role === 'none';
+}
+export function show(t) {
+    const keep = ['src', 'href', 'type', 'name', 'id', 'class', 'role'];
+    const shown = keep
+        .filter((k) => typeof t.attrs[k] === 'string' && t.attrs[k] !== '')
+        .slice(0, 2)
+        .map((k) => ` ${k}="${t.attrs[k].slice(0, 40)}"`)
+        .join('');
+    return `<${t.name}${shown}${t.spread ? ' {...}' : ''}>`;
+}
+export function at(t, file) {
+    return { file, line: t.line, element: show(t) };
+}
+/** Every real `aria-*` attribute. A name outside this set is a typo, and a typo does nothing at all. */
+export const ARIA = new Set([
+    'aria-activedescendant', 'aria-atomic', 'aria-autocomplete', 'aria-braillelabel', 'aria-brailleroledescription',
+    'aria-busy', 'aria-checked', 'aria-colcount', 'aria-colindex', 'aria-colindextext', 'aria-colspan',
+    'aria-controls', 'aria-current', 'aria-describedby', 'aria-description', 'aria-details', 'aria-disabled',
+    'aria-dropeffect', 'aria-errormessage', 'aria-expanded', 'aria-flowto', 'aria-grabbed', 'aria-haspopup',
+    'aria-hidden', 'aria-invalid', 'aria-keyshortcuts', 'aria-label', 'aria-labelledby', 'aria-level', 'aria-live',
+    'aria-modal', 'aria-multiline', 'aria-multiselectable', 'aria-orientation', 'aria-owns', 'aria-placeholder',
+    'aria-posinset', 'aria-pressed', 'aria-readonly', 'aria-relevant', 'aria-required', 'aria-roledescription',
+    'aria-rowcount', 'aria-rowindex', 'aria-rowindextext', 'aria-rowspan', 'aria-selected', 'aria-setsize',
+    'aria-sort', 'aria-valuemax', 'aria-valuemin', 'aria-valuenow', 'aria-valuetext',
+]);
+/** A click handler, in any of the four dialects this scanner reads. */
+export function clickHandler(t) {
+    return ['onclick', '@click', 'v-on:click', 'on:click'].some((a) => a in t.attrs || t.dynamic.has(a));
+}
+export function keyHandler(t) {
+    return Object.keys(t.attrs).concat([...t.dynamic]).some((a) => /key(down|up|press)/i.test(a));
+}
+export function tabIndexOf(t) {
+    const raw = t.attrs.tabindex ?? t.attrs.tabIndex;
+    if (raw === undefined)
+        return null;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : null;
+}
+/**
+ * Fields that take typing, and therefore need a label. Buttons and hidden fields are excluded: a
+ * submit button is named by its value, and a hidden field is not announced at all.
+ */
+export const UNLABELLED_TYPES = new Set(['hidden', 'submit', 'reset', 'button', 'image']);
+/**
+ * Hidden from everybody, so no name is needed and none is missing.
+ *
+ * A file picker styled out of sight and clicked by a button beside it is the standard way to build
+ * an upload control, and Keycloak's `<input id="jarUpload" type="file" style={{display:"none"}}>` is
+ * exactly that. `display:none` takes an element out of the accessibility tree altogether: it is
+ * announced to nobody, so "it has no label" stops nobody either.
+ *
+ * When the style is a JSX expression its text is not kept, so whether it hides the element cannot be
+ * read. That is not a reason to call it a certain barrier - it is a reason to say so.
+ */
+export function hiddenFromEveryone(t) {
+    if ('hidden' in t.attrs && t.attrs.hidden !== 'false')
+        return true;
+    if (t.attrs['aria-hidden'] === 'true')
+        return true;
+    const style = typeof t.attrs.style === 'string' ? t.attrs.style : '';
+    return /display\s*:\s*none|visibility\s*:\s*hidden/i.test(style);
+}

package/dist/engine/access/wcag.js

@@ -19,6 +19,21 @@ export const RULES = {
         severity: 'blocker',
         stops: 'a screen reader announces "edit text" with no way to know what to type',
     },
+    // A select and a textarea are form controls like any other, and both were missing here. A rule the
+    // scanner can raise but this table does not describe renders as "WCAG 2.2, unrated" with no line
+    // saying who it stops - which is most of what makes an accessibility finding worth acting on.
+    'select-name': {
+        criterion: '4.1.2 Name, Role, Value',
+        level: 'A',
+        severity: 'blocker',
+        stops: 'a screen reader announces "combo box" and nothing else, so the user is told there is a choice but not what it decides',
+    },
+    'label': {
+        criterion: '3.3.2 Labels or Instructions',
+        level: 'A',
+        severity: 'blocker',
+        stops: 'a screen reader announces "edit text, multi line" with no way to know what to type',
+    },
     'button-name': {
         criterion: '4.1.2 Name, Role, Value',
         level: 'A',

package/dist/engine/schema/dialect-rules-node.js

@@ -142,14 +142,31 @@ const EFCORE = [
  */
 const XML_TABLE = String.raw `tableName\s*=\s*["']([\w.]+)["']`;
 const LIQUIBASE = [
-    {
-        find: new RegExp(String.raw `<dropColumn[^>]*${XML_TABLE}[\s\S]{0,300}?<column[^>]*name\s*=\s*["']([\w.]+)["']`, 'i'),
+    // Liquibase writes a dropped column two ways, and both of these rules are needed. The order they
+    // are tried in does not matter now that neither can match the other's shape.
+    //
+    // The nested form, where the columns are children of the element:
+    //   <dropColumn tableName="CLIENT">
+    //     <column name="ALLOWED_CLAIMS_MASK"/>
+    //   </dropColumn>
+    //
+    // `(?:(?!\/>)[^>])*>` is the important part: it matches the opening tag only when that tag is not
+    // self-closing. Without it the rule matched a self-closing `<dropColumn ... />` and then went on
+    // looking for a `<column name=` for up to 300 characters, which in Keycloak's changelog found one
+    // three lines later inside an unrelated `<createTable>`. Tewip reported "drops CLIENT.REALM_ID"
+    // while quoting a line that says `columnName="ALLOWED_CLAIMS_MASK"` - a headline contradicted by
+    // its own evidence, and the wrong column to go looking for.
+    {
+        find: new RegExp(String.raw `<dropColumn(?:(?!\/>)[^>])*${XML_TABLE}(?:(?!\/>)[^>])*>[\s\S]{0,300}?<column[^>]*name\s*=\s*["']([\w.]+)["']`, 'i'),
         risk: 'breaks-old-code',
         what: (m) => `drops ${m[1]}.${m[2]}`,
         instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
         table: (m) => m[1],
         column: (m) => m[2],
     },
+    // The attribute form. Both orders, because XML attributes have no required order and Keycloak
+    // writes `tableName` first - which the old rule, demanding `columnName` first, could never match.
+    // Sixty-seven dropped columns in that repository and this is the spelling nearly all of them use.
     {
         find: new RegExp(String.raw `<dropColumn[^>]*columnName\s*=\s*["']([\w.]+)["'][^>]*${XML_TABLE}`, 'i'),
         risk: 'breaks-old-code',
@@ -158,6 +175,14 @@ const LIQUIBASE = [
         table: (m) => m[2],
         column: (m) => m[1],
     },
+    {
+        find: new RegExp(String.raw `<dropColumn[^>]*${XML_TABLE}[^>]*columnName\s*=\s*["']([\w.]+)["']`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
     {
         find: new RegExp(String.raw `<dropTable[^>]*${XML_TABLE}`, 'i'),
         risk: 'destroys-data',

package/dist/engine/schema/frameworks.js

@@ -46,29 +46,51 @@ const BY_DIALECT = {
     liquibase: LIQUIBASE,
     laravel: LARAVEL,
 };
-/** Findings from a framework migration, with the line each one sits on. */
+/**
+ * Findings from a framework migration, with the line each one sits on.
+ *
+ * Every occurrence, not the first. `find.exec(text)` returns a single match, so a migration that
+ * dropped five tables reported one of them - and the other four were not mentioned anywhere, not
+ * even as "and more". Keycloak's `jpa-changelog-26.0.0.xml` drops **eight** tables; Tewip named one.
+ * Under-reporting a destructive change is the worst direction to be wrong in, because the reader
+ * sees a finding, deals with it, and reasonably concludes that was all of them.
+ *
+ * Found in Phase 43 and it was never dialect-specific: Django, Rails, Alembic, Laravel, Sequelize,
+ * Knex and EF Core all ran through this same loop.
+ */
 export function readFramework(dialect, text) {
     const lines = text.split(String.fromCharCode(10));
     const out = [];
+    // One line can only hold one finding of a given kind, and two rules often describe the same
+    // statement - Liquibase writes `dropColumn` in an attribute form and a nested form, and both
+    // rules exist to read it. Keyed by line and risk so the same drop is not reported twice.
+    const seen = new Set();
     for (const operation of BY_DIALECT[dialect]) {
-        const hit = operation.find.exec(text);
-        if (!hit)
-            continue;
         if (operation.unless?.test(text))
             continue;
-        // The line the match starts on, so the reader can go straight to it.
-        const before = text.slice(0, hit.index ?? 0).split(String.fromCharCode(10)).length;
-        out.push({
-            statement: (lines[before - 1] ?? hit[0]).trim().slice(0, 300),
-            line: before,
-            risk: operation.risk,
-            what: operation.what(hit),
-            instead: operation.instead,
-            table: operation.table?.(hit) ?? '',
-            column: operation.column?.(hit) ?? '',
-        });
+        // A fresh global copy: the rules are shared module-level objects, and a global regex carries
+        // `lastIndex` between calls, so reusing one would start the next file mid-way through.
+        const all = new RegExp(operation.find.source, operation.find.flags.replace('g', '') + 'g');
+        for (const hit of text.matchAll(all)) {
+            // The line the match starts on, so the reader can go straight to it.
+            const before = text.slice(0, hit.index ?? 0).split(String.fromCharCode(10)).length;
+            const key = `${before}:${operation.risk}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({
+                statement: (lines[before - 1] ?? hit[0]).trim().slice(0, 300),
+                line: before,
+                risk: operation.risk,
+                what: operation.what(hit),
+                instead: operation.instead,
+                table: operation.table?.(hit) ?? '',
+                column: operation.column?.(hit) ?? '',
+            });
+        }
     }
-    return out;
+    // In file order, because a reader works down the file rather than down a list of rules.
+    return out.sort((a, b) => a.line - b.line);
 }
 /** A migration that cannot be rolled back by running its own down step. */
 export function irreversible(dialect, text) {

package/dist/engine/schema/migration-files.js

@@ -0,0 +1,79 @@
+// Which files in a project are migrations at all.
+//
+// Split out of schema-command.ts in Phase 44, when the corpus harness needed to ask the question
+// across a whole checkout rather than across a diff and that file went past the 300-line rule.
+// Keeping it in one place is the point: the alternative was a copy of these patterns in a script,
+// and two definitions of "is this a migration" drift the moment one of them is fixed.
+import { readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+// A directory called `migration/` says what is probably in it, not what every file in it is. This
+// matched *anything* underneath one, so Keycloak's `docs/guides/migration/index.adoc` and its 113
+// `migration/migrators/MigrateTo12_0_0.java` classes - application code that moves data between
+// Keycloak versions, nothing to do with a schema file - were selected as migrations and then listed
+// as ones Tewip could not read. 205 files chosen in order to read 89. A "could not read" list that
+// is mostly documentation teaches the reader to skip the list.
+//
+// So the directory decides *where*, and the extension decides *whether it could hold DDL at all*.
+const MIGRATION_DIR = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|flyway|changelogs?|sql)\//i;
+const COULD_HOLD_DDL = /\.(sql|py|rb|js|mjs|cjs|ts|php|cs|xml|ya?ml|json|go|exs?)$/i;
+// Flyway's Java migrations are real, and they are named the way Flyway requires: `V2__add_index.java`
+// or `R__rebuild_views.java`. Keycloak's `MigrateTo12_0_0.java` is not one. Taking `.java` on the
+// strength of its directory alone is what filled that list with source files.
+const FLYWAY_JAVA = /(^|\/)[VR][\w.]*__[\w.-]+\.(java|kt|scala)$/;
+export const MIGRATION = {
+    test: (path) => MIGRATION_DIR.test(path) && (COULD_HOLD_DDL.test(path) || FLYWAY_JAVA.test(path)),
+};
+// A changelog is often not in a directory that says so. OpenMRS keeps 44 Liquibase changelogs in
+// `api/src/main/resources/` named `liquibase-*.xml`, and the path filter saw none of them - so a
+// real healthcare system with 44 migration files was told it had none. The name counts too.
+//
+// And a changelog is named for what it is, but hardly ever *only* that. Phase 42 taught this filter
+// to read `liquibase-update-to-latest.xml` and it still missed Keycloak's 83, every one called
+// `jpa-changelog-<version>.xml`: the word had to *begin* the name. Prefixes are the norm once a
+// project has more than one database. Letting a release-notes `CHANGELOG.xml` through costs nothing,
+// because `dialectOf` still has to find `<databaseChangeLog` in it before it is read as a migration.
+export const NAMED_MIGRATION = /(^|\/)[\w.-]*(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i;
+export const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate)\/.*\.(py|rb|js|ts|php|cs)$/i;
+/**
+ * Every migration in a whole repository, by the same filters a diff is read through.
+ *
+ * `schemaFiles` answers "which of these changed files are migrations", which is the question a pull
+ * request asks. "What migrations does this project have at all" is a different question, and the
+ * corpus harness needs it to re-derive a verified number across a pinned checkout.
+ */
+export function migrationsUnder(root, limit = 20_000) {
+    const skip = new Set(['node_modules', '.git', 'dist', 'build', 'target', 'vendor', '__pycache__', '.venv', 'venv', '.next', '.cache']);
+    const found = [];
+    const walk = (where, depth) => {
+        if (depth > 12 || found.length >= limit)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(where);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (skip.has(entry) || entry.startsWith('.'))
+                continue;
+            const full = join(where, entry);
+            let info;
+            try {
+                info = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (info.isDirectory()) {
+                walk(full, depth + 1);
+                continue;
+            }
+            const rel = relative(root, full).replaceAll(String.fromCharCode(92), '/');
+            if (SCHEMA_FILE.test(rel) || MIGRATION.test(rel) || NAMED_MIGRATION.test(rel))
+                found.push(rel);
+        }
+    };
+    walk(root, 0);
+    return found.sort();
+}

package/dist/engine/schema/schema-command.js

@@ -13,12 +13,8 @@ import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
 import { readSql } from './statements.js';
-const MIGRATION = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|flyway|changelogs?|sql)\//i;
-// A changelog is often not in a directory that says so. OpenMRS keeps 44 Liquibase changelogs in
-// `api/src/main/resources/` named `liquibase-*.xml`, and the path filter saw none of them - so a
-// real healthcare system with 44 migration files was told it had none. The name counts too.
-const NAMED_MIGRATION = /(^|\/)(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i;
-const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate)\/.*\.(py|rb|js|ts|php|cs)$/i;
+import { MIGRATION, NAMED_MIGRATION, SCHEMA_FILE, migrationsUnder } from './migration-files.js';
+export { migrationsUnder };
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
     const named = cmd.files !== undefined && cmd.files.length > 0;

package/dist/engine/start/start-command.js

@@ -85,9 +85,10 @@ export function lookAround(root, limit = 4000) {
             else if (/(k6|lighthouse|summary|lhr)[\w.-]*\.json$/i.test(entry) && info.size < 8_000_000)
                 found.perfReports.push(rel);
             // A changelog is often not in a directory that says so: OpenMRS keeps 44 Liquibase files in
-            // `api/src/main/resources/` named `liquibase-*.xml`. The name counts as well as the path.
+            // `api/src/main/resources/` named `liquibase-*.xml`. The name counts as well as the path - and
+            // the word may sit anywhere in it, because Keycloak's 83 are `jpa-changelog-<version>.xml`.
             const inMigrations = /(^|\/)(migrations?|migration|db\/migrate|changelogs?)\//i.test(rel) ||
-                /(^|\/)(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i.test(rel);
+                /(^|\/)[\w.-]*(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i.test(rel);
             // Reading a file is only worth it for the two questions a name cannot answer: is this a
             // test, and is this a migration. Both are cheap, and both are often wrong from the path.
             const language = languageOf(entry);

package/dist/engine/vouch/assertions.js

@@ -30,6 +30,13 @@ const CHECKS = [
     /\bpytest\s*\.\s*(raises|warns|approx|fail)\b/,
     /\bnp\s*\.\s*testing\s*\.\s*assert/,
     /\bassert_(frame|series|index)_equal\b/,
+    // A bare `fail(...)`, which is how JUnit, TestNG and Go spell "this must not be reached" once the
+    // assertion is statically imported. `Assert.fail(...)` was already read by the pattern below;
+    // `fail(...)` on its own was not, so OpenMRS's RefByUuidTest - whose only real check is a `fail()`
+    // in the catch, beside a deliberate `assertTrue(true)` in the try - was called a tautology that
+    // "no change to the code can falsify". Make `getRefByUuid` throw and it falsifies immediately.
+    // The leading class keeps `shouldFail(` and `canFail(` out, and the paren must come next.
+    /(^|[^\w.])(?:Assert(?:ions)?\s*\.\s*)?fail\s*\(/,
     // Java, Kotlin, C#, Scala.
     /\bAssert(ions)?\s*\./,
     /\bassertThat\s*\(/,

package/dist/engine/vouch/vouch.js

@@ -50,12 +50,12 @@ export function vouchFile(file, text) {
     const focus = [...text.matchAll(/\b(it|test|describe)\s*\.\s*only\s*\(|\bfdescribe\s*\(|\bfit\s*\(/g)].find((hit) => !ranges.some(([from, to]) => (hit.index ?? 0) > from && (hit.index ?? 0) < to));
     return {
         file,
-        judgements: tests.map((test) => judge(file, test, helpers)),
+        judgements: tests.map((test) => judge(file, test, helpers, language)),
         unread: '',
         focused: focus ? `${focus[0].trim()}…) is focused, so the rest of this file does not run` : '',
     };
 }
-function judge(file, test, helpers) {
+function judge(file, test, helpers, language) {
     const at = { file, name: test.name, line: test.line };
     if (test.skipped)
         return { ...at, verdict: 'never-runs', evidence: test.name, why: MEANS['never-runs'] };
@@ -76,7 +76,7 @@ function judge(file, test, helpers) {
     if (unfinished.length > 0 && !checksSomething(stripLines(body, unfinished))) {
         return { ...at, verdict: 'unfinished-expectation', evidence: unfinished[0], why: MEANS['unfinished-expectation'] };
     }
-    const swallowed = swallowsFailure(body, checks);
+    const swallowed = swallowsFailure(body, checks, language);
     if (swallowed)
         return { ...at, verdict: 'swallows-failure', evidence: swallowed, why: MEANS['swallows-failure'] };
     if (checks)
@@ -129,15 +129,44 @@ function withoutText(body) {
     }
     return out;
 }
+/**
+ * On the JVM, the only catches that can swallow a failing assertion.
+ *
+ * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
+ * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
+ * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
+ *
+ * This is not a detail. It is the difference between the standard Java way of writing "I expect this
+ * to throw" -
+ *
+ *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
+ *
+ * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
+ * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
+ * tests worthless**, every one of them this idiom. Telling a developer their working test is
+ * worthless is the one failure this project cannot afford, so the caught type is now read.
+ *
+ * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
+ * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
+ */
+const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
 /**
  * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
  * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
  * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
  */
-function swallowsFailure(body, checks) {
+function swallowsFailure(body, checks, language) {
     if (!checks)
         return ''; // nothing to swallow; judged as no-assertion instead
     for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
+        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
+        if (language === 'jvm') {
+            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
+            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
+            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
+            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
+                continue;
+        }
         const open = body.indexOf('{', hit.index ?? 0);
         const handler = balanced(body, open);
         if (handler === null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
@@ -63,7 +63,9 @@
     "typecheck": "tsc --noEmit",
     "build": "tsc -p tsconfig.build.json",
     "prepack": "npm run build",
-    "tewip": "node cli/tewip.ts"
+    "tewip": "node cli/tewip.ts",
+    "version": "node scripts/sync-version.ts && git add server.json",
+    "corpus": "node scripts/corpus.ts"
   },
   "license": "Apache-2.0",
   "devDependencies": {