supercov 4.9.0 → 4.11.0

package/docs/supported-suites.md

@@ -429,13 +429,52 @@ server is built from that copy. Go has no per-request context Supercov can
 carry a test's name in to every probe, so the server sweeps what ran every
 5 ms, and each sweep is credited to the browser test that was running then,
 if only one was, and said to be. Work done while two tests ran at once, as
-with parallel workers, is the run's and no test's. The server's coverage is a
+with parallel workers, is the run's and no test's; the run says how many tests
+that left without their server work, and `--workers=1` gives each test its
+own. The server's coverage is a
 Go run of its own, published as the run or beside the browser run, as for a
 [Python server](#a-python-server-under-browser-tests).
 
 A server binary built before the run is not the one Supercov instruments:
 start it with `go run`, or build it in the test command.
 
+### A Java or Kotlin server under browser tests
+
+A Playwright suite whose server is built by its own command (`./gradlew
+bootRun`, `mvn spring-boot:run`, or `javac` and `java`) measures it the way it
+measures a [Go server](#a-go-server-under-browser-tests): the copy's Java and
+Kotlin are rewritten with probes, the runtime goes in each module's main
+source set, and what the server ran is swept every 5 ms and credited by time
+to the browser test running then, if only one was. A jar built before the run
+is not the one Supercov instruments.
+
+```sh
+npx supercov -- npx playwright test
+```
+
+### A server Docker Compose builds
+
+A Playwright suite whose server `docker compose up` builds (`build:` in the
+compose file) measures it in any of these languages: Node, Python, Ruby, Go,
+Java or Kotlin. The image is built from Supercov's copy, so it holds the
+copy's code. Supercov's `docker` on the suite's PATH gives each service
+built from the copy the run's settings, and mounts the project's `.supercov`
+into it at the same path, so the server writes its coverage where the run
+reads it. Each request or window is credited to its test as for a server
+started directly. Supercov builds those services before starting them, so
+an image left over from an earlier run is never used. When the command ends
+it stops the containers it started; it never removes them.
+
+- Services that pull an image (`image:` with no `build:`) run code nobody
+  instrumented, and are left as they are.
+- A Python or Ruby image may keep the code at a path of its own
+  (`COPY backend/ /srv/`): the runtime matches the image's files to the
+  copy's by their paths' common ending, and only when several of them match.
+- A Go image needs Supercov's runtime package, `_supercov_runtime/` at the
+  module root: copy the whole module (`COPY . .`), not chosen directories.
+- `docker run` and a `docker build` the command makes itself are not
+  covered; neither is Windows.
+
 ```sh
 npx supercov -- npx playwright test
 ```

package/docs/workspace-isolation.md

@@ -85,6 +85,16 @@ When a run fails in a project that has a `build` script the command does not
 reach, it says this. `SUPERCOV_KEEP_WORKSPACE=1` leaves the instrumented copy
 in `.supercov/workspaces/` after a run, to inspect.
 
+A package inside a larger git repository (`web/` beside `cmd/`, or
+`packages/app` in a monorepo) is copied alone, but the copy sits at the
+package's path in the repository, with the repository's other files and
+directories linked beside it from your checkout. A suite that reaches outside
+the package, a `webServer` running `go run ../cmd/testserver` or a tsconfig
+extending `../../tsconfig.base.json`, finds them where it finds them without
+Supercov. They are your checkout's own files, not copies, and they are not
+measured; the repository's `.git` and lockfiles are never linked. To measure code outside the
+package too, run Supercov from the repository root.
+
 ## Files Supercov creates
 
 | Location | What it is for |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supercov",
-  "version": "4.9.0",
+  "version": "4.11.0",
   "description": "Coverage, security and code quality for coding agents",
   "keywords": [
     "coverage",
@@ -83,7 +83,7 @@
     "eval:skill": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag behavior trigger --allow-tools Bash Edit Write --max-cost-usd 15",
     "eval:skill-triggers": "claude plugin eval plugins/supercov --scaffold --trust-plugin --no-publish --model claude-sonnet-5 --judge-model claude-haiku-4-5 --threshold 0.66 --tag trigger --ablation none --max-cost-usd 5",
     "test:engine": "cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo test --workspace && npm run test:runtime && npm run test:rust-assets && npm run test:engine-integrations",
-    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
+    "test:engine-integrations": "cargo build -p supercov && node scripts/html-report-integration.mjs && node scripts/rust-process-supervision.mjs && node scripts/rust-direct-node-integration.mjs && node scripts/rust-public-run-integration.mjs && node scripts/rust-embedded-runtime-integration.mjs && node scripts/rust-direct-vitest-integration.mjs && node scripts/rust-direct-jest-integration.mjs && node scripts/mocha-failure-output.mjs && node scripts/failure-output.mjs node ava tap && node scripts/side-by-side.mjs node && node scripts/merge-across.mjs && node scripts/rust-direct-playwright-integration.mjs && node scripts/rust-custom-browser-playwright-integration.mjs && node scripts/cross-origin-requests.mjs && node scripts/leaving-page.mjs && node scripts/background-by-time.mjs && node scripts/python-server-playwright.mjs && node scripts/ruby-server-playwright.mjs && node scripts/go-server-playwright.mjs && node scripts/jvm-server-playwright.mjs && node scripts/docker-server-playwright.mjs && node scripts/rust-classic-browser-integration.mjs && node scripts/rust-top-packages-integration.mjs && node scripts/rust-generic-esbuild-integration.mjs && node scripts/rust-generic-tsc-integration.mjs && node scripts/rust-generic-build-matrix.mjs && node scripts/rust-vite-playwright-integration.mjs",
     "test:platform": "cargo test --workspace && cargo build -p supercov && node scripts/rust-process-supervision.mjs && node scripts/workspace-crash-integration.mjs",
     "test:native-package": "cargo build --release -p supercov && node scripts/native-package-integration.mjs && node scripts/native-release-set-integration.mjs",
     "test:pypi-wheel": "node scripts/pypi-wheel-integration.mjs",
@@ -120,14 +120,14 @@
     "test:windows-tls": "node scripts/windows-tls-test.mjs"
   },
   "optionalDependencies": {
-    "@supercov/cli-darwin-arm64": "4.9.0",
-    "@supercov/cli-darwin-x64": "4.9.0",
-    "@supercov/cli-linux-arm64-gnu": "4.9.0",
-    "@supercov/cli-linux-arm64-musl": "4.9.0",
-    "@supercov/cli-linux-x64-gnu": "4.9.0",
-    "@supercov/cli-linux-x64-musl": "4.9.0",
-    "@supercov/cli-win32-arm64": "4.9.0",
-    "@supercov/cli-win32-x64": "4.9.0"
+    "@supercov/cli-darwin-arm64": "4.11.0",
+    "@supercov/cli-darwin-x64": "4.11.0",
+    "@supercov/cli-linux-arm64-gnu": "4.11.0",
+    "@supercov/cli-linux-arm64-musl": "4.11.0",
+    "@supercov/cli-linux-x64-gnu": "4.11.0",
+    "@supercov/cli-linux-x64-musl": "4.11.0",
+    "@supercov/cli-win32-arm64": "4.11.0",
+    "@supercov/cli-win32-x64": "4.11.0"
   },
   "peerDependencies": {
     "@playwright/test": ">=1.55.0",

package/runtime/javascript/atomic.mjs

@@ -2,6 +2,22 @@ import { appendFileSync, existsSync, mkdirSync, openSync, closeSync, fsyncSync,
 import { randomUUID } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { Buffer } from "node:buffer";
+
+// In a container Supercov's `docker` launcher mounts the run's directory
+// into, its user (root) owns what it creates there; a directory made with
+// the usual mask would keep the run, outside, from removing what goes in it.
+function makeDirectory(directory) {
+    if (process.env.SUPERCOV_CONTAINER !== "1")
+        return mkdirSync(directory, { recursive: true });
+    const previous = process.umask(0);
+    try {
+        return mkdirSync(directory, { recursive: true, mode: 0o777 });
+    }
+    finally {
+        process.umask(previous);
+    }
+}
+
 function fsyncDirectory(path) {
     try {
         const directory = openSync(path, "r");
@@ -18,7 +34,7 @@ function fsyncDirectory(path) {
 }
 /** Write a complete sibling file and atomically replace the destination. */
 export function atomicWriteFileSync(path, data, options) {
-    mkdirSync(dirname(path), { recursive: true });
+    makeDirectory(dirname(path));
     const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let descriptor;
     try {
@@ -41,7 +57,7 @@ export function atomicWriteFileSync(path, data, options) {
 }
 /** Append one recoverable JSONL record and make the completed line durable. */
 export function appendJsonLineDurableSync(path, data) {
-    mkdirSync(dirname(path), { recursive: true });
+    makeDirectory(dirname(path));
     const existed = existsSync(path);
     const descriptor = openSync(path, "a", 0o600);
     try {
@@ -56,12 +72,12 @@ export function appendJsonLineDurableSync(path, data) {
 }
 /** Append a complete local record; process exit closes it before publication. */
 export function appendJsonLineSync(path, data) {
-    mkdirSync(dirname(path), { recursive: true });
+    makeDirectory(dirname(path));
     appendFileSync(path, data.endsWith("\n") ? data : `${data}\n`, { mode: 0o600 });
 }
 /** Atomically publish a fully prepared file or directory and persist its entry. */
 export function atomicRenameSync(source, destination) {
-    mkdirSync(dirname(destination), { recursive: true });
+    makeDirectory(dirname(destination));
     renameSync(source, destination);
     fsyncDirectory(dirname(destination));
 }

package/runtime/javascript/bootstrap.cjs

@@ -19,21 +19,28 @@ else {
         // <workspace>/.supercov/node_modules/bootstrap.cjs
         const root = path.resolve(__dirname, "..", "..");
         const settings = JSON.parse(fs.readFileSync(path.join(__dirname, "run.json"), "utf8"));
-        const moved = (value) => typeof value === "string" && settings.root !== root
-            ? value.split(settings.root).join(root)
+        // An image built from the workspace holds a copy of it, but its
+        // evidence belongs where the run reads it: when the run's own
+        // directory is mounted here at its path (Supercov's `docker` launcher
+        // mounts it), the host's paths are kept, and a copy that goes away
+        // with its container is not written to.
+        const hostVisible = settings.root !== root && fs.existsSync(path.join(settings.root, ".supercov"));
+        const here = hostVisible ? settings.root : root;
+        const moved = (value) => typeof value === "string" && settings.root !== here
+            ? value.split(settings.root).join(here)
             : value;
         // Settings carried over from the host name the host's paths, which do
         // not exist here; replace them all rather than keep a mixture.
-        const foreign = process.env.SUPERCOV_PROJECT_ROOT !== root;
+        const foreign = process.env.SUPERCOV_PROJECT_ROOT !== here;
         for (const [name, value] of Object.entries(settings.environment)) {
             if (foreign || process.env[name] === undefined)
                 process.env[name] = moved(value);
         }
-        process.env.SUPERCOV_PROJECT_ROOT = root;
+        process.env.SUPERCOV_PROJECT_ROOT = here;
         process.env.SUPERCOV_EXECUTION_LOG_SHARD ??= `bootstrap-${process.pid}-${Date.now()}`;
         require("./runtime.mjs");
         // Counted in the run's summary: coverage from here belongs to no test.
-        require("./launchSupervisor.mjs").recordExecution({ event: "guest-process", guestRoot: root });
+        require("./launchSupervisor.mjs").recordExecution({ event: "guest-process", guestRoot: here });
     }
     catch {
         // Without its settings or its runtime nothing can be recorded here,

package/runtime/javascript/launchSupervisor.mjs

@@ -4,6 +4,22 @@ import { appendFileSync, mkdirSync, statSync } from "node:fs";
 import Module, { syncBuiltinESMExports } from "node:module";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+
+// In a container Supercov's `docker` launcher mounts the run's directory
+// into, its user (root) owns what it creates there; a directory made with
+// the usual mask would keep the run, outside, from removing what goes in it.
+function makeDirectory(directory) {
+    if (process.env.SUPERCOV_CONTAINER !== "1")
+        return mkdirSync(directory, { recursive: true });
+    const previous = process.umask(0);
+    try {
+        return mkdirSync(directory, { recursive: true, mode: 0o777 });
+    }
+    finally {
+        process.umask(previous);
+    }
+}
+
 const HOST_PATH_KEYS = ["hostPath", "source", "src", "localPath"];
 const GUEST_PATH_KEYS = [
     "guestPath",
@@ -83,7 +99,7 @@ function record(value) {
             ppid: process.ppid,
             ...value,
         })}\n`;
-        mkdirSync(dirname(path), { recursive: true });
+        makeDirectory(dirname(path));
         appendFileSync(path, line);
         executionLog = { token: executionLog.token, path, size: executionLog.size + Buffer.byteLength(line) };
     }

package/runtime/javascript/playwright.mjs

@@ -216,6 +216,9 @@ class CoveragePhaseController {
     // fixture override tears down before the collector's own fixture, and a
     // closed page cannot be evaluated, so the evidence is taken on the way out.
     earlySnapshots = [];
+    // Evidence documents gave as they left (`__supercovLeaving`), merged with
+    // the rest when there is any.
+    leftSnapshots = [];
     snapshottedPages = new WeakSet();
     snapshottedWorkers = new WeakSet();
     // Workers that did not answer an evaluation in time. They are not waited
@@ -279,8 +282,10 @@ class CoveragePhaseController {
             if (snapshot)
                 snapshots.push(snapshot);
         }
-        this.runtimeSnapshots = snapshots;
-        return snapshots;
+        this.runtimeSnapshots = this.leftSnapshots.length > 0
+            ? [mergeSnapshots([...this.leftSnapshots, ...snapshots])]
+            : snapshots;
+        return this.runtimeSnapshots;
     }
     /**
      * A worker's evidence, or nothing when it cannot be read. A worker that
@@ -291,20 +296,15 @@ class CoveragePhaseController {
         if (this.workersWithoutRuntime.has(worker)) {
             // Asked once more, without waiting: it may have loaded an
             // instrumented script since it was registered.
-            const answer = await bounded(worker
-                .evaluate(() => globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__?.())
-                .catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
+            const answer = await bounded(readSnapshot(worker).catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
             if (answer && answer !== WORKER_TIMED_OUT) {
                 this.snapshottedWorkers.add(worker);
                 return answer;
             }
             return undefined;
         }
-        const answer = await bounded(worker
-            .evaluate(() => {
-            const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
-            return getSnapshot?.() ?? { decisions: [], hits: [], events: [] };
-        })
+        const answer = await bounded(readSnapshot(worker)
+            .then((snapshot) => snapshot ?? { decisions: [], hits: [], events: [] })
             .catch(() => undefined), WORKER_SNAPSHOT_WAIT_MS);
         if (answer === WORKER_TIMED_OUT) {
             this.unresponsiveWorkers.add(worker);
@@ -335,11 +335,11 @@ class CoveragePhaseController {
                 .evaluate(({ token, url }) => {
                 const entries = globalThis.__SUPERCOV_WORKER_EVIDENCE__?.() ?? [];
                 const byToken = token ? entries.find((entry) => entry.token === token) : undefined;
-                if (byToken)
-                    return byToken;
                 const byUrl = entries.filter((entry) => entry.url === url);
-                return byUrl.length === 1 ? byUrl[0] : undefined;
+                const found = byToken ?? (byUrl.length === 1 ? byUrl[0] : undefined);
+                return found ? JSON.stringify(found) : undefined;
             }, { token, url })
+                .then((text) => (typeof text === "string" ? JSON.parse(text) : undefined))
                 .catch(() => undefined), WORKER_ACTIVATION_WAIT_MS);
             if (pushed && pushed !== WORKER_TIMED_OUT)
                 return pushed;
@@ -349,11 +349,8 @@ class CoveragePhaseController {
     async snapshotPage(page) {
         const snapshots = [];
         for (const frame of page.frames()) {
-            snapshots.push(await frame
-                .evaluate(() => {
-                const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
-                return getSnapshot?.() ?? { decisions: [], hits: [], events: [] };
-            })
+            snapshots.push(await readSnapshot(frame)
+                .then((snapshot) => snapshot ?? { decisions: [], hits: [], events: [] })
                 .catch(() => ({
                 decisions: [],
                 hits: [],
@@ -432,6 +429,20 @@ class CoveragePhaseController {
             // learned its phase only from the next action, after it had
             // loaded, and everything it ran while loading was placed by time.
             await cdp.send("Page.enable").catch(() => undefined);
+            // A document that leaves hands its evidence over here: the
+            // next one reads what it stored only on the same origin.
+            cdp.on("Runtime.bindingCalled", ({ name, payload }) => {
+                if (name !== LEAVING_BINDING || this.runtimeSnapshots)
+                    return;
+                try {
+                    this.leftSnapshots.push(JSON.parse(payload));
+                }
+                catch {
+                    // Not evidence.
+                }
+            });
+            await cdp.send("Runtime.enable").catch(() => undefined);
+            await cdp.send("Runtime.addBinding", { name: LEAVING_BINDING }).catch(() => undefined);
             this.cdpSessions.set(page, cdp);
         }
         const phaseId = this.requestPhaseId();
@@ -883,6 +894,63 @@ class CoveragePhaseController {
         await this.scriptUpdate.catch(() => undefined);
     }
 }
+/**
+ * A page's or worker's evidence. It holds an event for every hit of every
+ * phase, tens of thousands of objects on a large frontend, and Playwright
+ * returns an object value by value: reading it took half a second a page at
+ * the end of every test (20,000 events: 470 ms, against 34 ms as one JSON
+ * string), and doubled a 76-test suite's time.
+ */
+const LEAVING_BINDING = "__supercovLeaving";
+/**
+ * One snapshot holding everything in `snapshots`, each observation once: a
+ * document that left gave its evidence, and the next one on its origin
+ * restored the same evidence and added to it.
+ */
+function mergeSnapshots(snapshots) {
+    const hits = new Set();
+    const events = new Map();
+    const decisions = new Map();
+    const logicals = new Map();
+    const vectorsOf = (map, key, initial) => {
+        let entry = map.get(key);
+        if (!entry) {
+            entry = { ...initial, seen: new Map() };
+            map.set(key, entry);
+        }
+        return entry;
+    };
+    for (const snapshot of snapshots) {
+        for (const id of snapshot?.hits ?? [])
+            hits.add(id);
+        for (const event of snapshot?.events ?? [])
+            events.set(JSON.stringify(event), event);
+        for (const decision of snapshot?.decisions ?? []) {
+            const entry = vectorsOf(decisions, decision.meta?.id, { meta: decision.meta });
+            for (const vector of decision.vectors ?? [])
+                entry.seen.set(JSON.stringify(vector), vector);
+        }
+        for (const logical of snapshot?.logicals ?? []) {
+            const entry = vectorsOf(logicals, logical.id, { id: logical.id });
+            for (const vector of logical.vectors ?? [])
+                entry.seen.set(JSON.stringify(vector), vector);
+        }
+    }
+    return {
+        decisions: [...decisions.values()].map(({ seen, meta }) => ({ meta, vectors: [...seen.values()] })),
+        hits: [...hits],
+        events: [...events.values()],
+        logicals: [...logicals.values()].map(({ seen, id }) => ({ id, vectors: [...seen.values()] })),
+    };
+}
+function readSnapshot(target) {
+    return target
+        .evaluate(() => {
+        const getSnapshot = globalThis.__SUPERCOV_COVERAGE_SNAPSHOT__;
+        return getSnapshot ? JSON.stringify(getSnapshot()) : undefined;
+    })
+        .then((text) => (typeof text === "string" ? JSON.parse(text) : undefined));
+}
 let activeController;
 let bridgedAssertionDepth = 0;
 const controllers = new Map();

package/runtime/javascript/runtime.mjs

@@ -25,9 +25,6 @@ var __spreadProps = (a, b) => __spreadValues(a, b);
 // `globalThis.Buffer = undefined` to check it copes -- and the runtime runs
 // inside those tests; it must not fail where the application does not.
 var capturedBuffer = typeof Buffer === "undefined" ? void 0 : Buffer;
-// Likewise the timer: a test that installs fake timers would otherwise hold
-// the browser's evidence back until it advanced its clock.
-var capturedSetTimeout = setTimeout;
 
 // dist/transport.js
 var COVERAGE_SCOPE_HEADER = "x-supercov-scope";
@@ -419,7 +416,6 @@ function pushWorkerEvidence() {
   }
   runtimeGlobal.__SUPERCOV_WORKER_EVIDENCE__ = () => Array.from(received, ([token, pushed]) => ({ token, url: pushed.url, current: pushed.current, snapshot: pushed.snapshot }));
 })();
-var persistBrowserScheduled = false;
 var persistBrowserListenersInstalled = false;
 function persistBrowserNow() {
   if (!isBrowser)
@@ -429,31 +425,39 @@ function persistBrowserNow() {
   } catch (e) {
   }
 }
+// The Playwright collector's binding takes the evidence of a document that
+// is about to leave. localStorage gives it to the next document only on the
+// same origin: a click that sent the page to another one (an admin's
+// masquerade link, a sign-in redirect) lost every hit it made. Called from
+// `pagehide` the binding never reached the collector; from `beforeunload`
+// it does.
+function handOverBrowser() {
+  try {
+    if (typeof runtimeGlobal.__supercovLeaving === "function")
+      runtimeGlobal.__supercovLeaving(JSON.stringify(coverageSnapshot()));
+  } catch (e) {
+  }
+}
 function persistBrowser() {
   if (!isBrowser)
     return;
-  // Persistence exists so evidence survives navigation, not to mirror every
-  // event: serializing the whole snapshot per event is quadratic in a
-  // render burst. Coalesce to one write per macrotask and flush when the
-  // page is actually leaving.
-  if (!persistBrowserListenersInstalled) {
-    persistBrowserListenersInstalled = true;
-    try {
-      addEventListener("pagehide", persistBrowserNow);
-      addEventListener("visibilitychange", () => {
-        if (typeof document !== "undefined" && document.visibilityState === "hidden")
-          persistBrowserNow();
-      });
-    } catch (e) {
-    }
-  }
-  if (persistBrowserScheduled)
+  // Persistence exists so evidence survives navigation, so it is written
+  // when the page leaves. Written after every macrotask that recorded
+  // anything, the whole snapshot was serialized again and again: a large
+  // instrumented frontend doubled a Playwright suite's time. A page the
+  // test closes is read by the collector before it closes.
+  if (persistBrowserListenersInstalled)
     return;
-  persistBrowserScheduled = true;
-  capturedSetTimeout(() => {
-    persistBrowserScheduled = false;
-    persistBrowserNow();
-  }, 0);
+  persistBrowserListenersInstalled = true;
+  try {
+    addEventListener("beforeunload", handOverBrowser);
+    addEventListener("pagehide", persistBrowserNow);
+    addEventListener("visibilitychange", () => {
+      if (typeof document !== "undefined" && document.visibilityState === "hidden")
+        persistBrowserNow();
+    });
+  } catch (e) {
+  }
 }
 function attemptKey(scope) {
   return `${scope.runId}\0${scope.workerId}\0${scope.attemptId}`;
@@ -517,7 +521,7 @@ function flushBufferedServerEvidence(scope) {
   if (!fs || buffered.records.size === 0)
     return void 0;
   try {
-    fs.mkdirSync(buffered.directory, { recursive: true });
+    makeEvidenceDirectory(fs, buffered.directory);
     fs.appendFileSync(buffered.path, [...buffered.records.values()].map((record) => JSON.stringify(record)).join("\n") + "\n");
     return buffered.path;
   } catch (e) {
@@ -607,11 +611,32 @@ function flushBackgroundAppends(fs) {
     }
   }
 }
+// In a container Supercov's `docker` launcher mounts the run's directory
+// into, its user (root) owns what it creates there, and the run, outside,
+// could not remove what went in it. There each directory made is opened to
+// all.
+function makeEvidenceDirectory(fs, directory) {
+  const first = fs.mkdirSync(directory, { recursive: true });
+  if (!first || typeof process === "undefined" || !process.env || process.env.SUPERCOV_CONTAINER !== "1")
+    return;
+  let current = first;
+  const opened = [current];
+  for (const part of directory.slice(first.length).split(/[\\/]/).filter(Boolean)) {
+    current = `${current}/${part}`;
+    opened.push(current);
+  }
+  for (const made of opened) {
+    try {
+      fs.chmodSync(made, 0o777);
+    } catch (e) {
+    }
+  }
+}
 function writeBackgroundLines(fs, runId, payload) {
   var _a8;
   const directory = backgroundEvidenceDirectory(runId);
   if (!state.createdEvidenceDirectories.has(directory)) {
-    fs.mkdirSync(directory, { recursive: true });
+    makeEvidenceDirectory(fs, directory);
     state.createdEvidenceDirectories.add(directory);
   }
   let path = state.backgroundWriters.get(runId);
@@ -741,7 +766,7 @@ function flushServerAppends() {
       if (!fs)
         throw new Error("node:fs is unavailable");
       if (!state.createdEvidenceDirectories.has(entry.directory)) {
-        fs.mkdirSync(entry.directory, { recursive: true });
+        makeEvidenceDirectory(fs, entry.directory);
         state.createdEvidenceDirectories.add(entry.directory);
       }
       fs.appendFileSync(path, entry.lines.join(""));