tewip-ai 0.69.7 → 0.69.9

package/dist/cli/help.js

@@ -152,7 +152,9 @@ Usage:
                                     report and it reads that too - Lighthouse runs axe rules, so
                                     either works. Contrast moves out of the unchecked list, rules
                                     that map to no WCAG criterion are reported as advice rather than
-                                    barriers (51 of 174 findings on nine real pages), and what the
+                                    barriers (51 of 174 findings on nine real pages run through axe;
+                                    a Lighthouse report runs a WCAG-aligned subset and produced 2 of
+                                    363 on six real pages, so expect little advice from one), and what the
                                     tool could not determine becomes a question. Lighthouse's ten
                                     manual checks are questions too, never passes. No model, no cost.
   tewip standards [--diff main...HEAD] [--strict] [--out standards.md]

package/dist/engine/access/access-command.js

@@ -12,6 +12,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { normalise } from '../quality/source-text.js';
 import { dirname, join, relative, resolve } from 'node:path';
 import { sourceFiles } from '../secure/secrets.js';
+import { readHandWritten } from '../../reporters/store.js';
 import { JS_LIKE, MARKUP, tags } from './markup.js';
 import { checkFile } from './checks.js';
 import { readAxeReport } from './reports.js';
@@ -27,7 +28,7 @@ export function readAccepted(root) {
     const file = join(root, '.tewip', 'access-accepted.txt');
     if (!existsSync(file))
         return new Set();
-    return new Set(readFileSync(file, 'utf8')
+    return new Set(readHandWritten(file)
         .split('\n')
         .map((l) => l.split(' - ')[0].trim())
         .filter((l) => l !== '' && !l.startsWith('#')));

package/dist/engine/access/render.js

@@ -61,17 +61,36 @@ export function renderAccess(result, scanned) {
     }
     else {
         const stopping = barriers.filter((f) => blocks(f.rule)).length;
-        const counts = [
-            `${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} (${stopping} that stop somebody outright)`,
-            `${questions.length} for a person to settle`,
-        ];
-        if (accepted.length > 0)
-            counts.push(`${accepted.length} already accepted`);
+        const counts = [];
         if (browser) {
-            counts.unshift(`${browser.barriers.length} barriers the browser run proves`);
-            if (browser.questions.length > 0)
-                counts.push(`${browser.questions.length} the browser could not determine`);
+            // How many **rules**, then how many places. On Hacker News the browser count was "244
+            // barriers", of which **238 were one rule** - colour contrast - on one page. The number was
+            // arithmetically right and told the reader nothing they could act on: five things are wrong
+            // here, one of them in 238 places. A count of occurrences presented as a count of problems
+            // makes a page look hopeless and hides which five things to fix.
+            const rules = new Set(browser.barriers.map((f) => f.rule)).size;
+            counts.push(browser.barriers.length === 0
+                ? 'no barrier in the browser run'
+                : `${rules} ${rules === 1 ? 'barrier' : 'barriers'} the browser run proves, in ${browser.barriers.length} ${browser.barriers.length === 1 ? 'place' : 'places'}`);
+        }
+        // And this count is from reading markup, which the sentence never said. Beside a browser count
+        // also called "barriers", a reader saw "244 barriers..., 0 barriers" and could not tell whether
+        // the second number corrected the first. With no markup read at all there is no count to give:
+        // zero files examined is not a finding of zero.
+        if (filesRead > 0) {
+            counts.push(`${barriers.length} ${barriers.length === 1 ? 'barrier' : 'barriers'} in the markup (${stopping} that stop somebody outright)`);
+            counts.push(`${questions.length} for a person to settle`);
+        }
+        else if (!browser) {
+            counts.push('no markup file was read, so nothing was checked');
         }
+        else if (questions.length > 0) {
+            counts.push(`${questions.length} for a person to settle`);
+        }
+        if (accepted.length > 0)
+            counts.push(`${accepted.length} already accepted`);
+        if (browser && browser.questions.length > 0)
+            counts.push(`${browser.questions.length} the browser could not determine`);
         lines.push(`**${counts.join(', ')}.**`, '');
     }
     if (browser) {
@@ -82,8 +101,15 @@ export function renderAccess(result, scanned) {
     section('Only a person can settle these', [...questions].sort(worstFirst), lines);
     if (browser && browser.advice.length > 0) {
         // Kept out of the counts above on purpose. These are axe's own best-practice rules, which test
-        // no standard: on nine real pages they were 51 of 174 findings, outnumbering every real barrier.
-        // Reporting them as equals is how a team learns to ignore the whole report.
+        // no standard: on nine real pages **run through axe** they were 51 of 174 findings, outnumbering
+        // every real barrier. Reporting them as equals is how a team learns to ignore the whole report.
+        //
+        // That 51-of-174 is an axe number and only an axe number. Measured again on six real pages
+        // through **Lighthouse** - gov.uk, MDN, Hacker News, python.org, w3.org/WAI, Wikipedia - advice
+        // was 2 of 363 findings, 0.6%, because Lighthouse's accessibility category runs a WCAG-aligned
+        // subset of axe and leaves nearly all the best-practice rules out. Both numbers are real; a
+        // published one without the condition it was measured under is the kind of claim this project
+        // exists to stop making.
         const rules = [...new Set(browser.advice.map((f) => f.rule))].sort();
         lines.push('## Advice, not barriers', '');
         lines.push(`${browser.advice.length} ${browser.advice.length === 1 ? 'finding comes' : 'findings come'} from axe rules that map to no WCAG criterion - ` +

package/dist/engine/secure/triage.js

@@ -15,12 +15,13 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { readHandWritten } from '../../reporters/store.js';
 /** Findings a person has already judged, one per line: "<kind> <where> - reason". */
 export function readAccepted(root) {
     const file = join(root, '.tewip', 'security-accepted.txt');
     if (!existsSync(file))
         return new Set();
-    return new Set(readFileSync(file, 'utf8')
+    return new Set(readHandWritten(file)
         .split('\n')
         .map((l) => l.split(' - ')[0].trim())
         .filter(Boolean));

package/dist/engine/standards/standards-command.js

@@ -78,11 +78,21 @@ export function renderStandards(standards, violations, checkedFiles) {
         ].join(String.fromCharCode(10));
     }
     const checkable = standards.filter((s) => s.rules.length > 0);
-    const guidanceOnly = standards.filter((s) => s.rules.length === 0 && s.guidance.trim());
+    // Every standard that carries prose, not only the ones carrying nothing else.
+    //
+    // This was `s.rules.length === 0 && s.guidance.trim()`, so a standard written in the shape the
+    // feature is documented with - front matter rules, then prose below them - had its prose
+    // **invisible in this report**. Found by writing this project's own house rules in exactly that
+    // shape: four rules were listed as enforced and three paragraphs of guidance were never mentioned,
+    // under a closing line promising "everything else is prose Tewip carries for you". The other
+    // renderer, `renderViolations`, gets this right but only prints when something is broken - so a
+    // team doing it properly and keeping to its own rules is never told its guidance was read at all.
+    const carrying = standards.filter((s) => s.guidance.trim().length > 0);
+    const guidanceOnly = carrying.filter((s) => s.rules.length === 0);
     const lines = [
         '# What this project has taught Tewip',
         '',
-        `${standards.length} standard(s) loaded: ${checkable.length} with rules Tewip can check, ${guidanceOnly.length} guidance only.`,
+        `${standards.length} standard(s) loaded: ${checkable.length} with rules Tewip can check, ${carrying.length} carrying guidance it cannot${guidanceOnly.length > 0 ? ` (${guidanceOnly.length} guidance only)` : ''}.`,
         ...(checkedFiles > 0 ? ['', `${checkedFiles} changed file(s) checked. **${violations.length}** broke a rule.`] : []),
         '',
         '## Checked and enforced',
@@ -97,8 +107,12 @@ export function renderStandards(standards, violations, checkedFiles) {
         }
     }
     lines.push('');
-    if (guidanceOnly.length > 0) {
-        lines.push('## Carried, but not checked', '', 'Tewip passes these to the model when it writes or fixes something, and quotes them in reports. It', 'cannot verify them, and it will never report them as kept.', '', ...guidanceOnly.map((s) => `- **${s.name}**${s.description ? ` — ${s.description}` : ''}`), '');
+    if (carrying.length > 0) {
+        lines.push('## Carried, but not checked', '', 'Tewip passes these to the model when it writes or fixes something, and quotes them in reports. It', 'cannot verify them, and it will never report them as kept.', '', ...carrying.map((s) => {
+            const words = s.guidance.trim().split(/\s+/).length;
+            const also = s.rules.length > 0 ? ` (alongside its ${s.rules.length} enforced rule${s.rules.length === 1 ? '' : 's'})` : '';
+            return `- **${s.name}**${s.description ? ` — ${s.description}` : ''}: ${words} word(s) of guidance${also}`;
+        }), '');
     }
     const unusable = standards.filter((s) => s.unusable);
     if (unusable.length > 0) {

package/dist/engine/standards/standards.js

@@ -6,8 +6,16 @@
  * unusable rather than silently ignored - a rule nobody is enforcing is worse than no rule, because
  * somebody believes in it.
  */
-export function readStandard(file, text) {
+export function readStandard(file, rawText) {
     const name = file.split(/[\\/]/).pop()?.replace(/\.md$/i, '') ?? file;
+    // A leading byte-order mark, which Notepad, Visual Studio and PowerShell's `Set-Content -Encoding
+    // utf8` all write by default on Windows. Three invisible bytes before `---` stop the front matter
+    // matching, so **every enforced rule in the file silently becomes prose** and the report says
+    // "0 with rules Tewip can check" without once mentioning why. Found by accident: this project's own
+    // standards file was rewritten by a PowerShell command and four working rules stopped being
+    // enforced with no error anywhere. For a team on Windows that is total, silent rule loss - the
+    // exact thing `unusable` exists to prevent, happening in the one place it could not report.
+    const text = rawText.replace(/^/, '');
     const front = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
     const body = front ? text.slice(front[0].length).trim() : text.trim();
     const standard = { name, description: '', appliesTo: [], rules: [], guidance: body, unusable: '' };
@@ -40,7 +48,12 @@ export function readStandard(file, text) {
         standard.description = firstLine(body);
     return standard;
 }
-/** `forbid: /waitForTimeout/ in tests because a fixed wait hides a race` */
+/**
+ * `forbid: /waitForTimeout/ in tests because a fixed wait hides a race`
+ *
+ * The `in` clause may carry an exception: `in engine/ not -command.ts`. Everything before `not` is
+ * where the rule applies, everything after it is where it does not.
+ */
 function parseRule(kind, value, scope) {
     const shape = /^\/(.+?)\/([a-z]*)\s*(?:\bin\s+([^]*?))?\s*(?:\bbecause\s+([^]*))?$/i.exec(value.trim());
     if (!shape)
@@ -51,10 +64,12 @@ function parseRule(kind, value, scope) {
     catch {
         return null;
     }
+    const [inside, outside] = (shape[3] ?? '').split(/\bnot\b/);
     return {
         kind,
         pattern: shape[2] ? `/${shape[1]}/${shape[2]}` : shape[1],
-        where: shape[3] ? list(shape[3]) : scope,
+        where: inside && inside.trim() ? list(inside) : scope,
+        except: outside ? list(outside) : [],
         because: (shape[4] ?? '').trim(),
     };
 }
@@ -92,7 +107,11 @@ export function check(standards, file, text) {
         if (!covers(standard.appliesTo, file))
             continue;
         for (const rule of standard.rules) {
-            if (!covers(rule.where, file))
+            // `covers([])` is deliberately true - an empty scope means everything - so an exception has to
+            // be checked for existence first. Written the short way, `|| covers(rule.except, file)`, every
+            // rule with no exception is skipped and the report says nothing broke: a clean answer produced
+            // by a bug, which is the exact shape this project keeps finding.
+            if (!covers(rule.where, file) || (rule.except.length > 0 && covers(rule.except, file)))
                 continue;
             let pattern;
             try {

package/dist/reporters/store.js

@@ -7,6 +7,19 @@ export const DATA_DIR = join(PROJECT_ROOT, 'data');
 const COLLECT_DIR = process.env.TRIAGE_DATA_DIR ? resolve(PROJECT_ROOT, process.env.TRIAGE_DATA_DIR) : DATA_DIR;
 export const TRIAGE_FILE = join(COLLECT_DIR, 'triage.jsonl');
 export const RUNS_FILE = join(COLLECT_DIR, 'runs.jsonl');
+/**
+ * A file a person wrote, read as text, without the byte-order mark Windows editors put in front.
+ *
+ * Notepad, Visual Studio and PowerShell's `Set-Content -Encoding utf8` all write three invisible
+ * bytes before the first character. Nothing downstream expects them: a standards file stops being
+ * enforced because `/^---/` no longer matches, and the first line of an accepted-findings list stops
+ * matching the finding it was written to accept - so a judged finding comes back and keeps coming
+ * back, with nothing anywhere saying why. Every file this project reads **because a person wrote it
+ * by hand** goes through here.
+ */
+export function readHandWritten(file) {
+    return readFileSync(file, 'utf8').replace(/^\uFEFF/, '');
+}
 export function appendJsonl(file, rows) {
     if (rows.length === 0)
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.69.7",
+  "version": "0.69.9",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [