supercov 4.2.0 → 4.3.0

package/docs/assertions.md

@@ -86,6 +86,8 @@ npx supercov runs latest assertions
 Supercov renders what the test ran -- its code, its helpers, and the source it
 executed -- and asks [Jev](https://typesafe.ai) whether the test would fail for
 each statement's change. It prints an estimate first; `--dry-run` sends nothing.
+The estimate gives the first round and the most the pass can send, which is
+what it sends when no test is judged to catch anything.
 It needs a TypeSafe AI API key in `TYPESAFE_API_KEY`.
 
 `assertions` reads the saved result with no network and no key, a page at a

package/docs/cli.md

@@ -61,7 +61,8 @@ the score is arithmetic this command does over the answers. Text reports a band,
 `good`, `fair` or `weak`; `--json` carries the number and every check with what
 is known about it. `--all` includes test files, generated output and anything
 outside a source root, all of which are left out by default. `--dry-run` prints
-the exact requests and contacts nothing.
+the exact requests and contacts nothing; how many there are and what they cost
+is one line on stderr.
 
 `quality diff` reports what changed between two assessments: which files lost
 or gained health, each check that moved in them with its value before and after,
@@ -354,7 +355,17 @@ npx supercov diff <older-run> <newer-run>
 
 `diff` reports gains and losses. Use it after adding a test to prove that the
 expected behavior became covered without an unexplained regression elsewhere.
-Neither input run is changed.
+Neither input run is changed. Under the totals it lists what was lost, marked
+`-`, and then what was gained, marked `+`:
+
+```
+gained: 1 lines, 1 branches, 0 MC/DC conditions
+lost: 1 lines, 1 branches, 0 MC/DC conditions
+- line src/fee.js:5
+- branch src/fee.js:2 false
++ line src/fee.js:3
++ branch src/fee.js:2 true
+```
 
 Two runs of the same code can differ a little: what an end-to-end suite
 reaches depends on timing, on the order of tests, and on state outside the
@@ -497,6 +508,11 @@ Merge creates a new run. The inputs must describe the same source,
 configuration, toolchain, schema, and coverage denominator. Supercov rejects an
 incompatible merge rather than publishing a misleading aggregate.
 
+`assertions assess` assesses a merged run across every suite merged into it,
+reusing the answers saved when its parts were assessed. `tests affected` is
+asked of the runs that were merged, which hold the record of what each test
+ran.
+
 ## Clean local data
 
 ```sh supercov

package/docs/quality.md

@@ -153,6 +153,12 @@ Source roots come from your package manifests and from what they declare, so a
 Test files, generated output, tool scripts, examples, benchmarks and
 documentation are left out, each with its reason. `--all` includes everything.
 
+A JavaScript or TypeScript file a coverage run would measure is always read,
+by `quality` and by `security`: the App Router handler at
+`app/api/wordpress/test/route.ts` is a route, not a test, and a root named in
+`SUPERCOV_SOURCE_ROOTS` is not second-guessed by its own name. Generated and
+vendored files stay out.
+
 If some of your code sits somewhere none of that recognises, Supercov asks Jev
 about those paths with your whole tree as context, and says how many it decided
 that way. To decide yourself:

package/docs/security.md

@@ -183,6 +183,12 @@ many of its measured lines no test reached. A handler that builds a query from
 request input is one thing; the same handler that no test ever executes is a
 stronger claim, and one that needs both halves of this product to make.
 
+When the run's assertions were assessed (`runs <run> assertions assess`), the
+report also says which flagged lines a test is judged to catch a change to, and
+which flagged files tests run without catching any line of. A run that was not
+assessed says so instead: nobody asked its tests, which is not the same as
+their catching nothing.
+
 ## What a change introduced
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -119,14 +119,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.2.0",
-    "@supercov/cli-darwin-x64": "4.2.0",
-    "@supercov/cli-linux-arm64-gnu": "4.2.0",
-    "@supercov/cli-linux-arm64-musl": "4.2.0",
-    "@supercov/cli-linux-x64-gnu": "4.2.0",
-    "@supercov/cli-linux-x64-musl": "4.2.0",
-    "@supercov/cli-win32-arm64": "4.2.0",
-    "@supercov/cli-win32-x64": "4.2.0"
+    "@supercov/cli-darwin-arm64": "4.3.0",
+    "@supercov/cli-darwin-x64": "4.3.0",
+    "@supercov/cli-linux-arm64-gnu": "4.3.0",
+    "@supercov/cli-linux-arm64-musl": "4.3.0",
+    "@supercov/cli-linux-x64-gnu": "4.3.0",
+    "@supercov/cli-linux-x64-musl": "4.3.0",
+    "@supercov/cli-win32-arm64": "4.3.0",
+    "@supercov/cli-win32-x64": "4.3.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -198,6 +198,7 @@ class CoveragePhaseController {
     cdpSessions = new Map();
     newDocumentScriptIds = new Map();
     pendingRegistrations = new Set();
+    pageRegistrations = new WeakMap();
     scriptUpdate = Promise.resolve();
     proxyCache = new WeakMap();
     runtimeSnapshots;
@@ -381,8 +382,27 @@ class CoveragePhaseController {
             }
         }
     }
-    async registerPage(page) {
-        if (this.pages.has(page) || this.disposed)
+    /**
+     * A page is registered once, and whoever asks while that is under way
+     * waits for it. Playwright announces a page to the context's listener
+     * before the fixture that hands it to the test has it, so the listener
+     * started the registration and the fixture, finding the page known,
+     * returned at once: the test's first `page.goto` began before the page had
+     * the session a phase is installed through. The document it loaded did not
+     * know its phase, and its hits were left to be placed by their time.
+     */
+    registerPage(page) {
+        if (this.disposed)
+            return Promise.resolve();
+        let registration = this.pageRegistrations.get(page);
+        if (!registration) {
+            registration = this.registerNewPage(page);
+            this.pageRegistrations.set(page, registration);
+        }
+        return registration;
+    }
+    async registerNewPage(page) {
+        if (this.pages.has(page))
             return;
         timingCount("registerPage");
         this.pages.add(page);
@@ -393,8 +413,15 @@ class CoveragePhaseController {
             adopted: !this.contexts.has(context) && tracked && !headersKnown,
         });
         const cdp = await page.context().newCDPSession(page).catch(() => undefined);
-        if (cdp)
+        if (cdp) {
+            // Chromium runs a session's new-document scripts only once the
+            // session has enabled the Page domain. Without it the script that
+            // tells a document its phase was accepted and never ran: a page
+            // learned its phase only from the next action, after it had
+            // loaded, and everything it ran while loading was placed by time.
+            await cdp.send("Page.enable").catch(() => undefined);
             this.cdpSessions.set(page, cdp);
+        }
         const phaseId = this.requestPhaseId();
         if (phaseId)
             await this.activatePage(page, phaseId);