tewip-ai 0.70.14 → 0.70.16

package/README.md

@@ -1035,20 +1035,32 @@ import does not show.
 notice it, then run the **whole** suite to find out which tests really catch it. A failure is dropping a
 catching test.
 
-Re-derived on 2026-10-17 against a suite that had grown to 1,136 tests: **9 judged changes, 0 catching
-tests lost, 5.7% of the suite selected.** The harness refuses to report at all when it could not read
-which tests caught anything, because a selection cannot be shown safe by changes nothing was observed
-to catch.
-
-| Project | Judged cases | Catching test lost | Suite selected |
-| --- | --- | --- | --- |
-| This repository (node --test, 76 test files) | 8 | **0** | 7–9% |
-| expressjs/express (Mocha, 88 test files) | 2 | **0** | refused to narrow — every test reaches the change |
-
-Those two rows are the point. On a layered codebase it runs under a tenth of the suite and keeps every
-test that would have caught the bug; on a monolith where every test imports the package front door it says
-there is nothing to skip, rather than inventing a saving. It is also an MCP tool, so an agent can ask what
-to run before running anything.
+Re-derived on 2026-10-19 over ten modules against a suite of 1,288 tests, and redone from scratch
+because Phase 92 found the mutation engine could write something other than what it reported: **28
+real changes, 19 of them caught by the full suite and so able to judge a selection, 0 catching tests
+lost.** The other 9 were caught by nothing at all and are excluded rather than counted as successes -
+a selection cannot be shown safe by a change no test noticed.
+
+**The saving is not one number, and the 5.7% published before was not representative.** It depends on
+how central the changed file is, which is the truth about what your tests can reach rather than a
+weakness in the selection:
+
+| changed file | test files selected (of 101) | share |
+| --- | --- | --- |
+| `engine/release/channels.ts` | 4 | 4% |
+| `engine/flaky/flaky.ts`, `engine/perf/compare.ts` | 5 | 5% |
+| `engine/secure/secrets.ts` | 12 | 12% |
+| `engine/prove/mutants.ts` | 31 | 31% |
+| `engine/vouch/vouch.ts` | 44 | 44% |
+| `engine/schema/statements.ts` | 47 | 47% |
+| `engine/rules.ts`, `engine/import/junit.ts` | 52 | 52% |
+
+Average across the nineteen judged changes: **27.9%**. Change a leaf module and the run narrows to a
+twentieth of the suite; change the rule engine and half of it legitimately reaches the change. The
+earlier figure was measured on peripheral files and sat at the bottom of that range, which is the
+wrong number to plan a CI budget against. On a monolith where every test imports the package front
+door it says there is nothing to skip, rather than inventing a saving. It is also an MCP tool, so an
+agent can ask what to run before running anything.
 
 **In CI**, `mode: pick` runs before your tests and hands the workflow the files to run:
 
@@ -1276,6 +1288,40 @@ The first matching rule, in this order, decides the category. If a lower-priorit
 | `timing-flaky` | TIMING | the failure rate is 20%-80% over at least 3 runs, and the error message varies |
 | `real-bug-assertion` | REAL_BUG | a value mismatch on a test whose history is stable: it was clean before and has failed the same way since |
 
+### How often each rule is right
+
+Measured over the six labelled datasets with `node eval/calibration.ts`, rules only, no model. The
+`claimed` column is the confidence the rule prints beside its answer; `observed` is how often that
+answer matched a hand label. A rule that claims more than it delivers is the one kind of error this
+project will not keep.
+
+| rule | cases | right | observed | claimed | projects |
+|---|---|---|---|---|---|
+| `timing-retry-pass` | 1478 | 1463 | 99.0% | 0.74 | 6 |
+| `env-network` | 395 | 395 | 100.0% | 0.80 | 5 |
+| `env-server-error` | 43 | 43 | 100.0% | 0.60 | 5 |
+| `timing-intercepted` | 32 | 32 | 100.0% | 0.80 | 5 |
+| `real-bug-assertion` | 26 | 10 | 38.5% | 0.40 | 5 |
+| `locator-drift-strict` | 17 | 17 | 100.0% | 0.89 | 2 |
+| `timing-flaky` | 9 | 9 | 100.0% | 0.90 | 1 |
+| `test-data-collision` | 6 | 6 | 100.0% | 0.70 | 1 |
+| `locator-drift` | 5 | 3 | 60.0% | 0.80 | 2 |
+
+Every rule but two understates itself, which is safe and not free: the merge gate trusts 0.7 and
+auto-fix needs 0.85, so a rule right 395 times out of 395 while claiming 0.80 sends work to a person
+who did not need to see it.
+
+`real-bug-assertion` was the exception, and it is the rule that tells a team their application is
+broken. It claimed `0.65 + 0.05 x failingStreak`, up to 0.9, and was right 10 times in 26 - all 16
+misses a flaky test called a real bug. The streak term was not merely unearned but inverted: at a
+streak of 1 the rule is right 62.5% across five projects, and at 2 or more it is right none of ten.
+It now claims 0.40, which is how often it is right, and sits below both thresholds - in front of a
+person, where a two-in-five signal belongs. Nothing it decides changed: the rules layer answers the
+same 2,012 failures and gets the same 1,979 right.
+
+`locator-drift` at 60% is measured and left alone: five cases across two projects is not enough to
+move a number, and saying so is better than either ignoring it or inventing a fix.
+
 History is **point-in-time**: each failure is judged only with runs up to and including its own run, never later ones. A test's first-ever failure therefore has no history, and history-based rules decline it.
 
 ## Usage

package/dist/engine/prove/mutants.js

@@ -153,12 +153,28 @@ export function spread(all, limit) {
     const step = all.length / limit;
     return Array.from({ length: limit }, (unused, i) => all[Math.floor(i * step)]);
 }
-/** The file with this one mutant applied, ready to be written and then put back. */
+/**
+ * The file with this one mutant applied, ready to be written and then put back.
+ *
+ * The replacement is spliced in by index rather than through `String.replace`. With a string
+ * pattern, `replace` still reads `$$`, `$&`, `` $` `` and `$'` in the *replacement* as substitution
+ * patterns, so the text written to the file was not always the text the mutant said it was.
+ *
+ * Swept over 61,630 mutants across 3,696 real files from the corpus, 8 came out wrong, in three
+ * shapes: Leaflet's bundled `touch$$1` became `touch$1`, which is a different variable; and two of
+ * Saleor's workflow patterns, `'^\.github/workflows/e2e\.yml$'` and `'^[[:space:]]*$'`, lost their
+ * trailing `$'` to the "everything after the match" pattern.
+ *
+ * Eight in sixty thousand sounds like nothing until you read what it is: this is the one place
+ * Tewip writes to a file nobody asked it to touch, and it was reporting one change while making
+ * another. A mutant that mangles an identifier is not the mutant whose survival is being judged.
+ */
 export function applyMutant(text, mutant) {
     const lines = text.split(String.fromCharCode(10));
     const line = lines[mutant.line - 1];
     if (line === undefined || line.trim() !== mutant.was)
         throw new Error(`line ${mutant.line} is not what the mutant was made from, so nothing was written`);
-    lines[mutant.line - 1] = line.replace(mutant.was, mutant.now);
+    const at = line.indexOf(mutant.was);
+    lines[mutant.line - 1] = at < 0 ? line : `${line.slice(0, at)}${mutant.now}${line.slice(at + mutant.was.length)}`;
     return lines.join(String.fromCharCode(10));
 }

package/dist/engine/release/channels.js

@@ -0,0 +1,85 @@
+// Is every place Tewip is published actually carrying this release?
+//
+// There is a standing rule on this project: check every distribution channel after every
+// improvement, because a stale channel looks exactly like a current one. It was being done by hand,
+// and by hand it failed twice in one day - not because the check was skipped, but because the
+// question was wrong. The MCP registry was asked `?search=<name>&limit=100`, which returns a capped
+// version history and came back without the two newest releases in it. It answered with a version
+// number, the version number looked plausible, and it would have looked just as plausible if
+// nothing were wrong.
+//
+// So the verdict here has three values, not two. `unverified` is the whole point of the file: a
+// channel nobody could read is not a channel that is up to date, and must never be rendered as one.
+/** A gap younger than this is a release in flight, not a release that failed. */
+export const PATIENCE_HOURS = 12;
+/** Compares two dotted versions. Missing parts count as zero, so 0.70 is older than 0.70.1. */
+export function compareVersions(a, b) {
+    const parts = (v) => v.split('.').map((n) => Number.parseInt(n, 10) || 0);
+    const [x, y] = [parts(a), parts(b)];
+    for (let i = 0; i < Math.max(x.length, y.length); i++) {
+        const d = (x[i] ?? 0) - (y[i] ?? 0);
+        if (d !== 0)
+            return d < 0 ? -1 : 1;
+    }
+    return 0;
+}
+export function judge(reading) {
+    if (reading.actual === null) {
+        return {
+            ...reading,
+            verdict: 'unverified',
+            says: `could not be read${reading.problem ? `: ${reading.problem}` : ''}. This is not the same as being up to date - nothing here says whether ${reading.name} has ${reading.expected} or not.`,
+        };
+    }
+    const order = compareVersions(reading.actual, reading.expected);
+    if (order === 0)
+        return { ...reading, verdict: 'current', says: `has ${reading.actual}.` };
+    if (order < 0) {
+        const age = reading.ageHours;
+        // Unknown age is treated as old. Not knowing how long a channel has been behind is not a reason
+        // to assume it only just happened.
+        if (age !== null && age !== undefined && age < PATIENCE_HOURS) {
+            const how = age < 1 ? `${Math.max(1, Math.round(age * 60))} minute(s)` : `${age.toFixed(1)} hour(s)`;
+            return {
+                ...reading,
+                verdict: 'waiting',
+                says: `has ${reading.actual}; ${reading.expected} was cut ${how} ago and has not reached it yet. Normal this soon after a release - a problem if it is still true tomorrow.`,
+            };
+        }
+        const how = age === null || age === undefined ? '' : ` It has been ${age.toFixed(0)} hour(s).`;
+        return { ...reading, verdict: 'behind', says: `has ${reading.actual}, but this repository is at ${reading.expected}. The release did not reach it.${how}` };
+    }
+    // Ahead is not an error on its own: the editor extension keeps its own version line, and a
+    // channel can legitimately carry something this checkout has not caught up with.
+    return { ...reading, verdict: 'ahead', says: `has ${reading.actual}, which is newer than this checkout's ${reading.expected}.` };
+}
+const MARK = { current: 'ok', behind: 'BEHIND', waiting: 'waiting', ahead: 'ahead', unverified: 'UNVERIFIED' };
+/** The whole answer, written so the two states that need a person are impossible to skim past. */
+export function renderChannels(readings) {
+    const judged = readings.map(judge);
+    const width = Math.max(...judged.map((c) => c.name.length), 12);
+    const lines = ['Where Tewip is published', ''];
+    for (const c of judged)
+        lines.push(`  ${MARK[c.verdict].padEnd(11)} ${c.name.padEnd(width)}  ${c.says}`);
+    const behind = judged.filter((c) => c.verdict === 'behind');
+    const unverified = judged.filter((c) => c.verdict === 'unverified');
+    lines.push('');
+    if (behind.length > 0) {
+        lines.push(`${behind.length} channel(s) did not get this release: ${behind.map((c) => c.name).join(', ')}.`, '');
+    }
+    if (unverified.length > 0) {
+        // Named separately from `behind` on purpose. Folding the two together is how an unanswered
+        // query becomes a clean report.
+        lines.push(`${unverified.length} channel(s) could not be checked at all: ${unverified.map((c) => c.name).join(', ')}. Nothing above says whether those are current.`, '');
+    }
+    const waiting = judged.filter((c) => c.verdict === 'waiting');
+    if (waiting.length > 0) {
+        lines.push(`${waiting.length} channel(s) have not caught up with this release yet: ${waiting.map((c) => c.name).join(', ')}. Nothing is wrong unless this is still true tomorrow.`, '');
+    }
+    if (behind.length === 0 && unverified.length === 0 && waiting.length === 0)
+        lines.push('Every channel answered, and every one has this release.', '');
+    lines.push('How each was asked:');
+    for (const c of judged)
+        lines.push(`  ${c.name}: ${c.asked}`);
+    return { text: lines.join(String.fromCharCode(10)), behind: behind.length, unverified: unverified.length, waiting: waiting.length };
+}

package/dist/engine/rules.js

@@ -171,6 +171,37 @@ const envServerError = {
  * is what the streak conditions below are reading and what one CI run cannot supply. Re-derive with
  * `node eval/mismatch-precision.ts` before changing any of this.
  */
+/**
+ * How often this rule is right, measured rather than argued.
+ *
+ * It used to claim `0.65 + 0.05 * failingStreak`, up to 0.9, and across the six labelled datasets
+ * it was right 10 times out of 26 - the only overconfident rule in the set, and the one that tells
+ * a team their application is broken. All 16 misses were the same: a flaky test called a real bug,
+ * which is the failure the comment above this rule exists to warn about.
+ *
+ * The streak term was worse than unearned, it was inverted. Split by streak length:
+ *
+ *     streak 1    10/16   62.5%   across 5 projects
+ *     streak 2+    0/10    0.0%   across 1 project
+ *
+ * So the formula paid the most confidence exactly where the rule was never right. The streak is
+ * gone from the number rather than used to refuse those cases: 0 of 10 is ten failures from one
+ * project, and silencing a category on one project's data is how this rule got here. Lowering an
+ * overstated number is safe; suppressing findings on thin evidence is not.
+ *
+ * A third change was tried and taken back out. Requiring the test to have passed before - the
+ * condition `env-server-error` carries, and the rule was wrong all 3 times it fired without one -
+ * breaks the behaviour six importers deliberately test, that a wrong value failing every attempt in
+ * a single run is a real bug. Three cases is not enough to remove a designed answer, and Phase 64
+ * already recorded the cost of this rule declining too readily: `tewip bugs` filed one ticket out of
+ * 1,964 real failures. Lowering an overstated number is safe. Refusing to answer is not, and it was
+ * not earned.
+ *
+ * 0.40 is simply how often the rule is right: 10 of 26. It sits below the 0.7 the merge gate trusts
+ * and the 0.85 auto-fix needs, which is where a signal right two times in five belongs - in front of
+ * a person, which is what the report already calls it. Re-derive with `node eval/calibration.ts`.
+ */
+const REAL_BUG_ASSERTION_CONFIDENCE = 0.4;
 const realBugAssertion = {
     id: 'real-bug-assertion',
     evaluate({ record, history, loadFailedRequests }) {
@@ -196,7 +227,7 @@ const realBugAssertion = {
             : `failed all ${failingStreak} recorded runs with the same mismatch: ${values}`;
         return {
             category: 'REAL_BUG',
-            confidence: Math.min(0.9, 0.65 + 0.05 * failingStreak + (passesBeforeStreak >= 3 ? 0.05 : 0)),
+            confidence: REAL_BUG_ASSERTION_CONFIDENCE,
             evidence: [{ source: this.id, message, data: { ...mismatch, failingStreak, passesBeforeStreak } }],
         };
     },

package/dist/engine/schema/frameworks.js

@@ -1,5 +1,15 @@
 import { ALEMBIC, DJANGO, LARAVEL, RAILS } from './dialect-rules.js';
 import { EFCORE, KNEX, LIQUIBASE, SEQUELIZE } from './dialect-rules-node.js';
+/**
+ * Every way a knex migration declares its rollback.
+ *
+ * `exports.down =` is the CommonJS form the first three projects this was verified against all
+ * used - opencollective-api, Matterwiki and Coflnet. TypeScript projects do not write that, and
+ * nocodb writes `const down = async (knex) => {` in 236 of its 219 migration files (some declare
+ * more than one). Missing the declaration means the rollback is read as part of the change, and a
+ * migration that adds tables is reported as one that drops them.
+ */
+const KNEX_DOWN = /^\s*(?:export\s+)?(?:const|let|var)\s+down\s*=|^\s*(?:export\s+)?(?:async\s+)?function\s+down\s*\(|^\s*(?:module\.)?exports\.down\s*=/;
 export function dialectOf(file, text) {
     const path = file.split('\\').join('/').toLowerCase();
     if (path.endsWith('.sql'))
@@ -13,6 +23,17 @@ export function dialectOf(file, text) {
         return 'rails';
     if (/\bop\.(?:drop_column|add_column|create_index|alter_column|drop_table|rename_table|execute)\b/.test(text))
         return 'alembic';
+    // Kysely, which immich moved to from TypeORM. The DDL is raw SQL inside tagged template
+    // literals - await sql`ALTER TABLE ... DROP COLUMN ...`.execute(db) - so it is perfectly readable
+    // once the wrapper is recognised, exactly as it was for TypeORM.
+    //
+    // Before this, immich's 100 migrations were not reported as unreadable. They were not reported
+    // at all: migrationsUnder drops a file whose dialect is unknown, on the grounds that such a file
+    // is not a migration - which is right for a library module called helpers.rb and wrong for a
+    // whole dialect. The 37 files Tewip did find there were generated query files under src/queries,
+    // and the real migration that drops assets.isVisible and assets.isArchived was silent.
+    if (/from\s+['\"]kysely['\"]|\bKysely\s*</.test(text) && /\bsql`/.test(text))
+        return 'kysely';
     // TypeORM writes a migration as a class with up() and down(), and puts the real DDL in template
     // strings passed to queryRunner.query(). The SQL is right there and perfectly readable; only the
     // wrapper was unfamiliar, so every TypeORM project was told Tewip could not read its migrations
@@ -40,6 +61,10 @@ const BY_DIALECT = {
     rails: RAILS,
     alembic: ALEMBIC,
     typeorm: [],
+    // Neither has operations of its own: the whole migration is raw SQL, read by `readSql`. TypeORM
+    // hands it over through queryRunner.query(...), Kysely through a tagged template, and Kysely is
+    // routed straight to the SQL reader before this table is consulted.
+    kysely: [],
     sequelize: SEQUELIZE,
     knex: KNEX,
     efcore: EFCORE,
@@ -136,7 +161,13 @@ export function forwardOnly(dialect, text) {
             // ecosystems as dropping a column. Verified on real migrations from opencollective-api,
             // Matterwiki and Coflnet, all three of which have their only destructive call in down.
             (dialect === 'sequelize' && /^\s*down\s*:/.test(line)) ||
-            (dialect === 'knex' && /^\s*(?:exports\.down|module\.exports\.down)\s*=/.test(line)) ||
+            // Knex is declared four ways and the pattern only knew two of them. nocodb writes
+            // `const down = async (knex) => {` in 236 of its migrations and `exports.down` in none, so
+            // every rollback was read as part of the change: 122 findings, each one a dropTable in a
+            // `down` that undoes its own `up`, which is what a reversible migration is.
+            (dialect === 'knex' && KNEX_DOWN.test(line)) ||
+            // Kysely declares its rollback the same way: export async function down(db) {
+            (dialect === 'kysely' && /^\s*(?:export\s+)?(?:async\s+)?function\s+down\s*\(/.test(line)) ||
             (dialect === 'efcore' && /^\s*protected\s+override\s+void\s+Down\s*\(/.test(line)) ||
             // Laravel's rollback, which in real files often comes *before* up().
             (dialect === 'laravel' && /^\s*(?:public\s+)?function\s+down\s*\(/.test(line)) ||

package/dist/engine/schema/kept.js

@@ -0,0 +1,87 @@
+/**
+ * Tables this migration creates itself.
+ *
+ * A lock is only expensive because of the rows it holds up, and a table created three statements
+ * earlier has none. This matters enormously on the tools that generate their SQL: a Prisma project
+ * emits `CREATE TABLE` followed by an `ADD CONSTRAINT ... FOREIGN KEY` for every relation, so
+ * documenso's 165 real migrations produced 275 "blocks writes while it runs" findings - 1.7 per
+ * migration, nearly all of them about tables that did not exist a moment before. That is the volume
+ * at which a team stops reading the report, which costs more than the warnings are worth.
+ */
+function createdHere(text) {
+    const names = new Set();
+    // The frameworks say "create this table" in their own words, and the suppression is worth nothing
+    // in a dialect it cannot read. Only SQL was read, so bitwarden/server's 456 EF Core migrations -
+    // which do exactly what Prisma does, a CreateTable followed by a CreateIndex for every relation -
+    // produced 647 "blocks writes" findings about tables that had not existed a statement earlier.
+    // EF Core puts the name on the line after the call, so these have to reach across a newline.
+    const FRAMEWORK_CREATES = [
+        /migrationBuilder\s*\.\s*CreateTable\s*\([\s\S]{0,80}?name\s*:\s*["']([\w$.]+)["']/gi,
+        // Django names the model rather than the table, and so does its AddIndex, so the two match each
+        // other. Saleor never exercises this - Django convention puts CreateModel and AddIndex in
+        // separate migrations - but every other dialect here has its create form registered and this
+        // one did not, which is the kind of gap that waits for a project with different habits.
+        /migrations\s*\.\s*CreateModel\s*\([\s\S]{0,60}?name\s*=\s*["']([\w]+)["']/gi,
+        /queryInterface\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
+        /knex\s*\.\s*schema\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
+        /Schema\s*::\s*create\s*\(\s*["']([\w$.]+)["']/gi,
+        /\bcreate_table\s+[:'"]([\w$.]+)/gi,
+        /\bop\s*\.\s*create_table\s*\(\s*["']([\w$.]+)["']/gi,
+        /<createTable[^>]*tableName\s*=\s*["']([\w$.]+)["']/gi,
+    ];
+    for (const pattern of FRAMEWORK_CREATES)
+        for (const m of text.matchAll(pattern))
+            names.add(m[1].toLowerCase().replace(/^.*\./, ''));
+    // Every dialect's way of quoting a name, because the suppression is useless in the one that does
+    // not match. This read PostgreSQL's "quoted" form and plain names, and not SQL Server's
+    // [dbo].[Grant] - which is standard T-SQL and what bitwarden/server is written in throughout. No
+    // table was ever recognised as freshly created there, so every index built on a table created two
+    // statements earlier was reported as blocking writes: 714 findings, nearly all of them free.
+    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([\w$.\"\[\]`]+)/gi)) {
+        // `[dbo].[Grant]` and `"public"."grant"` and `grant` all have to arrive here as the same word,
+        // because that is the form the findings report a table in.
+        names.add(m[1].replace(/[\"\[\]`]/g, '').toLowerCase().replace(/^.*\./, ''));
+    }
+    return names;
+}
+/** Risks that are only risks because rows already exist. */
+const ONLY_HURTS_EXISTING_ROWS = new Set(['locks-writes', 'slow']);
+/**
+ * Tables that something is renamed *to* in this migration.
+ *
+ * SQLite cannot alter a column, so the way to change one is to build a new table, copy every row
+ * into it, drop the original and rename the copy into its place. TypeORM generates exactly that,
+ * automatically, for every column change on SQLite, and n8n's migrations are full of it:
+ *
+ *     CREATE TABLE temporary_credentials_entity (...)
+ *     INSERT INTO temporary_credentials_entity SELECT ... FROM credentials_entity
+ *     DROP TABLE credentials_entity
+ *     ALTER TABLE temporary_credentials_entity RENAME TO credentials_entity
+ *
+ * The drop is real and the table is gone for an instant, but nothing is lost: the rows were copied
+ * first and the name is given straight back. Calling that "drops the table credentials_entity and
+ * everything in it" is wrong, and it would be wrong on nearly every TypeORM migration ever
+ * generated for SQLite.
+ */
+function renamedInto(text) {
+    const names = new Set();
+    for (const m of text.matchAll(/\bRENAME\s+TO\s+([\w."'`$[\]{}]+)/gi)) {
+        names.add(m[1].replace(/\$\{[^}]*\}/g, '').replace(/["'`[\]]/g, '').toLowerCase().replace(/^.*\./, ''));
+    }
+    return names;
+}
+export function droppingWhatIsNew(findings, text) {
+    const fresh = createdHere(text);
+    const rebuilt = renamedInto(text);
+    if (fresh.size === 0 && rebuilt.size === 0)
+        return findings;
+    const nameOf = (f) => f.table.toLowerCase().replace(/^.*\./, '');
+    return findings.filter((f) => {
+        if (ONLY_HURTS_EXISTING_ROWS.has(f.risk) && fresh.has(nameOf(f)))
+            return false;
+        // A table dropped and immediately given its name back by a rename is a rebuild, not a loss.
+        if (f.risk === 'destroys-data' && rebuilt.has(nameOf(f)))
+            return false;
+        return true;
+    });
+}

package/dist/engine/schema/migration-files.js

@@ -15,14 +15,37 @@ import { join, relative } from 'node:path';
 // is mostly documentation teaches the reader to skip the list.
 //
 // So the directory decides *where*, and the extension decides *whether it could hold DDL at all*.
-const MIGRATION_DIR = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|flyway|changelogs?|sql)\//i;
+// `versions` is Alembic's revision directory in every configuration it has - `alembic/versions`,
+// `migrations/versions`, or whatever `script_location` points at. Netflix/dispatch keeps 162 of them
+// under `src/dispatch/database/revisions/<name>/versions/`, where neither `alembic` nor `migrations`
+// appears in the path, and Tewip found two files in that repository - both `.sql`, one of them a
+// search-expressions file that is not a migration at all. A project with 162 migrations was read as
+// a project with none of them.
+//
+// Letting the directory through costs little, because `dialectOf` still has to find `op.drop_column`
+// or its siblings before anything is read as a migration - the same argument that lets a
+// release-notes CHANGELOG.xml through below.
+const MIGRATION_DIR = /(^|\/)(migrations?|migration|db\/migrate|prisma\/migrations|alembic|versions|flyway|changelogs?|sql)\//i;
 const COULD_HOLD_DDL = /\.(sql|py|rb|js|mjs|cjs|ts|php|cs|xml|ya?ml|json|go|exs?)$/i;
 // Flyway's Java migrations are real, and they are named the way Flyway requires: `V2__add_index.java`
 // or `R__rebuild_views.java`. Keycloak's `MigrateTo12_0_0.java` is not one. Taking `.java` on the
 // strength of its directory alone is what filled that list with source files.
 const FLYWAY_JAVA = /(^|\/)[VR][\w.]*__[\w.-]+\.(java|kt|scala)$/;
+/**
+ * Directories whose SQL is a fixture, not something anybody deploys.
+ *
+ * `SCHEMA_FILE` takes any `.sql` file anywhere, because a migration really can sit outside a
+ * directory that says so. nocodb ships the Sakila sample database for its tests, and eleven of
+ * those dumps - `mysql-sakila-drop-objects.sql`, `oracle-sakila-delete-data.sql` and the rest -
+ * were read as migrations that destroy data. They were 102 of the 106 findings in that repository,
+ * and not one of them will ever run against a live database.
+ *
+ * This command answers what a migration will do to a running system, so a file under `tests` is
+ * out of scope by the question's own definition.
+ */
+const FIXTURE_DIR = /(^|\/)(tests?|__tests__|specs?|fixtures?|testdata|mocks?)\//i;
 export const MIGRATION = {
-    test: (path) => MIGRATION_DIR.test(path) && (COULD_HOLD_DDL.test(path) || FLYWAY_JAVA.test(path)),
+    test: (path) => !FIXTURE_DIR.test(path) && MIGRATION_DIR.test(path) && (COULD_HOLD_DDL.test(path) || FLYWAY_JAVA.test(path)),
 };
 // A changelog is often not in a directory that says so. OpenMRS keeps 44 Liquibase changelogs in
 // `api/src/main/resources/` named `liquibase-*.xml`, and the path filter saw none of them - so a
@@ -34,7 +57,8 @@ export const MIGRATION = {
 // project has more than one database. Letting a release-notes `CHANGELOG.xml` through costs nothing,
 // because `dialectOf` still has to find `<databaseChangeLog` in it before it is read as a migration.
 export const NAMED_MIGRATION = /(^|\/)[\w.-]*(liquibase|changelog)[\w.-]*\.(xml|ya?ml|json)$/i;
-export const SCHEMA_FILE = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate)\/.*\.(py|rb|js|ts|php|cs)$/i;
+const SCHEMA_PATH = /\.(sql)$|(^|\/)(migrations?|migration|db\/migrate|versions)\/.*\.(py|rb|js|ts|php|cs)$/i;
+export const SCHEMA_FILE = { test: (path) => !FIXTURE_DIR.test(path) && SCHEMA_PATH.test(path) };
 /**
  * Every migration in a whole repository, by the same filters a diff is read through.
  *

package/dist/engine/schema/schema-command.js

@@ -13,9 +13,11 @@ import { normalise } from '../quality/source-text.js';
 import { dirname, resolve } from 'node:path';
 import { changeSummary } from '../quality/grounding.js';
 import { dialectOf, forwardOnly, irreversible, readFramework } from './frameworks.js';
+import { droppingWhatIsNew } from './kept.js';
 import { readSql } from './statements.js';
 import { MIGRATION, NAMED_MIGRATION, SCHEMA_FILE, migrationsUnder } from './migration-files.js';
 export { migrationsUnder };
+export { droppingWhatIsNew };
 /** The schema files in this change. */
 export function schemaFiles(cmd) {
     const named = cmd.files !== undefined && cmd.files.length > 0;
@@ -27,60 +29,6 @@ export function schemaFiles(cmd) {
         // sitting outside a migrations/ directory was being answered with "no migration in this change".
         .filter((f) => (named || SCHEMA_FILE.test(f) || MIGRATION.test(f) || NAMED_MIGRATION.test(f)) && existsSync(resolve(cmd.root, f)));
 }
-/**
- * Tables this migration creates itself.
- *
- * A lock is only expensive because of the rows it holds up, and a table created three statements
- * earlier has none. This matters enormously on the tools that generate their SQL: a Prisma project
- * emits `CREATE TABLE` followed by an `ADD CONSTRAINT ... FOREIGN KEY` for every relation, so
- * documenso's 165 real migrations produced 275 "blocks writes while it runs" findings - 1.7 per
- * migration, nearly all of them about tables that did not exist a moment before. That is the volume
- * at which a team stops reading the report, which costs more than the warnings are worth.
- */
-function createdHere(text) {
-    const names = new Set();
-    // The frameworks say "create this table" in their own words, and the suppression is worth nothing
-    // in a dialect it cannot read. Only SQL was read, so bitwarden/server's 456 EF Core migrations -
-    // which do exactly what Prisma does, a CreateTable followed by a CreateIndex for every relation -
-    // produced 647 "blocks writes" findings about tables that had not existed a statement earlier.
-    // EF Core puts the name on the line after the call, so these have to reach across a newline.
-    const FRAMEWORK_CREATES = [
-        /migrationBuilder\s*\.\s*CreateTable\s*\([\s\S]{0,80}?name\s*:\s*["']([\w$.]+)["']/gi,
-        // Django names the model rather than the table, and so does its AddIndex, so the two match each
-        // other. Saleor never exercises this - Django convention puts CreateModel and AddIndex in
-        // separate migrations - but every other dialect here has its create form registered and this
-        // one did not, which is the kind of gap that waits for a project with different habits.
-        /migrations\s*\.\s*CreateModel\s*\([\s\S]{0,60}?name\s*=\s*["']([\w]+)["']/gi,
-        /queryInterface\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
-        /knex\s*\.\s*schema\s*\.\s*createTable\s*\(\s*["']([\w$.]+)["']/gi,
-        /Schema\s*::\s*create\s*\(\s*["']([\w$.]+)["']/gi,
-        /\bcreate_table\s+[:'"]([\w$.]+)/gi,
-        /\bop\s*\.\s*create_table\s*\(\s*["']([\w$.]+)["']/gi,
-        /<createTable[^>]*tableName\s*=\s*["']([\w$.]+)["']/gi,
-    ];
-    for (const pattern of FRAMEWORK_CREATES)
-        for (const m of text.matchAll(pattern))
-            names.add(m[1].toLowerCase().replace(/^.*\./, ''));
-    // Every dialect's way of quoting a name, because the suppression is useless in the one that does
-    // not match. This read PostgreSQL's "quoted" form and plain names, and not SQL Server's
-    // [dbo].[Grant] - which is standard T-SQL and what bitwarden/server is written in throughout. No
-    // table was ever recognised as freshly created there, so every index built on a table created two
-    // statements earlier was reported as blocking writes: 714 findings, nearly all of them free.
-    for (const m of text.matchAll(/\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([\w$.\"\[\]`]+)/gi)) {
-        // `[dbo].[Grant]` and `"public"."grant"` and `grant` all have to arrive here as the same word,
-        // because that is the form the findings report a table in.
-        names.add(m[1].replace(/[\"\[\]`]/g, '').toLowerCase().replace(/^.*\./, ''));
-    }
-    return names;
-}
-/** Risks that are only risks because rows already exist. */
-const ONLY_HURTS_EXISTING_ROWS = new Set(['locks-writes', 'slow']);
-export function droppingWhatIsNew(findings, text) {
-    const fresh = createdHere(text);
-    if (fresh.size === 0)
-        return findings;
-    return findings.filter((f) => !(ONLY_HURTS_EXISTING_ROWS.has(f.risk) && fresh.has(f.table.toLowerCase().replace(/^.*\./, ''))));
-}
 export function readMigration(root, file) {
     let text = '';
     try {
@@ -93,14 +41,16 @@ export function readMigration(root, file) {
     // Only the forward path: a rollback step contains the mirror image of the change, and reading it as
     // part of the change says a migration that creates a table destroys one.
     const forward = forwardOnly(dialect, text);
-    if (dialect === 'sql')
+    // Kysely's DDL is raw SQL in a template literal, so once the rollback is removed the same
+    // reader that handles a .sql file handles it.
+    if (dialect === 'sql' || dialect === 'kysely')
         return { file, dialect, findings: droppingWhatIsNew(readSql(forward), forward), unread: '', irreversible: false };
     if (dialect === 'unknown') {
         return {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Laravel, EF Core and Liquibase migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, Kysely, Laravel, EF Core and Liquibase migrations',
             irreversible: false,
         };
     }

package/dist/engine/schema/statements.js

@@ -1,5 +1,13 @@
 const CLEAN = (s) => s.replace(/\s+/g, ' ').trim();
-const NAME = String.raw `[\w."\[\]` + "`" + String.raw `]+`;
+// A table name as it is written, including a JavaScript template interpolation.
+//
+// n8n prefixes every table through `${tablePrefix}`, and without the interpolation in here two
+// things went wrong on its 106 TypeORM migrations. `DROP TABLE IF EXISTS ${tablePrefix}x`
+// backtracked past the optional IF EXISTS and matched `IF`, so Tewip reported "drops the table IF".
+// `DROP TABLE "${tablePrefix}x"` matched the opening quote alone, which `bare` then stripped to
+// nothing, so Tewip reported "drops the table  and everything in it" with a hole where the name
+// should be. Both are worse than saying nothing: a reader cannot check either of them.
+const NAME = String.raw `(?:\$\{[^}]*\}|[\w."\[\]` + "`" + String.raw `])+`;
 /**
  * What a statement does. Ordered: the first rule that matches decides, so the most serious reading of a
  * statement wins over a milder one.
@@ -114,7 +122,40 @@ const RULES = [
     },
 ];
 /** `"users"` and `` `users` `` and `[users]` are all the table users. */
-const bare = (name) => name.replace(/["`[\]]/g, '').trim();
+/**
+ * The name without its quoting, and without the prefix expression a project may wrap it in.
+ *
+ * `${tablePrefix}credentials_entity` is reported as `credentials_entity`, the name a reader will
+ * recognise and search for: the prefix is configuration, identical for every table in the
+ * migration, and carrying it through only makes every finding harder to read.
+ *
+ * Three things real projects do that this has to survive, all found on n8n and immich:
+ *
+ * A name that is nothing but the expression. `ALTER TABLE ${tempInsightsRawTable} RENAME TO
+ * ${insightsRawTable}` leaves nothing once the interpolation is stripped, which read as "renames
+ * the table  to ". A finding with a hole where the name belongs cannot be checked by the person
+ * reading it, so when nothing survives, the expression is the name.
+ *
+ * A name that ends the template. NAME accepts a backtick because MySQL quotes with one, so in
+ * sql`truncate ${sql.table('ocr_search')}`.execute(db) it ran straight past the closing backtick
+ * and reported "empties the table execute". The template ends where its backtick is.
+ *
+ * And a builder call that names the table inside the expression. `sql.table('ocr_search')` says
+ * which table plainly, and quoting the whole expression back at the reader when the answer is
+ * right there would be needlessly unhelpful.
+ */
+const bare = (name) => {
+    const inTemplate = name.includes('${') ? name.split('`')[0] : name;
+    const named = /\$\{[^}]*\(\s*['"]([\w.$]+)['"]/.exec(inTemplate);
+    if (named)
+        return named[1];
+    const unquoted = inTemplate.replace(/["`[\]]/g, '').trim();
+    const withoutPrefix = unquoted
+        .replace(/\$\{[^}]*\}/g, '')
+        .replace(/^\.+|\.+$/g, '')
+        .trim();
+    return withoutPrefix || unquoted;
+};
 /** The statements of a SQL file, with the line each one starts on and comments removed. */
 export function statementsOf(sql) {
     // Comments are blanked rather than removed, so every remaining character keeps its original position

package/dist/engine/secure/secrets.js

@@ -71,10 +71,74 @@ const DOC_FILE = /(?:^|[\\/])(?:\.env\.example|\.env\.sample|\.env\.template|[^\
  * there is, and a key pasted into an example file by accident is one of the commonest ways
  * credentials leak. That case is now shown as a template finding instead of being dismissed.
  */
-export function looksPlanted(value, line, file, before = '') {
+/**
+ * A URL-shaped credential whose destination cannot be a real system, or whose user and password
+ * are the same word.
+ *
+ * A credential matters because it is a way in to something. `postgres://saleor:saleor@localhost`
+ * is a way in to the machine it is already running on, and `user:password@example.com` points at
+ * a domain reserved by RFC 2606 precisely so that it cannot be anybody's system.
+ *
+ * Measured on Saleor at its pinned commit: six findings were reported as needing someone now, at
+ * high severity, each telling the team to "revoke it at the issuer first". Three were the Django
+ * local-development default in settings.py, one of them on a commented-out line, and the evidence
+ * offered was that the value "has the randomness of a real credential" - about the word `saleor`.
+ *
+ * Nothing is dropped. The finding becomes a placeholder finding, shown as noise with its reason
+ * attached. Suppressing a real secret is far worse than reporting a false one, so the two tests
+ * are narrow: a destination that provably reaches nobody, and a password identical to its own
+ * username, which nobody chooses for a credential that guards anything.
+ */
+/** Domains that exist so they cannot be anybody's system (RFC 2606, RFC 6761). */
+const RESERVED = /^(?:[\w-]+\.)*example\.(?:com|org|net)$|\.(?:invalid|test|localhost|local)$/i;
+/** Addresses that only ever mean the machine the code is running on. */
+const THIS_MACHINE = /^(?:localhost|127\.0\.0\.1|\[?::1\]?|0\.0\.0\.0)$/i;
+const CREDENTIALLED_URL = /[a-z][a-z0-9+.-]*:\/\/([^:/\s'\"]+):([^@\s'\"]+)@([^/\s'\"?#]+)/gi;
+/**
+ * A credential whose destination is the machine it runs on.
+ *
+ * This is deliberately not treated as a placeholder. A hardcoded password in settings.py is a real
+ * string that a person should see - an earlier phase decided exactly that, about this exact case -
+ * and calling it noise would hide it. What was wrong was only the urgency: Saleor's Django default
+ * was reported as needing someone now, at high severity, told to "revoke it at the issuer first".
+ * There is no issuer. It belongs in "real, but not reachable", which is the bucket for something
+ * true of the repository and not of what it runs.
+ */
+export function credentialGoesNowhere(value, line) {
+    for (const [, , password, hostport] of [...value.matchAll(CREDENTIALLED_URL), ...[...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value)]) {
+        if (password !== value && !value.includes(password))
+            continue;
+        const host = hostport.replace(/:\d+$/, '');
+        if (THIS_MACHINE.test(host))
+            return `the URL points at ${host}, so it reaches only the machine it runs on`;
+    }
+    return null;
+}
+export function urlCredentialIsHarmless(value, line) {
+    // The URL rules capture the whole URL as the value, not the password inside it - which is also
+    // why these pass the entropy gate at all, and why the report offered "the randomness of a real
+    // credential (3.82 bits per character)" as evidence about a string that is mostly the word
+    // `postgres` and a hostname. So the value is read as a URL first, and only then looked for inside
+    // the line, which is how the patterns that do capture a bare password arrive here.
+    const inValue = [...value.matchAll(CREDENTIALLED_URL)];
+    const inLine = [...line.matchAll(CREDENTIALLED_URL)].filter((m) => m[2] === value);
+    for (const [, user, password, hostport] of [...inValue, ...inLine]) {
+        const host = hostport.replace(/:\d+$/, '');
+        if (RESERVED.test(host))
+            return `the URL points at ${host}, a domain reserved so that it cannot be anybody's system`;
+        if (user.toLowerCase() === password.toLowerCase())
+            return 'the user and the password are the same word, which is a stand-in rather than a credential';
+    }
+    return null;
+}
+export function looksPlanted(value, line, file, before = '', whole = value) {
     if (PLACEHOLDER_WORDS.test(value))
         return 'the value itself says it is an example';
-    if (PLACEHOLDER_WORDS.test(line))
+    // Only the words *around* the credential are commentary about it. A hostname or a database name
+    // inside the URL is part of the credential: a real password at db.acme-prod.example-corp.io was
+    // dismissed because "example" was in the line, and it was in the line because it was in the host.
+    const around = line.split(whole).join(' ');
+    if (PLACEHOLDER_WORDS.test(around))
         return 'the line around it says it is an example';
     // JSON and YAML put the key on its own line when the value is long, and an OpenAPI schema is all
     // long values. nocodb declares `"example":` and then the token underneath it, so reading only the
@@ -83,6 +147,9 @@ export function looksPlanted(value, line, file, before = '') {
         return 'the key above it says it is an example';
     if (/(.)\1{5,}/.test(value))
         return 'the value repeats one character, so it is a stand-in';
+    const harmless = urlCredentialIsHarmless(value, line);
+    if (harmless)
+        return harmless;
     return null;
 }
 /** True when only the file's name suggests a template, whatever the value itself looks like. */
@@ -150,7 +217,16 @@ export function scanSecrets(root, files = sourceFiles(root)) {
         for (const { kind, what, re, minEntropy } of PATTERNS) {
             for (const match of text.matchAll(re)) {
                 const value = match[1];
-                const entropy = entropyOf(value);
+                // Where a pattern captures the credential separately, that is what gets judged. The two
+                // URL rules capture the whole URL first and the password second, and judging the URL meant
+                // a hostname or a database name decided whether a password was real: a genuine credential
+                // at db.acme-prod.example-corp.io was dismissed because its host contains "example", and
+                // any connection string to a database called sample or demo would go the same way.
+                // Suppressing a real secret is the worst thing this scanner can do, and it was one word in
+                // an unrelated part of the string away. The whole match is still what gets redacted, so
+                // nothing of the URL is printed either way.
+                const secret = match[2] ?? value;
+                const entropy = entropyOf(secret);
                 if (entropy < (minEntropy ?? 3))
                     continue;
                 const index = match.index ?? 0;
@@ -170,7 +246,8 @@ export function scanSecrets(root, files = sourceFiles(root)) {
                     line,
                     evidence: redact(lines[line - 1] ?? '', value),
                     entropy: Number(entropy.toFixed(2)),
-                    placeholder: looksPlanted(value, lines[line - 1] ?? '', rel, lines[line - 2] ?? ''),
+                    placeholder: looksPlanted(secret, lines[line - 1] ?? '', rel, lines[line - 2] ?? '', value),
+                    localOnly: credentialGoesNowhere(value, lines[line - 1] ?? ''),
                     template: inATemplate(rel),
                 });
             }

package/dist/engine/secure/triage.js

@@ -63,6 +63,15 @@ export function triageSecret(finding, root, accepted) {
     if (finding.placeholder) {
         return { ...base, verdict: 'noise', severity: 'low', why: `${finding.placeholder}: ${finding.evidence}`, next: 'nothing: this is not a credential' };
     }
+    if (finding.localOnly) {
+        return {
+            ...base,
+            verdict: 'not-reachable',
+            severity: 'low',
+            why: `${finding.evidence} - ${finding.localOnly}`,
+            next: 'nothing to revoke, because nothing outside this machine accepts it. Worth replacing with a value read from the environment, on a normal schedule.',
+        };
+    }
     if (finding.template) {
         // Only the file's name says this is a template; the value itself looks like a real credential.
         // Dismissing it would hide the commonest accident there is - a working key pasted into an

package/dist/engine/vouch/find-tests.js

@@ -4,7 +4,7 @@
 // added. tests-in.ts keeps the questions every language shares - which language is this, does it
 // look like tests at all, which parts of it are text rather than code - and this file holds the
 // four readers: callbacks (JavaScript), indentation (Python), `end` (Ruby), and braces (the rest).
-import { braced, isText, lineAt, textRanges } from './tests-in.js';
+import { bodyBrace, braced, isText, lineAt, textRanges } from './tests-in.js';
 /**
  * `it('...', async () => { ... })` and its many spellings, including `test.each`, `it.skip` and a
  * plain `function ()` callback. The body is taken by matching braces from the callback's opening one.
@@ -17,7 +17,7 @@ function jsTests(text) {
         const at = hit.index ?? 0;
         if (isText(ranges, at))
             continue;
-        const open = text.indexOf('{', at + hit[0].length);
+        const open = bodyBrace(text, at + hit[0].length);
         if (open === -1)
             continue;
         const body = braced(text, open);

package/dist/engine/vouch/tests-in.js

@@ -185,3 +185,35 @@ function closingQuote(text, from) {
     }
     return text.length;
 }
+/**
+ * Where a test's body actually starts.
+ *
+ * Taking the first `{` after the title is right until the callback destructures its argument:
+ *
+ *     it.each(components)('transforms $name', ({ name, className }) => {
+ *       expect(componentNameToClassName(name)).toBe(className)
+ *     })
+ *
+ * The first `{` there belongs to the parameter list, so the body read back was `{ name, className }`
+ * - which contains no assertion, and the test was reported as one only a crash could fail.
+ *
+ * Measured on alphagov/govuk-frontend, the UK government's design system and the first real
+ * JavaScript project this was ever pointed at: 21 accusations across 1,817 tests, and 19 of them
+ * were this. Nineteen correct tests told they check nothing.
+ *
+ * A brace is a parameter list when what follows its match is `)` and then an arrow or the body's
+ * own brace. Anything else is the body.
+ */
+export function bodyBrace(text, from) {
+    let open = text.indexOf('{', from);
+    for (let guard = 0; open !== -1 && guard < 4; guard += 1) {
+        const inside = braced(text, open);
+        if (inside === null)
+            return -1;
+        const after = text.slice(open + inside.length + 2, open + inside.length + 24);
+        if (!/^\s*\)\s*(=>|\{)/.test(after))
+            return open;
+        open = text.indexOf('{', open + inside.length + 2);
+    }
+    return open;
+}

package/dist/engine/vouch/text.js

@@ -2,14 +2,78 @@
 //
 // Split out in Phase 44 so that `swallowed.ts` could use them without importing the module that
 // imports it. Nothing here knows what a test is; they are string surgery and nothing more.
-/** Comments cannot assert, and a commented-out check is the classic way a test stops checking. */
+// Comments cannot assert, and a commented-out check is the classic way a test stops checking.
+//
+// Written with line comments rather than a block, because the example below contains the exact
+// character sequence that ends one - which is the whole point of the bug.
+//
+// This used to be a regex that replaced everything from a slash-star to the next star-slash, and a
+// regex cannot tell a comment from a string that happens to contain one. gin's TestParseAccept
+// parses an HTTP Accept header, and the media type `*/*` contains both sequences:
+//
+//     parts := parseAccept("text/html , application/xml;q=0.9,  */* ;q=0.8")
+//     assert.Len(t, parts, 4)
+//     assert.Equal(t, "text/html", parts[0])
+//     ...
+//     assert.Equal(t, "*/*", parts[3])
+//
+// A comment was opened inside the first string and closed in the last assertion. Everything
+// between - all five assertions - became a single space, and a thoroughly checked test was
+// reported as one that compares no value and only a crash could fail. Found on gin-gonic/gin, the
+// first real Go project this was ever pointed at.
+//
+// So the text is walked instead, and a quoted string is skipped whole - which is what the rules
+// above already assumed: "Strings are blanked as well as comments".
 export function withoutComments(body) {
-    return body
-        .replace(/\/\*[\s\S]*?\*\//g, ' ')
-        .split(String.fromCharCode(10))
-        .map((line) => line.replace(/(^|\s)\/\/.*$/, '').replace(/(^|\s)#(?!\{).*$/, ''))
-        .join(String.fromCharCode(10));
+    let out = '';
+    for (let i = 0; i < body.length; i += 1) {
+        const ch = body[i];
+        const next = body[i + 1] ?? '';
+        if (ch === '"' || ch === "'" || ch === '`') {
+            const end = endOfString(body, i);
+            out += body.slice(i, end + 1);
+            i = end;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const close = body.indexOf('*/', i + 2);
+            // An unclosed block comment runs to the end, which is what a compiler would do too.
+            out += ' ';
+            i = close === -1 ? body.length : close + 1;
+            continue;
+        }
+        const atLineStart = i === 0 || /\s/.test(body[i - 1] ?? '');
+        // `http://x` is not a comment, which is why the start of the line or a space is required.
+        if (ch === '/' && next === '/' && atLineStart) {
+            i = indexOrEnd(body, i) - 1;
+            continue;
+        }
+        if (ch === '#' && next !== '{' && atLineStart) {
+            i = indexOrEnd(body, i) - 1;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
 }
+/** Where the string opening at `from` ends, honouring backslash escapes. */
+function endOfString(text, from) {
+    const quote = text[from];
+    for (let i = from + 1; i < text.length; i += 1) {
+        if (text[i] === '\\') {
+            i += 1;
+            continue;
+        }
+        if (text[i] === quote)
+            return i;
+    }
+    return text.length - 1;
+}
+/** The newline at or after `from`, or the end of the text. */
+const indexOrEnd = (text, from) => {
+    const at = text.indexOf(String.fromCharCode(10), from);
+    return at === -1 ? text.length : at;
+};
 export const stripLines = (body, lines) => body
     .split(String.fromCharCode(10))
     .filter((line) => !lines.some((drop) => line.trim() === drop.trim()))

package/dist/engine/watch/watch-command.js

@@ -129,12 +129,24 @@ export function howToWriteAReport(root) {
         gradle: './gradlew test   (already writes XML to build/test-results)',
         playwright: 'npx playwright test --reporter=blob',
     };
-    const here = detectFrameworks(root)
-        .map((f) => JUNIT[f.id])
-        .filter((line, i, all) => Boolean(line) && all.indexOf(line) === i);
+    // Languages Tewip reads reports for but cannot run a suite in, so `detectFrameworks` - which
+    // exists to *run* tests - never names them. Without this, a Rust project was told to configure
+    // pytest, jest or dotnet, which is the exact advice the comment above calls the kind that gets a
+    // tool closed. Found by running `tewip watch` in BurntSushi/ripgrep.
+    const BY_MARKER = [
+        { file: 'Cargo.toml', line: 'cargo nextest run --profile ci   (with [profile.ci.junit] path = "report.xml" in .config/nextest.toml)' },
+        { file: 'composer.json', line: './vendor/bin/phpunit --log-junit report.xml' },
+        { file: 'Gemfile', line: 'bundle exec rspec --format RspecJunitFormatter --out report.xml   (needs the rspec_junit_formatter gem)' },
+    ];
+    const here = [
+        ...detectFrameworks(root).map((f) => JUNIT[f.id]),
+        ...BY_MARKER.filter((m) => existsSync(join(root, m.file))).map((m) => m.line),
+    ].filter((line, i, all) => Boolean(line) && all.indexOf(line) === i);
     const head = 'The tests failed but wrote no report Tewip can read.';
     if (here.length === 0) {
-        return `${head} Make the runner write JUnit XML (for example: pytest --junitxml=report.xml, jest --reporters=jest-junit, dotnet test --logger trx).`;
+        // Nothing here was recognised, so this is a list of examples and says so. Naming three runners
+        // as though they were this project's is how the advice went wrong in the first place.
+        return `${head} Tewip did not recognise the runner here, so it cannot name the command. Whatever you use, make it write JUnit XML - for example pytest --junitxml=report.xml, jest --reporters=jest-junit, or dotnet test --logger trx.`;
     }
     return [`${head} For the runner${here.length === 1 ? '' : 's'} this project has, that is:`, ...here.map((line) => `  ${line}`)].join(String.fromCharCode(10));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.70.14",
+  "version": "0.70.16",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [
@@ -65,6 +65,7 @@
     "prepack": "npm run build",
     "tewip": "node cli/tewip.ts",
     "version": "node scripts/sync-version.ts && git add server.json",
+    "channels": "node scripts/channels.ts",
     "corpus": "node scripts/corpus.ts"
   },
   "license": "Apache-2.0",