supercov 4.24.1 → 4.24.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.24.1",
+  "version": "4.24.2",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -101,6 +101,7 @@
     "check:tooling": "npm run test:release-tooling && npm run test:runtime && npm run test:action && npm run test:rust-assets && npm run test:agent-commands && npm run test:assertions && npm run test:sweep-target && npm run test:skip-guard && npm run test:windows-tls && node scripts/package-preflight.mjs && node scripts/verify-binstall-metadata.mjs --offline",
     "release:check": "cargo clean && node scripts/sweep-target.mjs && npm run check && npm run test:engine && npm run test:go && npm run test:jvm && npm run test:launcher && npm run test:fixture && npm run test:watchdog && npm run test:engine-contract && npm run test:agent && npm run test:child-attribution && npm run test:host-loader && npm run test:python && npm run test:ruby-coverage && npm run test:rust-public-cargo && npm run test:packed-npx && npm run test:clang-mcdc && npm run benchmark:check",
     "release:bump": "node scripts/bump-version.mjs",
+    "release:verify": "node scripts/verify-release.mjs",
     "sweep": "node scripts/sweep-target.mjs",
     "oracle:rust": "cargo build --release -p supercov && node scripts/rust-coverage-oracle.mjs",
     "prepack": "node scripts/package-preflight.mjs",
@@ -122,14 +123,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.24.1",
-    "@supercov/cli-darwin-x64": "4.24.1",
-    "@supercov/cli-linux-arm64-gnu": "4.24.1",
-    "@supercov/cli-linux-arm64-musl": "4.24.1",
-    "@supercov/cli-linux-x64-gnu": "4.24.1",
-    "@supercov/cli-linux-x64-musl": "4.24.1",
-    "@supercov/cli-win32-arm64": "4.24.1",
-    "@supercov/cli-win32-x64": "4.24.1"
+    "@supercov/cli-darwin-arm64": "4.24.2",
+    "@supercov/cli-darwin-x64": "4.24.2",
+    "@supercov/cli-linux-arm64-gnu": "4.24.2",
+    "@supercov/cli-linux-arm64-musl": "4.24.2",
+    "@supercov/cli-linux-x64-gnu": "4.24.2",
+    "@supercov/cli-linux-x64-musl": "4.24.2",
+    "@supercov/cli-win32-arm64": "4.24.2",
+    "@supercov/cli-win32-x64": "4.24.2"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/atomic.mjs

@@ -1,4 +1,4 @@
-import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { Buffer } from "node:buffer";
@@ -18,6 +18,22 @@ function makeDirectory(directory) {
     }
 }
 
+// And a file made there is readable by every user, whatever the process's
+// mask: a container's root wrote evidence only it could read, and the run,
+// as another user, recorded nothing ("Permission denied", 4.24.1).
+const inContainer = () => process.env.SUPERCOV_CONTAINER === "1";
+const fileMode = () => (inContainer() ? 0o666 : 0o600);
+function openToAll(path) {
+    if (!inContainer())
+        return;
+    try {
+        chmodSync(path, 0o666);
+    }
+    catch {
+        // Left as the mask made it: the run says what it could not read.
+    }
+}
+
 function fsyncDirectory(path) {
     try {
         const directory = openSync(path, "r");
@@ -38,7 +54,8 @@ export function atomicWriteFileSync(path, data, options) {
     const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let descriptor;
     try {
-        descriptor = openSync(temporary, "wx", 0o600);
+        descriptor = openSync(temporary, "wx", fileMode());
+        openToAll(temporary);
         writeFileSync(descriptor, data, options);
         fsyncSync(descriptor);
         closeSync(descriptor);
@@ -59,7 +76,7 @@ export function atomicWriteFileSync(path, data, options) {
 export function appendJsonLineDurableSync(path, data) {
     makeDirectory(dirname(path));
     const existed = existsSync(path);
-    const descriptor = openSync(path, "a", 0o600);
+    const descriptor = openSync(path, "a", fileMode());
     try {
         writeFileSync(descriptor, data.endsWith("\n") ? data : `${data}\n`);
         fsyncSync(descriptor);
@@ -67,13 +84,18 @@ export function appendJsonLineDurableSync(path, data) {
     finally {
         closeSync(descriptor);
     }
-    if (!existed)
+    if (!existed) {
+        openToAll(path);
         fsyncDirectory(dirname(path));
+    }
 }
 /** Append a complete local record; process exit closes it before publication. */
 export function appendJsonLineSync(path, data) {
     makeDirectory(dirname(path));
-    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: 0o600 });
+    const opening = inContainer() && !existsSync(path);
+    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: fileMode() });
+    if (opening)
+        openToAll(path);
 }
 /** Atomically publish a fully prepared file or directory and persist its entry. */
 export function atomicRenameSync(source, destination) {

package/runtime/javascript/jest.cjs

@@ -10,7 +10,7 @@
 // CommonJS on purpose: Jest's module system loads setup files without the
 // ESM flag, and the runtime it needs is already on the sandbox global.
 const { createHash, randomUUID } = require("node:crypto");
-const { appendFileSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
+const { appendFileSync, chmodSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
 const { relative, resolve, sep } = require("node:path");
 const { Buffer } = require("node:buffer");
 
@@ -115,8 +115,13 @@ function writeEvidence(payload) {
         const writer = (process.env.SUPERCOV_EXECUTION_LOG_SHARD ?? `pid-${process.pid}`).replace(/[^A-Za-z0-9_-]/g, "_");
         journal = { path: resolve(directory, `jest-worker-${writer}-${randomUUID()}.mcdc.jsonl`), size: 0 };
     }
+    // In a container its root writes the journal, and the run, as another
+    // user, reads it: opened to all there, as atomic.mjs opens its files.
+    const container = process.env.SUPERCOV_CONTAINER === "1";
+    const mode = container ? 0o666 : 0o600;
+    const opening = container && journal.size === 0;
     if (process.env.SUPERCOV_DURABLE_EVIDENCE_EACH_TEST === "1") {
-        const descriptor = openSync(journal.path, "a", 0o600);
+        const descriptor = openSync(journal.path, "a", mode);
         try {
             writeFileSync(descriptor, line);
             fsyncSync(descriptor);
@@ -126,7 +131,15 @@ function writeEvidence(payload) {
         }
     }
     else {
-        appendFileSync(journal.path, line, { mode: 0o600 });
+        appendFileSync(journal.path, line, { mode });
+    }
+    if (opening) {
+        try {
+            chmodSync(journal.path, 0o666);
+        }
+        catch {
+            // Left as the mask made it.
+        }
     }
     journal.size += Buffer.byteLength(line);
 }

package/runtime/javascript/runtime.mjs

@@ -651,7 +651,8 @@ function markContainerWriting(fs) {
   state.containerMarked = true;
   try {
     fs.mkdirSync(mark.slice(0, mark.lastIndexOf("/")), { recursive: true });
-    fs.writeFileSync(mark, "");
+    fs.writeFileSync(mark, "", { mode: 0o666 });
+    fs.chmodSync(mark, 0o666);
   } catch (e) {
   }
 }