supercov 4.0.0 → 4.1.0

package/docs/cli.md

@@ -147,6 +147,7 @@ npx supercov runs <run-id> [query] [options]
 | `decision <id \| path:line>` | Understand missing boolean outcomes and MC/DC witnesses |
 | `line <path:line>` | See one line's state, obligations, and covering tests |
 | `test <id \| name>` | See the coverage attributed to one test |
+| `tests without-evidence` | List the tests that made assertions and recorded no coverage, which the summary counts in a warning |
 | `kinds` | Group coverage by test level, such as unit or E2E |
 | `runners` | Group coverage by test runner |
 | `scope` | See what is source and what is not, by directory and reason; `--files` lists every file |
@@ -175,12 +176,16 @@ npx supercov runs latest files --group dir --depth 2 --metric branches
 ```
 
 ```
-Directory   Files  Lines     e2e    unit      All
-app             4     15  86.67%   0.00%  100.00%
-lib             1     10  90.00%  40.00%   90.00%
-components      1      2 100.00%   0.00%  100.00%
+Directory   Files  Lines      e2e    unit  no test      All
+app             5     23   86.96%   0.00%    8.70%   95.65%
+lib             1     10   90.00%  40.00%    0.00%   90.00%
+.               2      8   75.00%   0.00%   25.00%  100.00%
+components      1      2  100.00%   0.00%    0.00%  100.00%
 ```
 
+`no test` is what ran only while no test was running, such as a server
+starting before the first test. The column is there when a directory has any.
+
 In `--json`, every file of `files` and `gaps` carries `totals` and `covered`
 for each metric beside what is missing, so a percentage can be worked out for
 any file or set of files.

package/docs/coverage-model.md

@@ -106,6 +106,14 @@ By test kind
   no test                    lines  17.14%  branches   0.00%  MC/DC   0.00%
 ```
 
+`files --group dir` has the same figure as a `no test` column wherever a
+directory has any, so a directory's `All` never stands above its kinds
+unexplained.
+
+A test that made assertions and has no covered line to its name is counted in
+a warning on the summary. `npx supercov runs latest tests without-evidence`
+lists every such test, with its file, kind and outcome.
+
 See [Supported suites](supported-suites.md) for the attribution available from
 each runner.
 

package/docs/workspace-isolation.md

@@ -39,10 +39,16 @@ and the instrumented copy is not what you wrote:
 - Biome, oxlint, dprint, cspell and knip run on your source as you wrote it:
   the copy's `node_modules/.bin` starts each of them in a view of the copy
   that holds every file in its original text. A file the tool writes there
-  (a report, a cache) is the command's output like any other. A change it
-  makes to a source file (`--write`, `--fix`) is not applied during a measured
-  run, and the run says so. To have another tool that reads source as text run
-  the same way, name it: `SUPERCOV_SOURCE_TOOLS=typos,stylelint`.
+  (a report, a cache) is the command's output like any other. To have another
+  tool that reads source as text run the same way, name it:
+  `SUPERCOV_SOURCE_TOOLS=typos,stylelint`.
+- A change one of these tools makes to a source file (`prettier --write`,
+  `eslint --fix`, `biome check --write`, `dprint fmt`) is made in your
+  project when the command ends, and a tool later in the same command reads
+  the changed text. The tests ran the copy instrumented before the change, so
+  the run measured the file as it was, says so, and reads as stale; the next
+  run measures the changed file. A file you edited yourself while the command
+  ran keeps your edit, and the run names it.
 - Coverage tools the command runs itself (tap, c8, nyc, Jest's and Vitest's
   `--coverage`) still collect and report coverage. They measure the
   instrumented copy, and report close to what they report without Supercov,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -119,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.0.0",
-    "@supercov/cli-darwin-x64": "4.0.0",
-    "@supercov/cli-linux-arm64-gnu": "4.0.0",
-    "@supercov/cli-linux-arm64-musl": "4.0.0",
-    "@supercov/cli-linux-x64-gnu": "4.0.0",
-    "@supercov/cli-linux-x64-musl": "4.0.0",
-    "@supercov/cli-win32-arm64": "4.0.0",
-    "@supercov/cli-win32-x64": "4.0.0"
+    "@supercov/cli-darwin-arm64": "4.1.0",
+    "@supercov/cli-darwin-x64": "4.1.0",
+    "@supercov/cli-linux-arm64-gnu": "4.1.0",
+    "@supercov/cli-linux-arm64-musl": "4.1.0",
+    "@supercov/cli-linux-x64-gnu": "4.1.0",
+    "@supercov/cli-linux-x64-musl": "4.1.0",
+    "@supercov/cli-win32-arm64": "4.1.0",
+    "@supercov/cli-win32-x64": "4.1.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/register.mjs

@@ -8,7 +8,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import Module, { register, syncBuiltinESMExports } from "node:module";
 import fs, { closeSync, openSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { installLaunchSupervisor, wrapImportedCapability } from "./launchSupervisor.mjs";
 import { __supercovBindCapabilityWrapper } from "./capability.mjs";
@@ -85,6 +85,34 @@ if (process.env.SUPERCOV_DURABLE_EVIDENCE_EACH_TEST === "1" ||
     // and may evaluate before any ESM instrumented file imports it.
     globalThis.__supercovRuntime ??= globalThis.__SUPERCOV_DIRECT_RUNTIME__;
 }
+// Next.js runs a middleware and a route with `runtime = "edge"` in a VM
+// context of its own, the Edge Runtime's, and that context's global is not
+// this one. An instrumented file found no runtime there: every request to an
+// application with a middleware.ts failed on "Cannot read properties of
+// undefined (reading 'mcdcBegin')", and `next build` failed collecting page
+// data for an edge route. Such a context reads this process's runtime, so
+// what runs there is measured like the rest of the server.
+const virtualMachine = Module._load("node:vm", undefined, false);
+const createContext = virtualMachine.createContext;
+virtualMachine.createContext = function createContextWithRuntime(...parameters) {
+    const context = Reflect.apply(createContext, this, parameters);
+    if (parameters[1]?.name === "Edge Runtime") {
+        try {
+            Object.defineProperty(context, "__SUPERCOV_DIRECT_RUNTIME__", {
+                configurable: true,
+                enumerable: false,
+                get: () => globalThis.__SUPERCOV_DIRECT_RUNTIME__ ?? process.__SUPERCOV_DIRECT_RUNTIME__,
+                set(value) {
+                    Object.defineProperty(context, "__SUPERCOV_DIRECT_RUNTIME__", {
+                        configurable: true, enumerable: false, writable: true, value,
+                    });
+                },
+            });
+        }
+        catch { }
+    }
+    return context;
+};
 // Workers are independent Node processes and an explicit `execArgv: []`
 // otherwise strips the preload that supplies the isolated runtime. Preserve
 // every user option while adding exactly one Supercov import.
@@ -196,6 +224,32 @@ else if (/\/node_modules\/next\/dist\/compiled\/jest-worker\/processChild\.js$/.
         return Reflect.apply(compile, this, [content, filename, ...rest]);
     };
 }
+// Next.js looks for lockfiles from its directory upwards, takes the outermost
+// as its workspace root, and warns when it finds more than one. The copy
+// holds the project's lockfile and lies inside the project, so every build
+// under Supercov warned twice that the root "may not be correct", naming the
+// copy's lockfile. The root Next picks is the project, which is right: it
+// holds the copy and the dependencies. The copy's lockfile is left out of
+// what the warning counts, and one the project really has twice still warns.
+if (/\/node_modules\/(?:\.bin\/next$|next\/dist\/)/.test(entrypoint)) {
+    const copy = fileURLToPath(new URL("../../", import.meta.url));
+    const copies = [...new Set([copy, (() => {
+                try {
+                    return realpathSync(copy);
+                }
+                catch {
+                    return copy;
+                }
+            })()])];
+    const declared = "function warnDuplicatedLockFiles(lockFiles) {";
+    const compile = Module.prototype._compile;
+    Module.prototype._compile = function _compile(content, filename, ...rest) {
+        if (typeof content === "string" && /[\\/]next[\\/]dist[\\/]lib[\\/]find-root\.js$/.test(filename)) {
+            content = content.replace(declared, `${declared} lockFiles = lockFiles.filter((file, index) => index === lockFiles.length - 1 || !${JSON.stringify(copies)}.some((copy) => file.startsWith(copy)));`);
+        }
+        return Reflect.apply(compile, this, [content, filename, ...rest]);
+    };
+}
 function installAuthoredSourceView() {
     let authored;
     try {
@@ -205,6 +259,8 @@ function installAuthoredSourceView() {
         authored = new Set();
     }
     const authoredRoot = fileURLToPath(new URL("./.authored/", import.meta.url));
+    // What a tool of the command wrote to a rewritten file: `--fix`, `--write`.
+    const changedRoot = fileURLToPath(new URL("./.changed/", import.meta.url));
     const workspace = fileURLToPath(new URL("../../", import.meta.url));
     const roots = [...new Set([workspace, (() => {
                 try {
@@ -231,9 +287,28 @@ function installAuthoredSourceView() {
         }
         return undefined;
     };
+    const { existsSync: exists, mkdirSync: makeDirectory } = fs;
+    // A rewritten file reads as the command has it now: what one of its
+    // tools made of it, or what its author wrote.
     const authoredPath = (path) => {
         const local = inside(path);
-        return local !== undefined && authored.has(local) ? resolve(authoredRoot, local) : path;
+        if (local === undefined || !authored.has(local))
+            return path;
+        const changed = resolve(changedRoot, local);
+        return exists(changed) ? changed : resolve(authoredRoot, local);
+    };
+    // And it is written beside the instrumented copy, never over it. Prettier
+    // with `--write` and ESLint with `--fix` replaced the copy with the
+    // source they had read: the file then ran unmeasured, and one whose tests
+    // passed read 0% covered. Supercov gives the project the change when the
+    // command ends.
+    const changedPath = (path) => {
+        const local = inside(path);
+        if (local === undefined || !authored.has(local))
+            return path;
+        const changed = resolve(changedRoot, local);
+        makeDirectory(dirname(changed), { recursive: true });
+        return changed;
     };
     // A recursive listing names nested entries by relative path, or as
     // entries whose parent is inside .supercov.
@@ -250,7 +325,17 @@ function installAuthoredSourceView() {
         ? entries
         : entries.filter((entry) => !hidden(entry));
     const { readFileSync: readSync, readFile: readCallback, readdirSync: listSync, readdir: listCallback } = fs;
-    const { readFile: readPromise, readdir: listPromise } = fs.promises;
+    const { readFile: readPromise, readdir: listPromise, writeFile: writePromise } = fs.promises;
+    const { writeFileSync: writeSync, writeFile: writeCallback } = fs;
+    fs.writeFileSync = function writeFileSync(path, ...rest) {
+        return Reflect.apply(writeSync, this, [changedPath(path), ...rest]);
+    };
+    fs.writeFile = function writeFile(path, ...rest) {
+        return Reflect.apply(writeCallback, this, [changedPath(path), ...rest]);
+    };
+    fs.promises.writeFile = function writeFile(path, ...rest) {
+        return Reflect.apply(writePromise, this, [changedPath(path), ...rest]);
+    };
     fs.readFileSync = function readFileSync(path, ...rest) {
         return Reflect.apply(readSync, this, [authoredPath(path), ...rest]);
     };

package/runtime/javascript/runtime.mjs

@@ -886,21 +886,40 @@ function finishAssertionPhase(phase, error) {
     phase.error = error instanceof Error ? error.message : String(error);
 }
 
-function cleanInstrumentationStack(error) {
+const INSTRUMENTATION_FRAME = /[\\/]\.supercov[\\/](?:node_modules[\\/])?(?:playwright|nodeTest|vitest|runtime|launchSupervisor|nodeAssert|nodeAssertStrict|nodeAssertAdapter|register|resolve-loader)\.(?:js|mjs)(?::|\))/u;
+// A lexical wrapper runs the assertion in a function of its own, so its
+// stack had two frames where the author wrote one: the function Supercov
+// added, at the assertion, and below the runtime's frames the function the
+// author wrote, at the wrapper. Vitest printed both, `:12:35` and `:12:1`.
+// They are one frame again: the author's function, where the assertion is.
+function cleanInstrumentationStack(error, lexical = false) {
   if (!error || typeof error !== "object" || typeof error.stack !== "string")
     return error;
   const lines = error.stack.split("\n");
-  const visible = lines.filter((line, index) => index === 0 || !/[\\/]\.supercov[\\/](?:node_modules[\\/])?(?:playwright|nodeTest|vitest|runtime|launchSupervisor|nodeAssert|nodeAssertStrict|nodeAssertAdapter|register|resolve-loader)\.(?:js|mjs)(?::|\))/u.test(line));
-  if (visible.length !== lines.length) {
-    try {
-      error.stack = visible.join("\n");
-    } catch (e) {
-    }
+  const hidden = lines.map((line, index) => index > 0 && INSTRUMENTATION_FRAME.test(line));
+  const first = hidden.indexOf(true);
+  if (first < 0)
+    return error;
+  const last = hidden.lastIndexOf(true);
+  let visible;
+  const frame = /^(\s*at (?:async )?)(?:(.*?) \()?(.*?:\d+:\d+)\)?$/;
+  const added = lexical && first > 1 ? frame.exec(lines[first - 1]) : null;
+  const written = added && last + 1 < lines.length ? frame.exec(lines[last + 1]) : null;
+  if (added && written && added[2] === void 0 && !/^node:/.test(written[3])) {
+    const merged = written[2] === void 0 ? lines[first - 1] : `${written[1]}${written[2]} (${added[3]})`;
+    visible = [...lines.slice(0, first - 1), merged, ...lines.slice(last + 2)];
+  } else {
+    visible = lines.filter((line, index) => !hidden[index]);
+  }
+  try {
+    error.stack = visible.join("\n");
+  } catch (e) {
   }
   return error;
 }
 function withNodeAssertionPhase(operation, source, callback) {
   var _a8;
+  const lexical = typeof source === "string";
   const context = currentRequestContext();
   const scope = context.scope;
   if (!scope)
@@ -944,13 +963,13 @@ function withNodeAssertionPhase(operation, source, callback) {
         return value;
       }, (error) => {
         finishAssertionPhase(phase, error);
-        throw cleanInstrumentationStack(error);
+        throw cleanInstrumentationStack(error, lexical);
       });
     finishAssertionPhase(phase);
     return result;
   } catch (error) {
     finishAssertionPhase(phase, error);
-    throw cleanInstrumentationStack(error);
+    throw cleanInstrumentationStack(error, lexical);
   }
 }
 // Callee binding preserves receiver, getter/evaluation order, spreads and the

package/runtime/javascript/vitestReporter.mjs

@@ -1,7 +1,112 @@
-import { relative, resolve, sep } from "node:path";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inferTestProvenance } from "./provenance.mjs";
 import { appendEvidenceRecord } from "./atomic.mjs";
+// The files of the copy Supercov rewrote, by path inside it, and where each
+// is kept as its author wrote it or as a tool of the command changed it.
+const copyRoots = (() => {
+    const copy = fileURLToPath(new URL("../../", import.meta.url));
+    try {
+        return [...new Set([copy, fs.realpathSync(copy)])];
+    }
+    catch {
+        return [copy];
+    }
+})();
+let rewritten;
+function rewrittenFile(path) {
+    if (rewritten === undefined) {
+        try {
+            rewritten = new Set(JSON.parse(fs.readFileSync(new URL("./authored-sources.json", import.meta.url), "utf8")));
+        }
+        catch {
+            rewritten = new Set();
+        }
+    }
+    if (typeof path !== "string" || !isAbsolute(path))
+        return undefined;
+    for (const root of copyRoots) {
+        const local = relative(root, path);
+        if (local !== ".." && !local.startsWith(`..${sep}`) && !isAbsolute(local)) {
+            const file = local.split(sep).join("/");
+            return rewritten.has(file) ? file : undefined;
+        }
+    }
+    return undefined;
+}
+const SOURCE_MAP = "\n//# sourceMappingURL=data:application/json;base64,";
+/**
+ * A rewritten file's source map names the project's own file, by absolute
+ * path, so a Node stack trace reads as the project's. Vitest prints a frame
+ * relative to its root, which is the copy: `../../../../lib/crypto.ts:3:11`
+ * where it prints `lib/crypto.ts:3:11` without Supercov, and a file outside
+ * its module graph gets no code under the frame. Vite is handed the same
+ * code with a map that names the file itself.
+ */
+export function supercovSourceMaps() {
+    const { readFile } = fs.promises;
+    return {
+        name: "supercov:source-maps",
+        enforce: "pre",
+        async load(id) {
+            if (rewrittenFile(id) === undefined)
+                return null;
+            try {
+                const code = await readFile(id, "utf8");
+                const found = code.lastIndexOf(SOURCE_MAP);
+                if (found < 0)
+                    return null;
+                const encoded = code.slice(found + SOURCE_MAP.length).trim();
+                if (/\s/.test(encoded))
+                    return null;
+                const map = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+                map.sources = [basename(id)];
+                return { code: code.slice(0, found + 1), map };
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+// Vitest reads a file a failure names: to print the code around the nearest
+// frame, and (Vitest 4) to look for a source map in it. In the copy that is
+// the rewritten file. An assertion wrapped into one long line printed no code
+// at all, any other line printed Supercov's, and positions that were already
+// the author's were mapped a second time through the file's own map: a test
+// file's frame at `:12:35` read `:12:0`. What Vitest itself reads is the text
+// the file was rewritten from. What runs is not read here: Vite loads it.
+let readsAuthored = false;
+function readAuthoredFromVitest() {
+    if (readsAuthored)
+        return;
+    readsAuthored = true;
+    const { readFileSync, existsSync } = fs;
+    const kept = (name, file) => fileURLToPath(new URL(`./${name}/${file}`, import.meta.url));
+    const calledByVitest = () => {
+        const holder = {};
+        const limit = Error.stackTraceLimit;
+        try {
+            Error.stackTraceLimit = 1;
+            Error.captureStackTrace(holder, supercovReadFileSync);
+        }
+        finally {
+            Error.stackTraceLimit = limit;
+        }
+        return /[\\/]vitest[\\/]dist[\\/]/.test(String(holder.stack).split("\n")[1] ?? "");
+    };
+    function supercovReadFileSync(path, ...rest) {
+        const file = rewrittenFile(path);
+        if (file === undefined || !calledByVitest())
+            return Reflect.apply(readFileSync, this, [path, ...rest]);
+        const changed = kept(".changed", file);
+        return Reflect.apply(readFileSync, this, [existsSync(changed) ? changed : kept(".authored", file), ...rest]);
+    }
+    fs.readFileSync = supercovReadFileSync;
+    syncBuiltinESMExports();
+}
 function sourcePath(moduleId) {
     const absolute = moduleId.startsWith("file:")
         ? fileURLToPath(moduleId)
@@ -29,6 +134,7 @@ export default class SupercovVitestReporter {
     }
     onInit(vitest) {
         this.configureProjects?.(vitest.projects);
+        readAuthoredFromVitest();
     }
     onBrowserInit(project) {
         this.configureProjects?.([project]);