@veda-hq/pariksha 0.5.17 → 0.5.19

package/README.md

@@ -4,8 +4,8 @@
 test-quality ratchets. Part of [Veda](https://github.com/veda-hq/veda).
 
 ```sh
-npx @veda-hq/pariksha@0.5.17 <check> [flags]
-npx @veda-hq/pariksha@0.5.17 --version
+npx @veda-hq/pariksha@0.5.19 <check> [flags]
+npx @veda-hq/pariksha@0.5.19 --version
 ```
 
 Every check exits 0 when the repository passes, 1 when it refuses something
@@ -467,6 +467,44 @@ config (an unknown, missing or bad key or pattern), a malformed baseline, no
 `node_modules/.bin` (DOC-DRIFT-02 would know no bin), a missing or failing
 lychee, a `--base` with no merge base, or a failed git call.
 
+## `duplicate-tests`
+
+```sh
+pariksha duplicate-tests [--config <file>] [--files-from <file>|-] [--root <dir>]
+```
+
+A test copied rather than written: two tests whose matchers, names and
+describe paths score at or above the threshold (default 0.85; across two
+files never below 0.95). The score weighs the matcher set (`expect()` and
+every `.to…()` call in the test, Jaccard) at 50%, the name at 20% and the
+describe path at 30% (edit distance); `describe(X.name)` names its block `X`,
+and two tests in no describe block compare their file stems. A pair is not
+compared when either test has fewer than three matcher calls, either name is
+generic (`should return`, …), the names are opposite cases (an opposite
+pair, other HTTP methods or statuses, other uppercase `AND`/`OR`, another
+endpoint), or, in one file, either name has a word the other lacks or the
+same words come in another order.
+
+Without `--files-from` every tracked file on disk is listed; with it, the
+listed paths (one per line or NUL-separated, relative to the root or
+absolute; `-` reads stdin). A listed path counts when `include` matches it
+relative to the root. A file that cannot be read warns on stderr and is
+skipped; a file that does not parse prints `❌ Parse error:` on stderr and
+gives no tests. The report goes to stdout. The JSON `--config` (relative to
+the root) replaces each default it names:
+
+- `include` (default `\.(test|spec)\.(ts|tsx|js|jsx)$`): which paths are tests.
+- `threshold` (default `0.85`).
+- `commonNames`: names too generic to compare, lowercased.
+- `oppositePairs`: `[word, word]` pairs that mark two names as opposite
+  cases (the default holds fifteen, such as `success`/`failure` and
+  `valid`/`invalid`). Names are lowercased before they are matched, so a pair
+  must be lowercase to match.
+
+Needs `typescript` `>=5.4 <6`, as `coverage-by-type` does. A `.ts` file is
+read as TypeScript and the rest as TSX; a `.ts` file that only parses as
+TSX is read so, and one with a `<T>value` assertion gives no tests.
+
 ## `enforcement-claims`
 
 ```sh
@@ -740,6 +778,88 @@ root-relative POSIX path, a check not in `checks`, an `exemptIn` group
 baseline, a root holding no tracked file, a group discovering nothing, no
 base without `--no-base`, a failed git call, or no `typescript`.
 
+## `flaky-tests`
+
+```sh
+pariksha flaky-tests [--config <file>] [--files-from <file>|-] [--runs <n>] [--root <dir>]
+```
+
+Runs the test files `--runs` times (default 5, at most 1000) with
+`npx vitest run --reporter=json --passWithNoTests`, the files under each
+package root together from that root and the rest from the repository root,
+and judges every run's JSON report strictly (a report that breaks Vitest's
+contract, or a clean exit with no report or one saying `success: false`, is
+not trusted). The verdicts, each exiting 1 but the last:
+
+1. a run exited non-zero without collecting a test case (an unloadable file,
+   a crashed runner): the runner output is printed, and any flaky test seen
+   in the other runs below it;
+2. a test passed in some runs and failed in others: flaky;
+3. every run failed, or a test failed in every run: not flaky, but broken;
+4. every run passed: `✅ No flaky tests found across N test cases.`
+
+The files are listed as for `duplicate-tests`. The JSON `--config` (relative
+to the root) replaces each default it names:
+
+- `include` (default `\.(test|spec)\.(ts|tsx|js|jsx)$`): which paths are tests.
+- `packageRoots` (default none): directories, relative to the root, whose
+  files Vitest runs from that directory, with its config.
+- `exclude` (default none): globs passed to Vitest as `--exclude`.
+
+## `masked-exit-codes`
+
+```sh
+pariksha masked-exit-codes [--config <file>] [--staged] [--root <dir>]
+```
+
+A gate that keeps reporting success after it stopped checking passes
+everything: a hook that runs a commit-message linter and then `exit 0`, a
+review step whose failures read as "no issues found", a baseline read with
+`2>/dev/null || true`. `|| true` has honest uses (an optional tool, grep's
+"no matches"), so this refuses only the shapes that silence a gate command's
+verdict:
+
+1. `exit 0` at the end of a script that ran a gate, with no branch on the
+   gate's status;
+2. `|| true`, a `||` handler that does not exit non-zero, or `2>/dev/null`
+   with the status unchecked, on a gate command, also in a script the line
+   hands a shell (`eval '…'`, `bash -c '…'`, what `echo`/`printf` pipes
+   into `sh`) and inside `$( … )`;
+3. in a file `pipefailScope` matches, `echo`/`printf` of a variable piped
+   into a reader that stops early (`grep -q`, `-m`, `-l`, `head`): under
+   pipefail the writer can fail after the match, which reads as a miss.
+
+The files are those git tracks under the root ending `.sh` or under a hook
+directory, outside `node_modules/`, read from the working tree, or the index
+with `--staged`. Comments, quoted text, heredoc bodies and continuation lines
+are read as bash reads them. The JSON `--config` (relative to the root) is
+optional:
+
+```json
+{
+  "id": "SH-001",
+  "gateCommands": ["eslint", "tsc", "vitest", "prettier --check", "commitlint", "run-validation.sh"],
+  "hookDirs": [".husky/"],
+  "pipefailScope": ["^\\.husky/", "^scripts/lib/.+\\.sh$"]
+}
+```
+
+- `id` (default `masked-exit-codes`) names the check in its messages.
+- `gateCommands` (default `eslint`, `tsc`, `vitest`, `prettier --check`,
+  `commitlint`, `cubic review`, `gitleaks`, `actionlint`, `shellcheck`,
+  `depcruise`, `stryker`) are the commands whose status is a verdict; one of
+  several words must appear whole. Keep it narrow: a broad list fires on
+  every optional-tool probe.
+- `hookDirs` (default `.husky/`) are path prefixes whose files are shell
+  whatever their name.
+- `pipefailScope` (default `^\.husky/`) are path regexes: the files that run
+  under `set -o pipefail`.
+
+A clean run prints `✅ <id>: no masked exit codes (N shell file(s) scanned)`
+to stdout; each finding goes to stderr with its line and why, and exits 1.
+No shell file at all exits 1 (`the file lookup failed`), as the original
+did; a bad config or a failed git call exits 2.
+
 ## `non-synced-resources`
 
 ```sh
@@ -869,6 +989,93 @@ Parsing those is the job of a command guard such as kavach's `git_safety`.
 project's settings and then also skips the user's own `defaultMode`, so it
 belongs in user settings only.
 
+## `shell-gates`
+
+```sh
+pariksha shell-gates [--config <file>] [--staged | --all | --base <ref> | --files-from <file>|-] [--only <checks>] [--root <dir>]
+```
+
+A shell script that works on its writer's Mac can fail on Linux CI, and a
+git hook that picks up whatever `node` is on PATH can run a check under the
+wrong runtime. This runs three gates over the shell files a change writes:
+
+1. ShellCheck, a binary on PATH (install it: <https://www.shellcheck.net>),
+   once per pass, by default `--severity=warning`, then `--severity=info
+   --include=SC2086,SC2013,SC2015` (an unquoted expansion, `for x in $(cat
+   f)`, `a && b || c`). Its targets are `*.sh`, `*.bash`, the hooks
+   directory's direct children without an extension, and extensionless
+   files whose first line is a sh, bash, dash or ksh `#!`. Staged mode
+   writes the index's copy of each to a temporary directory and judges
+   that; base mode judges the HEAD commit's copy of what the branch changed
+   since its merge base with `<ref>`; `--all` judges the working tree; files
+   mode passes the listed paths as they are.
+2. The hook preamble, over the hooks directory's direct children without an
+   extension. A hook must source `selectScript` and call `selectFunction`
+   (with `|| exit 1`, or a branch that exits) before it runs a runtime
+   (`runtimes`, by default `node`, `npx`, `pnpm`, `npm`, `tsx`, `corepack`,
+   `yarn`), here or in a function it calls; an opt-out (`[ "$X" = 0 ] &&
+   exit 0`) comes before that selection; it never edits PATH or drives
+   nvm, fnm or mise itself; it never `exec sh <hook>`s (that ignores the
+   target's shebang); and an INT, TERM, HUP or QUIT trap's handler ends in
+   `exit`, or bash resumes after it and a cancelled hook carries on.
+3. The pitfalls, over every shell target: `grep -E` or `egrep` with `\s`,
+   `\S`, `\d` or `\D` (not POSIX ERE: BSD grep matches nothing); GNU-only
+   `xargs -d`/`-r`; `xargs` without `-0` fed a file list; file operands
+   after `xargs`, or a list expansion to grep, without `--`; `<( … )` in a
+   file `validatorPaths` matches; a literal `/tmp/<name>` (use `mktemp`);
+   an unguarded `/opt/homebrew` or `/Users/` literal, a fixed `-avd
+   <name>`, a personal device name; `NVM_DIR` set without honouring an
+   existing one; `lockf` without `-k`; `$(( … ))` over a value from `read`
+   or `date` without `10#` (`08` is bad octal); `dirname "$0"` beside
+   `BASH_SOURCE`; `git worktree list` parsed without `--porcelain`; and
+   `grep -o` over a JSON `"key":`. Comments, quoted text and heredoc bodies
+   are read as bash reads them.
+
+The preamble and pitfalls judge the same kind of target, less `exclude`
+and symlinks: `--staged` (the default) the staged copies, `--base` the
+files changed since the merge base with `<ref>` (read from the working
+tree), `--all` every tracked one, `--files-from` the listed paths (one per
+line or NUL-separated; a file, or `-` for stdin). A change under
+`gateInputs` (staged, or on the branch) re-judges every target, and a
+staged change to a `shellcheck.inputs` path makes ShellCheck judge the
+whole index. `--only preamble,pitfalls` runs
+only those checks, and no ShellCheck. The JSON `--config` (relative to the
+root) is optional:
+
+```json
+{
+  "hooksDir": ".husky/",
+  "exclude": ["node_modules/", ".husky/_/", "vendor/"],
+  "gateInputs": ["scripts/validations/shell/"],
+  "preamble": { "id": "SHELL-06", "selectScript": "scripts/lib/select-node.sh", "selectFunction": "select_node" },
+  "pitfalls": { "id": "SHELL-03", "validatorPaths": ["^scripts/validations/"] },
+  "shellcheck": { "inputs": ["scripts/run-validation.sh"], "install": "run the machine setup (or: brew install shellcheck)" },
+  "guidance": ["", "   SHELL-06 and SHELL-03 are described in docs/shell.md."]
+}
+```
+
+- `hooksDir` (default `.husky/`, ending in `/`) is the git hooks directory.
+- `exclude` (default `node_modules/`, `.husky/_/`) are path prefixes never
+  judged by the preamble and pitfalls; a `/node_modules/` segment never is.
+- `gateInputs` (default none) are path prefixes of the gate's own inputs.
+- `preamble` (default none, which leaves only the pitfalls to run):
+  `selectScript` and `selectFunction` are required; `id` defaults to
+  `hook-preamble`, `runtimes` to the list above.
+- `pitfalls`: `id` (default `shell-pitfalls`) and `validatorPaths` (path
+  regexes, default none).
+- `shellcheck`: `passes` (lists of flags after `--norc`; `[]` runs no
+  ShellCheck), `inputs` (default none) and `install`, the text a missing
+  ShellCheck message gives.
+- `guidance` (default a pointer to this section) is printed after the
+  findings.
+
+ShellCheck's own report comes first, then `✅ Shell gates: N file(s) pass
+<checks>`, or `❌ Shell gates: N finding(s) in M file(s)` on stderr with
+each finding as `file:line  <id> <rule>` and its message, then the
+guidance. It exits 1 on any ShellCheck or rule finding, or when ShellCheck
+is not installed; 2 on a bad config, two modes, an empty list, or a
+selection or git failure, since nothing was checked.
+
 ## markdownlint rules
 
 ```jsonc

package/dist/cli.js

@@ -7,11 +7,13 @@ import { fileURLToPath } from 'node:url';
 import { checkAbsolutePaths, DEFAULT_GUIDANCE as ABSOLUTE_PATHS_GUIDANCE } from "./absolute-paths.js";
 import { checkGates, DEFAULT_GATE_CONFIG, parseGateConfig as parseAggregateConfig } from "./aggregate-gate-needs.js";
 import { parseDocConfig, readDoc, selectDocs } from "./doc-files.js";
+import { DEFAULT_MASKED_CONFIG, findMaskedExits, formatMasked, parseMaskedConfig, readerFor as maskedReaderFor, shellFiles } from "./masked-exit-codes.js";
 import { checkNonSyncedResources, DEFAULT_GUIDANCE as NON_SYNCED_GUIDANCE } from "./non-synced-resources.js";
+import { ALL_CHECKS as SHELL_CHECKS, parseGatesConfig, runShellGates, shellcheckRunner } from "./shell-gates.js";
 import { checkPnpmSettings, DEFAULT_PNPM_CONFIG, formatParity, parsePnpmConfig } from "./pnpm-settings.js";
 import { adrDirOf, DEFAULTS, findUncited, formatClaims, listAdrs, readOrUndefined, stagedSource, treeSource } from "./authority-citations.js";
 import { findDenied, hash, isText, parseDenyList } from "./boundary.js";
-import { DEFAULT_CONFIG, findGaps, formatGaps, listedPaths, parseConfig, treePaths } from "./coverage-by-type.js";
+import { DEFAULT_CONFIG, entries, findGaps, formatGaps, listedPaths, parseConfig, treePaths } from "./coverage-by-type.js";
 import { checkBuild, checkPackage, checkVitest, formatViolations, loaderFailure, loadVitestExclude, missingConfigs, ownedBy, parseConfig as parseExemptions } from "./coverage-exemptions.js";
 import { checkBudgets } from "./doc-budgets.js";
 import { lycheeRunner } from "./doc-links.js";
@@ -27,6 +29,8 @@ import { discover as discoverCodecs, fileOf as codecFileOf, findings as codecFin
 import { discoverGroup, findings as faultFindings, formatFindings as formatFaultFindings, parseBaseline as parseFaultBaseline, parseConfig as parseFaultConfig } from "./fault-injection-registry.js";
 import { emptyRoots, growthSince, readBaseline, wholeId } from "./registry-ratchet.js";
 import { checkClaims, formatOutcome, loadEslint, parseConfig as parseClaimsConfig } from "./enforcement-claims.js";
+import { parseConfig as parseDuplicateConfig, runDuplicateTests } from "./duplicate-tests.js";
+import { DEFAULT_RUNS, npxVitest, parseConfig as parseFlakyConfig, parseRuns, runFlakyTests } from "./flaky-tests.js";
 export const DENY_FILE = '.veda/deny.sha256';
 const USAGE = [
     'usage: pariksha authority-citations [--mode staged|tree] [--authority <a,b>] [--issue-prefix <A,B>] [--adr-dir <dir>] [--root <dir>]',
@@ -38,13 +42,17 @@ const USAGE = [
     '       pariksha coverage-exemptions --config <file> [--package <dir>] [--root <dir>]',
     '       pariksha doc-budgets --table <file> [--section <name>] [--root <dir>]',
     '       pariksha doc-references --config <file> (--staged | --base <ref> [--head <ref>] | --all [--update-baseline | --write-baseline]) [--checks <ids>] [--root <dir>]',
+    '       pariksha duplicate-tests [--config <file>] [--files-from <file>|-] [--root <dir>]',
     '       pariksha enforcement-claims --config <file> [--root <dir>]',
     '       pariksha env-gate-switches --config <file> [--mode staged|tree] [--root <dir>]',
     '       pariksha export-deletions [--base <ref>] [--root <dir>]',
     '       pariksha fault-injection-registry --config <file> [--base <ref> | --no-base] [--root <dir>]',
+    '       pariksha flaky-tests [--config <file>] [--files-from <file>|-] [--runs <n>] [--root <dir>]',
+    '       pariksha masked-exit-codes [--config <file>] [--staged] [--root <dir>]',
     '       pariksha non-synced-resources [--config <file>] [--files-from <file>|-] [--root <dir>]',
     '       pariksha pnpm-settings [--config <file>] [--root <dir>]',
     '       pariksha required-settings --require <file> [--settings <file>] [--root <dir>]',
+    '       pariksha shell-gates [--config <file>] [--staged | --all | --base <ref> | --files-from <file>|-] [--only <checks>] [--root <dir>]',
     '       pariksha hash <word>',
     '       pariksha --version',
 ].join('\n');
@@ -120,6 +128,76 @@ const nonSyncedResources = docCheck('non-synced-resources', NON_SYNCED_GUIDANCE,
         throw new Error(`${base} is not in a git repository`);
     return top;
 }, config));
+/** Standard input, or the file `from` names, read whole. */
+const listFrom = (from, io) => (from === '-' ? (io.stdin ?? (() => readFileSync(0, 'utf8')))() : readFileSync(resolve(from), 'utf8'));
+/**
+ * masked-exit-codes: the shell files git tracks under `--root`, read from
+ * the working tree, or the index with `--staged`. The report goes to stdout
+ * when clean and stderr when not, as the original printed it.
+ */
+const maskedExitCodes = (f, io) => {
+    const root = resolve(f.get('--root') ?? '.');
+    try {
+        const configPath = f.get('--config');
+        const config = configPath === undefined ? DEFAULT_MASKED_CONFIG : parseMaskedConfig(readFileSync(resolve(root, configPath), 'utf8'));
+        const files = shellFiles(root, config);
+        const problems = files.length === 0 ? [] : findMaskedExits(root, files, maskedReaderFor(f.has('--staged')), config);
+        const result = formatMasked(problems, files.length, config.id);
+        result.out.forEach(io.out);
+        result.err.forEach(io.err);
+        return result.ok ? 0 : 1;
+    }
+    catch (e) {
+        io.err(`pariksha masked-exit-codes: ${e.message}; nothing was checked, so this is not a pass`);
+        return 2;
+    }
+};
+/**
+ * shell-gates: one of `--staged` (the default), `--all`, `--base <ref>` or
+ * `--files-from <file>|-`; `--only` names the checks to run, and then
+ * ShellCheck sits the run out, as the original did.
+ */
+const shellGates = (f, io) => {
+    const P = '❌ Shell gates could not run:';
+    const root = resolve(f.get('--root') ?? '.');
+    const modes = ['--staged', '--all', '--base', '--files-from'].filter((name) => f.has(name));
+    if (modes.length > 1) {
+        io.err(`${P} choose one of --staged, --all, --base, --files-from (got ${modes.join(', ')})`);
+        return 2;
+    }
+    let config;
+    let mode;
+    try {
+        const configPath = f.get('--config');
+        config = parseGatesConfig(configPath === undefined ? '{}' : readFileSync(resolve(root, configPath), 'utf8'));
+        const base = f.get('--base');
+        const from = f.get('--files-from');
+        if (from !== undefined) {
+            const files = entries(listFrom(from, io));
+            if (files.length === 0)
+                throw new Error('the --files-from list names no file, and a check of nothing is no pass');
+            mode = { kind: 'files', files };
+        }
+        else
+            mode = base !== undefined ? { kind: 'base', base } : f.has('--all') ? { kind: 'all' } : { kind: 'staged' };
+    }
+    catch (e) {
+        io.err(`${P} ${e.message}`);
+        return 2;
+    }
+    const only = f.get('--only');
+    let checks = SHELL_CHECKS.filter((name) => name !== 'preamble' || config.preamble !== undefined);
+    if (only !== undefined) {
+        const names = only.split(',').filter(Boolean);
+        const unknown = names.filter((name) => !SHELL_CHECKS.some((check) => check === name));
+        if (names.length === 0 || unknown.length > 0) {
+            io.err(`${P} --only takes ${SHELL_CHECKS.join(',')}; got ${names.join(',') || 'nothing'}`);
+            return 2;
+        }
+        checks = SHELL_CHECKS.filter((name) => names.includes(name));
+    }
+    return runShellGates({ root, mode, checks, only: only !== undefined }, config, { out: io.out, err: io.err, shellcheck: io.shellcheck ?? shellcheckRunner() });
+};
 const aggregateGateNeeds = (f, io) => {
     const root = resolve(f.get('--root') ?? '.');
     const configPath = f.get('--config');
@@ -620,6 +698,77 @@ const requiredSettings = (f, io) => {
     result.err.forEach(io.err);
     return result.ok ? 0 : 1;
 };
+/**
+ * The test files duplicate-tests and flaky-tests judge, relative to the root:
+ * those `--files-from` lists (mode `files`; a relative entry is read from the
+ * root), or every tracked file on disk (mode `all`), kept when `include`
+ * matches the root-relative path.
+ */
+const testFiles = (f, io, root, include) => {
+    const from = f.get('--files-from');
+    const listed = from === undefined
+        ? must(gitAt(root), ['ls-files', '-z'])
+            .split('\0')
+            .filter((p) => p && existsSync(join(root, p)))
+        : entries(from === '-' ? (io.stdin ?? (() => readFileSync(0, 'utf8')))() : readFileSync(resolve(from), 'utf8')).map((e) => relative(root, resolve(root, e)));
+    return { mode: from === undefined ? 'all' : 'files', files: listed.filter((p) => include.test(p)) };
+};
+/** duplicate-tests: the report on stdout, warnings and parse errors on stderr, as the original printed them. */
+const duplicateTests = (f, io) => {
+    const P = 'pariksha duplicate-tests:';
+    const dir = resolve(f.get('--root') ?? '.');
+    const root = topOf(dir);
+    if (root === undefined) {
+        io.err(`${P} ${dir} is not in a git repository`);
+        return 2;
+    }
+    const ts = (io.typescript ?? (() => loadTypescript(typescriptLoaders(root))))();
+    if (typeof ts === 'string') {
+        io.err(`${P} ${ts}`);
+        return 2;
+    }
+    try {
+        const configPath = f.get('--config');
+        const config = parseDuplicateConfig(configPath === undefined ? undefined : readFileSync(resolve(root, configPath), 'utf8'));
+        const { mode, files } = testFiles(f, io, root, config.include);
+        const listed = files.map((file) => ({ file, path: resolve(root, file), read: () => readFileSync(resolve(root, file), 'utf8') }));
+        const result = runDuplicateTests(ts, config, mode, listed);
+        result.out.forEach(io.out);
+        result.err.forEach(io.err);
+        return result.code;
+    }
+    catch (e) {
+        io.err(`${P} ${e.message}; nothing was checked, so this is not a pass`);
+        return 2;
+    }
+};
+/** flaky-tests: `--runs` passes (default 5) of Vitest over the test files, from each package root. */
+const flakyTests = (f, io) => {
+    const P = 'pariksha flaky-tests:';
+    const runsText = f.get('--runs');
+    const runs = runsText === undefined ? DEFAULT_RUNS : parseRuns(runsText);
+    if (runs === null) {
+        io.err('--runs must be an integer from 1 to 1000');
+        return 2;
+    }
+    const dir = resolve(f.get('--root') ?? '.');
+    const root = topOf(dir);
+    if (root === undefined) {
+        io.err(`${P} ${dir} is not in a git repository`);
+        return 2;
+    }
+    let selected;
+    try {
+        const configPath = f.get('--config');
+        const config = parseFlakyConfig(configPath === undefined ? undefined : readFileSync(resolve(root, configPath), 'utf8'));
+        selected = { config, ...testFiles(f, io, root, config.include) };
+    }
+    catch (e) {
+        io.err(`${P} ${e.message}; nothing was checked, so this is not a pass`);
+        return 2;
+    }
+    return runFlakyTests(selected.config, runs, selected.mode, root, selected.files, io.vitest ?? npxVitest, io.out);
+};
 const COMMANDS = {
     'codec-registry': { allowed: ['--config', '--base', '--root'], switches: ['--no-base'], run: codecRegistry },
     'coverage-exemptions': { allowed: ['--config', '--package', '--root'], run: coverageExemptions },
@@ -633,10 +782,14 @@ const COMMANDS = {
     'coverage-by-type': { allowed: ['--config', '--files-from', '--root'], run: coverageByType },
     'doc-budgets': { allowed: ['--table', '--section', '--root'], run: docBudgets },
     'doc-references': { allowed: ['--config', '--base', '--head', '--checks', '--root'], switches: ['--staged', '--all', '--update-baseline', '--write-baseline'], run: docReferences },
+    'duplicate-tests': { allowed: ['--config', '--files-from', '--root'], run: duplicateTests },
     'enforcement-claims': { allowed: ['--config', '--root'], run: enforcementClaims },
+    'flaky-tests': { allowed: ['--config', '--files-from', '--runs', '--root'], run: flakyTests },
     'env-gate-switches': { allowed: ['--config', '--mode', '--root'], run: envGateSwitches },
     'export-deletions': { allowed: ['--base', '--root'], run: exportDeletions },
+    'masked-exit-codes': { allowed: ['--config', '--root'], switches: ['--staged'], run: maskedExitCodes },
     'required-settings': { allowed: ['--require', '--settings', '--root'], run: requiredSettings },
+    'shell-gates': { allowed: ['--config', '--base', '--files-from', '--only', '--root'], switches: ['--staged', '--all'], run: shellGates },
 };
 /** The exit code; a Promise of it for the one check that is asynchronous (enforcement-claims, which loads ESLint). */
 export const run = (args, io, version = ownVersion(), env = process.env) => {