flagrm 0.2.1 → 0.4.0

package/dist/core/baseline.js

@@ -3,13 +3,15 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import fg from "fast-glob";
-import { CONFIG_FILENAMES } from "./config.js";
+import { changeFilter } from "./change-filter.js";
 import { configSnapshot, projectCommands } from "./config-snapshot.js";
 import { environmentProblem } from "./environment.js";
 import { changedFilesSince } from "./git.js";
 import { buildInventory } from "./inventory.js";
+import { withScopeFiles } from "./scope-files.js";
 import { JSON_SCHEMA_VERSION, READABLE_BASELINE_VERSIONS, } from "./types.js";
 import { readJson, relativePath } from "./util.js";
+import { parseTestLog } from "./verify/log-results.js";
 import { collectTestResults, shortTestNames } from "./verify/test-results.js";
 /**
  * `.flagrm/<flag>/` under the config root. A name that isn't safe as a directory
@@ -39,7 +41,7 @@ const MAX_FAILED_NAMES = 20;
  * `baseline.json` keeps everything.
  */
 export function baselineSummary(baseline, file) {
-    const { config: _config, checks, ...rest } = baseline;
+    const { config: _config, acceptedConfig: _accepted, checks, ...rest } = baseline;
     return {
         ...rest,
         ...(checks
@@ -84,10 +86,11 @@ export function readBaseline(root, flag) {
  * Run one shell command inside a project, streaming its output to `logFile`
  * (no buffer limit, stdout and stderr interleaved as printed). A command that
  * can't start, is killed or outlives the project's `timeout` fails with the
- * reason at the end of the log. A test run also reads the project's
- * `testResults` files written during it.
+ * reason at the end of the log. A test run also reads the `testResults`
+ * files (absolute path or glob) written during it, or without any, what its
+ * log says (`log-results.ts`).
  */
-export async function runCheck(ctx, check, command, logFile, claimed) {
+export async function runCheck(ctx, check, command, logFile, claimed, testResults) {
     const started = Date.now();
     fs.mkdirSync(path.dirname(logFile), { recursive: true });
     fs.writeFileSync(logFile, `$ ${command}\n`, "utf8");
@@ -110,14 +113,17 @@ export async function runCheck(ctx, check, command, logFile, claimed) {
         durationMs: Date.now() - started,
         log: logFile,
     };
+    if (reason)
+        run.interrupted = reason;
     if (run.exitCode !== 0) {
         const problem = environmentProblem(fs.readFileSync(logFile, "utf8"), ctx.root);
         if (problem)
             run.failure = { kind: "environment", message: problem };
     }
-    const results = check === "test" && ctx.project.testResults
-        ? collectTestResults(ctx.project.testResults, started, claimed)
-        : undefined;
+    let results = check === "test" && testResults ? collectTestResults(testResults, started, claimed) : undefined;
+    // No result files: the runner's log still names failing tests and prints counts.
+    if (check === "test" && !results)
+        results = parseTestLog(fs.readFileSync(logFile, "utf8"));
     if (results)
         run.results = results;
     return run;
@@ -191,11 +197,12 @@ export function incrementalBuildGap(adapter, build) {
     return "`dotnet build` without `--no-incremental` skips up-to-date projects and prints none of their warnings, so the dead-code check may report existing unused code as new: add `--no-incremental` to `build`";
 }
 /**
- * Build then test every project. A project that configures `build` and/or
- * `test` runs exactly those; one that configures neither gets the adapter's
- * defaults (`dotnet build --no-incremental`, `npx ng test`, ...).
+ * Build, test, then lint every project, each command resolved on its own
+ * (see `projectCommands`): the configured one, none for `false`, else the
+ * adapter's default (`dotnet build --no-incremental`, `npx ng test`, ...;
+ * lint has none).
  */
-export async function runChecks(projects, logDir, only = ["build", "test"]) {
+export async function runChecks(projects, logDir, only = ["build", "test", "lint"]) {
     const runs = [];
     // Projects whose `testResults` patterns overlap must not count each other's result files.
     const claimed = new Map();
@@ -205,7 +212,8 @@ export async function runChecks(projects, logDir, only = ["build", "test"]) {
             const command = commands[check];
             if (!command)
                 continue;
-            runs.push(await runCheck(ctx, check, command, path.join(logDir, `${ctx.name}.${check}.log`), claimed));
+            const log = path.join(logDir, `${ctx.name}.${check}.log`);
+            runs.push(await runCheck(ctx, check, command, log, claimed, commands.testResults));
         }
     }
     return runs;
@@ -249,23 +257,26 @@ export async function discoverFlag(projects, flag) {
     const flow = entry?.flow ?? [];
     const names = mergeNames([{ name: flag, kind: "literal", source: "discovery" }], [
         ...(entry?.definitions ?? []).map((d) => ({ name: d.name, kind: "alias", source: "discovery" })),
-        ...flow.filter((n) => n.record).map((n) => flowName(projects, n)),
+        ...flow.filter((n) => n.record).flatMap((n) => flowNames(projects, n)),
     ]);
     const key = (n) => `${n.name}\0${n.file ?? ""}`;
     const recorded = new Set(names.map(key));
     const suggestedNames = flow
-        .filter((n) => !n.record && !recorded.has(key(flowName(projects, n))))
+        .filter((n) => !n.record && !recorded.has(key(flowNames(projects, n)[0])))
         .map(({ record: _record, ...name }) => name)
         .filter((n, i, all) => all.findIndex((m) => m.name === n.name && m.file === n.file) === i);
     return { names, suggestedNames, parameterizedTests: entry?.parameterizedTests ?? [] };
 }
-/** A flow name as a wrapper; a local, parameter or field only in its own file. */
-function flowName(projects, n) {
+/** A flow name as recorded: an alias everywhere; a wrapper, a local, parameter or field only in its own file. */
+function flowNames(projects, n) {
+    if (n.kind === "alias")
+        return [{ name: n.name, kind: "alias", source: "discovery" }];
     const name = { name: n.name, kind: "wrapper", source: "discovery" };
     const root = projects[0]?.ctx.config.root;
-    if (root && (n.kind === "local" || n.kind === "parameter" || n.kind === "field"))
-        name.file = relativePath(root, n.file);
-    return name;
+    if (root && (n.kind === "local" || n.kind === "parameter" || n.kind === "field")) {
+        return withScopeFiles(projects, root, relativePath(root, n.file)).map((file) => ({ ...name, file }));
+    }
+    return [name];
 }
 /** The names {@link discoverFlag} records. */
 export async function discoverNames(projects, flag) {
@@ -290,29 +301,33 @@ export function mergeNames(existing, added) {
 }
 /**
  * Files changed since `sha` that count as edits to the code: everything but
- * `.flagrm/`, the flagrm config, which may change to fix the setup, and the
- * files matching `testResults` patterns (absolute), which the baseline's own
- * test run writes. Undefined when git can't tell (not a repository, or `sha`
- * isn't in it).
+ * `.flagrm/`, what `ignore` names (flagrm's setup files, which may change to
+ * fix the setup, and `exclude`d paths), and the files matching `testResults`
+ * patterns (absolute), which the baseline's own test run writes. Undefined
+ * when git can't tell (not a repository, or `sha` isn't in it).
  */
-export function editsSince(root, sha, testResults = []) {
-    const results = new Set(testResults.flatMap((pattern) => fg
+export function editsSince(root, sha, testResults = [], ignore = changeFilter()) {
+    const results = matchingFiles(root, testResults);
+    return changedFilesSince(root, sha, ignore)?.filter((rel) => !results.has(rel));
+}
+/** The files (relative to `root`) matching absolute paths or globs, such as `testResults` patterns. */
+export function matchingFiles(root, patterns) {
+    return new Set(patterns.flatMap((pattern) => fg
         .sync(path.sep === "\\" ? pattern.replace(/\\/g, "/") : pattern, { absolute: true, dot: true })
         .map((file) => relativePath(root, file))));
-    return changedFilesSince(root, sha)?.filter((rel) => !CONFIG_FILENAMES.includes(rel) && !results.has(rel));
 }
 /**
  * `baseline --force` starts over only before the removal began: the working
  * tree must still match the baseline commit. Otherwise the new baseline would
  * record half-removed code, and verify would no longer see those edits.
  * Without git there is nothing to compare, so it is allowed. Files matching
- * `testResults` (absolute patterns) are not edits.
+ * `testResults` (absolute patterns) and the ones `ignore` names are not edits.
  */
-export function assertNoEditsSinceBaseline(root, flag, testResults = []) {
+export function assertNoEditsSinceBaseline(root, flag, testResults = [], ignore = changeFilter()) {
     const sha = readJson(baselinePath(root, flag))?.git?.sha;
     if (!sha)
         return;
-    const edits = editsSince(root, sha, testResults);
+    const edits = editsSince(root, sha, testResults, ignore);
     if (edits === undefined) {
         throw new UsageError(`The baseline commit ${sha.slice(0, 7)} of ${flag} is not in this repository, so flagrm can't tell whether the ` +
             `code was edited since. If it wasn't, delete ${relativePath(root, flagDir(root, flag))}/ and take a new baseline.`);
@@ -320,12 +335,42 @@ export function assertNoEditsSinceBaseline(root, flag, testResults = []) {
     if (edits.length === 0)
         return;
     const shown = edits.slice(0, 5).join(", ") + (edits.length > 5 ? `, and ${edits.length - 5} more` : "");
-    const uncommitted = new Set(changedFilesSince(root, "HEAD") ?? []);
+    const uncommitted = new Set(changedFilesSince(root, "HEAD", ignore) ?? []);
     const fix = edits.every((rel) => uncommitted.has(rel))
         ? `Set the edits aside with \`git stash -u\`, run \`flagrm baseline ${flag} --force\` again, then \`git stash pop\`.`
         : `Some are committed since the baseline commit ${sha.slice(0, 7)}: check out code without the removal first.`;
     throw new UsageError(`The code changed since the baseline of ${flag} (${shown}), so --force would record a half-done removal. ${fix}`);
 }
+/** Parse `--accept config,failures`; throws on anything else, or nothing. */
+export function parseAccept(value) {
+    const items = value
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (items.length === 0)
+        throw new UsageError("--accept takes config, failures; got nothing.");
+    for (const item of items) {
+        if (item !== "config" && item !== "failures") {
+            throw new UsageError(`--accept takes config, failures; not "${item}".`);
+        }
+    }
+    return [...new Set(items)];
+}
+/**
+ * Record the user's acknowledgement: the current configuration (verify then
+ * warns only about later changes) and/or the baseline's failing tests (listed
+ * as info). The git state, checks and names stay as they are, so this is
+ * safe mid-removal, unlike `--force`.
+ */
+export function acceptBaseline(root, flag, projects, what) {
+    const { baseline } = readBaseline(root, flag);
+    const next = { ...baseline };
+    if (what.includes("config"))
+        next.acceptedConfig = configSnapshot(projects);
+    if (what.includes("failures"))
+        next.acceptedFailures = true;
+    return saveBaseline(root, next);
+}
 /** Append names to an existing baseline; its git state and checks stay as they are. */
 export function addNames(root, flag, added) {
     const { baseline } = readBaseline(root, flag);
@@ -344,30 +389,38 @@ export function validateAgentNames(projects, names) {
         }
     }
 }
-/**
- * Up to `max` distinct lines of a log that look like errors, so the reader sees
- * why a command failed without opening the log. Compiler warnings and summary
- * lines such as `0 Error(s)` are skipped: in a large build they bury the one
- * real error. When no line looks like an error, the last `max` lines instead.
- */
-export function errorExcerpt(log, max = 10) {
+/** A log's non-blank lines, trimmed, without ANSI colors or the `$ <command>` header; undefined when unreadable. */
+export function logLines(log) {
     if (!log)
-        return [];
+        return undefined;
     let text;
     try {
         text = fs.readFileSync(log, "utf8");
     }
     catch {
-        return [];
+        return undefined;
     }
-    const all = text
+    return (text
         .split(/\r?\n/)
         // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI colors (ngc colors even when piped)
         .map((line) => line.replace(/\u001b\[[0-9;]*m/g, "").trim())
-        .filter((line) => line && !line.startsWith("$ "));
-    const lines = all
-        .filter((line) => /\berror\b|\bfailed\b|✗|×/i.test(line))
-        .filter((line) => !/:\s*warning\b/i.test(line) && !/^\d+ Error\(s\)$/i.test(line));
+        .filter((line) => line && !line.startsWith("$ ")));
+}
+/** A log line that reports an error: not a compiler warning, nor a summary such as `0 Error(s)`. */
+export function looksLikeError(line) {
+    return /\berror\b|\bfailed\b|✗|×/i.test(line) && !/:\s*warning\b/i.test(line) && !/^\d+ Error\(s\)$/i.test(line);
+}
+/**
+ * Up to `max` distinct lines of a log that look like errors, so the reader sees
+ * why a command failed without opening the log. Compiler warnings and summary
+ * lines such as `0 Error(s)` are skipped: in a large build they bury the one
+ * real error. When no line looks like an error, the last `max` lines instead.
+ */
+export function errorExcerpt(log, max = 10) {
+    const all = logLines(log);
+    if (!all)
+        return [];
+    const lines = all.filter(looksLikeError);
     // No line says error (e.g. "A compatible .NET SDK was not found"): the end of the log usually does.
     if (!lines.length)
         return all.slice(-max);

package/dist/core/change-filter.js

@@ -0,0 +1,68 @@
+/**
+ * What is not part of a flag removal: flagrm's own setup files (`init`,
+ * `update` and `scope --write` write them, often while a removal starts) and
+ * the config's `exclude` globs (generated output such as `graphify-out/`).
+ * verify's changed files, `baseline --force`, the Stop hook and the tree
+ * fingerprint all use this one filter, so verify and the hook agree.
+ */
+import picomatch from "picomatch";
+import { CONFIG_FILENAMES, loadConfig } from "./config.js";
+import { AGENT_SKILL_DIRS, SKILLS } from "./install.js";
+import { relativePath } from "./util.js";
+/** The files `flagrm init`, `update` and `scope --write` write, relative to the config root. */
+export const SETUP_PATTERNS = [
+    ...CONFIG_FILENAMES,
+    ".gitignore",
+    ".claude/settings.json",
+    ...AGENT_SKILL_DIRS.flatMap((dir) => SKILLS.map((skill) => `${dir}/${skill}/**`)),
+    ".github/prompts/flagrm-*.prompt.md",
+    "AGENTS.md",
+    "**/flagrm.slnf",
+];
+const isSetup = picomatch([...SETUP_PATTERNS], { dot: true });
+/**
+ * The filter for a config: setup files, and paths matching an `exclude` glob
+ * relative to the config root or to the path of the project they are in
+ * (`exclude` is also read per project when scanning). Without a config, only
+ * setup files.
+ */
+export function changeFilter(config) {
+    const exclude = config?.exclude.length ? excludeMatcher(config.exclude) : undefined;
+    const projectDirs = config
+        ? config.projects.map((p) => relativePath(config.root, p.path)).filter((dir) => dir && !dir.startsWith(".."))
+        : [];
+    return (rel) => {
+        if (isSetup(rel))
+            return true;
+        if (!exclude)
+            return false;
+        if (exclude(rel))
+            return true;
+        return projectDirs.some((dir) => rel.startsWith(`${dir}/`) && exclude(rel.slice(dir.length + 1)));
+    };
+}
+/**
+ * Matches `exclude` the way scanning's fast-glob `ignore` does: a pattern
+ * that matches a directory (`graphify-out`, `graphify-out/`) excludes
+ * everything under it, so test the path and each of its parent directories.
+ * `covers` reads the same way.
+ */
+export function excludeMatcher(patterns) {
+    const isMatch = picomatch(patterns.map((p) => p.replace(/\/+$/, "")), { dot: true });
+    return (rel) => {
+        for (let end = rel.length; end > 0; end = rel.lastIndexOf("/", end - 1)) {
+            if (isMatch(rel.slice(0, end)))
+                return true;
+        }
+        return false;
+    };
+}
+/** {@link changeFilter} for the config at `root`; only setup files when it can't be loaded. Never throws. */
+export function changeFilterAt(root) {
+    try {
+        return changeFilter(loadConfig({ quiet: true }, root));
+    }
+    catch {
+        return changeFilter();
+    }
+}

package/dist/core/config-snapshot.js

@@ -8,10 +8,34 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { relativePath } from "./util.js";
-/** A project's build/test commands: the configured ones, or the adapter's defaults when it configures neither. */
+/**
+ * A project's build/test/lint commands, each resolved on its own: the
+ * configured one, none for `false`, else the adapter's default (lint has none). `testResults` defaults
+ * only along with the default test command, whose output location it names.
+ */
 export function projectCommands(adapter, ctx) {
-    const configured = ctx.project.build !== undefined || ctx.project.test !== undefined;
-    return configured ? { build: ctx.project.build, test: ctx.project.test } : (adapter.defaultCommands?.(ctx) ?? {});
+    const fallback = adapter.defaultCommands?.(ctx) ?? {};
+    const out = { defaults: [] };
+    for (const key of ["build", "test"]) {
+        const configured = ctx.project[key];
+        if (configured === false)
+            continue;
+        if (configured !== undefined)
+            out[key] = configured;
+        else if (fallback[key]) {
+            out[key] = fallback[key];
+            out.defaults.push(key);
+        }
+    }
+    if (typeof ctx.project.lint === "string")
+        out.lint = ctx.project.lint;
+    if (ctx.project.testResults)
+        out.testResults = ctx.project.testResults;
+    else if (out.defaults.includes("test") && fallback.testResults) {
+        out.testResults = fallback.testResults;
+        out.defaults.push("testResults");
+    }
+    return out;
 }
 /** Solution and project files: a removal may edit them, so they don't count as a command's configuration. */
 const PROJECT_FILE = /\.(sln|slnx|\w*proj)$/i;
@@ -36,8 +60,10 @@ export function configSnapshot(projects) {
             entry.build = command(commands.build);
         if (commands.test)
             entry.test = command(commands.test);
-        if (ctx.project.testResults)
-            entry.testResults = relativePath(root, ctx.project.testResults);
+        if (commands.lint)
+            entry.lint = command(commands.lint);
+        if (commands.testResults)
+            entry.testResults = relativePath(root, commands.testResults);
         snapshot.projects.push(entry);
     }
     return snapshot;
@@ -79,6 +105,7 @@ export function configChanges(before, now) {
         for (const [kind, check] of [
             ["build", "build"],
             ["test", "tests"],
+            ["lint", "lint"],
         ]) {
             const a = was?.[kind];
             const b = is?.[kind];
@@ -139,11 +166,14 @@ function withoutCommands(text) {
     const strip = (project) => {
         if (!project || typeof project !== "object")
             return project;
-        const { build: _b, test: _t, testResults: _r, timeout: _o, ...rest } = project;
+        // `covers` changes no command's result, and `coverage` always reads the current config.
+        const { build: _b, test: _t, lint: _l, testResults: _r, timeout: _o, covers: _c, ...rest } = project;
         return rest;
     };
     if (parsed && typeof parsed === "object") {
         const config = { ...parsed };
+        // Only says which agents `init` sets up; never changes what is scanned.
+        delete config.tools;
         if (Array.isArray(config.projects))
             config.projects = config.projects.map(strip);
         for (const legacy of ["frontend", "backend"]) {

package/dist/core/config.js

@@ -48,9 +48,11 @@ const KNOWN_PROJECT_KEYS = [
     "path",
     "build",
     "test",
+    "lint",
     "testResults",
     "timeout",
     "globs",
+    "covers",
     "methods",
     "attributes",
 ];
@@ -135,6 +137,16 @@ function optionalString(value, where) {
         throw new Error(`${where} must be a non-empty string.`);
     return value;
 }
+/** A build/test command: a non-empty string, or `false` to run none (not even the adapter's default). */
+function optionalCommand(value, where) {
+    if (value === false)
+        return false;
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value.trim())
+        throw new Error(`${where} must be a non-empty string or false.`);
+    return value;
+}
 function optionalPositiveNumber(value, where) {
     if (value === undefined)
         return undefined;
@@ -162,7 +174,7 @@ function adapterDefaults(adapter, file) {
         return { methods: backend, attributes };
     return { methods: [...new Set([...frontend, ...backend])], attributes };
 }
-function parseProject(raw, index, file, fileDir) {
+function parseProject(raw, index, file, fileDir, quiet = false) {
     const where = `projects[${index}]`;
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
         throw new Error(`${where} must be an object with name, adapter and path.`);
@@ -174,7 +186,8 @@ function parseProject(raw, index, file, fileDir) {
     if (!PROJECT_NAME.test(name)) {
         throw new Error(`${where}: name "${name}" must start with a letter or digit and contain only letters, digits, _ . -`);
     }
-    warnOnUnknownKeys(p, KNOWN_PROJECT_KEYS, `project "${name}"`);
+    if (!quiet)
+        warnOnUnknownKeys(p, KNOWN_PROJECT_KEYS, `project "${name}"`);
     if (typeof p.adapter !== "string" || !ADAPTER_IDS.includes(p.adapter)) {
         throw new Error(`${where}: adapter "${String(p.adapter)}" is not one of ${ADAPTER_IDS.join(", ")}.`);
     }
@@ -187,16 +200,18 @@ function parseProject(raw, index, file, fileDir) {
         name,
         adapter,
         path: resolveProjectDir(fileDir, p.path, `Project "${name}"`),
-        build: optionalString(p.build, `${where}.build`),
-        test: optionalString(p.test, `${where}.test`),
+        build: optionalCommand(p.build, `${where}.build`),
+        test: optionalCommand(p.test, `${where}.test`),
+        lint: optionalCommand(p.lint, `${where}.lint`),
         testResults: testResults && path.resolve(fileDir, testResults),
         timeout: optionalPositiveNumber(p.timeout, `${where}.timeout`),
         globs: optionalStringList(p.globs, `${where}.globs`),
+        covers: optionalStringList(p.covers, `${where}.covers`),
         methods: optionalStringList(p.methods, `${where}.methods`) ?? defaults.methods,
         attributes: optionalStringList(p.attributes, `${where}.attributes`) ?? defaults.attributes,
     };
     // Keep the resolved shape free of absent optional keys.
-    for (const key of ["build", "test", "testResults", "timeout", "globs"]) {
+    for (const key of ["build", "test", "lint", "testResults", "timeout", "globs", "covers"]) {
         if (project[key] === undefined)
             delete project[key];
     }
@@ -221,12 +236,13 @@ export function loadConfig(cli, cwd = process.cwd()) {
     if (configPath && fs.existsSync(configPath)) {
         file = readConfigFile(configPath);
         fileDir = path.dirname(configPath);
-        warnOnUnknownKeys(file, KNOWN_CONFIG_KEYS, configPath);
+        if (!cli.quiet)
+            warnOnUnknownKeys(file, KNOWN_CONFIG_KEYS, configPath);
     }
     if (file.projects !== undefined && !Array.isArray(file.projects)) {
         throw new Error(`"projects" must be a list of { name, adapter, path } entries.`);
     }
-    const projects = (file.projects ?? []).map((raw, i) => parseProject(raw, i, file, fileDir));
+    const projects = (file.projects ?? []).map((raw, i) => parseProject(raw, i, file, fileDir, cli.quiet));
     const legacyProject = (name, adapter, dir) => ({
         name,
         adapter,

package/dist/core/detect.js

@@ -6,6 +6,7 @@
  */
 import path from "node:path";
 import fg from "fast-glob";
+import { detectTestRunner } from "./test-runner.js";
 const IGNORE = ["**/node_modules/**", "**/.git/**", "**/bin/**", "**/obj/**", "**/dist/**"];
 const depth = (file) => file.split("/").length;
 /** Markers whose directory isn't inside another marker's directory, one per directory. */
@@ -35,8 +36,7 @@ export function detectProjects(cwd) {
     const found = [];
     for (const marker of topmost(find("**/angular.json"))) {
         const dir = path.posix.dirname(marker);
-        const jest = fg.sync("jest.config.{js,ts,mjs,cjs}", { cwd: path.join(cwd, dir) }).length > 0;
-        found.push({ adapter: "angular", path: dir, marker, jest });
+        found.push({ adapter: "angular", path: dir, marker, testRunner: detectTestRunner(path.join(cwd, dir)) });
     }
     const solutions = topmost(find("**/*.{sln,slnx}"));
     if (solutions.length) {

package/dist/core/doctor.js

@@ -1,12 +1,13 @@
 /**
  * `flagrm doctor`: is this repository ready for an agent to remove a flag?
- * Config, build/test commands, git, .gitignore, the installed skills and
+ * Config, build/test/lint commands, git, .gitignore, the installed skills and
  * hook, and baselines left behind by abandoned removals.
  */
 import fs from "node:fs";
 import path from "node:path";
 import { realProbes } from "../adapters/dotnet/setup.js";
 import { errorExcerpt, incrementalBuildGap, runCheck, templateCheckGap } from "./baseline.js";
+import { changeFilter, changeFilterAt } from "./change-filter.js";
 import { findConfigFile, loadConfig, TOOL_IDS } from "./config.js";
 import { projectCommands } from "./config-snapshot.js";
 import { gitState, isAncestor } from "./git.js";
@@ -14,8 +15,20 @@ import { installedSkillVersion, SKILLS, stopHookState, TOOL_SKILL_DIRS } from ".
 import { packageVersion } from "./package.js";
 import { resolveProjects } from "./registry.js";
 import { setupReport } from "./scope.js";
+import { detectTestRunner, testResultsHint } from "./test-runner.js";
 import { savedTools } from "./tools.js";
 import { onPath, readJson, relativePath } from "./util.js";
+import { hasTestNames } from "./verify/test-results.js";
+/** How to get test results for a project without `testResults`: .NET writes TRX, JavaScript runners by detection. */
+function missingResultsFix(adapterId, ctx, root) {
+    const dir = path.join(root, ".flagrm", "test-results", ctx.name);
+    const fromProject = relativePath(ctx.root, dir) || ".";
+    const fromConfig = `./${relativePath(root, dir)}`;
+    if (adapterId === "dotnet") {
+        return `add \`--logger trx --results-directory "${fromProject}"\` to the test command and set testResults: ${fromConfig}/*.trx`;
+    }
+    return testResultsHint(detectTestRunner(ctx.root), fromProject, fromConfig, adapterId === "angular", root);
+}
 /** Check the setup in `cwd`: config and commands, git, .gitignore, skills, hook and abandoned baselines. */
 export async function runDoctor(cwd, options = {}) {
     const checks = [];
@@ -25,10 +38,17 @@ export async function runDoctor(cwd, options = {}) {
     const root = configFile ? path.dirname(configFile) : cwd;
     await configChecks(cwd, configFile, options, add);
     const git = gitState(root);
+    // flagrm's own setup files and `exclude`d paths aren't part of a removal, so they needn't be committed first.
+    const dirty = git.dirtyFiles ?? [];
+    const ignore = changeFilterAt(root);
+    const other = dirty.filter((rel) => !ignore(rel));
+    const setup = dirty.filter(changeFilter());
     if (git.sha === null)
         add("warn", "not a git repository: verify can't diff against the baseline");
-    else if (git.dirty)
-        add("warn", `${git.dirtyFiles?.length ?? 0} uncommitted files — commit or stash before a removal`);
+    else if (other.length)
+        add("warn", `${other.length} uncommitted files — commit or stash before a removal`);
+    else if (setup.length)
+        add("ok", `working tree clean apart from flagrm's setup files (${setup.length}): commit them before or with the removal`);
     else
         add("ok", "working tree clean");
     const gitignore = path.join(root, ".gitignore");
@@ -85,10 +105,13 @@ async function configChecks(cwd, configFile, options, add) {
     setupChecks(projects, root, options.probes ?? realProbes((exe) => onPath(exe, root)), add);
     for (const { adapter, ctx } of projects) {
         const commands = projectCommands(adapter, ctx);
-        for (const check of ["build", "test"]) {
+        for (const check of ["build", "test", "lint"]) {
             const command = commands[check];
             if (!command) {
-                add("warn", `${ctx.name}: no ${check} command — verify can't ${check === "build" ? "check the build" : "compare tests"}`);
+                // Lint is optional: verify skips it without a command, which is no problem.
+                if (check !== "lint") {
+                    add("warn", `${ctx.name}: no ${check} command — verify can't ${check === "build" ? "check the build" : "compare tests"}`);
+                }
                 continue;
             }
             const missing = simpleCommandProgram(command);
@@ -102,11 +125,32 @@ async function configChecks(cwd, configFile, options, add) {
                         add("warn", `${ctx.name}: ${gap}`);
                 }
             }
+            if (check === "test" && !commands.testResults) {
+                add("warn", `${ctx.name}: test command has no testResults — verify reads failing tests and counts from the log only and deleted tests from the diff, so it can't compare tests by name`, [`fix: ${missingResultsFix(adapter.id, ctx, root)}`]);
+            }
             if (!options.run) {
-                add("ok", `${ctx.name}: ${check} command \`${command}\``);
+                const source = commands.defaults.includes(check) ? " (adapter default)" : "";
+                add("ok", `${ctx.name}: ${check} command \`${command}\`${source}`);
+                continue;
+            }
+            const log = path.join(root, ".flagrm", "doctor", `${ctx.name}.${check}.log`);
+            const run = await runCheck(ctx, check, command, log, undefined, commands.testResults);
+            // Proven here rather than halfway through a removal: without readable results, verify can't compare tests.
+            if (check === "test" && commands.testResults && !hasTestNames(run.results)) {
+                add("fail", `${ctx.name}: \`${command}\` wrote no test results matching ${relativePath(cwd, commands.testResults)}`, run.exitCode === 0 ? undefined : errorExcerpt(run.log, 3));
+                continue;
+            }
+            // A suite that is already red is no setup problem: the baseline records those tests as known failures.
+            if (run.exitCode !== 0 && run.results?.failed && run.results.failedNames.length >= run.results.failed) {
+                const failed = run.results.failed;
+                add("warn", `${ctx.name}: \`${command}\`: ${failed === 1 ? "1 test fails already — the baseline records it as a known failure" : `${failed} tests fail already — the baseline records them as known failures`}, which verify only warns about`);
+                continue;
+            }
+            // Lint debt is no setup problem: verify only warns about a lint run that already failed at the baseline.
+            if (check === "lint" && run.exitCode !== 0 && !run.failure && !run.interrupted) {
+                add("warn", `${ctx.name}: \`${command}\` fails already (exit ${run.exitCode}) — verify only warns about lint errors the baseline had`, errorExcerpt(run.log, 3));
                 continue;
             }
-            const run = await runCheck(ctx, check, command, path.join(root, ".flagrm", "doctor", `${ctx.name}.${check}.log`));
             if (run.exitCode === 0) {
                 add("ok", `${ctx.name}: \`${command}\` passed`);
                 continue;