Recommended Free Tools
Yes, according to the author’s account. A code-review command given the positional argument selftest treated it as a scan path, found no such directory, skipped it, and reported zero files and zero lines. It still returned a 100/100 health score, a “safe to merge” verdict, and exit code 0. Every signal a pipeline reads said the review had passed, but nothing had been examined.
The account comes from Felixwang007, republished at World Programming on October 1, 2026. The tool’s behavior and the audit figures below are the author’s reports. They have not been independently reproduced.
As an Amazon Associate I earn from qualifying purchases.
What the author reports happened
The tool’s real self-test is started with a --selftest flag. The incident came from a different input: the positional word selftest, which the tool did not recognize as a mode. The sequence the author describes runs as follows.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- The command receives
selftestas a positional argument. - The tool reads that word as a directory to scan, not as a request to run its self-test.
- The directory does not exist. The tool skips it instead of stopping with an error.
- The run summary reports a scope of 0 files and 0 lines.
- The run produces a health score of 100/100, a “safe to merge” verdict, and exit code 0.
The author’s point is that the malformed invocation exposed a separate behavior, scan mode with an empty target, which deserves its own handling.
#1 Best Overall
Why an empty scope looks like a pass
A score calculated from findings will read as perfect when there are no findings to count. Unless the code checks how much was examined, zero problems and zero work produce identical output. The author’s central line puts it this way: “Nothing wrong” and “nothing examined” are not the same result, and a tool that returns the same status for both cannot be part of a gate.
The author describes two ways this could reach production:
- Continuous integration: a pipeline passes an empty changed-file variable to the reviewer. The reviewer scans nothing and the job goes green.
- Agent tooling: an agent passes the wrong parameter, such as a subcommand name where a path belongs. The agent then reports the change as reviewed.
Two self-test conventions, and where each goes wrong
The author audited 34 packages in 2026 and found three patterns for self-tests. The counts below are the author’s figures.
Rank #2
| Convention | Example invocation | Packages (author count) | Failure the author highlights |
|---|---|---|---|
| Flag-based self-test | tool --selftest |
5 | Explicit and documented, so the harness can call it directly. |
| Positional subcommand | tool selftest |
12 | The word can be read as a scan path. If the path is missing, the run can succeed with nothing examined. |
| No self-test | Not applicable | 17 | Nothing confirms the checks can fail, so their output cannot be trusted as evidence. |
Flag-based self-tests
A flag such as --selftest is unambiguous because it cannot be confused with a path. The harness can call one exact form and read the result. The code-review tool in the incident uses this form.
Positional subcommands
A bare word that also works as a file or directory name is a hazard. The same argument list can mean a check in one case and a scan target in another. Unless the tool rejects a missing path loudly, the harness will not notice the difference.
Packages with no self-test
Seventeen packages had no self-test at all. Without one, there is no way to show that a rule set fires on bad input, so a clean result carries little information.
Rank #3
The audit figures and how far to trust them
The author reports the following for a single package audit. These numbers describe one author’s sample and are not representative statistics about agent tooling in general.
- Five flag-based self-tests had 30, 54, 16, 40, and 77 assertions.
- The code-review tool’s
--selftesthad 54 assertions and 38 rules. The author reports that 23 of those rules fired on dirty samples. - Across the 17 packages with self-tests, the author gives a total of about 700 assertions. “About 700” is the author’s rounded total, not a separately measured figure.
The 23-of-38 figure matters because a rule that never fires on bad input is a rule that cannot catch anything. The author does not say what the other 15 rules check or why they stayed silent on the dirty samples, so the figure should be read as a prompt for inspection rather than a verdict on the tool.
Positive and negative cases a checker needs
A self-test that only confirms a check finds problems can still hide over-reporting. The author recommends paired cases, a sample that must trigger a finding and a sample that must not. The author’s examples come from a SQL inspector:
DROP TABLEshould produce a finding, whileDROP TABLE IF EXISTSshould not.- A phrase inside a string literal should not be mistaken for a missing
WHEREclause. SELECT *inside a comment should not be reported.- An environment variable reference should not be treated as a literal password.
- A PL/pgSQL
BEGIN ... ENDbody should not be mistaken for an unclosed transaction.
These are the author’s examples. They have not been independently tested here, but they show the shape of a useful check: each rule has a case where it must speak and a case where it must stay quiet.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A safeguard checklist for CI and agent harnesses
The author offers five recommendations. They are the author’s own and do not cite a formal standard or independent validation.
- Report whether work was examined. Treat zero files, zero rules run, or zero tokens as a distinct non-success condition.
- Document one exact self-test invocation for each package, and have the harness read that contract rather than guess from source text.
- Show that each self-test can fail by deliberately breaking an assertion or rule.
- Include positive samples where a check must fire and negative samples where it must stay silent.
- Run the gate in the publish or deploy step, and stop on failure rather than trusting an earlier report.
For the first recommendation, a guard can sit in the wrapper script. The line below is an illustrative sketch, not code from the author’s tool. It assumes the wrapper can count reviewed files:
if [ "$reviewed_files" -eq 0 ]; then echo "review examined no files" >&2; exit 1; fiThe exit code is the point. Any non-zero value that the pipeline treats as failure will stop the merge, and the message makes the empty scope visible in logs.
What this does and does not establish
The evidence is one author’s incident report and one audit. The exact behavior of the tool has not been reproduced independently, and no official standard for reviewer exit codes was located. The author’s own caveat for the code-review tool is that its rules have a clear limit: “static rules can only disprove, not prove — still verify permissions, concurrency and money precision by hand.”
The narrower lesson holds up on its own terms. A success exit code shows only that the program finished without a reported error. It does not show that the intended files were read, so a gate should record what it examined alongside whether it passed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
