@doubleloop-io/oxlint-plugin-effect 0.1.0-rc.0 → 0.1.0-rc.1

package/dist/rules/all-errors-handled-at-boundary.js

@@ -0,0 +1,111 @@
+import { defineRule } from "@oxlint/plugins";
+import { calleeOf, isServerComponent, memberOf, nearestFunction, } from "../shared/effect-ast.js";
+import { filePatternsSchema } from "../shared/file-globs.js";
+import { isTestFile } from "../shared/test-files.js";
+// The *Exit runners hand failures back as values, so an open error channel cannot leak there.
+// `NodeRuntime.runMain`/`BunRuntime.runMain` are boundaries too: they log the Cause and exit with
+// code 1, which is the right outcome for a process failing to start (a ConfigError, a busy port).
+const effectRunners = new Set(["runPromise", "runSync", "runFork", "runCallback"]);
+const isRunnerCall = (node) => effectRunners.has(calleeOf(node, "Effect") ?? "");
+const isEffectTypeName = (name) => (name.type === "Identifier" && name.name === "Effect") ||
+    (name.type === "TSQualifiedName" &&
+        name.left.type === "Identifier" &&
+        name.left.name === "Effect" &&
+        name.right.name === "Effect");
+const isClosedEffectType = (type) => type?.type === "TSTypeReference" &&
+    isEffectTypeName(type.typeName) &&
+    type.typeArguments?.params[1]?.type === "TSNeverKeyword";
+const parameterType = (identifier) => {
+    for (let fn = nearestFunction(identifier); fn; fn = nearestFunction(fn)) {
+        for (const param of fn.params) {
+            if (param.type === "Identifier" && param.name === identifier.name) {
+                return param.typeAnnotation?.typeAnnotation;
+            }
+        }
+    }
+    return undefined;
+};
+// They turn every failure into a success value, so whatever comes before cannot leak.
+const failureToValue = new Set(["result", "exit"]);
+const isPipeCall = (node) => node.callee.type === "MemberExpression" &&
+    !node.callee.computed &&
+    node.callee.property.type === "Identifier" &&
+    node.callee.property.name === "pipe";
+// `Effect.result(program)` or `program.pipe(…, Effect.result)`.
+const endsWithFailureToValue = (node) => {
+    const last = isPipeCall(node) ? node.arguments.at(-1) : undefined;
+    const step = last === undefined ? calleeOf(node, "Effect") : memberOf(last, "Effect");
+    return failureToValue.has(step ?? "");
+};
+const hasClosedErrorChannel = (node) => {
+    if (node?.type === "TSSatisfiesExpression")
+        return isClosedEffectType(node.typeAnnotation);
+    if (node?.type === "Identifier")
+        return isClosedEffectType(parameterType(node));
+    if (node?.type === "CallExpression")
+        return endsWithFailureToValue(node);
+    return false;
+};
+export const allErrorsHandledAtBoundaryRule = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Close the error channel to `never` before running an Effect at the boundary. Test files are skipped.",
+        },
+        messages: {
+            openErrorChannel: "Close the error channel before running: `program satisfies Effect.Effect<A, never>`, or a runner parameter typed `Effect.Effect<A, never, never>`.",
+        },
+        schema: [
+            {
+                type: "object",
+                properties: { testFiles: filePatternsSchema },
+                additionalProperties: false,
+            },
+        ],
+    },
+    createOnce(context) {
+        const frames = [];
+        let inTestFile = false;
+        const enter = (fn) => {
+            frames.push({ fn, rendersJsx: false, openRuns: [] });
+        };
+        // The JSX can follow the run, so whether the function is a Server Component is known only on exit.
+        const exit = () => {
+            const frame = frames.pop();
+            if (frame === undefined || isServerComponent(frame.fn, frame.rendersJsx))
+                return;
+            for (const node of frame.openRuns)
+                context.report({ node, messageId: "openErrorChannel" });
+        };
+        const markJsx = () => {
+            const frame = frames.at(-1);
+            if (frame !== undefined)
+                frame.rendersJsx = true;
+        };
+        return {
+            // A test is not a boundary: a rejected run fails it with the error, which is the point.
+            before() {
+                inTestFile = isTestFile(context);
+            },
+            ArrowFunctionExpression: enter,
+            FunctionExpression: enter,
+            FunctionDeclaration: enter,
+            "ArrowFunctionExpression:exit": exit,
+            "FunctionExpression:exit": exit,
+            "FunctionDeclaration:exit": exit,
+            JSXElement: markJsx,
+            JSXFragment: markJsx,
+            CallExpression(node) {
+                if (inTestFile)
+                    return;
+                if (!isRunnerCall(node) || hasClosedErrorChannel(node.arguments[0]))
+                    return;
+                const frame = frames.at(-1);
+                if (frame === undefined)
+                    context.report({ node, messageId: "openErrorChannel" });
+                else
+                    frame.openRuns.push(node);
+            },
+        };
+    },
+});

package/dist/rules/error-handling-in-effect-fn-handler.js

@@ -1,5 +1,5 @@
 import { defineRule } from "@oxlint/plugins";
-import { isInsideEffectGeneratorBody, memberOf } from "../shared/effect-ast.js";
+import { isEffectGenerator, isInsideEffectGeneratorBody, memberOf, nearestFunction, } from "../shared/effect-ast.js";
 import { filePatternsSchema } from "../shared/file-globs.js";
 import { isTestFile } from "../shared/test-files.js";
 // mapError, orElse and orElseSucceed stay allowed: they name a failure or give an alternative
@@ -27,6 +27,82 @@ const errorHandlers = new Set([
     "result",
     "sandbox",
 ]);
+// Effect 4 names first, then the v3 ones without a v4 counterpart.
+const iterationCombinators = new Set([
+    "filter",
+    "filterMap",
+    "filterMapEffect",
+    "findFirst",
+    "findFirstFilter",
+    "forEach",
+    "partition",
+    "reduce",
+    "validate",
+    "dropUntil",
+    "dropWhile",
+    "every",
+    "exists",
+    "mergeAll",
+    "reduceWhile",
+    "takeUntil",
+    "takeWhile",
+    "validateAll",
+    "validateFirst",
+]);
+const failureCatchers = new Set([
+    "catch",
+    "catchAll",
+    "catchFilter",
+    "catchIf",
+    "catchTag",
+    "catchTags",
+]);
+const isEffectDie = (node) => ["die", "dieMessage"].includes(memberOf(node, "Effect") ?? "");
+const returnedExpression = (fn) => {
+    if (fn.body?.type !== "BlockStatement")
+        return fn.body;
+    const [statement, ...rest] = fn.body.body;
+    return rest.length === 0 && statement?.type === "ReturnStatement" ? statement.argument : null;
+};
+const onlyDies = (handler) => {
+    if (isEffectDie(handler))
+        return true;
+    if (handler.type !== "ArrowFunctionExpression" && handler.type !== "FunctionExpression") {
+        return false;
+    }
+    const returned = returnedExpression(handler);
+    return returned?.type === "CallExpression" && isEffectDie(returned.callee);
+};
+// Turning a failure into a defect is a selective `orDie`, which stays allowed: it declares the case
+// untracked rather than handling it. The handler is the last argument in both the pipeable and the
+// data-first forms; `catchTags` takes an object of handlers and is exempt only when all of them die.
+const isDieOnlyCatch = (node, name) => {
+    const call = node.parent;
+    if (call?.type !== "CallExpression" || call.callee !== node || !failureCatchers.has(name)) {
+        return false;
+    }
+    const handler = call.arguments.at(-1);
+    if (handler === undefined)
+        return false;
+    if (name !== "catchTags")
+        return onlyDies(handler);
+    return (handler.type === "ObjectExpression" &&
+        handler.properties.length > 0 &&
+        handler.properties.every((property) => property.type === "Property" && onlyDies(property.value)));
+};
+// A handler in the callback of an iteration (`Effect.forEach(items, (item) => ... Effect.catch ...)`)
+// handles each element on its own; moved to the `Effect.fn` pipeables, the first failure would stop
+// them all. Other callbacks (`flatMap`, `tap`) stay on the success path and are still reported.
+const isInsideIterationCallback = (node) => {
+    for (let fn = nearestFunction(node); fn && !isEffectGenerator(fn); fn = nearestFunction(fn)) {
+        const call = fn.parent;
+        if (call?.type === "CallExpression" &&
+            iterationCombinators.has(memberOf(call.callee, "Effect") ?? "")) {
+            return true;
+        }
+    }
+    return false;
+};
 export const errorHandlingInEffectFnHandlerRule = defineRule({
     meta: {
         type: "suggestion",
@@ -56,7 +132,9 @@ export const errorHandlingInEffectFnHandlerRule = defineRule({
                 if (inTestFile ||
                     name === undefined ||
                     !errorHandlers.has(name) ||
-                    !isInsideEffectGeneratorBody(node)) {
+                    !isInsideEffectGeneratorBody(node) ||
+                    isInsideIterationCallback(node) ||
+                    isDieOnlyCatch(node, name)) {
                     return;
                 }
                 context.report({ node, messageId: "handlerInGenerator", data: { name } });

package/dist/rules/no-bare-error-in-effect.js

@@ -1,20 +1,35 @@
 import { defineRule } from "@oxlint/plugins";
 import { calleeOf, isEffectGenerator, nearestFunction } from "../shared/effect-ast.js";
+import { filePatternsSchema } from "../shared/file-globs.js";
+import { isTestFile } from "../shared/test-files.js";
 // Only the two forms the effecttsgo preset misses: `Effect.fail(new Error(…))` and
 // `extends Error` are already reported by global-error-in-effect-failure and extends-native-error.
 export const noBareErrorInEffectRule = defineRule({
     meta: {
         type: "problem",
         docs: {
-            description: "Fail Effects with tagged errors, never with a `throw` or a primitive value.",
+            description: "Fail Effects with tagged errors, never with a `throw` or a primitive value. Primitive failures in test files are allowed.",
         },
         messages: {
             throwInGenerator: "A `throw` inside an Effect generator becomes a defect: `return yield* new TaggedError(...)` instead.",
             primitiveFailure: "Fail with a tagged error (`Data.TaggedError` or `Schema.TaggedError`), not a primitive value.",
         },
+        schema: [
+            {
+                type: "object",
+                properties: { testFiles: filePatternsSchema },
+                additionalProperties: false,
+            },
+        ],
     },
     createOnce(context) {
+        let inTestFile = false;
         return {
+            // A test's synthetic failure (`Effect.fail("boom")`) feeds code generic over the error,
+            // which never discriminates it; a `throw` is still a defect there.
+            before() {
+                inTestFile = isTestFile(context);
+            },
             ThrowStatement(node) {
                 const fn = nearestFunction(node);
                 if (fn !== undefined && isEffectGenerator(fn)) {
@@ -22,7 +37,7 @@ export const noBareErrorInEffectRule = defineRule({
                 }
             },
             CallExpression(node) {
-                if (calleeOf(node, "Effect") !== "fail")
+                if (inTestFile || calleeOf(node, "Effect") !== "fail")
                     return;
                 const [failure] = node.arguments;
                 if (failure?.type === "Literal" || failure?.type === "TemplateLiteral") {

package/dist/rules/no-manual-discriminant-comparison.js

@@ -3,6 +3,16 @@ import { configuredDiscriminants, discriminantOf, discriminantsSchema, isEqualit
 export const remedyFor = (discriminant) => discriminant === "_tag"
     ? "`Match.tagsExhaustive`, the tagged enum `$match` or an exhaustive ts-pattern match; for a single check, `Predicate.isTagged`"
     : `\`Match.discriminatorsExhaustive("${discriminant}")\` or an exhaustive ts-pattern match`;
+// Effect's own two-variant types cannot gain a variant: their refinements are the remedy.
+const effectVariants = {
+    Success: { owner: "`Result`/`Exit`", guard: "`Result.isSuccess` or `Exit.isSuccess`" },
+    Failure: { owner: "`Result`/`Exit`", guard: "`Result.isFailure` or `Exit.isFailure`" },
+    Left: { owner: "`Either`", guard: "`Either.isLeft`" },
+    Right: { owner: "`Either`", guard: "`Either.isRight`" },
+    Some: { owner: "`Option`", guard: "`Option.isSome`" },
+    None: { owner: "`Option`", guard: "`Option.isNone`" },
+};
+const effectVariantOf = (tag) => Object.hasOwn(effectVariants, tag) ? { tag, ...effectVariants[tag] } : undefined;
 export const noManualDiscriminantComparisonRule = defineRule({
     meta: {
         type: "suggestion",
@@ -11,6 +21,7 @@ export const noManualDiscriminantComparisonRule = defineRule({
         },
         messages: {
             manualComparison: "Comparing `{{discriminant}}` with a literal still compiles when a variant is added: use {{remedy}}.",
+            effectVariantComparison: 'For the `"{{tag}}"` variant of {{owner}}, use {{guard}}; for a union of your own, {{remedy}}.',
             manualSwitch: "A `switch` on `{{discriminant}}` still compiles when a variant is added: use {{remedy}}.",
         },
         schema: [
@@ -23,15 +34,23 @@ export const noManualDiscriminantComparisonRule = defineRule({
     },
     createOnce(context) {
         let discriminants = new Set();
-        const report = (node, discriminant, messageId) => {
+        const report = (node, discriminant, messageId, literal) => {
             // Inside `Effect.catch` handlers, `_tag` belongs to `anti-slop-no-manual-effect-error-tag`.
             if (discriminant === "_tag" && isInsideBroadEffectHandler(node))
                 return;
-            context.report({
-                node,
-                messageId,
-                data: { discriminant, remedy: remedyFor(discriminant) },
-            });
+            const remedy = remedyFor(discriminant);
+            const variant = discriminant === "_tag" && literal !== undefined
+                ? effectVariantOf(literal)
+                : undefined;
+            if (variant !== undefined) {
+                context.report({
+                    node,
+                    messageId: "effectVariantComparison",
+                    data: { ...variant, remedy },
+                });
+                return;
+            }
+            context.report({ node, messageId, data: { discriminant, remedy } });
         };
         return {
             before() {
@@ -40,13 +59,17 @@ export const noManualDiscriminantComparisonRule = defineRule({
             BinaryExpression(node) {
                 if (!isEqualityComparison(node))
                     return;
-                const discriminant = isStringLiteral(node.right)
-                    ? discriminantOf(node.left, discriminants)
+                const literal = isStringLiteral(node.right)
+                    ? node.right
                     : isStringLiteral(node.left)
-                        ? discriminantOf(node.right, discriminants)
+                        ? node.left
                         : undefined;
+                if (literal === undefined)
+                    return;
+                const subject = literal === node.right ? node.left : node.right;
+                const discriminant = discriminantOf(subject, discriminants);
                 if (discriminant !== undefined)
-                    report(node, discriminant, "manualComparison");
+                    report(node, discriminant, "manualComparison", literal.value);
             },
             SwitchStatement(node) {
                 const discriminant = discriminantOf(node.discriminant, discriminants);

package/dist/rules/no-manual-discriminant-construction.js

@@ -1,5 +1,5 @@
 import { defineRule } from "@oxlint/plugins";
-import { calleeOf } from "../shared/effect-ast.js";
+import { calleeOf, isFunctionNode } from "../shared/effect-ast.js";
 import { configuredDiscriminants, discriminantsSchema, isStringLiteral, propertyName, } from "../shared/tagged-values.js";
 export const remedyFor = (discriminant) => discriminant === "_tag"
     ? "the Schema's tagged `.make`, the tagged class or error constructor, or the `Data.taggedEnum` variant constructor"
@@ -29,8 +29,47 @@ const isSchemaCodecApplication = (call) => {
     const method = calleeOf(call.callee, "Schema");
     return method !== undefined && (method.startsWith("decode") || method.startsWith("encode"));
 };
-// A literal nested in a pattern or in a codec input belongs to it as much as the outermost one.
-const isPatternOrCodecInput = (node) => {
+// `expect(x).toMatchObject(…)`, `expect(x).not.toEqual(…)`, `expect.objectContaining(…)`: the
+// literal describes the expected shape, and a partial match has no constructor to call.
+const isAssertionExpectation = (call) => {
+    if (call.callee.type !== "MemberExpression")
+        return false;
+    let link = call.callee;
+    while (link.type === "MemberExpression" || link.type === "CallExpression") {
+        link = link.type === "MemberExpression" ? link.object : link.callee;
+    }
+    return link.type === "Identifier" && link.name === "expect";
+};
+// `JSON.stringify({ _tag: "NotReady" })`: the literal is the serialized form, which no constructor builds.
+const isJsonSerialization = (call) => calleeOf(call, "JSON") === "stringify";
+const declaredFunction = (name, scope) => {
+    for (let current = scope; current; current = current.upper) {
+        const definition = current.set.get(name)?.defs[0];
+        if (definition === undefined)
+            continue;
+        const declared = definition.node.type === "VariableDeclarator" ? definition.node.init : definition.node;
+        return isFunctionNode(declared) ? declared : undefined;
+    }
+    return undefined;
+};
+// `readinessAgainst(503, { _tag: "NotReady" })` with `readinessAgainst` declared in the file as
+// `(status: number, body: unknown) => …`: the author declared the argument raw data, such as the
+// body a fake HTTP server answers with. Without types, a function imported from elsewhere is not seen.
+const isUnknownArgument = (call, argument, sourceCode) => {
+    if (call.callee.type !== "Identifier")
+        return false;
+    const index = call.arguments.findIndex((candidate) => candidate === argument);
+    if (call.arguments.slice(0, index).some((candidate) => candidate.type === "SpreadElement")) {
+        return false;
+    }
+    const fn = declaredFunction(call.callee.name, sourceCode.getScope(call));
+    const parameter = fn?.params[index];
+    const binding = parameter?.type === "AssignmentPattern" ? parameter.left : parameter;
+    return (binding?.type === "Identifier" &&
+        binding.typeAnnotation?.typeAnnotation.type === "TSUnknownKeyword");
+};
+// A literal nested in a pattern, in an expectation or in raw input belongs to it as much as the outermost one.
+const isPatternExpectationOrRawInput = (node, sourceCode) => {
     let child = node;
     let current = node.parent;
     while (current?.type === "Property" ||
@@ -43,7 +82,10 @@ const isPatternOrCodecInput = (node) => {
         current.arguments.some((argument) => argument === child) &&
         (isMatchPatternCall(current) ||
             isTsPatternWithCall(current) ||
-            isSchemaCodecApplication(current)));
+            isAssertionExpectation(current) ||
+            isSchemaCodecApplication(current) ||
+            isJsonSerialization(current) ||
+            isUnknownArgument(current, child, sourceCode)));
 };
 export const noManualDiscriminantConstructionRule = defineRule({
     meta: {
@@ -75,7 +117,7 @@ export const noManualDiscriminantConstructionRule = defineRule({
                     const discriminant = propertyName(property);
                     if (discriminant === undefined || !discriminants.has(discriminant))
                         continue;
-                    if (isPatternOrCodecInput(node))
+                    if (isPatternExpectationOrRawInput(node, context.sourceCode))
                         return;
                     context.report({
                         node: property,

package/dist/rules/no-provide-on-definition.js

@@ -1,5 +1,6 @@
 import { defineRule } from "@oxlint/plugins";
 import { calleeOf, isEffectFnApplication } from "../shared/effect-ast.js";
+import { runnerName } from "../shared/effect-runners.js";
 import { filePatternsSchema } from "../shared/file-globs.js";
 import { isTestFile } from "../shared/test-files.js";
 const pipeReceiver = (call) => {
@@ -54,6 +55,32 @@ const providedDefinition = (provide) => {
         return true;
     return parent.arguments.includes(provide) && isProgramDefinition(pipeReceiver(parent));
 };
+const isRunnerCall = (node) => node?.type === "CallExpression" &&
+    node.callee.type === "MemberExpression" &&
+    runnerName(node.callee) !== undefined;
+// The expression a `.pipe(…)` or a data-first `Effect.*` combinator builds around `node`.
+const enclosingProgram = (node) => {
+    const { parent } = node;
+    if (parent?.type === "MemberExpression" && parent.object === node) {
+        const call = parent.parent;
+        return call?.type === "CallExpression" && pipeReceiver(call) === node ? call : undefined;
+    }
+    return parent?.type === "CallExpression" &&
+        parent.arguments.some((argument) => argument === node) &&
+        (pipeReceiver(parent) !== undefined || calleeOf(parent, "Effect") !== undefined) &&
+        !isRunnerCall(parent)
+        ? parent
+        : undefined;
+};
+// A program handed straight to `Effect.run*` has no caller to wire it: it is being dispatched.
+const isDispatchedInline = (provide) => {
+    let program = provide;
+    for (let outer = enclosingProgram(program); outer; outer = enclosingProgram(program)) {
+        program = outer;
+    }
+    const { parent } = program;
+    return isRunnerCall(parent) && parent.arguments.some((argument) => argument === program);
+};
 // A program that provides its own layers can no longer be wired differently by its caller:
 // the dispatch that picks the adapters is where `Effect.provide` belongs.
 export const noProvideOnDefinitionRule = defineRule({
@@ -85,7 +112,9 @@ export const noProvideOnDefinitionRule = defineRule({
                     return;
                 // A Layer that captures its context with `Effect.context()` hands it back to each
                 // method: the caller already chose the adapters when it built the Layer.
-                if (providedDefinition(node) && !isCapturedContext(providedValue(node))) {
+                if (providedDefinition(node) &&
+                    !isCapturedContext(providedValue(node)) &&
+                    !isDispatchedInline(node)) {
                     context.report({ node, messageId: "provideOnDefinition" });
                 }
             },

package/dist/rules/prefer-effect-vitest.d.ts

@@ -0,0 +1 @@
+export declare const preferEffectVitestRule: import("@oxlint/plugins").Rule;

package/dist/rules/prefer-effect-vitest.js

@@ -0,0 +1,52 @@
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { defineRule } from "@oxlint/plugins";
+import { runnerName } from "../shared/effect-runners.js";
+import { filePatternsSchema } from "../shared/file-globs.js";
+import { isTestFile } from "../shared/test-files.js";
+// Without `@effect/vitest` the remedy is out of reach, so the rule stays silent. Not cached:
+// a long-lived linter would miss a later install, and only test files pay for the lookup.
+const isEffectVitestInstalled = (filename) => {
+    for (let dir = dirname(filename);; dir = dirname(dir)) {
+        if (existsSync(join(dir, "node_modules", "@effect", "vitest", "package.json")))
+            return true;
+        if (dirname(dir) === dir)
+            return false;
+    }
+};
+// Reports references too, not only calls: `const run = Effect.runPromise` escapes nothing.
+export const preferEffectVitestRule = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Run Effects in tests through `@effect/vitest`. Only test files of projects that install it are checked.",
+        },
+        messages: {
+            runInTest: "`{{name}}` runs an Effect program in a test: let `@effect/vitest` run it, so the test gets the test runtime and its fixtures become Layers.",
+        },
+        schema: [
+            {
+                type: "object",
+                properties: { testFiles: filePatternsSchema },
+                additionalProperties: false,
+            },
+        ],
+    },
+    createOnce(context) {
+        let checked = false;
+        return {
+            before() {
+                checked =
+                    isTestFile(context) &&
+                        isEffectVitestInstalled(resolve(context.cwd, context.filename));
+            },
+            MemberExpression(node) {
+                if (!checked)
+                    return;
+                const name = runnerName(node);
+                if (name !== undefined)
+                    context.report({ node, messageId: "runInTest", data: { name } });
+            },
+        };
+    },
+});

package/dist/rules/redacted-secret-names.js

@@ -18,9 +18,7 @@ const isRedactedSchema = (node) => node?.type === "CallExpression" &&
     (memberOf(node.callee, "Schema")?.startsWith("Redacted") ?? false);
 const isRedactedConfig = (node) => {
     const name = calleeOf(node, "Config");
-    return (name === "redacted" ||
-        (name === "schema" && isRedactedSchema(node.arguments[0])) ||
-        calleeOf(node.parent, "Config") === "redacted");
+    return name === "Redacted" || (name === "schema" && isRedactedSchema(node.arguments[0]));
 };
 const isRedactedReference = (node) => (memberOf(node, "Schema") ?? calleeOf(node, "Schema"))?.startsWith("Redacted") ?? false;
 // `Schema.String`, `Schema.NonEmptyString.check(…)`, `Schema.optional(Schema.String)`: a schema
@@ -68,7 +66,7 @@ export const redactedSecretNamesRule = defineRule({
             description: "Read configuration values and declare Schema fields whose name looks like a secret as `Redacted`.",
         },
         messages: {
-            notRedacted: "`{{name}}` looks like a secret: read it with `Config.redacted` or `Config.schema(Schema.Redacted(...), name)`.",
+            notRedacted: "`{{name}}` looks like a secret: read it with `Config.Redacted` or `Config.schema(Schema.Redacted(...), name)`.",
             fieldNotRedacted: "`{{name}}` looks like a secret: declare it as `Schema.Redacted(...)` so it stays out of logs.",
         },
         schema: [

package/dist/rules/run-only-in-runner.d.ts

@@ -0,0 +1 @@
+export declare const runOnlyInRunnerRule: import("@oxlint/plugins").Rule;

package/dist/rules/{run-only-at-entry.js → run-only-in-runner.js}

@@ -1,45 +1,35 @@
 import { defineRule } from "@oxlint/plugins";
-import { memberOf } from "../shared/effect-ast.js";
+import { runnerName } from "../shared/effect-runners.js";
 import { isEntryFile } from "../shared/entry-files.js";
 import { filePatternsSchema } from "../shared/file-globs.js";
-const runtimeEntries = [
-    ["NodeRuntime", "runMain"],
-    ["BunRuntime", "runMain"],
-    ["ManagedRuntime", "make"],
-];
-const runnerName = (node) => {
-    const effectMember = memberOf(node, "Effect");
-    if (effectMember?.startsWith("run"))
-        return `Effect.${effectMember}`;
-    const entry = runtimeEntries.find(([object, property]) => memberOf(node, object) === property);
-    return entry === undefined ? undefined : `${entry[0]}.${entry[1]}`;
-};
+import { isTestFile } from "../shared/test-files.js";
 // Reports references too, not only calls: `const run = Effect.runPromise` escapes nothing.
-export const runOnlyAtEntryRule = defineRule({
+export const runOnlyInRunnerRule = defineRule({
     meta: {
         type: "problem",
         docs: {
-            description: "Run Effect programs only at the entry point. Entry files are skipped.",
+            description: "Run Effect programs only at the entry point. Entry and test files are skipped.",
         },
         messages: {
-            runOutsideEntry: "`{{name}}` runs an Effect program: only the entry point may do that. Tests use `it.effect`, or a single test runner listed in `entryFiles`.",
+            runOutsideEntry: "`{{name}}` runs an Effect program: only the entry point may do that.",
         },
         schema: [
             {
                 type: "object",
-                properties: { entryFiles: filePatternsSchema },
+                properties: { entryFiles: filePatternsSchema, testFiles: filePatternsSchema },
                 additionalProperties: false,
             },
         ],
     },
     createOnce(context) {
-        let inEntryFile = false;
+        let skipped = false;
         return {
+            // How tests run their Effects is `prefer-effect-vitest`'s concern.
             before() {
-                inEntryFile = isEntryFile(context);
+                skipped = isEntryFile(context) || isTestFile(context);
             },
             MemberExpression(node) {
-                if (inEntryFile)
+                if (skipped)
                     return;
                 const name = runnerName(node);
                 if (name !== undefined)