supercov 4.24.0 → 4.24.2

package/docs/supported-suites.md

@@ -715,8 +715,11 @@ image, as `.:/workspace` in a compose file does: Supercov runs the command
 in the copy, so the mount is of the copy. It gets the run's settings with
 each path into the copy moved to where the container sees it, and the
 project's `node_modules`, which the copy's packages link to, mounted
-read-only at its own path. A mount of one directory of the project
-(`./src:/app/src`) is not the copy, and is left alone.
+read-only at its own path. The copy's `.supercov`, where the run's evidence
+is written, is mounted writable where the container sees it, so a copy
+mounted read-only (`.:/workspace:ro`) is measured as well. A mount of one
+directory of the project (`./src:/app/src`) is not the copy, and is left
+alone.
 
 The tests can run in such a container too. A command `docker exec` (or
 `docker compose exec`) starts in it, `npx playwright test` say, gets the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.24.0",
+  "version": "4.24.2",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -101,6 +101,7 @@
     "check:tooling": "npm run test:release-tooling && npm run test:runtime && npm run test:action && npm run test:rust-assets && npm run test:agent-commands && npm run test:assertions && npm run test:sweep-target && npm run test:skip-guard && npm run test:windows-tls && node scripts/package-preflight.mjs && node scripts/verify-binstall-metadata.mjs --offline",
     "release:check": "cargo clean && node scripts/sweep-target.mjs && npm run check && npm run test:engine && npm run test:go && npm run test:jvm && npm run test:launcher && npm run test:fixture && npm run test:watchdog && npm run test:engine-contract && npm run test:agent && npm run test:child-attribution && npm run test:host-loader && npm run test:python && npm run test:ruby-coverage && npm run test:rust-public-cargo && npm run test:packed-npx && npm run test:clang-mcdc && npm run benchmark:check",
     "release:bump": "node scripts/bump-version.mjs",
+    "release:verify": "node scripts/verify-release.mjs",
     "sweep": "node scripts/sweep-target.mjs",
     "oracle:rust": "cargo build --release -p supercov && node scripts/rust-coverage-oracle.mjs",
     "prepack": "node scripts/package-preflight.mjs",
@@ -122,14 +123,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.24.0",
-    "@supercov/cli-darwin-x64": "4.24.0",
-    "@supercov/cli-linux-arm64-gnu": "4.24.0",
-    "@supercov/cli-linux-arm64-musl": "4.24.0",
-    "@supercov/cli-linux-x64-gnu": "4.24.0",
-    "@supercov/cli-linux-x64-musl": "4.24.0",
-    "@supercov/cli-win32-arm64": "4.24.0",
-    "@supercov/cli-win32-x64": "4.24.0"
+    "@supercov/cli-darwin-arm64": "4.24.2",
+    "@supercov/cli-darwin-x64": "4.24.2",
+    "@supercov/cli-linux-arm64-gnu": "4.24.2",
+    "@supercov/cli-linux-arm64-musl": "4.24.2",
+    "@supercov/cli-linux-x64-gnu": "4.24.2",
+    "@supercov/cli-linux-x64-musl": "4.24.2",
+    "@supercov/cli-win32-arm64": "4.24.2",
+    "@supercov/cli-win32-x64": "4.24.2"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/atomic.mjs

@@ -1,4 +1,4 @@
-import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { Buffer } from "node:buffer";
@@ -18,6 +18,22 @@ function makeDirectory(directory) {
     }
 }
 
+// And a file made there is readable by every user, whatever the process's
+// mask: a container's root wrote evidence only it could read, and the run,
+// as another user, recorded nothing ("Permission denied", 4.24.1).
+const inContainer = () => process.env.SUPERCOV_CONTAINER === "1";
+const fileMode = () => (inContainer() ? 0o666 : 0o600);
+function openToAll(path) {
+    if (!inContainer())
+        return;
+    try {
+        chmodSync(path, 0o666);
+    }
+    catch {
+        // Left as the mask made it: the run says what it could not read.
+    }
+}
+
 function fsyncDirectory(path) {
     try {
         const directory = openSync(path, "r");
@@ -38,7 +54,8 @@ export function atomicWriteFileSync(path, data, options) {
     const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let descriptor;
     try {
-        descriptor = openSync(temporary, "wx", 0o600);
+        descriptor = openSync(temporary, "wx", fileMode());
+        openToAll(temporary);
         writeFileSync(descriptor, data, options);
         fsyncSync(descriptor);
         closeSync(descriptor);
@@ -59,7 +76,7 @@ export function atomicWriteFileSync(path, data, options) {
 export function appendJsonLineDurableSync(path, data) {
     makeDirectory(dirname(path));
     const existed = existsSync(path);
-    const descriptor = openSync(path, "a", 0o600);
+    const descriptor = openSync(path, "a", fileMode());
     try {
         writeFileSync(descriptor, data.endsWith("\n") ? data : `${data}\n`);
         fsyncSync(descriptor);
@@ -67,13 +84,18 @@ export function appendJsonLineDurableSync(path, data) {
     finally {
         closeSync(descriptor);
     }
-    if (!existed)
+    if (!existed) {
+        openToAll(path);
         fsyncDirectory(dirname(path));
+    }
 }
 /** Append a complete local record; process exit closes it before publication. */
 export function appendJsonLineSync(path, data) {
     makeDirectory(dirname(path));
-    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: 0o600 });
+    const opening = inContainer() && !existsSync(path);
+    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: fileMode() });
+    if (opening)
+        openToAll(path);
 }
 /** Atomically publish a fully prepared file or directory and persist its entry. */
 export function atomicRenameSync(source, destination) {

package/runtime/javascript/jest.cjs

@@ -10,7 +10,7 @@
 // CommonJS on purpose: Jest's module system loads setup files without the
 // ESM flag, and the runtime it needs is already on the sandbox global.
 const { createHash, randomUUID } = require("node:crypto");
-const { appendFileSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
+const { appendFileSync, chmodSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
 const { relative, resolve, sep } = require("node:path");
 const { Buffer } = require("node:buffer");
 
@@ -115,8 +115,13 @@ function writeEvidence(payload) {
         const writer = (process.env.SUPERCOV_EXECUTION_LOG_SHARD ?? `pid-${process.pid}`).replace(/[^A-Za-z0-9_-]/g, "_");
         journal = { path: resolve(directory, `jest-worker-${writer}-${randomUUID()}.mcdc.jsonl`), size: 0 };
     }
+    // In a container its root writes the journal, and the run, as another
+    // user, reads it: opened to all there, as atomic.mjs opens its files.
+    const container = process.env.SUPERCOV_CONTAINER === "1";
+    const mode = container ? 0o666 : 0o600;
+    const opening = container && journal.size === 0;
     if (process.env.SUPERCOV_DURABLE_EVIDENCE_EACH_TEST === "1") {
-        const descriptor = openSync(journal.path, "a", 0o600);
+        const descriptor = openSync(journal.path, "a", mode);
         try {
             writeFileSync(descriptor, line);
             fsyncSync(descriptor);
@@ -126,7 +131,15 @@ function writeEvidence(payload) {
         }
     }
     else {
-        appendFileSync(journal.path, line, { mode: 0o600 });
+        appendFileSync(journal.path, line, { mode });
+    }
+    if (opening) {
+        try {
+            chmodSync(journal.path, 0o666);
+        }
+        catch {
+            // Left as the mask made it.
+        }
     }
     journal.size += Buffer.byteLength(line);
 }

package/runtime/javascript/runtime.mjs

@@ -625,6 +625,7 @@ function flushBackgroundAppends(fs) {
 // all.
 function makeEvidenceDirectory(fs, directory) {
   const first = fs.mkdirSync(directory, { recursive: true });
+  markContainerWriting(fs);
   if (!first || typeof process === "undefined" || !process.env || process.env.SUPERCOV_CONTAINER !== "1")
     return;
   let current = first;
@@ -640,6 +641,21 @@ function makeEvidenceDirectory(fs, directory) {
     }
   }
 }
+// A container Supercov's relay measured says, once, that its evidence could
+// be written: one that never does -- a server stopped at its first probe, a
+// directory it may not write -- is named when the run ends.
+function markContainerWriting(fs) {
+  const mark = typeof process !== "undefined" && process.env ? process.env.SUPERCOV_CONTAINER_MARK : void 0;
+  if (!mark || state.containerMarked)
+    return;
+  state.containerMarked = true;
+  try {
+    fs.mkdirSync(mark.slice(0, mark.lastIndexOf("/")), { recursive: true });
+    fs.writeFileSync(mark, "", { mode: 0o666 });
+    fs.chmodSync(mark, 0o666);
+  } catch (e) {
+  }
+}
 function writeBackgroundLines(fs, runId, payload) {
   var _a8;
   const directory = backgroundEvidenceDirectory(runId);