hecks 3.4.2 → 3.6.0

data/lib/hecks/tools/fuzz_sweep/reporting.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require_relative "../../tools"
+
+module Hecks
+  module Tools
+    module FuzzSweep
+      # Prints a domain's result, then shrinks and saves one repro script per distinct finding.
+      module Reporting
+        # Writes a shrunk (or original) step sequence to disk as a replayable script.
+        #
+        # @param steps [Array<Hash>] the step sequence to save
+        # @param path [String] the file path to write the script to
+        # @param seed [Integer] the seed that produced `steps`, recorded in the script's own note
+        # @param domain_name [String] the domain's basename, for the script's `name` field
+        # @return [void]
+        def write_script(steps, path, seed, domain_name)
+          File.write(path, JSON.pretty_generate(
+                             name:  "#{domain_name}-fuzz",
+                             note:  "generated by hecks fuzz — seed #{seed}",
+                             steps: steps
+                           ))
+        end
+
+        # Prints the final report, then shrinks and saves one repro script per distinct finding.
+        #
+        # @param result [Result] what the sweep of one domain drew and found
+        # @return [Boolean] whether the domain had no findings
+        def report(result)
+          executed = result.clean + result.failures.length
+          puts "   #{executed} seeds executed (#{result.drawn} drawn) — " \
+               "#{result.clean} clean, #{result.failures.length} found something"
+          report_shortfall(result, executed)
+          clean = result.failures.empty?
+          report_findings(result) unless clean
+          puts
+          clean
+        end
+
+        private
+
+        def report_shortfall(result, executed)
+          return unless executed < result.seeds
+
+          puts "   SHORT — asked for #{result.seeds} executing seeds and drew #{result.drawn} to find #{executed}."
+          puts "          The generator is not reaching state ; this sweep proves less than it looks."
+        end
+
+        def report_findings(result)
+          grouped = result.failures.group_by { |failure| failure[:signature] }
+          puts "   #{grouped.size} distinct finding(s):"
+          save_dir = save_directory(result)
+          grouped.each_value.with_index(1) do |group, number|
+            print_finding(group, number, result.seeds)
+            save_finding(result, group.min_by { |failure| failure[:steps].length }, save_dir)
+          end
+        end
+
+        # @return [String] where the repro scripts go, created when missing
+        def save_directory(result)
+          File.join(result.root, "tmp/fuzz-failures").tap { |dir| FileUtils.mkdir_p(dir) }
+        end
+
+        def print_finding(group, number, seeds)
+          seeds_hit = group.map { |failure| failure[:seed] }
+          puts
+          puts "   (#{number}) #{group.first[:signature]} — #{group.first[:message]}"
+          puts "       #{group.length} of #{seeds} seeds: #{seeds_hit.first(8).join(", ")}#{", …" if seeds_hit.length > 8}"
+        end
+
+        # Shrinks the smallest failing sequence of a finding and saves it as a repro script.
+        def save_finding(result, smallest, save_dir)
+          shrunk = shrink(result.domain, smallest[:steps], smallest[:signature], result.adapter)
+          save_path = File.join(save_dir, "#{result.name}-seed#{smallest[:seed]}.json")
+          write_script(shrunk, save_path, smallest[:seed], result.name)
+          print_saved(smallest[:steps].length, shrunk.length, "hecks run #{result.domain} #{save_path}")
+        end
+
+        def print_saved(from, to, command)
+          puts "       shrunk #{from} steps -> #{to}"
+          puts "       reproduce: #{command}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/tools/fuzz_sweep.rb

@@ -2,10 +2,12 @@
 
 require "json"
 require "tmpdir"
-require "tempfile"
 require "etc"
-require "fileutils"
 require_relative "../tools"
+require_relative "fuzz_sweep/options"
+require_relative "fuzz_sweep/findings"
+require_relative "fuzz_sweep/reporting"
+require_relative "fuzz_sweep/pool"
 
 module Hecks
   module Tools
@@ -33,6 +35,18 @@ module Hecks
       # The persistence an ephemeral boot may use.
       ADAPTERS = %i[memory sqlite postgres].freeze
 
+      # What drawing seeds for one domain found: how many ran clean, the findings, how many seeds
+      # were drawn, and the reason the domain was skipped when it cannot be fuzzed.
+      Draw = Struct.new(:clean, :failures, :drawn, :skipped)
+
+      # What the sweep of one domain drew and found, for the final report.
+      Result = Struct.new(:domain, :name, :seeds, :drawn, :clean, :failures, :adapter, :root)
+
+      extend Options
+      extend Findings
+      extend Reporting
+      extend Pool
+
       module_function
 
       # Runs a sweep as the command line asks.
@@ -46,145 +60,39 @@ module Hecks
         require "hecks"
         require "hecks/fuzzing"
         options = parse(argv.dup)
-        return 1 unless options
-
-        return 1 if options[:adapter] == :postgres && !postgres_reachable?
+        return 1 unless options && adapter_ready?(options)
 
         # Every discoverable domain, so one added anywhere is swept without a list. Paths the sweep
         # cannot boot are routed by Hecks::Corpus::ROUTES to the check that owns them.
         domains = options[:domain] ? [options[:domain]] : Hecks::Corpus.fuzzable_domains(root)
-        # One child per core; a real Postgres runs one at a time.
-        workers = options[:workers] || (options[:adapter] == :postgres ? 1 : Etc.nprocessors)
-        ok = sweep(domains, workers, options, root)
+        ok = sweep(domains, worker_count(options), options, root)
 
         puts(ok ? "CLEAN — no generated sequence broke a property or the interpreter." : "FUZZ FOUND SOMETHING.")
         ok ? 0 : 1
       end
 
-      # @param args [Array<String>] the command line, consumed
-      # @return [Hash, nil] `seeds`, `steps`, `workers`, `adapter` and `domain`; nil after a refusal
-      def parse(args)
-        options = { seeds: 20, steps: 30, workers: nil, adapter: :memory, domain: nil }
-        until args.empty?
-          case (arg = args.shift)
-          when "--seeds" then options[:seeds] = Integer(args.shift)
-          when "--steps" then options[:steps] = Integer(args.shift)
-          when "--workers" then options[:workers] = Integer(args.shift)
-          when "--adapter"
-            options[:adapter] = args.shift.to_s.downcase.to_sym
-            unless ADAPTERS.include?(options[:adapter])
-              warn "unknown --adapter #{options[:adapter]} — memory, sqlite, or postgres"
-              return nil
-            end
-          else options[:domain] = arg
-          end
-        end
-        options
-      end
-
-      # `postgres` needs a reachable local server and is slower per dispatch, so pass smaller
-      # `--seeds` and `--steps`.
-      #
-      # @return [Boolean] whether a local Postgres answers; warns why when it does not
-      def postgres_reachable?
-        require "pg"
-        PG.connect(dbname: "postgres").close
-        true
-      rescue LoadError, PG::Error => e
-        warn "--adapter postgres needs a reachable local Postgres — #{e.class}: #{e.message}"
-        false
-      end
-
       # @param domains [Array<String>] the domain directories
       # @param workers [Integer] how many children may run at once
       # @param options [Hash] the parsed options
       # @param root [String] the checkout
       # @return [Boolean] whether every domain was clean
       def sweep(domains, workers, options, root)
-        if workers > 1 && domains.size > 1
-          # Booted here so every child inherits the grammar instead of each paying for a cold boot.
-          require "hecks/bluebook/meta_validator"
-          Hecks::Bluebook::MetaValidator.grammar_registry
-          $stdout.flush
-          fuzz_in_pool(domains, workers) do |domain|
-            fuzz_domain(domain, options[:seeds], options[:steps], options[:adapter], root)
-          end
-        else
-          domains.reduce(true) do |all_ok, domain|
-            fuzz_domain(domain, options[:seeds], options[:steps], options[:adapter], root) && all_ok
-          end
-        end
-      end
-
-      # Writes a shrunk (or original) step sequence to disk as a replayable script.
-      #
-      # @param steps [Array<Hash>] the step sequence to save
-      # @param path [String] the file path to write the script to
-      # @param seed [Integer] the seed that produced `steps`, recorded in the script's own note
-      # @param domain_name [String] the domain's basename, for the script's `name` field
-      # @return [void]
-      def write_script(steps, path, seed, domain_name)
-        File.write(path, JSON.pretty_generate(
-                           name:  "#{domain_name}-fuzz",
-                           note:  "generated by hecks fuzz — seed #{seed}",
-                           steps: steps
-                         ))
-      end
-
-      # An exception escaping Replay's per-step isolation is an interpreter defect, not a domain
-      # refusal.
-      #
-      # @param domain [String] the domain directory
-      # @param steps [Array<Hash>] the sequence to replay
-      # @param adapter [Symbol] the persistence to boot on
-      # @return [Array(Symbol, String)] the verdict (`:clean`, `:property_violation`, `:crash`) and
-      #   its message
-      def outcome(domain, steps, adapter = :memory)
-        history = Hecks::Fuzzing::Replay.call(domain, steps, adapter: adapter)
-        violations = Hecks::Fuzzing::Properties.check(history).reject { |_, result| result == true }
-        return [:clean, nil] if violations.empty?
+        return sweep_serially(domains, options, root) unless workers > 1 && domains.size > 1
 
-        [:property_violation, violations.map { |name, message| "#{name}: #{message}" }.join("; ")]
-      rescue StandardError => e
-        [:crash, "#{e.class}: #{e.message}"]
+        # Booted here so every child inherits the grammar instead of each paying for a cold boot.
+        require "hecks/bluebook/meta_validator"
+        Hecks::Bluebook::MetaValidator.grammar_registry
+        $stdout.flush
+        fuzz_in_pool(domains, workers) { |domain| fuzz_with(options, domain, root) }
       end
 
-      # Groups findings by property name or exception class, stable across shrink candidates.
-      #
-      # @param message [String, nil] a finding's message
-      # @return [String] the property name or exception class it opens with
-      def signature_of(message)
-        return "unknown" unless message
-
-        message.split(":").first
+      # @return [Boolean] whether every domain was clean
+      def sweep_serially(domains, options, root)
+        domains.reduce(true) { |all_ok, domain| fuzz_with(options, domain, root) && all_ok }
       end
 
-      # A compound finding that mixes a known shape with any other offender is not known and still
-      # fails.
-      #
-      # @param name [String] the domain's name
-      # @param failure [Hash] a finding: `signature` and `message`
-      # @return [Boolean] whether every offender is an allowlisted one
-      def known_finding?(name, failure)
-        matchers = KNOWN_FUZZ_FINDINGS.dig(name, failure[:signature])
-        return false unless matchers
-
-        failure[:message].split("; ").all? { |chunk| matchers.any? { |regex| regex.match?(chunk) } }
-      end
-
-      # Skips only exact, already-tracked wiring gaps; any other WiringError is re-raised.
-      #
-      # @param error [Hecks::Runtime::WiringError] what generating a sequence raised
-      # @return [Symbol] a key of `SKIPPED_DOMAIN_REASONS`
-      def known_unfuzzable_wiring_gap(error)
-        case error.message
-        when %r{a compute/rekey rule is declared}
-          # compute/rekey needs an era/Postgres migration, so it cannot boot under IsolatedBoot's
-          # Memory rebind. Real coverage lives in spec/adapters/driven/postgres_era/*_spec.rb.
-          :skip_compute_rekey
-        else
-          raise error
-        end
+      def fuzz_with(options, domain, root)
+        fuzz_domain(domain, options[:seeds], options[:steps], options[:adapter], root)
       end
 
       # Draws seeds until `seeds` results execute or the draw cap is hit.
@@ -200,173 +108,67 @@ module Hecks
         name = File.basename(domain)
         puts "── #{name}#{" (#{adapter})" unless adapter == :memory}"
 
-        failures = []
-        clean = 0
-        drawn = 0
-        cap = seeds * DRAW_LIMIT
-
-        while (clean + failures.length) < seeds && drawn < cap
-          drawn += 1
-          seed = drawn
-          generated = begin
-            Hecks::Fuzzing::SequenceGenerator.generate(domain, seed: seed, steps: steps, adapter: adapter)
-          rescue Hecks::Runtime::WiringError => e
-            known_unfuzzable_wiring_gap(e)
-          end
-          if (reason = SKIPPED_DOMAIN_REASONS[generated])
-            puts "   skipped — #{reason} (not fuzzable under :#{adapter})"
-            return true
-          end
-          verdict, message = outcome(domain, generated, adapter)
-
-          if verdict == :clean
-            determinism = Hecks::Fuzzing::Properties.replay_is_deterministic(domain, generated, adapter: adapter)
-            if determinism == true
-              clean += 1
-              next
-            end
-            verdict = :nondeterminism
-            message = determinism
-          end
-
-          failures << { seed: seed, steps: generated, verdict: verdict, message: message,
-                        signature: "#{verdict}: #{signature_of(message)}" }
-        end
-
-        # Known findings print but count as clean, so the sweep does not read as short.
-        known, failures = failures.partition { |failure| known_finding?(name, failure) }
-        known.each do |failure|
-          puts "   KNOWN (allowlisted, not failing) — #{failure[:signature]} — #{failure[:message]}"
+        draw = draw_seeds(domain, seeds, steps, adapter)
+        if draw.skipped
+          puts "   skipped — #{draw.skipped} (not fuzzable under :#{adapter})"
+          return true
         end
-        clean += known.length
 
-        report(domain, name, seeds, drawn, clean, failures, adapter, root)
+        report(settle_known(Result.new(domain, name, seeds, draw.drawn, draw.clean, draw.failures, adapter, root)))
       end
 
-      # Shrinks steps, then arguments, keeping a removal only while the same finding reproduces.
+      # Known findings print but count as clean, so the sweep does not read as short.
       #
-      # @param domain [String] the domain directory
-      # @param steps [Array<Hash>] the failing sequence
-      # @param signature [String] the finding to keep
-      # @param adapter [Symbol] the persistence to boot on
-      # @return [Array<Hash>] the smallest sequence found
-      def shrink(domain, steps, signature, adapter = :memory)
-        Hecks::Fuzzing::Shrinker.call(steps) { |candidate| same_finding?(domain, candidate, signature, adapter) }.steps
-      end
-
-      # @param domain [String] the domain directory
-      # @param candidate [Array<Hash>] a sequence to replay
-      # @param signature [String] the finding to keep
-      # @param adapter [Symbol] the persistence to boot on
-      # @return [Boolean] whether the candidate sequence reproduces the finding
-      def same_finding?(domain, candidate, signature, adapter)
-        verdict, message = outcome(domain, candidate, adapter)
-        "#{verdict}: #{signature_of(message)}" == signature
-      end
-
-      # @param step [Hash] one step of a sequence
-      # @return [Hash] its arguments
-      def args_of(step) = Hecks::Fuzzing::Shrinker.args_of(step)
-
-      # The argument pass alone.
-      #
-      # @param domain [String] the domain directory
-      # @param steps [Array<Hash>] the failing sequence
-      # @param signature [String] the finding to keep
-      # @param adapter [Symbol] the persistence to boot on
-      # @return [Array<Hash>] the sequence with every argument the finding does not need dropped
-      def shrink_arguments(domain, steps, signature, adapter = :memory)
-        Hecks::Fuzzing::Shrinker.drop_arguments(steps, Hecks::Fuzzing::Shrinker::Meter.new(nil)) do |candidate|
-          same_finding?(domain, candidate, signature, adapter)
+      # @param result [Result] what the sweep drew and found
+      # @return [Result] the same result, with the allowlisted findings moved to `clean`
+      def settle_known(result)
+        known, result.failures = result.failures.partition { |failure| known_finding?(result.name, failure) }
+        known.each do |failure|
+          puts "   KNOWN (allowlisted, not failing) — #{failure[:signature]} — #{failure[:message]}"
         end
+        result.clean += known.length
+        result
       end
 
-      # Prints the final report, then shrinks and saves one repro script per distinct finding.
-      #
-      # @param domain [String] the domain directory
-      # @param name [String] its name
-      # @param seeds [Integer] how many executing seeds were asked for
-      # @param drawn [Integer] how many were drawn
-      # @param clean [Integer] how many ran clean
-      # @param failures [Array<Hash>] the findings
-      # @param adapter [Symbol] the persistence the sweep booted on
-      # @param root [String] the checkout, where the repro scripts are saved
-      # @return [Boolean] whether the domain had no findings
-      # rubocop:disable-next Metrics/AbcSize
-      def report(domain, name, seeds, drawn, clean, failures, adapter = :memory, root = Tools::ROOT) # rubocop:disable Naming/PredicateMethod
-        executed = clean + failures.length
-        puts "   #{executed} seeds executed (#{drawn} drawn) — #{clean} clean, #{failures.length} found something"
+      # @return [Draw] the seeds drawn, stopping early when the domain cannot be fuzzed
+      def draw_seeds(domain, seeds, steps, adapter)
+        draw = Draw.new(0, [], 0, nil)
+        cap = seeds * DRAW_LIMIT
+        while (draw.clean + draw.failures.length) < seeds && draw.drawn < cap
+          draw.drawn += 1
+          generated = generate_sequence(domain, draw.drawn, steps, adapter)
+          draw.skipped = SKIPPED_DOMAIN_REASONS[generated]
+          return draw if draw.skipped
 
-        if executed < seeds
-          puts "   SHORT — asked for #{seeds} executing seeds and drew #{drawn} to find #{executed}."
-          puts "          The generator is not reaching state ; this sweep proves less than it looks."
+          record_seed(draw, domain, generated, adapter)
         end
+        draw
+      end
 
-        if failures.empty?
-          puts
-          return true
-        end
-
-        grouped = failures.group_by { |failure| failure[:signature] }
-        puts "   #{grouped.size} distinct finding(s):"
-        save_dir = File.join(root, "tmp/fuzz-failures")
-        FileUtils.mkdir_p(save_dir)
-
-        grouped.each_value.with_index(1) do |group, number|
-          seeds_hit = group.map { |failure| failure[:seed] }
-          smallest  = group.min_by { |failure| failure[:steps].length }
-
-          puts
-          puts "   (#{number}) #{group.first[:signature]} — #{group.first[:message]}"
-          puts "       #{group.length} of #{seeds} seeds: #{seeds_hit.first(8).join(', ')}#{', …' if seeds_hit.length > 8}"
-
-          shrunk = shrink(domain, smallest[:steps], smallest[:signature], adapter)
-          save_path = File.join(save_dir, "#{name}-seed#{smallest[:seed]}.json")
-          write_script(shrunk, save_path, smallest[:seed], name)
+      # @return [Array<Hash>, Symbol] the sequence, or the key of the reason it cannot be generated
+      def generate_sequence(domain, seed, steps, adapter)
+        Hecks::Fuzzing::SequenceGenerator.generate(domain, seed: seed, steps: steps, adapter: adapter)
+      rescue Hecks::Runtime::WiringError => e
+        known_unfuzzable_wiring_gap(e)
+      end
 
-          puts "       shrunk #{smallest[:steps].length} steps -> #{shrunk.length}"
-          puts "       reproduce: hecks run #{domain} #{save_path}"
-        end
+      # Files one drawn sequence under `draw` as clean or as a finding.
+      def record_seed(draw, domain, generated, adapter)
+        verdict, message = verdict_for(domain, generated, adapter)
+        return draw.clean += 1 if verdict == :clean
 
-        puts
-        false
+        draw.failures << { seed: draw.drawn, steps: generated, verdict: verdict, message: message,
+                           signature: "#{verdict}: #{signature_of(message)}" }
       end
 
-      # Forks one child per domain, up to `workers`, printing each child's output whole in domain
-      # order. A child that crashes exits non-zero and counts as a finding.
-      #
-      # @param domains [Array<String>] the domain directories
-      # @param workers [Integer] how many children may run at once
-      # @yieldparam domain [String] a domain directory
-      # @yieldreturn [Boolean] whether it was clean
-      # @return [Boolean] true if every domain's child exited 0, false if any exited non-zero
-      def fuzz_in_pool(domains, workers) # rubocop:disable Naming/PredicateMethod
-        pending = domains.each_with_index.to_a
-        running = {}
-        results = {}
-        until pending.empty? && running.empty?
-          while running.size < workers && (domain, index = pending.shift)
-            out = Tempfile.new("fuzz")
-            pid = fork do
-              $stdout.reopen(out)
-              $stderr.reopen(out)
-              exit(yield(domain) ? 0 : 1)
-            end
-            running[pid] = [index, out, Process.clock_gettime(Process::CLOCK_MONOTONIC)]
-          end
-          pid, status = Process.wait2
-          index, out, started = running.delete(pid)
-          results[index] = [status.success?, out, Process.clock_gettime(Process::CLOCK_MONOTONIC) - started]
-        end
-        slowest = results.max_by(5) { |_, (_, _, seconds)| seconds }
-                         .map { |index, (_, _, seconds)| "#{File.basename(domains[index])} #{seconds.round}s" }
-        warn "slowest domains: #{slowest.join(', ')}"
-        results.sort.map do |_, (clean, out, _)|
-          out.rewind
-          print out.read
-          out.close!
-          clean
-        end.all?
+      # @return [Array(Symbol, String)] the verdict, replaying a clean run once more to see that it
+      #   repeats; and its message
+      def verdict_for(domain, generated, adapter)
+        verdict, message = outcome(domain, generated, adapter)
+        return [verdict, message] unless verdict == :clean
+
+        determinism = Hecks::Fuzzing::Properties.replay_is_deterministic(domain, generated, adapter: adapter)
+        determinism == true ? [:clean, nil] : [:nondeterminism, determinism]
       end
     end
   end

data/lib/hecks/tools/gate.rb

@@ -28,8 +28,7 @@ module Hecks
         stages = YAML.load_file(STAGES_FILE, aliases: true)
         return list(stages) if argv == ["--list"]
 
-        name = argv.find { |arg| !arg.include?("=") && !arg.start_with?("--") }
-        only = argv.filter_map { |arg| arg.delete_prefix("only=").split(",") if arg.start_with?("only=") }.flatten
+        name, only = parse(argv)
         stage = stages[name]
         return usage(stages, name) unless stage
 
@@ -39,6 +38,14 @@ module Hecks
         report(name, checks, run_all(stage, checks, root))
       end
 
+      # @param argv [Array<String>] the command line words
+      # @return [Array(String, Array<String>)] the stage name and the check ids named by `only=`
+      def parse(argv)
+        name = argv.find { |arg| !arg.include?("=") && !arg.start_with?("--") }
+        only = argv.filter_map { |arg| arg.delete_prefix("only=").split(",") if arg.start_with?("only=") }.flatten
+        [name, only]
+      end
+
       # @param checks [Array<Hash>] a stage's checks
       # @param only [Array<String>] the check ids asked for; every check when empty
       # @return [Array<Hash>, nil] the checks to run, nil when an id names no check
@@ -79,37 +86,45 @@ module Hecks
         [Etc.nprocessors / 2, 1].max
       end
 
+      # @param name [String] the stage name
+      # @param checks [Array<Hash>] the checks that ran
+      # @param results [Hash{String => Array}] each check's output and whether it passed
+      # @return [Integer] 0 when every check passed, 1 otherwise
       def report(name, checks, results)
         failed = checks.reject { |check| results.fetch(check["id"]).last }
-        failed.each do |check|
-          output, = results.fetch(check["id"])
-          puts "\n[gate #{name}] #{check['title']}\n\n#{output}"
-          puts "\n[gate #{name}] BLOCKED: #{check['blocked']}\n"
-        end
-        if failed.empty?
-          puts "[gate #{name}] green: #{checks.map { |check| check['id'] }.join(', ')}"
-          return 0
-        end
+        failed.each { |check| print_failure(name, check, results.fetch(check["id"]).first) }
+        return summary(name, "red", failed, 1) unless failed.empty?
+
+        summary(name, "green", checks, 0)
+      end
+
+      # @return [Integer] the given status, after printing the stage's verdict and its check ids
+      def summary(name, verdict, checks, status)
+        puts "[gate #{name}] #{verdict}: #{checks.map { |check| check["id"] }.join(", ")}"
+        status
+      end
 
-        puts "[gate #{name}] red: #{failed.map { |check| check['id'] }.join(', ')}"
-        1
+      # @return [void] prints a failing check's output and what its failure means
+      def print_failure(name, check, output)
+        puts "\n[gate #{name}] #{check["title"]}\n\n#{output}"
+        puts "\n[gate #{name}] BLOCKED: #{check["blocked"]}\n"
       end
 
       def list(stages)
         stages.each do |name, stage|
-          puts "#{name}: #{stage.fetch('checks').map { |check| check['id'] }.join(', ')}"
+          puts "#{name}: #{stage.fetch("checks").map { |check| check["id"] }.join(", ")}"
         end
         0
       end
 
       def unknown(stage, only)
         known = stage.fetch("checks").map { |check| check["id"] }
-        warn "no such check: #{(only - known).join(', ')} (checks: #{known.join(', ')})"
+        warn "no such check: #{(only - known).join(", ")} (checks: #{known.join(", ")})"
         2
       end
 
       def usage(stages, name)
-        warn(name ? "no such stage: #{name} (stages: #{stages.keys.join(', ')})" : USAGE)
+        warn(name ? "no such stage: #{name} (stages: #{stages.keys.join(", ")})" : USAGE)
         2
       end
     end