supercov 4.5.0 → 4.7.0

package/docs/cli.md

@@ -121,6 +121,18 @@ npx supercov -- cargo nextest run
 Use the complete command you rely on before merging or deploying. A coverage run
 preserves the wrapped command's exit status, so it can remain a CI gate.
 
+A script that queries the run it just recorded can have Supercov write the
+run's id to a file. `latest` is the newest run, which is another one when two
+commands record runs side by side:
+
+```sh supercov-example
+SUPERCOV_RUN_ID_FILE=unit.id npx supercov -- <test command>
+npx supercov runs <run-id> check --min-lines 80   # the id in unit.id
+```
+
+The file is removed when the run starts and written when it is recorded, so a
+run that is not recorded leaves no id behind.
+
 ## List and select runs
 
 ```sh supercov
@@ -511,8 +523,13 @@ pass in the run is listed regardless.
 per line, for a runner's filter. A Vitest, Playwright or node:test test inside
 `describe` blocks is printed as the blocks and the test joined by spaces
 (`small charges`), which is what `vitest -t`, `--grep` and
-`--test-name-pattern` match. A dependency, lockfile, configuration or
-toolchain change affects every test and is reported as such. A source file
+`--test-name-pattern` match. A helper beside the tests, or source outside what is
+measured, that changed affects the tests whose files import it (a JavaScript or
+TypeScript helper that only gained functions affects none), and every test
+where Supercov cannot read the imports. A dependency,
+lockfile, configuration or toolchain change affects every test and is reported
+as such; a test runner's settings affect only the runs that used that runner.
+A source file
 added since the run is outside every test's record; the working-tree check
 says so, and the suite should run in full.
 
@@ -595,24 +612,61 @@ A test that is in two of the runs is one test in the merge. If it failed in
 either, it is failed, which is why a command run again replaces its earlier
 run and is not merged with it.
 
-The runs may differ in their tests when the later ones have only gained test
-files. Measuring a new test alone and adding it to the runs before it is
-then the whole suite's figure, without the whole suite's time:
+The runs may differ in their tests, the helpers beside them, and the test
+runners' settings, as long as nothing that changed reaches what an earlier
+run's tests did. Measuring a new test alone and adding it to the runs before it
+is then the whole suite's figure, without the whole suite's time:
 
 ```sh supercov-example
-npx supercov -- npm test                       # the suite, once
-npx supercov -- npx vitest run test/new.test.ts   # a test added since, alone
+npx supercov -- npm test               # the suite, once
+npx supercov -- <the new test alone>   # a test added since
 npx supercov merge
 ```
 
-A run is left out, and named, when a file of its own tests has changed since
-it ran, or a file tests load that is not itself a test's: what it recorded is
-then of other tests. Measure those again to count them.
+Each file that differs from what an earlier run was recorded with is judged by
+what that run's tests did with it:
+
+- Another run's test file: it was not in this run. A file of the run's own
+  tests: what it recorded is of other tests, and the run is left out.
+- A file the run measured: left out, always.
+- A helper, fixture or support file, or source outside what is measured (a
+  simulator kept out of `SUPERCOV_SOURCE_ROOTS`): left out of a run only when
+  that run's test files import it, directly or through other files. Supercov
+  reads the imports of JavaScript, TypeScript and Python tests, with pytest's
+  `conftest.py` files and `pytest_plugins`; a computed import, a change to
+  `sys.path`, or tests in another language count every helper as loaded. A
+  JavaScript or TypeScript helper that only gained functions, which code
+  written before cannot have called, leaves every run in.
+- A test runner's settings: `playwright.config.*`, `vitest.config.*`,
+  `jest.config.*` and `ava.config.*` belong to their runner, and a run that
+  did not use that runner keeps. Of Playwright's settings, only those that
+  decide what a test does count: `use`, `testDir`, `webServer`,
+  `globalSetup`, `globalTeardown`, and a project's `dependencies` and
+  `teardown`. Timeouts, retries, workers, reporters, which files and names to
+  run, and projects added since schedule tests and change nothing an earlier
+  test reached. This needs the newer run to have measured Playwright.
+- Any other configuration, such as `tsconfig.json`, `vite.config.*` or a
+  Babel file, may set how any test runs, and leaves the run out.
+
+A run left out is named with the files and the functions that changed. The
+merged run lists what differed and why it does not reach the earlier runs:
+`merged across:` in `runs <id>`, and `mergedAcross` in JSON.
+
+When you know a change Supercov counts does not alter what the earlier tests
+ran, say so:
+
+```sh supercov-example
+npx supercov merge --allow-changed
+```
+
+The product code, the dependencies, and what is measured must still be the
+same, and a run whose own test files changed is still left out. What was
+accepted is listed in `merged across:` as accepted.
 
 `assertions assess` assesses a merged run across every suite merged into it,
-reusing the answers saved when its parts were assessed. `tests affected` is
-asked of the runs that were merged, which hold the record of what each test
-ran.
+reusing the answers saved when its parts were assessed. `tests affected` of a
+merged run is answered from the runs it was merged from, which hold the record
+of what each test ran; a test in several of them is affected where any says so.
 
 ## Clean local data
 
@@ -660,6 +714,7 @@ terminal or offline environment after the package has been downloaded.
 | `SUPERCOV_SOURCE_ROOTS` | Comma-separated directories or files that hold your own code, in any language; everything else is left out |
 | `SUPERCOV_TEST_KIND` | Label the wrapped command as a test level such as `unit` or `e2e` |
 | `SUPERCOV_SOURCE_TOOLS` | Comma-separated names of tools the test command runs that read source as text, such as a linter or a spell checker, besides Biome, oxlint, dprint, cspell and knip. Each is run on your source as you wrote it instead of on the instrumented copy |
+| `SUPERCOV_RUN_ID_FILE` | A file to write the recorded run's id to, for a script to query that run rather than `latest` |
 | `SUPERCOV_KEEP_WORKSPACE` | Set to `1` to leave the instrumented copy of the project in `.supercov/workspaces/` after the run, to inspect what the command ran |
 
 Examples:

package/docs/performance.md

@@ -120,6 +120,20 @@ Each completed run stores compressed evidence and metadata under
 `.supercov/runs/<run-id>/`. Query views are derived from that evidence rather
 than stored as a full report for every filter.
 
+Most of a large run is its query index, `query-index.v1.bin`: on a suite of
+about 400 tests with per-test evidence, 160 MB of a 216 MB run, beside 58 MB of
+evidence. The index is a cache. Supercov builds it again from the evidence the
+first time the run is queried without it, so a CI job that keeps runs as an
+artifact can leave it out:
+
+```sh supercov-example
+tar czf supercov-runs.tgz --exclude 'query-index.v1.bin' .supercov/runs
+```
+
+A merged run holds a copy of each run's evidence and an index of its own, so
+merging adds about as much again. To hand a run to a reviewer, the HTML report
+(`npx supercov report`) is usually the smaller artifact.
+
 The isolated workspace may be larger because it can contain an instrumented
 build cache. Supercov does not delete history in the background.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.5.0",
+  "version": "4.7.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -83,7 +83,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +120,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.5.0",
-    "@supercov/cli-darwin-x64": "4.5.0",
-    "@supercov/cli-linux-arm64-gnu": "4.5.0",
-    "@supercov/cli-linux-arm64-musl": "4.5.0",
-    "@supercov/cli-linux-x64-gnu": "4.5.0",
-    "@supercov/cli-linux-x64-musl": "4.5.0",
-    "@supercov/cli-win32-arm64": "4.5.0",
-    "@supercov/cli-win32-x64": "4.5.0"
+    "@supercov/cli-darwin-arm64": "4.7.0",
+    "@supercov/cli-darwin-x64": "4.7.0",
+    "@supercov/cli-linux-arm64-gnu": "4.7.0",
+    "@supercov/cli-linux-arm64-musl": "4.7.0",
+    "@supercov/cli-linux-x64-gnu": "4.7.0",
+    "@supercov/cli-linux-x64-musl": "4.7.0",
+    "@supercov/cli-win32-arm64": "4.7.0",
+    "@supercov/cli-win32-x64": "4.7.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -18,7 +18,7 @@ import * as standardPlaywright from "@playwright/test";
 import * as coverageRuntime from "./runtime.mjs";
 import { inferTestProvenance } from "./provenance.mjs";
 import { appendJsonLineDurableSync, appendJsonLineSync } from "./atomic.mjs";
-import { COVERAGE_PHASE_HEADER, COVERAGE_PHASE_COOKIE, COVERAGE_SCOPE_COOKIE, COVERAGE_SCOPE_HEADER, COVERAGE_CARRIER_ENV, encodeCoverageCarrier, encodeCoverageScope, serverEvidenceDirectory, serverEvidencePath, } from "./transport.mjs";
+import { COVERAGE_PHASE_HEADER, COVERAGE_PHASE_COOKIE, COVERAGE_PHASE_SITE_COOKIE, COVERAGE_SCOPE_COOKIE, COVERAGE_SCOPE_HEADER, COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_CARRIER_ENV, encodeCoverageCarrier, encodeCoverageScope, serverEvidenceDirectory, serverEvidencePath, } from "./transport.mjs";
 export * from "@playwright/test";
 const generatedTargetModule = "__SUPERCOV_PLAYWRIGHT_MODULE__";
 const targetModule = process.env["SUPERCOV_PLAYWRIGHT_MODULE"] ??
@@ -236,9 +236,21 @@ class CoveragePhaseController {
     // Parameter properties are stateful despite the base ESLint rule treating
     // this as an empty constructor.
     // eslint-disable-next-line no-useless-constructor
-    constructor(scope, configuredHeaders = {}) {
+    constructor(scope, configuredHeaders = {}, baseURL) {
         this.scope = scope;
         this.configuredHeaders = configuredHeaders;
+        // Where the app under test is served: the project's base URL, and the
+        // local hosts a web server listens on. A cookie is kept per host, for
+        // every port of it.
+        const hosts = ["http://localhost/", "http://127.0.0.1/"];
+        try {
+            if (baseURL)
+                hosts.unshift(new URL("/", baseURL).href);
+        }
+        catch {
+            // A base URL Playwright itself would refuse.
+        }
+        this.appHosts = [...new Set(hosts)];
     }
     allPages() {
         return [...this.pages];
@@ -446,17 +458,34 @@ class CoveragePhaseController {
         // own attempt, so the newest wins; the fetch patch is installed once
         // and reads the attempt at call time, so a stale copy can never pin an
         // old scope onto a request the way nested wrappers would.
-        await context.addInitScript(({ attemptId, scopeHeader, scopeValue, scopeCookie }) => {
+        await context.addInitScript(({ attemptId, scopeHeader, scopeValue, scopeCookie, scopeSiteCookie }) => {
             const coverageGlobal = globalThis;
             coverageGlobal.__SUPERCOV_ATTEMPT__ = { attemptId, scopeValue };
             coverageGlobal.__SUPERCOV_MCDC_TEST_ID__ = attemptId;
             try {
                 document.cookie = `${scopeCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=Lax`;
+                // And for this document's frames on another of the app's
+                // hosts, where crossing sites is allowed.
+                if (globalThis.isSecureContext)
+                    document.cookie = `${scopeSiteCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=None; Secure`;
                 if (!coverageGlobal.__SUPERCOV_BROWSER_FETCH_PATCHED__) {
                     const originalFetch = globalThis.fetch?.bind(globalThis);
                     if (originalFetch) {
                         coverageGlobal.__SUPERCOV_BROWSER_FETCH_PATCHED__ = true;
                         globalThis.fetch = ((input, init) => {
+                            // Only the page's own origin hears the scope. A
+                            // header on a request to another origin makes the
+                            // browser ask that origin first, and one that
+                            // allows only the headers it uses refuses: the
+                            // page's fetch failed under measurement alone.
+                            try {
+                                const target = new URL(input instanceof Request ? input.url : String(input), location.href);
+                                if (target.origin !== location.origin)
+                                    return originalFetch(input, init);
+                            }
+                            catch {
+                                return originalFetch(input, init);
+                            }
                             const headers = new Headers(init?.headers ??
                                 (input instanceof Request ? input.headers : undefined));
                             headers.set(scopeHeader, coverageGlobal.__SUPERCOV_ATTEMPT__?.scopeValue ?? scopeValue);
@@ -476,6 +505,7 @@ class CoveragePhaseController {
             scopeHeader: COVERAGE_SCOPE_HEADER,
             scopeValue: encodeCoverageScope(this.scope),
             scopeCookie: COVERAGE_SCOPE_COOKIE,
+            scopeSiteCookie: COVERAGE_SCOPE_SITE_COOKIE,
         }).catch(() => undefined);
         const register = (page) => {
             const pending = this.registerPage(page).finally(() => this.pendingRegistrations.delete(pending));
@@ -513,6 +543,16 @@ class CoveragePhaseController {
             if (!originalFetch)
                 return answer;
             globalThis.fetch = ((input, init) => {
+                // As in a page: another origin would be asked first, and may
+                // refuse a header it does not expect.
+                try {
+                    const target = new URL(input instanceof Request ? input.url : String(input), globalThis.location.href);
+                    if (target.origin !== globalThis.location.origin)
+                        return originalFetch(input, init);
+                }
+                catch {
+                    return originalFetch(input, init);
+                }
                 const headers = new Headers(init?.headers ??
                     (input instanceof Request ? input.headers : undefined));
                 headers.set(scopeHeader, scopeValue);
@@ -705,13 +745,10 @@ class CoveragePhaseController {
         const options = scoped[0] && typeof scoped[0] === "object"
             ? scoped[0]
             : {};
-        scoped[0] = {
-            ...options,
-            extraHTTPHeaders: {
-                ...(options.extraHTTPHeaders ?? {}),
-                ...(activeCoverageHeaders() ?? {}),
-            },
-        };
+        // The scope reaches the app in cookies once the context is
+        // registered (`updateContextHeaders`); headers on the context would
+        // go to every origin the page fetches from.
+        scoped[0] = { ...options };
         return scoped;
     }
     /**
@@ -734,7 +771,7 @@ class CoveragePhaseController {
     }
     async activateFrames(phaseId) {
         await timed("activate.frameEvaluate", () => Promise.all([...this.pages].flatMap((page) => page.frames()).map((frame) => frame
-            .evaluate(({ id, attemptId, storageKey, scopeCookie, scopeValue, phaseCookie }) => {
+            .evaluate(({ id, attemptId, storageKey, scopeCookie, scopeValue, phaseCookie, scopeSiteCookie, phaseSiteCookie }) => {
             globalThis.__SUPERCOV_PHASE_ID__ = id;
             const coverageGlobal = globalThis;
             // A document that loaded under an earlier test's attempt (a page
@@ -746,6 +783,10 @@ class CoveragePhaseController {
                 localStorage.setItem(storageKey, id);
                 document.cookie = `${scopeCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=Lax`;
                 document.cookie = `${phaseCookie}=${encodeURIComponent(id)}; Path=/; SameSite=Lax`;
+                if (globalThis.isSecureContext) {
+                    document.cookie = `${scopeSiteCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=None; Secure`;
+                    document.cookie = `${phaseSiteCookie}=${encodeURIComponent(id)}; Path=/; SameSite=None; Secure`;
+                }
             }
             catch {
                 // Sandboxed/cross-origin frames may not expose localStorage.
@@ -757,6 +798,8 @@ class CoveragePhaseController {
             scopeCookie: COVERAGE_SCOPE_COOKIE,
             scopeValue: encodeCoverageScope(this.scope),
             phaseCookie: COVERAGE_PHASE_COOKIE,
+            scopeSiteCookie: COVERAGE_SCOPE_SITE_COOKIE,
+            phaseSiteCookie: COVERAGE_PHASE_SITE_COOKIE,
         })
             .catch(() => undefined))));
     }
@@ -779,14 +822,43 @@ class CoveragePhaseController {
                 this.unresponsiveWorkers.add(worker);
         })));
     }
+    /**
+     * Tell the app which test and phase its requests belong to, in cookies on
+     * the app's hosts. Headers set on the context went with every request the
+     * browser made, to any origin, and a header on a request to another
+     * origin makes the browser ask that origin first: one that allows only the
+     * headers it uses refused, and the page's request failed under
+     * measurement alone. A cookie never does. The page sends it to its own
+     * site from the first navigation on, and, on a secure origin, to frames
+     * of the app's other hosts as well.
+     */
     async updateContextHeaders(context, phaseId) {
-        await context
-            .setExtraHTTPHeaders({
-            ...(this.contextConfiguredHeaders.get(context) ?? this.configuredHeaders),
-            [COVERAGE_SCOPE_HEADER]: encodeCoverageScope(this.scope),
-            ...(phaseId ? { [COVERAGE_PHASE_HEADER]: phaseId } : {}),
-        })
-            .catch(() => undefined);
+        const scope = encodeURIComponent(encodeCoverageScope(this.scope));
+        const phase = phaseId ? encodeURIComponent(phaseId) : undefined;
+        const pairs = (scopeName, phaseName) => [
+            [scopeName, scope],
+            ...(phase ? [[phaseName, phase]] : []),
+        ];
+        await Promise.all([
+            // The context's own headers are the owner's, unchanged.
+            context
+                .setExtraHTTPHeaders(this.contextConfiguredHeaders.get(context) ?? this.configuredHeaders)
+                .catch(() => undefined),
+            ...this.appHosts.map((url) => {
+                const host = new URL(url);
+                // For the app's own site: requests, navigations and sockets.
+                const cookies = pairs(COVERAGE_SCOPE_COOKIE, COVERAGE_PHASE_COOKIE).map(([name, value]) => ({ name, value, url, sameSite: "Lax" }));
+                // For its frames on another of its hosts: a cookie that
+                // crosses sites must be Secure, which needs https or a local
+                // host. Chromium keeps such a cookie only when it is given by
+                // domain; given by an http URL it is dropped without a word.
+                if (host.protocol === "https:" || ["localhost", "127.0.0.1"].includes(host.hostname)) {
+                    cookies.push(...pairs(COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_PHASE_SITE_COOKIE).map(([name, value]) => ({ name, value, domain: host.hostname, path: "/", sameSite: "None", secure: true })));
+                }
+                // One host refused leaves the others theirs.
+                return context.addCookies(cookies).catch(() => undefined);
+            }),
+        ]);
     }
     async activatePage(page, phaseId) {
         const cdp = this.cdpSessions.get(page);
@@ -1352,7 +1424,7 @@ const instrumentedFixtures = {
         async ({}, use, testInfo) => {
             const scope = executionScope(testInfo);
             const configuredHeaders = Object.fromEntries(Object.entries(testInfo.project.use.extraHTTPHeaders ?? {}).map(([name, value]) => [name, String(value)]));
-            const controller = new CoveragePhaseController(scope, configuredHeaders);
+            const controller = new CoveragePhaseController(scope, configuredHeaders, testInfo.project.use.baseURL);
             controllers.set(scope.attemptId, controller);
             activeController = controller;
             directRuntime()?.activateCoverageScope(scope);

package/runtime/javascript/runtime.mjs

@@ -34,6 +34,8 @@ var COVERAGE_SCOPE_HEADER = "x-supercov-scope";
 var COVERAGE_PHASE_HEADER = "x-supercov-phase";
 var COVERAGE_SCOPE_COOKIE = "__supercov_scope";
 var COVERAGE_PHASE_COOKIE = "__supercov_phase";
+var COVERAGE_SCOPE_SITE_COOKIE = "__supercov_scope_site";
+var COVERAGE_PHASE_SITE_COOKIE = "__supercov_phase_site";
 var COVERAGE_CARRIER_ENV = "SUPERCOV_CONTEXT";
 var DEFAULT_SERVER_EVIDENCE_ROOT = "/tmp/supercov-server-evidence";
 function configuredServerEvidenceRoot() {
@@ -1345,8 +1347,10 @@ function requestCoverageContext(value) {
       }
     }
   }
-  const encodedScope = (_a8 = headers.get(COVERAGE_SCOPE_HEADER)) != null ? _a8 : cookies.get(COVERAGE_SCOPE_COOKIE);
-  const rawPhaseId = (_b = headers.get(COVERAGE_PHASE_HEADER)) != null ? _b : cookies.get(COVERAGE_PHASE_COOKIE);
+  // A frame of the app on another of its hosts carries only the cookies
+  // made to cross sites.
+  const encodedScope = (_a8 = headers.get(COVERAGE_SCOPE_HEADER)) != null ? _a8 : cookies.has(COVERAGE_SCOPE_COOKIE) ? cookies.get(COVERAGE_SCOPE_COOKIE) : cookies.get(COVERAGE_SCOPE_SITE_COOKIE);
+  const rawPhaseId = (_b = headers.get(COVERAGE_PHASE_HEADER)) != null ? _b : cookies.has(COVERAGE_PHASE_COOKIE) ? cookies.get(COVERAGE_PHASE_COOKIE) : cookies.get(COVERAGE_PHASE_SITE_COOKIE);
   const scope = decodeCoverageScope(typeof encodedScope === "string" ? encodedScope : void 0);
   // The phase cookie outlives a test in a shared browser context just like
   // the stored phase does (see currentPhaseId); a request carrying a scope

package/runtime/javascript/transport.mjs

@@ -2,6 +2,11 @@ export const COVERAGE_SCOPE_HEADER = "x-supercov-scope";
 export const COVERAGE_PHASE_HEADER = "x-supercov-phase";
 export const COVERAGE_SCOPE_COOKIE = "__supercov_scope";
 export const COVERAGE_PHASE_COOKIE = "__supercov_phase";
+// The same, for frames of the app on another of its hosts: a cookie that
+// crosses sites must be Secure, and a Secure cookie is not sent over ws://,
+// so the two cannot be one.
+export const COVERAGE_SCOPE_SITE_COOKIE = "__supercov_scope_site";
+export const COVERAGE_PHASE_SITE_COOKIE = "__supercov_phase_site";
 export const COVERAGE_CARRIER_ENV = "SUPERCOV_CONTEXT";
 export const DEFAULT_SERVER_EVIDENCE_ROOT = "/tmp/supercov-server-evidence";
 // Buffer as it was when Supercov loaded. Tests replace globals -- axios's set