tewip-ai 0.72.0 → 0.73.0

package/dist/engine/vouch/assertions.js

@@ -14,6 +14,14 @@ const CHECKS = [
     /\bshould\s*\.\s*not\b/,
     /\bassert\b\s*[.(]/,
     /\bassert(Equals?|True|False|Null|NotNull|That|Throws|Match|Contains|Rejects|Fails)\b/i,
+    // Any call named assertSomething. The list above needs the suffix to end on a word boundary, so
+    // keycloak's own `assertNullAdditionalJdbcProperty(config, null, prop)` matched nothing: `Null` is
+    // followed by `A`. Four of its ConfigurationTest tests delegate to a helper built out of those
+    // calls, and the helper was being credited only because the *string* `--db-tls-mode=verify-server`
+    // happened to contain the word `verify` - so narrowing `verify` to a call turned four correct
+    // verdicts into accusations. The corpus caught it. A call named `assertX(` is the universal
+    // convention for a custom assertion, and reading it as one is both broader and the actual reason.
+    /\bassert[A-Z]\w*\s*\(/,
     /\.\s*to\s*\.\s*(equal|be|deep|have|include|throw|match|exist)\b/,
     /\btoMatch(Snapshot|InlineSnapshot|ImageSnapshot)\s*\(/,
     /\bexpect(Type|TypeOf)\s*[<(]/,

package/dist/engine/walk.js

@@ -7,7 +7,7 @@
 //
 // The cap now counts the files the caller actually wants. A budget spent on files the caller will
 // discard is not a budget.
-import { readdirSync, statSync } from 'node:fs';
+import { lstatSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 const SKIP_DIR = new Set(['node_modules', '.git', 'dist', 'build', 'out', 'coverage', 'target', 'vendor', '__pycache__', '.venv', 'venv', '.tewip', '.next', '.cache']);
 const BINARY = /\.(?:png|jpe?g|gif|webp|ico|svg|pdf|zip|gz|tar|exe|dll|so|dylib|woff2?|ttf|eot|mp4|mp3|wav|class|jar|pyc|lock)$/i;
@@ -39,11 +39,29 @@ export function scanSourceFiles(root, limit = 5000, keep) {
             const path = join(dir, entry);
             let info;
             try {
-                info = statSync(path);
+                // `lstat`, not `stat`: a symlink must be seen as a symlink. See below.
+                info = lstatSync(path);
             }
             catch {
                 continue;
             }
+            // A symlink is neither walked nor read.
+            //
+            // `stat` follows them, so a link to a directory looked like a directory and was walked. In
+            // immich, `fastlane/metadata` points at `../mobile/android/fastlane/metadata` inside the same
+            // repository: following it read 77 files a second time, under a path they do not really have.
+            // A finding in one of them would have been reported twice, at two different paths, and the
+            // file count no longer meant what the report said it meant.
+            //
+            // Worse than the double count: a link pointing out of the project would have Tewip reading
+            // files outside the directory it was given, which it must never do whatever is on the other
+            // end. Anything genuinely inside the project is still reached by its real path.
+            //
+            // Windows was already doing the right thing by accident - git writes a symlink there as a
+            // small text file - which is exactly why this hid: the numbers were recorded on Windows and
+            // only the Linux corpus run disagreed.
+            if (info.isSymbolicLink())
+                continue;
             if (info.isDirectory()) {
                 if (!SKIP_DIR.has(entry))
                     walk(path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [