saboteur 0.9.0 → 0.11.0

data/lib/saboteur/engine/diagnostics.rb

@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: MIT
 # frozen_string_literal: true
 
+require "io/console"
 require "tempfile"
 
+require_relative "../reporter/palette"
+
 module Saboteur
   class Engine
     # What a run has to say besides results: warnings for the report, the
@@ -66,19 +69,32 @@ module Saboteur
       end
 
       MARKS = { killed: ".", survived: "S", timeout: "T", resource_limit: "L", error: "E" }.freeze
-      LEGEND = ". killed  S survived  T timeout  L resource limit  E error"
-      LINE_WIDTH = 50
+      MARK_TOKENS = { "." => :dim, "S" => :fail, "T" => :warn, "E" => :fail, "L" => :fail }.freeze
+      # Readback whitelist: mutant children inherit the progress fd and can
+      # write arbitrary bytes, so only known mark letters come back out.
+      READBACK_GLYPHS = (MARK_TOKENS.keys + ["?"]).freeze
+      # s:skipped never prints a glyph: skipped mutants never reach
+      # progress (see start_progress); the letter is legend-only.
+      LEGEND = ".:killed S:survived T:timeout E:error s:skipped L:resource limit"
+
+      # Chunk sizing: leave room for the "  (n/total ...)" suffix, never
+      # below the floor.
+      CHUNK_MARGIN = 10
+      CHUNK_FLOOR = 40
+      DEFAULT_WIDTH = 80
 
       GenerationEvent = Data.define(:file, :subject, :source, :operator, :reason)
       Omission = Data.define(:subject, :count, :limit)
       DiscoveryFailure = Data.define(:file, :reason)
 
       attr_reader :warnings, :live_announced, :invalid_mutations, :generation_events, :omissions, :discovery_failures,
-                  :hazard_suppressions, :inline_suppressions, :verbose
+                  :hazard_suppressions, :inline_suppressions, :verbose, :quiet_start
 
-      def initialize(err, verbose: false)
+      def initialize(err, verbose: false, palette: nil, quiet_start: true)
         @err = err
         @verbose = verbose
+        @quiet_start = quiet_start
+        @palette = palette || Reporter::Palette.for(err)
         @warnings = []
         @invalid_mutations = 0
         @generation_events = []
@@ -163,6 +179,51 @@ module Saboteur
         @err.puts("saboteur: #{Text.display_safe_lines(message)}")
       end
 
+      # Chatter the default view folds into the quiet-start lines;
+      # --verbose prints it byte-for-byte as before.
+      def detail(message)
+        inform(message) if @verbose || !@quiet_start
+      end
+
+      # A selection explanation the default view carries as one dim
+      # summary line: the full text stays in report.warnings for machine
+      # consumers and counts as announced, so it is not reprinted at the
+      # end of the run.
+      def announce_demoted(message)
+        safe = Text.display_safe_lines(message)
+        warn(safe)
+        @live_announced << safe
+      end
+
+      # The quiet start: three lines, then progress. --verbose keeps
+      # today's chatter instead and never prints these.
+      def quiet_start_header(scope:, seed:, operators:)
+        return if @verbose || !@quiet_start
+
+        dot = @palette.glyph(:middot)
+        line = "saboteur #{Saboteur::VERSION} #{dot} #{scope} #{dot} seed #{seed} #{dot} " \
+               "#{operators} operators (--list-operators)"
+        @err.puts(@palette.paint(:dim, line))
+      end
+
+      def quiet_baseline(passes:, elapsed:, tests:, cached:)
+        return if @verbose || !@quiet_start
+
+        check = @palette.paint(:pass, @palette.glyph(:check))
+        suffix = cached ? " (cached)" : ""
+        line = "#{check} baseline green (#{passes} #{passes == 1 ? 'pass' : 'passes'}, " \
+               "#{format('%.1f', elapsed)}s)  #{check} coverage map: #{tests} " \
+               "#{tests == 1 ? 'test' : 'tests'}#{suffix}"
+        @err.puts(line)
+      end
+
+      def quiet_inference(spec_count)
+        return if spec_count.nil? || @verbose || !@quiet_start
+
+        files = spec_count == 1 ? "spec file" : "spec files"
+        @err.puts(@palette.paint(:dim, "spec inference: #{spec_count} #{files} (details: --verbose)"))
+      end
+
       # --verbose: one line per finished subject with its result marks, so a
       # survivor is attributable to a method as soon as the subject
       # completes, before the whole run ends (#262).
@@ -170,7 +231,7 @@ module Saboteur
         return unless @verbose
         return if results.empty?
 
-        marks = results.map { |result| MARKS.fetch(result.status, "?") }.join
+        marks = results.map { |result| painted_mark(MARKS.fetch(result.status, "?")) }.join
         inform("#{subject.id}  #{marks}")
       end
 
@@ -204,21 +265,36 @@ module Saboteur
         @progress_file = Tempfile.new("saboteur-progress")
         @progress_file.binmode
         @progress_file.sync = true
-        @err.puts("saboteur: progress #{LEGEND}") unless progress_on_terminal?
+        @glyphs = +""
+        @err.puts(@palette.paint(:dim, LEGEND))
       end
 
       def progress(result)
         mark = MARKS.fetch(result.status, "?")
-        return plain_progress(mark) unless @progress_file
+        return plain_progress(painted_mark(mark)) unless @progress_file
 
         done = record_progress(mark)
-        progress_on_terminal? ? terminal_progress(done) : ci_progress(mark, done)
+        if progress_on_terminal?
+          @glyphs << mark
+          @glyphs.size >= chunk_width ? commit_chunk(done) : redraw_line(done)
+        elsif (done % chunk_width).zero?
+          commit_file_chunk(done - chunk_width, chunk_width, done)
+        end
         @err.flush
       end
 
+      def painted_mark(mark)
+        token = MARK_TOKENS[mark]
+        token ? @palette.paint(token, mark) : mark
+      end
+
       def finish_progress
-        @err.puts if @progress_file && (progress_on_terminal? || @progress_file.size % LINE_WIDTH != 0)
-        @progress_file&.close!
+        return unless @progress_file
+
+        size = @progress_file.size
+        pending = size % chunk_width
+        commit_file_chunk(size - pending, pending, size) if pending.positive?
+        @progress_file.close!
         @progress_file = nil
       end
 
@@ -245,13 +321,42 @@ module Saboteur
         @err.respond_to?(:tty?) && @err.tty?
       end
 
-      def terminal_progress(done)
-        @err.print("\r\e[Ksaboteur: #{progress_summary(done)}")
+      def chunk_width
+        columns = begin
+          @err.winsize[1] if @err.respond_to?(:winsize)
+        rescue SystemCallError
+          nil
+        end
+        [(columns || DEFAULT_WIDTH) - CHUNK_MARGIN, CHUNK_FLOOR].max
       end
 
-      def ci_progress(mark, done)
-        @err.print(mark)
-        @err.print(" #{progress_summary(done)}\n") if (done % LINE_WIDTH).zero?
+      def painted_glyphs
+        @glyphs.each_char.map { |glyph| painted_mark(glyph) }.join
+      end
+
+      def redraw_line(done)
+        @line_open = true
+        @err.print("\r\e[K#{painted_glyphs}  #{@palette.paint(:dim, progress_summary(done))}")
+      end
+
+      def commit_chunk(done)
+        @err.print("\r\e[K#{painted_glyphs}  #{@palette.paint(:dim, progress_summary(done))}\n")
+        @glyphs.clear
+      end
+
+      # Piped chunks and the final partial chunk come from the progress
+      # file, not the buffer: workers each buffer only their own marks,
+      # while the shared file the workers inherit holds every mark.
+      def commit_file_chunk(start, length, done)
+        @err.print("\r\e[K") if @line_open
+        @err.print("#{painted_file_glyphs(start, length)}  #{@palette.paint(:dim, progress_summary(done))}\n")
+      end
+
+      # binread caps at both +length+ (the recorded mark count) and EOF,
+      # so a short or padded file cannot leak extra glyphs.
+      def painted_file_glyphs(start, length)
+        bytes = File.binread(@progress_file.path, length, start)
+        bytes.each_char.filter_map { |glyph| painted_mark(glyph) if READBACK_GLYPHS.include?(glyph) }.join
       end
 
       def eta_text(done)

data/lib/saboteur/engine/run_fingerprint.rb

@@ -14,7 +14,7 @@ module Saboteur
     class RunFingerprint
       FORMAT_VERSION = 1
       MANIFESTS = %w[Gemfile gems.rb Gemfile.lock gems.locked .rspec .rspec-local].freeze
-      LOCATION_SETTINGS = Config::OUTPUT_KEYS
+      LOCATION_SETTINGS = Config::OUTPUT_KEYS + Config::PRESENTATION_KEYS
       ENTRY_KINDS = %w[ruby manifest boot hook source_plugin extra data].freeze
       EXCLUDED_DIRECTORIES = %w[.git vendor node_modules].freeze
       Entry = Data.define(:path, :kind, :state, :sha256, :required)

data/lib/saboteur/engine/scheduler.rb

@@ -232,6 +232,26 @@ module Saboteur
         result
       end
 
+      attr_reader :runner, :map
+
+      # The eval prefix a post-run confirmation run needs for this subject
+      # (#1063): the same wrapper detection load_problem applies, reduced to
+      # the sorbet sig prefix a survivor could have run with.
+      def confirmation_prefix(subject)
+        return nil unless @verify_loaded
+        return nil if @reevaluator.whole_file?(subject)
+
+        owner = @reevaluator.resolve_owner(subject)
+        target = subject.singleton ? owner.singleton_class : owner
+        method = own_method(target, subject.name)
+        return nil unless method
+
+        file, = method.source_location
+        Execution::Wrapper.around(method, file) == :sorbet ? subject.sig_source : nil
+      rescue Error
+        nil
+      end
+
       # The tests that ran the edited code (a coarse edit spans the whole
       # body, so it gets every test of the method), prior killers first, then
       # fastest-first.

data/lib/saboteur/engine/selection_announcement.rb

@@ -27,8 +27,15 @@ module Saboteur
       end
 
       def announce_selection(guess)
-        if guess.changed.zero? || guess.specs.any?
+        if guess.changed.zero?
           @diagnostics.announce(selection_message(guess))
+        elsif guess.specs.any?
+          @quiet_spec_count = guess.specs.size
+          if @diagnostics.verbose || !@diagnostics.quiet_start
+            @diagnostics.announce(selection_message(guess))
+          else
+            @diagnostics.announce_demoted(selection_message(guess))
+          end
         else
           @diagnostics.inform(selection_message(guess))
         end

data/lib/saboteur/engine/survivor_confirmation.rb

@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+module Saboteur
+  class Engine
+    # Post-run survivor confirmation (#1063): with partial_coverage=use the
+    # coverage map can be a partial rebuild, so every open survivor's
+    # covering specs the mutant never ran get one budgeted confirmation run
+    # through the same Runner invocation the scheduler makes. A failing run
+    # kills the mutant; a passing run marks the result confirmed; anything
+    # that could not run is marked unconfirmed with the reason. The field is
+    # additive - the status keeps its meaning - and no outcome is silent.
+    class SurvivorConfirmation
+      # The most covering specs one survivor re-runs; the config's
+      # confirmation_budget caps the whole pass.
+      MAX_SPECS_PER_SURVIVOR = 8
+
+      def initialize(config:, map:, scheduler:, diagnostics:, budget_exceeded:, cache: nil)
+        @config = config
+        @map = map
+        @scheduler = scheduler
+        @diagnostics = diagnostics
+        @budget_exceeded = budget_exceeded
+        @cache = cache
+      end
+
+      def call(results, ignore_list:, early_stop: nil)
+        survivors = results.select { |result| result.survived? && !ignore_list.accepts?(result) }
+        return results if survivors.empty?
+
+        if early_stop
+          @diagnostics.warn("survivor confirmation covers only the survivors reached before the run " \
+                            "stopped early (#{early_stop.reason})")
+        end
+        @remaining = @config["confirmation_budget"]
+        results.map { |result| survivors.include?(result) ? confirm(result) : result }
+               .tap { |confirmed| summarize(confirmed) }
+      end
+
+      private
+
+      def confirm(result)
+        return unconfirmed(result, "the confirmation budget is spent") if @remaining <= 0
+        return unconfirmed(result, "the --max-duration budget is spent") if @budget_exceeded.call
+
+        tests = unrun_covering_tests(result)
+        return result if tests.empty?
+
+        outcome = run_confirmation(result, tests)
+        @remaining -= outcome.runtime || 0
+        case outcome.status
+        when :killed then checked_kill(result, tests, outcome)
+        when :survived then result.with_confirmation("confirmed")
+        else unconfirmed(result, "the confirmation run #{outcome.status}: #{outcome.message}")
+        end
+      end
+
+      # The whole-suite map's covering tests for the mutant's edited lines
+      # (branch evidence intersected, mirroring the scheduler), minus the
+      # tests the mutant already ran, fastest first, capped.
+      def unrun_covering_tests(result)
+        fastest_first(covering_tests(result) - (result.executed || result.covered_by)).first(MAX_SPECS_PER_SURVIVOR)
+      end
+
+      def covering_tests(result)
+        line_numbers = result.mutation.edits.flat_map { |edit| result.subject.coverage_lines_for(edit) }.uniq
+        tests = @map.tests_for_edit(result.subject, line_numbers)
+        branch_tests = @map.tests_for_branches(result.subject, result.mutation.edits)
+        branch_tests ? tests & branch_tests : tests
+      end
+
+      def fastest_first(tests)
+        tests.sort_by { |id| @map.recorded_runtime([id]) || Float::INFINITY }
+      end
+
+      def run_confirmation(result, tests)
+        @scheduler.runner.run(subject: result.subject, text: result.mutated_source, test_ids: tests,
+                              timeout: timeout_for(tests, result), mutation: result.mutation,
+                              eval_prefix: @scheduler.confirmation_prefix(result.subject))
+      end
+
+      # A confirmation kill stands only after the same VerdictCheck the
+      # scheduler runs: the kill sequence, in order, must pass with the
+      # method unchanged, so an order-dependent spec cannot convert a true
+      # survivor into a credited kill (security review). A rejected kill
+      # becomes an error; a check the budgets never let run comes back
+      # unverified - outside the score and never cached.
+      def checked_kill(result, tests, outcome)
+        kill = result.with_confirmation("confirmed", status: :killed, reason: outcome.message,
+                                                     killed_by: outcome.failed_ids, covered_by: tests,
+                                                     kill_cause: outcome.kill_cause,
+                                                     runtime: (result.runtime || 0) + (outcome.runtime || 0),
+                                                     executed: (result.executed || []) + outcome.executed_ids)
+        checked = VerdictCheck.new(run_unchanged: unchanged_runner(result.subject),
+                                   baseline_timeout: @config["baseline_timeout"]).call([kill]).first
+        return checked unless checked.status == :killed
+
+        @diagnostics.inform("#{result.subject.id} #{result.mutation.operator} #{result.digest}: " \
+                            "killed on confirmation by #{outcome.failed_ids.first}")
+        record_kill(result, kill)
+        checked
+      end
+
+      # The standing kill goes into the verdict cache with the mutant's full
+      # covering test set, not the capped confirmation subset: the cache
+      # fingerprint digests that set, so only the full set overwrites the
+      # survivor verdict the run cached and lets the next run reuse the kill
+      # (#1079). ResultCache#record replaces the subject+mutation entry, so
+      # the stale survivor verdict cannot win a later lookup.
+      def record_kill(result, kill)
+        @cache&.record(kill.with_confirmation("confirmed", covered_by: covering_tests(result)))
+      end
+
+      # The unchanged-method re-run VerdictCheck checks a kill against, in
+      # the unchanged_runner shape (scheduler.rb), against the confirmation
+      # and --max-duration budgets instead of the scheduler's plan state.
+      def unchanged_runner(subject)
+        lambda do |tests, timeout|
+          if @remaining <= 0 || @budget_exceeded.call
+            Execution::Runner::Outcome.new(status: :unverified, runtime: 0.0,
+                                           message: "the confirmation budget is spent")
+          else
+            outcome = @scheduler.runner.run(subject: subject, text: subject.source, test_ids: tests,
+                                            timeout: timeout,
+                                            eval_prefix: @scheduler.confirmation_prefix(subject))
+            @remaining -= outcome.runtime || 0
+            outcome
+          end
+        end
+      end
+
+      def unconfirmed(result, reason)
+        result.with_confirmation("unconfirmed(#{reason})")
+      end
+
+      # The scheduler's timeout_for shape with the post-run slowdown of 1.0.
+      # recorded_runtime is nil without arm durations: fall back to the
+      # mutant's own first-run runtime, then to the suite's mean.
+      def timeout_for(tests, result)
+        recorded = @map.recorded_runtime(tests) || result.runtime || suite_mean_runtime
+        return @config["baseline_timeout"] unless recorded
+
+        [@config["timeout_factor"] * recorded, @config["timeout_min"]].max
+      end
+
+      def suite_mean_runtime
+        durations = @map.tests.map { |id| @map.recorded_runtime([id]) }.compact
+        durations.empty? ? nil : durations.sum / durations.size
+      end
+
+      def summarize(results)
+        counts = results.filter_map(&:confirmation).tally
+        return if counts.empty?
+
+        @diagnostics.inform("survivor confirmation: #{counts.map { |mark, n| "#{n} #{mark}" }.join(', ')}")
+      end
+    end
+  end
+end

data/lib/saboteur/engine.rb

@@ -12,6 +12,7 @@ require_relative "engine/load_coverage"
 require_relative "engine/out_of_scope_guard"
 require_relative "engine/run_budget"
 require_relative "engine/selection_announcement"
+require_relative "engine/survivor_confirmation"
 require_relative "engine/thread_warnings"
 
 require_relative "engine/pipelines"
@@ -38,10 +39,13 @@ module Saboteur
     # The specs inference narrowed the run to, or nil when it did not.
     attr_reader :guessed_tests
 
-    def initialize(config, err: $stderr, digest: nil, capture_evidence: false, evidence_files: [], verbose: false)
+    def initialize(config, err: $stderr, digest: nil, capture_evidence: false, evidence_files: [], verbose: false,
+                   palette: nil, quiet_start: true)
       @config = config
       @hooks = Hooks.new
-      @diagnostics = Diagnostics.new(err, verbose: verbose)
+      @diagnostics = Diagnostics.new(err, verbose: verbose, palette: palette, quiet_start: quiet_start)
+      @completed_baseline_passes = 0
+      @baseline_elapsed = 0.0
       @root = File.realpath(config.root)
       @skipped_subjects = {}
       @replay = Replay.new(digest: digest) if digest
@@ -158,7 +162,7 @@ module Saboteur
     end
 
     # The run's immutable report, built once the last result is in.
-    def announce_operators = @diagnostics.inform("Operators: #{config.operator_policy['effective'].join(', ')}")
+    def announce_operators = @diagnostics.detail("Operators: #{config.operator_policy['effective'].join(', ')}")
 
     def build_report(results, subjects, scope, started)
       Report.new(results: results, subjects: subjects, wall_time: monotonic - started, root: @root,
@@ -200,6 +204,7 @@ module Saboteur
       store = coverage_store(integration, load_lines, load_methods)
       full_passes = config["baseline_passes"] + (store.reusable?(files) ? 0 : 1)
       warn_unscoped(integration, full_passes)
+      announce_quiet_start(store, files)
       check_baseline(integration, full_passes)
       refuse_unaffordable_coverage_build(store, files)
       return [] if abandon_for_budget?(subjects)
@@ -217,13 +222,31 @@ module Saboteur
       # mutant when serial. Pack the heap now that the map and candidates
       # are retained, to reduce later copying of shared pages.
       Execution::ForkReadiness.prepare_heap
-      results = run_candidates(runnable_subjects, runnable_lists, scheduler, cache, ignore_list)
+      results = run_and_confirm(runnable_subjects, runnable_lists, scheduler, cache, ignore_list)
       cache&.save
       results
     rescue BudgetPhaseTimeout => e
       budget_phase_stop(e, subjects)
     end
 
+    # The candidate run plus the opt-in post-run confirmation pass (#1063):
+    # confirmation runs after the last result, before the verdict cache is
+    # written, so a confirmed kill overwrites the survivor verdict the run
+    # cached (#1079). BudgetPhaseTimeout is not raised from the pass:
+    # post-run its rescue would discard every result, so a spent budget
+    # marks the remaining survivors unconfirmed instead.
+    def run_and_confirm(subjects, lists, scheduler, cache, ignore_list)
+      confirm_survivors(run_candidates(subjects, lists, scheduler, cache, ignore_list), scheduler, cache, ignore_list)
+    end
+
+    def confirm_survivors(results, scheduler, cache, ignore_list)
+      return results unless CoveragePartial.use?(config, config["coverage_parts"])
+
+      SurvivorConfirmation.new(config: config, map: scheduler.map, scheduler: scheduler, diagnostics: @diagnostics,
+                               budget_exceeded: method(:budget_exceeded?), cache: cache)
+                          .call(results, ignore_list: ignore_list, early_stop: @early_stop)
+    end
+
     def run_candidates(subjects, lists, scheduler, cache, ignore_list)
       @diagnostics.start_progress(lists.sum(&:size))
       distribution = Distribution.new(jobs: external_command? ? 1 : config["jobs"], scheduler: scheduler,
@@ -266,8 +289,22 @@ module Saboteur
       end
     end
 
+    # The default view's first line: the run's identity, dim, before the
+    # baseline's own chatter (demoted to --verbose) would start.
+    def announce_quiet_start(store, files)
+      @map_cached = store.reusable?(files)
+      @diagnostics.quiet_start_header(scope: config["since"] ? "--since #{config['since']}" : "whole project",
+                                      seed: config["seed"], operators: config.operator_policy["effective"].size)
+    end
+
     def inform_about_run(subjects, map)
-      @diagnostics.inform("#{subjects.size} subjects, #{map.tests.size} tests in coverage map")
+      if @diagnostics.quiet_start && !@diagnostics.verbose
+        @diagnostics.quiet_baseline(passes: @completed_baseline_passes, elapsed: @baseline_elapsed,
+                                    tests: map.tests.size, cached: @map_cached)
+        @diagnostics.quiet_inference(@quiet_spec_count)
+      else
+        @diagnostics.inform("#{subjects.size} subjects, #{map.tests.size} tests in coverage map")
+      end
       ThreadWarnings.warn(@diagnostics)
     end
 
@@ -437,7 +474,7 @@ module Saboteur
     # Loads the target and stops coverage, returning what the rest of the
     # run needs from that boot.
     def boot_target(boot)
-      @diagnostics.inform("loading the application")
+      @diagnostics.detail("loading the application")
       integration = boot.load_target
       files = config.included_files
       load_lines, load_methods = suspend_coverage(files)

data/lib/saboteur/help.rb

@@ -30,7 +30,10 @@ module Saboteur
            "resource-limited mutant.",
       4 => "Time budget spent: --max-duration stopped the run before the next subject, so the score is " \
            "partial. --max-duration-ok leaves the exit to the plain verdict: 0, 1, or 3 when the budget " \
-           "stopped the run before any mutant was tested."
+           "stopped the run before any mutant was tested.",
+      5 => "Baseline suite red: the unchanged suite failed its check, so no mutant ran. Fix your tests first.",
+      70 => "Internal crash: a saboteur bug, never your code. The error line names a log with the full " \
+            "backtrace; please report it."
     }.freeze
 
     DOCTOR_EXIT_CODE_MEANINGS = {

data/lib/saboteur/mutation_source/builtin.rb

@@ -4,6 +4,7 @@
 require "prism"
 require_relative "base"
 require_relative "filter_replacement"
+require_relative "copy_replacement"
 require_relative "literal_replacement"
 require_relative "argument_removal"
 require_relative "argument_swap"
@@ -21,6 +22,7 @@ require_relative "interpolation_removal"
 require_relative "jump_value"
 require_relative "regex_replacement"
 require_relative "rescue_removal"
+require_relative "ensure_removal"
 require_relative "when_removal"
 require_relative "unary_removal"
 
@@ -31,6 +33,10 @@ module Saboteur
     class Builtin < Base
       DEFAULT_ARID = [
         '\A(puts|pp|p|print|warn)\b',
+        # Exception message arguments read as diagnostics too (#1066): a
+        # raise/fail string edit sits inside the call, so the line and the
+        # call head both have to match.
+        '\A(raise|fail)\b',
         '\A(@|self\.|::)?(Rails\.)?logger\b',
         # A logger at the end of a receiver chain: Sentry.sdk_logger.warn
         # (#665). The match is case-sensitive, so SDK_LOGGER stays
@@ -76,10 +82,10 @@ module Saboteur
       SCOPE_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       # The single-purpose sources, in the order they run after the shared walk.
       DELEGATED = [
-        FilterReplacement, LiteralReplacement, ArgumentRemoval, PairRemoval, ElementRemoval, ChainRemoval,
-        EndpointReplacement, RangeReplacement, OperatorAssignment, ConditionNegation, MethodSwap,
+        FilterReplacement, CopyReplacement, LiteralReplacement, ArgumentRemoval, PairRemoval, ElementRemoval,
+        ChainRemoval, EndpointReplacement, RangeReplacement, OperatorAssignment, ConditionNegation, MethodSwap,
         OperandReplacement, InterpolationRemoval, RegexReplacement, ArgumentSwap, JumpValue, RescueRemoval,
-        WhenRemoval, UnaryRemoval
+        EnsureRemoval, WhenRemoval, UnaryRemoval
       ].freeze
 
       def initialize(arid: DEFAULT_ARID, operators: [], exclude_operators: [])

data/lib/saboteur/mutation_source/copy_replacement.rb

@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: MIT
+# frozen_string_literal: true
+
+require "prism"
+require_relative "base"
+
+module Saboteur
+  module MutationSource
+    # Drops a defensive copy (x.dup, x.clone becomes x) or makes a deep copy
+    # shallow (x.deep_dup becomes x.dup). Both let a caller and a callee share
+    # state that the original code kept apart.
+    class CopyReplacement < Base
+      DROPPED = %i[dup clone].freeze
+      SHALLOWER = { deep_dup: "dup" }.freeze
+      SCOPE_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+
+      # Base inherits Object's empty initializer; there is no parent state to set.
+      def initialize(arid: []) # rubocop:disable Lint/MissingSuper
+        @arid = arid.map { |pattern| Regexp.new(pattern) }
+      end
+
+      def name
+        "copy_replacement"
+      end
+
+      def mutations_for(subject)
+        found = []
+        visit(subject.body_node, subject, found)
+        found
+      end
+
+      private
+
+      def visit(node, subject, found)
+        return if node.nil? || SCOPE_NODES.any? { |scope| node.is_a?(scope) }
+
+        if node.is_a?(Prism::StatementsNode)
+          node.body.each { |statement| visit(statement, subject, found) unless arid?(statement) }
+          return
+        end
+
+        replace_copy(node, subject, found) if node.is_a?(Prism::CallNode)
+        node.compact_child_nodes.each { |child| visit(child, subject, found) }
+        nil
+      end
+
+      def replace_copy(node, subject, found)
+        return unless node.receiver && node.block.nil? && node.arguments.nil?
+
+        edit = DROPPED.include?(node.name) ? drop(node, subject) : shallow(node, subject)
+        found << Mutation.new(subject_id: subject.id, operator: name, edits: [edit], source: name) if edit
+      end
+
+      # Receiver stays; the dot (or &.) through the end of the call goes.
+      def drop(node, subject)
+        Edit.new(file: subject.file, start_byte: node.call_operator_loc.start_offset,
+                 end_byte: node.end_offset, replacement: "")
+      end
+
+      def shallow(node, subject)
+        replacement = SHALLOWER[node.name] or return
+        location = node.message_loc
+        Edit.new(file: subject.file, start_byte: location.start_offset, end_byte: location.end_offset,
+                 replacement: replacement)
+      end
+
+      def arid?(node)
+        @arid.any? { |pattern| pattern.match?(node.slice) }
+      end
+    end
+  end
+end