supercov 0.0.35 → 0.0.37

package/README.md

@@ -40,6 +40,7 @@ npx supercov -- cargo test
 npx supercov -- cargo nextest run
 npx supercov -- pytest
 npx supercov -- python -m unittest
+npx supercov -- bundle exec rspec
 ```
 
 ## Give Supercov a job
@@ -101,6 +102,19 @@ From lines and branches to MC/DC, every gap becomes a concrete test target. Supe
 
 The denominator comes from source structure before the run, so adding or removing tests cannot silently change what 100% means. Ambiguous source scope, uninstrumented code, and missing evidence remain visible as completeness blockers.
 
+## Install for your language
+
+The same binary ships through each language's own package manager, at the same version, from one release:
+
+```bash
+npx supercov -- npm test                          # npm
+uvx --from supercov-cli supercov -- pytest        # PyPI
+gem install supercov && supercov -- bundle exec rspec   # RubyGems
+cargo install supercov && supercov -- cargo test  # crates.io, built from source
+```
+
+`pip install supercov-cli` and `gem install supercov` install a wheel or gem that carries the binary for your platform; nothing is compiled. The crate builds from source and needs Rust 1.95.
+
 ## Supported languages
 
 | Language | Status | Start with |
@@ -116,6 +130,18 @@ The denominator comes from source structure before the run, so adding or removin
 
 Supercov requires Node.js 22 or newer. Rust support currently uses Rust 1.95; cargo-nextest 0.9.138 and 0.9.140 are supported. Python support requires CPython 3.12 or newer and measures pytest and unittest runs. Ruby support requires Ruby 3.3 or newer (3.4 or newer for full measurement) and measures RSpec, Minitest, test-unit and Cucumber runs.
 
+## Supported operating systems and architectures
+
+The CLI is a single native binary. `npx supercov` selects the build for the machine it runs on; nothing is compiled during installation.
+
+| Operating system | Architectures | Notes |
+| --- | --- | --- |
+| macOS | arm64 (Apple silicon), x64 (Intel) | macOS 11 or newer |
+| Linux | arm64, x64 | glibc 2.28 or newer (Debian 10, Ubuntu 18.10, RHEL 8 and later), or musl (Alpine); chosen automatically |
+| Windows | arm64, x64 | Windows 10 or newer |
+
+On Windows, JavaScript and TypeScript suites are verified on every release; Python, Ruby, and Rust suites are not yet verified there. Containers, VMs, and remote executors run the same Linux builds. Every release publishes the same binaries to npm, PyPI (`supercov-cli`, a wheel per platform) and RubyGems (`supercov`, a gem per platform except arm64 Windows, which Ruby has no platform for), and the source to crates.io (`supercov`).
+
 ## Supported test suites
 
 Supercov uses exact per-test attribution where an adapter is available. For other supported runners, it reports aggregate structural coverage instead of guessing which test covered a path.
@@ -129,6 +155,9 @@ Supercov uses exact per-test attribution where an adapter is available. For othe
 | AVA and Mocha | Aggregate structural coverage |
 | Cargo's standard libtest runner | Exact test and attempt identity |
 | cargo-nextest | Exact test, attempt, retry, and binary identity |
+| RSpec | Exact example and before/example/after phase identity |
+| Minitest and test-unit | Exact test and setup/test/teardown identity |
+| Cucumber | Exact scenario and hook-phase identity |
 
 Supercov works with Vite, Next, Turbopack, Webpack, esbuild, SWC, and projects with no build step. One command can collect evidence from several supported runners into a single run.
 

package/docs/coverage-model.md

@@ -58,7 +58,8 @@ owners are allowed, and everyone else is denied. Branches, decision vectors, and
 MC/DC expose those missing cases instead of treating one executed line as proof
 that the decision is safe.
 
-The same principle applies to Rust boolean expressions and control flow.
+The same principle applies to Rust, Python, and Ruby boolean expressions and
+control flow.
 
 ## What 100% means
 

package/docs/getting-started.md

@@ -15,15 +15,22 @@ Supercov supports JavaScript, TypeScript, Rust, Python, and Ruby today.
 
 You need:
 
+- macOS (arm64 or x64), Linux (arm64 or x64, glibc 2.28 or newer or musl), or
+  Windows (arm64 or x64; JavaScript and TypeScript suites are verified there
+  today);
 - Node.js 22 or newer;
 - a test command that already works in the repository; and
 - for Rust, the Rust 1.95 toolchain;
 - for Python, CPython 3.12 or newer with pytest or unittest;
 - for Ruby, Ruby 3.4 or newer with RSpec, Minitest, test-unit or Cucumber (3.3 measures lines, methods and simple branches only).
 
-The CLI is distributed through npm, even for Rust projects. The first `npx`
-invocation may download Supercov from the npm registry. Supercov itself does not
-upload your source or coverage evidence to a Supercov service.
+The CLI is a native binary. `npx supercov` picks the build for your operating
+system and architecture, and nothing is compiled on install; the same binary is
+on PyPI as `supercov-cli` (`uvx --from supercov-cli supercov`) and on RubyGems
+as `supercov` (`gem install supercov`), at the same version, and the source is
+on crates.io (`cargo install supercov`). The first invocation may download
+Supercov from the registry. Supercov itself does not upload your source or
+coverage evidence to a Supercov service.
 
 ## 1. Run your real test command
 

package/docs/supported-suites.md

@@ -63,6 +63,20 @@ TypeScript, and TSX are supported.
 Supercov instruments an isolated copy. It does not ask you to add an import,
 reporter, plugin, or alternate build output.
 
+A suite that runs its own compiled output is built before the tests start.
+Supercov reads the tests: one that imports from `dist/`, or launches a package
+script that does—`spawn("npm", ["run", "start"])`, `execSync("npm run
+start")`, or any launch handed to the shell as one string—means the build is
+part of the run, and a `build` script is run inside the isolated copy first.
+Without it the server under test would never exist. A launch that only names a
+build subcommand, such as `vite build`, is not taken as consuming a build.
+
+Instrumented TypeScript is exempt from the host's type policy whether the
+compile is Supercov's own build step or the test command's own `tsc`.
+Instrumentation necessarily rewrites control-flow expressions in ways a type
+checker cannot narrow through, so a project that compiles inside its test
+command builds under measurement exactly as it does without it.
+
 ### Browsers, servers, and child processes
 
 Playwright support includes Chromium, Firefox, and WebKit, along with pages,
@@ -82,6 +96,15 @@ a short drain window after the test command finishes so buffered evidence can
 arrive. Work without a reliable test identity is kept as background coverage
 instead of being assigned to an arbitrary test.
 
+A child a test stops in teardown keeps the coverage it produced. Buffered
+evidence is written when a terminating signal arrives—`SIGTERM`, `SIGINT`,
+`SIGHUP`—not only when the process exits on its own, so killing a gateway
+after the request it served does not lose the request. The program's own
+signal handling is untouched: a process with no handler still dies from the
+signal exactly as it would unmeasured, and one with its own handler keeps
+it. `SIGKILL` cannot be caught by anything and is the one stop that loses
+whatever was still buffered.
+
 ## Rust
 
 | Runner | Attribution | Current requirement |
@@ -208,6 +231,16 @@ decisions, `||=`, loops, `rescue` flow, a second statement on a line) is
 declared unmeasured on that interpreter rather than shown as a gap. Ruby 3.4
 and newer measure everything.
 
+Ruby reads its own coverage as the interpreter exits, and that shapes what a
+stopped process keeps. A process ended by a signal it can catch—`SIGTERM`
+from a test's teardown, `SIGINT`—unwinds through that exit and reports
+everything it measured. A process killed with `SIGKILL`, or one that leaves
+through `exit!`, never gets there and takes with it whatever it observed since
+its last test boundary. Supercov cannot recover that or say which lines it
+would have been, so the run declares that a process did not report, which
+blocks completeness, rather than counting those lines against the code. Stop a
+Ruby server with `SIGTERM`, or wait for it to exit, and it reports.
+
 ```sh
 npx supercov -- rspec
 npx supercov -- bundle exec rspec

package/docs/troubleshooting.md

@@ -100,6 +100,14 @@ Read the reason in the summary, `scope`, or `gaps` output. Fix a configuration
 problem when one is named. Otherwise stop the coverage loop and report the
 limit; do not change application code or add a meaningless test to chase 100%.
 
+One limit names a cause you can remove. `ruby-process-did-not-report` means a
+Ruby process the run measured ended without reporting: it was killed with
+`SIGKILL`, or left through `exit!`, before the exit where Ruby hands over its
+coverage. Whatever that process observed since its last test boundary is gone,
+and its lines are not shown as uncovered because nothing can say whether they
+ran. Stop the process with `SIGTERM` instead, or wait for it to exit, and the
+limit does not appear.
+
 ## Coverage is aggregate instead of per test
 
 Aggregate coverage still shows which source ran, but Supercov cannot truthfully

package/docs/verification.md

@@ -68,12 +68,15 @@ aggregate instead of being assigned to whichever test happened to be nearby.
 
 Release checks cover program behavior before and after instrumentation, line and
 branch results, decision vectors and MC/DC, supported JavaScript, TypeScript,
-and Rust runner contracts, Chromium, Firefox, and WebKit execution, clean
-installation, interrupted-run recovery, and isolated publication.
+Rust, Python, and Ruby runner contracts, Chromium, Firefox, and WebKit
+execution, clean installation, interrupted-run recovery, and isolated
+publication.
 
 JavaScript behavior is exercised against a pinned TC39 Test262 corpus. MC/DC
 cases are also compared with an independent LLVM implementation so a
-self-consistent calculation error does not pass unnoticed.
+self-consistent calculation error does not pass unnoticed. Python and Ruby
+gates run real suites through their supported runners and assert the resulting
+coverage totals, test identity, and measurement limits.
 
 These checks reduce risk; they do not replace reviewing the assertions and
 behavior protected by a new test.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "supercov",
-  "version": "0.0.35",
-  "description": "Zero-edit, runner-aware coverage completeness for JavaScript, TypeScript, Rust, and Python test suites",
+  "version": "0.0.37",
+  "description": "Zero-edit, runner-aware coverage completeness for JavaScript, TypeScript, Rust, Python, and Ruby test suites",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/supercorp-ai/supercov.git"
   },
-  "homepage": "https://github.com/supercorp-ai/supercov#readme",
+  "homepage": "https://supercov.com",
   "bugs": {
     "url": "https://github.com/supercorp-ai/supercov/issues"
   },
@@ -65,6 +65,7 @@
     "benchmark:python-monitoring": "cargo build -p supercov && node scripts/python-monitoring-benchmark.mjs",
     "check": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && npm run test && npm run test:runtime && npm run test:rust-assets && node scripts/package-preflight.mjs",
     "release:check": "npm run check && npm run test:engine && npm run test:fixture && npm run test:watchdog && npm run test:engine-contract && npm run test:agent && npm run test:child-attribution && npm run test:host-loader && npm run test:python-monitoring && npm run test:ruby-coverage && npm run test:packed-npx && npm run test:clang-mcdc && npm run benchmark:check",
+    "release:bump": "node scripts/bump-version.mjs",
     "prepack": "node scripts/package-preflight.mjs",
     "prepublishOnly": "npm run release:check",
     "test:child-attribution": "cargo build -p supercov && node scripts/rust-child-attribution-integration.mjs",
@@ -73,12 +74,14 @@
     "test:ruby-coverage": "cargo build -p supercov && node scripts/ruby-coverage-integration.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "0.0.35",
-    "@supercov/cli-darwin-x64": "0.0.35",
-    "@supercov/cli-linux-arm64-gnu": "0.0.35",
-    "@supercov/cli-linux-arm64-musl": "0.0.35",
-    "@supercov/cli-linux-x64-gnu": "0.0.35",
-    "@supercov/cli-linux-x64-musl": "0.0.35"
+    "@supercov/cli-darwin-arm64": "0.0.37",
+    "@supercov/cli-darwin-x64": "0.0.37",
+    "@supercov/cli-linux-arm64-gnu": "0.0.37",
+    "@supercov/cli-linux-arm64-musl": "0.0.37",
+    "@supercov/cli-linux-x64-gnu": "0.0.37",
+    "@supercov/cli-linux-x64-musl": "0.0.37",
+    "@supercov/cli-win32-arm64": "0.0.37",
+    "@supercov/cli-win32-x64": "0.0.37"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -13,6 +13,7 @@ import http from "node:http";
 import https from "node:https";
 import { syncBuiltinESMExports } from "node:module";
 import { relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 import * as standardPlaywright from "@playwright/test";
 import * as coverageRuntime from "./runtime.mjs";
 import { inferTestProvenance } from "./provenance.mjs";
@@ -147,8 +148,11 @@ function callerSource() {
         .replace(/\/$/, "");
     if (!projectRoot)
         return normalized;
+    // A stack frame's URL is what Node's pathToFileURL produces -- on Windows
+    // `file:///C:/...`, never a hand-built `file://C:/...` -- so strip the
+    // prefix derived the same way, then the bare path for frames without one.
     return normalized
-        .replace(`file://${projectRoot}/`, "")
+        .replace(`${pathToFileURL(projectRoot).href}/`, "")
         .replace(`${projectRoot}/`, "");
 }
 class CoveragePhaseController {
@@ -168,9 +172,11 @@ class CoveragePhaseController {
     scriptUpdate = Promise.resolve();
     proxyCache = new WeakMap();
     runtimeSnapshots;
-    // Contexts this controller found rather than created: it does not know
+    // Contexts whose creation the collector did not observe: it does not know
     // what `extraHTTPHeaders` their owner configured, so it must not rewrite
     // them (the scope cookie and the fetch patch still carry attribution).
+    // A worker-scoped context launched through a patched BrowserType is found
+    // later but is not opaque: its original headers were captured at launch.
     adoptedContexts = new Set();
     // Listeners installed on contexts that outlive this test, removed on
     // dispose so a worker-scoped context does not keep registering pages with
@@ -257,8 +263,10 @@ class CoveragePhaseController {
         if (this.disposed)
             return;
         for (const context of liveTrackedContexts()) {
-            if (!this.contexts.has(context))
-                await this.registerContext(context, this.configuredHeaders, { adopted: true }).catch(() => undefined);
+            if (!this.contexts.has(context)) {
+                const headersKnown = trackedContextConfiguredHeaders.has(context);
+                await this.registerContext(context, trackedContextConfiguredHeaders.get(context) ?? this.configuredHeaders, { adopted: !headersKnown }).catch(() => undefined);
+            }
         }
     }
     async registerPage(page) {
@@ -266,8 +274,11 @@ class CoveragePhaseController {
             return;
         timingCount("registerPage");
         this.pages.add(page);
-        await this.registerContext(page.context(), this.configuredHeaders, {
-            adopted: !this.contexts.has(page.context()) && liveTrackedContexts().has(page.context()),
+        const context = page.context();
+        const tracked = liveTrackedContexts().has(context);
+        const headersKnown = trackedContextConfiguredHeaders.has(context);
+        await this.registerContext(context, trackedContextConfiguredHeaders.get(context) ?? this.configuredHeaders, {
+            adopted: !this.contexts.has(context) && tracked && !headersKnown,
         });
         const cdp = await page.context().newCDPSession(page).catch(() => undefined);
         if (cdp)
@@ -399,6 +410,14 @@ class CoveragePhaseController {
         this.disposed = true;
         await Promise.all([...this.pendingRegistrations]);
         await this.scriptUpdate;
+        // A worker-scoped context survives this test. Remove its test scope
+        // while preserving the exact headers supplied by the suite so work
+        // between tests cannot be charged to the attempt that just ended.
+        await Promise.all([...this.contexts]
+            .filter((context) => !this.adoptedContexts.has(context))
+            .map((context) => context
+            .setExtraHTTPHeaders(this.contextConfiguredHeaders.get(context) ?? {})
+            .catch(() => undefined)));
         for (const [context, listeners] of this.contextListeners) {
             for (const [event, listener] of listeners)
                 context.off?.(event, listener);
@@ -505,9 +524,10 @@ class CoveragePhaseController {
             trackBrowser(result);
         if (typeof candidate["pages"] === "function" &&
             typeof candidate["route"] === "function") {
-            trackContext(result);
-            await this.registerContext(result, (sourceArgs?.[0]
-                ?.extraHTTPHeaders ?? this.configuredHeaders));
+            const configuredHeaders = sourceArgs?.[0]
+                ?.extraHTTPHeaders ?? this.configuredHeaders;
+            trackContext(result, configuredHeaders);
+            await this.registerContext(result, configuredHeaders);
         }
         if (typeof candidate["frames"] === "function" &&
             typeof candidate["context"] === "function")
@@ -630,6 +650,10 @@ const controllers = new Map();
 // launches are recorded here, and each test's controller adopts what is live.
 const trackedBrowsers = new Set();
 const trackedContexts = new Set();
+// Creation-time headers for contexts launched through patched Playwright
+// methods. Capturing an explicit empty object matters: it proves replacing
+// the headers later is safe, unlike a context discovered only by enumeration.
+const trackedContextConfiguredHeaders = new WeakMap();
 const patchedPrototypes = new WeakSet();
 function trackBrowser(browser) {
     if (!browser || typeof browser !== "object" || trackedBrowsers.has(browser))
@@ -638,8 +662,12 @@ function trackBrowser(browser) {
     browser.once?.("disconnected", () => trackedBrowsers.delete(browser));
     patchBrowserPrototype(browser);
 }
-function trackContext(context) {
-    if (!context || typeof context !== "object" || trackedContexts.has(context))
+function trackContext(context, configuredHeaders) {
+    if (!context || typeof context !== "object")
+        return;
+    if (configuredHeaders !== undefined)
+        trackedContextConfiguredHeaders.set(context, configuredHeaders);
+    if (trackedContexts.has(context))
         return;
     trackedContexts.add(context);
     context.once?.("close", () => trackedContexts.delete(context));
@@ -685,10 +713,11 @@ function patchBrowserPrototype(browser) {
     patchedPrototypes.add(prototype);
     patchOnce(browser, "newContext", (original) => async function (...args) {
         const context = await original.apply(this, args);
-        trackContext(context);
+        const configuredHeaders = args[0]?.extraHTTPHeaders ?? {};
+        trackContext(context, configuredHeaders);
         const controller = activeController;
         if (controller && !controller.contexts.has(context))
-            await controller.registerContext(context, args[0]?.extraHTTPHeaders ?? controller.configuredHeaders, { adopted: true }).catch(() => undefined);
+            await controller.registerContext(context, configuredHeaders).catch(() => undefined);
         return context;
     });
 }
@@ -734,10 +763,11 @@ function installBrowserLaunchTracking() {
     }
     patchOnce(browserType, "launchPersistentContext", (original) => async function (...args) {
         const context = await original.apply(this, args);
-        trackContext(context);
+        const configuredHeaders = args[1]?.extraHTTPHeaders ?? {};
+        trackContext(context, configuredHeaders);
         const controller = activeController;
         if (controller)
-            await controller.registerContext(context, args[1]?.extraHTTPHeaders ?? controller.configuredHeaders, { adopted: true }).catch(() => undefined);
+            await controller.registerContext(context, configuredHeaders).catch(() => undefined);
         return context;
     });
 }

package/runtime/javascript/resolve-loader.mjs

@@ -18,8 +18,10 @@ function belongsToProject(parentURL) {
         return false;
     if (!PROJECT_ROOT)
         return parentURL.includes("/tests/");
-    const normalizedRoot = PROJECT_ROOT.replaceAll("\\", "/").replace(/\/$/, "");
-    const projectURL = `file://${normalizedRoot}/`;
+    // Derive the URL the way Node derives parentURL, or the two never match on
+    // Windows: a hand-built `file://C:/...` is not the `file:///C:/...` that
+    // pathToFileURL produces, and every project module would read as foreign.
+    const projectURL = pathToFileURL(PROJECT_ROOT).href.replace(/\/?$/, "/");
     const generatedURL = `${projectURL}.supercov/`;
     return (parentURL.startsWith(projectURL) && !parentURL.startsWith(generatedURL));
 }