supercov 4.13.0 → 4.15.0

package/docs/agent-loop.md

@@ -122,7 +122,7 @@ The file query explained the gap:
 ```text
  LINE  STATUS        SOURCE
     2  PARTIAL       signedIn && !expired
-       Unobserved: no witness pair shows `!expired` independently changing the decision result
+       Unobserved: `!expired` was never false; needs `signedIn` true, `!expired` false, decision false
 ```
 
 Both return paths had run, but neither test checked an expired session. MC/DC

package/docs/cli.md

@@ -159,7 +159,7 @@ npx supercov runs <run-id> [query] [options]
 | `files` | See every included file, including fully covered files; `--group dir` shows coverage by directory, split by test kind |
 | `file <path>` | Inspect the open obligations in one file |
 | `decision <id \| path:line>` | Understand missing boolean outcomes and MC/DC witnesses |
-| `line <path:line>` | See one line's state, obligations, and covering tests |
+| `line <path:line>...` | See a line's state, obligations, and covering tests; several lines, or `--from-file` with one per line, in one call |
 | `test <id \| name>` | See the coverage attributed to one test |
 | `tests without-evidence` | List the tests that made assertions and recorded no coverage, which the summary counts in a warning |
 | `kinds` | Group coverage by test level, such as unit or E2E |
@@ -204,6 +204,28 @@ In `--json`, every file of `files` and `gaps` carries `totals` and `covered`
 for each metric beside what is missing, so a percentage can be worked out for
 any file or set of files.
 
+`line` reads the run once for every location it is given, so asking for
+twenty lines in one call costs about what one does. `--from-file` takes the
+locations from a file, one per line, skipping blank lines and `#` comments.
+Each line of several lists its state, its gaps and its first three covering
+tests, with `totalTests` and `totalPhases` for the rest; asked alone, a line
+lists every test and phase. In `--json` the reply is `coverage.lines`, one
+entry per location in order, each location once. Locations that do not fit one
+reply are listed in `remaining`, and `pagination.nextOffset` says where the next
+reply starts: ask again with `--offset`, as for any page.
+
+```sh supercov
+npx supercov runs latest line app/routes/checkout.ts:42 app/routes/checkout.ts:57
+npx supercov runs latest line --from-file lines.txt --json
+```
+
+An MC/DC gap names the value each missing condition never took, in `file`,
+`line` and `decision` (`` `sum < 50` was never true; needs `express` false,
+`sum < 50` true, decision true ``). In `--json` it is `missingOutcomes`:
+`["true"]` or `["false"]`, both when no test evaluated the condition, and
+none when it took both values but never decided the result alone.
+`file --group decision` lists the missing conditions under each decision.
+
 Run any query with `--help` to see only the options valid for that query:
 
 ```sh supercov
@@ -249,6 +271,10 @@ with `--min-lines`, `--min-statements`, `--min-functions`, `--min-branches` or
 eligible obligations, in addition to the whole run. Both report the counts
 behind the percentage and, for lines, where the gaps are.
 
+`--kind`, `--runner`, `--tag`, `--title` and `--test-file` hold some of the
+run's tests to a floor of their own, `--kind e2e --min-lines 60` say, from the
+same run.
+
 Floors are compared against the counts, never a rounded percentage: 9,999
 covered lines out of 10,000 displays as 99.99% and fails a 100% floor, and a
 run that displayed `100.00%` could never pass one while something is uncovered.
@@ -287,6 +313,9 @@ changed file that looks like product source but is absent from the run is named
 separately, because treating it as zero uncovered lines would report success for
 code nothing ran.
 
+`--kind`, `--runner`, `--tag`, `--title` and `--test-file` ask whether some of
+the tests reach the change: the E2E tests, or the tests of one file.
+
 `--annotate github` prints workflow-command annotations on stdout, combining
 adjacent misses into one range and capping the total (`--max-annotations`). It
 needs no token and posts no comment.
@@ -358,9 +387,10 @@ npx supercov runs latest gaps --format jsonl > gaps.jsonl
 
 Each line holds the file, the line, the source of that line and what `runs
 <id> file` says of the obligation: for an MC/DC condition its decision, the
-condition and the vectors observed. `--metric`, `--filter`, `--kind` and
-`--runner` narrow it as they narrow `gaps`, and nothing is paged, so a tool or
-an agent reads a run's every gap in one pass instead of a page at a time.
+condition and the vectors observed. `--metric`, `--filter`, `--kind`,
+`--runner`, `--tag`, `--title` and `--test-file` narrow it as they narrow
+`gaps`, and nothing is paged, so a tool or an agent reads a run's every gap in
+one pass instead of a page at a time.
 
 ```sh supercov-example
 npx supercov runs report --format lcov --output coverage/lcov.info
@@ -369,7 +399,14 @@ npx supercov runs report --format html --output coverage/report
 ```
 
 Both are written from the same view `check` and `patch` read, so a viewer,
-hosted service or CI integration sees the totals Supercov enforced. Paths are
+hosted service or CI integration sees the totals Supercov enforced. `--kind`,
+`--runner`, `--tag`, `--title` and `--test-file` write the coverage of only
+those tests, from the same run:
+
+```sh supercov-example
+npx supercov runs report --format lcov --kind e2e --output coverage/e2e.info
+```
+ Paths are
 repository-relative with forward slashes, ordering is stable, and the file is
 written atomically; an existing file is kept unless you pass `--force`. Without
 `--output` the report goes to stdout and diagnostics to stderr, so a redirect
@@ -422,12 +459,42 @@ one as a public artifact.
 | `--filter all \| passed \| failed` | Recalculate the view from all, successful, or failed attempts |
 | `--kind <kind>` | Restrict to a test level such as `unit`, `integration`, or `e2e` |
 | `--runner <runner>` | Restrict to one runner |
+| `--tag <tag>` | Restrict to tests with this tag; repeat it for tests with any of several, and start a value with `!` to leave those tests out |
+| `--title <text>` | Restrict to tests whose name contains this text |
+| `--test-file <path>` | Restrict to tests in this file, or in this directory |
 | `--metric all \| lines \| statements \| functions \| branches \| mcdc` | Choose a metric for `files`, `gaps`, `diff`, or `minimize` |
 | `--limit N`, `--offset N` | Page through a collection |
 | `--json` | Return the machine-readable form |
 
 Collection output includes a copyable command for the next page.
 
+### Read some of a run's tests
+
+`--tag`, `--title` and `--test-file` read the coverage of only the tests they
+pick, from a run already measured: the API tests of a Playwright suite, the
+tests of one spec file, everything named `checkout`. Each takes several values
+for tests matching any of them, and when several are given a test must match
+each. A value starting with `!` leaves those tests out, so the browser tests of
+a suite whose other tests are tagged read as the tests with none of the tags.
+
+```sh supercov
+npx supercov runs latest --tag @api
+npx supercov runs latest gaps --test-file tests/e2e/checkout.spec.ts
+npx supercov runs latest files --title checkout --tag smoke
+npx supercov runs latest --tag '!api' --tag '!cron' --tag '!webhook'
+```
+
+A tag is what the runner gives a test: a Playwright tag (`{ tag: '@api' }`, or
+an `@word` in the title), an `@word` in a Jest, Vitest, Mocha, `node:test`,
+AVA or tap title, a pytest marker, an RSpec tag or `type`, a Cucumber tag, a
+JUnit `@Tag` or a TestNG group. Tags are written with or without the `@` and in
+any case. `runs <id> test <name>` lists a test's tags.
+
+The first query with a filter works out its coverage from the run's evidence
+and keeps it beside the run (12 s for a run of about 3,000 tests); asking again
+reads it back in a fraction of a second. Nothing is added to the test run
+itself.
+
 For a large file, group and rank its decisions:
 
 ```sh supercov
@@ -514,6 +581,10 @@ npx supercov report --runs 10
 npx supercov report --output artifacts/supercov-report.html --no-open
 ```
 
+`--kind`, `--runner`, `--tag`, `--title` and `--test-file` make a report of
+only those tests' coverage, in every run it holds; a run with none of them is
+left out, and the report names the tests it shows.
+
 A report includes the five newest runs; `--runs N` includes up to 20. A large
 project's report can pass GitHub's 25 MB attachment limit; `--runs 1` makes
 the smallest. See [Portable HTML reports](reports.md) for

package/docs/evidence.md

@@ -37,7 +37,9 @@ later queries faster; it can rebuild that index from the run.
 
 Supercov compares a stored run with the current workspace. If relevant source,
 tests, dependencies, configuration, or toolchain inputs changed, the run is
-marked stale.
+marked stale. A query of a stale run names the files that changed since it,
+tests and source, those added since its commit included, so you can tell which
+tests are newer than the run.
 
 A stale run is still valid history. It simply should not be presented as the
 current state of the repository. Run the complete suite again before choosing
@@ -126,6 +128,11 @@ proof of what the test checks. A name such as `gatewayE2e.test.ts` identifies an
 E2E test. Ambiguous names keep the runner's default, and the report tells you
 how many tests use that default.
 
+A tag naming a level — `@unit`, `@component`, `@integration` or `@e2e` — sets
+a test's kind, ahead of its path and runner: a Playwright tag or an `@word` in
+a JavaScript test's title, a pytest marker, an RSpec tag, a Cucumber tag, a
+JUnit `@Tag` or a TestNG group. Other tags stay tags, which `--tag` selects by.
+
 If your suite has a known kind, set it when running the command:
 
 ```sh supercov-example

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.13.0",
+  "version": "4.15.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -74,7 +74,6 @@
     "test:fixture": "cargo build -p supercov && node scripts/rust-fixture-matrix.mjs",
     "test:packed-npx": "cargo build --release -p supercov && node scripts/packed-npx-integration.mjs",
     "test:isolation": "cargo build -p supercov && node scripts/isolation-integration.mjs",
-    "test:filesystem": "cargo test --workspace && cargo build -p supercov && node scripts/workspace-crash-integration.mjs",
     "test:watchdog": "cargo build -p supercov && node scripts/watchdog-integration.mjs",
     "test:html-report": "cargo build -p supercov && node scripts/html-report-integration.mjs",
     "test:engine-contract": "cargo build -p supercov && node scripts/engine-contract.mjs",
@@ -83,7 +82,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/context-headers.mjs && node scripts/context-cookies.mjs && node scripts/hidden-request-emit.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.13.0",
-    "@supercov/cli-darwin-x64": "4.13.0",
-    "@supercov/cli-linux-arm64-gnu": "4.13.0",
-    "@supercov/cli-linux-arm64-musl": "4.13.0",
-    "@supercov/cli-linux-x64-gnu": "4.13.0",
-    "@supercov/cli-linux-x64-musl": "4.13.0",
-    "@supercov/cli-win32-arm64": "4.13.0",
-    "@supercov/cli-win32-x64": "4.13.0"
+    "@supercov/cli-darwin-arm64": "4.15.0",
+    "@supercov/cli-darwin-x64": "4.15.0",
+    "@supercov/cli-linux-arm64-gnu": "4.15.0",
+    "@supercov/cli-linux-arm64-musl": "4.15.0",
+    "@supercov/cli-linux-x64-gnu": "4.15.0",
+    "@supercov/cli-linux-x64-musl": "4.15.0",
+    "@supercov/cli-win32-arm64": "4.15.0",
+    "@supercov/cli-win32-x64": "4.15.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/jest.cjs

@@ -67,14 +67,27 @@ const KINDS = [
     ["integration", /(^|[/_.-])(integration|int)([/_.-]|$)/i],
     ["e2e", /(^|[/_.-])(e2e|end-to-end|offline|online)([/_.-]|$)/i],
 ];
-function provenance(testFile) {
+// As provenance.mjs reads them: `@word` in a test's name, without the `@`.
+const TITLE_TAG = /(?:^|\s)@([\p{L}\p{N}_][\p{L}\p{N}_:./-]*)/gu;
+const KIND_TAGS = new Set(["unit", "component", "integration", "e2e"]);
+function provenance(testFile, name) {
+    const tags = [];
+    if (typeof name === "string" && name.includes("@")) {
+        for (const match of name.matchAll(TITLE_TAG))
+            if (!tags.includes(match[1]))
+                tags.push(match[1]);
+    }
+    const carried = tags.length > 0 ? { tags } : {};
     const explicit = process.env.SUPERCOV_TEST_KIND?.trim();
     if (explicit)
-        return { runner: "jest", kind: explicit.toLowerCase(), source: "explicit" };
+        return { runner: "jest", kind: explicit.toLowerCase(), source: "explicit", ...carried };
+    const tagged = tags.find((tag) => KIND_TAGS.has(tag.toLowerCase()));
+    if (tagged)
+        return { runner: "jest", kind: tagged.toLowerCase(), source: "tag", ...carried };
     const kind = KINDS.find(([, pattern]) => pattern.test(testFile))?.[0];
     return kind
-        ? { runner: "jest", kind, source: "path" }
-        : { runner: "jest", kind: "unit", source: "runner-default" };
+        ? { runner: "jest", kind, source: "path", ...carried }
+        : { runner: "jest", kind: "unit", source: "runner-default", ...carried };
 }
 // One journal per writer, as atomic.mjs's appendEvidenceRecord keeps it: a
 // file per test cost a directory, a file and a rename each. Jest gives every
@@ -185,7 +198,7 @@ if (runtime && evidenceDirectory && typeof beforeEach === "function" && typeof a
             retry: current.retry,
             // The reporter's record carries the outcome.
             status: "unknown",
-            provenance: provenance(current.testFile),
+            provenance: provenance(current.testFile, current.fullName),
             phases: runtime.takeNodeAssertionPhases(scope),
             runtime: [runtime.coverageSnapshot()],
             browser: [],

package/runtime/javascript/jestReporter.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { relative, resolve, sep } from "node:path";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { appendEvidenceRecord } from "./atomic.mjs";
 function digest(value) {
     return createHash("sha256").update(value).digest("hex").slice(0, 24);
@@ -52,6 +52,7 @@ export default class SupercovJestReporter {
             runner: "jest",
             file: testFile,
             explicitKind: process.env["SUPERCOV_TEST_KIND"],
+            tags: testTags(undefined, [result.fullName]),
         });
         const record = (attempt, attemptStatus, flaky) => {
             const payload = {

package/runtime/javascript/mocha.mjs

@@ -11,7 +11,7 @@ import { realpathSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { appendEvidenceRecord } from "./atomic.mjs";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { runnerExecutionScope } from "./runnerEvidence.mjs";
 
 const SETUP_HOOK = /^"(?:before|after) all" hook/;
@@ -156,6 +156,7 @@ function observe(runner, runtime, write) {
                 runner: "mocha",
                 file: testFile,
                 explicitKind: process.env.SUPERCOV_TEST_KIND,
+                tags: id.role ? [] : testTags(undefined, [id.name]),
             }),
             ...(scope ? { phases: runtime.takeNodeAssertionPhases(scope) } : {}),
             runtime: snapshot ? [snapshot] : [],

package/runtime/javascript/playwright.mjs

@@ -8,15 +8,15 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { createHash, randomBytes } from "node:crypto";
 import childProcess from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import http from "node:http";
 import https from "node:https";
 import { syncBuiltinESMExports } from "node:module";
-import { relative, resolve, sep } from "node:path";
+import { dirname, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import * as standardPlaywright from "@playwright/test";
 import * as coverageRuntime from "./runtime.mjs";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { appendJsonLineDurableSync, appendJsonLineSync } from "./atomic.mjs";
 import { COVERAGE_PHASE_HEADER, COVERAGE_PHASE_COOKIE, COVERAGE_PHASE_SITE_COOKIE, COVERAGE_SCOPE_COOKIE, COVERAGE_SCOPE_HEADER, COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_CARRIER_ENV, encodeCoverageCarrier, encodeCoverageScope, serverEvidenceDirectory, serverEvidencePath, } from "./transport.mjs";
 export * from "@playwright/test";
@@ -194,7 +194,6 @@ class CoveragePhaseController {
     pages = new Set();
     workers = new Set();
     contexts = new Set();
-    contextConfiguredHeaders = new Map();
     cdpSessions = new Map();
     newDocumentScriptIds = new Map();
     pendingRegistrations = new Set();
@@ -387,7 +386,7 @@ class CoveragePhaseController {
         for (const context of liveTrackedContexts()) {
             if (!this.contexts.has(context)) {
                 const headersKnown = trackedContextConfiguredHeaders.has(context);
-                await this.registerContext(context, trackedContextConfiguredHeaders.get(context) ?? this.configuredHeaders, { adopted: !headersKnown }).catch(() => undefined);
+                await this.registerContext(context, { adopted: !headersKnown }).catch(() => undefined);
             }
         }
     }
@@ -454,7 +453,7 @@ class CoveragePhaseController {
         const context = page.context();
         const tracked = liveTrackedContexts().has(context);
         const headersKnown = trackedContextConfiguredHeaders.has(context);
-        await this.registerContext(context, trackedContextConfiguredHeaders.get(context) ?? this.configuredHeaders, {
+        await this.registerContext(context, {
             adopted: !this.contexts.has(context) && tracked && !headersKnown,
         });
         const cdp = await page.context().newCDPSession(page).catch(() => undefined);
@@ -490,11 +489,11 @@ class CoveragePhaseController {
         for (const worker of page.workers())
             void this.registerWorker(worker);
     }
-    async registerContext(context, configuredHeaders = this.configuredHeaders, { adopted = false } = {}) {
+    async registerContext(context, { adopted = false } = {}) {
         if (this.contexts.has(context) || this.disposed)
             return;
         this.contexts.add(context);
-        this.contextConfiguredHeaders.set(context, configuredHeaders);
+        patchContextPrototype(context);
         if (adopted)
             this.adoptedContexts.add(context);
         await context.addInitScript({ content: browserRuntimePrelude }).catch(() => undefined);
@@ -646,14 +645,6 @@ class CoveragePhaseController {
         this.disposed = true;
         await Promise.all([...this.pendingRegistrations]);
         await this.scriptUpdate;
-        // A worker-scoped context survives this test. Remove its test scope
-        // while preserving the exact headers supplied by the suite so work
-        // between tests cannot be charged to the attempt that just ended.
-        await Promise.all([...this.contexts]
-            .filter((context) => !this.adoptedContexts.has(context))
-            .map((context) => context
-            .setExtraHTTPHeaders(this.contextConfiguredHeaders.get(context) ?? {})
-            .catch(() => undefined)));
         for (const [context, listeners] of this.contextListeners) {
             for (const [event, listener] of listeners)
                 context.off?.(event, listener);
@@ -773,7 +764,7 @@ class CoveragePhaseController {
             const configuredHeaders = sourceArgs?.[0]
                 ?.extraHTTPHeaders ?? this.configuredHeaders;
             trackContext(result, configuredHeaders);
-            await this.registerContext(result, configuredHeaders);
+            await this.registerContext(result);
         }
         if (typeof candidate["frames"] === "function" &&
             typeof candidate["context"] === "function")
@@ -896,11 +887,10 @@ class CoveragePhaseController {
             [scopeName, scope],
             ...(phase ? [[phaseName, phase]] : []),
         ];
+        // The context's own headers are left alone: they are the suite's, and
+        // a test that sets more with `setExtraHTTPHeaders` keeps them. Setting
+        // them back at every phase dropped a test's `X-Forwarded-For`.
         await Promise.all([
-            // The context's own headers are the owner's, unchanged.
-            context
-                .setExtraHTTPHeaders(this.contextConfiguredHeaders.get(context) ?? this.configuredHeaders)
-                .catch(() => undefined),
             ...this.appHosts.map((url) => {
                 const host = new URL(url);
                 // For the app's own site: requests, navigations and sockets.
@@ -1078,7 +1068,7 @@ function patchBrowserPrototype(browser) {
         trackContext(context, configuredHeaders);
         const controller = activeController;
         if (controller && !controller.contexts.has(context))
-            await controller.registerContext(context, configuredHeaders).catch(() => undefined);
+            await controller.registerContext(context).catch(() => undefined);
         return context;
     });
 }
@@ -1088,7 +1078,29 @@ function patchBrowserPrototype(browser) {
  * a customer context opened mid-test is usually closed in a `finally`; either
  * way the page is gone by the time the test's snapshots are collected.
  */
+/** The cookies Supercov gives a context to carry the test's scope. */
+const OWN_COOKIES = new Set([COVERAGE_SCOPE_COOKIE, COVERAGE_PHASE_COOKIE, COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_PHASE_SITE_COOKIE]);
+const suiteCookies = (cookies) => (Array.isArray(cookies) ? cookies.filter((cookie) => !OWN_COOKIES.has(cookie?.name)) : cookies);
 function patchContextPrototype(context) {
+    // A test reads and saves the cookies it and its app set, never
+    // Supercov's: an assertion on `cookies()` failed only under measurement,
+    // and `storageState({ path })` wrote the scope into the suite's saved
+    // login. A `clearCookies()` takes the scope too, and the test's next
+    // action puts it back, as every action does.
+    patchOnce(context, "cookies", (original) => async function (...args) {
+        return suiteCookies(await original.apply(this, args));
+    });
+    patchOnce(context, "storageState", (original) => async function (options, ...rest) {
+        const { path, ...others } = options && typeof options === "object" ? options : {};
+        const state = await original.call(this, others, ...rest);
+        const own = state && typeof state === "object" ? { ...state, cookies: suiteCookies(state.cookies) } : state;
+        if (path) {
+            // As Playwright writes it.
+            mkdirSync(dirname(resolve(path)), { recursive: true });
+            writeFileSync(path, JSON.stringify(own, undefined, 2));
+        }
+        return own;
+    });
     patchOnce(context, "close", (original) => async function (...args) {
         for (const page of this.pages()) {
             await controllerOwning(page)?.snapshotBeforeClose(page).catch(() => undefined);
@@ -1128,7 +1140,7 @@ function installBrowserLaunchTracking() {
         trackContext(context, configuredHeaders);
         const controller = activeController;
         if (controller)
-            await controller.registerContext(context, configuredHeaders).catch(() => undefined);
+            await controller.registerContext(context).catch(() => undefined);
         return context;
     });
 }
@@ -1603,6 +1615,7 @@ const instrumentedFixtures = {
                             file: testFile,
                             project: testInfo.project.name,
                             explicitKind: process.env["SUPERCOV_TEST_KIND"],
+                            tags: testTags(testInfo.tags, testInfo.titlePath),
                         }),
                         phases: mergeCollectedPhases(controller.phases, directRuntime()?.takeNodeAssertionPhases(scope) ?? []),
                         ...(controller.workerEvidenceMissing ? { attribution: "partial" } : {}),

package/runtime/javascript/playwrightReporter.mjs

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { appendJsonLineDurableSync, appendJsonLineSync } from "./atomic.mjs";
 const GENERATED_EVIDENCE_DIRECTORY = "__SUPERCOV_EVIDENCE_DIRECTORY__";
 const evidenceWriterIdentity = () => (process.env.SUPERCOV_EXECUTION_LOG_SHARD ?? `pid-${process.pid}`)
@@ -94,6 +94,7 @@ export default class SupercovPlaywrightReporter {
                 file: testFile,
                 project: test.parent.project()?.name,
                 explicitKind: process.env["SUPERCOV_TEST_KIND"],
+                tags: testTags(test.tags, test.titlePath()),
             }),
             browser: [],
             server: [],

package/runtime/javascript/provenance.mjs

@@ -49,7 +49,46 @@ function basenameKind(file) {
         return undefined;
     return segmentKind(file.split(/[/\\]/).pop());
 }
-export function inferTestProvenance({ runner, file, project, explicitKind, }) {
+// A tag naming a test level says what the test is, as an explicit kind does.
+const KIND_TAGS = new Set(["unit", "component", "integration", "e2e"]);
+// `@word` in a title is a tag, as Playwright reads one: `checkout @e2e`.
+const TITLE_TAG = /(?:^|\s)@([\p{L}\p{N}_][\p{L}\p{N}_:./-]*)/gu;
+// The tags a test carries: those its runner names, then any `@word` in its
+// titles, without the `@`, each once. Only text the runner already handed
+// over is read, so a run costs what it did.
+export function testTags(named, titles) {
+    const tags = [];
+    const add = (value) => {
+        const tag = String(value).trim().replace(/^@/, "");
+        if (tag && !tags.includes(tag))
+            tags.push(tag);
+    };
+    for (const tag of Array.isArray(named) ? named : [])
+        add(tag);
+    for (const title of Array.isArray(titles) ? titles : []) {
+        if (typeof title !== "string" || !title.includes("@"))
+            continue;
+        for (const match of title.matchAll(TITLE_TAG))
+            add(match[1]);
+    }
+    return tags;
+}
+export function inferTestProvenance({ runner, file, project, explicitKind, tags, }) {
+    const carried = tags ?? [];
+    const kindTag = explicitKind?.trim()
+        ? undefined
+        : carried.find((tag) => KIND_TAGS.has(tag.toLowerCase()));
+    const provenance = kindTag
+        ? {
+            runner,
+            kind: kindTag.toLowerCase(),
+            ...(project ? { project } : {}),
+            source: "tag",
+        }
+        : inferredProvenance({ runner, file, project, explicitKind });
+    return carried.length > 0 ? { ...provenance, tags: carried } : provenance;
+}
+function inferredProvenance({ runner, file, project, explicitKind, }) {
     if (explicitKind?.trim()) {
         return {
             runner,

package/runtime/javascript/runnerEvidence.mjs

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { appendEvidenceRecord } from "./atomic.mjs";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { serverEvidencePath } from "./transport.mjs";
 
 let cachedProcessInstanceToken;
@@ -123,6 +123,7 @@ export function writeRunnerEvidence(identity, status, scope, evidenceDirectoryOv
             runner: identity.runner,
             file: testFile,
             explicitKind: process.env["SUPERCOV_TEST_KIND"],
+            tags: identity.role ? [] : testTags(identity.tags, [identity.name]),
         }),
         ...(phases.length > 0 ? { phases } : {}),
         runtime: [],

package/runtime/javascript/runtime.mjs

@@ -1491,30 +1491,55 @@ function installNodeRequestPropagation() {
   const SecureServer = https && https.Server;
   if (!EventEmitter) return;
   const original = EventEmitter.prototype.emit;
+  // The test a request is for, worked out once, from whichever sees it first.
+  const requestContexts = new WeakMap();
+  const owningRequest = (server, request, response) => {
+    if (requestContexts.has(request))
+      return requestContexts.get(request);
+    let context = emitterCoverageContexts.get(server);
+    // HTTP headers establish ownership even when Express/SDK listeners and
+    // the server process were created by a shared before hook.
+    const incoming = requestCoverageContext(request);
+    noteSupport(incoming && incoming.scope);
+    if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
+    if (incoming && incoming.scope)
+      noteServedAttempt(incoming.scope);
+    // A request that names no test, to a server no test owns, is numbered:
+    // the report credits its work to the test running when it came.
+    if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
+      context = { request: nextUnscopedRequest() };
+    // Node emits a request's body and its response's events outside the
+    // handler's context, so a handler that reads the body -- `req.on('end')`
+    // -- ran as no test's. The request and response carry it with them.
+    if (incoming && context) {
+      for (const emitter of [request, response]) {
+        if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
+          emitterCoverageContexts.set(emitter, context);
+      }
+    }
+    if (request && typeof request === "object")
+      requestContexts.set(request, incoming ? context : void 0);
+    return incoming ? context : void 0;
+  };
+  // Node publishes every request here before it emits it. An `emit` of the
+  // server's own, defined before this patch by a preload that called the
+  // emit it found, hid every request from the patch below, and what ran on
+  // the request's events -- a page rendered as the response went out --
+  // was credited to no test. Nothing hides this channel.
+  try {
+    const channels = builtin("node:diagnostics_channel");
+    if (channels && typeof channels.subscribe === "function")
+      channels.subscribe("http.server.request.start", (message) => {
+        if (message && message.request)
+          owningRequest(message.server, message.request, message.response);
+      });
+  } catch {}
   EventEmitter.prototype.emit = function(event, ...args) {
     let context = emitterCoverageContexts.get(this);
     if ((event === "request" || event === "upgrade") &&
         ((Server && this instanceof Server) || (SecureServer && this instanceof SecureServer))) {
-      // HTTP headers establish ownership even when Express/SDK listeners and
-      // the server process were created by a shared before hook.
-      const incoming = requestCoverageContext(args[0]);
-      noteSupport(incoming && incoming.scope);
-      if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
-      if (incoming && incoming.scope)
-        noteServedAttempt(incoming.scope);
-      // A request that names no test, to a server no test owns, is numbered:
-      // the report credits its work to the test running when it came.
-      if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
-        context = { request: nextUnscopedRequest() };
-      // Node emits a request's body and its response's events outside the
-      // handler's context, so a handler that reads the body -- `req.on('end')`
-      // -- ran as no test's. The request and response carry it with them.
-      if (incoming && context) {
-        for (const emitter of args.slice(0, 2)) {
-          if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
-            emitterCoverageContexts.set(emitter, context);
-        }
-      }
+      const owner = owningRequest(this, args[0], args[1]);
+      if (owner) context = owner;
     }
     const invoke = () => Reflect.apply(original, this, [event, ...args]);
     try {

package/runtime/javascript/vitest.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { relative, resolve, sep } from "node:path";
 import { afterEach, beforeEach } from "vitest";
 import { coverageSnapshot as localCoverageSnapshot, activateCoverageScope as localActivateCoverageScope, enableRuntimeSnapshotEvidence as localEnableRuntimeSnapshotEvidence, resetCoverage as localResetCoverage, takeNodeAssertionPhases as localTakeNodeAssertionPhases, } from "./runtime.mjs";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { appendEvidenceRecord } from "./atomic.mjs";
 const evidenceDirectory = process.env["SUPERCOV_EVIDENCE_DIR"];
 const emittedSetupFiles = new Set();
@@ -109,6 +109,7 @@ afterEach((context) => {
             file: testFile,
             project: task.file.projectName,
             explicitKind: process.env["SUPERCOV_TEST_KIND"],
+            tags: testTags(task.tags, [...titlePath(task)]),
         }),
         ...(scope ? { phases: runtime.takeNodeAssertionPhases(scope) } : {}),
         runtime: [runtime.coverageSnapshot()],

package/runtime/javascript/vitestReporter.mjs

@@ -1,6 +1,6 @@
 import { relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { inferTestProvenance } from "./provenance.mjs";
+import { inferTestProvenance, testTags } from "./provenance.mjs";
 import { appendEvidenceRecord } from "./atomic.mjs";
 function sourcePath(moduleId) {
     const absolute = moduleId.startsWith("file:")
@@ -59,6 +59,7 @@ export default class SupercovVitestReporter {
                 file: testFile,
                 project: testCase.project.name,
                 explicitKind: process.env["SUPERCOV_TEST_KIND"],
+                tags: testTags(testCase.tags ?? testCase.options?.tags, [testCase.fullName]),
             }),
             runtime: [],
             browser: [],
@@ -104,6 +105,7 @@ export default class SupercovVitestReporter {
                         file: testFile,
                         project: file.projectName,
                         explicitKind: process.env["SUPERCOV_TEST_KIND"],
+                        tags: testTags(task.tags, names),
                     }),
                     runtime: [],
                     browser: [],