supercov 4.24.1 → 4.24.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.24.1",
+  "version": "4.24.3",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -101,6 +101,7 @@
     "check:tooling": "npm run test:release-tooling && npm run test:runtime && npm run test:action && npm run test:rust-assets && npm run test:agent-commands && npm run test:assertions && npm run test:sweep-target && npm run test:skip-guard && npm run test:windows-tls && node scripts/package-preflight.mjs && node scripts/verify-binstall-metadata.mjs --offline",
     "release:check": "cargo clean && node scripts/sweep-target.mjs && npm run check && npm run test:engine && npm run test:go && npm run test:jvm && npm run test:launcher && npm run test:fixture && npm run test:watchdog && npm run test:engine-contract && npm run test:agent && npm run test:child-attribution && npm run test:host-loader && npm run test:python && npm run test:ruby-coverage && npm run test:rust-public-cargo && npm run test:packed-npx && npm run test:clang-mcdc && npm run benchmark:check",
     "release:bump": "node scripts/bump-version.mjs",
+    "release:verify": "node scripts/verify-release.mjs",
     "sweep": "node scripts/sweep-target.mjs",
     "oracle:rust": "cargo build --release -p supercov && node scripts/rust-coverage-oracle.mjs",
     "prepack": "node scripts/package-preflight.mjs",
@@ -122,14 +123,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.24.1",
-    "@supercov/cli-darwin-x64": "4.24.1",
-    "@supercov/cli-linux-arm64-gnu": "4.24.1",
-    "@supercov/cli-linux-arm64-musl": "4.24.1",
-    "@supercov/cli-linux-x64-gnu": "4.24.1",
-    "@supercov/cli-linux-x64-musl": "4.24.1",
-    "@supercov/cli-win32-arm64": "4.24.1",
-    "@supercov/cli-win32-x64": "4.24.1"
+    "@supercov/cli-darwin-arm64": "4.24.3",
+    "@supercov/cli-darwin-x64": "4.24.3",
+    "@supercov/cli-linux-arm64-gnu": "4.24.3",
+    "@supercov/cli-linux-arm64-musl": "4.24.3",
+    "@supercov/cli-linux-x64-gnu": "4.24.3",
+    "@supercov/cli-linux-x64-musl": "4.24.3",
+    "@supercov/cli-win32-arm64": "4.24.3",
+    "@supercov/cli-win32-x64": "4.24.3"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/atomic.mjs

@@ -1,4 +1,4 @@
-import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { Buffer } from "node:buffer";
@@ -18,6 +18,22 @@ function makeDirectory(directory) {
     }
 }
 
+// And a file made there is readable by every user, whatever the process's
+// mask: a container's root wrote evidence only it could read, and the run,
+// as another user, recorded nothing ("Permission denied", 4.24.1).
+const inContainer = () => process.env.SUPERCOV_CONTAINER === "1";
+const fileMode = () => (inContainer() ? 0o666 : 0o600);
+function openToAll(path) {
+    if (!inContainer())
+        return;
+    try {
+        chmodSync(path, 0o666);
+    }
+    catch {
+        // Left as the mask made it: the run says what it could not read.
+    }
+}
+
 function fsyncDirectory(path) {
     try {
         const directory = openSync(path, "r");
@@ -38,7 +54,8 @@ export function atomicWriteFileSync(path, data, options) {
     const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let descriptor;
     try {
-        descriptor = openSync(temporary, "wx", 0o600);
+        descriptor = openSync(temporary, "wx", fileMode());
+        openToAll(temporary);
         writeFileSync(descriptor, data, options);
         fsyncSync(descriptor);
         closeSync(descriptor);
@@ -59,7 +76,7 @@ export function atomicWriteFileSync(path, data, options) {
 export function appendJsonLineDurableSync(path, data) {
     makeDirectory(dirname(path));
     const existed = existsSync(path);
-    const descriptor = openSync(path, "a", 0o600);
+    const descriptor = openSync(path, "a", fileMode());
     try {
         writeFileSync(descriptor, data.endsWith("\n") ? data : `${data}\n`);
         fsyncSync(descriptor);
@@ -67,13 +84,18 @@ export function appendJsonLineDurableSync(path, data) {
     finally {
         closeSync(descriptor);
     }
-    if (!existed)
+    if (!existed) {
+        openToAll(path);
         fsyncDirectory(dirname(path));
+    }
 }
 /** Append a complete local record; process exit closes it before publication. */
 export function appendJsonLineSync(path, data) {
     makeDirectory(dirname(path));
-    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: 0o600 });
+    const opening = inContainer() && !existsSync(path);
+    appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: fileMode() });
+    if (opening)
+        openToAll(path);
 }
 /** Atomically publish a fully prepared file or directory and persist its entry. */
 export function atomicRenameSync(source, destination) {

package/runtime/javascript/jest.cjs

@@ -10,7 +10,7 @@
 // CommonJS on purpose: Jest's module system loads setup files without the
 // ESM flag, and the runtime it needs is already on the sandbox global.
 const { createHash, randomUUID } = require("node:crypto");
-const { appendFileSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
+const { appendFileSync, chmodSync, closeSync, fsyncSync, mkdirSync, openSync, statSync, writeFileSync } = require("node:fs");
 const { relative, resolve, sep } = require("node:path");
 const { Buffer } = require("node:buffer");
 
@@ -115,8 +115,13 @@ function writeEvidence(payload) {
         const writer = (process.env.SUPERCOV_EXECUTION_LOG_SHARD ?? `pid-${process.pid}`).replace(/[^A-Za-z0-9_-]/g, "_");
         journal = { path: resolve(directory, `jest-worker-${writer}-${randomUUID()}.mcdc.jsonl`), size: 0 };
     }
+    // In a container its root writes the journal, and the run, as another
+    // user, reads it: opened to all there, as atomic.mjs opens its files.
+    const container = process.env.SUPERCOV_CONTAINER === "1";
+    const mode = container ? 0o666 : 0o600;
+    const opening = container && journal.size === 0;
     if (process.env.SUPERCOV_DURABLE_EVIDENCE_EACH_TEST === "1") {
-        const descriptor = openSync(journal.path, "a", 0o600);
+        const descriptor = openSync(journal.path, "a", mode);
         try {
             writeFileSync(descriptor, line);
             fsyncSync(descriptor);
@@ -126,7 +131,15 @@ function writeEvidence(payload) {
         }
     }
     else {
-        appendFileSync(journal.path, line, { mode: 0o600 });
+        appendFileSync(journal.path, line, { mode });
+    }
+    if (opening) {
+        try {
+            chmodSync(journal.path, 0o666);
+        }
+        catch {
+            // Left as the mask made it.
+        }
     }
     journal.size += Buffer.byteLength(line);
 }

package/runtime/javascript/launchSupervisor.mjs

@@ -729,6 +729,39 @@ function injectChildEnvironment(method, args) {
     });
     return next;
 }
+// A signal a crash raises, never the SIGTERM or SIGKILL a suite's teardown
+// sends. A child it ends says nothing: on 2026-11-06 a backend that died so
+// right after it listened read as one that never became ready, and a
+// Playwright worker as one that "exited unexpectedly".
+const CRASH_SIGNALS = new Set(["SIGSEGV", "SIGBUS", "SIGILL", "SIGFPE", "SIGABRT", "SIGTRAP", "SIGSYS"]);
+function noteCrash(signal, child, command, started) {
+    if (!CRASH_SIGNALS.has(signal))
+        return;
+    record({
+        event: "child-exit",
+        ...(typeof child === "number" ? { child } : {}),
+        signal,
+        command: safeArgument(String(command ?? "")),
+        ranMs: Date.now() - started,
+    });
+}
+function watchChild(method, args, run) {
+    const started = Date.now();
+    let launched;
+    try {
+        launched = run();
+    }
+    catch (error) {
+        // execSync and execFileSync throw for a child a signal ended.
+        noteCrash(error?.signal, error?.pid, args[0], started);
+        throw error;
+    }
+    if (method === "spawnSync")
+        noteCrash(launched?.signal, launched?.pid, args[0], started);
+    else if (typeof launched?.once === "function")
+        launched.once("exit", (_code, signal) => noteCrash(signal, launched.pid, args[0], started));
+    return launched;
+}
 function patchChildProcesses() {
     const methods = [
         "spawn",
@@ -745,7 +778,7 @@ function patchChildProcesses() {
             configurable: true,
             enumerable: true,
             writable: true,
-            value: keepPromisifiedShape(original, (...args) => Reflect.apply(original, childProcess, injectChildEnvironment(method, args))),
+            value: keepPromisifiedShape(original, (...args) => watchChild(method, args, () => Reflect.apply(original, childProcess, injectChildEnvironment(method, args)))),
         });
     }
     syncBuiltinESMExports();

package/runtime/javascript/register.mjs

@@ -13,6 +13,27 @@ import { fileURLToPath } from "node:url";
 import { installLaunchSupervisor, wrapImportedCapability } from "./launchSupervisor.mjs";
 import { __supercovBindCapabilityWrapper } from "./capability.mjs";
 installLaunchSupervisor();
+// Playwright 1.59 writes each file it compiles into its cache in place and
+// reads it back unchecked: a process that read one while another wrote it
+// ran an empty module, and a config of no `default` failed at "Cannot add
+// property metadata, object is not extensible". The cache a run gives it
+// starts empty, so every run compiled; there each file is written whole, or
+// is not there yet and is compiled again. A file written beside the cache's
+// folders, not in one, is never taken for an old entry and removed.
+const transformCache = process.env.PWTEST_CACHE_DIR;
+if (transformCache) {
+    const cacheFolder = resolve(transformCache) + sep;
+    const writeFileSync = fs.writeFileSync;
+    let written = 0;
+    fs.writeFileSync = function (file, ...rest) {
+        if (typeof file !== "string" || !resolve(file).startsWith(cacheFolder))
+            return writeFileSync.call(this, file, ...rest);
+        const partial = resolve(transformCache, `.writing-${process.pid}-${written++}`);
+        writeFileSync.call(this, partial, ...rest);
+        fs.renameSync(partial, file);
+    };
+    syncBuiltinESMExports();
+}
 // Instrumented sources import the browser-safe capability seam; bind the
 // real supervisor implementation before any user module evaluates.
 __supercovBindCapabilityWrapper(wrapImportedCapability);

package/runtime/javascript/runtime.mjs

@@ -651,7 +651,8 @@ function markContainerWriting(fs) {
   state.containerMarked = true;
   try {
     fs.mkdirSync(mark.slice(0, mark.lastIndexOf("/")), { recursive: true });
-    fs.writeFileSync(mark, "");
+    fs.writeFileSync(mark, "", { mode: 0o666 });
+    fs.chmodSync(mark, 0o666);
   } catch (e) {
   }
 }