mutineer 1.7.0 → 1.8.0

data/lib/mutineer/baseline.rb

@@ -50,7 +50,7 @@ module Mutineer
     # @return [Mutineer::Baseline] baseline object.
     # @raise [Mutineer::ConfigError] when the file is missing or invalid.
     def self.load(path)
-      doc = JSON.parse(File.read(path))
+      doc = JSON.parse(File.read(path, encoding: "UTF-8"))
       unless doc.is_a?(Hash) && doc["schema_version"] && doc["survivors"].is_a?(Array)
         raise ConfigError, "not a Mutineer JSON report: #{path}"
       end

data/lib/mutineer/changed_lines.rb

@@ -73,7 +73,8 @@ module Mutineer
     # @return [String] diff text, or `""` on failure (after a stderr warning).
     def git_diff(ref, abs_file, project_root)
       out, _err, status = Open3.capture3(
-        "git", "--literal-pathspecs", "-C", project_root, "diff", "--unified=0", ref, "--", abs_file
+        "git", "--literal-pathspecs", "-C", project_root, "diff", "--unified=0", ref, "--", abs_file,
+        binmode: true # the hunk regex must not trip on a changed line's non-ASCII bytes
       )
       if status.success?
         return out if indexed?(abs_file, project_root)

data/lib/mutineer/cli.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "fileutils"
 require "optparse"
 require "open3"
 require_relative "version"
@@ -17,6 +18,7 @@ require_relative "migrate"
 require_relative "mutator_registry"
 require_relative "triage"
 require_relative "init"
+require_relative "redaction"
 
 module Mutineer
   # Command-line entry point. `start` is the single public method called by
@@ -34,7 +36,7 @@ module Mutineer
       Usage: mutineer [options] <command> [args]
 
       Commands:
-        run [options] <source...> --test <test> [--test <test>...]
+        run [options] <source...> [--test <test>...]
                                                      Mutate, run, and report
         run --dry-run [options] <source...>          Print candidate mutations only
         triage REPORT.json --reason TEXT
@@ -48,7 +50,9 @@ module Mutineer
                                                      --force replaces an existing file.
 
       Run options:
-        --test FILE          Test file covering the sources (one per flag; repeat it)
+        --test FILE          Test file covering the sources (one per flag; repeat it).
+                             Omit to pair each source with its test by convention
+                             (not under --dry-run)
         --operators LIST     Comma-separated operator names (default: Tier 1 set)
         --threshold FLOAT    Fail (exit 1) when score < FLOAT (default: 0 = off)
         --baseline FILE      Fail (exit 1) on NEW survivors / score drop vs a prior
@@ -73,7 +77,7 @@ module Mutineer
                              cover these sources
         --framework NAME     minitest or rspec (default: auto-detect from --test names)
         --boot FILE          Require FILE once in the parent to boot the app env, then
-                             fork per mutant (Rails apps; requires --test)
+                             fork per mutant (Rails apps; needs a test, given or found by convention)
         --rails              Boot config/environment; without --daemon, defaults to
                              redefine and serial execution
         --test-command CMD   Run the target suite in the app's own runtime as a
@@ -97,7 +101,9 @@ module Mutineer
                              matrix:)
         --allow-empty        A run with no mutants is expected; do not warn (--no-allow-empty
                              beats a .mutineer.yml allow_empty:)
-        --verbose            Surface the real error when a fork capture fails (alias: --debug)
+        --verbose            Show full error details: the backtrace and causes of a load
+                             failure, the real error of a failed fork capture, and the
+                             --test-command output (alias: --debug)
 
       Options:
         --list-operators  List available operators (default vs optional) and exit
@@ -207,7 +213,9 @@ module Mutineer
       case argv.first
       when "run"
         warn_config_root_mismatch(file_path, config.project_root) if file_path
-        tests_as_sources = argv[1..].grep(%r{(\A|/)(test|spec)/.*_(test|spec)\.rb\z})
+        tests_as_sources = argv[1..].select do |arg|
+          Pairing.test_given_as_source?(arg, project_root: config.project_root, tests: config.tests)
+        end
         if config.explicit?(:tests) && tests_as_sources.any?
           warn "mutineer: #{tests_as_sources.join(', ')} looks like a test file, not a source. " \
                "--test takes one file; repeat it for each test file (--test a_test.rb --test b_test.rb)"
@@ -248,7 +256,7 @@ module Mutineer
     # @return [void]
     def self.migrate(config, file_path)
       current, old_to_new = Migrate.id_maps(config)
-      text = File.read(file_path)
+      text = File.read(file_path, encoding: "UTF-8")
       outcome = Migrate.rewrite(text, current, old_to_new)
       outcome.replacements.each do |rep|
         puts "[mutineer] #{rep.old_id} -> #{rep.new_ids.join(', ')}"
@@ -336,38 +344,55 @@ module Mutineer
       config.dry_run ? dry_run(config) : execute(config)
     rescue ArgumentError => e
       # Unknown --operators value surfaces here; no backtrace reaches the user.
+      warn "mutineer: #{Redaction.text(e.message)}"
+      exit 2
+    rescue Mutineer::ConfigError => e
+      # A config value that only the booted app can check (`shared_databases`
+      # naming the primary database). A usage error, raised before any mutant runs.
       warn "mutineer: #{e.message}"
       exit 2
     rescue SystemCallError => e
       # A missing/unreadable path reaches here as Errno::ENOENT etc. A plain
       # message and usage exit, never a raw backtrace.
-      warn "mutineer: #{e.message}"
+      warn "mutineer: #{Redaction.text(e.message)}"
       exit 2
     rescue SyntaxError => e
-      # A syntactically invalid source file surfaces when `require`d; report it
-      # cleanly rather than dumping a backtrace.
-      warn "mutineer: cannot load source: #{e.message}"
+      # Boot, source and require files report a SyntaxError as ProjectLoadError
+      # below. This covers a file loaded on any other path; report it cleanly
+      # rather than dumping a backtrace.
+      warn "mutineer: cannot load source: #{Redaction.text(e.message)}"
       exit 1
     rescue Mutineer::ParseError => e
-      warn "mutineer: error reading: #{e.message}"
+      warn "mutineer: error reading: #{Redaction.text(e.message)}"
       exit 1
     rescue Mutineer::SmokeCheckError => e
       # The unmutated suite is not green under --test-command: a broken
       # environment, not weak tests. Runtime error (exit 1), not usage (exit 2).
-      warn "mutineer: #{e.message}"
+      warn "mutineer: #{Redaction.text(e.message)}"
       exit 1
     rescue Mutineer::ConcurrentRunError => e
       # Another process owns a source file. Runtime error (exit 1), not a
       # backtrace: the working tree is still the other run's responsibility.
-      warn "mutineer: #{e.message}"
+      warn "mutineer: #{Redaction.text(e.message)}"
       exit 1
     rescue Mutineer::CoverageFromError => e
-      warn "mutineer: #{e.message}"
+      warn "mutineer: #{Redaction.text(e.message)}"
       exit 2
     rescue Mutineer::DaemonBootError => e
       # The daemon is gone for good, so the run ended rather than scoring the rest
       # against it. A deliberate stop deserves a message, not a raw backtrace.
+      warn "mutineer: #{Redaction.text(e.message)}"
+      exit 1
+    rescue Mutineer::ProjectLoadError => e
+      # A boot file, source or --require file failed to load. The message is
+      # already redacted; --verbose adds the backtrace and the cause chain.
       warn "mutineer: #{e.message}"
+      if config.verbose
+        (e.backtrace || []).each { |frame| warn "\t#{Redaction.text(frame)}" }
+        e.causes.each { |cause| warn "mutineer: caused by: #{cause}" }
+      else
+        warn "mutineer: re-run with --verbose for the backtrace and causes"
+      end
       exit 1
     end
 
@@ -383,8 +408,9 @@ module Mutineer
       validate_test_command!(config) if config.test_command
 
       validate_since!(config) if config.since
-      preflight_output!(config.output) if config.output
+      preflight_output!(config.output, config) if config.output
       preflight_baseline!(config.baseline) if config.baseline
+      preflight_same_file!(config) if config.output && config.baseline && !config.dry_run
 
       # When --test is omitted, infer each source's test by convention. Autopair
       # also re-detects framework from inferred tests when --framework was not set.
@@ -636,13 +662,50 @@ module Mutineer
       exit 2
     end
 
-    # Preflights an output path.
+    # #281: a report written over its own baseline turns a failed gate into the
+    # next baseline. Same check as the Action's guard (action.yml); the message
+    # is that guard's text adapted for the CLI, so keep the two in step. The
+    # output is expanded the way Reporter#report writes it, so `x/../b.json`
+    # with a missing `x/` still matches `b.json`. File.identical? is false when
+    # either file is missing, so a new output path never matches.
+    # Unlike the Action's guard, a dry run skips this check: it writes no report.
+    #
+    # @api private
+    # @param config [Mutineer::Config] run configuration (output and baseline set).
+    # @return [void]
+    def self.preflight_same_file!(config)
+      output = File.expand_path(config.output)
+      return unless File.identical?(output, config.baseline)
+
+      warn "mutineer: --output and #{config.origin(:baseline)} are the same file ('#{File.realpath(output)}'). " \
+           "A failing run would replace the baseline. Write the report to a separate path. " \
+           "Copy that file onto the baseline only when the run exits 0."
+      exit 2
+    end
+
+    # Preflights an output path. A missing parent is a usage error (exit 2),
+    # except the cache directory: the documented `--output .mutineer/run.json`
+    # must work on a fresh checkout. It is created here, before the run, so a
+    # failure to create it exits 2 up front. A later failed check can leave the
+    # empty cache directory behind (a real run creates it anyway). A dry run
+    # writes no report, so it creates nothing.
     #
     # @api private
     # @param path [String] output file path.
+    # @param config [Mutineer::Config] run configuration (for the cache directory).
     # @return [void]
-    def self.preflight_output!(path)
+    def self.preflight_output!(path, config)
       dir = File.dirname(File.expand_path(path))
+      if !File.exist?(dir) && dir == File.expand_path(config.cache_dir, config.project_root)
+        return if config.dry_run
+
+        begin
+          FileUtils.mkdir_p(dir)
+        rescue SystemCallError => e
+          warn "mutineer: cannot write to #{path}: #{e.message}"
+          exit 2
+        end
+      end
       return if File.directory?(dir) && File.writable?(dir)
 
       reason = File.directory?(dir) ? "directory is not writable" : "no such directory"
@@ -683,18 +746,24 @@ module Mutineer
                             baseline: delta ? delta.legacy_matches : 0 }
       reporter.report(out: $stdout, err: $stderr, threshold: config.threshold,
                       format: config.format, output: config.output, baseline: delta,
-                      scoped: !config.since.nil?, legacy_id_matches: legacy_id_matches)
+                      scoped: !config.since.nil?, legacy_id_matches: legacy_id_matches,
+                      declined: extras.fetch(:declined, {}))
       warn_empty_run(config, extras) if aggregate.total.zero?
 
       # Warn (stderr, so it never pollutes json/html) that an external run's score
       # is not comparable to an in-process run: no coverage narrowing (uncovered
-      # mutants count as survivors), and an infra failure that still starts the
-      # suite is scored as a kill (exit 126/127 are scored error). Daemon coverage fallback warnings are emitted from the runner
-      # only when the map is unavailable, not on every --daemon run.
+      # mutants count as survivors), and an infra failure that exits 1 can still
+      # score as a kill (#292): with the summary check on, when its output names a
+      # failing test; with it off (the clean run printed no Minitest or RSpec
+      # summary line), on any exit 1, a load crash included. Daemon coverage
+      # fallback warnings are emitted from the runner only when the map is
+      # unavailable, not on every --daemon run.
       if config.test_command
         warn "[mutineer] --test-command score is an upper bound, not comparable to an " \
-             "in-process run: no coverage narrowing (uncovered mutants count as survivors) " \
-             "and an infra failure is scored as a kill (except exit 126 and 127, scored error)."
+             "in-process run: no coverage narrowing (uncovered mutants count as survivors). " \
+             "Only exit 1 counts as a kill, or a SimpleCov gate exit whose summary shows a failing " \
+             "test (an RSpec --failure-exit-code other than 1 makes every kill an error). When the clean run printed a Minitest or RSpec summary line, " \
+             "Mutineer also reads it to tell a crash from a kill. See https://github.com/davidteren/mutineer/blob/main/docs/rails-setup.md#apps-on-ruby--34"
       end
 
       # Nudge toward the opt-in tier-2 operators (human report only: never
@@ -717,15 +786,21 @@ module Mutineer
     #
     # @param config [Mutineer::Config] run configuration.
     # @param extras [Hash] the run extras; `:unscoped_mutants` counts the mutants (run and
-    #   suppressed) before --since.
+    #   suppressed) before --since, and `:declined` the candidates each operator did not mutate.
     # @return [void]
     def self.warn_empty_run(config, extras)
       # Mutants existed before --since narrowed them: the changes held none.
       if config.since && extras[:unscoped_mutants].to_i.positive?
         warn "mutineer: nothing to test in the changes since #{config.since}"
       elsif !config.allow_empty
-        warn "mutineer: no mutants were generated. Check that the sources contain code the " \
-             "operators mutate. The run exits 0, and #{BECOMES_ERROR_IN_2_0}. " \
+        declined = extras.fetch(:declined, {}).values.sum
+        cause = if declined.positive?
+                  "#{declined} #{declined == 1 ? 'candidate was' : 'candidates were'} declined " \
+                    "(--dry-run shows the count per operator)."
+                else
+                  "Check that the sources contain code the operators mutate."
+                end
+        warn "mutineer: no mutants were generated. #{cause} The run exits 0, and #{BECOMES_ERROR_IN_2_0}. " \
              "Pass --allow-empty (or allow_empty: true) if an empty run is expected."
       end
     end
@@ -837,8 +912,25 @@ module Mutineer
       breakdown = per_operator.map { |op, n| "#{op}: #{n}" }.join(", ")
       summary = breakdown.empty? ? "" : "#{breakdown} — "
       puts "#{summary}#{total} mutations (dry run, not executed); " \
-           "#{skipped} skipped (invalid); #{ignored} ignored (suppressed)"
+           "#{skipped} skipped (invalid); #{ignored} ignored (suppressed); " \
+           "#{declined_summary(extras[:declined], since: config.since)}"
       exit 0
     end
+
+    # Formats the dry run's declined count: the total, then each operator's
+    # count when the total is above zero. `--since` does not narrow the count,
+    # so under `--since` the text says so.
+    #
+    # @param declined [Hash{String => Integer}] operator name => declined count.
+    # @param since [String, nil] the `--since` ref, when set.
+    # @return [String] e.g. `2 declined (range: 2)`.
+    def self.declined_summary(declined, since:)
+      total = declined.values.sum
+      text = "#{total} declined"
+      text += " in the scanned files (not narrowed by --since)" if since
+      return text if total.zero?
+
+      "#{text} (#{declined.map { |op, n| "#{op}: #{n}" }.join(', ')})"
+    end
   end
 end

data/lib/mutineer/concern_blocks.rb

@@ -10,13 +10,19 @@ module Mutineer
   # mutant of a concern with such a block would error. {.forget} removes the
   # stored blocks that the source file defined, so the mutant's load stores
   # its own. {.replace} wraps the load and puts back any block the load did not
-  # store again, such as one under an `unless defined?` guard. A class that
-  # already includes the concern keeps what the original block defined in it:
-  # ActiveSupport does not run the block there again.
-  # Discovery marks the defs in these blocks (see {Subject#unplaceable?}).
+  # store again, such as one under an `unless defined?` guard.
+  #
+  # ActiveSupport does not run the block again in a class that already includes
+  # the concern, so that class keeps what the original block defined. For a def
+  # in the block, the mutant file also passes the mutated def to
+  # {.store_hook_def}, just before the `included` or `prepended` call, and
+  # {.place_hook_def} then loads only that def into each class that has the
+  # method (#297). Nothing else in the block runs again. Discovery decides which
+  # defs can be placed this way (see {Subject#unplaceable?}).
   #
   # Call it only in a forked child that loads the mutant. Without
-  # ActiveSupport it does nothing.
+  # ActiveSupport, {.replace} and {.forget} do nothing; {.store_hook_def} and
+  # {.place_hook_def} work without it.
   #
   # Stdlib-only, so the app-side daemon can load it.
   module ConcernBlocks
@@ -66,6 +72,163 @@ module Mutineer
       forgotten
     end
 
+    # Keeps the mutated hook-block def for {.place_hook_def}. The mutant file
+    # calls it in the concern's body, just before the hook call, so the block has
+    # the same constant scope as the hook block (#297).
+    #
+    # @yield the mutated def, run later with `class_eval` in each owner.
+    # @return [nil]
+    def self.store_hook_def(&block)
+      @hook_def = block
+      nil
+    end
+
+    # Takes the def {.store_hook_def} kept, clears it, and runs it with
+    # `class_eval` in each module whose own method came from the original def
+    # (see {.owners}), so that module gets the mutated method and nothing else in
+    # the block runs again. Each owner keeps the method's visibility. A class
+    # that includes the concern later gets the mutant from the stored block.
+    #
+    # @param source_file [String] the file the mutant replaces.
+    # @param line [Integer] the original def's first line.
+    # @param name [Symbol] the method name.
+    # @param singleton [Boolean] true for a class method.
+    # @raise [RuntimeError] when no def was kept (the mutant file did not reach
+    #   its hook call), or when a module keeps the original under another name
+    #   (see {.aliases}) or in a live method handle; the child then scores the
+    #   mutant `error`.
+    # @return [Integer] how many owners got the mutated def.
+    def self.place_hook_def(source_file:, line:, name:, singleton:)
+      block = @hook_def
+      @hook_def = nil
+      where = "mutineer: could not place the mutant of #{name} (#{source_file}:#{line})"
+      unless block
+        raise "#{where}: the mutant file did not reach its included or prepended call. " \
+              "This is a mutineer bug; please report it."
+      end
+
+      # Check before owner and alias lookup create temporary UnboundMethods.
+      if retained_hook_def?(source_file: source_file, line: line, name: name)
+        raise "#{where}: the original is retained in a Method or UnboundMethod object, " \
+              "so the mutant scores error."
+      end
+
+      # ponytail: one ObjectSpace walk per mutant (about 11 ms with Rails loaded);
+      # index modules by method name if a large app makes it slow.
+      modules = ObjectSpace.each_object(Module).to_a
+      found = owners(modules, source_file: source_file, line: line, name: name, singleton: singleton)
+      mod, other = aliases(modules, source_file: source_file, line: line, name: name, singleton: singleton).first
+      if mod
+        raise "#{where}: #{mod.inspect}#{singleton ? "." : "#"}#{other} is an alias of it and keeps the " \
+              "original method, so the mutant scores error."
+      end
+
+      found.each do |owner|
+        target = singleton ? owner.singleton_class : owner
+        visibility = if target.private_method_defined?(name, false) then :private
+                     elsif target.protected_method_defined?(name, false) then :protected
+                     end
+        owner.class_eval(&block) # a `def` in the block defines public
+        target.send(visibility, name) if visibility
+      end
+      found.size
+    end
+
+    # Each module whose own method `name` (its singleton class's, for a class
+    # method) has the original def's file and line: every place the original
+    # block defined it. A subclass that overrides the method, or a class that
+    # only inherits it, is not one.
+    #
+    # @param modules [Array<Module>] every module, including singleton classes
+    #   into which a concern can be included.
+    # @param source_file [String] the file the mutant replaces.
+    # @param line [Integer] the original def's first line.
+    # @param name [Symbol] the method name.
+    # @param singleton [Boolean] true for a class method.
+    # @return [Array<Module>]
+    def self.owners(modules, source_file:, line:, name:, singleton:)
+      path = real_path(source_file)
+      modules.select { |mod| own_method_at?(singleton ? mod.singleton_class : mod, name, path, line) }
+    end
+
+    # Each other name any module has for the original def: an alias made
+    # outside the block. Check independently of {.owners}: a wrapper can replace
+    # the original name while its alias keeps the original body, so the mutant
+    # could falsely survive even when no current-name owner remains.
+    #
+    # @param modules [Array<Module>] every module, including singleton classes.
+    # @param source_file [String] the file the mutant replaces.
+    # @param line [Integer] the original def's first line.
+    # @param name [Symbol] the method name.
+    # @param singleton [Boolean] true for a class method.
+    # @return [Array<Array(Module, Symbol)>] each module and its alias name.
+    def self.aliases(modules, source_file:, line:, name:, singleton:)
+      path = real_path(source_file)
+      modules.flat_map do |mod|
+        target = singleton ? mod.singleton_class : mod
+        (target.instance_methods(false) + target.private_instance_methods(false)).filter_map do |other|
+          [mod, other] if other != name && own_method_at?(target, other, path, line, original_name: name)
+        end
+      end
+    end
+
+    # True when the module's own method `name` starts at this file and line.
+    # A prepended method can hide it from `instance_method`, so follow `super`
+    # until the lookup reaches the method whose owner is the module itself.
+    #
+    # @param target [Module] the module or singleton class to read.
+    # @param name [Symbol] the method name.
+    # @param path [String] the source file's real path.
+    # @param line [Integer] the def's first line.
+    # @param original_name [Symbol] the name the original definition used;
+    #   distinguishes an alias from another definition on the same line.
+    # @return [Boolean]
+    def self.own_method_at?(target, name, path, line, original_name: name)
+      return false unless target.method_defined?(name, false) || target.private_method_defined?(name, false)
+
+      method = target.instance_method(name)
+      method = method.super_method while method && !method.owner.equal?(target)
+      return false unless method
+
+      file, def_line = method.source_location
+      method.original_name == original_name && def_line == line && !file.nil? && real_path(file) == path
+    end
+
+    # True when a live Method or UnboundMethod keeps the original definition.
+    # A wrapper can call that handle after the named method was replaced, so
+    # loading another def cannot make the wrapper test the mutant. A matching
+    # but unreachable reflection result is harmless: collect it, then check
+    # again. Most mutants have no matching handle and need no explicit GC.
+    #
+    # @param source_file [String] the file the mutant replaces.
+    # @param line [Integer] the original def's first line.
+    # @param name [Symbol] the original method name.
+    # @return [Boolean]
+    def self.retained_hook_def?(source_file:, line:, name:)
+      path = real_path(source_file)
+      return false unless method_handle_at?(path, line, name)
+
+      GC.start
+      method_handle_at?(path, line, name)
+    end
+
+    # True when the heap contains a handle for this original definition. Return
+    # only a boolean, so the first check does not itself retain a dead handle
+    # across the GC in {.retained_hook_def?}.
+    #
+    # @param path [String] the source file's real path.
+    # @param line [Integer] the original def's first line.
+    # @param name [Symbol] the original method name.
+    # @return [Boolean]
+    def self.method_handle_at?(path, line, name)
+      [Method, UnboundMethod].any? do |kind|
+        ObjectSpace.each_object(kind).any? do |method|
+          file, def_line = method.source_location
+          method.original_name == name && def_line == line && !file.nil? && real_path(file) == path
+        end
+      end
+    end
+
     # The file's real path, so a symlinked or relative path matches the path
     # Ruby recorded when it loaded the file.
     #

data/lib/mutineer/config.rb

@@ -63,6 +63,7 @@ module Mutineer
                      flag: "--capture-timeout"),
     ConfigOption.new(field: :cache_dir, type: :string, yaml_key: "cache_dir", flag: "--cache-dir"),
     ConfigOption.new(field: :allow_empty, type: :bool, yaml_key: "allow_empty", flag: "--allow-empty"),
+    ConfigOption.new(field: :shared_databases, type: :string_list, yaml_key: "shared_databases"),
     ConfigOption.new(field: :coverage_from, type: :string, flag: "--coverage-from"),
     ConfigOption.new(field: :format, type: :enum, flag: "--format", values: %w[human json html]),
     ConfigOption.new(field: :strategy, type: :enum, flag: "--strategy", values: %w[reload redefine],
@@ -84,6 +85,9 @@ module Mutineer
   # `matrix` (--matrix) runs every covering test for each mutant and reports
   # which tests kill it (see KillMatrix); it never changes a verdict.
   #
+  # `shared_databases` (file only) names test database configs that parallel
+  # `--daemon` workers may share; see DaemonBackend.worker_count_for.
+  #
   # Boot mode adds: boot (a file to require ONCE in the parent so the app env,
   # e.g. Rails, is booted before forking; sources are then NOT manually required)
   # and rails (sugar: defaults boot to config/environment, prefers redefine without
@@ -97,6 +101,7 @@ module Mutineer
     # :daemon_timeout stays programmatic (set by tests/Runner; no flag yet).
     :baseline, :baseline_epsilon, :fail_fast, :test_command,
     :daemon, :daemon_timeout, :timeout, :capture_timeout, :matrix, :allow_empty, :coverage_from,
+    :shared_databases,
     keyword_init: true
   ) do
     # Config file name.
@@ -133,6 +138,7 @@ module Mutineer
       self.daemon        = false if daemon.nil?
       self.matrix        = false if matrix.nil?
       self.allow_empty   = false if allow_empty.nil?
+      self.shared_databases ||= []
     end
 
     # True when the user wrote `key`, on the command line or in the config