tewip-ai 0.52.0 → 0.54.0

package/dist/engine/access/access-command.js

@@ -9,6 +9,7 @@
 //
 // It never says a page is accessible. It says what was checked.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { dirname, join, relative, resolve } from 'node:path';
 import { sourceFiles } from '../secure/secrets.js';
 import { JS_LIKE, MARKUP, tags } from './markup.js';
@@ -50,7 +51,7 @@ export function findBarriers(root, only) {
     for (const path of files) {
         let source;
         try {
-            source = readFileSync(path, 'utf8');
+            source = normalise(readFileSync(path, 'utf8'));
         }
         catch {
             continue;

package/dist/engine/access/checks.js

@@ -6,9 +6,9 @@
 // div that only answers to a mouse. The ones that need a rendered page (contrast, focus order,
 // whether alt text is any good) are not attempted here and are listed in NOT_CHECKED instead.
 import { inside, labelledBy } from './markup.js';
-import { ARIA, INTERACTIVE, UNLABELLED_TYPES, at, clickHandler, decorative, hiddenFromEveryone, keyHandler, show, tabIndexOf } from './element.js';
+import { ARIA, INTERACTIVE, UNLABELLED_TYPES, at, clickHandler, decorative, hiddenFromEveryone, keyHandler, notRendered, show, tabIndexOf } from './element.js';
 /** Checks that look at one element at a time. */
-function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent = new Set()) {
+function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent = new Set(), boundLabels = new Set()) {
     const out = [];
     const place = at(t, file);
     const name = labelledBy(t);
@@ -44,7 +44,8 @@ function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent
     // and `<Select onOpenChange={...}>` was reported as an unnamed combo box; what that component
     // renders, and whether it labels itself, is not in this file and cannot be read from it.
     if (nameRule && !t.component && !hiddenFromEveryone(t) && (t.name !== 'input' || !UNLABELLED_TYPES.has(t.attrs.type ?? 'text'))) {
-        const linked = typeof t.attrs.id === 'string' && labelFor.has(t.attrs.id);
+        const bound = ['asp-for', 'formControlName', 'v-model', 'data-valmsg-for'].some((key) => typeof t.attrs[key] === 'string' && boundLabels.has(`${key}=${t.attrs[key]}`));
+        const linked = bound || (typeof t.attrs.id === 'string' && labelFor.has(t.attrs.id));
         if (!name.named && !linked && openLabels === 0) {
             if (name.unknown || t.dynamic.has('id') || t.dynamic.has('style') || (typeof t.attrs.id === 'string' && namedByComponent.has(t.attrs.id))) {
                 out.push({ rule: nameRule, confidence: 'ask-a-person', ...place,
@@ -73,7 +74,11 @@ function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent
             why: `tabindex="${tabindex}" takes this element out of the document order and puts it before everything that has none`,
             next: 'use tabindex="0" and let the source order decide, or move the element in the markup' });
     }
-    if (t.attrs['aria-hidden'] === 'true' && (INTERACTIVE.has(t.name) || (tabindex !== null && tabindex >= 0))) {
+    // `hidden` takes the element out of the tab order as well as out of the page, so aria-hidden on it
+    // hides nothing that was reachable. GOV.UK's service-navigation toggle is written
+    // `<button ... hidden aria-hidden="true">` and uncovered by JavaScript when the menu is enabled -
+    // progressive enhancement done properly, reported as a barrier.
+    if (t.attrs['aria-hidden'] === 'true' && !notRendered(t) && (INTERACTIVE.has(t.name) || (tabindex !== null && tabindex >= 0))) {
         out.push({ rule: 'aria-hidden-focusable', confidence: 'barrier', ...place,
             why: 'hidden from screen readers but still reachable by the tab key',
             next: 'also remove it from the tab order with tabindex="-1", or stop hiding it' });
@@ -121,6 +126,22 @@ function perElement(t, file, labelFor, openLabels, ancestorKey, namedByComponent
 export function checkFile(source, all, file, isDocument = false) {
     const out = [];
     const labelFor = new Set(all.filter((t) => t.name === 'label' && t.attrs.for).map((t) => t.attrs.for));
+    // A framework can bind a label to a field without either of them spelling `for` or `id`. ASP.NET
+    // Core Tag Helpers do it with the model property: `asp-for="Name"` on the <label> renders
+    // `for="Name"`, and the same on the <input> renders `id="Name"`. bitwarden/server's admin views
+    // are written this way throughout, and 111 correctly labelled fields were called unlabelled.
+    // The same shape as PatternFly's FormGroup in Phase 43: the label is real, it is just not here.
+    const BINDS = ['asp-for', 'formControlName', 'v-model', 'data-valmsg-for'];
+    const boundLabels = new Set();
+    for (const t of all) {
+        if (t.name !== 'label')
+            continue;
+        for (const key of BINDS) {
+            const value = t.attrs[key];
+            if (typeof value === 'string' && value !== '')
+                boundLabels.add(`${key}=${value}`);
+        }
+    }
     // Ids that a *component* names in one of its props. A design system labels a field by being told
     // which field it is for - PatternFly's `<FormGroup label={...} fieldId="x">` renders `<label for="x">`
     // around its children - and that label exists only in the component's own source, not here.
@@ -153,7 +174,7 @@ export function checkFile(source, all, file, isDocument = false) {
                 open.length = from;
             continue;
         }
-        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys), namedByComponent));
+        out.push(...perElement(t, file, labelFor, Math.max(openLabels - (t.name === 'label' ? 1 : 0), 0), open.some((o) => o.keys), namedByComponent, boundLabels));
         if (!t.selfClosing)
             open.push({ name: t.name, keys: keyHandler(t) });
         const id = t.attrs.id;

package/dist/engine/access/element.js

@@ -58,9 +58,22 @@ export const UNLABELLED_TYPES = new Set(['hidden', 'submit', 'reset', 'button',
  * When the style is a JSX expression its text is not kept, so whether it hides the element cannot be
  * read. That is not a reason to call it a certain barrier - it is a reason to say so.
  */
-export function hiddenFromEveryone(t) {
+/**
+ * Not rendered at all, and therefore not in the tab order either.
+ *
+ * Separate from `hiddenFromEveryone` because `aria-hidden` hides an element from a screen reader
+ * while leaving it perfectly focusable - that gap is a real barrier and has its own rule. The
+ * `hidden` attribute and `display:none` close the gap: nothing can reach the element by any route.
+ */
+export function notRendered(t) {
     if ('hidden' in t.attrs && t.attrs.hidden !== 'false')
         return true;
+    const style = typeof t.attrs.style === 'string' ? t.attrs.style : '';
+    return /display\s*:\s*none|visibility\s*:\s*hidden/i.test(style);
+}
+export function hiddenFromEveryone(t) {
+    if (notRendered(t))
+        return true;
     if (t.attrs['aria-hidden'] === 'true')
         return true;
     const style = typeof t.attrs.style === 'string' ? t.attrs.style : '';

package/dist/engine/access/markup.js

@@ -31,6 +31,27 @@ const TAG = /<(\/?)([A-Za-z][A-Za-z0-9._:-]*)(?=[\s/>])((?:[^>"'{]|"[^"]*"|'[^']
 const ATTRIBUTE = /([@:#\[A-Za-z_][-A-Za-z0-9_:.@\]]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|\{((?:[^{}]|\{[^{}]*\})*)\}|([^\s"'<>`=]+)))?/g;
 /** `{...props}`, `{...rest}` - the thing that makes every other judgement about the element unsafe. */
 const SPREAD = /\{\s*\.\.\./;
+/**
+ * A template language's version of a spread: an expression standing where an attribute *name*
+ * would go, rather than inside a value.
+ *
+ * GOV.UK's own input component is written this way - every attribute, `id` included, comes out of
+ * one macro call:
+ *
+ *     <input
+ *       {{- govukAttributes({ class: classNames, id: id, name: params.name, ... }) }}
+ *
+ * so after the expressions are blanked the element reads as a bare `<input>` with nothing on it,
+ * and the scanner called the UK government's accessible-by-obligation text input a certain
+ * barrier. It is not: it is an element this file cannot answer for, which is a different verdict.
+ *
+ * Quoted values are removed first, because `id="{{ params.id }}"` is a dynamic attribute - which
+ * is already handled, and separately - rather than attributes arriving from somewhere else.
+ */
+function templateSpread(blob) {
+    const withoutValues = blob.replace(/"[^"]*"|'[^']*'/g, '""');
+    return /\{\{|\{%|<%|#{/.test(withoutValues);
+}
 /**
  * Comments, and the bodies of script and style, hold things shaped like tags that are not tags.
  *
@@ -73,7 +94,7 @@ export const JS_LIKE = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/i;
 function readAttributes(blob) {
     const attrs = {};
     const dynamic = new Set();
-    const spread = SPREAD.test(blob);
+    const spread = SPREAD.test(blob) || templateSpread(blob);
     // A spread's contents would otherwise be read as attribute names: `{...props}` becomes `props`.
     const readable = blob.replace(/\{\s*\.\.\.(?:[^{}]|\{[^{}]*\})*\}/g, ' ');
     for (const m of readable.matchAll(ATTRIBUTE)) {

package/dist/engine/quality/source-text.js

@@ -0,0 +1,29 @@
+// Reading somebody else's file, the same way on every machine.
+//
+// Found by the corpus harness on its first run in CI, Phase 44: the same pinned commit of Keycloak
+// produced 0 swallows-failure findings on Windows and 3 on Linux, and OpenMRS differed by seven
+// crash-only tests. Git for Windows checks source out with CRLF, so the text Tewip judged was not
+// the text the project wrote, and a scanner whose answer depends on which machine ran it is not
+// giving an answer at all - it is giving an opinion with a hostname attached.
+//
+// The carriage returns go at the boundary rather than in each rule, because the alternative is
+// remembering `\r?` in every pattern anybody writes afterwards, and one forgotten `\r?` is this bug
+// again. Line numbers are unaffected: a CRLF file has exactly as many newlines as an LF one.
+//
+// A BOM goes too. It is invisible, it sits before the first character of the file, and it stops a
+// pattern anchored at the start of the text from matching the first line.
+import { readFileSync } from 'node:fs';
+/** The file's text with line endings normalised, or '' when it cannot be read. */
+export function sourceText(file) {
+    try {
+        return normalise(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return '';
+    }
+}
+/** Normalised, for text that has already been read. */
+export function normalise(text) {
+    const withoutBom = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    return withoutBom.includes(String.fromCharCode(13)) ? withoutBom.split(String.fromCharCode(13) + String.fromCharCode(10)).join(String.fromCharCode(10)) : withoutBom;
+}

package/dist/engine/schema/schema-command.js

@@ -9,6 +9,7 @@
 // such. A mention in a comment counts as a mention; Tewip says where it looked and lets the reader judge.
 import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
@@ -38,8 +39,32 @@ export function schemaFiles(cmd) {
  */
 function createdHere(text) {
     const names = new Set();
-    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?"?([\w$.]+)"?/gi)) {
-        names.add(m[1].toLowerCase().replace(/^.*\./, ''));
+    // The frameworks say "create this table" in their own words, and the suppression is worth nothing
+    // in a dialect it cannot read. Only SQL was read, so bitwarden/server's 456 EF Core migrations -
+    // which do exactly what Prisma does, a CreateTable followed by a CreateIndex for every relation -
+    // produced 647 "blocks writes" findings about tables that had not existed a statement earlier.
+    // EF Core puts the name on the line after the call, so these have to reach across a newline.
+    const FRAMEWORK_CREATES = [
+        /migrationBuilder\s*\.\s*CreateTable\s*\([\s\S]{0,80}?name\s*:\s*["']([\w$.]+)["']/gi,
+        /queryInterface\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
+        /knex\s*\.\s*schema\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
+        /Schema\s*::\s*create\s*\(\s*["']([\w$.]+)["']/gi,
+        /\bcreate_table\s+[:'"]([\w$.]+)/gi,
+        /\bop\s*\.\s*create_table\s*\(\s*["']([\w$.]+)["']/gi,
+        /<createTable[^>]*tableName\s*=\s*["']([\w$.]+)["']/gi,
+    ];
+    for (const pattern of FRAMEWORK_CREATES)
+        for (const m of text.matchAll(pattern))
+            names.add(m[1].toLowerCase().replace(/^.*\./, ''));
+    // Every dialect's way of quoting a name, because the suppression is useless in the one that does
+    // not match. This read PostgreSQL's "quoted" form and plain names, and not SQL Server's
+    // [dbo].[Grant] - which is standard T-SQL and what bitwarden/server is written in throughout. No
+    // table was ever recognised as freshly created there, so every index built on a table created two
+    // statements earlier was reported as blocking writes: 714 findings, nearly all of them free.
+    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([\w$.\"\[\]`]+)/gi)) {
+        // `[dbo].[Grant]` and `"public"."grant"` and `grant` all have to arrive here as the same word,
+        // because that is the form the findings report a table in.
+        names.add(m[1].replace(/[\"\[\]`]/g, '').toLowerCase().replace(/^.*\./, ''));
     }
     return names;
 }
@@ -54,7 +79,7 @@ export function droppingWhatIsNew(findings, text) {
 export function readMigration(root, file) {
     let text = '';
     try {
-        text = readFileSync(resolve(root, file), 'utf8');
+        text = normalise(readFileSync(resolve(root, file), 'utf8'));
     }
     catch {
         return { file, dialect: 'unknown', findings: [], unread: 'the file could not be read', irreversible: false };

package/dist/engine/vouch/find-tests.js

@@ -239,7 +239,14 @@ function bracedTests(language, text) {
         // An annotation disables a test outright. A `t.Skip()` may be conditional - cobra's
         // TestDeadcodeElimination skips on Windows and runs everywhere else - so it counts only when it
         // is unconditional, at the top level of the body.
-        const skipped = /@(Disabled|Ignore)\b|\[\s*Ignore\b/.test(around) || skipsUnconditionally(body);
+        // xUnit - the most used .NET framework by a distance - has no separate attribute for this. It
+        // skips by giving the test attribute a reason: `[Fact(Skip = "...")]`, `[Theory(Skip = ...)]`.
+        // Only `[Ignore]` was read, which is NUnit and MSTest, so bitwarden/server's **43 skipped tests
+        // were reported as 1**. A team told their suite is sound while 43 of its tests never run is
+        // worse off than a team told nothing at all.
+        const skipped = /@(Disabled|Ignore)\b|\[\s*Ignore\b/.test(around) ||
+            /\[\s*\w*(?:Fact|Theory)\s*\([^)]*\bSkip\s*=/.test(around) ||
+            skipsUnconditionally(body);
         found.push({ name, line: lineAt(text, at), body, skipped, callback: '' });
     }
     return found;
@@ -253,7 +260,12 @@ function skipsUnconditionally(body) {
     let depth = 0;
     for (const line of body.split(String.fromCharCode(10))) {
         const text = line.trim();
-        if (depth === 0 && /^\w+\s*\.\s*Skip(Now)?\s*\(/.test(text))
+        // `t.Skip(...)` in Go: a short receiver, and a whole statement with nothing chained onto it.
+        // `\w+\.Skip(` matched any identifier at all, so C#'s LINQ - `collections.Skip(1).ToList()`,
+        // which is how .NET pages a sequence - read as a test turning itself off. bitwarden/server has
+        // one, and it was the only never-runs Tewip reported there until xUnit's `[Fact(Skip = ...)]`
+        // was understood; the real number was 43 and the one it had was wrong.
+        if (depth === 0 && /^\w{1,3}\s*\.\s*Skip(f|Now)?\s*\([^)]*\)\s*;?\s*$/.test(text))
             return true;
         depth += (line.match(/\{/g) ?? []).length - (line.match(/\}/g) ?? []).length;
     }

package/dist/engine/vouch/swallowed.js

@@ -0,0 +1,92 @@
+// Whether a test's own verdict is caught and thrown away.
+//
+// Split out of vouch.ts in Phase 44. It is the rule that has been wrong most often and most
+// expensively - 166 false accusations in Phase 43, two more in Phase 44 - so it is worth having
+// where it can be read on its own, with the reasoning that corrected it attached.
+import { checksSomething } from './assertions.js';
+import { balanced, withoutComments } from './text.js';
+/**
+ * On the JVM, the only catches that can swallow a failing assertion.
+ *
+ * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
+ * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
+ * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
+ *
+ * This is not a detail. It is the difference between the standard Java way of writing "I expect this
+ * to throw" -
+ *
+ *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
+ *
+ * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
+ * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
+ * tests worthless**, every one of them this idiom. Telling a developer their working test is
+ * worthless is the one failure this project cannot afford, so the caught type is now read.
+ *
+ * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
+ * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
+ */
+const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
+/**
+ * The `try` block that belongs to a `catch`, so the question can be asked about the right code.
+ *
+ * Walks back from the `catch` over the `}` that closes the try and finds its `{` by counting.
+ */
+function tryBlockBefore(body, catchAt) {
+    const close = body.lastIndexOf('}', catchAt);
+    if (close === -1)
+        return '';
+    let depth = 0;
+    for (let i = close; i >= 0; i -= 1) {
+        if (body[i] === '}')
+            depth += 1;
+        else if (body[i] === '{') {
+            depth -= 1;
+            if (depth === 0)
+                return body.slice(i + 1, close);
+        }
+    }
+    return '';
+}
+/**
+ * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
+ * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
+ * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
+ */
+export function swallowsFailure(body, checks, language) {
+    if (!checks)
+        return ''; // nothing to swallow; judged as no-assertion instead
+    for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
+        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
+        if (language === 'jvm') {
+            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
+            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
+            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
+            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
+                continue;
+        }
+        // The catch has to be able to swallow *this test's verdict*, and it can only do that when the
+        // assertion is inside its own try. Keycloak's admin-client tests open with
+        //
+        //     try { await delByName({ name }); } catch { /* ignore */ }
+        //
+        // to make sure the scope does not already exist, and then assert afterwards, outside it. The
+        // rule asked "does this test assert anywhere, and is there an empty catch anywhere" and so
+        // called three correct tests worthless. A try around setup is not a swallowed verdict.
+        const guarded = tryBlockBefore(body, hit.index ?? 0);
+        if (guarded !== '' && !checksSomething(guarded))
+            continue;
+        const open = body.indexOf('{', hit.index ?? 0);
+        const handler = balanced(body, open);
+        if (handler === null)
+            continue;
+        const meaningful = withoutComments(handler).trim();
+        const rescues = checksSomething(handler) || /\b(throw|raise|rethrow|fail|t\s*\.\s*(Error|Fatal)|pytest\s*\.\s*fail)\b/.test(handler);
+        if (rescues)
+            continue;
+        // A handler that only logs, or does nothing at all, discards the failure.
+        if (meaningful === '' || /^(console\s*\.\s*\w+\s*\([^;]*\)\s*;?|print\s*\([^;]*\)\s*;?|pass|;)$/.test(meaningful.replace(/\s+/g, ' ').trim())) {
+            return meaningful === '' ? 'catch { }' : meaningful.slice(0, 120);
+        }
+    }
+    return '';
+}

package/dist/engine/vouch/text.js

@@ -0,0 +1,45 @@
+// Small text operations the vouch rules share.
+//
+// Split out in Phase 44 so that `swallowed.ts` could use them without importing the module that
+// imports it. Nothing here knows what a test is; they are string surgery and nothing more.
+/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */
+export function withoutComments(body) {
+    return body
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .split(String.fromCharCode(10))
+        .map((line) => line.replace(/(^|\s)\/\/.*$/, '').replace(/(^|\s)#(?!\{).*$/, ''))
+        .join(String.fromCharCode(10));
+}
+export const stripLines = (body, lines) => body
+    .split(String.fromCharCode(10))
+    .filter((line) => !lines.some((drop) => line.trim() === drop.trim()))
+    .join(String.fromCharCode(10));
+/** The first line that does something, for the report to quote. */
+export function firstRealLine(body) {
+    const lines = body
+        .split(String.fromCharCode(10))
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && l !== '{' && l !== '}');
+    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
+    // quoted evidence for 166 real findings was the single character "#", which tells a reader
+    // nothing about the test it is accusing. The line that does something is the evidence.
+    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
+    // bracket. Evidence has to be something a reader can recognise as the test doing work.
+    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
+    return (code ?? lines[0] ?? '').slice(0, 120);
+}
+export const balanced = (text, open) => {
+    if (open === -1)
+        return null;
+    let depth = 0;
+    for (let i = open; i < text.length; i += 1) {
+        if (text[i] === '{')
+            depth += 1;
+        else if (text[i] === '}') {
+            depth -= 1;
+            if (depth === 0)
+                return text.slice(open + 1, i);
+        }
+    }
+    return null;
+};

package/dist/engine/vouch/vouch-command.js

@@ -5,6 +5,7 @@
 // Tewip would not judge - and it ends with what it refused, because that is what makes the rest of
 // it believable.
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { normalise } from '../quality/source-text.js';
 import { join, relative } from 'node:path';
 import { CANNOT_FAIL, vouchFile } from './vouch.js';
 const SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', 'vendor', 'target', '.venv', '__pycache__', '.tewip']);
@@ -57,7 +58,7 @@ export function vouchAll(root, paths) {
     for (const file of testFiles(root, paths)) {
         let text;
         try {
-            text = readFileSync(file, 'utf8');
+            text = normalise(readFileSync(file, 'utf8'));
         }
         catch {
             continue;

package/dist/engine/vouch/vouch.js

@@ -9,6 +9,8 @@
 // their time and their trust, and a reviewer who is wrong once is ignored afterwards. So a body whose
 // checking happens somewhere this cannot follow is reported as undecided, by name, and never as
 // vacuous.
+import { balanced, firstRealLine, stripLines, withoutComments } from './text.js';
+import { swallowsFailure } from './swallowed.js';
 import { checksSomething, tautologies, unfinishedExpectations } from './assertions.js';
 import { languageOf, looksLikeTests, testsIn, textRanges } from './tests-in.js';
 /** Everything a verdict other than `checks` means, in the words the report uses. */
@@ -129,59 +131,6 @@ function withoutText(body) {
     }
     return out;
 }
-/**
- * On the JVM, the only catches that can swallow a failing assertion.
- *
- * `Assert.fail()` and every JUnit matcher throw `AssertionError`, which extends `Error`, which
- * extends `Throwable` - and `Error` is **not** an `Exception`. So `catch (Exception e) { }` does not
- * catch a failing assertion, and neither does `catch (NotFoundException e) { }`. Only these do.
- *
- * This is not a detail. It is the difference between the standard Java way of writing "I expect this
- * to throw" -
- *
- *     try { parse(bad); Assert.fail(); } catch (VerificationException expected) { }
- *
- * - which is a correct test that fails properly when `parse` stops throwing, and a test that really
- * does discard its own verdict. Tewip could not tell them apart and called **166 correct Keycloak
- * tests worthless**, every one of them this idiom. Telling a developer their working test is
- * worthless is the one failure this project cannot afford, so the caught type is now read.
- *
- * C# is deliberately not here: NUnit, xUnit and MSTest all throw assertion failures that derive from
- * `Exception`, so `catch (Exception)` really does swallow them there. Same shape, opposite answer.
- */
-const JVM_SWALLOWS = /^(?:java\.lang\.)?(?:Throwable|Error|AssertionError)$/;
-/**
- * Everything inside a `try` whose `catch` discards what it caught. An assertion failure is an
- * exception, so a test shaped this way reports success however the code behaves - and a `catch` that
- * asserts, re-throws or fails the test is the legitimate version, which this leaves alone.
- */
-function swallowsFailure(body, checks, language) {
-    if (!checks)
-        return ''; // nothing to swallow; judged as no-assertion instead
-    for (const hit of body.matchAll(/catch\s*(\([^)]*\))?\s*\{/g)) {
-        // On the JVM the caught type decides it, and nearly every type leaves the assertion alone.
-        if (language === 'jvm') {
-            const caught = /\(\s*(?:final\s+)?([\w.]+)/.exec(hit[1] ?? '');
-            // A multi-catch - `catch (A | B e)` - swallows only if one of its types does.
-            const types = (hit[1] ?? '').replace(/[()]/g, '').split('|').map((t) => t.trim().split(/\s+/)[0]);
-            if (!types.some((t) => JVM_SWALLOWS.test(t)) && !(caught && JVM_SWALLOWS.test(caught[1])))
-                continue;
-        }
-        const open = body.indexOf('{', hit.index ?? 0);
-        const handler = balanced(body, open);
-        if (handler === null)
-            continue;
-        const meaningful = withoutComments(handler).trim();
-        const rescues = checksSomething(handler) || /\b(throw|raise|rethrow|fail|t\s*\.\s*(Error|Fatal)|pytest\s*\.\s*fail)\b/.test(handler);
-        if (rescues)
-            continue;
-        // A handler that only logs, or does nothing at all, discards the failure.
-        if (meaningful === '' || /^(console\s*\.\s*\w+\s*\([^;]*\)\s*;?|print\s*\([^;]*\)\s*;?|pass|;)$/.test(meaningful.replace(/\s+/g, ' ').trim())) {
-            return meaningful === '' ? 'catch { }' : meaningful.slice(0, 120);
-        }
-    }
-    return '';
-}
 /** Functions defined in this file that assert, so a test calling one really is checking something. */
 function helpersThatCheck(text, language) {
     const names = new Set();
@@ -216,44 +165,4 @@ function indentedFrom(text, from) {
 }
 /** Names that are calls but not helpers: language and framework machinery. */
 const LANGUAGE_NOISE = new Set(['if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'await', 'typeof', 'new', 'require', 'import', 'print', 'console', 'log', 'describe', 'beforeEach', 'afterEach', 'it', 'test', 'range', 'len', 'str', 'int', 'super', 'Error', 'Promise', 'Array', 'Object', 'String', 'Number', 'Boolean', 'Date', 'JSON', 'Math', 'Map', 'Set']);
-const balanced = (text, open) => {
-    if (open === -1)
-        return null;
-    let depth = 0;
-    for (let i = open; i < text.length; i += 1) {
-        if (text[i] === '{')
-            depth += 1;
-        else if (text[i] === '}') {
-            depth -= 1;
-            if (depth === 0)
-                return text.slice(open + 1, i);
-        }
-    }
-    return null;
-};
-/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */
-function withoutComments(body) {
-    return body
-        .replace(/\/\*[\s\S]*?\*\//g, ' ')
-        .split(String.fromCharCode(10))
-        .map((line) => line.replace(/(^|\s)\/\/.*$/, '').replace(/(^|\s)#(?!\{).*$/, ''))
-        .join(String.fromCharCode(10));
-}
-const stripLines = (body, lines) => body
-    .split(String.fromCharCode(10))
-    .filter((line) => !lines.some((drop) => line.trim() === drop.trim()))
-    .join(String.fromCharCode(10));
-/** The first line that does something, for the report to quote. */
-function firstRealLine(body) {
-    const lines = body
-        .split(String.fromCharCode(10))
-        .map((l) => l.trim())
-        .filter((l) => l !== '' && l !== '{' && l !== '}');
-    // A comment is not the evidence. Saleor's tests are written `# given` / `# when / then`, so the
-    // quoted evidence for 166 real findings was the single character "#", which tells a reader
-    // nothing about the test it is accusing. The line that does something is the evidence.
-    // Nor is a line with nothing in it but punctuation: a lone quote closing a docstring, a stray
-    // bracket. Evidence has to be something a reader can recognise as the test doing work.
-    const code = lines.find((l) => !/^(#|\/\/|\/\*|\*|"""|'''|--)/.test(l) && /[A-Za-z0-9]/.test(l));
-    return (code ?? lines[0] ?? '').slice(0, 120);
-}
+/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */ 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [