@specific.dev/spectest 0.90.1 → 0.90.3

package/dist/browser-coverage.d.ts

@@ -22,10 +22,10 @@ export declare function foldBrowserCoverage(service: string, files: FileCounts):
 /** Harvest every live session, so a capture sees the counters of code
  *  that ran since the last browser op. */
 export declare function harvestAllBrowserCoverage(): Promise<void>;
-/** One lcov document per service that has any browser coverage — and
- *  the totals are cleared, so the next capture holds only what runs
- *  from now on. Module memory forks with the environment, so a forked
- *  child starts from its parent's last capture, empty. */
-export declare function takeBrowserCoverageReports(): Map<string, string>;
+/** Take one service's lcov report and clear only its totals. Other
+ *  services retain their coverage until their own capture. Each capture
+ *  is a delta; after every service is captured, a forked child inherits
+ *  empty totals from its parent. */
+export declare function takeBrowserCoverageReport(service: string): string;
 /** The current totals, without clearing them (tests). */
 export declare function browserCoverageReports(): Map<string, string>;

package/dist/browser-coverage.js

@@ -12,8 +12,8 @@
 //
 // Harvest runs before every browser step (a click that navigates
 // cross-site replaces the renderer, and the old counters with it) and at
-// every coverage capture. `browserCoverageReports` renders the totals as
-// one lcov per service for the `case-coverage` bundle.
+// every coverage capture. `takeBrowserCoverageReport` renders and clears
+// one service's totals for the `case-coverage` bundle.
 //
 // Configured by the daemon at /load with the host → service table; a
 // project with no `coverage: { browser: true }` service never attaches
@@ -196,18 +196,15 @@ function parseDataUrl(ref) {
 export async function harvestAllBrowserCoverage() {
     await Promise.all([...LIVE_COLLECTORS].map((c) => harvestBrowserCoverage(c.cdp)));
 }
-/** One lcov document per service that has any browser coverage — and
- *  the totals are cleared, so the next capture holds only what runs
- *  from now on. Module memory forks with the environment, so a forked
- *  child starts from its parent's last capture, empty. */
-export function takeBrowserCoverageReports() {
-    const out = new Map();
-    for (const [service, files] of TOTALS) {
-        if (files.size > 0)
-            out.set(service, lcovDocument(files));
-    }
-    TOTALS.clear();
-    return out;
+/** Take one service's lcov report and clear only its totals. Other
+ *  services retain their coverage until their own capture. Each capture
+ *  is a delta; after every service is captured, a forked child inherits
+ *  empty totals from its parent. */
+export function takeBrowserCoverageReport(service) {
+    const files = TOTALS.get(service);
+    const report = files ? lcovDocument(files) : "TN:\n";
+    TOTALS.delete(service);
+    return report;
 }
 /** The current totals, without clearing them (tests). */
 export function browserCoverageReports() {

package/dist/coverage.d.ts

@@ -213,6 +213,8 @@ export declare const NODE_COVERAGE_DUMP_PREFIX = "node-";
  *   source map: the inline `data:` map in the text, the file the last
  *   `sourceMappingURL` comment names, or `<script>.map` next to the
  *   script; `sourcesContent` dropped (the sources are the repository).
+ *   Records are keyed by their descriptor and compiled-source hash, not
+ *   their URL: a recompilation can reuse a URL with different source.
  *   "Once per branch" is a marker file under `.spectest/scripts/`: the
  *   directory is shared by every process of the service and forks with
  *   the environment, so a record written at bring-up or by an ancestor
@@ -292,7 +294,7 @@ export declare function collectNodeReports(dir: string): Promise<NodeReportStats
  * loads from this service's origins, maps it back to source through the
  * served source map, and writes one lcov per capture (`browser.lcov`)
  * holding what ran since the previous capture: every live session is
- * harvested first, and the totals are taken and cleared. Nothing ran ⇒
+ * harvested first, and only this service's totals are taken and cleared. Nothing ran ⇒
  * an lcov with no records, which is a report saying so.
  */
 export declare function browser(): CoverageAdapter;

package/dist/coverage.js

@@ -27,7 +27,7 @@
 //   import * as coverage from "@specific.dev/spectest/coverage";
 //   coverage: { adapters: [coverage.node(), coverage.browser()] }
 import { createHash } from "node:crypto";
-import { harvestAllBrowserCoverage, takeBrowserCoverageReports } from "./browser-coverage.js";
+import { harvestAllBrowserCoverage, takeBrowserCoverageReport } from "./browser-coverage.js";
 import { COVERAGE_CONTAINER_DIR } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR };
 /** Where `node()` mounts its hook inside the container. */
@@ -196,6 +196,8 @@ export const NODE_COVERAGE_DUMP_PREFIX = "node-";
  *   source map: the inline `data:` map in the text, the file the last
  *   `sourceMappingURL` comment names, or `<script>.map` next to the
  *   script; `sourcesContent` dropped (the sources are the repository).
+ *   Records are keyed by their descriptor and compiled-source hash, not
+ *   their URL: a recompilation can reuse a URL with different source.
  *   "Once per branch" is a marker file under `.spectest/scripts/`: the
  *   directory is shared by every process of the service and forks with
  *   the environment, so a record written at bring-up or by an ancestor
@@ -242,7 +244,9 @@ export const NODE_COVERAGE_HOOK = `"use strict";
   const SELF = url.pathToFileURL(__filename).href;
   const SCRIPTS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SCRIPTS_SUBDIR)});
   const MARKERS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_MARKERS_SUBDIR)});
-  const known = new Set();
+  // V8 script ids identify a compiled script within this process. A URL
+  // can be reused by another process, vm context, or compilation.
+  const known = new Map();
   let seq = 0;
 
   function isApp(u) {
@@ -375,7 +379,6 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     fs.renameSync(tmp, file);
   }
   function describe(s, source) {
-    const id = idOf(s.url);
     let scriptPath = null;
     try {
       scriptPath = url.fileURLToPath(s.url);
@@ -383,16 +386,20 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     const text = typeof source === "string" ? source : null;
     const record = {
       url: s.url,
+      sourceHash: text !== null ? crypto.createHash("sha256").update(text).digest("hex") : null,
       lineLengths: text !== null ? lineLengths(text) : null,
       functions: s.functions.map(function (f) {
         return [f.functionName, f.ranges[0].startOffset, f.ranges[0].endOffset];
       }),
       sourceMap: text !== null && scriptPath !== null ? readMap(scriptPath, text) : null,
     };
-    writeAtomic(path.join(SCRIPTS, id + ".json"), JSON.stringify({ spectestScript: record }));
-    try {
+    const document = JSON.stringify({ spectestScript: record });
+    const id = idOf(document);
+    if (!fs.existsSync(path.join(MARKERS, id))) {
+      writeAtomic(path.join(SCRIPTS, id + ".json"), document);
       fs.writeFileSync(path.join(MARKERS, id), "");
-    } catch (e) {}
+    }
+    return id;
   }
   function take() {
     const res = post("Profiler.takePreciseCoverage");
@@ -413,9 +420,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     if (kept.length === 0 && units.size === 0) return;
     const fresh = [];
     for (const s of kept) {
-      if (known.has(s.url)) continue;
-      known.add(s.url);
-      if (!fs.existsSync(path.join(MARKERS, idOf(s.url)))) fresh.push(s);
+      if (!known.has(s.scriptId)) fresh.push(s);
     }
     if (fresh.length > 0) {
       try {
@@ -426,7 +431,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
       for (const s of fresh) {
         const r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
         try {
-          describe(s, r && r.scriptSource);
+          known.set(s.scriptId, describe(s, r && r.scriptSource));
         } catch (e) {}
       }
       post("Debugger.disable");
@@ -442,7 +447,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
       result: kept.map(function (s) {
         return {
           url: s.url,
-          spectestScript: idOf(s.url),
+          spectestScript: known.get(s.scriptId) || null,
           functions: s.functions.filter(ran).map(function (f) {
             const first = f.ranges[0];
             const out = [first.startOffset, first.endOffset - first.startOffset, first.count];
@@ -805,7 +810,7 @@ export async function collectNodeReports(dir) {
  * loads from this service's origins, maps it back to source through the
  * served source map, and writes one lcov per capture (`browser.lcov`)
  * holding what ran since the previous capture: every live session is
- * harvested first, and the totals are taken and cleared. Nothing ran ⇒
+ * harvested first, and only this service's totals are taken and cleared. Nothing ran ⇒
  * an lcov with no records, which is a report saying so.
  */
 export function browser() {
@@ -817,7 +822,7 @@ export function browser() {
         },
         async capture(ctx) {
             await harvestAllBrowserCoverage();
-            const lcov = takeBrowserCoverageReports().get(ctx.service) ?? "TN:\n";
+            const lcov = takeBrowserCoverageReport(ctx.service);
             await ctx.writeReport("browser.lcov", lcov);
         },
     };

package/dist/harness/browser-coverage.d.ts

@@ -41,11 +41,12 @@ export interface DecodedSourceMap {
 /** Decode one VLQ-encoded segment into its fields. */
 export declare function decodeVlq(segment: string): number[];
 /**
- * Normalise a source-map `sources` entry to a plain path. Bundlers prefix
+ * Normalise a source-map `sources` entry without discarding its identity. Bundlers prefix
  * their own scheme (`webpack:///./src/a.ts`), dev servers serve absolute
  * URLs paths (`/src/a.ts`), builds write relative ones (`../src/a.ts`).
- * The server maps these onto the repo by suffix, so all that matters here
- * is stripping what is not a path.
+ * The server validates file identity against the repository. Preserve
+ * virtual namespaces and external URLs; losing them makes foreign
+ * sources indistinguishable from project files.
  */
 export declare function normalizeSourcePath(src: string, sourceRoot?: string): string;
 /** Sources nobody's change can be attributed to: dependencies and bundler

package/dist/harness/browser-coverage.js

@@ -86,22 +86,28 @@ export function decodeVlq(segment) {
     return out;
 }
 /**
- * Normalise a source-map `sources` entry to a plain path. Bundlers prefix
+ * Normalise a source-map `sources` entry without discarding its identity. Bundlers prefix
  * their own scheme (`webpack:///./src/a.ts`), dev servers serve absolute
  * URLs paths (`/src/a.ts`), builds write relative ones (`../src/a.ts`).
- * The server maps these onto the repo by suffix, so all that matters here
- * is stripping what is not a path.
+ * The server validates file identity against the repository. Preserve
+ * virtual namespaces and external URLs; losing them makes foreign
+ * sources indistinguishable from project files.
  */
 export function normalizeSourcePath(src, sourceRoot) {
     let s = src;
     if (sourceRoot && !/^[a-z]+:/i.test(s)) {
         s = sourceRoot.replace(/\/?$/, "/") + s;
     }
-    s = s.replace(/^webpack:\/\/\/?/, "").replace(/^file:\/\//, "");
-    // A URL (`http://host/src/a.ts`, Vite's `/@fs/…`) keeps only its path.
-    const m = /^[a-z]+:\/\/[^/]*(\/.*)$/i.exec(s);
-    if (m)
-        s = m[1];
+    // Keep virtual source identity intact. Stripping the scheme turned
+    // webpack://_N_E/../src/utils.ts (a foreign source) into a plausible
+    // project path; a suffix match then attributed its lines to lib/utils.ts.
+    // Do not use URL here: it collapses the traversal we need to preserve.
+    if (/^(webpack|turbopack):\/\//.test(s))
+        return s;
+    s = s.replace(/^file:\/\//, "");
+    // External URLs keep their identity; Vite's /@fs is an explicit file path.
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s))
+        return s;
     s = s.replace(/^\/@fs\//, "/");
     s = s.replace(/\?.*$/, "");
     // Turbopack (Next.js) roots every source at the `[project]` token —

package/dist/index.d.ts

@@ -829,8 +829,7 @@ export type ServiceImage = {
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
- * instead of read stale).
+ * `ctx.readProjectFile` apply.
  */
 export declare function validateServiceImage(serviceName: string, image: ServiceImage): ServiceImage;
 export interface VolumeMount {

package/dist/index.js

@@ -253,8 +253,7 @@ const BUILD_TARGET_RE = /^[^\s]+$/;
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
- * instead of read stale).
+ * `ctx.readProjectFile` apply.
  */
 export function validateServiceImage(serviceName, image) {
     if (image.type !== "dockerfile")

package/dist/project-files.js

@@ -9,46 +9,20 @@
 //                                 on EVERY start, warm ones included.
 //
 // A warm start happens only when the warm-template hash matches, so /workspace
-// is correct for every file that is IN that hash. It can be behind for the two
-// kinds of file the hash excludes: `spectest/tests/**` (excluded so a test-only
-// edit keeps the fast start) and anything a project lists in
-// `spectest/.specignore`.
+// is correct for every file that is IN that hash. It can be behind for the one
+// kind of file the hash excludes: `spectest/tests/**` (excluded so a test-only
+// edit keeps the fast start).
 //
 // Hence the rule below: a path under `spectest/` resolves against the app copy
 // first, because that copy is always current — this is what lets a fixture live
 // in `spectest/tests/fixtures/` and still be found after it was added. Any
 // other path resolves against /workspace, which the hash keeps current.
-//
-// The remaining hole is a file that `.specignore` excludes AND that sits outside
-// `spectest/`: /workspace holds whatever the cold start uploaded, so a later
-// edit is invisible. Nothing can repair those bytes at read time, so we refuse
-// to read them instead of returning stale content. The control plane writes the
-// exact path list it excluded (env.rs) into ENV_IGNORED_FILE.
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import path from "node:path";
 /** The extracted repo — `ctx.projectRoot`. */
 export const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
 /** The app dir; the user's `spectest/` sits directly under it. */
 export const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
-/** Paths (repo-relative) the warm-template hash skipped because of
- *  `spectest/.specignore`. Written by the control plane at env start; absent
- *  when the project ships no `.specignore`. */
-const ENV_IGNORED_FILE = "/run/spectest-env-ignored.json";
-let _envIgnored;
-function envIgnored() {
-    if (_envIgnored)
-        return _envIgnored;
-    let paths = [];
-    try {
-        const raw = JSON.parse(readFileSync(ENV_IGNORED_FILE, "utf8"));
-        paths = raw.paths ?? [];
-    }
-    catch {
-        /* No file (no .specignore, or an older env) — nothing to refuse. */
-    }
-    _envIgnored = new Set(paths);
-    return _envIgnored;
-}
 /** Project files resolved since the last take — what a test read
  *  through the SDK. Module memory: forks with the environment; the
  *  coverage capture takes and clears it after every case, so a forked
@@ -89,11 +63,6 @@ export function resolveProjectPath(p, opts = {}) {
         if (existsSync(app))
             return app;
     }
-    if (envIgnored().has(rel)) {
-        throw new Error(`project file "${p}" is excluded by the environment cache ignore rules, so the copy in the VM ` +
-            `is whatever a cold start uploaded and can be out of date. Move it under ` +
-            `spectest/tests/ (still cache-free, and always re-uploaded), or drop the pattern.`);
-    }
     return path.join(WORKSPACE, rel);
 }
 /** {@link resolveProjectPath}, but a missing file is an error that names every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.90.1",
+  "version": "0.90.3",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser-coverage.ts

@@ -12,8 +12,8 @@
 //
 // Harvest runs before every browser step (a click that navigates
 // cross-site replaces the renderer, and the old counters with it) and at
-// every coverage capture. `browserCoverageReports` renders the totals as
-// one lcov per service for the `case-coverage` bundle.
+// every coverage capture. `takeBrowserCoverageReport` renders and clears
+// one service's totals for the `case-coverage` bundle.
 //
 // Configured by the daemon at /load with the host → service table; a
 // project with no `coverage: { browser: true }` service never attaches
@@ -220,17 +220,15 @@ export async function harvestAllBrowserCoverage(): Promise<void> {
   await Promise.all([...LIVE_COLLECTORS].map((c) => harvestBrowserCoverage(c.cdp)));
 }
 
-/** One lcov document per service that has any browser coverage — and
- *  the totals are cleared, so the next capture holds only what runs
- *  from now on. Module memory forks with the environment, so a forked
- *  child starts from its parent's last capture, empty. */
-export function takeBrowserCoverageReports(): Map<string, string> {
-  const out = new Map<string, string>();
-  for (const [service, files] of TOTALS) {
-    if (files.size > 0) out.set(service, lcovDocument(files));
-  }
-  TOTALS.clear();
-  return out;
+/** Take one service's lcov report and clear only its totals. Other
+ *  services retain their coverage until their own capture. Each capture
+ *  is a delta; after every service is captured, a forked child inherits
+ *  empty totals from its parent. */
+export function takeBrowserCoverageReport(service: string): string {
+  const files = TOTALS.get(service);
+  const report = files ? lcovDocument(files) : "TN:\n";
+  TOTALS.delete(service);
+  return report;
 }
 
 /** The current totals, without clearing them (tests). */

package/src/coverage.test.ts

@@ -135,6 +135,56 @@ describe("units", () => {
 });
 
 describe("browserCoverage", () => {
+  for (const order of ["dashboard first", "admin first", "concurrent"] as const) {
+    test(`services retain their own coverage and deltas: ${order}`, async () => {
+      const reports = new Map<string, string>();
+      const contexts = ["dashboard", "admin"].map((service): CoverageCaptureContext => ({
+        ...fakeCtx("unused"),
+        service,
+        async writeReport(name, content) {
+          expect(name).toBe("browser.lcov");
+          reports.set(service, content);
+        },
+      }));
+      if (order === "admin first") contexts.reverse();
+      const capture = async () => {
+        if (order === "concurrent") {
+          await Promise.all(contexts.map((ctx) => browser().capture!(ctx)));
+        } else {
+          for (const ctx of contexts) await browser().capture!(ctx);
+        }
+      };
+      foldBrowserCoverage("dashboard", new Map([["src/dashboard.ts", new Map([[1, 2]])]]));
+      foldBrowserCoverage("admin", new Map([["src/admin.ts", new Map([[3, 4]])]]));
+      await capture();
+      expect(reports.get("dashboard")).toBe("TN:\nSF:src/dashboard.ts\nDA:1,2\nLF:1\nLH:1\nend_of_record\n");
+      expect(reports.get("admin")).toBe("TN:\nSF:src/admin.ts\nDA:3,4\nLF:1\nLH:1\nend_of_record\n");
+
+      await capture();
+      expect(reports.get("dashboard")).toBe("TN:\n");
+      expect(reports.get("admin")).toBe("TN:\n");
+
+      foldBrowserCoverage("admin", new Map([["src/admin.ts", new Map([[3, 1]])]]));
+      await capture();
+      expect(reports.get("dashboard")).toBe("TN:\n");
+      expect(reports.get("admin")).toBe("TN:\nSF:src/admin.ts\nDA:3,1\nLF:1\nLH:1\nend_of_record\n");
+    });
+  }
+
+  test("capturing a service with no coverage preserves other services' totals", async () => {
+    const reports = new Map<string, string>();
+    foldBrowserCoverage("dashboard", new Map([["src/dashboard.ts", new Map([[1, 2]])]]));
+    for (const service of ["admin", "dashboard"]) {
+      await browser().capture!({
+        ...fakeCtx("unused"),
+        service,
+        async writeReport(_name, content) { reports.set(service, content); },
+      });
+    }
+    expect(reports.get("admin")).toBe("TN:\n");
+    expect(reports.get("dashboard")).toBe("TN:\nSF:src/dashboard.ts\nDA:1,2\nLF:1\nLH:1\nend_of_record\n");
+  });
+
   test("writes an empty lcov when nothing ran for the service", async () => {
     const dir = await fs.mkdtemp(path.join(os.tmpdir(), "spectest-cov-"));
     await browser().capture!(fakeCtx(dir));
@@ -297,6 +347,34 @@ describe.if(hasNode)("nodeCoverage hook (real node)", () => {
     }
   });
 
+  test("recompiled scripts at the same URL get distinct records within and across processes", async () => {
+    const dir = await scratch();
+    const sharedUrl = `file://${path.join(dir, "shared.js")}`;
+    await fs.writeFile(path.join(dir, "main.js"), `
+      const vm = require("node:vm");
+      vm.runInThisContext("globalThis.value = 1;", { filename: ${JSON.stringify(sharedUrl)} });
+      vm.runInThisContext("globalThis.value = 2;", { filename: ${JSON.stringify(sharedUrl)} });
+    `);
+    expect(await runOnce(dir, "main.js")).toBe(0);
+    const first = (await Promise.all((await dumpsIn(dir)).map((n) => readDump(dir, n))))
+      .flatMap((d) => d.result).filter((s) => s.url === sharedUrl);
+    expect(first).toHaveLength(2);
+    const ids = new Set(first.map((s) => s.spectestScript));
+    expect(ids.size).toBe(2); // same URL, line lengths and extents, different source
+    for (const id of ids) {
+      const record = JSON.parse(await fs.readFile(path.join(dir, NODE_COVERAGE_SCRIPTS_SUBDIR, `${id}.json`), "utf8"));
+      expect(record.spectestScript.url).toBe(sharedUrl);
+      expect(record.spectestScript.sourceHash).toMatch(/^[a-f0-9]{64}$/);
+    }
+    // A second process shares the marker directory. Identical descriptors
+    // deduplicate, but must never borrow the other compilation's identity.
+    expect(await runOnce(dir, "main.js")).toBe(0);
+    const all = (await Promise.all((await dumpsIn(dir)).map((n) => readDump(dir, n))))
+      .flatMap((d) => d.result).filter((s) => s.url === sharedUrl);
+    expect(all).toHaveLength(4);
+    expect(new Set(all.map((s) => s.spectestScript))).toEqual(ids);
+  });
+
   test("short-lived CLI processes write at exit; the map next to the script is recorded once, no NODE_V8_COVERAGE", async () => {
     const dir = await scratch();
     await fs.writeFile(path.join(dir, "cli.js"), "function used() { return 1 }\nfunction unused() { return 2 }\nused();\n");

package/src/coverage.ts

@@ -30,7 +30,7 @@
 import { createHash } from "node:crypto";
 
 import type { ServiceConfig } from "./index.js";
-import { harvestAllBrowserCoverage, takeBrowserCoverageReports } from "./browser-coverage.js";
+import { harvestAllBrowserCoverage, takeBrowserCoverageReport } from "./browser-coverage.js";
 
 import { COVERAGE_CONTAINER_DIR, type CoverageReportsMode } from "./harness/coverage.js";
 export { COVERAGE_CONTAINER_DIR, type CoverageReportsMode };
@@ -342,6 +342,8 @@ export const NODE_COVERAGE_DUMP_PREFIX = "node-";
  *   source map: the inline `data:` map in the text, the file the last
  *   `sourceMappingURL` comment names, or `<script>.map` next to the
  *   script; `sourcesContent` dropped (the sources are the repository).
+ *   Records are keyed by their descriptor and compiled-source hash, not
+ *   their URL: a recompilation can reuse a URL with different source.
  *   "Once per branch" is a marker file under `.spectest/scripts/`: the
  *   directory is shared by every process of the service and forks with
  *   the environment, so a record written at bring-up or by an ancestor
@@ -388,7 +390,9 @@ export const NODE_COVERAGE_HOOK = `"use strict";
   const SELF = url.pathToFileURL(__filename).href;
   const SCRIPTS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_SCRIPTS_SUBDIR)});
   const MARKERS = path.join(dir, ${JSON.stringify(NODE_COVERAGE_MARKERS_SUBDIR)});
-  const known = new Set();
+  // V8 script ids identify a compiled script within this process. A URL
+  // can be reused by another process, vm context, or compilation.
+  const known = new Map();
   let seq = 0;
 
   function isApp(u) {
@@ -521,7 +525,6 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     fs.renameSync(tmp, file);
   }
   function describe(s, source) {
-    const id = idOf(s.url);
     let scriptPath = null;
     try {
       scriptPath = url.fileURLToPath(s.url);
@@ -529,16 +532,20 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     const text = typeof source === "string" ? source : null;
     const record = {
       url: s.url,
+      sourceHash: text !== null ? crypto.createHash("sha256").update(text).digest("hex") : null,
       lineLengths: text !== null ? lineLengths(text) : null,
       functions: s.functions.map(function (f) {
         return [f.functionName, f.ranges[0].startOffset, f.ranges[0].endOffset];
       }),
       sourceMap: text !== null && scriptPath !== null ? readMap(scriptPath, text) : null,
     };
-    writeAtomic(path.join(SCRIPTS, id + ".json"), JSON.stringify({ spectestScript: record }));
-    try {
+    const document = JSON.stringify({ spectestScript: record });
+    const id = idOf(document);
+    if (!fs.existsSync(path.join(MARKERS, id))) {
+      writeAtomic(path.join(SCRIPTS, id + ".json"), document);
       fs.writeFileSync(path.join(MARKERS, id), "");
-    } catch (e) {}
+    }
+    return id;
   }
   function take() {
     const res = post("Profiler.takePreciseCoverage");
@@ -559,9 +566,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
     if (kept.length === 0 && units.size === 0) return;
     const fresh = [];
     for (const s of kept) {
-      if (known.has(s.url)) continue;
-      known.add(s.url);
-      if (!fs.existsSync(path.join(MARKERS, idOf(s.url)))) fresh.push(s);
+      if (!known.has(s.scriptId)) fresh.push(s);
     }
     if (fresh.length > 0) {
       try {
@@ -572,7 +577,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
       for (const s of fresh) {
         const r = post("Debugger.getScriptSource", { scriptId: s.scriptId });
         try {
-          describe(s, r && r.scriptSource);
+          known.set(s.scriptId, describe(s, r && r.scriptSource));
         } catch (e) {}
       }
       post("Debugger.disable");
@@ -588,7 +593,7 @@ export const NODE_COVERAGE_HOOK = `"use strict";
       result: kept.map(function (s) {
         return {
           url: s.url,
-          spectestScript: idOf(s.url),
+          spectestScript: known.get(s.scriptId) || null,
           functions: s.functions.filter(ran).map(function (f) {
             const first = f.ranges[0];
             const out = [first.startOffset, first.endOffset - first.startOffset, first.count];
@@ -964,7 +969,7 @@ export async function collectNodeReports(dir: string): Promise<NodeReportStats>
  * loads from this service's origins, maps it back to source through the
  * served source map, and writes one lcov per capture (`browser.lcov`)
  * holding what ran since the previous capture: every live session is
- * harvested first, and the totals are taken and cleared. Nothing ran ⇒
+ * harvested first, and only this service's totals are taken and cleared. Nothing ran ⇒
  * an lcov with no records, which is a report saying so.
  */
 export function browser(): CoverageAdapter {
@@ -976,7 +981,7 @@ export function browser(): CoverageAdapter {
     },
     async capture(ctx) {
       await harvestAllBrowserCoverage();
-      const lcov = takeBrowserCoverageReports().get(ctx.service) ?? "TN:\n";
+      const lcov = takeBrowserCoverageReport(ctx.service);
       await ctx.writeReport("browser.lcov", lcov);
     },
   };

package/src/harness/browser-coverage.test.ts

@@ -41,10 +41,10 @@ describe("source maps", () => {
       mappings: "AAAA,ICAA;ACIA",
     });
     expect(map).not.toBeNull();
-    expect(map!.sources).toEqual(["src/a.ts", "node_modules/x.js", "src/b.ts"]);
+    expect(map!.sources).toEqual(["webpack:///./src/a.ts", "webpack:///./node_modules/x.js", "src/b.ts"]);
     const files = mapToOriginal(map!, new Map([[1, 2], [2, 0]]));
-    expect([...files.keys()]).toEqual(["src/a.ts", "src/b.ts"]);
-    expect(files.get("src/a.ts")!.get(1)).toBe(2);
+    expect([...files.keys()]).toEqual(["webpack:///./src/a.ts", "src/b.ts"]);
+    expect(files.get("webpack:///./src/a.ts")!.get(1)).toBe(2);
     expect(files.get("src/b.ts")!.get(5)).toBe(0);
   });
 
@@ -54,9 +54,12 @@ describe("source maps", () => {
     expect(decodeSourceMap("nope")).toBeNull();
   });
 
-  test("normalizeSourcePath strips schemes, roots and queries", () => {
-    expect(normalizeSourcePath("webpack:///./src/a.ts")).toBe("src/a.ts");
-    expect(normalizeSourcePath("http://app.test/src/a.ts?t=1")).toBe("/src/a.ts");
+  test("normalizeSourcePath preserves namespaces and external origins", () => {
+    expect(normalizeSourcePath("webpack:///./src/a.ts")).toBe("webpack:///./src/a.ts");
+    expect(normalizeSourcePath("webpack://_N_E/../src/utils.ts")).toBe("webpack://_N_E/../src/utils.ts");
+    expect(normalizeSourcePath("webpack://_N_E/./lib/utils.ts")).toBe("webpack://_N_E/./lib/utils.ts");
+    expect(normalizeSourcePath("turbopack:///[project]/src/a.ts")).toBe("turbopack:///[project]/src/a.ts");
+    expect(normalizeSourcePath("http://app.test/src/a.ts?t=1")).toBe("http://app.test/src/a.ts?t=1");
     expect(normalizeSourcePath("/@fs/repo/src/a.ts")).toBe("/repo/src/a.ts");
     expect(normalizeSourcePath("a.ts", "/app/src")).toBe("/app/src/a.ts");
     expect(normalizeSourcePath("file:///app/src/a.ts")).toBe("/app/src/a.ts");

package/src/harness/browser-coverage.ts

@@ -119,21 +119,26 @@ export function decodeVlq(segment: string): number[] {
 }
 
 /**
- * Normalise a source-map `sources` entry to a plain path. Bundlers prefix
+ * Normalise a source-map `sources` entry without discarding its identity. Bundlers prefix
  * their own scheme (`webpack:///./src/a.ts`), dev servers serve absolute
  * URLs paths (`/src/a.ts`), builds write relative ones (`../src/a.ts`).
- * The server maps these onto the repo by suffix, so all that matters here
- * is stripping what is not a path.
+ * The server validates file identity against the repository. Preserve
+ * virtual namespaces and external URLs; losing them makes foreign
+ * sources indistinguishable from project files.
  */
 export function normalizeSourcePath(src: string, sourceRoot?: string): string {
   let s = src;
   if (sourceRoot && !/^[a-z]+:/i.test(s)) {
     s = sourceRoot.replace(/\/?$/, "/") + s;
   }
-  s = s.replace(/^webpack:\/\/\/?/, "").replace(/^file:\/\//, "");
-  // A URL (`http://host/src/a.ts`, Vite's `/@fs/…`) keeps only its path.
-  const m = /^[a-z]+:\/\/[^/]*(\/.*)$/i.exec(s);
-  if (m) s = m[1];
+  // Keep virtual source identity intact. Stripping the scheme turned
+  // webpack://_N_E/../src/utils.ts (a foreign source) into a plausible
+  // project path; a suffix match then attributed its lines to lib/utils.ts.
+  // Do not use URL here: it collapses the traversal we need to preserve.
+  if (/^(webpack|turbopack):\/\//.test(s)) return s;
+  s = s.replace(/^file:\/\//, "");
+  // External URLs keep their identity; Vite's /@fs is an explicit file path.
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) return s;
   s = s.replace(/^\/@fs\//, "/");
   s = s.replace(/\?.*$/, "");
   // Turbopack (Next.js) roots every source at the `[project]` token —

package/src/index.ts

@@ -1272,8 +1272,7 @@ const BUILD_TARGET_RE = /^[^\s]+$/;
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
- * instead of read stale).
+ * `ctx.readProjectFile` apply.
  */
 export function validateServiceImage(serviceName: string, image: ServiceImage): ServiceImage {
   if (image.type !== "dockerfile") return image;

package/src/project-files.ts

@@ -9,23 +9,16 @@
 //                                 on EVERY start, warm ones included.
 //
 // A warm start happens only when the warm-template hash matches, so /workspace
-// is correct for every file that is IN that hash. It can be behind for the two
-// kinds of file the hash excludes: `spectest/tests/**` (excluded so a test-only
-// edit keeps the fast start) and anything a project lists in
-// `spectest/.specignore`.
+// is correct for every file that is IN that hash. It can be behind for the one
+// kind of file the hash excludes: `spectest/tests/**` (excluded so a test-only
+// edit keeps the fast start).
 //
 // Hence the rule below: a path under `spectest/` resolves against the app copy
 // first, because that copy is always current — this is what lets a fixture live
 // in `spectest/tests/fixtures/` and still be found after it was added. Any
 // other path resolves against /workspace, which the hash keeps current.
-//
-// The remaining hole is a file that `.specignore` excludes AND that sits outside
-// `spectest/`: /workspace holds whatever the cold start uploaded, so a later
-// edit is invisible. Nothing can repair those bytes at read time, so we refuse
-// to read them instead of returning stale content. The control plane writes the
-// exact path list it excluded (env.rs) into ENV_IGNORED_FILE.
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import path from "node:path";
 
 /** The extracted repo — `ctx.projectRoot`. */
@@ -33,25 +26,6 @@ export const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
 /** The app dir; the user's `spectest/` sits directly under it. */
 export const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
 
-/** Paths (repo-relative) the warm-template hash skipped because of
- *  `spectest/.specignore`. Written by the control plane at env start; absent
- *  when the project ships no `.specignore`. */
-const ENV_IGNORED_FILE = "/run/spectest-env-ignored.json";
-
-let _envIgnored: Set<string> | undefined;
-function envIgnored(): Set<string> {
-  if (_envIgnored) return _envIgnored;
-  let paths: string[] = [];
-  try {
-    const raw = JSON.parse(readFileSync(ENV_IGNORED_FILE, "utf8")) as { paths?: string[] };
-    paths = raw.paths ?? [];
-  } catch {
-    /* No file (no .specignore, or an older env) — nothing to refuse. */
-  }
-  _envIgnored = new Set(paths);
-  return _envIgnored;
-}
-
 /** Project files resolved since the last take — what a test read
  *  through the SDK. Module memory: forks with the environment; the
  *  coverage capture takes and clears it after every case, so a forked
@@ -92,13 +66,6 @@ export function resolveProjectPath(p: string, opts: { record?: boolean } = {}):
     const app = path.join(APP_DIR, rel);
     if (existsSync(app)) return app;
   }
-  if (envIgnored().has(rel)) {
-    throw new Error(
-      `project file "${p}" is excluded by the environment cache ignore rules, so the copy in the VM ` +
-        `is whatever a cold start uploaded and can be out of date. Move it under ` +
-        `spectest/tests/ (still cache-free, and always re-uploaded), or drop the pattern.`,
-    );
-  }
   return path.join(WORKSPACE, rel);
 }