supercov 4.14.0 → 4.15.0

package/docs/cli.md

@@ -210,8 +210,9 @@ locations from a file, one per line, skipping blank lines and `#` comments.
 Each line of several lists its state, its gaps and its first three covering
 tests, with `totalTests` and `totalPhases` for the rest; asked alone, a line
 lists every test and phase. In `--json` the reply is `coverage.lines`, one
-entry per location in order; any that do not fit one reply are listed in
-`remaining`, to ask for next.
+entry per location in order, each location once. Locations that do not fit one
+reply are listed in `remaining`, and `pagination.nextOffset` says where the next
+reply starts: ask again with `--offset`, as for any page.
 
 ```sh supercov
 npx supercov runs latest line app/routes/checkout.ts:42 app/routes/checkout.ts:57
@@ -458,7 +459,7 @@ one as a public artifact.
 | `--filter all \| passed \| failed` | Recalculate the view from all, successful, or failed attempts |
 | `--kind <kind>` | Restrict to a test level such as `unit`, `integration`, or `e2e` |
 | `--runner <runner>` | Restrict to one runner |
-| `--tag <tag>` | Restrict to tests with this tag; repeat it for tests with any of several |
+| `--tag <tag>` | Restrict to tests with this tag; repeat it for tests with any of several, and start a value with `!` to leave those tests out |
 | `--title <text>` | Restrict to tests whose name contains this text |
 | `--test-file <path>` | Restrict to tests in this file, or in this directory |
 | `--metric all \| lines \| statements \| functions \| branches \| mcdc` | Choose a metric for `files`, `gaps`, `diff`, or `minimize` |
@@ -473,12 +474,14 @@ Collection output includes a copyable command for the next page.
 pick, from a run already measured: the API tests of a Playwright suite, the
 tests of one spec file, everything named `checkout`. Each takes several values
 for tests matching any of them, and when several are given a test must match
-each.
+each. A value starting with `!` leaves those tests out, so the browser tests of
+a suite whose other tests are tagged read as the tests with none of the tags.
 
 ```sh supercov
 npx supercov runs latest --tag @api
 npx supercov runs latest gaps --test-file tests/e2e/checkout.spec.ts
 npx supercov runs latest files --title checkout --tag smoke
+npx supercov runs latest --tag '!api' --tag '!cron' --tag '!webhook'
 ```
 
 A tag is what the runner gives a test: a Playwright tag (`{ tag: '@api' }`, or
@@ -488,8 +491,9 @@ JUnit `@Tag` or a TestNG group. Tags are written with or without the `@` and in
 any case. `runs <id> test <name>` lists a test's tags.
 
 The first query with a filter works out its coverage from the run's evidence
-and keeps it beside the run (about half a minute for a 1,100-test run); asking
-again reads it back. Nothing is added to the test run itself.
+and keeps it beside the run (12 s for a run of about 3,000 tests); asking again
+reads it back in a fraction of a second. Nothing is added to the test run
+itself.
 
 For a large file, group and rank its decisions:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.14.0",
+  "version": "4.15.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -82,7 +82,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/context-headers.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/mock-reach.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/shared-page.mjs && node scripts/context-headers.mjs && node scripts/context-cookies.mjs && node scripts/hidden-request-emit.mjs && node scripts/js-syntax-zoo.mjs && node scripts/ruby-syntax-zoo.mjs && node scripts/rust-syntax-zoo.mjs && node scripts/python-syntax-zoo.mjs && node scripts/go-syntax-zoo.mjs && node scripts/java-syntax-zoo.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -119,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.14.0",
-    "@supercov/cli-darwin-x64": "4.14.0",
-    "@supercov/cli-linux-arm64-gnu": "4.14.0",
-    "@supercov/cli-linux-arm64-musl": "4.14.0",
-    "@supercov/cli-linux-x64-gnu": "4.14.0",
-    "@supercov/cli-linux-x64-musl": "4.14.0",
-    "@supercov/cli-win32-arm64": "4.14.0",
-    "@supercov/cli-win32-x64": "4.14.0"
+    "@supercov/cli-darwin-arm64": "4.15.0",
+    "@supercov/cli-darwin-x64": "4.15.0",
+    "@supercov/cli-linux-arm64-gnu": "4.15.0",
+    "@supercov/cli-linux-arm64-musl": "4.15.0",
+    "@supercov/cli-linux-x64-gnu": "4.15.0",
+    "@supercov/cli-linux-x64-musl": "4.15.0",
+    "@supercov/cli-win32-arm64": "4.15.0",
+    "@supercov/cli-win32-x64": "4.15.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -8,11 +8,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { createHash, randomBytes } from "node:crypto";
 import childProcess from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import http from "node:http";
 import https from "node:https";
 import { syncBuiltinESMExports } from "node:module";
-import { relative, resolve, sep } from "node:path";
+import { dirname, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import * as standardPlaywright from "@playwright/test";
 import * as coverageRuntime from "./runtime.mjs";
@@ -493,6 +493,7 @@ class CoveragePhaseController {
         if (this.contexts.has(context) || this.disposed)
             return;
         this.contexts.add(context);
+        patchContextPrototype(context);
         if (adopted)
             this.adoptedContexts.add(context);
         await context.addInitScript({ content: browserRuntimePrelude }).catch(() => undefined);
@@ -1077,7 +1078,29 @@ function patchBrowserPrototype(browser) {
  * a customer context opened mid-test is usually closed in a `finally`; either
  * way the page is gone by the time the test's snapshots are collected.
  */
+/** The cookies Supercov gives a context to carry the test's scope. */
+const OWN_COOKIES = new Set([COVERAGE_SCOPE_COOKIE, COVERAGE_PHASE_COOKIE, COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_PHASE_SITE_COOKIE]);
+const suiteCookies = (cookies) => (Array.isArray(cookies) ? cookies.filter((cookie) => !OWN_COOKIES.has(cookie?.name)) : cookies);
 function patchContextPrototype(context) {
+    // A test reads and saves the cookies it and its app set, never
+    // Supercov's: an assertion on `cookies()` failed only under measurement,
+    // and `storageState({ path })` wrote the scope into the suite's saved
+    // login. A `clearCookies()` takes the scope too, and the test's next
+    // action puts it back, as every action does.
+    patchOnce(context, "cookies", (original) => async function (...args) {
+        return suiteCookies(await original.apply(this, args));
+    });
+    patchOnce(context, "storageState", (original) => async function (options, ...rest) {
+        const { path, ...others } = options && typeof options === "object" ? options : {};
+        const state = await original.call(this, others, ...rest);
+        const own = state && typeof state === "object" ? { ...state, cookies: suiteCookies(state.cookies) } : state;
+        if (path) {
+            // As Playwright writes it.
+            mkdirSync(dirname(resolve(path)), { recursive: true });
+            writeFileSync(path, JSON.stringify(own, undefined, 2));
+        }
+        return own;
+    });
     patchOnce(context, "close", (original) => async function (...args) {
         for (const page of this.pages()) {
             await controllerOwning(page)?.snapshotBeforeClose(page).catch(() => undefined);

package/runtime/javascript/runtime.mjs

@@ -1491,30 +1491,55 @@ function installNodeRequestPropagation() {
   const SecureServer = https && https.Server;
   if (!EventEmitter) return;
   const original = EventEmitter.prototype.emit;
+  // The test a request is for, worked out once, from whichever sees it first.
+  const requestContexts = new WeakMap();
+  const owningRequest = (server, request, response) => {
+    if (requestContexts.has(request))
+      return requestContexts.get(request);
+    let context = emitterCoverageContexts.get(server);
+    // HTTP headers establish ownership even when Express/SDK listeners and
+    // the server process were created by a shared before hook.
+    const incoming = requestCoverageContext(request);
+    noteSupport(incoming && incoming.scope);
+    if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
+    if (incoming && incoming.scope)
+      noteServedAttempt(incoming.scope);
+    // A request that names no test, to a server no test owns, is numbered:
+    // the report credits its work to the test running when it came.
+    if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
+      context = { request: nextUnscopedRequest() };
+    // Node emits a request's body and its response's events outside the
+    // handler's context, so a handler that reads the body -- `req.on('end')`
+    // -- ran as no test's. The request and response carry it with them.
+    if (incoming && context) {
+      for (const emitter of [request, response]) {
+        if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
+          emitterCoverageContexts.set(emitter, context);
+      }
+    }
+    if (request && typeof request === "object")
+      requestContexts.set(request, incoming ? context : void 0);
+    return incoming ? context : void 0;
+  };
+  // Node publishes every request here before it emits it. An `emit` of the
+  // server's own, defined before this patch by a preload that called the
+  // emit it found, hid every request from the patch below, and what ran on
+  // the request's events -- a page rendered as the response went out --
+  // was credited to no test. Nothing hides this channel.
+  try {
+    const channels = builtin("node:diagnostics_channel");
+    if (channels && typeof channels.subscribe === "function")
+      channels.subscribe("http.server.request.start", (message) => {
+        if (message && message.request)
+          owningRequest(message.server, message.request, message.response);
+      });
+  } catch {}
   EventEmitter.prototype.emit = function(event, ...args) {
     let context = emitterCoverageContexts.get(this);
     if ((event === "request" || event === "upgrade") &&
         ((Server && this instanceof Server) || (SecureServer && this instanceof SecureServer))) {
-      // HTTP headers establish ownership even when Express/SDK listeners and
-      // the server process were created by a shared before hook.
-      const incoming = requestCoverageContext(args[0]);
-      noteSupport(incoming && incoming.scope);
-      if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
-      if (incoming && incoming.scope)
-        noteServedAttempt(incoming.scope);
-      // A request that names no test, to a server no test owns, is numbered:
-      // the report credits its work to the test running when it came.
-      if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
-        context = { request: nextUnscopedRequest() };
-      // Node emits a request's body and its response's events outside the
-      // handler's context, so a handler that reads the body -- `req.on('end')`
-      // -- ran as no test's. The request and response carry it with them.
-      if (incoming && context) {
-        for (const emitter of args.slice(0, 2)) {
-          if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
-            emitterCoverageContexts.set(emitter, context);
-        }
-      }
+      const owner = owningRequest(this, args[0], args[1]);
+      if (owner) context = owner;
     }
     const invoke = () => Reflect.apply(original, this, [event, ...args]);
     try {