omakit 0.4.2 → 0.5.0

package/tools/inspect/hosts.mjs

@@ -0,0 +1,141 @@
+// Host sites: every `http://` or `https://` literal in code or argv, with
+// the host and scheme it names, the tool the literal reaches (the argv it
+// sits in, or the call on its line), and the timeout and size-cap flags
+// that argv shows. A host built from a variable is not a host: a literal
+// whose host part holds `${...}` or stops at `://` is recorded as not
+// resolvable and never guessed.
+
+import { basename, blankComments, lineOf, shellSegments, shellWords } from "./text.mjs"
+import { toolOf } from "./processes.mjs"
+
+const URL = /https?:\/\/[^\s"'`)\]}>,;]*/g
+const TIMEOUT_FLAGS = ["--max-time", "-m", "--connect-timeout", "--timeout", "-T"]
+const SIZE_FLAGS = ["--max-filesize", "--quota", "-Q"]
+
+/** Loopback, link-local and RFC 1918 literals, and the names that resolve there. */
+export function privateAddress(host) {
+  const h = String(host).toLowerCase().replace(/^\[|\]$/g, "")
+  if (["localhost", "0.0.0.0", "::1", "::"].includes(h)) return true
+  const v4 = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/)
+  if (!v4) return /^f[cd][0-9a-f]{2}:|^fe80:/.test(h)
+  const [a, b] = [Number(v4[1]), Number(v4[2])]
+  return a === 10 || a === 127 || (a === 192 && b === 168) || (a === 172 && b >= 16 && b <= 31) || (a === 169 && b === 254) || (a === 100 && b >= 64 && b <= 127)
+}
+
+/** The host of a URL literal, or null when the text shows an expression where the host would be. */
+export function hostOf(url) {
+  const rest = url.replace(/^https?:\/\//, "")
+  const authority = rest.split(/[/?#]/)[0]
+  if (!authority || /\$\{|\$\(|["'`+]/.test(authority)) return null
+  const host = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority
+  const bare = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.split(":")[0]
+  return bare && /^[\w.\-[\]:]+$/.test(bare) ? bare : null
+}
+
+/** The flag with its value: `--max-time 5`, `--max-time=5`, `-m5`. */
+function flagValue(words, names) {
+  for (const [index, word] of words.entries()) {
+    for (const name of names) {
+      if (word === name) return `${name} ${words[index + 1] ?? ""}`.trim()
+      if (word.startsWith(`${name}=`)) return word
+      if (name.length === 2 && word.startsWith(name) && word.length > 2 && /\d/.test(word[2])) return word
+    }
+  }
+  return null
+}
+
+/** The words a URL is invoked with: a `-c` script's own words when the URL sits inside one, otherwise the argv. */
+function wordsAround(process, url) {
+  const argv = process.argv
+  const at = argv.findIndex((word) => word.includes(url))
+  if (at < 0 || !process.shellWrapper) return argv
+  const script = toolOf(argv).index + 2
+  if (at !== script) return argv
+  // The URL is a word inside the script string: the words of its own segment.
+  for (const segment of shellSegments(argv[at])) {
+    if (segment.text.includes(url)) return shellWords(segment.text)
+  }
+  return shellWords(argv[at])
+}
+
+function caps(words, wholeArgv) {
+  const joined = wholeArgv.join(" ")
+  const timeout = flagValue(words, TIMEOUT_FLAGS)
+    || (wholeArgv.some((word) => basename(word) === "timeout") ? `timeout ${wholeArgv[wholeArgv.findIndex((word) => basename(word) === "timeout") + 1] ?? ""}`.trim() : null)
+  const head = joined.match(/(?:^|[\s|/])head\s+(?:-\S+\s+)*-c\s+(\S+)/)
+  const size = flagValue(words, SIZE_FLAGS) || (head ? `head -c ${head[1]}` : null)
+  return {
+    timeout: { observed: Boolean(timeout), via: timeout },
+    sizeCap: { observed: Boolean(size), via: size },
+  }
+}
+
+/** Shell and Python comments blanked, quotes respected, line count kept. */
+function blankHashComments(text) {
+  return text.split("\n").map((line) => {
+    let quote = null
+    for (let i = 0; i < line.length; i += 1) {
+      const ch = line[i]
+      if (quote) {
+        if (ch === "\\") i += 1
+        else if (ch === quote) quote = null
+      } else if (ch === '"' || ch === "'") quote = ch
+      else if (ch === "#" && (i === 0 || /\s/.test(line[i - 1]))) return line.slice(0, i)
+    }
+    return line
+  }).join("\n")
+}
+
+function callOnLine(line, text) {
+  if (/(?<![\w.])fetch\s*\(/.test(line)) return "fetch"
+  if (/XMLHttpRequest/.test(line) || /XMLHttpRequest/.test(text)) return "XMLHttpRequest"
+  const call = line.match(/([A-Za-z_][\w.]*)\s*\([^()]*https?:\/\//)
+  return call ? call[1] : null
+}
+
+/**
+ * @param {{ path: string, kind: string, text: string }} file
+ * @param {Array} processes the process rows of the same file
+ * @returns {{ hosts: Array, notResolvable: Array }}
+ */
+export function extractHosts(file, processes = []) {
+  const text = file.kind === "qml" || file.kind === "js" ? blankComments(file.text) : file.kind === "shell" || file.kind === "python" ? blankHashComments(file.text) : file.text
+  const hosts = []
+  const notResolvable = []
+  for (const match of text.matchAll(URL)) {
+    const url = match[0]
+    const line = lineOf(text, match.index)
+    const scheme = url.startsWith("https") ? "https" : "http"
+    const host = hostOf(url)
+    if (!host) {
+      notResolvable.push({ file: file.path, line, kind: "host", text: url })
+      continue
+    }
+    const process = processes.find((row) => row.file === file.path && Array.isArray(row.argv) && row.argv.some((word) => word.includes(url)) && (row.declaredIn !== "shell" || row.line === line))
+    let tool = null
+    let words = []
+    let argv = []
+    if (process) {
+      argv = process.argv
+      words = wordsAround(process, url)
+      tool = toolOf(words).tool
+      if (tool) tool = basename(tool)
+    } else {
+      const lineText = text.split("\n")[line - 1] || ""
+      tool = callOnLine(lineText, text)
+    }
+    const { timeout, sizeCap } = caps(words, argv)
+    hosts.push({
+      host,
+      scheme,
+      file: file.path,
+      line,
+      tool,
+      timeout,
+      sizeCap,
+      flags: words.filter((word) => word.startsWith("-") && word !== "-"),
+      privateAddress: privateAddress(host),
+    })
+  }
+  return { hosts, notResolvable }
+}

package/tools/inspect/inspect.mjs

@@ -0,0 +1,182 @@
+// `omakit inspect <plugin-dir>`: what a plugin tree does, as observations.
+// Resolve the subject the way `submit` does, read its installable tree at
+// the commit, run the four extractors over every file inspect reads, run
+// the marketplace's own baseline through `verify` for the capabilities,
+// and build the document of docs/INSPECT.md. No verdict, and the one score
+// a position among listed trees by how much of its function text is in
+// long functions, never a grade: every
+// row is a fact the text shows, labelled observed, and the document ends
+// with what the method cannot see.
+//
+// Runs nothing from the tree, resolves no host, opens no socket, writes
+// nothing into the tree. The one thing it fetches is what `verify` fetches,
+// which under the local transport is nothing.
+
+import { join } from "node:path"
+import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
+import { marketplaceBaselineSection } from "../marketplace/verify.mjs"
+import { consequence } from "../marketplace/preflight.mjs"
+import { requirePin } from "../marketplace/pin.mjs"
+import { omakitCacheDir } from "../marketplace/paths.mjs"
+import { walkSubject } from "./walk.mjs"
+import { extractProcesses } from "./processes.mjs"
+import { extractHosts } from "./hosts.mjs"
+import { extractWrites } from "./writes.mjs"
+import { extractTimers } from "./timers.mjs"
+import { extractFunctions } from "./functions.mjs"
+import { evaluatePatterns, heavyShare, overSize, PATTERNS, rankOf, SIZE, sizeScore } from "./patterns.mjs"
+
+export const METHOD = "static extraction, regular expressions over qml and shell; observed, not executed"
+
+/**
+ * What regular expressions over QML and shell cannot see, printed at the
+ * end of every report and carried verbatim in the document. A tree that
+ * shows none of the facts is "observed nothing of this kind", never clean,
+ * because of this list.
+ */
+export const NOT_VISIBLE = Object.freeze([
+  "commands built at run time",
+  "hosts and paths from variables, properties, config or the environment",
+  "scripts a command calls that inspect does not follow",
+  "components loaded from outside the tree",
+  "encoded or obfuscated content, and what a sh -c or eval string runs",
+])
+
+/** The failure codes that mean the target could not be read at all: exit 2, the contract's second status. */
+export const NOT_READABLE = Object.freeze(["subject-not-found", "not-a-git-repository", "commit-not-found", "nothing-to-inspect", "usage"])
+
+export class InspectError extends Error {
+  constructor(code, message, remedy = null) {
+    super(message)
+    this.name = "InspectError"
+    this.code = code
+    this.remedy = remedy
+  }
+}
+
+/**
+ * @param {{ repoRoot: string, target: string, offline?: boolean, allowDirty?: boolean, omakitVersion: string, onPhase?: (text: string) => void, cacheRoot?: string }} options
+ * @returns {Promise<object>} the document of docs/INSPECT.md
+ */
+export async function inspectPlugin({ repoRoot, target, offline = false, allowDirty = false, omakitVersion, onPhase = () => {}, cacheRoot = omakitCacheDir() }) {
+  let subject
+  try {
+    subject = resolveSubject(target, { cacheRoot, allowDirty })
+  } catch (error) {
+    if (error instanceof SubjectError && error.code === "dirty-worktree") {
+      throw new InspectError(error.code, error.message.replace("read HEAD as committed", "inspect HEAD as committed"), "Commit them, or pass --allow-dirty to inspect HEAD as committed; uncommitted edits are not read.")
+    }
+    if (error instanceof SubjectError) throw new InspectError(error.code, error.message)
+    throw error
+  }
+  onPhase("reading the installable tree")
+  const tree = walkSubject(subject)
+  const dir = subject.subdir ? join(subject.dir, subject.subdir) : subject.dir
+  if (!tree.manifest && !tree.manifestError) {
+    throw new InspectError("nothing-to-inspect", `no manifest.json at the root of ${dir}, so there is no plugin to inspect`, "Pass the directory that holds the plugin's manifest.json.")
+  }
+  const pluginId = typeof tree.manifest?.id === "string" ? tree.manifest.id.trim() : null
+
+  onPhase("reading processes, hosts, writes and timers")
+  const processes = []
+  const hosts = []
+  const writes = []
+  const timers = []
+  const functions = []
+  const notResolvable = []
+  for (const file of tree.files) {
+    // Each function carries its rank among the listed ones (M12).
+    functions.push(...extractFunctions(file).map((entry) => ({ ...entry, percentile: rankOf(entry) })))
+    const rows = extractProcesses(file)
+    processes.push(...rows)
+    for (const row of rows) {
+      if (row.argvForm === "computed") notResolvable.push({ file: row.file, line: row.line, kind: "command", text: `command: ${row.commandText}` })
+    }
+    const found = extractHosts(file, rows)
+    hosts.push(...found.hosts)
+    notResolvable.push(...found.notResolvable)
+    writes.push(...extractWrites(file, { pluginId }))
+    const ticking = extractTimers(file)
+    timers.push(...ticking.timers)
+    notResolvable.push(...ticking.notResolvable)
+  }
+
+  let marketplaceBaseline
+  let blockingRules = []
+  if (offline) {
+    marketplaceBaseline = { skipped: true, reason: "--offline" }
+  } else {
+    onPhase("running the official security baseline over a local snapshot")
+    // The baseline sees the plugin's tree and nothing around it: for a plugin
+    // kept below the root of a larger repository, the local transport serves
+    // that directory's tree as the whole tree. Without this the baseline
+    // scanned the repository root and reported the root's evidence as the
+    // plugin's, which is the 0.1 Passport's first failure.
+    marketplaceBaseline = await marketplaceBaselineSection({ repoRoot, subject, subdir: subject.subdir })
+    if (marketplaceBaseline.invoked && marketplaceBaseline.official && !marketplaceBaseline.official.error) {
+      blockingRules = (await consequence(requirePin(repoRoot).dir, marketplaceBaseline.official)).selectivelyBlockingRules
+    }
+  }
+
+  const facts = { processes, hosts, writes, timers, notResolvable, files: tree.files, readme: tree.readme, baseline: marketplaceBaseline, blockingRules }
+  const { patterns, lookedFor } = evaluatePatterns(facts)
+
+  return {
+    omakit: omakitVersion,
+    command: "inspect",
+    method: METHOD,
+    subject: {
+      dir,
+      commit: subject.commit,
+      repository: { url: subject.repository.url },
+      mode: subject.mode,
+      pluginId,
+      filesRead: tree.filesRead,
+      // Paths `git status` lists at the checkout, under --allow-dirty: the
+      // tree was read at the commit, so these were not inspected. 0 for a
+      // clean checkout and for a fetched commit.
+      uncommittedFiles: subject.uncommittedFiles,
+    },
+    observed: { processes, hosts, writes, timers, functions },
+    // Size: the functions over the M12 thresholds, longest first. A count of
+    // lines, branches and nesting over the text, compared with what 90 of
+    // 100 functions in listed trees stay under; never a judgement.
+    size: {
+      measurement: SIZE.measurement,
+      // The listed trees' own heavy shares, so the score can be read from
+      // the document alone: `heavyShares[i]` is the i-th listed tree's.
+      sample: { trees: SIZE.trees, functions: SIZE.functions, heavyShares: [...SIZE.distribution.heavyShare] },
+      thresholds: { lines: SIZE.lines, branches: SIZE.branches, depth: SIZE.depth },
+      // The share of this tree's function lines inside functions over the
+      // thresholds, and 10 minus its rank among the listed trees' shares:
+      // where the tree sits, never whether it is good; null with no
+      // function to rank.
+      heavyShare: Math.round(heavyShare(functions) * 10000) / 10000,
+      score: sizeScore(functions),
+      over: overSize(functions),
+    },
+    // The headline split: a shell script contributes one site per command
+    // segment, so a tree with a few scripts carries hundreds of process
+    // sites beside a handful of QML Process blocks, and the two are said
+    // apart wherever the count is printed.
+    counts: {
+      processes: {
+        total: processes.length,
+        qml: processes.filter((row) => row.declaredIn === "qml").length,
+        shell: processes.filter((row) => row.declaredIn === "shell").length,
+      },
+      hosts: hosts.length,
+      writes: writes.length,
+      timers: timers.length,
+      functions: functions.length,
+      notResolvable: notResolvable.length,
+    },
+    notResolvable,
+    patterns,
+    lookedFor,
+    notVisible: [...NOT_VISIBLE],
+    marketplaceBaseline,
+  }
+}
+
+export { PATTERNS }

package/tools/inspect/measure-functions.mjs

@@ -0,0 +1,150 @@
+// M12 reproduction: how long a plugin's functions are, in listed trees.
+// The selection rule is the record's: the first 50 distinct community
+// repositories in the pinned catalog's order, laid out as a root plugin and
+// carrying a validated commit, each fetched read-only at that commit in
+// reviewer mode through tools/subject/resolve.mjs and read from the Git
+// object database through walk.mjs. `extractFunctions` runs over every
+// file inspect reads; nothing from a tree is executed. The record carries
+// no repository or commit: the rule reproduces the set.
+//
+// Writes docs/evidence/inspect/<date>-function-lengths.json (or --out FILE)
+// and prints the quantiles to stderr. The three p90 quantiles and the three
+// histograms replace the constants in patterns.mjs SIZE, and the per-tree
+// heavyShare list its SIZE.distribution.heavyShare; tests/unit/submit.test.mjs
+// holds them equal to the record.
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { requirePin } from "../marketplace/pin.mjs"
+import { CATALOG_PATH } from "../marketplace/registry.mjs"
+import { omakitCacheDir } from "../marketplace/paths.mjs"
+import { resolveSubject } from "../subject/resolve.mjs"
+import { walkSubject } from "./walk.mjs"
+import { extractFunctions } from "./functions.mjs"
+
+export const TREES = 50
+const KINDS = ["qml", "js", "shell", "python"]
+
+/** The nearest-rank quantile of a sorted list: the value at position ceil(p * n). */
+export function quantile(sorted, p) {
+  if (!sorted.length) return null
+  return sorted[Math.max(0, Math.ceil(p * sorted.length) - 1)]
+}
+
+/** Value to count, keys in ascending numeric order. */
+export function histogram(values) {
+  const counts = new Map()
+  for (const value of values) counts.set(value, (counts.get(value) || 0) + 1)
+  return Object.fromEntries([...counts.entries()].sort((a, b) => a[0] - b[0]).map(([value, count]) => [String(value), count]))
+}
+
+/**
+ * The record's selection: catalog order, community listings laid out as a
+ * root plugin with a validated commit, one entry per repository, the first
+ * `count`.
+ */
+export function selectTrees(catalog, count = TREES) {
+  const seen = new Set()
+  const picked = []
+  for (const plugin of Array.isArray(catalog.plugins) ? catalog.plugins : []) {
+    if (plugin.sourceType !== "community" || plugin.repositoryLayout !== "root-plugin") continue
+    if (typeof plugin.repo !== "string" || !/^[0-9a-f]{40}$/i.test(String(plugin.listingValidatedCommit || ""))) continue
+    if (seen.has(plugin.repo)) continue
+    seen.add(plugin.repo)
+    picked.push({ repo: plugin.repo, commit: plugin.listingValidatedCommit.toLowerCase() })
+    if (picked.length === count) break
+  }
+  return picked
+}
+
+/** Lines inside functions over any threshold, over lines inside every function; 0 with no function. */
+export function heavyLinesOf(functions, thresholds) {
+  return functions.filter((row) => row.lines > thresholds.lines || row.branches > thresholds.branches || row.depth > thresholds.depth).reduce((sum, row) => sum + row.lines, 0)
+}
+
+const median = (values) => {
+  if (!values.length) return null
+  const sorted = [...values].sort((a, b) => a - b)
+  const mid = Math.floor(sorted.length / 2)
+  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2
+}
+
+/**
+ * @param {Array<{ functions: Array, byKind?: object }>} trees the functions of each tree, in selection order
+ * @param {{ fetchFailed?: string[], date?: string, previous?: string }} [meta]
+ * @returns {object} the record
+ */
+export function buildRecord(trees, { fetchFailed = [], date = new Date().toISOString().slice(0, 10), previous = null } = {}) {
+  const pooled = trees.flatMap((tree) => tree.functions)
+  const sorted = (measure) => pooled.map((row) => row[measure]).sort((a, b) => a - b)
+  const lines = sorted("lines")
+  const depth = sorted("depth")
+  const branches = sorted("branches")
+  const quantiles = {
+    lines: { p50: quantile(lines, 0.5), p75: quantile(lines, 0.75), p90: quantile(lines, 0.9), p95: quantile(lines, 0.95), max: lines.at(-1) ?? null },
+    depth: { p50: quantile(depth, 0.5), p90: quantile(depth, 0.9), max: depth.at(-1) ?? null },
+    branches: { p50: quantile(branches, 0.5), p90: quantile(branches, 0.9), max: branches.at(-1) ?? null },
+  }
+  const thresholds = { lines: quantiles.lines.p90, branches: quantiles.branches.p90, depth: quantiles.depth.p90 }
+  const rows = trees.map((tree, index) => {
+    const functionLines = tree.functions.reduce((sum, row) => sum + row.lines, 0)
+    const heavyLines = heavyLinesOf(tree.functions, thresholds)
+    return {
+      row: index + 1,
+      functions: tree.functions.length,
+      byKind: Object.fromEntries(KINDS.map((kind) => [kind, tree.byKind?.[kind] ?? 0])),
+      longest: tree.functions.length ? Math.max(...tree.functions.map((row) => row.lines)) : 0,
+      medianLines: median(tree.functions.map((row) => row.lines)),
+      functionLines,
+      heavyLines,
+      heavyShare: functionLines ? Math.round((heavyLines / functionLines) * 10000) / 10000 : 0,
+    }
+  })
+  return {
+    measurement: "M12",
+    date,
+    command: "node tools/inspect/measure-functions.mjs",
+    method: `extractFunctions from tools/inspect/functions.mjs over the first ${trees.length} distinct repositories in the pinned catalog's order whose listing is community, laid out as a root plugin and carrying a validated commit (the 2026-09-15 inspect record's rule), each fetched read-only at that commit in reviewer mode. A function is a \`function name(\`, a named arrow function (\`const load = (rows) => {\`, \`this.load = rows => {\`), a method shorthand \`load(rows) {\` inside an object literal or a class, or a multi-line \`onSomething: {\` handler in QML and JavaScript; a \`name() {\` or \`function name\` block in shell; a \`def\` in Python. Anonymous callbacks are not counted. Lines are first to last line inclusive; depth is the deepest nesting below the body, the body itself at 0 in every language, a brace that opens an object or array literal or an inline arrow body not a level; branches count if, else if, for, while, switch, case, catch, &&, || and ?: (their shell and Python equivalents). Quantiles are nearest-rank over every function in the sample pooled, not per tree. \`distribution\` is the histogram of each measure over the same functions, value to count, from which a function's percentile rank is read. Per tree, functionLines is the lines inside every function, heavyLines the lines inside functions over any p90 threshold of this record, and heavyShare their ratio, 0 with no function; the size score of omakit inspect is a tree's position among these 50 heavyShares.`,
+    sample: { trees: trees.length, functions: pooled.length, fetchFailed },
+    quantiles,
+    distribution: { lines: histogram(lines), branches: histogram(branches), depth: histogram(depth) },
+    rows,
+    notes: `Rows carry no repository or commit; the selection rule reproduces the set. A function count and a longest length per tree are counts of what the extraction saw, not a judgement of any plugin.${previous ? ` ${previous}` : ""}`,
+  }
+}
+
+const PREVIOUS = "Re-measured on 2026-09-16 after three extraction fixes, so the quantiles are not comparable with the 0.4.3 record (this file at commit 6619c26: 50 trees, 6040 functions, p90 22 lines, 6 branches, nesting 3; and before it 18 trees, 715 functions, p90 18 lines, 7 branches, nesting 2): a Python body now starts at depth 0 the way a brace body does, where it started at 1; a brace that opens an object or array literal is no longer a nesting level; and a named arrow function or a method shorthand is a function, where only `function name(` and `onSomething: {` were."
+
+export async function measureFunctions(repoRoot, { count = TREES, cacheRoot = omakitCacheDir(), log = () => {} } = {}) {
+  const pin = requirePin(repoRoot)
+  const catalog = JSON.parse(readFileSync(join(pin.dir, CATALOG_PATH), "utf8"))
+  const selected = selectTrees(catalog, count)
+  const trees = []
+  const fetchFailed = []
+  for (const [index, entry] of selected.entries()) {
+    log(`${index + 1}/${selected.length} ${entry.repo}@${entry.commit.slice(0, 8)}`)
+    let subject
+    try {
+      subject = resolveSubject(`${entry.repo}@${entry.commit}`, { cacheRoot })
+    } catch (error) {
+      fetchFailed.push(`row ${index + 1}: ${error.code || "error"}`)
+      continue
+    }
+    const tree = walkSubject(subject)
+    const functions = tree.files.flatMap((file) => extractFunctions(file).map((row) => ({ ...row, fileKind: file.kind })))
+    const byKind = Object.fromEntries(KINDS.map((kind) => [kind, functions.filter((row) => row.fileKind === kind).length]))
+    trees.push({ functions, byKind })
+  }
+  return buildRecord(trees, { fetchFailed, previous: PREVIOUS })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const repoRoot = resolve(process.cwd())
+  const record = await measureFunctions(repoRoot, { log: (text) => process.stderr.write(`${text}\n`) })
+  const at = process.argv.indexOf("--out")
+  const evidencePath = resolve(at > 0 && process.argv[at + 1] ? process.argv[at + 1] : join(repoRoot, "docs/evidence/inspect", `${record.date}-function-lengths.json`))
+  mkdirSync(dirname(evidencePath), { recursive: true })
+  writeFileSync(evidencePath, `${JSON.stringify(record, null, 2)}\n`)
+  process.stderr.write(`${record.sample.trees} trees, ${record.sample.functions} functions; p90 ${record.quantiles.lines.p90} lines, ${record.quantiles.branches.p90} branches, nesting ${record.quantiles.depth.p90}; ${record.sample.fetchFailed.length} fetch failures\n${evidencePath}\n`)
+}