supercov 4.6.0 → 4.8.0

package/docs/cli.md

@@ -121,6 +121,18 @@ npx supercov -- cargo nextest run
 Use the complete command you rely on before merging or deploying. A coverage run
 preserves the wrapped command's exit status, so it can remain a CI gate.
 
+A script that queries the run it just recorded can have Supercov write the
+run's id to a file. `latest` is the newest run, which is another one when two
+commands record runs side by side:
+
+```sh supercov-example
+SUPERCOV_RUN_ID_FILE=unit.id npx supercov -- <test command>
+npx supercov runs <run-id> check --min-lines 80   # the id in unit.id
+```
+
+The file is removed when the run starts and written when it is recorded, so a
+run that is not recorded leaves no id behind.
+
 ## List and select runs
 
 ```sh supercov
@@ -511,9 +523,10 @@ pass in the run is listed regardless.
 per line, for a runner's filter. A Vitest, Playwright or node:test test inside
 `describe` blocks is printed as the blocks and the test joined by spaces
 (`small charges`), which is what `vitest -t`, `--grep` and
-`--test-name-pattern` match. A helper beside the tests that changed affects
-the tests whose files import it (a helper that only gained functions affects
-none), and every test where Supercov cannot read the imports. A dependency,
+`--test-name-pattern` match. A helper beside the tests, or source outside what is
+measured, that changed affects the tests whose files import it (a JavaScript or
+TypeScript helper that only gained functions affects none), and every test
+where Supercov cannot read the imports. A dependency,
 lockfile, configuration or toolchain change affects every test and is reported
 as such; a test runner's settings affect only the runs that used that runner.
 A source file
@@ -615,12 +628,15 @@ what that run's tests did with it:
 
 - Another run's test file: it was not in this run. A file of the run's own
   tests: what it recorded is of other tests, and the run is left out.
-- A helper, fixture or support file: left out of a run only when that run's
-  test files import it, directly or through other files. For JavaScript and
-  TypeScript tests Supercov reads the imports; a computed import path, or tests
-  in another language, count every helper as loaded. A helper that only gained
-  functions, which code written before cannot have called, leaves every run
-  in.
+- A file the run measured: left out, always.
+- A helper, fixture or support file, or source outside what is measured (a
+  simulator kept out of `SUPERCOV_SOURCE_ROOTS`): left out of a run only when
+  that run's test files import it, directly or through other files. Supercov
+  reads the imports of JavaScript, TypeScript and Python tests, with pytest's
+  `conftest.py` files and `pytest_plugins`; a computed import, a change to
+  `sys.path`, or tests in another language count every helper as loaded. A
+  JavaScript or TypeScript helper that only gained functions, which code
+  written before cannot have called, leaves every run in.
 - A test runner's settings: `playwright.config.*`, `vitest.config.*`,
   `jest.config.*` and `ava.config.*` belong to their runner, and a run that
   did not use that runner keeps. Of Playwright's settings, only those that
@@ -648,9 +664,9 @@ same, and a run whose own test files changed is still left out. What was
 accepted is listed in `merged across:` as accepted.
 
 `assertions assess` assesses a merged run across every suite merged into it,
-reusing the answers saved when its parts were assessed. `tests affected` is
-asked of the runs that were merged, which hold the record of what each test
-ran.
+reusing the answers saved when its parts were assessed. `tests affected` of a
+merged run is answered from the runs it was merged from, which hold the record
+of what each test ran; a test in several of them is affected where any says so.
 
 ## Clean local data
 
@@ -698,6 +714,7 @@ terminal or offline environment after the package has been downloaded.
 | `SUPERCOV_SOURCE_ROOTS` | Comma-separated directories or files that hold your own code, in any language; everything else is left out |
 | `SUPERCOV_TEST_KIND` | Label the wrapped command as a test level such as `unit` or `e2e` |
 | `SUPERCOV_SOURCE_TOOLS` | Comma-separated names of tools the test command runs that read source as text, such as a linter or a spell checker, besides Biome, oxlint, dprint, cspell and knip. Each is run on your source as you wrote it instead of on the instrumented copy |
+| `SUPERCOV_RUN_ID_FILE` | A file to write the recorded run's id to, for a script to query that run rather than `latest` |
 | `SUPERCOV_KEEP_WORKSPACE` | Set to `1` to leave the instrumented copy of the project in `.supercov/workspaces/` after the run, to inspect what the command ran |
 
 Examples:

package/docs/coverage-model.md

@@ -96,7 +96,16 @@ Both are useful:
 
 Code that runs while no test is running counts in the run's total and in no
 test's: a server starting before the first test, modules loading, work between
-tests. When a run has any, the summary's `By test kind` table ends with a
+tests.
+
+A request to your app server that names no test -- a webhook from a mock
+Stripe server Supercov does not measure -- is credited to the test running when
+the server handled it, if that test was the only one running then. A mock that
+runs under Supercov passes the test's identity on in its own requests, and its
+webhook is credited exactly. The run's
+`Attribution` line counts those tests as `with server work credited by time`,
+and each one's `runs <id> test` page says so. Work done while tests ran at
+once, or while none ran, stays no test's. When a run has any, the summary's `By test kind` table ends with a
 `no test` row for what only that covered, which is why a run with one kind of
 test can show a total above that kind's own:
 

package/docs/performance.md

@@ -120,6 +120,20 @@ Each completed run stores compressed evidence and metadata under
 `.supercov/runs/<run-id>/`. Query views are derived from that evidence rather
 than stored as a full report for every filter.
 
+Most of a large run is its query index, `query-index.v1.bin`: on a suite of
+about 400 tests with per-test evidence, 160 MB of a 216 MB run, beside 58 MB of
+evidence. The index is a cache. Supercov builds it again from the evidence the
+first time the run is queried without it, so a CI job that keeps runs as an
+artifact can leave it out:
+
+```sh supercov-example
+tar czf supercov-runs.tgz --exclude 'query-index.v1.bin' .supercov/runs
+```
+
+A merged run holds a copy of each run's evidence and an index of its own, so
+merging adds about as much again. To hand a run to a reviewer, the HTML report
+(`npx supercov report`) is usually the smaller artifact.
+
 The isolated workspace may be larger because it can contain an instrumented
 build cache. Supercov does not delete history in the background.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -83,7 +83,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/background-by-time.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +120,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.6.0",
-    "@supercov/cli-darwin-x64": "4.6.0",
-    "@supercov/cli-linux-arm64-gnu": "4.6.0",
-    "@supercov/cli-linux-arm64-musl": "4.6.0",
-    "@supercov/cli-linux-x64-gnu": "4.6.0",
-    "@supercov/cli-linux-x64-musl": "4.6.0",
-    "@supercov/cli-win32-arm64": "4.6.0",
-    "@supercov/cli-win32-x64": "4.6.0"
+    "@supercov/cli-darwin-arm64": "4.8.0",
+    "@supercov/cli-darwin-x64": "4.8.0",
+    "@supercov/cli-linux-arm64-gnu": "4.8.0",
+    "@supercov/cli-linux-arm64-musl": "4.8.0",
+    "@supercov/cli-linux-x64-gnu": "4.8.0",
+    "@supercov/cli-linux-x64-musl": "4.8.0",
+    "@supercov/cli-win32-arm64": "4.8.0",
+    "@supercov/cli-win32-x64": "4.8.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -18,7 +18,7 @@ import * as standardPlaywright from "@playwright/test";
 import * as coverageRuntime from "./runtime.mjs";
 import { inferTestProvenance } from "./provenance.mjs";
 import { appendJsonLineDurableSync, appendJsonLineSync } from "./atomic.mjs";
-import { COVERAGE_PHASE_HEADER, COVERAGE_PHASE_COOKIE, COVERAGE_SCOPE_COOKIE, COVERAGE_SCOPE_HEADER, COVERAGE_CARRIER_ENV, encodeCoverageCarrier, encodeCoverageScope, serverEvidenceDirectory, serverEvidencePath, } from "./transport.mjs";
+import { COVERAGE_PHASE_HEADER, COVERAGE_PHASE_COOKIE, COVERAGE_PHASE_SITE_COOKIE, COVERAGE_SCOPE_COOKIE, COVERAGE_SCOPE_HEADER, COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_CARRIER_ENV, encodeCoverageCarrier, encodeCoverageScope, serverEvidenceDirectory, serverEvidencePath, } from "./transport.mjs";
 export * from "@playwright/test";
 const generatedTargetModule = "__SUPERCOV_PLAYWRIGHT_MODULE__";
 const targetModule = process.env["SUPERCOV_PLAYWRIGHT_MODULE"] ??
@@ -236,9 +236,21 @@ class CoveragePhaseController {
     // Parameter properties are stateful despite the base ESLint rule treating
     // this as an empty constructor.
     // eslint-disable-next-line no-useless-constructor
-    constructor(scope, configuredHeaders = {}) {
+    constructor(scope, configuredHeaders = {}, baseURL) {
         this.scope = scope;
         this.configuredHeaders = configuredHeaders;
+        // Where the app under test is served: the project's base URL, and the
+        // local hosts a web server listens on. A cookie is kept per host, for
+        // every port of it.
+        const hosts = ["http://localhost/", "http://127.0.0.1/"];
+        try {
+            if (baseURL)
+                hosts.unshift(new URL("/", baseURL).href);
+        }
+        catch {
+            // A base URL Playwright itself would refuse.
+        }
+        this.appHosts = [...new Set(hosts)];
     }
     allPages() {
         return [...this.pages];
@@ -446,17 +458,34 @@ class CoveragePhaseController {
         // own attempt, so the newest wins; the fetch patch is installed once
         // and reads the attempt at call time, so a stale copy can never pin an
         // old scope onto a request the way nested wrappers would.
-        await context.addInitScript(({ attemptId, scopeHeader, scopeValue, scopeCookie }) => {
+        await context.addInitScript(({ attemptId, scopeHeader, scopeValue, scopeCookie, scopeSiteCookie }) => {
             const coverageGlobal = globalThis;
             coverageGlobal.__SUPERCOV_ATTEMPT__ = { attemptId, scopeValue };
             coverageGlobal.__SUPERCOV_MCDC_TEST_ID__ = attemptId;
             try {
                 document.cookie = `${scopeCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=Lax`;
+                // And for this document's frames on another of the app's
+                // hosts, where crossing sites is allowed.
+                if (globalThis.isSecureContext)
+                    document.cookie = `${scopeSiteCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=None; Secure`;
                 if (!coverageGlobal.__SUPERCOV_BROWSER_FETCH_PATCHED__) {
                     const originalFetch = globalThis.fetch?.bind(globalThis);
                     if (originalFetch) {
                         coverageGlobal.__SUPERCOV_BROWSER_FETCH_PATCHED__ = true;
                         globalThis.fetch = ((input, init) => {
+                            // Only the page's own origin hears the scope. A
+                            // header on a request to another origin makes the
+                            // browser ask that origin first, and one that
+                            // allows only the headers it uses refuses: the
+                            // page's fetch failed under measurement alone.
+                            try {
+                                const target = new URL(input instanceof Request ? input.url : String(input), location.href);
+                                if (target.origin !== location.origin)
+                                    return originalFetch(input, init);
+                            }
+                            catch {
+                                return originalFetch(input, init);
+                            }
                             const headers = new Headers(init?.headers ??
                                 (input instanceof Request ? input.headers : undefined));
                             headers.set(scopeHeader, coverageGlobal.__SUPERCOV_ATTEMPT__?.scopeValue ?? scopeValue);
@@ -476,6 +505,7 @@ class CoveragePhaseController {
             scopeHeader: COVERAGE_SCOPE_HEADER,
             scopeValue: encodeCoverageScope(this.scope),
             scopeCookie: COVERAGE_SCOPE_COOKIE,
+            scopeSiteCookie: COVERAGE_SCOPE_SITE_COOKIE,
         }).catch(() => undefined);
         const register = (page) => {
             const pending = this.registerPage(page).finally(() => this.pendingRegistrations.delete(pending));
@@ -513,6 +543,16 @@ class CoveragePhaseController {
             if (!originalFetch)
                 return answer;
             globalThis.fetch = ((input, init) => {
+                // As in a page: another origin would be asked first, and may
+                // refuse a header it does not expect.
+                try {
+                    const target = new URL(input instanceof Request ? input.url : String(input), globalThis.location.href);
+                    if (target.origin !== globalThis.location.origin)
+                        return originalFetch(input, init);
+                }
+                catch {
+                    return originalFetch(input, init);
+                }
                 const headers = new Headers(init?.headers ??
                     (input instanceof Request ? input.headers : undefined));
                 headers.set(scopeHeader, scopeValue);
@@ -705,13 +745,10 @@ class CoveragePhaseController {
         const options = scoped[0] && typeof scoped[0] === "object"
             ? scoped[0]
             : {};
-        scoped[0] = {
-            ...options,
-            extraHTTPHeaders: {
-                ...(options.extraHTTPHeaders ?? {}),
-                ...(activeCoverageHeaders() ?? {}),
-            },
-        };
+        // The scope reaches the app in cookies once the context is
+        // registered (`updateContextHeaders`); headers on the context would
+        // go to every origin the page fetches from.
+        scoped[0] = { ...options };
         return scoped;
     }
     /**
@@ -734,7 +771,7 @@ class CoveragePhaseController {
     }
     async activateFrames(phaseId) {
         await timed("activate.frameEvaluate", () => Promise.all([...this.pages].flatMap((page) => page.frames()).map((frame) => frame
-            .evaluate(({ id, attemptId, storageKey, scopeCookie, scopeValue, phaseCookie }) => {
+            .evaluate(({ id, attemptId, storageKey, scopeCookie, scopeValue, phaseCookie, scopeSiteCookie, phaseSiteCookie }) => {
             globalThis.__SUPERCOV_PHASE_ID__ = id;
             const coverageGlobal = globalThis;
             // A document that loaded under an earlier test's attempt (a page
@@ -746,6 +783,10 @@ class CoveragePhaseController {
                 localStorage.setItem(storageKey, id);
                 document.cookie = `${scopeCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=Lax`;
                 document.cookie = `${phaseCookie}=${encodeURIComponent(id)}; Path=/; SameSite=Lax`;
+                if (globalThis.isSecureContext) {
+                    document.cookie = `${scopeSiteCookie}=${encodeURIComponent(scopeValue)}; Path=/; SameSite=None; Secure`;
+                    document.cookie = `${phaseSiteCookie}=${encodeURIComponent(id)}; Path=/; SameSite=None; Secure`;
+                }
             }
             catch {
                 // Sandboxed/cross-origin frames may not expose localStorage.
@@ -757,6 +798,8 @@ class CoveragePhaseController {
             scopeCookie: COVERAGE_SCOPE_COOKIE,
             scopeValue: encodeCoverageScope(this.scope),
             phaseCookie: COVERAGE_PHASE_COOKIE,
+            scopeSiteCookie: COVERAGE_SCOPE_SITE_COOKIE,
+            phaseSiteCookie: COVERAGE_PHASE_SITE_COOKIE,
         })
             .catch(() => undefined))));
     }
@@ -779,14 +822,43 @@ class CoveragePhaseController {
                 this.unresponsiveWorkers.add(worker);
         })));
     }
+    /**
+     * Tell the app which test and phase its requests belong to, in cookies on
+     * the app's hosts. Headers set on the context went with every request the
+     * browser made, to any origin, and a header on a request to another
+     * origin makes the browser ask that origin first: one that allows only the
+     * headers it uses refused, and the page's request failed under
+     * measurement alone. A cookie never does. The page sends it to its own
+     * site from the first navigation on, and, on a secure origin, to frames
+     * of the app's other hosts as well.
+     */
     async updateContextHeaders(context, phaseId) {
-        await context
-            .setExtraHTTPHeaders({
-            ...(this.contextConfiguredHeaders.get(context) ?? this.configuredHeaders),
-            [COVERAGE_SCOPE_HEADER]: encodeCoverageScope(this.scope),
-            ...(phaseId ? { [COVERAGE_PHASE_HEADER]: phaseId } : {}),
-        })
-            .catch(() => undefined);
+        const scope = encodeURIComponent(encodeCoverageScope(this.scope));
+        const phase = phaseId ? encodeURIComponent(phaseId) : undefined;
+        const pairs = (scopeName, phaseName) => [
+            [scopeName, scope],
+            ...(phase ? [[phaseName, phase]] : []),
+        ];
+        await Promise.all([
+            // The context's own headers are the owner's, unchanged.
+            context
+                .setExtraHTTPHeaders(this.contextConfiguredHeaders.get(context) ?? this.configuredHeaders)
+                .catch(() => undefined),
+            ...this.appHosts.map((url) => {
+                const host = new URL(url);
+                // For the app's own site: requests, navigations and sockets.
+                const cookies = pairs(COVERAGE_SCOPE_COOKIE, COVERAGE_PHASE_COOKIE).map(([name, value]) => ({ name, value, url, sameSite: "Lax" }));
+                // For its frames on another of its hosts: a cookie that
+                // crosses sites must be Secure, which needs https or a local
+                // host. Chromium keeps such a cookie only when it is given by
+                // domain; given by an http URL it is dropped without a word.
+                if (host.protocol === "https:" || ["localhost", "127.0.0.1"].includes(host.hostname)) {
+                    cookies.push(...pairs(COVERAGE_SCOPE_SITE_COOKIE, COVERAGE_PHASE_SITE_COOKIE).map(([name, value]) => ({ name, value, domain: host.hostname, path: "/", sameSite: "None", secure: true })));
+                }
+                // One host refused leaves the others theirs.
+                return context.addCookies(cookies).catch(() => undefined);
+            }),
+        ]);
     }
     async activatePage(page, phaseId) {
         const cdp = this.cdpSessions.get(page);
@@ -1352,7 +1424,7 @@ const instrumentedFixtures = {
         async ({}, use, testInfo) => {
             const scope = executionScope(testInfo);
             const configuredHeaders = Object.fromEntries(Object.entries(testInfo.project.use.extraHTTPHeaders ?? {}).map(([name, value]) => [name, String(value)]));
-            const controller = new CoveragePhaseController(scope, configuredHeaders);
+            const controller = new CoveragePhaseController(scope, configuredHeaders, testInfo.project.use.baseURL);
             controllers.set(scope.attemptId, controller);
             activeController = controller;
             directRuntime()?.activateCoverageScope(scope);

package/runtime/javascript/runtime.mjs

@@ -34,6 +34,8 @@ var COVERAGE_SCOPE_HEADER = "x-supercov-scope";
 var COVERAGE_PHASE_HEADER = "x-supercov-phase";
 var COVERAGE_SCOPE_COOKIE = "__supercov_scope";
 var COVERAGE_PHASE_COOKIE = "__supercov_phase";
+var COVERAGE_SCOPE_SITE_COOKIE = "__supercov_scope_site";
+var COVERAGE_PHASE_SITE_COOKIE = "__supercov_phase_site";
 var COVERAGE_CARRIER_ENV = "SUPERCOV_CONTEXT";
 var DEFAULT_SERVER_EVIDENCE_ROOT = "/tmp/supercov-server-evidence";
 function configuredServerEvidenceRoot() {
@@ -459,7 +461,16 @@ function attemptKey(scope) {
 function serverRecordKey(record) {
   var _a8;
   const suffix = record.type === "decision" ? `${record.meta.id}:${vectorKey(record.vector)}` : record.id;
-  return `${(_a8 = record.phaseId) != null ? _a8 : "unscoped"}:${record.type}:${suffix}`;
+  // Each request that names no test keeps its own first hits: the report
+  // credits them to the test running when it came, and a later request's
+  // work belongs to whichever test was running then.
+  const request = record.request ? `request-${record.request}:` : "";
+  return `${request}${(_a8 = record.phaseId) != null ? _a8 : "unscoped"}:${record.type}:${suffix}`;
+}
+// Numbers the requests a server handles that name no test.
+function nextUnscopedRequest() {
+  state.unscopedRequests = (state.unscopedRequests || 0) + 1;
+  return state.unscopedRequests;
 }
 function beginBufferedServerEvidence(scope) {
   if (isBrowser)
@@ -792,7 +803,11 @@ function appendServer(record) {
   try {
     const directory = scope ? serverEvidenceDirectory(scope) : void 0;
     const path = scope ? serverEvidencePath(scope) : void 0;
-    const serialized = __spreadValues(__spreadValues({}, record), scope ? { scope } : {});
+    // Work done while handling a request that named no test -- a webhook a
+    // mock server sends -- says so, with the request's number.
+    const stored = serverPhaseStorage == null ? void 0 : serverPhaseStorage.getStore();
+    const unscopedRequest = !scope && stored && stored.request ? { request: stored.request } : {};
+    const serialized = __spreadValues(__spreadValues(__spreadValues({}, record), scope ? { scope } : {}), unscopedRequest);
     if (scope && state.bufferedAttempts.has(attemptKey(scope))) {
       const key = attemptKey(scope);
       const buffered = (_c = state.serverBuffers.get(key)) != null ? _c : {
@@ -1345,8 +1360,10 @@ function requestCoverageContext(value) {
       }
     }
   }
-  const encodedScope = (_a8 = headers.get(COVERAGE_SCOPE_HEADER)) != null ? _a8 : cookies.get(COVERAGE_SCOPE_COOKIE);
-  const rawPhaseId = (_b = headers.get(COVERAGE_PHASE_HEADER)) != null ? _b : cookies.get(COVERAGE_PHASE_COOKIE);
+  // A frame of the app on another of its hosts carries only the cookies
+  // made to cross sites.
+  const encodedScope = (_a8 = headers.get(COVERAGE_SCOPE_HEADER)) != null ? _a8 : cookies.has(COVERAGE_SCOPE_COOKIE) ? cookies.get(COVERAGE_SCOPE_COOKIE) : cookies.get(COVERAGE_SCOPE_SITE_COOKIE);
+  const rawPhaseId = (_b = headers.get(COVERAGE_PHASE_HEADER)) != null ? _b : cookies.has(COVERAGE_PHASE_COOKIE) ? cookies.get(COVERAGE_PHASE_COOKIE) : cookies.get(COVERAGE_PHASE_SITE_COOKIE);
   const scope = decodeCoverageScope(typeof encodedScope === "string" ? encodedScope : void 0);
   // The phase cookie outlives a test in a shared browser context just like
   // the stored phase does (see currentPhaseId); a request carrying a scope
@@ -1383,9 +1400,24 @@ function installNodeRequestPropagation() {
       // the server process were created by a shared before hook.
       const incoming = requestCoverageContext(args[0]);
       if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
+      // A request that names no test, to a server no test owns, is numbered:
+      // the report credits its work to the test running when it came.
+      if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
+        context = { request: nextUnscopedRequest() };
+      // Node emits a request's body and its response's events outside the
+      // handler's context, so a handler that reads the body -- `req.on('end')`
+      // -- ran as no test's. The request and response carry it with them.
+      if (incoming && context) {
+        for (const emitter of args.slice(0, 2)) {
+          if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
+            emitterCoverageContexts.set(emitter, context);
+        }
+      }
     }
     const invoke = () => Reflect.apply(original, this, [event, ...args]);
     try {
+      if (context && context.request && !context.scope)
+        return serverPhaseStorage.run(context, () => withProbeV2Context(context, invoke));
       return context ? withCoverageCarrier({ version: 1, ...context }, invoke) : invoke();
     } finally {
       if (event === "close") emitterCoverageContexts.delete(this);
@@ -1406,6 +1438,8 @@ function withRequestPhase(handler, event) {
     // owner. Shared servers have no captured test scope and stay unattributed.
     const inheritedContext = requestContext && requestContext.scope ? {} : registeredContext.scope ? registeredContext : requestContext === void 0 ? currentRequestContext() : {};
     const context = __spreadValues(__spreadValues({}, ((_a8 = requestContext == null ? void 0 : requestContext.scope) != null ? _a8 : inheritedContext.scope) ? { scope: (_b = requestContext == null ? void 0 : requestContext.scope) != null ? _b : inheritedContext.scope } : {}), ((_c = requestContext == null ? void 0 : requestContext.phaseId) != null ? _c : inheritedContext.phaseId) ? { phaseId: (_d = requestContext == null ? void 0 : requestContext.phaseId) != null ? _d : inheritedContext.phaseId } : {});
+    if (requestContext !== void 0 && !context.scope)
+      context.request = nextUnscopedRequest();
     const invoke = () => {
       if (event === "connection" && context.scope && args[0] &&
           typeof args[0] === "object" && typeof args[0].emit === "function")

package/runtime/javascript/transport.mjs

@@ -2,6 +2,11 @@ export const COVERAGE_SCOPE_HEADER = "x-supercov-scope";
 export const COVERAGE_PHASE_HEADER = "x-supercov-phase";
 export const COVERAGE_SCOPE_COOKIE = "__supercov_scope";
 export const COVERAGE_PHASE_COOKIE = "__supercov_phase";
+// The same, for frames of the app on another of its hosts: a cookie that
+// crosses sites must be Secure, and a Secure cookie is not sent over ws://,
+// so the two cannot be one.
+export const COVERAGE_SCOPE_SITE_COOKIE = "__supercov_scope_site";
+export const COVERAGE_PHASE_SITE_COOKIE = "__supercov_phase_site";
 export const COVERAGE_CARRIER_ENV = "SUPERCOV_CONTEXT";
 export const DEFAULT_SERVER_EVIDENCE_ROOT = "/tmp/supercov-server-evidence";
 // Buffer as it was when Supercov loaded. Tests replace globals -- axios's set