@specific.dev/spectest 0.131.16 → 0.131.17

package/README.md

@@ -83,6 +83,14 @@ Pub/Sub integrations are project-owned as of SDK 0.98.0. The former
 Use a local service definition or `serviceGroup()` wrapper; the repository’s
 `examples/google-pubsub` demonstrates this using public SDK APIs.
 
+## Browser coverage across navigation (0.131.17)
+
+Browser coverage keeps script identities separate when Chromium changes renderers
+during cross-site navigation, including login redirects. Anonymous browser code
+cannot inherit an earlier script’s URL or source map. No application configuration
+change is needed. A script identity change during capture is reported as incomplete
+coverage instead of publishing uncertain attribution.
+
 ## Next.js coverage (0.131.16)
 
 Use `coverage.next({ appDir: "ops", sourceRoot: "." })` in your Spectest

package/dist/browser-coverage.js

@@ -47,8 +47,9 @@ export async function attachBrowserCoverage(cdp) {
     COLLECTORS.set(cdp, collector);
     LIVE_COLLECTORS.add(collector);
     cdp.on("Debugger.scriptParsed", (ev) => {
-        if (!ev.url)
-            return;
+        // IDs belong to a renderer, not the lifetime of this CDP session. A
+        // cross-site navigation can reuse an old named ID for anonymous code.
+        // Replace anonymous entries too, invalidating the previous URL/source/map.
         collector.scripts.set(ev.scriptId, {
             url: ev.url,
             sourceMapURL: ev.sourceMapURL || undefined,
@@ -108,6 +109,7 @@ export async function harvestBrowserCoverage(cdp, signal) {
     }
 }
 async function harvestInner(c, config, signal) {
+    const scriptsAtTake = new Map(c.scripts);
     let result;
     try {
         ({ result } = (await c.cdp.send("Profiler.takePreciseCoverage")));
@@ -119,12 +121,13 @@ async function harvestInner(c, config, signal) {
         throw err;
     }
     for (const script of result) {
-        const info = c.scripts.get(script.scriptId) ?? (script.url ? { url: script.url } : undefined);
-        if (!info)
+        // The profiler's URL identifies this execution. Never supply a URL from
+        // an earlier renderer to an anonymous result.
+        if (!script.url)
             continue;
         let url;
         try {
-            url = new URL(info.url);
+            url = new URL(script.url);
         }
         catch {
             continue;
@@ -134,19 +137,34 @@ async function harvestInner(c, config, signal) {
         const service = config.serviceForHost(url.hostname);
         if (!service)
             continue;
+        let info = c.scripts.get(script.scriptId);
+        const before = scriptsAtTake.get(script.scriptId);
+        const changed = () => {
+            c.incomplete = new Error("Browser script identity changed during coverage capture; coverage is incomplete");
+            return c.incomplete;
+        };
+        if ((before && before !== info) || (info && info.url !== script.url))
+            throw changed();
+        if (!info) {
+            info = { url: script.url };
+            c.scripts.set(script.scriptId, info);
+        }
         if (info.source === undefined) {
             try {
                 const r = (await c.cdp.send("Debugger.getScriptSource", {
                     scriptId: script.scriptId,
                 }));
                 signal.throwIfAborted();
+                if (c.scripts.get(script.scriptId) !== info)
+                    throw changed();
                 info.source = r.scriptSource;
             }
             catch {
                 signal.throwIfAborted();
+                if (c.incomplete)
+                    throw c.incomplete;
                 continue; // script gone with its document
             }
-            c.scripts.set(script.scriptId, info);
         }
         const generated = rangesToLineCounts(info.source, script.functions);
         if (generated.size === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.131.16",
+  "version": "0.131.17",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser-coverage-deadline.test.ts

@@ -27,7 +27,10 @@ test("an ambiguous coverage timeout is retained and a late CDP result cannot pub
     await Bun.sleep(0);
     expect(sourceReads).toBe(0);
     expect(browserCoverageReports().has("coverage-deadline-test")).toBe(false);
-    await expect(harvestAllBrowserCoverage()).rejects.toThrow("Browser coverage capture was interrupted; coverage is incomplete");
+    // Other tests may also retain incomplete collectors. Global harvest must
+    // reject; this session must retain its own interruption reason.
+    await expect(harvestAllBrowserCoverage()).rejects.toThrow("coverage is incomplete");
+    await expect(harvestBrowserCoverage(cdp)).rejects.toThrow("Browser coverage capture was interrupted; coverage is incomplete");
     expect(takes).toBe(1);
   } finally { configureBrowserCoverage(null); }
 });

package/src/browser-coverage-identity.test.ts

@@ -0,0 +1,87 @@
+import { expect, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import type { CDPSession } from "playwright-core";
+import {
+  attachBrowserCoverage, configureBrowserCoverage, harvestBrowserCoverage,
+  takeBrowserCoverageReport,
+} from "./browser-coverage.js";
+
+function session() {
+  const events = new EventEmitter();
+  let source = "globalThis.ran = true;";
+  let url = "http://app.test/app.js";
+  const cdp = Object.assign(events, {
+    async send(method: string): Promise<any> {
+      if (method === "Profiler.takePreciseCoverage") return { result: [{ scriptId: "4", url,
+        functions: [{ ranges: [{ startOffset: 0, endOffset: source.length, count: 1 }] }] }] };
+      if (method === "Debugger.getScriptSource") return { scriptSource: source };
+      return {};
+    },
+  }) as unknown as CDPSession;
+  return { cdp, parsed(nextUrl = url, nextSource = source, sourceMapURL?: string) {
+    url = nextUrl; source = nextSource;
+    events.emit("Debugger.scriptParsed", { scriptId: "4", url, sourceMapURL });
+  } };
+}
+
+const inlineMap = (source: string) => "data:application/json;base64," + Buffer.from(JSON.stringify({
+  version: 3, sources: [source], names: [], mappings: "AAAA",
+})).toString("base64");
+
+test("a reused named ID replaces cached source maps even when its URL is unchanged", async () => {
+  const s = session();
+  configureBrowserCoverage({ serviceForHost: () => "identity-maps" });
+  try {
+    await attachBrowserCoverage(s.cdp);
+    s.parsed(undefined, undefined, inlineMap("src/old.ts"));
+    await harvestBrowserCoverage(s.cdp);
+    expect(takeBrowserCoverageReport("identity-maps")).toContain("SF:src/old.ts");
+    s.parsed(undefined, undefined, inlineMap("src/new.ts"));
+    await harvestBrowserCoverage(s.cdp);
+    const report = takeBrowserCoverageReport("identity-maps");
+    expect(report).toContain("SF:src/new.ts");
+    expect(report).not.toContain("src/old.ts");
+  } finally { configureBrowserCoverage(null); takeBrowserCoverageReport("identity-maps"); }
+});
+
+test("the profiler's anonymous URL cannot inherit a stale named URL", async () => {
+  const s = session();
+  configureBrowserCoverage({ serviceForHost: () => "identity-anonymous" });
+  try {
+    await attachBrowserCoverage(s.cdp);
+    s.parsed();
+    const send = s.cdp.send.bind(s.cdp);
+    s.cdp.send = (async (method: string) => {
+      if (method === "Profiler.takePreciseCoverage") {
+        const result = await send(method as any) as any;
+        result.result[0].url = "";
+        return result;
+      }
+      return send(method as any);
+    }) as CDPSession["send"];
+    await harvestBrowserCoverage(s.cdp);
+    expect(takeBrowserCoverageReport("identity-anonymous")).toBe("TN:\n");
+  } finally { configureBrowserCoverage(null); }
+});
+
+for (const phase of ["Profiler.takePreciseCoverage", "Debugger.getScriptSource"]) {
+  test(`script replacement during ${phase} retains an incomplete-capture error`, async () => {
+    const s = session();
+    const service = `identity-race-${phase}`;
+    configureBrowserCoverage({ serviceForHost: () => service });
+    try {
+      await attachBrowserCoverage(s.cdp);
+      s.parsed();
+      const send = s.cdp.send.bind(s.cdp);
+      s.cdp.send = (async (method: string) => {
+        const result = await send(method as any);
+        // The same URL and ID now refer to a different renderer's script.
+        if (method === phase) s.parsed(undefined, "globalThis.replacement = true;");
+        return result;
+      }) as CDPSession["send"];
+      await expect(harvestBrowserCoverage(s.cdp)).rejects.toThrow("identity changed during coverage capture");
+      expect(takeBrowserCoverageReport(service)).toBe("TN:\n");
+      await expect(harvestBrowserCoverage(s.cdp)).rejects.toThrow("coverage is incomplete");
+    } finally { configureBrowserCoverage(null); takeBrowserCoverageReport(service); }
+  });
+}

package/src/browser-coverage-navigation.test.ts

@@ -0,0 +1,54 @@
+import { expect, test } from "bun:test";
+import { existsSync } from "node:fs";
+import { chromium } from "playwright-core";
+import {
+  attachBrowserCoverage, configureBrowserCoverage, harvestBrowserCoverage,
+  takeBrowserCoverageReport,
+} from "./browser-coverage.js";
+
+const executablePath = Bun.which("chromium") ?? Bun.which("chromium-browser") ??
+  Bun.which("google-chrome") ?? chromium.executablePath();
+
+test.skipIf(!existsSync(executablePath))("cross-site script ID reuse cannot attribute anonymous code to an earlier empty script", async () => {
+  const emptyScript = "/ingest/static/1.438.19/exception-autocapture.js";
+  const map = Buffer.from(JSON.stringify({ version: 3, sources: ["src/customer.ts"], names: [], mappings: "AAAA" })).toString("base64");
+  const server = Bun.serve({ hostname: "0.0.0.0", port: 0, fetch(request) {
+    const url = new URL(request.url);
+    if (url.pathname === emptyScript) return new Response("", { headers: { "content-type": "application/javascript" } });
+    if (url.pathname === "/app.js") return new Response(`globalThis.appRan = true;\n//# sourceMappingURL=data:application/json;base64,${map}`, { headers: { "content-type": "application/javascript" } });
+    return new Response(url.hostname === "127.0.0.1"
+      ? `<script src="${emptyScript}"></script><script src="/app.js"></script><p>Application</p>`
+      : "<p>External login</p>", { headers: { "content-type": "text/html", "cache-control": "no-store" } });
+  } });
+  const browser = await chromium.launch({ executablePath, headless: true, args: ["--no-sandbox", "--site-per-process"] });
+  try {
+    const page = await browser.newPage();
+    const cdp = await page.context().newCDPSession(page);
+    const urls = new Map<string, string>();
+    let anonymousReuse = false;
+    cdp.on("Debugger.scriptParsed", event => {
+      if (urls.get(event.scriptId)?.endsWith(emptyScript) && !event.url) anonymousReuse = true;
+      urls.set(event.scriptId, event.url);
+    });
+    configureBrowserCoverage({ serviceForHost: host => host === "127.0.0.1" ? "navigation-test" : undefined });
+    await attachBrowserCoverage(cdp);
+    // Use different sites to force a renderer swap, then return to the app.
+    // Keep collected application counts across navigation until service capture.
+    for (const host of ["127.0.0.1", "127.0.0.2", "127.0.0.1", "127.0.0.2"]) {
+      await page.goto(`http://${host}:${server.port}/`);
+      await page.evaluate("(() => { const value = 1; return value + 1; })()");
+      await harvestBrowserCoverage(cdp);
+    }
+    expect(anonymousReuse).toBe(true); // Prove the regression's trigger happened.
+    const report = takeBrowserCoverageReport("navigation-test");
+    expect(report).toContain("SF:src/customer.ts\nDA:1,2\n");
+    expect(report).not.toContain(emptyScript);
+    expect(report.match(/^SF:/gm)).toHaveLength(1);
+    await cdp.detach();
+  } finally {
+    configureBrowserCoverage(null);
+    takeBrowserCoverageReport("navigation-test");
+    await browser.close();
+    server.stop(true);
+  }
+}, 15000);

package/src/browser-coverage.ts

@@ -87,7 +87,9 @@ export async function attachBrowserCoverage(cdp: CDPSession): Promise<void> {
   COLLECTORS.set(cdp, collector);
   LIVE_COLLECTORS.add(collector);
   cdp.on("Debugger.scriptParsed", (ev: { scriptId: string; url: string; sourceMapURL?: string }) => {
-    if (!ev.url) return;
+    // IDs belong to a renderer, not the lifetime of this CDP session. A
+    // cross-site navigation can reuse an old named ID for anonymous code.
+    // Replace anonymous entries too, invalidating the previous URL/source/map.
     collector.scripts.set(ev.scriptId, {
       url: ev.url,
       sourceMapURL: ev.sourceMapURL || undefined,
@@ -141,6 +143,7 @@ export async function harvestBrowserCoverage(cdp: CDPSession, signal?: AbortSign
 }
 
 async function harvestInner(c: Collector, config: BrowserCoverageConfig, signal: AbortSignal): Promise<void> {
+  const scriptsAtTake = new Map(c.scripts);
   let result: { scriptId: string; url: string; functions: V8FunctionCoverage[] }[];
   try {
     ({ result } = (await c.cdp.send("Profiler.takePreciseCoverage")) as { result: typeof result });
@@ -150,29 +153,42 @@ async function harvestInner(c: Collector, config: BrowserCoverageConfig, signal:
     throw err;
   }
   for (const script of result) {
-    const info = c.scripts.get(script.scriptId) ?? (script.url ? { url: script.url } : undefined);
-    if (!info) continue;
+    // The profiler's URL identifies this execution. Never supply a URL from
+    // an earlier renderer to an anonymous result.
+    if (!script.url) continue;
     let url: URL;
     try {
-      url = new URL(info.url);
+      url = new URL(script.url);
     } catch {
       continue;
     }
     if (url.protocol !== "http:" && url.protocol !== "https:") continue;
     const service = config.serviceForHost(url.hostname);
     if (!service) continue;
+    let info = c.scripts.get(script.scriptId);
+    const before = scriptsAtTake.get(script.scriptId);
+    const changed = () => {
+      c.incomplete = new Error("Browser script identity changed during coverage capture; coverage is incomplete");
+      return c.incomplete;
+    };
+    if ((before && before !== info) || (info && info.url !== script.url)) throw changed();
+    if (!info) {
+      info = { url: script.url };
+      c.scripts.set(script.scriptId, info);
+    }
     if (info.source === undefined) {
       try {
         const r = (await c.cdp.send("Debugger.getScriptSource", {
           scriptId: script.scriptId,
         })) as { scriptSource: string };
         signal.throwIfAborted();
+        if (c.scripts.get(script.scriptId) !== info) throw changed();
         info.source = r.scriptSource;
       } catch {
         signal.throwIfAborted();
+        if (c.incomplete) throw c.incomplete;
         continue; // script gone with its document
       }
-      c.scripts.set(script.scriptId, info);
     }
     const generated = rangesToLineCounts(info.source, script.functions);
     if (generated.size === 0) continue;