supercov 4.7.0 → 4.8.0

package/docs/coverage-model.md

@@ -96,7 +96,16 @@ Both are useful:
 
 Code that runs while no test is running counts in the run's total and in no
 test's: a server starting before the first test, modules loading, work between
-tests. When a run has any, the summary's `By test kind` table ends with a
+tests.
+
+A request to your app server that names no test -- a webhook from a mock
+Stripe server Supercov does not measure -- is credited to the test running when
+the server handled it, if that test was the only one running then. A mock that
+runs under Supercov passes the test's identity on in its own requests, and its
+webhook is credited exactly. The run's
+`Attribution` line counts those tests as `with server work credited by time`,
+and each one's `runs <id> test` page says so. Work done while tests ran at
+once, or while none ran, stays no test's. When a run has any, the summary's `By test kind` table ends with a
 `no test` row for what only that covered, which is why a run with one kind of
 test can show a total above that kind's own:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.7.0",
+  "version": "4.8.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -83,7 +83,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/background-by-time.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +120,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.7.0",
-    "@supercov/cli-darwin-x64": "4.7.0",
-    "@supercov/cli-linux-arm64-gnu": "4.7.0",
-    "@supercov/cli-linux-arm64-musl": "4.7.0",
-    "@supercov/cli-linux-x64-gnu": "4.7.0",
-    "@supercov/cli-linux-x64-musl": "4.7.0",
-    "@supercov/cli-win32-arm64": "4.7.0",
-    "@supercov/cli-win32-x64": "4.7.0"
+    "@supercov/cli-darwin-arm64": "4.8.0",
+    "@supercov/cli-darwin-x64": "4.8.0",
+    "@supercov/cli-linux-arm64-gnu": "4.8.0",
+    "@supercov/cli-linux-arm64-musl": "4.8.0",
+    "@supercov/cli-linux-x64-gnu": "4.8.0",
+    "@supercov/cli-linux-x64-musl": "4.8.0",
+    "@supercov/cli-win32-arm64": "4.8.0",
+    "@supercov/cli-win32-x64": "4.8.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/runtime.mjs

@@ -461,7 +461,16 @@ function attemptKey(scope) {
 function serverRecordKey(record) {
   var _a8;
   const suffix = record.type === "decision" ? `${record.meta.id}:${vectorKey(record.vector)}` : record.id;
-  return `${(_a8 = record.phaseId) != null ? _a8 : "unscoped"}:${record.type}:${suffix}`;
+  // Each request that names no test keeps its own first hits: the report
+  // credits them to the test running when it came, and a later request's
+  // work belongs to whichever test was running then.
+  const request = record.request ? `request-${record.request}:` : "";
+  return `${request}${(_a8 = record.phaseId) != null ? _a8 : "unscoped"}:${record.type}:${suffix}`;
+}
+// Numbers the requests a server handles that name no test.
+function nextUnscopedRequest() {
+  state.unscopedRequests = (state.unscopedRequests || 0) + 1;
+  return state.unscopedRequests;
 }
 function beginBufferedServerEvidence(scope) {
   if (isBrowser)
@@ -794,7 +803,11 @@ function appendServer(record) {
   try {
     const directory = scope ? serverEvidenceDirectory(scope) : void 0;
     const path = scope ? serverEvidencePath(scope) : void 0;
-    const serialized = __spreadValues(__spreadValues({}, record), scope ? { scope } : {});
+    // Work done while handling a request that named no test -- a webhook a
+    // mock server sends -- says so, with the request's number.
+    const stored = serverPhaseStorage == null ? void 0 : serverPhaseStorage.getStore();
+    const unscopedRequest = !scope && stored && stored.request ? { request: stored.request } : {};
+    const serialized = __spreadValues(__spreadValues(__spreadValues({}, record), scope ? { scope } : {}), unscopedRequest);
     if (scope && state.bufferedAttempts.has(attemptKey(scope))) {
       const key = attemptKey(scope);
       const buffered = (_c = state.serverBuffers.get(key)) != null ? _c : {
@@ -1387,9 +1400,24 @@ function installNodeRequestPropagation() {
       // the server process were created by a shared before hook.
       const incoming = requestCoverageContext(args[0]);
       if (incoming) context = incoming.scope ? incoming : context != null ? context : currentRequestContext();
+      // A request that names no test, to a server no test owns, is numbered:
+      // the report credits its work to the test running when it came.
+      if (incoming && serverPhaseStorage && !(context && (context.scope || context.phaseId)))
+        context = { request: nextUnscopedRequest() };
+      // Node emits a request's body and its response's events outside the
+      // handler's context, so a handler that reads the body -- `req.on('end')`
+      // -- ran as no test's. The request and response carry it with them.
+      if (incoming && context) {
+        for (const emitter of args.slice(0, 2)) {
+          if (emitter && typeof emitter === "object" && typeof emitter.emit === "function")
+            emitterCoverageContexts.set(emitter, context);
+        }
+      }
     }
     const invoke = () => Reflect.apply(original, this, [event, ...args]);
     try {
+      if (context && context.request && !context.scope)
+        return serverPhaseStorage.run(context, () => withProbeV2Context(context, invoke));
       return context ? withCoverageCarrier({ version: 1, ...context }, invoke) : invoke();
     } finally {
       if (event === "close") emitterCoverageContexts.delete(this);
@@ -1410,6 +1438,8 @@ function withRequestPhase(handler, event) {
     // owner. Shared servers have no captured test scope and stay unattributed.
     const inheritedContext = requestContext && requestContext.scope ? {} : registeredContext.scope ? registeredContext : requestContext === void 0 ? currentRequestContext() : {};
     const context = __spreadValues(__spreadValues({}, ((_a8 = requestContext == null ? void 0 : requestContext.scope) != null ? _a8 : inheritedContext.scope) ? { scope: (_b = requestContext == null ? void 0 : requestContext.scope) != null ? _b : inheritedContext.scope } : {}), ((_c = requestContext == null ? void 0 : requestContext.phaseId) != null ? _c : inheritedContext.phaseId) ? { phaseId: (_d = requestContext == null ? void 0 : requestContext.phaseId) != null ? _d : inheritedContext.phaseId } : {});
+    if (requestContext !== void 0 && !context.scope)
+      context.request = nextUnscopedRequest();
     const invoke = () => {
       if (event === "connection" && context.scope && args[0] &&
           typeof args[0] === "object" && typeof args[0].emit === "function")