saboteur 0.8.0 → 0.8.1

data/lib/saboteur/execution/test_command_shape.rb

@@ -0,0 +1,149 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "shellwords"
+
+module Saboteur
+  module Execution
+    # Shape check for --test-command strings (#611). ruby executes only the
+    # FIRST script named on its command line; extra .rb arguments become
+    # ARGV, so "ruby -Itest a_test.rb b_test.rb" exercises a fraction of the
+    # suite and the unrun files' mutants silently survive. Only that exact
+    # shape warns: the command is split on shell operators (&&, ||, ;, |,
+    # redirections excluded with their targets) and each simple command inspected on
+    # its own; option operands (-r helper, -I dir, -C dir, -E/-F/-K values)
+    # are parsed out and -e/--eval ends the search (the inline script
+    # decides what it loads); the script must look like a test file, so a
+    # custom runner taking file arguments stays quiet. Wrappers (env,
+    # timeout, nice, time, bundle exec [--]) and versioned rubies
+    # (ruby3.4) are unwrapped. Known false negatives, accepted: nested
+    # shells (sh -c '...') and non-test file names.
+    module TestCommandShape
+      SHELL_OPERATOR_TOKENS = %w[&& || ; | &].freeze
+
+      # ruby options that swallow the NEXT token as their operand, detached
+      # form (-I lib); the attached form (-Ilib) is one token and needs no
+      # skip.
+      RUBY_OPERAND_OPTIONS = %w[-r -I -C -E -F -K --encoding --eval].freeze
+
+      TEST_FILE = /\A(test_|spec_).*|(_test|_spec)\.rb\z/
+
+      module_function
+
+      def multi_file_ruby?(command)
+        simple_commands(command).any? { |simple| ruby_multi_file_simple_command?(simple) }
+      rescue ArgumentError
+        false
+      end
+
+      # ";" is a shell separator whenever unquoted - even glued to the next
+      # word ("cd spec;ruby ..."). Masking quoted and escaped semicolons
+      # first keeps 'ruby "a;b_test.rb"' one script; other operators split
+      # only as standalone tokens.
+      def simple_commands(command)
+        commands = [[]]
+        semicolon_segments(command).each do |segment|
+          Shellwords.split(segment).each do |token|
+            if SHELL_OPERATOR_TOKENS.include?(token)
+              commands << []
+            else
+              commands.last << token
+            end
+          end
+          commands << []
+        end
+        commands.reject(&:empty?)
+      end
+
+      QUOTED_OR_ESCAPED = /"(?:\\.|[^"\\])*"|'[^']*'|\\./m
+
+      def semicolon_segments(command)
+        masked = command.gsub(QUOTED_OR_ESCAPED) { |span| span.tr(";", "\0") }
+        masked.split(";", -1).map { |segment| segment.tr("\0", ";") }
+      end
+
+      def ruby_multi_file_simple_command?(tokens)
+        tokens = unwrap(tokens)
+        return false unless tokens.first&.then { |prog| File.basename(prog).match?(/\Aruby[\d.]*\z/) }
+
+        args = tokens[1..]
+        return false if args.any? { |token| token == "-e" || token.start_with?("-e") || token == "--eval" }
+
+        script, *rest = script_operands(args)
+        !script.nil? && script.end_with?(".rb") && File.basename(script).match?(TEST_FILE) &&
+          rest.any? { |token| token.end_with?(".rb") }
+      end
+
+      def unwrap(tokens)
+        tokens = tokens.dup
+        loop { break unless shift_wrapper?(tokens) }
+        tokens
+      end
+
+      # Shifts one leading wrapper (env, timeout, nice, time, bundle exec,
+      # VAR=value, --) off the tokens; false once the head is the command.
+      def shift_wrapper?(tokens)
+        first = tokens.first
+        if first&.match?(/\A[A-Za-z_]\w*=/) || first == "--"
+          tokens.shift
+        elsif %w[env /usr/bin/env].include?(first)
+          tokens.shift
+          skip_env_flags(tokens)
+        elsif %w[timeout nice time].include?(first)
+          tokens.shift
+          skip_wrapper_operand(first, tokens)
+        elsif first == "bundle" && tokens[1] == "exec"
+          tokens.shift(2)
+        else
+          return false
+        end
+        true
+      end
+
+      # timeout skips its flags and duration; nice its adjustment (detached
+      # -n 5/--adjustment 5 or glued -n5/--adjustment=5/legacy -5); time -p.
+      def skip_wrapper_operand(wrapper, tokens)
+        case wrapper
+        when "timeout"
+          tokens.shift while tokens.first&.start_with?("-")
+          tokens.shift
+        when "nice"
+          tokens.shift(2) if %w[-n --adjustment].include?(tokens.first)
+          tokens.shift if tokens.first&.match?(/\A-n\S|\A--adjustment=|\A-\d+\z/)
+        when "time"
+          tokens.shift if tokens.first == "-p"
+        end
+      end
+
+      def skip_env_flags(tokens)
+        tokens.shift while tokens.first&.start_with?("-") && !%w[-u -C].include?(tokens.first)
+        tokens.shift(2) while %w[-u -C].include?(tokens.first)
+      end
+
+      # Redirections are shell syntax, not ruby operands: the operator and
+      # its target ("2> errors.rb") or the glued form ("2>errors.rb",
+      # ">out", "&>all") never count as scripts.
+      REDIRECT_OPS = %w[> >> < 2> 2>> 1> 1>> &> &>>].freeze
+      GLUED_REDIRECT = /\A\d*(?:>>?|<|&>)/
+
+      # The operands after option parsing, script first: -e/-E/-r/-I/-C and
+      # friends swallow their value.
+      def script_operands(args)
+        operands = []
+        index = 0
+        while index < args.size
+          token = args[index]
+          if REDIRECT_OPS.include?(token) || RUBY_OPERAND_OPTIONS.include?(token)
+            index += 2
+          elsif token.match?(GLUED_REDIRECT) || token.start_with?("-")
+            index += 1
+          else
+            operands << token
+            index += 1
+          end
+        end
+        operands
+      end
+    end
+  end
+end

data/lib/saboteur/frameworks/sqlite_memory_database.rb

@@ -13,7 +13,18 @@ module Saboteur
     module SqliteMemoryDatabase
       REMEDY = "a sqlite :memory: database is empty in this forked child: in-memory databases do not " \
                "survive saboteur's fork, so a schema loaded at require time is lost. Load the schema in " \
-               "a before(:suite) hook, or in an after_fork hook (config/saboteur_hooks.rb via c.hooks)"
+               "a before(:suite) hook, or in an after_fork hook in config/saboteur_hooks.rb; wire it in " \
+               'config/saboteur.rb with c.hooks = ["config/saboteur_hooks.rb"]'
+
+      # The #594 seed variant: the suite moved its schema into a hook (the
+      # schema remedy above), so children get tables - but rows seeded at
+      # require time (rolify's spec/support/data.rb) lived in the parent's
+      # database and are lost across the fork all the same.
+      SEED_REMEDY = "a sqlite :memory: database in this forked child has its schema but no rows: rows seeded at " \
+                    "require time (seed data, fixtures loaded at boot) are lost across saboteur's fork, just like " \
+                    "the schema. Seed in a before(:suite) hook, or in an after_fork hook in " \
+                    "config/saboteur_hooks.rb; wire it in config/saboteur.rb with " \
+                    'c.hooks = ["config/saboteur_hooks.rb"]'
 
       module_function
 
@@ -24,7 +35,10 @@ module Saboteur
         return unless defined?(ActiveRecord::Base)
 
         pools = ActiveRecord::Base.connection_handler.connection_pool_list
-        pools.any? { |pool| empty_memory_database?(pool) } ? REMEDY : nil
+        return REMEDY if pools.any? { |pool| empty_memory_database?(pool) }
+        return SEED_REMEDY if pools.any? { |pool| unseeded_memory_database?(pool) }
+
+        nil
       rescue StandardError, ScriptError
         nil
       end
@@ -38,6 +52,22 @@ module Saboteur
         false
       end
 
+      # Schema but not a single row anywhere: the hook-loaded schema
+      # survived the fork, the require-time seeds did not (#594).
+      def unseeded_memory_database?(pool)
+        config = pool.db_config
+        return false unless config.adapter.to_s == "sqlite3" && config.database.to_s == ":memory:"
+
+        pool.with_connection do |connection|
+          tables = user_tables(connection)
+          tables.any? && tables.all? do |table|
+            connection.select_value("SELECT 1 FROM #{connection.quote_table_name(table)} LIMIT 1").nil?
+          end
+        end
+      rescue StandardError
+        false
+      end
+
       # Migration bookkeeping is not user schema: a database with only these
       # tables still has no schema for the suite's models.
       def user_tables(connection)

data/lib/saboteur/integration/rspec.rb

@@ -17,6 +17,7 @@ module Saboteur
         begin
           @runner.setup($stderr, load_output)
         rescue SystemExit => e
+          load_output.replay
           # A spec file calling exit at load makes RSpec print "While
           # loading <file> ..." (which names the file) and re-raise.
           # Uncaught, the parent exits with the spec's status: exit(0)
@@ -24,7 +25,15 @@ module Saboteur
           raise Error, "a spec file called exit while loading (status #{e.status})"
         end
         configuration.order = "rand:#{config.fetch('seed', 1)}"
-        raise Error, load_failure_message(load_output.failed_files) if quit_while_loading?(world)
+        if quit_while_loading?(world)
+          # RSpec's load dump ends in the saboteur frames the load was
+          # triggered through and a "No examples found." from the reporter;
+          # both contradict the tool's own message. Print the suite's error
+          # without them (#608).
+          $stdout.write LoadErrorReport.filter(load_output.text, verbose: config.fetch("verbose", false))
+          raise Error, load_failure_message(load_output.failed_files, load_output.text)
+        end
+        load_output.replay
 
         refuse_unintended_focus
       end
@@ -80,7 +89,10 @@ module Saboteur
 
       # A missing rspec-core is the target's setup error, not a saboteur
       # defect (#482): refuse with the remedy instead of crashing into the
-      # internal-error report. Only the framework's own LoadError converts -
+      # internal-error report. It is a usage error (#610): ConfigError maps
+      # to exit 2, and the remedy names docs/minitest.md rather than
+      # c.integration - rspec is the only integration, so pointing at it
+      # sent Minitest users down a dead end. Only the framework's own LoadError converts -
       # matched on the failed feature, not the message, so a missing
       # rspec/core_ext does not pose as rspec/core; a LoadError the app's
       # files raise keeps the crash route.
@@ -89,8 +101,9 @@ module Saboteur
       rescue LoadError => e
         raise unless e.path == "rspec/core"
 
-        raise Error, "rspec is not in the bundle: the RSpec integration needs the rspec-core gem. " \
-                     "Add it to the bundle's test group (or point c.integration at the suite's framework)"
+        raise ConfigError, "rspec is not in the bundle: the RSpec integration needs the rspec-core gem. " \
+                           "Add it to the bundle's test group. saboteur's built-in integration supports RSpec only - " \
+                           "see docs/minitest.md for other suites"
       end
 
       def all_tests
@@ -137,6 +150,19 @@ module Saboteur
 
       SHOWN_LOAD_FAILURES = 5
 
+      # Ruby's Coverage refuses a second start, so a suite whose
+      # spec_helper auto-starts SimpleCov/SingleCov collides with
+      # saboteur's own Coverage.start and the load quits with an opaque
+      # "No examples found" (#645, real run: audited @ dbf84326). Name the
+      # suspect and both guard styles. The gem's backtrace line is the
+      # fallback: the RuntimeError's text is Coverage's own, whoever
+      # started it second.
+      COVERAGE_DOUBLE_START = /coverage measurement is already setup/i
+      # A gem backtrace frame (path:line) or the start call itself - never a
+      # bare name, which a spec FILE name like simplecov_config_spec.rb
+      # would false-positive on (Pod 3 QA probe, #645).
+      COVERAGE_GEM_FRAME = %r{(?:single_cov|simplecov)[\w.\-/]*\.rb:\d+|\b(?:SimpleCov\.start|SingleCov\.setup)}i
+
       private
 
       # rspec-core 3.11 added rspec_is_quitting (SyntaxError and SystemExit
@@ -151,7 +177,7 @@ module Saboteur
       # printed are what a user needs. Name them and the way out: a repo
       # whose spec tree cannot load whole (an engine's dummy app, an
       # env-dependent integration spec) must narrow what loads (#378).
-      def load_failure_message(failed_files)
+      def load_failure_message(failed_files, captured_text = nil)
         message = +"rspec quit while loading spec files"
         if failed_files.any?
           shown = failed_files.first(SHOWN_LOAD_FAILURES)
@@ -164,6 +190,16 @@ module Saboteur
                    'c.rspec_args = ["--exclude-pattern", "spec/dummy/**/*_spec.rb"], or name the ' \
                    "suite with --test. Rails engines with an embedded dummy app (spec/dummy) need " \
                    'this; see README "Rails engines and dummy apps".'
+        if coverage_suspect?(captured_text)
+          message << "\nSuspect: your suite starts its own Coverage (saboteur starts one itself). " \
+                     "Guard it - if ENV[\"COVERAGE\"], or SingleCov's conditional setup API - " \
+                     "and see docs/recipes/README.md#simplecov."
+        end
+        message
+      end
+
+      def coverage_suspect?(captured_text)
+        captured_text&.match?(COVERAGE_DOUBLE_START) || captured_text&.match?(COVERAGE_GEM_FRAME) || false
       end
 
       def refuse_unintended_focus
@@ -293,26 +329,78 @@ module Saboteur
           @captured = +""
         end
 
+        # Buffer only: the caller decides after setup whether the captured
+        # text goes out as it is (a clean load), filtered (a load quit,
+        # #608) or verbatim on a SystemExit. Passing through during setup
+        # would print what a later filter needs to drop.
         def write(text)
-          @captured << text
-          super
+          @replayed ? __getobj__.write(text) : @captured << text
+          self
         end
 
         def print(*args)
-          @captured << args.join
-          super
+          write(args.join)
         end
 
         def puts(*args)
-          @captured << args.flatten.join("\n") << "\n"
-          super
+          write("#{args.flatten.join("\n")}\n")
         end
 
+        def replay
+          __getobj__.write(@captured)
+          # RSpec retains this stream for later suite-hook errors.
+          @replayed = true
+        end
+
+        def text = @captured
+
         def failed_files
           LOAD_FAILURE.flat_map { |pattern| @captured.scan(pattern) }.flatten
         end
       end
 
+      # The load dump RSpec prints when a spec file raises at load, trimmed
+      # to what the user acts on: the first error with the suite's own
+      # frames. The saboteur frames the load was triggered through and the
+      # reporter's "No examples found." (nothing ran because nothing loaded)
+      # read as saboteur crashing and contradict the tool's message; both
+      # stay under --verbose (#608).
+      class LoadErrorReport
+        HEADER = /^An error occurred while loading /
+        # The running tool's install root (a checkout or an unpacked gem),
+        # with separator. Only frames under it are saboteur's: the same
+        # lib/saboteur/ layout under ANOTHER root is the target's vendored
+        # copy or a dogfooded checkout, and those frames are the suite's
+        # (#608).
+        TOOL_ROOT = "#{File.expand_path('../../..', __dir__)}/".freeze
+        private_constant :HEADER, :TOOL_ROOT
+
+        def self.filter(text, verbose: false)
+          return text if verbose
+
+          lines = text.lines.reject { |line| line.strip == "No examples found." || saboteur_frame?(line) }
+          heads = lines.each_index.select { |index| lines[index].match?(HEADER) }
+          return lines.join if heads.size <= 1
+
+          kept = lines[0...heads[1]]
+          kept.pop while kept.last&.strip == ""
+          omitted = heads.size - 1
+          kept << "(#{omitted} more load error#{'s' if omitted > 1} omitted; rerun with --verbose for the full list)\n"
+          kept.join
+        end
+
+        # A backtrace frame inside the tool's install root. Relative frames
+        # (the suite's own "./spec/...") are never the tool's.
+        def self.saboteur_frame?(line)
+          line = line.strip
+          return false unless line.start_with?("# ")
+
+          path = line.sub(/\A#\s+/, "").sub(/:\d+:in .*\z/, "")
+          path.start_with?("/") && File.expand_path(path).start_with?(TOOL_ROOT)
+        end
+        private_class_method :saboteur_frame?
+      end
+
       class Listener
         EVENTS = %i[example_started example_finished example_failed].freeze
 

data/lib/saboteur/mutation_source/argument_swap.rb

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "operator_visit"
+
+module Saboteur
+  module MutationSource
+    # Swap two explicit positional arguments without moving their separators.
+    # Order-insensitive calls (includes, attr_reader, validates) can be equivalent; arid patterns can exclude them.
+    class ArgumentSwap < Base
+      include OperatorVisit
+
+      EXCLUDED = [Prism::KeywordHashNode, Prism::SplatNode, Prism::ForwardingArgumentsNode].freeze
+
+      def initialize(arid: []) # rubocop:disable Lint/MissingSuper
+        @arid = arid.map { |pattern| Regexp.new(pattern) }
+      end
+
+      def name
+        "argument_swap"
+      end
+
+      private
+
+      def mutate_node(node, subject, found)
+        return unless node.is_a?(Prism::CallNode) && node.opening_loc&.slice == "("
+
+        arguments = node.arguments&.arguments
+        return unless arguments&.size == 2
+        return if arguments.any? { |argument| excluded?(argument) }
+
+        left, right = arguments
+        return if left.slice == right.slice
+
+        # Prism forwards location offsets on nodes; removing .location here is equivalent.
+        edits = [[left, right], [right, left]].map do |original, replacement|
+          Edit.new(file: subject.file, start_byte: original.location.start_offset,
+                   end_byte: original.location.end_offset, replacement: replacement.slice)
+        end
+        found << Mutation.new(subject_id: subject.id, operator: name, edits: edits, source: name)
+      end
+
+      def excluded?(argument)
+        EXCLUDED.any? { |type| argument.is_a?(type) } || heredoc?(argument)
+      end
+
+      def heredoc?(node)
+        (node.respond_to?(:opening_loc) && node.opening_loc&.slice&.start_with?("<<")) ||
+          node.compact_child_nodes.any? { |child| heredoc?(child) }
+      end
+    end
+  end
+end

data/lib/saboteur/mutation_source/builtin.rb

@@ -6,6 +6,7 @@ require_relative "base"
 require_relative "filter_replacement"
 require_relative "literal_replacement"
 require_relative "argument_removal"
+require_relative "argument_swap"
 require_relative "chain_removal"
 require_relative "pair_removal"
 require_relative "element_removal"
@@ -65,6 +66,7 @@ module Saboteur
         @filter_replacement = FilterReplacement.new(arid: arid)
         @literal_replacement = LiteralReplacement.new(arid: arid)
         @argument_removal = ArgumentRemoval.new(arid: arid)
+        @argument_swap = ArgumentSwap.new(arid: arid)
         @pair_removal = PairRemoval.new(arid: arid)
         @element_removal = ElementRemoval.new(arid: arid)
         @chain_removal = ChainRemoval.new(arid: arid)
@@ -100,7 +102,7 @@ module Saboteur
         [@filter_replacement, @literal_replacement, @argument_removal, @pair_removal, @element_removal,
          @chain_removal,
          @endpoint_replacement, @range_replacement, @operator_assignment, @condition_negation,
-         @method_swap, @operand_replacement, @interpolation_removal, @regex_replacement]
+         @method_swap, @operand_replacement, @interpolation_removal, @regex_replacement, @argument_swap]
       end
 
       private

data/lib/saboteur/mutation_source/hazard_guard.rb

@@ -52,10 +52,11 @@ module Saboteur
         stack = [root]
         until stack.empty?
           node = stack.pop
-          next if node.is_a?(Prism::DefNode)
+          # def and lambda bodies run when called, not at load.
+          next if node.is_a?(Prism::DefNode) || node.is_a?(Prism::LambdaNode)
 
           if hazardous?(node)
-            slices << node.slice
+            slices << cite(node)
             next
           end
           stack.concat(node.compact_child_nodes)
@@ -68,6 +69,10 @@ module Saboteur
       # require_relative(begin ... end) runs arbitrary code on every
       # replay, so it is unvetted below like any other helper call.
       SAFE_LOAD_REQUIRES = %w[require require_relative].freeze
+      VISIBILITY_NAMES = %w[public private protected].freeze
+      CONSTANT_VISIBILITY_NAMES = %w[private_constant public_constant].freeze
+      # `X = Struct.new(:a)` / `Point = Data.define(:x)` without a block.
+      FACTORY_NEW = { "Struct" => :new, "Data" => :define }.freeze
 
       # Assignments whose value a replay re-runs: vetted when the value is
       # a plain literal construction.
@@ -81,11 +86,19 @@ module Saboteur
       # at load runs again on every mutant, outside the method hazard guard.
       # The vetted forms are narrow: require/require_relative, pure defs
       # (a body runs when called, not at load), class/module nesting with a
-      # constant superclass, and constant or local writes of plain literal
-      # values (a `.freeze` on the literal is looked through). Everything
-      # else - helper calls, registrations, writes to disk, class factories,
-      # top-level blocks - is named here, NOT proven unsafe: the check only
-      # says saboteur cannot account for what re-running it does (#319).
+      # constant superclass, a `class << self` block of the same vetted
+      # forms, bare visibility calls (public/private/protected with no
+      # argument, literal symbols, or a def - they only re-flag methods),
+      # constant-visibility calls with literal names, Struct/Data class
+      # factories with literal arguments and no block, and constant or
+      # local writes of plain literal values (a `.freeze` on the literal is
+      # looked through; a lambda literal is data - its body runs when
+      # called, not at load). Everything else - helper calls,
+      # registrations, writes to disk, class factories, top-level blocks -
+      # is named here, NOT proven unsafe: the check only says saboteur
+      # cannot account for what re-running it does (#319). Each entry is a
+      # one-line citation: the statement's first line cut to 60 characters,
+      # with its line number (#664).
       def unvetted_load_code(root)
         bad = []
         vet_statements(root.statements.body, bad)
@@ -112,21 +125,88 @@ module Saboteur
           nil
         when Prism::ClassNode, Prism::ModuleNode
           vet_scope(node, bad)
+        when Prism::SingletonClassNode
+          if vetted_singleton_target?(node.expression)
+            vet_scope(node, bad)
+          else
+            bad << cite(node)
+          end
         when *WRITE_NODES
-          bad << node.slice unless vetted_value?(node.value)
+          bad << cite(node) unless vetted_value?(node.value)
         when Prism::CallNode
-          bad << node.slice unless vetted_call?(node)
+          bad << cite(node) unless vetted_call?(node) || visibility_call?(node)
         else
-          bad << node.slice
+          bad << cite(node)
         end
       end
 
+      # "first line of the statement (line N)": a whole class body or a
+      # long call must not flood the warning (#664).
+      def cite(node)
+        first = node.slice.lines.first.to_s.strip
+        first = "#{first[0, 57]}..." if first.length > 60
+        "#{first} (line #{node.location.start_line})"
+      end
+
+      # `class << self` opens self's singleton class, and a constant or
+      # ivar target is only read. Anything else - `class << factory.build` -
+      # RUNS the expression at load, so the whole statement is unvetted.
+      def vetted_singleton_target?(node)
+        node.is_a?(Prism::SelfNode) || constant_read?(node) || node.is_a?(Prism::InstanceVariableReadNode)
+      end
+
       def vet_scope(node, bad)
         superclass = node.respond_to?(:superclass) ? node.superclass : nil
-        bad << superclass.slice if superclass && !constant_read?(superclass)
+        bad << cite(superclass) if superclass && !constant_read?(superclass)
         vet_statements(node.body&.body || [], bad)
       end
 
+      # A bare visibility call re-flags methods and nothing else, so a
+      # replay is harmless: no receiver, no block, and only literal symbol
+      # or def arguments (`private :x`, `private def x`). The constant
+      # twins (`private_constant :X`) re-flag a constant's visibility the
+      # same way, with literal symbol or string arguments (#537).
+      def visibility_call?(node)
+        return false unless node.receiver.nil? && node.block.nil?
+
+        arguments = node.arguments&.arguments || []
+        if VISIBILITY_NAMES.include?(node.name.to_s)
+          arguments.all? { |argument| argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::DefNode) }
+        elsif CONSTANT_VISIBILITY_NAMES.include?(node.name.to_s)
+          arguments.all? { |argument| argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode) }
+        else
+          false
+        end
+      end
+
+      # `.freeze` on a vetted literal freezes data: no side effect.
+      def freeze_call?(node)
+        node.name == :freeze && node.arguments.nil? && node.block.nil? && vetted_value?(node.receiver)
+      end
+
+      # A Struct/Data class factory with only literal arguments and no
+      # block just builds a class: replaying it rebuilds the class, so the
+      # file it sits in stays vetted (#537, real run: ruby-jwt #747's
+      # `VerificationContext = Struct.new(:payload, keyword_init: true)`).
+      # A block is class_eval'd at load and stays unvetted, as does any
+      # computed argument.
+      def factory_new?(node)
+        return false unless node.receiver.is_a?(Prism::ConstantReadNode) && node.block.nil?
+        return false unless FACTORY_NEW[node.receiver.name.to_s] == node.name
+
+        (node.arguments&.arguments || []).all? do |argument|
+          argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode) ||
+            keyword_bool?(argument)
+        end
+      end
+
+      def keyword_bool?(argument)
+        argument.is_a?(Prism::KeywordHashNode) && argument.elements.all? do |pair|
+          pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode) &&
+            (pair.value.is_a?(Prism::TrueNode) || pair.value.is_a?(Prism::FalseNode))
+        end
+      end
+
       def vetted_call?(node)
         return false unless SAFE_LOAD_REQUIRES.include?(node.name.to_s) && node.receiver.nil?
         return false unless node.block.nil?
@@ -146,7 +226,8 @@ module Saboteur
         case node
         when Prism::StringNode, Prism::SymbolNode, Prism::IntegerNode, Prism::FloatNode,
              Prism::TrueNode, Prism::FalseNode, Prism::NilNode, Prism::SourceFileNode,
-             Prism::ConstantReadNode, Prism::ConstantPathNode
+             Prism::ConstantReadNode, Prism::ConstantPathNode, Prism::RegularExpressionNode,
+             Prism::LambdaNode
           true
         when Prism::ArrayNode
           node.elements.all? { |element| vetted_value?(element) }
@@ -155,7 +236,7 @@ module Saboteur
             pair.is_a?(Prism::AssocNode) && vetted_value?(pair.key) && vetted_value?(pair.value)
           end
         when Prism::CallNode
-          node.name == :freeze && node.arguments.nil? && node.block.nil? && vetted_value?(node.receiver)
+          freeze_call?(node) || factory_new?(node)
         else
           false
         end

data/lib/saboteur/mutation_source/operator_examples.rb

@@ -22,6 +22,7 @@ module Saboteur
         "filter_replacement" => "xs.select { |x| x } -> xs.reject { |x| x }",
         "literal_string" => "\"hello\" -> \"\"",
         "literal_boolean" => "true -> false",
+        "argument_swap" => "send(a, b) -> send(b, a)",
         "argument_removal" => "send(a, b) -> send(a)",
         "pair_removal" => "{a: 1, b: 2} -> {b: 2}",
         "element_removal" => "TAGS = [a, b] -> TAGS = [b]",

data/lib/saboteur/mutation_source/operator_registry.rb

@@ -29,6 +29,7 @@ module Saboteur
         "filter_replacement" => "Swap select and reject",
         "literal_string" => "Empty a string literal",
         "literal_boolean" => "Swap a boolean literal",
+        "argument_swap" => "Swap two positional call arguments",
         "argument_removal" => "Remove a call argument",
         "pair_removal" => "Remove a hash pair",
         "element_removal" => "Remove an element of a constant array literal",

data/lib/saboteur/preview.rb

@@ -125,6 +125,11 @@ module Saboteur
     end
 
     def planned(subject, candidates, scope)
+      if subject.skip_reason
+        @diagnostics.warn("#{subject.id}: skipped (#{subject.skip_reason}); excluded from the planned total")
+        return []
+      end
+
       list = candidates.for(subject)
       list = scope.restrict(subject, list) if scope
       limit = @config["max_mutants_per_method"]