tewip-ai 0.52.0 → 0.53.0

package/dist/engine/access/access-command.js

@@ -9,6 +9,7 @@
 //
 // It never says a page is accessible. It says what was checked.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { dirname, join, relative, resolve } from 'node:path';
 import { sourceFiles } from '../secure/secrets.js';
 import { JS_LIKE, MARKUP, tags } from './markup.js';
@@ -50,7 +51,7 @@ export function findBarriers(root, only) {
     for (const path of files) {
         let source;
         try {
-            source = readFileSync(path, 'utf8');
+            source = normalise(readFileSync(path, 'utf8'));
         }
         catch {
             continue;

package/dist/engine/quality/source-text.js

@@ -0,0 +1,29 @@
+// Reading somebody else's file, the same way on every machine.
+//
+// Found by the corpus harness on its first run in CI, Phase 44: the same pinned commit of Keycloak
+// produced 0 swallows-failure findings on Windows and 3 on Linux, and OpenMRS differed by seven
+// crash-only tests. Git for Windows checks source out with CRLF, so the text Tewip judged was not
+// the text the project wrote, and a scanner whose answer depends on which machine ran it is not
+// giving an answer at all - it is giving an opinion with a hostname attached.
+//
+// The carriage returns go at the boundary rather than in each rule, because the alternative is
+// remembering `\r?` in every pattern anybody writes afterwards, and one forgotten `\r?` is this bug
+// again. Line numbers are unaffected: a CRLF file has exactly as many newlines as an LF one.
+//
+// A BOM goes too. It is invisible, it sits before the first character of the file, and it stops a
+// pattern anchored at the start of the text from matching the first line.
+import { readFileSync } from 'node:fs';
+/** The file's text with line endings normalised, or '' when it cannot be read. */
+export function sourceText(file) {
+    try {
+        return normalise(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return '';
+    }
+}
+/** Normalised, for text that has already been read. */
+export function normalise(text) {
+    const withoutBom = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    return withoutBom.includes(String.fromCharCode(13)) ? withoutBom.split(String.fromCharCode(13) + String.fromCharCode(10)).join(String.fromCharCode(10)) : withoutBom;
+}

package/dist/engine/schema/schema-command.js

@@ -9,6 +9,7 @@
 // such. A mention in a comment counts as a mention; Tewip says where it looked and lets the reader judge.
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
@@ -54,7 +55,7 @@ export function droppingWhatIsNew(findings, text) {
 export function readMigration(root, file) {
     let text = '';
     try {
-        text = readFileSync(resolve(root, file), 'utf8');
+        text = normalise(readFileSync(resolve(root, file), 'utf8'));
     }
     catch {
         return { file, dialect: 'unknown', findings: [], unread: 'the file could not be read', irreversible: false };

package/dist/engine/vouch/swallowed.js

@@ -0,0 +1,92 @@
+// Whether a test's own verdict is caught and thrown away.
+//
+// Split out of vouch.ts in Phase 44. It is the rule that has been wrong most often and most
+// expensively - 166 false accusations in Phase 43, two more in Phase 44 - so it is worth having
+// where it can be read on its own, with the reasoning that corrected it attached.
+import { checksSomething } from './assertions.js';
+import { balanced, withoutComments } from './text.js';
+/**
+ * On the JVM, the only catches that can swallow a failing assertion.
+ *
+ * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
+ * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
+ * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
+ *
+ * This is not a detail. It is the difference between the standard Java way of writing "I expect this
+ * to throw" -
+ *
+ *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
+ *
+ * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
+ * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
+ * tests worthless**, every one of them this idiom. Telling a developer their working test is
+ * worthless is the one failure this project cannot afford, so the caught type is now read.
+ *
+ * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
+ * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
+ */
+const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
+/**
+ * The `try` block that belongs to a `catch`, so the question can be asked about the right code.
+ *
+ * Walks back from the `catch` over the `}` that closes the try and finds its `{` by counting.
+ */
+function tryBlockBefore(body, catchAt) {
+    const close = body.lastIndexOf('}', catchAt);
+    if (close === -1)
+        return '';
+    let depth = 0;
+    for (let i = close; i >= 0; i -= 1) {
+        if (body[i] === '}')
+            depth += 1;
+        else if (body[i] === '{') {
+            depth -= 1;
+            if (depth === 0)
+                return body.slice(i + 1, close);
+        }
+    }
+    return '';
+}
+/**
+ * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
+ * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
+ * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
+ */
+export function swallowsFailure(body, checks, language) {
+    if (!checks)
+        return ''; // nothing to swallow; judged as no-assertion instead
+    for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
+        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
+        if (language === 'jvm') {
+            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
+            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
+            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
+            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
+                continue;
+        }
+        // The catch has to be able to swallow *this test's verdict*, and it can only do that when the
+        // assertion is inside its own try. Keycloak's admin-client tests open with
+        //
+        //     try { await delByName({ name }); } catch { /* ignore */ }
+        //
+        // to make sure the scope does not already exist, and then assert afterwards, outside it. The
+        // rule asked "does this test assert anywhere, and is there an empty catch anywhere" and so
+        // called three correct tests worthless. A try around setup is not a swallowed verdict.
+        const guarded = tryBlockBefore(body, hit.index ?? 0);
+        if (guarded !== '' && !checksSomething(guarded))
+            continue;
+        const open = body.indexOf('{', hit.index ?? 0);
+        const handler = balanced(body, open);
+        if (handler === null)
+            continue;
+        const meaningful = withoutComments(handler).trim();
+        const rescues = checksSomething(handler) || /\b(throw|raise|rethrow|fail|t\s*\.\s*(Error|Fatal)|pytest\s*\.\s*fail)\b/.test(handler);
+        if (rescues)
+            continue;
+        // A handler that only logs, or does nothing at all, discards the failure.
+        if (meaningful === '' || /^(console\s*\.\s*\w+\s*\([^;]*\)\s*;?|print\s*\([^;]*\)\s*;?|pass|;)$/.test(meaningful.replace(/\s+/g, ' ').trim())) {
+            return meaningful === '' ? 'catch { }' : meaningful.slice(0, 120);
+        }
+    }
+    return '';
+}

package/dist/engine/vouch/text.js

@@ -0,0 +1,45 @@
+// Small text operations the vouch rules share.
+//
+// Split out in Phase 44 so that `swallowed.ts` could use them without importing the module that
+// imports it. Nothing here knows what a test is; they are string surgery and nothing more.
+/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */
+export function withoutComments(body) {
+    return body
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .split(String.fromCharCode(10))
+        .map((line) => line.replace(/(^|\s)\/\/.*$/, '').replace(/(^|\s)#(?!\{).*$/, ''))
+        .join(String.fromCharCode(10));
+}
+export const stripLines = (body, lines) => body
+    .split(String.fromCharCode(10))
+    .filter((line) => !lines.some((drop) => line.trim() === drop.trim()))
+    .join(String.fromCharCode(10));
+/** The first line that does something, for the report to quote. */
+export function firstRealLine(body) {
+    const lines = body
+        .split(String.fromCharCode(10))
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && l !== '{' && l !== '}');
+    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
+    // quoted evidence for 166 real findings was the single character "#", which tells a reader
+    // nothing about the test it is accusing. The line that does something is the evidence.
+    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
+    // bracket. Evidence has to be something a reader can recognise as the test doing work.
+    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
+    return (code ?? lines[0] ?? '').slice(0, 120);
+}
+export const balanced = (text, open) => {
+    if (open === -1)
+        return null;
+    let depth = 0;
+    for (let i = open; i < text.length; i += 1) {
+        if (text[i] === '{')
+            depth += 1;
+        else if (text[i] === '}') {
+            depth -= 1;
+            if (depth === 0)
+                return text.slice(open + 1, i);
+        }
+    }
+    return null;
+};

package/dist/engine/vouch/vouch-command.js

@@ -5,6 +5,7 @@
 // Tewip would not judge - and it ends with what it refused, because that is what makes the rest of
 // it believable.
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { join, relative } from 'node:path';
 import { CANNOT_FAIL, vouchFile } from './vouch.js';
 const SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor', 'target', '.venv', '__pycache__', '.tewip']);
@@ -57,7 +58,7 @@ export function vouchAll(root, paths) {
     for (const file of testFiles(root, paths)) {
         let text;
         try {
-            text = readFileSync(file, 'utf8');
+            text = normalise(readFileSync(file, 'utf8'));
         }
         catch {
             continue;

package/dist/engine/vouch/vouch.js

@@ -9,6 +9,8 @@
 // their time and their trust, and a reviewer who is wrong once is ignored afterwards. So a body whose
 // checking happens somewhere this cannot follow is reported as undecided, by name, and never as
 // vacuous.
+import { balanced, firstRealLine, stripLines, withoutComments } from './text.js';
+import { swallowsFailure } from './swallowed.js';
 import { checksSomething, tautologies, unfinishedExpectations } from './assertions.js';
 import { languageOf, looksLikeTests, testsIn, textRanges } from './tests-in.js';
 /** Everything a verdict other than `checks` means, in the words the report uses. */
@@ -129,59 +131,6 @@ function withoutText(body) {
     }
     return out;
 }
-/**
- * On the JVM, the only catches that can swallow a failing assertion.
- *
- * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
- * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
- * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
- *
- * This is not a detail. It is the difference between the standard Java way of writing "I expect this
- * to throw" -
- *
- *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
- *
- * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
- * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
- * tests worthless**, every one of them this idiom. Telling a developer their working test is
- * worthless is the one failure this project cannot afford, so the caught type is now read.
- *
- * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
- * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
- */
-const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
-/**
- * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
- * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
- * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
- */
-function swallowsFailure(body, checks, language) {
-    if (!checks)
-        return ''; // nothing to swallow; judged as no-assertion instead
-    for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
-        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
-        if (language === 'jvm') {
-            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
-            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
-            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
-            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
-                continue;
-        }
-        const open = body.indexOf('{', hit.index ?? 0);
-        const handler = balanced(body, open);
-        if (handler === null)
-            continue;
-        const meaningful = withoutComments(handler).trim();
-        const rescues = checksSomething(handler) || /\b(throw|raise|rethrow|fail|t\s*\.\s*(Error|Fatal)|pytest\s*\.\s*fail)\b/.test(handler);
-        if (rescues)
-            continue;
-        // A handler that only logs, or does nothing at all, discards the failure.
-        if (meaningful === '' || /^(console\s*\.\s*\w+\s*\([^;]*\)\s*;?|print\s*\([^;]*\)\s*;?|pass|;)$/.test(meaningful.replace(/\s+/g, ' ').trim())) {
-            return meaningful === '' ? 'catch { }' : meaningful.slice(0, 120);
-        }
-    }
-    return '';
-}
 /** Functions defined in this file that assert, so a test calling one really is checking something. */
 function helpersThatCheck(text, language) {
     const names = new Set();
@@ -216,44 +165,4 @@ function indentedFrom(text, from) {
 }
 /** Names that are calls but not helpers: language and framework machinery. */
 const LANGUAGE_NOISE = new Set(['if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'await', 'typeof', 'new', 'require', 'import', 'print', 'console', 'log', 'describe', 'beforeEach', 'afterEach', 'it', 'test', 'range', 'len', 'str', 'int', 'super', 'Error', 'Promise', 'Array', 'Object', 'String', 'Number', 'Boolean', 'Date', 'JSON', 'Math', 'Map', 'Set']);
-const balanced = (text, open) => {
-    if (open === -1)
-        return null;
-    let depth = 0;
-    for (let i = open; i < text.length; i += 1) {
-        if (text[i] === '{')
-            depth += 1;
-        else if (text[i] === '}') {
-            depth -= 1;
-            if (depth === 0)
-                return text.slice(open + 1, i);
-        }
-    }
-    return null;
-};
-/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */
-function withoutComments(body) {
-    return body
-        .replace(/\/\*[\s\S]*?\*\//g, ' ')
-        .split(String.fromCharCode(10))
-        .map((line) => line.replace(/(^|\s)\/\/.*$/, '').replace(/(^|\s)#(?!\{).*$/, ''))
-        .join(String.fromCharCode(10));
-}
-const stripLines = (body, lines) => body
-    .split(String.fromCharCode(10))
-    .filter((line) => !lines.some((drop) => line.trim() === drop.trim()))
-    .join(String.fromCharCode(10));
-/** The first line that does something, for the report to quote. */
-function firstRealLine(body) {
-    const lines = body
-        .split(String.fromCharCode(10))
-        .map((l) => l.trim())
-        .filter((l) => l !== '' && l !== '{' && l !== '}');
-    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
-    // quoted evidence for 166 real findings was the single character "#", which tells a reader
-    // nothing about the test it is accusing. The line that does something is the evidence.
-    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
-    // bracket. Evidence has to be something a reader can recognise as the test doing work.
-    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
-    return (code ?? lines[0] ?? '').slice(0, 120);
-}
+/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */ 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [