@avi2dg/checks 0.8.0 → 0.10.0

package/scripts/comments.ts

@@ -1,309 +1,21 @@
 import { Effect, Schema } from "effect";
+import { commentsIn, refusalsIn, syntaxOf, unreadable, type Syntax } from "./comment-matchers.ts";
 
-export type Comment = { line: number; text: string };
-
-type Marker = { readonly token: string; readonly afterAWordBreak: boolean };
-type Quote = { readonly token: string; readonly backslashEscapes: boolean; readonly opensMidWord: boolean };
-
-type Syntax = {
-  readonly line: readonly Marker[];
-  readonly block: readonly (readonly [open: string, close: string])[];
-  readonly quotes: readonly Quote[];
-  readonly regexLiterals: boolean;
-};
-
-const anywhere = (token: string): Marker => ({ token, afterAWordBreak: false });
-const startingAWord = (token: string): Marker => ({ token, afterAWordBreak: true });
-const escaping = (token: string): Quote => ({ token, backslashEscapes: true, opensMidWord: true });
-const literal = (token: string): Quote => ({ token, backslashEscapes: false, opensMidWord: true });
-const outsideAWord = (quote: Quote): Quote => ({ ...quote, opensMidWord: false });
-
-const SLASHES: readonly (readonly [string, string])[] = [["/*", "*/"]];
-const SLASH_SLASH = [startingAWord("//")];
-const DASHES = [anywhere("--")];
-const STRINGS = [escaping('"'), escaping("'")];
-
-const JS: Syntax = {
-  line: SLASH_SLASH,
-  block: SLASHES,
-  quotes: [escaping('"'), outsideAWord(escaping("'")), escaping("`")],
-  regexLiterals: true,
-};
-const CURLY: Syntax = { ...JS, quotes: [...STRINGS, escaping("`")], regexLiterals: false };
-const PHP: Syntax = { line: [...SLASH_SLASH, anywhere("#")], block: SLASHES, quotes: STRINGS, regexLiterals: false };
-const HASH: Syntax = {
-  line: [startingAWord("#")],
-  block: [],
-  quotes: [escaping('"'), literal("'")],
-  regexLiterals: false,
-};
-const YAML: Syntax = { ...HASH, quotes: [escaping('"'), outsideAWord(literal("'"))] };
-const SQL: Syntax = { line: DASHES, block: SLASHES, quotes: STRINGS, regexLiterals: false };
-const LUA: Syntax = { line: DASHES, block: [["--[[", "]]"]], quotes: STRINGS, regexLiterals: false };
-const HASKELL: Syntax = { line: DASHES, block: [["{-", "-}"]], quotes: [escaping('"')], regexLiterals: false };
-const ML: Syntax = { line: [], block: [["(*", "*)"]], quotes: [escaping('"')], regexLiterals: false };
-
-export const SYNTAXES: Readonly<Record<string, Syntax>> = {
-  ts: JS,
-  tsx: JS,
-  mts: JS,
-  cts: JS,
-  js: JS,
-  jsx: JS,
-  mjs: JS,
-  cjs: JS,
-  go: CURLY,
-  rs: CURLY,
-  java: CURLY,
-  kt: CURLY,
-  swift: CURLY,
-  scala: CURLY,
-  c: CURLY,
-  h: CURLY,
-  cc: CURLY,
-  cpp: CURLY,
-  hpp: CURLY,
-  cs: CURLY,
-  php: PHP,
-  py: HASH,
-  rb: HASH,
-  ex: HASH,
-  exs: HASH,
-  sh: HASH,
-  bash: HASH,
-  zsh: HASH,
-  nix: HASH,
-  sql: SQL,
-  lua: LUA,
-  hs: HASKELL,
-  yaml: YAML,
-  yml: YAML,
-  toml: HASH,
-  ml: ML,
-};
+export { SYNTAXES, syntaxOf, type Comment } from "./comment-matchers.ts";
 
 export class UnreadableCode extends Schema.TaggedError<UnreadableCode>()("UnreadableCode", {
   message: Schema.String,
 }) {}
 
 export function syntaxFor(path: string): Effect.Effect<Syntax, UnreadableCode> {
-  const extension = path.slice(path.lastIndexOf(".") + 1);
-  const syntax = SYNTAXES[extension];
-  return syntax
-    ? Effect.succeed(syntax)
-    : Effect.fail(
-        new UnreadableCode({
-          message: `${path} is code the comment checks cannot read: add a comment syntax for .${extension} to scripts/comments.ts`,
-        }),
-      );
-}
-
-const WORD = /[\w$]/;
-
-const KEYWORDS = new Set([
-  "return",
-  "typeof",
-  "instanceof",
-  "in",
-  "of",
-  "new",
-  "delete",
-  "void",
-  "throw",
-  "case",
-  "do",
-  "else",
-  "yield",
-  "await",
-]);
-
-const AFTER_A_VALUE = /[)\]}"'`]/;
-
-function opensRegex(previous: string): boolean {
-  if (previous === "") return true;
-  if (WORD.test(previous[0]!)) return KEYWORDS.has(previous);
-  return !AFTER_A_VALUE.test(previous);
-}
-
-const WORD_BREAK = /[\s;|&(]/;
-
-function endOfQuoted(source: string, start: number, quote: Quote): number {
-  let i = start + quote.token.length;
-  while (i < source.length) {
-    if (quote.backslashEscapes && source[i] === "\\") i += 2;
-    else if (source.startsWith(quote.token, i)) return i + quote.token.length;
-    else i += 1;
-  }
-  return start + quote.token.length;
-}
-
-function endOfRegex(source: string, start: number): number {
-  let i = start + 1;
-  let inClass = false;
-  while (i < source.length) {
-    const char = source[i]!;
-    if (char === "\\") i += 2;
-    else if (char === "\n") return i;
-    else {
-      if (char === "[") inClass = true;
-      else if (char === "]") inClass = false;
-      else if (char === "/" && !inClass) return i + 1;
-      i += 1;
-    }
-  }
-  return source.length;
+  const syntax = syntaxOf(path);
+  return syntax ? Effect.succeed(syntax) : Effect.fail(new UnreadableCode({ message: unreadable(path) }));
 }
 
 export const comments = Effect.fn("comments")(function* (path: string, source: string) {
-  const syntax = yield* syntaxFor(path);
-  const found: Comment[] = [];
-  let i = 0;
-  let line = 1;
-  let previous = "";
-
-  const advance = (to: number): void => {
-    for (let k = i; k < to; k++) if (source[k] === "\n") line += 1;
-    i = to;
-  };
-
-  while (i < source.length) {
-    const char = source[i]!;
-
-    const block = syntax.block.find(([open]) => source.startsWith(open, i));
-    if (block) {
-      const [open, close] = block;
-      const closed = source.indexOf(close, i + open.length);
-      const stop = closed < 0 ? source.length : closed + close.length;
-      found.push({ line, text: source.slice(i, stop) });
-      advance(stop);
-      previous = "";
-      continue;
-    }
-
-    const marker = syntax.line.find(
-      ({ token, afterAWordBreak }) =>
-        source.startsWith(token, i) && (!afterAWordBreak || i === 0 || WORD_BREAK.test(source[i - 1]!)),
-    );
-    if (marker) {
-      const newline = source.indexOf("\n", i);
-      const stop = newline < 0 ? source.length : newline;
-      found.push({ line, text: source.slice(i, stop) });
-      advance(stop);
-      previous = "";
-      continue;
-    }
-
-    const quote = syntax.quotes.find(
-      ({ token, opensMidWord }) =>
-        source.startsWith(token, i) && (opensMidWord || i === 0 || !WORD.test(source[i - 1]!)),
-    );
-    if (quote) {
-      advance(endOfQuoted(source, i, quote));
-      previous = quote.token;
-      continue;
-    }
-
-    if (syntax.regexLiterals && char === "/" && opensRegex(previous)) {
-      advance(endOfRegex(source, i));
-      previous = "/";
-      continue;
-    }
-
-    if (WORD.test(char)) {
-      let end = i;
-      while (end < source.length && WORD.test(source[end]!)) end += 1;
-      previous = source.slice(i, end);
-      advance(end);
-      continue;
-    }
-
-    if (!/\s/.test(char)) previous = char;
-    advance(i + 1);
-  }
-
-  return found;
+  return commentsIn(source, yield* syntaxFor(path));
 });
 
-const LICENCE = /copyright|spdx-license-identifier|all rights reserved|licen[cs]ed under|permission is hereby granted/i;
-
-// A single sentence wraps to at most a few lines at a normal width, so a longer run at the
-// file's own opening is the shape of a paragraph rather than of one fact.
-const A_WRAPPED_SENTENCE_FITS_WITHIN = 3;
-
-function beginsItsLine(comment: Comment, lines: readonly string[]): boolean {
-  return lines[comment.line - 1]!.trimStart().startsWith(comment.text.split("\n")[0]!);
-}
-
-function openingBlock(found: readonly Comment[], source: string): Comment[] {
-  const lines = source.split("\n");
-  if (found.length === 0 || found[0]!.line !== 1 || !beginsItsLine(found[0]!, lines)) return [];
-  const block = [found[0]!];
-  let next = found[0]!.line + found[0]!.text.split("\n").length;
-  for (let i = 1; i < found.length && found[i]!.line === next && beginsItsLine(found[i]!, lines); i++) {
-    block.push(found[i]!);
-    next = found[i]!.line + found[i]!.text.split("\n").length;
-  }
-  return block;
-}
-
-type Check = {
-  readonly find: RegExp;
-  readonly refusal: (match: string) => string;
-};
-
-const CHECKS: readonly Check[] = [
-  {
-    find: /@ts-expect-error|@ts-ignore|\bprettier-ignore\b|\beslint-disable[\w-]*|\bbiome-ignore\b/,
-    refusal: (match) =>
-      `carries the machine-read directive \`${match}\`. Fix what the tool is reporting, or stop running the tool on this file`,
-  },
-  {
-    find: /\bADR[\s-]?\d+|\bdocs\/adr\b|\bRFC[\s-]?\d+|(?:^|[\s(["'`])#\d+\b|[\w.-]+\/[\w.-]+#\d+|\/(?:issues|pull)\/\d+/i,
-    refusal: (match) =>
-      `points at a record or a ticket (${JSON.stringify(match.trim())}). Drop the pointer: a record is reached by searching docs/adr, and the story of the change goes in the commit message`,
-  },
-  {
-    find: /^\/\*\*/,
-    refusal: () =>
-      "opens a doc block. Make the code say it, or put what the types cannot hold on a line comment in the fewest words that carry it",
-  },
-];
-
-function spans(from: number, lineCount: number, within: ReadonlySet<number> | undefined): boolean {
-  if (within === undefined) return true;
-  for (let line = from; line < from + lineCount; line += 1) if (within.has(line)) return true;
-  return false;
-}
-
-export const refused = Effect.fn("refused")(function* (
-  path: string,
-  source: string,
-  within?: ReadonlySet<number>,
-) {
-  const out: string[] = [];
-  const found = yield* comments(path, source);
-
-  const opening = openingBlock(found, source);
-  const openingText = opening.map((comment) => comment.text).join("\n");
-  const openingLines = opening.reduce((sum, comment) => sum + comment.text.split("\n").length, 0);
-  if (
-    opening.length > 0 &&
-    openingLines > A_WRAPPED_SENTENCE_FITS_WITHIN &&
-    !LICENCE.test(openingText) &&
-    spans(1, openingLines, within)
-  ) {
-    out.push(
-      `${path}:1 opens with a ${openingLines}-line rationale block. A record this long belongs in docs/adr or the repo's decision log, and the code does not point at it`,
-    );
-  }
-
-  for (const comment of found) {
-    if (LICENCE.test(comment.text)) continue;
-    if (!spans(comment.line, comment.text.split("\n").length, within)) continue;
-    for (const check of CHECKS) {
-      const [match] = check.find.exec(comment.text) ?? [];
-      if (match !== undefined) out.push(`${path}:${comment.line} ${check.refusal(match)}`);
-    }
-  }
-  return out;
+export const refused = Effect.fn("refused")(function* (path: string, source: string, within?: ReadonlySet<number>) {
+  return refusalsIn(path, source, yield* syntaxFor(path), within);
 });

package/scripts/flake.ts

@@ -0,0 +1,153 @@
+#!/usr/bin/env bun
+import { Config, Console, Effect, FileSystem, Option, Path, Random, Schema } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { runMain, Usage } from "./main.ts";
+import { NAME_SEPARATOR, parseReport, ReportError, reporterArgs, type TestResult } from "./test-report.ts";
+
+export type Run = {
+  readonly seed: number;
+  readonly passed: boolean;
+  readonly tests: number;
+  readonly failed: readonly TestResult[];
+};
+
+export type Failure = {
+  readonly file: string;
+  readonly test: string;
+  readonly line: number;
+  readonly seeds: readonly number[];
+};
+
+export type RunRecord = Omit<Run, "failed"> & { readonly failed: readonly string[] };
+
+export type FlakeRecord = {
+  readonly runs: readonly RunRecord[];
+  readonly failures: readonly Failure[];
+  readonly outsideTests: readonly number[];
+};
+
+type Plan = { readonly seeds: readonly number[] } | { readonly runs: number };
+
+const NAME = "checks-flake";
+const USAGE = `usage: ${NAME} [--runs <count> | --seed <seed>...] [--report <file>]`;
+const DEFAULT_RUNS = 10;
+const MAX_SEED = 2 ** 32 - 1;
+
+const wholeBetween = (minimum: number, maximum: number) =>
+  Schema.decodeUnknownEffect(Schema.NumberFromString.check(Schema.isInt(), Schema.isBetween({ minimum, maximum })));
+const decodeRuns = wholeBetween(1, 1000);
+const decodeSeed = wholeBetween(0, MAX_SEED);
+
+const parseArgs = Effect.fnUntraced(function* (args: readonly string[]) {
+  const usage = (reason?: string) => new Usage({ message: reason === undefined ? USAGE : `${reason}; ${USAGE}` });
+  let runs: string | undefined;
+  let report: string | undefined;
+  const seeds: string[] = [];
+  for (let index = 0; index < args.length; index += 2) {
+    const [flag, value] = [args[index], args[index + 1]];
+    if (value === undefined) return yield* usage();
+    if (flag === "--runs" && runs === undefined) runs = value;
+    else if (flag === "--seed") seeds.push(value);
+    else if (flag === "--report" && report === undefined) report = value;
+    else return yield* usage();
+  }
+  if (runs !== undefined && seeds.length > 0) return yield* usage();
+  const invalid = (flag: string) => (cause: { readonly message: string }) => usage(`${flag}: ${cause.message}`);
+  const plan: Plan =
+    seeds.length > 0
+      ? { seeds: yield* Effect.forEach(seeds, (seed) => decodeSeed(seed).pipe(Effect.mapError(invalid("--seed")))) }
+      : { runs: runs === undefined ? DEFAULT_RUNS : yield* decodeRuns(runs).pipe(Effect.mapError(invalid("--runs"))) };
+  return { plan, report };
+});
+
+const seedsOf = (plan: Plan) =>
+  "seeds" in plan ? Effect.succeed(plan.seeds) : Effect.replicateEffect(Random.nextIntBetween(0, MAX_SEED), plan.runs);
+
+const runOnce = Effect.fn("runOnce")(function* (seed: number, outfile: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const args = ["test", "--randomize", `--seed=${seed}`, ...reporterArgs(outfile)];
+  const exitCode = yield* spawner.exitCode(
+    ChildProcess.make(process.execPath, args, { stdin: "ignore", stdout: "ignore", stderr: "ignore" }),
+  );
+  const passed = exitCode === ChildProcessSpawner.ExitCode(0);
+  if (!(yield* fs.exists(outfile))) {
+    if (passed) return yield* new ReportError({ message: `bun test passed with seed ${seed} but wrote no report` });
+    return { seed, passed, tests: 0, failed: [] } satisfies Run;
+  }
+  const results = yield* parseReport(yield* fs.readFileString(outfile));
+  return { seed, passed, tests: results.length, failed: results.filter((result) => result.outcome === "failed") } satisfies Run;
+});
+
+function outcomeOf(run: Run): string {
+  if (run.passed) return "passed";
+  return run.failed.length === 0 ? "failed outside any test" : `failed, ${run.failed.length} test(s) failing`;
+}
+
+function nameOf(result: TestResult): string {
+  return `${result.file}${NAME_SEPARATOR}${result.name}`;
+}
+
+export function recordOf(runs: readonly Run[]): FlakeRecord {
+  const failures = new Map<string, { file: string; test: string; line: number; seeds: number[] }>();
+  for (const run of runs) {
+    const failing = new Map(run.failed.map((result) => [nameOf(result), result]));
+    for (const [name, result] of failing) {
+      const failure = failures.get(name) ?? { file: result.file, test: result.name, line: result.line, seeds: [] };
+      failure.seeds.push(run.seed);
+      failures.set(name, failure);
+    }
+  }
+  return {
+    runs: runs.map(({ seed, passed, tests, failed }) => ({ seed, passed, tests, failed: failed.map(nameOf) })),
+    failures: [...failures.values()].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line),
+    outsideTests: runs.filter((run) => !run.passed && run.failed.length === 0).map((run) => run.seed),
+  };
+}
+
+function cell(text: string): string {
+  return text.replaceAll("|", "\\|");
+}
+
+export function summary(record: FlakeRecord): string {
+  const total = record.runs.length;
+  const failedRuns = record.runs.filter((run) => !run.passed).length;
+  if (failedRuns === 0) return `${NAME}: ${total} run(s) passed, with seeds ${record.runs.map((run) => run.seed).join(", ")}`;
+  const lines = [`${NAME}: ${failedRuns} of ${total} run(s) failed, ${record.failures.length} test(s) failing in them`];
+  if (record.failures.length > 0) {
+    lines.push("", "| Test | Failed | Seeds |", "| --- | --- | --- |");
+    for (const failure of record.failures) {
+      const place = cell(`${failure.file}:${failure.line} ${failure.test}`);
+      lines.push(`| ${place} | ${failure.seeds.length} of ${total} runs | ${failure.seeds.join(", ")} |`);
+    }
+  }
+  if (record.outsideTests.length > 0) {
+    lines.push("", `${record.outsideTests.length} run(s) failed outside any test, with seeds ${record.outsideTests.join(", ")}`);
+  }
+  lines.push("", "Reproduce a failing run with bun test --randomize --seed=<seed>.");
+  return lines.join("\n");
+}
+
+const flake = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const { plan, report } = yield* parseArgs(process.argv.slice(2));
+  const seeds = yield* seedsOf(plan);
+  const dir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-flake-" });
+
+  const runs = yield* Effect.forEach(seeds, (seed, index) =>
+    runOnce(seed, path.join(dir, `${index}.xml`)).pipe(
+      Effect.tap((run) => Console.log(`${NAME}: run ${index + 1} of ${seeds.length}, seed ${seed}: ${outcomeOf(run)}`)),
+    ),
+  );
+  const record = recordOf(runs);
+  const text = summary(record);
+  yield* Console.log(text);
+
+  if (report !== undefined) yield* fs.writeFileString(report, `${JSON.stringify(record, null, 2)}\n`);
+  const stepSummary = yield* Config.option(Config.String("GITHUB_STEP_SUMMARY"));
+  if (Option.isSome(stepSummary)) yield* fs.writeFileString(stepSummary.value, `${text}\n`, { flag: "a" });
+  return runs.every((run) => run.passed);
+}).pipe(Effect.scoped);
+
+if (import.meta.main) runMain(NAME, flake);

package/scripts/gates.ts

@@ -1,21 +1,61 @@
+import { Schema } from "effect";
+
 export type Program = {
   readonly bin: string;
   readonly script: string;
 };
 
+type TrackedContent = {
+  readonly pathspecs: readonly string[];
+  readonly content: string;
+};
+
+export const EVERY_REPOSITORY = "every repository";
+
 export type KitGate = Program & {
   readonly reads: "tree" | "range";
+  readonly appliesTo: typeof EVERY_REPOSITORY | TrackedContent;
 };
 
 export const ENTRY_POINT: Program = { bin: "checks-lint", script: "lint.ts" };
 
+export const TEST_ENTRY_POINT: Program = { bin: "checks-test", script: "test.ts" };
+
 export const DEFAULT_BRANCH = "main";
 
-export const KIT_GATES: readonly KitGate[] = [
-  { bin: "checks-lint-coverage", script: "lint-coverage.sh", reads: "tree" },
-  { bin: "checks-test-layout", script: "test-layout.ts", reads: "tree" },
-  { bin: "checks-commit-identity", script: "commit-identity.ts", reads: "range" },
-  { bin: "checks-comment-gate", script: "comment-gate.ts", reads: "range" },
-  { bin: "checks-suppressions-ratchet", script: "suppressions-ratchet.ts", reads: "range" },
-  { bin: "checks-ci-wiring", script: "ci-wiring.ts", reads: "tree" },
-];
+const TYPESCRIPT_SOURCE: TrackedContent = { pathspecs: ["*.ts", "*.tsx"], content: "TypeScript source" };
+
+export const KIT_GATES = [
+  { bin: "checks-lint-coverage", script: "lint-coverage.sh", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
+  { bin: "checks-test-layout", script: "test-layout.ts", reads: "tree", appliesTo: TYPESCRIPT_SOURCE },
+  { bin: "checks-commit-identity", script: "commit-identity.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
+  { bin: "checks-comment-gate", script: "comment-gate.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
+  { bin: "checks-suppressions-ratchet", script: "suppressions-ratchet.ts", reads: "range", appliesTo: EVERY_REPOSITORY },
+  { bin: "checks-ci-wiring", script: "ci-wiring.ts", reads: "tree", appliesTo: EVERY_REPOSITORY },
+] as const satisfies readonly KitGate[];
+
+const UNCONDITIONAL = KIT_GATES.filter((gate) => gate.appliesTo === EVERY_REPOSITORY).map((gate) => gate.bin);
+
+// A selection without ci-wiring would go unchecked under checks-lint, so a gate every repository runs
+// is refused where checks-lint decodes the selection, not by ci-wiring.
+export const LintGates = Schema.Array(Schema.Literals(KIT_GATES.map((gate) => gate.bin))).check(
+  Schema.makeFilter((selected) => {
+    const missing = UNCONDITIONAL.filter((bin) => !selected.includes(bin));
+    if (missing.length === 0) return true;
+    const verb = missing.length === 1 ? "applies" : "apply";
+    return `checks-lint must run ${missing.join(", ")}, which ${verb} to ${EVERY_REPOSITORY}`;
+  }),
+);
+
+export const LintWiring = Schema.Struct({
+  ciWiring: Schema.optionalKey(
+    Schema.Struct({
+      defaultBranch: Schema.optionalKey(Schema.NonEmptyString),
+      lintGates: Schema.optionalKey(LintGates),
+    }),
+  ),
+});
+
+export function selectedGates(lintGates: typeof LintGates.Type | undefined): readonly KitGate[] {
+  return lintGates === undefined ? KIT_GATES : KIT_GATES.filter((gate) => lintGates.includes(gate.bin));
+}

package/scripts/git.ts

@@ -25,3 +25,17 @@ export const git = Effect.fn("git")(
   },
   Effect.scoped,
 );
+
+function namesAParent(commitObject: string): boolean {
+  const [headers = ""] = commitObject.split("\n\n", 1);
+  return headers.split("\n").some((header) => header.startsWith("parent "));
+}
+
+// A shallow clone's boundary commit reads as parentless to rev-parse and log, and judged against
+// the empty tree it would carry the whole repository; only the commit object still names its parents.
+export const parentOrEmptyTree = Effect.fn("parentOrEmptyTree")(function* (rev: string, cwd?: string) {
+  if (!namesAParent(yield* git(["cat-file", "commit", rev], cwd))) {
+    return (yield* git(["hash-object", "-t", "tree", "/dev/null"], cwd)).trim();
+  }
+  return (yield* git(["rev-parse", "--verify", `${rev}^`], cwd)).trim();
+});

package/scripts/lint-coverage.sh

@@ -12,15 +12,21 @@ if ! [ -s "$tmp/expected" ]; then
 fi
 
 # Explicit paths bypass ignore files, so only an unscoped walk proves coverage.
-oxlint --debug=files 2>/dev/null | grep -E '\.tsx?$' | LC_ALL=C sort > "$tmp/walked" || true
+if ! oxlint --debug=files > "$tmp/walk" 2> "$tmp/walk-error"; then
+  echo "lint-coverage: oxlint could not walk the tree:"
+  cat "$tmp/walk" "$tmp/walk-error"
+  exit 2
+fi
+grep -E '\.tsx?$' "$tmp/walk" | LC_ALL=C sort > "$tmp/walked" || true
 
 expected_count="$(wc -l < "$tmp/expected" | tr -d ' ')"
 walked_count="$(grep -c . "$tmp/walked" || true)"
 
-missing="$(comm -23 "$tmp/expected" "$tmp/walked")"
-if [ -n "$missing" ]; then
-  echo "lint-coverage: oxlint skips ${walked_count}/${expected_count} tracked .ts/.tsx files; missing:"
-  printf '%s\n' "$missing"
+comm -23 "$tmp/expected" "$tmp/walked" > "$tmp/missing"
+if [ -s "$tmp/missing" ]; then
+  missing_count="$(wc -l < "$tmp/missing" | tr -d ' ')"
+  echo "lint-coverage: oxlint skips ${missing_count}/${expected_count} tracked .ts/.tsx files; missing:"
+  cat "$tmp/missing"
   exit 1
 fi