supercov 4.9.0 → 4.10.1

package/docs/supported-suites.md

@@ -429,13 +429,25 @@ server is built from that copy. Go has no per-request context Supercov can
 carry a test's name in to every probe, so the server sweeps what ran every
 5 ms, and each sweep is credited to the browser test that was running then,
 if only one was, and said to be. Work done while two tests ran at once, as
-with parallel workers, is the run's and no test's. The server's coverage is a
+with parallel workers, is the run's and no test's; the run says how many tests
+that left without their server work, and `--workers=1` gives each test its
+own. The server's coverage is a
 Go run of its own, published as the run or beside the browser run, as for a
 [Python server](#a-python-server-under-browser-tests).
 
 A server binary built before the run is not the one Supercov instruments:
 start it with `go run`, or build it in the test command.
 
+### A Java or Kotlin server under browser tests
+
+A Playwright suite whose server is built by its own command (`./gradlew
+bootRun`, `mvn spring-boot:run`, or `javac` and `java`) measures it the way it
+measures a [Go server](#a-go-server-under-browser-tests): the copy's Java and
+Kotlin are rewritten with probes, the runtime goes in each module's main
+source set, and what the server ran is swept every 5 ms and credited by time
+to the browser test running then, if only one was. A jar built before the run
+is not the one Supercov instruments.
+
 ```sh
 npx supercov -- npx playwright test
 ```

package/docs/workspace-isolation.md

@@ -85,6 +85,16 @@ When a run fails in a project that has a `build` script the command does not
 reach, it says this. `SUPERCOV_KEEP_WORKSPACE=1` leaves the instrumented copy
 in `.supercov/workspaces/` after a run, to inspect.
 
+A package inside a larger git repository (`web/` beside `cmd/`, or
+`packages/app` in a monorepo) is copied alone, but the copy sits at the
+package's path in the repository, with the repository's other files and
+directories linked beside it from your checkout. A suite that reaches outside
+the package, a `webServer` running `go run ../cmd/testserver` or a tsconfig
+extending `../../tsconfig.base.json`, finds them where it finds them without
+Supercov. They are your checkout's own files, not copies, and they are not
+measured; the repository's `.git` and lockfiles are never linked. To measure code outside the
+package too, run Supercov from the repository root.
+
 ## Files Supercov creates
 
 | Location | What it is for |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.9.0",
+  "version": "4.10.1",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -83,7 +83,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +120,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.9.0",
-    "@supercov/cli-darwin-x64": "4.9.0",
-    "@supercov/cli-linux-arm64-gnu": "4.9.0",
-    "@supercov/cli-linux-arm64-musl": "4.9.0",
-    "@supercov/cli-linux-x64-gnu": "4.9.0",
-    "@supercov/cli-linux-x64-musl": "4.9.0",
-    "@supercov/cli-win32-arm64": "4.9.0",
-    "@supercov/cli-win32-x64": "4.9.0"
+    "@supercov/cli-darwin-arm64": "4.10.1",
+    "@supercov/cli-darwin-x64": "4.10.1",
+    "@supercov/cli-linux-arm64-gnu": "4.10.1",
+    "@supercov/cli-linux-arm64-musl": "4.10.1",
+    "@supercov/cli-linux-x64-gnu": "4.10.1",
+    "@supercov/cli-linux-x64-musl": "4.10.1",
+    "@supercov/cli-win32-arm64": "4.10.1",
+    "@supercov/cli-win32-x64": "4.10.1"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/playwright.mjs

@@ -216,6 +216,9 @@ class CoveragePhaseController {
     // fixture override tears down before the collector's own fixture, and a
     // closed page cannot be evaluated, so the evidence is taken on the way out.
     earlySnapshots = [];
+    // Evidence documents gave as they left (`__supercovLeaving`), merged with
+    // the rest when there is any.
+    leftSnapshots = [];
     snapshottedPages = new WeakSet();
     snapshottedWorkers = new WeakSet();
     // Workers that did not answer an evaluation in time. They are not waited
@@ -279,8 +282,10 @@ class CoveragePhaseController {
             if (snapshot)
                 snapshots.push(snapshot);
         }
-        this.runtimeSnapshots = snapshots;
-        return snapshots;
+        this.runtimeSnapshots = this.leftSnapshots.length > 0
+            ? [mergeSnapshots([...this.leftSnapshots, ...snapshots])]
+            : snapshots;
+        return this.runtimeSnapshots;
     }
     /**
      * A worker's evidence, or nothing when it cannot be read. A worker that
@@ -291,20 +296,15 @@ class CoveragePhaseController {
         if (this.workersWithoutRuntime.has(worker)) {
             // Asked once more, without waiting: it may have loaded an
             // instrumented script since it was registered.
-            const answer = await bounded(worker
-                .evaluate(() => globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__?.())
-                .catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
+            const answer = await bounded(readSnapshot(worker).catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
             if (answer && answer !== WORKER_TIMED_OUT) {
                 this.snapshottedWorkers.add(worker);
                 return answer;
             }
             return undefined;
         }
-        const answer = await bounded(worker
-            .evaluate(() => {
-            const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
-            return getSnapshot?.() ?? { decisions: [], hits: [], events: [] };
-        })
+        const answer = await bounded(readSnapshot(worker)
+            .then((snapshot) => snapshot ?? { decisions: [], hits: [], events: [] })
             .catch(() => undefined), WORKER_SNAPSHOT_WAIT_MS);
         if (answer === WORKER_TIMED_OUT) {
             this.unresponsiveWorkers.add(worker);
@@ -335,11 +335,11 @@ class CoveragePhaseController {
                 .evaluate(({ token, url }) => {
                 const entries = globalThis.__SUPERCOV_WORKER_EVIDENCE__?.() ?? [];
                 const byToken = token ? entries.find((entry) => entry.token === token) : undefined;
-                if (byToken)
-                    return byToken;
                 const byUrl = entries.filter((entry) => entry.url === url);
-                return byUrl.length === 1 ? byUrl[0] : undefined;
+                const found = byToken ?? (byUrl.length === 1 ? byUrl[0] : undefined);
+                return found ? JSON.stringify(found) : undefined;
             }, { token, url })
+                .then((text) => (typeof text === "string" ? JSON.parse(text) : undefined))
                 .catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
             if (pushed && pushed !== WORKER_TIMED_OUT)
                 return pushed;
@@ -349,11 +349,8 @@ class CoveragePhaseController {
     async snapshotPage(page) {
         const snapshots = [];
         for (const frame of page.frames()) {
-            snapshots.push(await frame
-                .evaluate(() => {
-                const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
-                return getSnapshot?.() ?? { decisions: [], hits: [], events: [] };
-            })
+            snapshots.push(await readSnapshot(frame)
+                .then((snapshot) => snapshot ?? { decisions: [], hits: [], events: [] })
                 .catch(() => ({
                 decisions: [],
                 hits: [],
@@ -432,6 +429,20 @@ class CoveragePhaseController {
             // learned its phase only from the next action, after it had
             // loaded, and everything it ran while loading was placed by time.
             await cdp.send("Page.enable").catch(() => undefined);
+            // A document that leaves hands its evidence over here: the
+            // next one reads what it stored only on the same origin.
+            cdp.on("Runtime.bindingCalled", ({ name, payload }) => {
+                if (name !== LEAVING_BINDING || this.runtimeSnapshots)
+                    return;
+                try {
+                    this.leftSnapshots.push(JSON.parse(payload));
+                }
+                catch {
+                    // Not evidence.
+                }
+            });
+            await cdp.send("Runtime.enable").catch(() => undefined);
+            await cdp.send("Runtime.addBinding", { name: LEAVING_BINDING }).catch(() => undefined);
             this.cdpSessions.set(page, cdp);
         }
         const phaseId = this.requestPhaseId();
@@ -883,6 +894,63 @@ class CoveragePhaseController {
         await this.scriptUpdate.catch(() => undefined);
     }
 }
+/**
+ * A page's or worker's evidence. It holds an event for every hit of every
+ * phase, tens of thousands of objects on a large frontend, and Playwright
+ * returns an object value by value: reading it took half a second a page at
+ * the end of every test (20,000 events: 470 ms, against 34 ms as one JSON
+ * string), and doubled a 76-test suite's time.
+ */
+const LEAVING_BINDING = "__supercovLeaving";
+/**
+ * One snapshot holding everything in `snapshots`, each observation once: a
+ * document that left gave its evidence, and the next one on its origin
+ * restored the same evidence and added to it.
+ */
+function mergeSnapshots(snapshots) {
+    const hits = new Set();
+    const events = new Map();
+    const decisions = new Map();
+    const logicals = new Map();
+    const vectorsOf = (map, key, initial) => {
+        let entry = map.get(key);
+        if (!entry) {
+            entry = { ...initial, seen: new Map() };
+            map.set(key, entry);
+        }
+        return entry;
+    };
+    for (const snapshot of snapshots) {
+        for (const id of snapshot?.hits ?? [])
+            hits.add(id);
+        for (const event of snapshot?.events ?? [])
+            events.set(JSON.stringify(event), event);
+        for (const decision of snapshot?.decisions ?? []) {
+            const entry = vectorsOf(decisions, decision.meta?.id, { meta: decision.meta });
+            for (const vector of decision.vectors ?? [])
+                entry.seen.set(JSON.stringify(vector), vector);
+        }
+        for (const logical of snapshot?.logicals ?? []) {
+            const entry = vectorsOf(logicals, logical.id, { id: logical.id });
+            for (const vector of logical.vectors ?? [])
+                entry.seen.set(JSON.stringify(vector), vector);
+        }
+    }
+    return {
+        decisions: [...decisions.values()].map(({ seen, meta }) => ({ meta, vectors: [...seen.values()] })),
+        hits: [...hits],
+        events: [...events.values()],
+        logicals: [...logicals.values()].map(({ seen, id }) => ({ id, vectors: [...seen.values()] })),
+    };
+}
+function readSnapshot(target) {
+    return target
+        .evaluate(() => {
+        const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
+        return getSnapshot ? JSON.stringify(getSnapshot()) : undefined;
+    })
+        .then((text) => (typeof text === "string" ? JSON.parse(text) : undefined));
+}
 let activeController;
 let bridgedAssertionDepth = 0;
 const controllers = new Map();

package/runtime/javascript/runtime.mjs

@@ -25,9 +25,6 @@ var __spreadProps = (a, b) => __spreadValues(a, b);
 // `globalThis.Buffer = undefined` to check it copes -- and the runtime runs
 // inside those tests; it must not fail where the application does not.
 var capturedBuffer = typeof Buffer === "undefined" ? void 0 : Buffer;
-// Likewise the timer: a test that installs fake timers would otherwise hold
-// the browser's evidence back until it advanced its clock.
-var capturedSetTimeout = setTimeout;
 
 // dist/transport.js
 var COVERAGE_SCOPE_HEADER = "x-supercov-scope";
@@ -419,7 +416,6 @@ function pushWorkerEvidence() {
   }
   runtimeGlobal.__SUPERCOV_WORKER_EVIDENCE__ = () => Array.from(received, ([token, pushed]) => ({ token, url: pushed.url, current: pushed.current, snapshot: pushed.snapshot }));
 })();
-var persistBrowserScheduled = false;
 var persistBrowserListenersInstalled = false;
 function persistBrowserNow() {
   if (!isBrowser)
@@ -429,31 +425,44 @@ function persistBrowserNow() {
   } catch (e) {
   }
 }
+// The Playwright collector's binding takes the evidence of a document that
+// is about to leave. localStorage gives it to the next document only on the
+// same origin: a click that sent the page to another one (an admin's
+// masquerade link, a sign-in redirect) lost every hit it made. Called from
+// `pagehide` the binding never reached the collector; from `beforeunload`
+// it does.
+function handOverBrowser() {
+  try {
+    if (typeof runtimeGlobal.__supercovLeaving === "function")
+      runtimeGlobal.__supercovLeaving(JSON.stringify(coverageSnapshot()));
+  } catch (e) {
+  }
+}
 function persistBrowser() {
   if (!isBrowser)
     return;
-  // Persistence exists so evidence survives navigation, not to mirror every
-  // event: serializing the whole snapshot per event is quadratic in a
-  // render burst. Coalesce to one write per macrotask and flush when the
-  // page is actually leaving.
-  if (!persistBrowserListenersInstalled) {
-    persistBrowserListenersInstalled = true;
-    try {
-      addEventListener("pagehide", persistBrowserNow);
-      addEventListener("visibilitychange", () => {
-        if (typeof document !== "undefined" && document.visibilityState === "hidden")
-          persistBrowserNow();
-      });
-    } catch (e) {
-    }
-  }
-  if (persistBrowserScheduled)
+  // Persistence exists so evidence survives navigation, so it is written
+  // when the page leaves. Written after every macrotask that recorded
+  // anything, the whole snapshot was serialized again and again: a large
+  // instrumented frontend doubled a Playwright suite's time. A page the
+  // test closes is read by the collector before it closes.
+  if (persistBrowserListenersInstalled)
     return;
-  persistBrowserScheduled = true;
-  capturedSetTimeout(() => {
-    persistBrowserScheduled = false;
-    persistBrowserNow();
-  }, 0);
+  persistBrowserListenersInstalled = true;
+  try {
+    // `beforeunload` fires inside the assignment that starts the navigation,
+    // and the rest of that handler runs after it, before the document goes.
+    addEventListener("beforeunload", () => {
+      handOverBrowser();
+      Promise.resolve().then(handOverBrowser);
+    });
+    addEventListener("pagehide", persistBrowserNow);
+    addEventListener("visibilitychange", () => {
+      if (typeof document !== "undefined" && document.visibilityState === "hidden")
+        persistBrowserNow();
+    });
+  } catch (e) {
+  }
 }
 function attemptKey(scope) {
   return `${scope.runId}\0${scope.workerId}\0${scope.attemptId}`;