saboteur 0.8.1 → 0.9.0

data/lib/saboteur/config.rb

@@ -18,6 +18,10 @@ module Saboteur
     LEGACY_IGNORE_FILE = ".saboteur-ignore.yml"
     IGNORE_FILE = "config/saboteur_ignore.rb"
 
+    # Settings that say where saboteur writes, never what it mutates: left
+    # out of the run fingerprint, baseline evidence and score-history scope.
+    OUTPUT_KEYS = %w[cache_dir json_report html_report score_history resume].freeze
+
     DEFAULTS = {
       "integration" => "rspec",
       "require" => [],
@@ -69,7 +73,15 @@ module Saboteur
       "subjects" => [],
       "since" => nil,
       "cache" => true,
+      # Experimental (#46): "shadow" also builds a partial coverage map after a
+      # cache miss and compares it with the full map, which the run still uses.
+      # "use" uses the partial map when it is safe and builds the full map otherwise.
+      "partial_coverage" => "off",
+      # coverage (default) reads Coverage around every test; trace gets lines and
+      # methods from a TracePoint and reads branches once per spec file (#725).
+      "coverage_recorder" => "coverage",
       "incremental" => false,
+      "resume" => nil,
       "shard" => nil,
       "allow_focus" => false,
       "fail_fast" => false,
@@ -79,6 +91,8 @@ module Saboteur
       "matrix" => false,
       "seed" => 1,
       "baseline_passes" => 2,
+      # Parallel children for the coverage-map build (#741); 1 keeps the single child.
+      "coverage_parts" => 1,
       "max_duration" => nil,
       "max_duration_ok" => false,
       "tests" => [],
@@ -92,8 +106,10 @@ module Saboteur
       "verbose" => false
     }.freeze
 
-    INTEGER_KEYS = %w[jobs max_memory_mb max_processes max_mutants_per_method seed baseline_passes].freeze
+    INTEGER_KEYS = %w[jobs max_memory_mb max_processes max_mutants_per_method seed baseline_passes
+                      coverage_parts].freeze
     FLOAT_KEYS = %w[timeout_factor timeout_min baseline_timeout coverage_timeout].freeze
+    STRING_KEYS = %w[test_selection partial_coverage coverage_recorder].freeze
     NILABLE_FLOAT_KEYS = %w[threshold max_duration].freeze
     THRESHOLD_RANGE = (0.0..100.0)
 
@@ -215,10 +231,29 @@ module Saboteur
     # Paths of saboteur's own output, relative to the root, that do not count as source changes.
     def output_paths
       prefix = File.join(File.realpath(root), "")
-      %w[cache_dir json_report html_report score_history].filter_map { |key| path(key) }
-                                                         .map { |file| File.expand_path(file) }
-                                                         .select { |file| file.start_with?(prefix) }
-                                                         .map { |file| file.delete_prefix(prefix) }
+      OUTPUT_KEYS.filter_map { |key| path(key) }
+                 .select { |file| file.start_with?(prefix) }
+                 .map { |file| file.delete_prefix(prefix) }
+    end
+
+    # Tool-owned paths, relative to the root, that never count as
+    # working-tree changes (#638): the run's output, plus an in-repo
+    # BUNDLE_GEMFILE sidecar and its lock - the documented trial setup
+    # should not read as a dirty tree. Path-exact, never a glob, so a
+    # real untracked Gemfile.lock still counts.
+    def ignored_tree_paths(gemfile: ENV.fetch("BUNDLE_GEMFILE", nil))
+      prefix = File.join(File.realpath(root), "")
+      sidecar = gemfile && File.expand_path(gemfile, prefix)
+      begin
+        sidecar &&= File.join(File.realpath(File.dirname(sidecar)), File.basename(sidecar))
+      rescue SystemCallError
+        # The sidecar's directory does not exist; keep the expanded spelling.
+      end
+      paths = output_paths
+      if sidecar&.start_with?(prefix) && sidecar != File.join(prefix, "Gemfile")
+        paths.concat([sidecar, DirtyTreeWarning.lockfile_for(sidecar)].map { |file| file.delete_prefix(prefix) })
+      end
+      paths
     end
 
     private
@@ -239,11 +274,28 @@ module Saboteur
       FLOAT_KEYS.each { |key| @values[key] = Float(@values[key]) }
       LIST_KEYS.each { |key| @values[key] = Array(@values[key]).map(&:to_s) }
       NILABLE_FLOAT_KEYS.each { |key| @values[key] = Float(@values[key]) unless @values[key].nil? }
-      @values["test_selection"] = @values["test_selection"].to_s
+      STRING_KEYS.each { |key| @values[key] = @values[key].to_s }
     rescue ArgumentError, TypeError => e
       raise ConfigError, "invalid config value: #{e.message}"
     end
 
+    def validate_partial_coverage!
+      return if %w[off shadow use].include?(self["partial_coverage"])
+
+      raise ConfigError, "partial_coverage must be one of: off, shadow, use"
+    end
+
+    def validate_coverage_settings!
+      validate_partial_coverage!
+      validate_coverage_recorder!
+    end
+
+    def validate_coverage_recorder!
+      return if %w[coverage trace].include?(self["coverage_recorder"])
+
+      raise ConfigError, "coverage_recorder must be one of: coverage, trace"
+    end
+
     def validate_mutant_limit!
       raise ConfigError, "max_mutants_per_method must be > 0" unless self["max_mutants_per_method"].positive?
     end
@@ -252,6 +304,7 @@ module Saboteur
     def validate_baseline!
       raise ConfigError, "seed must be >= 0" if self["seed"].negative?
       raise ConfigError, "baseline_passes must be >= 1" if self["baseline_passes"] < 1
+      raise ConfigError, "coverage_parts must be >= 1" if self["coverage_parts"] < 1
       raise ConfigError, "max_duration must be > 0" if self["max_duration"] && !self["max_duration"].positive?
     end
 
@@ -270,6 +323,7 @@ module Saboteur
     def validate_modes!
       validate_fail_fast!
       validate_matrix!
+      validate_resume!
       validate_test_selection!
       validate_gates!
       validate_score_gates!
@@ -327,6 +381,17 @@ module Saboteur
       raise ConfigError, "matrix cannot be combined with incremental: reused verdicts list only the first killer"
     end
 
+    # --resume DIR keeps verdicts in DIR for a later run (#471); it reuses
+    # them the way --incremental does, so the same limits apply.
+    def validate_resume!
+      resume = self["resume"]
+      return if resume.nil?
+      raise ConfigError, "resume must be a non-blank directory path" unless resume.is_a?(String) && !resume.strip.empty?
+      return unless self["matrix"] || !self["test_command"].to_s.empty?
+
+      raise ConfigError, "resume cannot be combined with matrix or test_command: reused verdicts are not valid there"
+    end
+
     def validate_threshold!
       threshold = self["threshold"]
       return if threshold.nil? || THRESHOLD_RANGE.cover?(threshold)
@@ -376,6 +441,7 @@ module Saboteur
         raise ConfigError, "flaky_check must be one of: off, survivors, decisive"
       end
 
+      validate_coverage_settings!
       validate_mutant_limit!
       validate_threshold!
       validate_modes!

data/lib/saboteur/constant_subject_finder.rb

@@ -3,6 +3,7 @@
 
 require "prism"
 require_relative "subject"
+require_relative "deep_source"
 require_relative "constant_subject"
 
 module Saboteur
@@ -47,6 +48,8 @@ module Saboteur
       result = Prism.parse(source)
       return Parsed.new(subjects: [], unsupported: [], errors: result.errors.map(&:message)) if result.failure?
 
+      DeepSource.check!(result.value, file)
+
       ctx = { file: file, source: source, frozen: frozen_literals?(result) }
       out = { subjects: [], unsupported: [], ambiguous: [] }
       walk(result.value, [], out, **ctx)

data/lib/saboteur/custom_map.rb

@@ -67,23 +67,24 @@ module Saboteur
 
       numbered = key.is_a?(Regexp) && spec.match?(/\\\d/)
       named = key.is_a?(Regexp) && spec.match?(/%[-0-9]*[<{][^>}]+[>}]|\\k</)
-      if numbered && named
-        raise ConfigError, "#{path}: #{key.inspect} maps to #{spec.inspect}; " \
-                           'regex map specs support \1 backreferences only'
-      end
-      return if numbered # backreference filled in at match time
-
+      # Existence is deliberately not checked here: a stale or mistyped
+      # entry warns at guess time and the naming convention takes over,
+      # instead of the whole run dying at boot on one bad line (#640).
+      # The root check comes first: no template, backreference or named,
+      # may skip it (#712).
       expanded = File.expand_path(spec, root)
       unless expanded.start_with?("#{root}/")
         raise ConfigError, "#{path}: #{key.inspect} maps to #{spec.inspect}, which is outside the project root"
       end
-      return if Dir.glob(expanded).any?
-
-      if named
+      if numbered && named
         raise ConfigError, "#{path}: #{key.inspect} maps to #{spec.inspect}; " \
                            'regex map specs support \1 backreferences only'
       end
-      raise ConfigError, "#{path}: #{key.inspect} maps to #{spec.inspect}, which matches no file"
+      return if numbered # backreference filled in at match time
+      return unless named
+
+      raise ConfigError, "#{path}: #{key.inspect} maps to #{spec.inspect}; " \
+                         'regex map specs support \1 backreferences only'
     end
 
     private_class_method :validate_entry, :validate_spec
@@ -160,14 +161,14 @@ module Saboteur
       return :excluded if matches.all? { |entry, _| entry.specs.empty? }
 
       matches.reject { |entry, _| entry.specs.empty? }
-             .flat_map { |entry, match| resolve(entry, match) }
+             .flat_map { |entry, match| resolve(entry, match, file) }
     end
 
     def specificity(key)
       key.count("^*?[]{}\\")
     end
 
-    def resolve(entry, match)
+    def resolve(entry, match, file = nil)
       return :excluded if entry.specs.empty?
 
       specs = entry.specs
@@ -176,6 +177,13 @@ module Saboteur
         # that is never a real spec path, so drop it here rather than letting
         # a junk entry reach the run.
         specs = specs.map { |spec| spec.gsub(/\\(\d+)/) { match[::Regexp.last_match(1).to_i].to_s } }.reject(&:empty?)
+        # A capture can carry "../" segments the template check never saw:
+        # refuse a filled spec that escapes the root (#712).
+        escaped = specs.reject { |spec| File.expand_path(spec, @root).start_with?("#{@root}/") }
+        if escaped.any?
+          raise ConfigError,
+                "#{entry.key.inspect} maps #{file} to #{escaped.first.inspect}, which is outside the project root"
+        end
       end
       specs
     end

data/lib/saboteur/deep_source.rb

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  # A file nested deeper than the walkers can safely recurse (#719).
+  class DeepSourceError < Error
+    def initialize(file, limit)
+      super("#{file} nests deeper than #{limit} AST levels; saboteur cannot walk it safely")
+    end
+  end
+
+  # The AST walkers (SubjectFinder, ConstantSubjectFinder, AttributeFinder
+  # and the operator visits) recurse one stack frame per nesting level and
+  # overflow the Ruby stack around a thousand nested calls, while Prism
+  # still parses to about five thousand (#719). Measuring depth iteratively
+  # before any walk turns that crash into a clean refusal: the CLI boundary
+  # prints one line naming the file and exits 3.
+  module DeepSource
+    # Two AST levels per nested call (`a(` adds a CallNode and an
+    # ArgumentsNode). The finders walk a file from its root and survive a
+    # thousand nested calls, so their limit sits just above that. The
+    # operator visits recurse deeper per level (method_swap overflows a
+    # bare stack around 900 nested calls, earlier under the engine), so a
+    # subject's body refuses earlier. Both margins stay deterministic:
+    # a clean refusal instead of a SystemStackError that depends on how
+    # deep the caller's stack already is.
+    MAX_AST_DEPTH = 2200
+    MAX_MUTATION_DEPTH = 1200
+
+    def self.check!(program, file, limit: MAX_AST_DEPTH)
+      raise DeepSourceError.new(file, limit) if depth(program) > limit
+    end
+
+    # Iterative on purpose: a recursive measure would crash on exactly the
+    # files it exists to catch (#719, same shape as #711).
+    def self.depth(node)
+      max = 0
+      work = [[node, 1]]
+      until work.empty?
+        current, level = work.pop
+        next if current.nil?
+
+        max = level if level > max
+        current.compact_child_nodes.each { |child| work << [child, level + 1] }
+      end
+      max
+    end
+  end
+end

data/lib/saboteur/dirty_tree_warning.rb

@@ -26,7 +26,7 @@ module Saboteur
     # unknown tree. The root is physical (realpath), like the paths
     # Config#included_files returns.
     def self.for(config, config_path:, gemfile: ENV.fetch("BUNDLE_GEMFILE", nil))
-      state = WorkingTree.new(config.root, ignored: config.output_paths).state
+      state = WorkingTree.new(config.root, ignored: config.ignored_tree_paths(gemfile: gemfile)).state
       root = File.realpath(config.root)
       new(state, included: relative(config.included_files, root), include: config["include"],
                  exclude: config["exclude"], root: root,

data/lib/saboteur/doctor.rb

@@ -19,6 +19,7 @@ module Saboteur
     def call
       Engine::Boot.refuse_recursion!
       check_runtime
+      check_environment
       check_coverage
       check_boot_files
       check_custom_map
@@ -55,6 +56,11 @@ module Saboteur
       raise Error, "target boot failed: #{e.class}: #{e.message}; check require files, hooks and rspec_args"
     end
 
+    def check_environment
+      hints = EnvironmentHints.all(@config.root)
+      @out.puts "Environment: #{hints.empty? ? 'no bundler/appraisal problems detected' : hints.join('; ')}"
+    end
+
     def check_runtime
       @out.puts "Ruby: #{RUBY_DESCRIPTION}"
       unless Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.3") && Process.respond_to?(:fork)

data/lib/saboteur/engine/baseline_guard.rb

@@ -5,6 +5,7 @@ require "json"
 require "fileutils"
 require_relative "../text"
 require_relative "../frameworks/sqlite_memory_database"
+require_relative "baseline_parts"
 
 module Saboteur
   class Engine
@@ -12,6 +13,8 @@ module Saboteur
     # or mutation source is used. This catches observed instability, not all
     # possible flaky behaviour.
     class BaselineGuard
+      include BaselineParts
+
       # How many unchanged-suite checks actually completed and validated:
       # the number of order comparisons a run can claim is one less.
       attr_reader :completed_passes
@@ -131,10 +134,10 @@ module Saboteur
         return if mutants_get >= pass_elapsed
 
         verdict = mutants_get <= 0 ? "exceeds" : "barely fits"
-        @diagnostics.warn("projected baseline+coverage ~#{projected.round}s #{verdict} " \
+        @diagnostics.warn("raise --max-duration, pass fewer --baseline-passes, or narrow the scope\n  " \
+                          "projected baseline+coverage ~#{projected.round}s #{verdict} " \
                           "--max-duration #{budget.round}s; mutants would get " \
-                          "~#{format('%g', [mutants_get, 0].max.round(1))}s. Raise --max-duration, pass fewer " \
-                          "--baseline-passes, or narrow the scope")
+                          "~#{format('%g', [mutants_get, 0].max.round(1))}s")
       end
 
       # An admitted pass still gets only the time left in the run budget:
@@ -176,6 +179,9 @@ module Saboteur
       end
 
       def check(number)
+        parts = baseline_parts
+        return check_parts(number, parts) if parts.size > 1
+
         Execution::ForkReadiness.prepare_heap
         heartbeat = @diagnostics.progress_heartbeat("baseline check #{number}").watch(log_path(number))
         admitted = phase_timeout
@@ -183,6 +189,11 @@ module Saboteur
                                  label: "baseline child died during setup/run") do |writer|
           record(writer, number)
         end
+        settled(number, result, admitted)
+      end
+
+      def settled(number, result, admitted, part: nil)
+        @part = part
         refuse_budget_stop(number, admitted) if budget_stopped?(result, admitted)
         refuse(number, stopped_reason(result)) if result.stopped_by
         # Before the payload checks: a child killed by a signal (the OOM
@@ -221,15 +232,16 @@ module Saboteur
           data["executed"].is_a?(Array) && data["executed"].all?(String)
       end
 
-      def record(writer, number)
-        path = log_path(number)
+      def record(writer, number, files: nil, part: nil)
+        path = log_path(number, part)
         FileUtils.mkdir_p(File.dirname(path))
         $stdout.reopen(path, "w")
         $stdout.sync = true
         $stderr.reopen($stdout)
         @hooks.run(:after_fork)
         Kernel.srand(@config["seed"])
-        result = @integration.run_baseline(seed: @config["seed"])
+        seed = @config["seed"]
+        result = files ? @integration.run_baseline(seed: seed, files: files) : @integration.run_baseline(seed: seed)
         payload = { passed: result.passed, failed: result.failed_ids, executed: result.executed_ids }
         payload[:hint] = Frameworks::SqliteMemoryDatabase.fork_loss_hint unless result.passed
         writer.write(JSON.generate(payload))
@@ -260,29 +272,54 @@ module Saboteur
         return if errors.empty? || !spec_helper_requires_minitest?
 
         symptom = (lines.find { |line| line.include?("undefined method") } || errors.first).strip
-        @diagnostics.warn("the baseline failure looks like a Minitest suite running under RSpec, not a " \
+        @diagnostics.warn("run saboteur on an RSpec suite: it is RSpec-only, so a Minitest suite cannot be " \
+                          "mutation tested with it\n  " \
+                          "the baseline failure looks like a Minitest suite running under RSpec, not a " \
                           "broken RSpec suite: the log shows #{errors.size} " \
                           "NoMethodError#{'s' if errors.size > 1} (for example: #{symptom.slice(0, EXCERPT_WIDTH)}) " \
-                          "and spec/spec_helper.rb requires minitest. saboteur is RSpec-only, so a " \
-                          "Minitest suite cannot be mutation tested with it.")
+                          "and spec/spec_helper.rb requires minitest")
       end
 
       # The framework check behind the warning: spec_helper is the
-      # suite's own declaration of what it runs on.
+      # suite's own declaration of what it runs on. Parsed, not grepped: a
+      # regex also fires on commented-out or heredoc "require" lines for a
+      # framework the project does not use (#708).
       def spec_helper_requires_minitest?
-        File.read(File.join(@config.root, "spec", "spec_helper.rb")).match?(/^\s*require\s+["']minitest/)
+        require_calls(Prism.parse_file(File.join(@config.root, "spec", "spec_helper.rb")).value)
+          .any? { |name| name == "minitest" || name.start_with?("minitest/") }
       rescue SystemCallError
         false
       end
 
+      # Iterative like RefinementActivations.collect: a deeply nested
+      # spec_helper must never raise SystemStackError out of a warning
+      # heuristic (same class as #711).
+      def require_calls(node)
+        found = []
+        work = [node]
+        until work.empty?
+          current = work.pop
+          next unless current.is_a?(Prism::Node)
+
+          if current.is_a?(Prism::CallNode) && current.name == :require && current.receiver.nil?
+            argument = current.arguments&.arguments&.first
+            found << argument.unescaped if argument.is_a?(Prism::StringNode)
+          end
+          work.concat(current.compact_child_nodes)
+        end
+        found
+      end
+
       # A child that recognises its own failure shape (an empty sqlite
       # :memory: database after the fork, #387) says how to fix it.
       def with_hint(reason, data)
         data["hint"] ? "#{reason}. #{data['hint']}" : reason
       end
 
-      def log_path(number)
-        File.join(@config.path("cache_dir"), "baseline-#{number}.log")
+      # A split check keeps one log per part: baseline-1-part-2.log.
+      def log_path(number, part = @part)
+        name = part ? "baseline-#{number}-part-#{part + 1}.log" : "baseline-#{number}.log"
+        File.join(@config.path("cache_dir"), name)
       end
 
       # Leftover children are a pass-with-leaks verdict, not a suite

data/lib/saboteur/engine/baseline_parts.rb

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require_relative "suite_partition"
+
+module Saboteur
+  class Engine
+    # A baseline check split like the coverage build (--coverage-parts N):
+    # the same disjoint spec-file parts run as children at once, each over
+    # its own files. Uses the guard's @config, @integration, @supervisor,
+    # @diagnostics, @part and settled/phase_timeout/log_path.
+    #
+    # The check's contract is unchanged. Every part must pass, and the
+    # examples the parts executed together must be exactly the loaded
+    # suite's (the guard compares them before it accepts the pass). What a
+    # split no longer shows is a failure that needs the whole suite in one
+    # process.
+    module BaselineParts
+      private
+
+      # The parts the coverage build would use. One part (or none, for an
+      # adapter that lists no spec files) means the ordinary single check.
+      def baseline_parts
+        Engine::SuitePartition.parts(@integration.test_files, @config["coverage_parts"])
+      end
+
+      def check_parts(number, parts)
+        Execution::ForkReadiness.prepare_heap
+        heartbeat = @diagnostics.progress_heartbeat("baseline check #{number} (#{parts.size} parts)")
+                                .watch(log_path(number, 0))
+        admitted = phase_timeout
+        results = @supervisor.run_many(parts.size, timeout: admitted, on_tick: heartbeat.method(:tick),
+                                                   label: "baseline child died during setup/run") do |writer, slot|
+          ENV["TEST_ENV_NUMBER"] = slot.zero? ? "" : (slot + 1).to_s
+          record(writer, number, files: parts[slot], part: slot)
+        end
+        joined(results.each_with_index.map { |result, slot| settled(number, result, admitted, part: slot) })
+      end
+
+      # What the guard's checks read: the first failing part's own result
+      # (its failures and hint; @part names its log), or a pass carrying
+      # every example the parts executed.
+      def joined(datas)
+        @part = datas.index { |data| !(data["passed"] && data["failed"].empty?) }
+        return datas[@part] if @part
+
+        { "passed" => true, "failed" => [], "executed" => datas.flat_map { |data| data["executed"] } }
+      end
+    end
+  end
+end

data/lib/saboteur/engine/boot.rb

@@ -71,6 +71,10 @@ module Saboteur
         Integration::RSpec.new(@config).require_framework if @config["integration"] == "rspec"
         @config["require"].each { |file| require File.expand_path(file, @root) }
         integration = Integration.fetch(@config["integration"]).new(@config)
+        # Running outside the bundle or beside an Appraisal gemfile set
+        # loads the wrong gems; say so before the spec load fails in
+        # confusing ways (#598, #609). Advisory only.
+        EnvironmentHints.all(@root).each { |hint| warn "saboteur: warning: #{hint}" }
         integration.setup
         rails&.after_boot
         @hooks.run(:after_boot)

data/lib/saboteur/engine/candidate_selection.rb

@@ -8,11 +8,12 @@ module Saboteur
     class CandidateSelection
       attr_reader :skipped_subjects, :selected, :unscoped_digests
 
-      def initialize(candidates:, map:, limit:, diagnostics:)
+      def initialize(candidates:, map:, limit:, diagnostics:, root: nil)
         @candidates = candidates
         @map = map
         @limit = limit
         @diagnostics = diagnostics
+        @root = root
         @skipped_subjects = {}
         @selected = {}
         @unscoped_digests = {}
@@ -29,6 +30,7 @@ module Saboteur
           return @selected[subject] = []
         end
 
+        warn_boot_once(subject)
         list = @candidates.for(subject)
         # The full pre-scope digests let IgnoreList#apply tell "mutation gone"
         # from "mutation scoped out of this run" (#284).
@@ -48,18 +50,26 @@ module Saboteur
 
       private
 
+      # A note, not a verdict (#575): every mutant still runs and scores.
+      def warn_boot_once(subject)
+        return unless @map.boot_once?(subject)
+
+        @diagnostics.warn("#{subject.id}: verify a survivor here by mutating the file on disk\n  " \
+                          "covered by every test and run at boot: mutants apply after boot, so a survivor " \
+                          "can be a boot-once effect the suite cannot re-observe (#575)")
+      end
+
       # A scoped no-coverage skip names the specs the run loaded: coverage
       # living in a sibling spec file is otherwise invisible, and the false
       # read is "untestable" when the truth is "not loaded" (#636). Names
       # at most five, like the other selection notes.
       def skip_announcement(subject, reason)
-        line = "#{subject.id}: skipped (#{reason}); its change is not verified by this run"
+        line = "#{subject.id} (#{subject.location(@root)}): skipped (#{reason}); its change is not verified by this run"
         return line unless reason == "no coverage"
 
         loaded = @map.tests.map { |id| id.split("[").first.delete_prefix("./") }.uniq.sort
-        more = loaded.size > 5 ? ", ..." : ""
-        names = loaded.empty? ? "none" : loaded.first(5).join(", ")
-        "#{line} - loaded specs: #{names}#{more}; " \
+        names = loaded.empty? ? "none" : Text.name_list(loaded)
+        "#{line} - loaded specs: #{names}; " \
           "other spec files may cover it, pass --test to load them"
       end
 

data/lib/saboteur/engine/candidates.rb

@@ -109,6 +109,9 @@ module Saboteur
       end
 
       def proposals(source, subject)
+        # The operator visits recurse over the subject's body; refuse a
+        # body nested too deeply instead of crashing the run (#719).
+        DeepSource.check!(subject.node, subject.file, limit: DeepSource::MAX_MUTATION_DEPTH)
         proposals = source.mutations_for(subject)
         if proposals.empty?
           @diagnostics.record_generation(subject, source: source_name(source), reason: "empty_generation")
@@ -142,7 +145,7 @@ module Saboteur
 
         [mutation, text]
       rescue ArgumentError => e
-        @diagnostics.warn("#{subject.id}: dropped #{mutation.source} mutation: #{e.message}")
+        @diagnostics.warn("#{subject.id}: dropped #{mutation.source} mutation\n  #{e.message}")
         record_drop(subject, mutation, "invalid_edit")
       end