mutineer 1.7.0 → 1.8.0

data/lib/mutineer/coverage_map.rb

@@ -37,6 +37,10 @@ module Mutineer
     # The result is already in the pipe then; the wait only lets the reader
     # thread run, even when the capture deadline has passed (#129).
     RESULT_GRACE = 1
+    # The redaction module, by absolute path, for the subprocess scripts: they
+    # write a failing test's report, or a load error, to the inherited stderr,
+    # and either can quote DATABASE_URL.
+    REDACTION_PATH = File.expand_path("redaction.rb", __dir__)
 
     attr_reader :project_root, :failed_test_files, :failed_clean_tests, :phase_a_ran, :map
 
@@ -447,7 +451,7 @@ module Mutineer
         raise CoverageFromError, "--coverage-from #{@coverage_from} is this run's own cache; give the run another --cache-dir"
       end
 
-      cached = JSON.parse(File.read(@coverage_from))
+      cached = JSON.parse(File.read(@coverage_from, encoding: "UTF-8"))
       reason = capture_mismatch(cached)
       raise CoverageFromError, "--coverage-from #{@coverage_from} cannot be reused: #{reason}" if reason
 
@@ -467,7 +471,7 @@ module Mutineer
         return "it has no source fingerprints; capture it again with this version and --rails/--boot"
       end
       return "its entries are not the shape a coverage cache saves; capture it again" unless well_formed_capture?(cached)
-      return "its tests, --require files, boot file, load paths or framework differ" unless cached["inputs"] == compute_digest(inputs_only: true)
+      return "its tests, --require files, boot file, load paths, framework or Minitest seed differ, or an older version made it; capture it again" unless cached["inputs"] == compute_digest(inputs_only: true)
 
       fingerprints = source_fingerprints
       missing = fingerprints.keys - cached["sources"].keys
@@ -1028,10 +1032,14 @@ module Mutineer
         Minitest.define_singleton_method(:plugin_mutineer_report_init) { |options| reporter << Minitest::SummaryReporter.new(_report, options) }
         Minitest.extensions << "mutineer_report"
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_preload_paths.inspect}.each { |f| require f }
-        #{loads}
-        _passed = Minitest.run([])
-        $stderr.write(_report.string) unless _passed
+        begin
+          #{abs_preload_paths.inspect}.each { |f| require f }
+          Minitest::Runnable.reset
+          #{loads}
+        #{load_failure_rescue}
+        end
+        _passed = Minitest.run(#{minitest_seed_args_expression})
+        $stderr.write(#{redacted_expression("_report.string")}) unless _passed
         exit(_passed ? 0 : 1)
       RUBY
     end
@@ -1053,14 +1061,58 @@ module Mutineer
         end
         RSpec::Core::Runner.disable_autorun!
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_preload_paths.inspect}.each { |f| require f }
+        begin
+          #{abs_preload_paths.inspect}.each { |f| require f }
+        #{load_failure_rescue}
+        end
         _sink = StringIO.new
         status = RSpec::Core::Runner.run(["--no-color", #{specs}], _sink, _sink)
-        $stderr.write(_sink.string) unless status.zero?
+        $stderr.write(#{redacted_expression("_sink.string")}) unless status.zero?
         exit(status.zero? ? 0 : 1)
       RUBY
     end
 
+    # Ruby source, for a subprocess script, that loads the redaction module
+    # and returns the redacted value of `expression`.
+    #
+    # @api private
+    # @param expression [String] Ruby source for the text to redact.
+    # @return [String] Ruby script text.
+    def redacted_expression(expression)
+      "(require #{REDACTION_PATH.inspect}; Mutineer::Redaction.text(#{expression}))"
+    end
+
+    # Ruby source, for a subprocess script, that closes a `begin` around the
+    # project and test file loads. A load error then prints one redacted line
+    # (Ruby's own printer would show DATABASE_URL raw), and the child still
+    # exits 1, as it did when the error went uncaught. Under --verbose the
+    # redacted backtrace follows; otherwise a hint says how to get it.
+    #
+    # @api private
+    # @return [String] Ruby script text.
+    def load_failure_rescue
+      detail =
+        if @verbose
+          <<~RUBY.chomp
+            (_e.backtrace || []).each { |_f| $stderr.puts("\t" + Mutineer::Redaction.text(_f)) }
+            _cause = _e.cause
+            while _cause
+              $stderr.puts("[mutineer] caused by: " + Mutineer::Redaction.describe(_cause))
+              _cause = _cause.cause
+            end
+          RUBY
+        else
+          '$stderr.puts("[mutineer] re-run with --verbose for the backtrace")'
+        end
+      <<~RUBY.chomp
+        rescue ScriptError, StandardError => _e
+          require #{REDACTION_PATH.inspect}
+          $stderr.puts("[mutineer] load failed: " + Mutineer::Redaction.describe(_e))
+          #{detail}
+          exit 1
+      RUBY
+    end
+
     # Builds the framework-specific subprocess script.
     #
     # @api private
@@ -1088,11 +1140,15 @@ module Mutineer
         Minitest.extensions << "mutineer_report"
         Coverage.start(lines: true, methods: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_preload_paths.inspect}.each { |f| require f }
-        _load = #{load_coverage_expression}
-        load #{absolute(test_path).inspect}
-        _passed = Minitest.run([])
-        $stderr.write(_report.string) unless _passed
+        begin
+          #{abs_preload_paths.inspect}.each { |f| require f }
+          _load = #{load_coverage_expression}
+          Minitest::Runnable.reset
+          load #{absolute(test_path).inspect}
+        #{load_failure_rescue}
+        end
+        _passed = Minitest.run(#{minitest_seed_args_expression})
+        $stderr.write(#{redacted_expression("_report.string")}) unless _passed
         _coverage = Coverage.result.transform_values { |v| v.is_a?(Hash) ? v[:lines] : v }
         _result.puts JSON.generate("passed" => _passed == true, "coverage" => _coverage,
                                     "load_coverage" => _load,
@@ -1101,6 +1157,18 @@ module Mutineer
       RUBY
     end
 
+    # Selects the seed inside the generated child, after its tests and helpers
+    # load. Choosing in the parent can ignore a helper's SEED assignment and
+    # let a clean check pass in an order the mutant run never uses (#282).
+    # The default comes from the same constant as the in-process runner; the
+    # child needs no Mutineer require and the parent's environment is unchanged.
+    #
+    # @api private
+    # @return [String] Ruby expression for the Minitest argument array.
+    def minitest_seed_args_expression
+      "ENV[\"SEED\"] ? [] : [\"--seed\", #{MinitestIntegration::PINNED_SEED.to_s.inspect}]"
+    end
+
     # Same coverage-JSON contract as the minitest path, but driven by RSpec:
     # require rspec/core lazily, require the sources under Coverage, then run the
     # one spec via RSpec::Core::Runner. The JSON goes to the result channel (see
@@ -1122,11 +1190,14 @@ module Mutineer
         RSpec::Core::Runner.disable_autorun!
         Coverage.start(lines: true, methods: true)
         $LOAD_PATH.unshift(*#{abs_load_paths.inspect})
-        #{abs_preload_paths.inspect}.each { |f| require f }
-        _load = #{load_coverage_expression}
+        begin
+          #{abs_preload_paths.inspect}.each { |f| require f }
+          _load = #{load_coverage_expression}
+        #{load_failure_rescue}
+        end
         _sink = StringIO.new
         _status = RSpec::Core::Runner.run(["--no-color", #{absolute(test_path).inspect}], _sink, _sink)
-        $stderr.write(_sink.string) unless _status.zero?
+        $stderr.write(#{redacted_expression("_sink.string")}) unless _status.zero?
         _coverage = Coverage.result.transform_values { |v| v.is_a?(Hash) ? v[:lines] : v }
         _result.puts JSON.generate("passed" => _status.zero?, "coverage" => _coverage,
                                     "load_coverage" => _load,
@@ -1355,6 +1426,10 @@ module Mutineer
       end
       @load_paths.sort.each { |lp| d.update("loadpath\0#{lp}\0") }
       d.update("framework\0#{@framework}\0")
+      # The seed sets the test order, and the order can change which lines run (#282).
+      # This is the configured seed. A test helper that changes SEED is not
+      # digested, like any other helper edit.
+      d.update("seed\0#{MinitestIntegration.seed}\0") unless @framework == "rspec"
       d.hexdigest
     end
 
@@ -1448,7 +1523,7 @@ module Mutineer
     def read_cache
       return nil unless File.exist?(cache_path)
 
-      JSON.parse(File.read(cache_path))
+      JSON.parse(File.read(cache_path, encoding: "UTF-8"))
     rescue JSON::ParserError
       nil # corrupt cache: rebuild from scratch
     end

data/lib/mutineer/daemon_backend.rb

@@ -33,8 +33,11 @@ module Mutineer
 
     # The daemon's per-mutant tempfile, written into the source dir so
     # require_relative resolves. The leading dot hides it from Zeitwerk (#253);
-    # older versions wrote it without one. Kept in step with DaemonServer#sweep_temps.
-    DAEMON_TEMP_GLOB = "{.,}mutineer_daemon*.rb"
+    # older versions wrote it without one. Daemon files only, unlike the boot
+    # sweeps ({OrphanGuard::TEMP_BASENAME}): this sweep runs after the boot and
+    # waits up to {SWEEP_GRACE} while any file it matches is still owned, so a
+    # parallel in-process run's live files would add that wait to every daemon run.
+    DAEMON_TEMP_GLOB = "{.,}mutineer_daemon#{"[0-9]" * 8}-*.rb"
 
     # Seconds the end-of-run sweep waits for an orphaned child to die. Its
     # watchdog notices a dead daemon within {OrphanGuard::POLL}.
@@ -169,16 +172,15 @@ module Mutineer
         raise
       rescue DaemonBootError => e
         warn_coverage_fallback("#{e.class}: #{e.message}")
-        return [nil, worker_count, nil]
+        # No daemon listed a Rails app's databases, so no second worker may
+        # share them. A --boot app without --rails has no database routing.
+        unknown = { "error" => "the first daemon did not boot" }
+        return [nil, config.rails ? worker_count_for(unknown, [], worker_count) : worker_count, nil]
       end
 
       begin
-        count = client.database_count.to_i
-        if count > 1 && worker_count > 1
-          warn "[mutineer] this app has #{count} databases; Mutineer runs one worker. " \
-               "Parallel runs support one database."
-          worker_count = 1
-        end
+        # Raises ConfigError when shared_databases lists the primary database.
+        worker_count = worker_count_for(client.databases, config.shared_databases, worker_count)
         # Raises DaemonBootError. Callers must not score mutants after this.
         client.provision(worker_count)
         [coverage_map_from_client(client, config), worker_count, client]
@@ -189,6 +191,52 @@ module Mutineer
       end
     end
 
+    # The worker count once the booted app's databases are known. Each worker
+    # copies only the primary database, so a second database forces one worker
+    # unless `shared_databases` lists it. Listing the primary is a config error.
+    # A failed lookup also forces one worker: a database nobody counted must
+    # never be shared by accident.
+    #
+    # @param databases [Hash, nil] the daemon's report: "names" and "primary",
+    #   or "error" (with "primary" when it resolves). nil when the app has no
+    #   worker-DB adapter.
+    # @param shared [Array<String>] the `shared_databases` config names.
+    # @param worker_count [Integer] the workers requested.
+    # @return [Integer] the workers to start.
+    # @raise [Mutineer::ConfigError] when `shared` lists the primary database.
+    def self.worker_count_for(databases, shared, worker_count)
+      return worker_count if databases.nil?
+
+      primary = databases["primary"]
+      if shared.include?(primary)
+        raise ConfigError, "shared_databases lists #{primary}, the database each worker copies. " \
+                           "List only the other databases, the ones parallel workers may share."
+      end
+
+      if databases["error"]
+        if worker_count > 1
+          warn "[mutineer] could not list this app's databases (#{databases["error"]}); Mutineer runs one worker."
+        end
+        return 1
+      end
+
+      names = Array(databases["names"])
+      unknown = shared - names
+      if unknown.any?
+        warn "[mutineer] shared_databases names no test database: #{unknown.join(", ")}. " \
+             "This app has #{names.join(", ")}."
+      end
+
+      unshared = names - shared
+      return worker_count unless unshared.size > 1 && worker_count > 1
+
+      outside = shared.empty? ? "" : " outside shared_databases"
+      warn "[mutineer] this app has #{unshared.size} databases#{outside}; Mutineer runs one worker. " \
+           "Parallel runs support one database. To run in parallel, list each one " \
+           "your tests never use under shared_databases: #{(unshared - [primary]).join(", ")}."
+      1
+    end
+
     # Turn one daemon's coverage reply into a map. Does not start or stop the daemon.
     #
     # @param client [Mutineer::DaemonClient]
@@ -204,7 +252,7 @@ module Mutineer
           failed_test_files: data["failed_test_files"] || [],
           project_root: config.project_root,
           failed_clean_tests: data["failed_clean_tests"]
-        ))
+        ), framework: config.framework)
       end
 
       unless data && !(data["map"] || {}).empty?
@@ -299,7 +347,8 @@ module Mutineer
       threads = []
       begin
         worker_count.times do
-          clients << DaemonClient.new(boot: boot_config(config, abs_tests), app_root: config.project_root)
+          clients << DaemonClient.new(boot: boot_config(config, abs_tests, parallel: true),
+                                      app_root: config.project_root)
           clients.last.start
         end
       ensure
@@ -384,10 +433,15 @@ module Mutineer
           # A :maybe mutant that cannot be placed stays no_coverage, as in-process.
           sel && sel[0] == :maybe ? Result.no_coverage : Result.unplaceable
         else
+          payload = { "code" => mutated, "source_file" => File.expand_path(subject.file, config.project_root) }
+          if subject.reload_hook_call
+            # #297: the daemon child places the hook-block def, as in-process (Runner.run).
+            payload["code"], hook_def = JobPlan.hook_mutant(mutated, mutation, subject, source)
+            payload["hook_def"] = hook_def.to_h { |key, value| [key.to_s, key == :name ? value.to_s : value] }
+          end
           verdict = client.request(
             id: req_id, worker: worker, timeout: config.daemon_timeout || DEFAULT_TIMEOUT,
-            payload: { "code" => mutated, "source_file" => File.expand_path(subject.file, config.project_root) },
-            tests: sel ? sel[1] : abs_tests
+            payload: payload, tests: sel ? sel[1] : abs_tests
           )
           # A survivor whose line ran at load, as in-process (Runner.run).
           loaded = JobPlan.load_verdict(result_for(verdict), subject.file, mutation, subject, source, coverage_map)
@@ -407,8 +461,10 @@ module Mutineer
     # @param coverage [Boolean] whether this daemon builds the coverage map.
     # @param db_role [String, nil] "prepare" (copy databases on command),
     #   "worker" (lock only), or nil to pick from `coverage`.
+    # @param parallel [Boolean] whether this daemon is one of several workers.
+    #   Only then does it check `shared_databases` after each mutant.
     # @return [Hash] the boot config shipped to the daemon.
-    def self.boot_config(config, abs_tests, coverage: false, db_role: nil)
+    def self.boot_config(config, abs_tests, coverage: false, db_role: nil, parallel: false)
       {
         project_root: config.project_root,
         boot: File.expand_path(config.boot || "config/environment", config.project_root),
@@ -420,9 +476,9 @@ module Mutineer
         source_dirs: JobPlan.source_dirs(config), # so the daemon can sweep orphan mutant temps
         framework: config.framework,
         rails: config.rails,
-        # Schema for per-worker DB isolation. Sent when present; the daemon loads
-        # it over a worker's copy of the test DB only when that copy is out of date.
-        schema: schema_path(config),
+        # Databases the workers share. A parallel worker fails a mutant whose
+        # tests used one. One worker shares nothing, so it gets no names.
+        shared_databases: parallel ? config.shared_databases : [],
         # Coverage narrowing. Only the short-lived map-building daemon starts
         # Coverage (before boot); worker daemons boot with it OFF (no wasted
         # instrumentation/memory across every mutant fork). `sources`/`tests` are the
@@ -438,19 +494,6 @@ module Mutineer
       }
     end
 
-    # Absolute path to the app's `db/schema.rb` if it exists, else nil. Each worker
-    # DB starts as a copy of the test DB; the daemon loads this file over the copy
-    # when the copy's schema differs. `structure.sql` apps get nil and keep the
-    # copy as it is.
-    #
-    # @param config [Mutineer::Config] the run config.
-    # @api private
-    # @return [String, nil] absolute schema path or nil.
-    def self.schema_path(config)
-      path = File.expand_path("db/schema.rb", config.project_root)
-      File.exist?(path) ? path : nil
-    end
-
     # Map a daemon verdict string to a Result. The daemon reports the four
     # run-time states it can decide; pre-fork states (skipped/no_coverage/…) are
     # resolved tool-side before a request is ever sent.
@@ -471,7 +514,7 @@ module Mutineer
     # tests drive directly: {boot_config} from the zero-dep suite and
     # {build_coverage_map} from the daemon suite. Everything else is daemon-pipeline
     # internals with no caller outside this file.
-    private_class_method :sweep_daemon_temps, :run_serial, :run_parallel, :job_result, :schema_path, :result_for,
-                         :prepare_run, :coverage_map_from_client
+    private_class_method :sweep_daemon_temps, :run_serial, :run_parallel, :job_result, :result_for,
+                         :prepare_run, :coverage_map_from_client, :worker_count_for
   end
 end

data/lib/mutineer/daemon_client.rb

@@ -5,6 +5,7 @@ require "io/wait"
 require "open3"
 require_relative "external_backend"
 require_relative "rails_run_env"
+require_relative "redaction"
 
 module Mutineer
   # Raised when the daemon cannot be booted or is gone for good: a bad boot path, an
@@ -43,6 +44,9 @@ module Mutineer
     # Seconds the daemon gets to boot the app and answer the handshake. A boot
     # that never returns ends the run instead of hanging it (#101).
     BOOT_TIMEOUT = 600
+    # Seconds close_io waits for the stderr drain to reach EOF before it stops
+    # the thread, so a last line without a newline is not lost.
+    DRAIN_GRACE = 1
     # Bundler's marker for a variable that was unset before it activated.
     BUNDLER_UNSET = "BUNDLER_ENVIRONMENT_PRESERVER_INTENTIONALLY_NIL"
 
@@ -72,13 +76,12 @@ module Mutineer
       self
     end
 
-    # How many database configs the booted test environment reported.
-    # 1 when the daemon did not send a count.
+    # The booted test environment's databases, as the daemon reported them:
+    # "names" and "primary", or "error" when the lookup failed. nil when the
+    # app has no worker-DB adapter.
     #
-    # @return [Integer]
-    def database_count
-      @database_count || 1
-    end
+    # @return [Hash, nil]
+    attr_reader :databases
 
     # Ask the daemon to create `slots` worker databases. Raises when the copy
     # fails or another run holds the database, so the caller stops before any
@@ -346,15 +349,14 @@ module Mutineer
             "-r", DAEMON_PATH, "-e", "Mutineer::DaemonServer.run",
             unsetenv_others: true, chdir: @app_root
           )
-          # Drain daemon stderr to the tool's stderr so child/boot errors are visible.
-          # Tracked (not fire-and-forget) so close_io can reclaim it on quit/respawn;
-          # the rescue swallows the benign EBADF/IOError raised when close_io closes
-          # the pipe out from under an in-flight copy_stream.
-          @drain = Thread.new do # rubocop:disable ThreadSafety/NewThread
-            IO.copy_stream(@stderr, @errio)
-          rescue IOError, Errno::EBADF
-            nil
-          end
+          # Replies are UTF-8 JSON, and the app's stderr is redacted as text: with
+          # LANG unset both pipes would read as US-ASCII (#303).
+          @stdout.set_encoding(Encoding::UTF_8)
+          @stderr.set_encoding(Encoding::UTF_8)
+          # Drain daemon stderr to the tool's stderr so child/boot errors are visible,
+          # redacted line by line (#288: the app's output goes through here too).
+          # Tracked (not fire-and-forget) so close_io can reclaim it on quit/respawn.
+          @drain = Thread.new { drain_stderr(@stderr) } # rubocop:disable ThreadSafety/NewThread
 
           send_line(@boot)
           read_line(BOOT_TIMEOUT)
@@ -373,7 +375,7 @@ module Mutineer
         close_io
         raise (timed_out ? DaemonBootTimeout : DaemonBootError), "daemon failed to boot under the app bundle: #{detail}"
       end
-      @database_count = ready["database_count"] || 1
+      @databases = ready["databases"]
     end
 
     # Respawn after a crash, up to MAX_RESTARTS, then hard-fail loudly.
@@ -413,6 +415,33 @@ module Mutineer
       nil
     end
 
+    # Copy each line of the daemon's stderr to the tool's stderr, redacted.
+    # A line is the unit the daemon and the app write, so a password is never
+    # split across two redaction calls. The line break is kept outside the
+    # redaction, so a line redaction hides as a whole still ends its line.
+    # After a write fails (EPIPE from a tool stderr that went away), the drain
+    # keeps reading and drops the lines, so the daemon never blocks on a full
+    # pipe. The outer rescue swallows the benign EBADF/IOError raised when
+    # close_io closes the pipe under an in-flight read, so the thread never
+    # ends with an error that close_io's join would re-raise.
+    #
+    # @param io [IO] the daemon's stderr pipe.
+    # @return [nil]
+    def drain_stderr(io)
+      writable = true
+      io.each_line do |line|
+        next unless writable
+
+        body = line.chomp("\n").scrub # an invalid byte must not stop the drain
+        @errio.write(Redaction.text(body), body.length < line.length ? "\n" : "")
+      rescue StandardError
+        writable = false
+      end
+      nil
+    rescue StandardError
+      nil
+    end
+
     # Close the IPC pipes, stop the stderr-drain thread, and reap the daemon so a
     # respawn or quit leaves no leaked fd, thread, or zombie.
     #
@@ -425,7 +454,11 @@ module Mutineer
       rescue Errno::ESRCH
         nil # it exited between the check and the kill
       end
-      @drain&.kill # stop the drain BEFORE closing its fd (avoids a copy_stream EBADF)
+      # The drain holds a partial last line until EOF. Give it a moment to reach
+      # EOF now the daemon is dead, so a boot error with no final newline still
+      # prints; then stop it BEFORE closing its fd (avoids an EBADF mid-read).
+      @drain&.join(DRAIN_GRACE)
+      @drain&.kill
       [@stdin, @stdout, @stderr].each { |io| io&.close rescue nil } # rubocop:disable Style/RescueModifier
       @wait_thr&.join # reap the exited daemon so respawn/quit leaves no zombie
       @stdin = @stdout = @stderr = @drain = @wait_thr = nil