ci(dup): guard duplicate scan coverage

.github/workflows/ci.yml

@@ -1396,6 +1396,7 @@ jobs:
               pnpm check:no-conflict-markers
               pnpm tool-display:check
               pnpm check:host-env-policy:swift
+              pnpm dup:check:coverage
               ;;
             prod-types)
               pnpm tsgo:prod

package.json

@@ -1326,6 +1326,7 @@
     "docs:spellcheck": "bash scripts/docs-spellcheck.sh",
     "docs:spellcheck:fix": "bash scripts/docs-spellcheck.sh --write",
     "dup:check": "node scripts/check-duplicates.mjs",
+    "dup:check:coverage": "node scripts/check-duplicates.mjs --coverage",
     "dup:check:json": "node scripts/check-duplicates.mjs --json",
     "format": "oxfmt --write --threads=1",
     "format:all": "pnpm format && pnpm format:swift",

scripts/check-changed.mjs

@@ -57,6 +57,7 @@ export function createChangedCheckPlan(result, options = {}) {
   add("changelog attributions", ["check:changelog-attributions"]);
   add("guarded extension wildcard re-exports", ["lint:extensions:no-guarded-wildcard-reexports"]);
   add("plugin-sdk wildcard re-exports", ["lint:extensions:no-plugin-sdk-wildcard-reexports"]);
+  add("duplicate scan target coverage", ["dup:check:coverage"]);
 
   if (result.docsOnly) {
     return {

scripts/check-duplicates.mjs

@@ -23,6 +23,12 @@ const targets = [
   "vitest.config.ts",
 ];
 
+const sourceExtensions = new Set([".ts", ".tsx", ".js", ".mjs", ".cjs"]);
+const sourcePattern = "**/*.{ts,tsx,js,mjs,cjs}";
+const testPattern = "**/*.{test,e2e.test,live.test}.{ts,tsx,js,mjs,cjs}";
+// Keep local agent support trees and vendored snapshots classified but outside jscpd.
+const intentionallyUnscannedPrefixes = [".agents/", ".pi/", "vendor/"];
+
 const generatedIgnores = [
   "extensions/qa-matrix/src/shared/**",
   "extensions/qa-matrix/src/report.ts",
@@ -42,8 +48,18 @@ const testIgnores = [
   "**/*.test.ts",
   "**/*.test.tsx",
   "**/*.test.js",
+  "**/*.test.mjs",
+  "**/*.test.cjs",
   "**/*.e2e.test.ts",
+  "**/*.e2e.test.tsx",
+  "**/*.e2e.test.js",
+  "**/*.e2e.test.mjs",
+  "**/*.e2e.test.cjs",
   "**/*.live.test.ts",
+  "**/*.live.test.tsx",
+  "**/*.live.test.js",
+  "**/*.live.test.mjs",
+  "**/*.live.test.cjs",
 ];
 
 const commonArgs = [
@@ -58,6 +74,58 @@ const commonArgs = [
 ];
 
 const json = process.argv.includes("--json");
+const coverageOnly = process.argv.includes("--coverage");
+
+function normalizeRepoPath(value) {
+  return value.split(path.sep).join("/");
+}
+
+function isUnderPrefix(value, prefix) {
+  return value === prefix.slice(0, -1) || value.startsWith(prefix);
+}
+
+function isCoveredByTargets(file) {
+  return targets.some((target) => {
+    const normalizedTarget = normalizeRepoPath(target);
+    if (file === normalizedTarget) {
+      return true;
+    }
+    return file.startsWith(`${normalizedTarget}/`);
+  });
+}
+
+function listTrackedSourceFiles() {
+  const result = spawnSync("git", ["ls-files", "-z"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (result.status !== 0) {
+    throw new Error(result.stderr || "git ls-files failed");
+  }
+  return result.stdout
+    .split("\0")
+    .filter(Boolean)
+    .map(normalizeRepoPath)
+    .filter((file) => sourceExtensions.has(path.extname(file)))
+    .filter((file) => !intentionallyUnscannedPrefixes.some((prefix) => isUnderPrefix(file, prefix)))
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+function assertTargetCoverage() {
+  const uncovered = listTrackedSourceFiles().filter((file) => !isCoveredByTargets(file));
+  if (uncovered.length === 0) {
+    console.log(`[dup:check] target coverage ok`);
+    return true;
+  }
+  console.error(
+    "[dup:check] tracked duplicate-scan source files are outside scan targets or intentional excludes:",
+  );
+  for (const file of uncovered) {
+    console.error(`  - ${file}`);
+  }
+  return false;
+}
 
 function reportArgs(name) {
   if (!json) {
@@ -70,36 +138,39 @@ const scans = [
   {
     name: "production",
     targets,
-    pattern: "**/*.{ts,tsx,js,mjs,cjs}",
+    pattern: sourcePattern,
     ignore: [...testIgnores, ...generatedIgnores],
   },
   {
     name: "tests",
     targets,
-    pattern: "**/*.{test,e2e.test,live.test}.{ts,tsx,js}",
+    pattern: testPattern,
     ignore: generatedIgnores,
   },
   {
     name: "src-mixed",
     targets: ["src"],
-    pattern: "**/*.{ts,tsx,js,mjs,cjs}",
+    pattern: sourcePattern,
     ignore: generatedIgnores,
   },
   {
     name: "extensions-mixed",
     targets: ["extensions"],
-    pattern: "**/*.{ts,tsx,js,mjs,cjs}",
+    pattern: sourcePattern,
     ignore: generatedIgnores,
   },
   {
     name: "test-mixed",
     targets: ["test"],
-    pattern: "**/*.{ts,tsx,js,mjs,cjs}",
+    pattern: sourcePattern,
     ignore: generatedIgnores,
   },
 ];
 
-let failed = false;
+let failed = !assertTargetCoverage();
+if (coverageOnly) {
+  process.exit(failed ? 1 : 0);
+}
 for (const scan of scans) {
   console.log(`\n[dup:check] ${scan.name}`);
   const result = spawnSync(

scripts/check.mjs

@@ -43,6 +43,7 @@ export async function main(argv = process.argv.slice(2)) {
         { name: "tool display", args: ["tool-display:check"] },
         { name: "host env policy", args: ["check:host-env-policy:swift"] },
         { name: "opengrep rule metadata", args: ["check:opengrep-rule-metadata"] },
+        { name: "duplicate scan target coverage", args: ["dup:check:coverage"] },
       ],
     },
     {