tewip-ai 0.69.9 → 0.70.0

package/dist/engine/access/render.js

@@ -48,7 +48,16 @@ function section(title, findings, lines) {
     }
 }
 export function renderAccess(result, scanned) {
-    const { barriers, questions, accepted, filesRead, browser } = result;
+    // A missing list means an empty one. `accepted` and the browser run's own lists were read
+    // straight off the object, so a caller that left one out got
+    // `TypeError: Cannot read properties of undefined (reading 'length')` from the renderer rather
+    // than a report - and this is an exported function the MCP tool also calls. It happened twice in
+    // one hour during Phase 68, and the test that pins it was written by `tewip incident` from the
+    // real stack trace of the second time.
+    const { barriers = [], questions = [], accepted = [], filesRead = 0 } = result;
+    const browser = result.browser
+        ? { ...result.browser, barriers: result.browser.barriers ?? [], questions: result.browser.questions ?? [], advice: result.browser.advice ?? [], superseded: result.browser.superseded ?? [] }
+        : result.browser;
     const lines = ['# Tewip accessibility check', ''];
     lines.push(`Read ${filesRead} markup ${filesRead === 1 ? 'file' : 'files'} under \`${scanned}\`, without rendering any of them.`, '');
     if (browser) {

package/dist/engine/attest/attest-command.js

@@ -14,7 +14,9 @@ export function verifyAttestation(file, keyFile) {
     const bundle = JSON.parse(readFileSync(resolve(file), 'utf8'));
     const publicKey = keyFile ? readFileSync(resolve(keyFile), 'utf8') : undefined;
     const checked = check(bundle, publicKey);
-    const ok = checked.contentMatches && checked.signature !== 'invalid';
+    // 'stripped' counts as a failure: the caller supplied a key, so it asked who made this, and a
+    // bundle with no signature cannot answer. See `check` in seal.ts for the attack that exposed it.
+    const ok = checked.contentMatches && checked.signature !== 'invalid' && checked.signature !== 'stripped';
     const report = [
         `# ${ok ? 'Checked' : 'Do not trust this bundle'}: ${file.split(/[\/]/).pop()}`,
         '',

package/dist/engine/attest/seal.js

@@ -20,18 +20,24 @@ import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, veri
  * different bundle.
  */
 export function canonical(bundle) {
-    const ordered = (value) => {
+    // The seal is left out of its own digest, which it has to be - but only the **top-level** one.
+    // The filter used to apply at every depth, so any field named `seal` anywhere inside the bundle
+    // was invisible to the digest: content could be added under `claims[0].seal` without changing the
+    // digest or invalidating the signature over it. Nothing reads such a field today, which is why
+    // this is small rather than serious; the claim being made is that the digest covers the content,
+    // and a digest with a hole in it is not that claim.
+    const ordered = (value, top = false) => {
         if (Array.isArray(value))
-            return value.map(ordered);
+            return value.map((v) => ordered(v));
         if (value && typeof value === 'object') {
             return Object.fromEntries(Object.entries(value)
-                .filter(([k]) => k !== 'seal')
+                .filter(([k]) => !(top && k === 'seal'))
                 .sort(([a], [b]) => a.localeCompare(b))
                 .map(([k, v]) => [k, ordered(v)]));
         }
         return value;
     };
-    return JSON.stringify(ordered(bundle));
+    return JSON.stringify(ordered(bundle, true));
 }
 export const digestOf = (bundle) => createHash('sha256').update(canonical(bundle)).digest('hex');
 /**
@@ -65,10 +71,27 @@ export function check(bundle, publicKeyPem) {
         return { contentMatches: false, signature: bundle.seal?.signature ? 'invalid' : 'absent', says: 'the content does not match the digest recorded inside it: it has been changed since it was written' };
     }
     if (!bundle.seal?.signature) {
+        // A key was given, so authorship is what was asked about - and there is nothing here to answer
+        // with. This used to return the same pass as an unsigned bundle checked without a key, so:
+        // change a fact, erase the "what was not checked" list, delete the signature, recompute the
+        // digest, and `attest --verify bundle.json --key release.pem` printed "Content matches its
+        // digest: yes" and **exited 0**. Any gate scripted on it passed. Removing a signature is the
+        // oldest attack on one, and "there is nothing to check" is a failure to establish what was
+        // asked, not a pass.
+        if (publicKeyPem?.trim()) {
+            return {
+                contentMatches: true,
+                signature: 'stripped',
+                says: 'a public key was given but this bundle carries no signature, so who produced it cannot be established. ' +
+                    'The content does match the digest recorded inside it, and that is worth nothing here: anyone who edits a bundle can recompute its digest, which is exactly what removing the signature would look like',
+            };
+        }
         return {
             contentMatches: true,
             signature: 'absent',
-            says: 'the content matches its own digest, and nothing more: no signature was made, so this shows the bundle is undamaged, not that nobody edited it - an editor can recompute a digest',
+            // "no signature was made" asserted something about the bundle's history that cannot be known
+            // from the bundle: it may have been removed. What is observable is that it carries none.
+            says: 'the content matches its own digest, and nothing more: this bundle carries no signature, so this shows it is undamaged, not that nobody edited it - an editor can recompute a digest',
         };
     }
     if (!publicKeyPem?.trim()) {

package/dist/engine/incident/incident-command.js

@@ -11,7 +11,7 @@
 // never ran is reported as exactly that and the file is removed, because a test wrongly labelled
 // "reproduces the outage" is worse than no test: the next person will trust it.
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import { noModelHelp } from '../llm/providers.js';
 import { writerFromEnv } from '../quality/model.js';
 import { usageLine } from '../llm/usage.js';
@@ -54,6 +54,16 @@ function asScenario(incident) {
         expected: `it fails with ${[incident.errorType, incident.errorMessage].filter(Boolean).join(': ') || incident.title}. Write the test asserting the behaviour that SHOULD happen, so it is red now and green once the bug is fixed.`,
     };
 }
+/**
+ * How to import a source file from the folder the test will be written in.
+ *
+ * Always relative and always with a `./` or `../` in front, because a bare `access/render.ts` is a
+ * package specifier to Node, not a path.
+ */
+export function importPathFor(root, testDir, file) {
+    const path = relative(resolve(testDir), resolve(root, file)).split('\\').join('/');
+    return path.startsWith('.') ? path : `./${path}`;
+}
 export async function runIncident(cmd) {
     const incident = readIncident(readFileSync(resolve(cmd.file), 'utf8'));
     const framework = chooseFramework(detectFrameworks(cmd.root), cmd.framework, false);
@@ -69,7 +79,11 @@ export async function runIncident(cmd) {
     const fileName = framework.fileFor(`incident-${Date.now().toString(36)}`);
     const testFile = join(framework.testDir, fileName);
     mkdirSync(dirname(testFile), { recursive: true });
-    const draft = await draftTest(model, { framework, fileName, pages: [], feature: `A production incident: ${incident.title}`, code }, asScenario(incident));
+    // Each source file with the path to import it by from the test's own folder. Without this the
+    // model only had project-relative paths and every import it wrote was wrong for any framework
+    // whose test folder is not the project root.
+    const withImports = code.map((c) => ({ ...c, importPath: importPathFor(cmd.root, framework.testDir, c.file) }));
+    const draft = await draftTest(model, { framework, fileName, pages: [], feature: `A production incident: ${incident.title}`, code: withImports, testDir: relative(cmd.root, framework.testDir).split('\\').join('/') || '.' }, asScenario(incident));
     writeFileSync(testFile, draft.code, 'utf8');
     console.error('Wrote the test; running it now, because a test nobody ran proves nothing…');
     const run = runTest(framework, testFile);

package/dist/engine/incident/incident.js

@@ -1,18 +1,48 @@
 const LIBRARY = /[\\/](?:node_modules|site-packages|dist-packages|vendor|\.venv|venv|target[\\/]dependency|gems)[\\/]/;
 const RUNTIME = /^(?:node:|internal[\\/]|java\.|javax\.|sun\.|System\.|Microsoft\.)/;
 const ours = (file) => Boolean(file) && !LIBRARY.test(file) && !RUNTIME.test(file);
-const frame = (file, line, fn) => ({
-    file: String(file ?? '').replace(/\\/g, '/'),
-    line: Number(line) || 0,
-    fn: String(fn ?? ''),
-    ours: ours(String(file ?? '')),
-});
+/**
+ * A `file://` URL back into the path it names.
+ *
+ * Node has printed ESM stack frames as URLs since v12, and ESM is the default for every project with
+ * `"type": "module"` - which this one is. `file:///app/src/pay.ts` and `file:///C:/app/src/pay.ts`
+ * are what a real trace contains, and a path is what every later step needs.
+ */
+function asPath(file) {
+    const text = String(file ?? '').replace(/\\/g, '/');
+    if (!/^file:\/\//i.test(text))
+        return text;
+    const withoutScheme = text.replace(/^file:\/\/\/?/i, '');
+    // A Windows drive keeps its letter; everything else is rooted.
+    const path = /^[a-z]:/i.test(withoutScheme) ? withoutScheme : `/${withoutScheme}`;
+    try {
+        return decodeURIComponent(path);
+    }
+    catch {
+        return path; // a malformed escape is not a reason to lose the frame
+    }
+}
+const frame = (file, line, fn) => {
+    const path = asPath(file);
+    return { file: path, line: Number(line) || 0, fn: String(fn ?? ''), ours: ours(path) };
+};
 /** A stack trace as every language prints it, which is the fallback when there is no tool. */
 export function framesFromStack(stack) {
     const out = [];
     for (const line of stack.split('\n')) {
-        // JavaScript: "at handler (/app/src/pay.ts:42:9)" or "at /app/src/pay.ts:42:9"
-        const js = /^\s*at\s+(?:(?<fn>[^(]+?)\s+\()?(?<file>[^():]+?):(?<line>\d+):\d+\)?\s*$/.exec(line);
+        // JavaScript: "at handler (/app/src/pay.ts:42:9)" or "at /app/src/pay.ts:42:9", and - what a
+        // modern Node actually prints - "at handler (file:///C:/app/src/pay.ts:42:9)".
+        //
+        // The file group was `[^():]+?`: no colons allowed. A `file://` URL has one in the scheme and a
+        // Windows path has another in the drive letter, so **not one ESM frame could be read** - on any
+        // platform, in any project with `"type": "module"`, which is most of them and is this one. The
+        // command's whole premise is writing a test against the code the trace names, and it could not
+        // name the code. Found on a real trace from this repository: `incident` reported "it names no
+        // file inside this project" about `engine/access/render.ts:129`, which is in this project.
+        //
+        // The group now takes anything and the tail anchors it: `:digits:digits` at the end of the line
+        // is what makes a JavaScript frame, and a JVM frame has only one number so it still falls through.
+        const js = /^\s*at\s+(?:(?<fn>[^(]+?)\s+\()?(?<file>.+?):(?<line>\d+):\d+\)?\s*$/.exec(line);
         if (js?.groups) {
             out.push(frame(js.groups.file, js.groups.line, (js.groups.fn ?? '').trim()));
             continue;

package/dist/engine/quality/write.js

@@ -14,7 +14,8 @@ const RULES = `Rules:
 - Wait for conditions, never for fixed times.
 - Do not hard-code values that change as the app's content grows (counts, totals, dates, ids) unless the scenario is about that exact value: check their shape instead (a number of books, a date), so the test does not break the day a record is added.
 - One test file, complete, runnable as is, no placeholders. It must actually run here: Tewip runs it against the app now, and a skipped test proves nothing. A guard like the example's (skip where the app lacks something) is fine, as long as it does not skip here.
-- mutation.find must be an exact substring of your code that appears once, inside the main assertion (the value or condition it expects); mutation.replace is what to put there instead so that the test must fail if it is a real check. Keep the code valid: change an expected value, not the syntax.`;
+- mutation.find must be an exact substring of your code that appears once, inside the main assertion (the value or condition it expects); mutation.replace is what to put there instead so that the test must fail if it is a real check. Keep the code valid: change an expected value, not the syntax.
+- To import something from codeUnderTest, use that entry's importPath exactly as given. It is already relative to the folder the test will be written in (testWillBeWrittenIn); its \`file\` is relative to the project root and is there to tell you where the code lives, not how to import it.`;
 const DRAFT_SYSTEM = `You are Tewip's test writer, a senior SDET. Write one automated test for the scenario given.\n\n${RULES}`;
 const REPAIR_SYSTEM = `You are Tewip's test writer, a senior SDET. Your test failed when run against the working app. Read the real error and decide:
 - fault "test": the test is wrong (a locator, a wait, a wrong assumption about the page). Return the corrected full test.
@@ -44,6 +45,9 @@ function contextFor(ctx, scenario) {
         exampleTest: example,
         pages: ctx.pages.map((p) => ({ readAt: p.url, title: p.title, accessibilitySnapshot: p.aria })),
         codeUnderTest: ctx.code?.length ? ctx.code : undefined,
+        // Where the test file itself will sit, so a relative import can be written correctly rather
+        // than guessed from a project-relative path.
+        testWillBeWrittenIn: ctx.testDir || undefined,
         houseRules: ctx.houseRules || undefined,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.69.9",
+  "version": "0.70.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [