@specific.dev/spectest 0.59.3 → 0.59.4

package/dist/browser-coverage.js

@@ -19,7 +19,7 @@
 // project with no `coverage: { browser: true }` service never attaches
 // anything, so it costs nothing.
 import { createHash } from "node:crypto";
-import { decodeSourceMap, lcovDocument, mapToOriginal, mergeFileCounts, rangesToLineCounts, } from "./harness/browser-coverage.js";
+import { decodeSourceMap, isDocumentScriptPath, lcovDocument, mapToOriginal, mergeFileCounts, rangesToLineCounts, } from "./harness/browser-coverage.js";
 import { rawFetch } from "./harness/raw-fetch.js";
 let CONFIG = null;
 /** Set (or clear, with `null`) at /load. */
@@ -106,6 +106,8 @@ async function harvestInner(c, config) {
             continue;
         if (info.map === undefined)
             info.map = await sourceMapFor(info, url);
+        if (!info.map && isDocumentScriptPath(url.pathname))
+            continue; // inline script in a page
         const files = info.map
             ? mapToOriginal(info.map, generated)
             : new Map([[url.pathname, generated]]);

package/dist/coverage.d.ts

@@ -99,6 +99,10 @@ export declare function appendEnvFlag(env: Readonly<Record<string, string>> | un
  * wrapper dumped the wrapper and silently never the server (reported by
  * a user 2026-08-27). At capture spectest asks every live socket and
  * unlinks the stale ones. Unref'd, so a short-lived process still exits.
+ * Main thread only: a worker thread inherits `NODE_OPTIONS`, and tsx's
+ * ESM loader thread bound the shared per-pid path last, so every
+ * `--import tsx` server answered with the loader's coverage — the app's
+ * main thread was never dumped (found in the same user's first full run).
  * No signal is used: signals are claimed by frameworks (SIGUSR2 stops a
  * Temporal worker, restarts nodemon), a socket is nobody's.
  */

package/dist/coverage.js

@@ -109,12 +109,20 @@ export function appendEnvFlag(env, name, value) {
  * wrapper dumped the wrapper and silently never the server (reported by
  * a user 2026-08-27). At capture spectest asks every live socket and
  * unlinks the stale ones. Unref'd, so a short-lived process still exits.
+ * Main thread only: a worker thread inherits `NODE_OPTIONS`, and tsx's
+ * ESM loader thread bound the shared per-pid path last, so every
+ * `--import tsx` server answered with the loader's coverage — the app's
+ * main thread was never dumped (found in the same user's first full run).
  * No signal is used: signals are claimed by frameworks (SIGUSR2 stops a
  * Temporal worker, restarts nodemon), a socket is nobody's.
  */
 export const NODE_COVERAGE_HOOK = `"use strict";
 // spectest coverage hook (coverage.node() adapter). See \`spectest docs /services/coverage\`.
-if (process.env.NODE_V8_COVERAGE) {
+// Main thread only: worker threads inherit NODE_OPTIONS and would bind
+// the same per-pid socket last — tsx's ESM loader runs on one, and it
+// stole the socket from every \`--import tsx\` server, so a dump was the
+// loader's isolate and never the app's.
+if (process.env.NODE_V8_COVERAGE && require("node:worker_threads").isMainThread) {
   const net = require("node:net");
   const fs = require("node:fs");
   const v8 = require("node:v8");
@@ -259,6 +267,9 @@ const COMPACTED_V8_REPORTS = new Set();
 export function isAppScriptUrl(url) {
     return (url.startsWith("file://") &&
         !url.includes("/node_modules/") &&
+        // Package managers run from a cache, not node_modules: corepack's pnpm
+        // is `/root/.cache/node/corepack/…`, 2 MiB of dump per `pnpm run`.
+        !url.includes("/.cache/") &&
         !url.endsWith("/" + NODE_COVERAGE_HOOK_PATH.split("/").pop()));
 }
 /**

package/dist/harness/browser-coverage.d.ts

@@ -51,6 +51,14 @@ export declare function normalizeSourcePath(src: string, sourceRoot?: string): s
 /** Sources nobody's change can be attributed to: dependencies and bundler
  *  runtime shims. */
 export declare function isForeignSource(path: string): boolean;
+/**
+ * A script with no source map is attributed to its served path — unless
+ * that path is a page, not a file: an inline `<script>` in an HTML
+ * document reports the document's URL (`/`, `/projects/123`), and no
+ * repository file can ever be named by it. Extension-less paths are
+ * treated as pages.
+ */
+export declare function isDocumentScriptPath(pathname: string): boolean;
 /**
  * Decode a source map document. Index maps (`sections`) are not
  * supported and decode to `null`, as does anything malformed — the

package/dist/harness/browser-coverage.js

@@ -104,6 +104,10 @@ export function normalizeSourcePath(src, sourceRoot) {
         s = m[1];
     s = s.replace(/^\/@fs\//, "/");
     s = s.replace(/\?.*$/, "");
+    // Turbopack (Next.js) roots every source at the `[project]` token —
+    // `/[project]/dashboard/app/page.tsx` — which is the workspace root,
+    // i.e. repo-relative once stripped.
+    s = s.replace(/^\/?\[project\]\//, "");
     while (s.startsWith("./"))
         s = s.slice(2);
     return s;
@@ -117,7 +121,20 @@ export function isForeignSource(path) {
         path.startsWith("(webpack)") ||
         path.startsWith("\0") ||
         path.startsWith("vite/") ||
-        path.startsWith("@vite/"));
+        path.startsWith("@vite/") ||
+        path.startsWith("[turbopack]/") ||
+        path.startsWith("/[turbopack]/"));
+}
+/**
+ * A script with no source map is attributed to its served path — unless
+ * that path is a page, not a file: an inline `<script>` in an HTML
+ * document reports the document's URL (`/`, `/projects/123`), and no
+ * repository file can ever be named by it. Extension-less paths are
+ * treated as pages.
+ */
+export function isDocumentScriptPath(pathname) {
+    const last = pathname.split("/").pop() ?? "";
+    return !last.includes(".");
 }
 /**
  * Decode a source map document. Index maps (`sections`) are not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.59.3",
+  "version": "0.59.4",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser-coverage.ts

@@ -25,6 +25,7 @@ import {
   type DecodedSourceMap,
   type FileCounts,
   decodeSourceMap,
+  isDocumentScriptPath,
   lcovDocument,
   mapToOriginal,
   mergeFileCounts,
@@ -137,6 +138,7 @@ async function harvestInner(c: Collector, config: BrowserCoverageConfig): Promis
     const generated = rangesToLineCounts(info.source, script.functions);
     if (generated.size === 0) continue;
     if (info.map === undefined) info.map = await sourceMapFor(info, url);
+    if (!info.map && isDocumentScriptPath(url.pathname)) continue; // inline script in a page
     const files: FileCounts = info.map
       ? mapToOriginal(info.map, generated)
       : new Map([[url.pathname, generated]]);

package/src/coverage.test.ts

@@ -77,6 +77,7 @@ describe("compactV8Document", () => {
       { scriptId: "1", url: "file:///app/src/a.ts", functions: [] },
       { scriptId: "2", url: "file:///app/node_modules/x/index.js", functions: [] },
       { scriptId: "3", url: "node:fs", functions: [] },
+      { scriptId: "5", url: "file:///root/.cache/node/corepack/v1/pnpm/10.0.0/dist/pnpm.cjs", functions: [] },
       { scriptId: "4", url: "", functions: [] },
     ],
     "source-map-cache": {
@@ -256,6 +257,34 @@ describe.if(hasNode)("nodeCoverage hook (real node)", () => {
     expect(doc.result.map((x) => x.url)).toEqual([`file://${path.join(dir, "cli.js")}`]); // compacted
   });
 
+  test("a worker thread does not bind the socket; the main thread's dump is the app's", async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "spectest-covhook-"));
+    const hook = path.join(dir, "coverage-hook.cjs");
+    await fs.writeFile(hook, NODE_COVERAGE_HOOK);
+    await fs.writeFile(
+      path.join(dir, "server.js"),
+      "function appWork() { return 1 } appWork();\n" +
+        "new (require('node:worker_threads').Worker)('setInterval(() => {}, 1000)', { eval: true });\n" +
+        SERVER_JS,
+    );
+    const child = spawn("node", [path.join(dir, "server.js")], {
+      env: { ...process.env, NODE_V8_COVERAGE: dir, NODE_OPTIONS: `--require ${hook}` },
+      stdio: ["ignore", "pipe", "inherit"],
+    });
+    await new Promise<void>((resolve) => child.stdout!.once("data", () => resolve()));
+    try {
+      await new Promise((r) => setTimeout(r, 300)); // let the worker thread start
+      expect((await socketsIn(dir)).length).toBe(1);
+      await node().capture!(fakeCtx(dir));
+      const reports = (await reportsIn(dir)).filter((n) => n !== NODE_COVERAGE_EMPTY_REPORT);
+      expect(reports.length).toBe(1);
+      const doc = JSON.parse(await fs.readFile(path.join(dir, reports[0]!), "utf8")) as { result: { url: string }[] };
+      expect(doc.result.some((s) => s.url.endsWith("/server.js"))).toBe(true);
+    } finally {
+      child.kill("SIGKILL");
+    }
+  });
+
   test("a stale socket left by a killed process is removed at capture", async () => {
     const dir = await fs.mkdtemp(path.join(os.tmpdir(), "spectest-covhook-"));
     const first = await start(dir, "server.js", 1);

package/src/coverage.ts

@@ -193,12 +193,20 @@ export function appendEnvFlag(
  * wrapper dumped the wrapper and silently never the server (reported by
  * a user 2026-08-27). At capture spectest asks every live socket and
  * unlinks the stale ones. Unref'd, so a short-lived process still exits.
+ * Main thread only: a worker thread inherits `NODE_OPTIONS`, and tsx's
+ * ESM loader thread bound the shared per-pid path last, so every
+ * `--import tsx` server answered with the loader's coverage — the app's
+ * main thread was never dumped (found in the same user's first full run).
  * No signal is used: signals are claimed by frameworks (SIGUSR2 stops a
  * Temporal worker, restarts nodemon), a socket is nobody's.
  */
 export const NODE_COVERAGE_HOOK = `"use strict";
 // spectest coverage hook (coverage.node() adapter). See \`spectest docs /services/coverage\`.
-if (process.env.NODE_V8_COVERAGE) {
+// Main thread only: worker threads inherit NODE_OPTIONS and would bind
+// the same per-pid socket last — tsx's ESM loader runs on one, and it
+// stole the socket from every \`--import tsx\` server, so a dump was the
+// loader's isolate and never the app's.
+if (process.env.NODE_V8_COVERAGE && require("node:worker_threads").isMainThread) {
   const net = require("node:net");
   const fs = require("node:fs");
   const v8 = require("node:v8");
@@ -345,6 +353,9 @@ export function isAppScriptUrl(url: string): boolean {
   return (
     url.startsWith("file://") &&
     !url.includes("/node_modules/") &&
+    // Package managers run from a cache, not node_modules: corepack's pnpm
+    // is `/root/.cache/node/corepack/…`, 2 MiB of dump per `pnpm run`.
+    !url.includes("/.cache/") &&
     !url.endsWith("/" + NODE_COVERAGE_HOOK_PATH.split("/").pop())
   );
 }

package/src/harness/browser-coverage.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import {
   decodeSourceMap,
   decodeVlq,
+  isDocumentScriptPath,
   isForeignSource,
   lcovDocument,
   mapToOriginal,
@@ -92,3 +93,19 @@ describe("serviceForHost", () => {
     expect(serviceForHost("example.com", services, table)).toBeUndefined();
   });
 });
+
+describe("turbopack + inline scripts", () => {
+  test("[project] root token is stripped, [turbopack] shims are foreign", () => {
+    expect(normalizeSourcePath("/[project]/dashboard/app/page.tsx")).toBe("dashboard/app/page.tsx");
+    expect(normalizeSourcePath("[project]/dashboard/app/page.tsx")).toBe("dashboard/app/page.tsx");
+    expect(isForeignSource("/[turbopack]/browser/runtime/base/build-base.ts")).toBe(true);
+    expect(isForeignSource("[turbopack]/shared/runtime-utils.ts")).toBe(true);
+    expect(isForeignSource("dashboard/app/page.tsx")).toBe(false);
+  });
+  test("an unmapped script at a page URL is a document script, a .js file is not", () => {
+    expect(isDocumentScriptPath("/")).toBe(true);
+    expect(isDocumentScriptPath("/projects/proj_1")).toBe(true);
+    expect(isDocumentScriptPath("/_next/static/chunks/main.js")).toBe(false);
+    expect(isDocumentScriptPath("/app.js")).toBe(false);
+  });
+});

package/src/harness/browser-coverage.ts

@@ -136,6 +136,10 @@ export function normalizeSourcePath(src: string, sourceRoot?: string): string {
   if (m) s = m[1];
   s = s.replace(/^\/@fs\//, "/");
   s = s.replace(/\?.*$/, "");
+  // Turbopack (Next.js) roots every source at the `[project]` token —
+  // `/[project]/dashboard/app/page.tsx` — which is the workspace root,
+  // i.e. repo-relative once stripped.
+  s = s.replace(/^\/?\[project\]\//, "");
   while (s.startsWith("./")) s = s.slice(2);
   return s;
 }
@@ -150,10 +154,24 @@ export function isForeignSource(path: string): boolean {
     path.startsWith("(webpack)") ||
     path.startsWith("\0") ||
     path.startsWith("vite/") ||
-    path.startsWith("@vite/")
+    path.startsWith("@vite/") ||
+    path.startsWith("[turbopack]/") ||
+    path.startsWith("/[turbopack]/")
   );
 }
 
+/**
+ * A script with no source map is attributed to its served path — unless
+ * that path is a page, not a file: an inline `<script>` in an HTML
+ * document reports the document's URL (`/`, `/projects/123`), and no
+ * repository file can ever be named by it. Extension-less paths are
+ * treated as pages.
+ */
+export function isDocumentScriptPath(pathname: string): boolean {
+  const last = pathname.split("/").pop() ?? "";
+  return !last.includes(".");
+}
+
 /**
  * Decode a source map document. Index maps (`sections`) are not
  * supported and decode to `null`, as does anything malformed — the