aztrx-cli 0.1.0 → 0.1.1

package/dist/core/pr.js

@@ -1,5 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
+import { sanitizeSecrets } from "./heal/redact.js";
 /**
  * F-report — the PR bot's markdown comment. Same findings as the HTML report,
  * reshaped for a GitHub PR: a status badge, one `<details>` per finding, the
@@ -14,12 +15,6 @@ const SEV_BADGE = {
     warning: "f5a623",
     noise: "5b6573",
 };
-const SEV_ICON = {
-    crash: "💥",
-    error: "🚨",
-    warning: "⚠️",
-    noise: "·",
-};
 /** Shields.io badge-path escaping: literal `-` → `--`, `/` → `%2F`, space → `_`. */
 function shield(s) {
     return s.replace(/-/g, "--").replace(/\//g, "%2F").replace(/ /g, "_");
@@ -30,6 +25,28 @@ function badge(label, value, color) {
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+/** Wrap `code` in a backtick fence one longer than any run inside it, so the
+ * content can never close the fence (blocks markdown breakout from a hostile
+ * sourcemap snippet or patch). */
+function fence(code, lang = "") {
+    const runs = code.match(/`+/g) ?? [];
+    const maxRun = runs.reduce((m, r) => Math.max(m, r.length), 0);
+    const delim = "`".repeat(Math.max(3, maxRun + 1));
+    return `${delim}${lang}\n${code.trimEnd()}\n${delim}`;
+}
+/** Inline code that can't be broken out of — backticks/newlines are stripped. */
+function inlineCode(s) {
+    return "`" + s.replace(/`/g, "").replace(/[\r\n]/g, " ") + "`";
+}
+/** Scrub secrets and strip markdown-breakout chars for anything inlined into a
+ * heading or inline-code span. The PR comment renders untrusted stack/snippet
+ * text — a secret in it (or a stray backtick) must never leak or break out. */
+function cleanInline(s) {
+    return sanitizeSecrets(s).replace(/`/g, "").replace(/[\r\n]/g, " ");
+}
+/** Hard cap on the server body inlined into a PR comment — a 500 page can be
+ * huge, and only the first line or two are ever diagnostic. */
+const SERVER_BODY_CAP = 2000;
 function readIfExists(p) {
     try {
         return fs.readFileSync(p, "utf-8");
@@ -39,8 +56,8 @@ function readIfExists(p) {
     }
 }
 function describeAction(a) {
-    const sel = a.selectors[0] ? ` \`${a.selectors[0]}\`` : "";
-    const val = a.value ? ` \`${a.value}\`` : "";
+    const sel = a.selectors[0] ? ` ${inlineCode(sanitizeSecrets(a.selectors[0]))}` : "";
+    const val = a.value ? ` ${inlineCode(sanitizeSecrets(a.value))}` : "";
     return `**${a.type}**${val}${sel}`;
 }
 function healBlock(f) {
@@ -52,6 +69,7 @@ function healBlock(f) {
         unfixed: { text: "unfixed", color: "f5a623" },
         rejected: { text: "rejected", color: "ff5a5f" },
         "compile-failed": { text: "compile-failed", color: "ff5a5f" },
+        "test-failed": { text: "test-failed", color: "ff5a5f" },
         "apply-failed": { text: "apply-failed", color: "ff5a5f" },
         skipped: { text: "skipped", color: "5b6573" },
         "no-llm": { text: "no-llm", color: "5b6573" },
@@ -63,13 +81,14 @@ function healBlock(f) {
     // The saved unified diff is only produced for a patch that reached verify.
     const diff = h.patchPath ? readIfExists(path.resolve(h.patchPath)) : null;
     if (diff) {
-        body.push("```diff");
-        body.push(diff.trimEnd());
-        body.push("```");
+        body.push(fence(diff, "diff"));
     }
     else if (h.explanation) {
         body.push(`> ${h.explanation}`);
     }
+    if (h.test?.ran) {
+        body.push(`**tests** ${inlineCode(h.test.command)} — ${h.test.ok ? "passed" : "failed"}`);
+    }
     if (h.error)
         body.push(`\n_${escapeHtml(h.error)}_`);
     return `\n<details>\n<summary>${badge("heal", meta.text, meta.color)} proposed patch${via}${tiers}</summary>\n\n${body.join("\n")}\n</details>`;
@@ -83,20 +102,25 @@ function reproBlock(f) {
         ? `\n${r.actions.map((a, i) => `${i + 1}. ${describeAction(a)}`).join("\n")}`
         : "";
     const spec = readIfExists(path.resolve(r.specPath));
-    const specBlock = spec ? `\n\`\`\`ts\n${spec.trimEnd()}\n\`\`\`` : "";
+    const specBlock = spec ? `\n${fence(spec, "ts")}` : "";
     return `\n<details>\n<summary>▶ ${verdict} · ${r.actions.length} step(s)</summary>\n\n**Reproduce**${steps}${specBlock}\n</details>`;
 }
 function findingBlock(f) {
     const sev = f.severity;
-    const icon = SEV_ICON[sev] ?? "·";
-    const first = f.rawMessage.split("\n")[0];
+    const first = sanitizeSecrets(f.rawMessage.split("\n")[0]);
     const loc = f.mappedLocation
-        ? `\n**Location** \`${f.mappedLocation.filePath}:${f.mappedLocation.line}:${f.mappedLocation.column}\``
+        ? `\n**Location** \`${cleanInline(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}\``
         : "";
     const snippet = f.mappedLocation?.codeContext
-        ? `\n\n\`\`\`${path.extname(f.mappedLocation.filePath).replace(".", "") || "ts"}\n${f.mappedLocation.codeContext.trimEnd()}\n\`\`\``
+        ? `\n\n${fence(sanitizeSecrets(f.mappedLocation.codeContext), path.extname(f.mappedLocation.filePath).replace(".", "") || "ts")}`
+        : "";
+    const serverErr = f.serverError
+        ? `\n**Server** ${escapeHtml(sanitizeSecrets(f.serverError.message))}` +
+            (f.serverError.body
+                ? `\n\n${fence(sanitizeSecrets(f.serverError.body.slice(0, SERVER_BODY_CAP)), "text")}`
+                : "")
         : "";
-    return `<details open>\n<summary>${icon} <code>${escapeHtml(sev)}</code> — ${escapeHtml(first)}</summary>\n${loc}${snippet}${reproBlock(f)}${healBlock(f)}\n</details>`;
+    return `<details open>\n<summary><code>${escapeHtml(sev)}</code> — ${escapeHtml(first)}</summary>\n${loc}${snippet}${serverErr}${reproBlock(f)}${healBlock(f)}\n</details>`;
 }
 export function renderPrComment(targetUrl, findings, opts = {}) {
     void opts;
@@ -120,13 +144,13 @@ export function renderPrComment(targetUrl, findings, opts = {}) {
         .join("  ");
     const body = sorted.length
         ? sorted.map(findingBlock).join("\n\n")
-        : "> ✅ No crash, error, or warning surfaced — the app survived this pass.";
+        : "> No crash, error, or warning surfaced — the app survived this pass.";
     return `<!-- aztrx -->
-## ⚡ Aztrx — runtime stress-test
+## Aztrx AI — runtime stress-test
 
 ${summaryBadges}
 
-**Target** \`${targetUrl}\` · **${counts.crash ?? 0} crash** · **${counts.error ?? 0} error** · **${counts.warning ?? 0} warning**
+**Target** \`${cleanInline(targetUrl)}\` · **${counts.crash ?? 0} crash** · **${counts.error ?? 0} error** · **${counts.warning ?? 0} warning**
 
 ---
 

package/dist/core/replay.js

@@ -26,6 +26,22 @@ export async function replayActions(page, actions) {
             await page.waitForTimeout(30);
             continue;
         }
+        if (a.type === "request" && a.request) {
+            // Issue the request in-page so the attached interceptor sees the response
+            // and emits `network_5xx` — that is how a server finding reproduces here.
+            await page
+                .evaluate(async (r) => {
+                try {
+                    await fetch(r.url, { method: r.method, headers: r.headers, body: r.body });
+                }
+                catch {
+                    // ignore — the 5xx (or its absence) is observed by the interceptor
+                }
+            }, a.request)
+                .catch(() => { });
+            await page.waitForTimeout(50);
+            continue;
+        }
         for (const sel of a.selectors) {
             const loc = page.locator(sel).first();
             const n = await loc.count().catch(() => 0);
@@ -66,7 +82,7 @@ export class ReplayEngine {
             this.browser = await chromium.launch({ headless: true });
         return this.browser;
     }
-    async run(url, actions, targetFingerprint) {
+    async run(url, actions, targetFingerprint, opts) {
         // The browser is reused across replays for speed, but after enough page
         // loads a renderer can crash. Relaunch once and retry so a single crash
         // doesn't take down the whole repro pipeline.
@@ -80,7 +96,18 @@ export class ReplayEngine {
                 page = await context.newPage();
                 const bus = new EventBus();
                 const fingerprints = new Set();
-                bus.on("telemetry", (p) => fingerprints.add(fingerprintOf(p)));
+                const types = new Set();
+                // For type-based verification (server findings), ignore telemetry from the
+                // initial load + settle window — only the replayed requests count. Client
+                // verification stays fingerprint-exact and keeps collecting from page
+                // attach, so a mount-time client bug still verifies.
+                let collecting = !opts?.targetType;
+                bus.on("telemetry", (p) => {
+                    if (!collecting)
+                        return;
+                    fingerprints.add(fingerprintOf(p));
+                    types.add(p.type);
+                });
                 attachInterceptor(page, bus);
                 if (this.opts.attachGuard)
                     await this.opts.attachGuard(page);
@@ -89,9 +116,14 @@ export class ReplayEngine {
                 // `load` event plus a settle window, and a replay that clicks before React
                 // attaches its handlers won't reproduce the crash (false "unreliable").
                 await page.waitForTimeout(2000);
+                if (opts?.targetType)
+                    collecting = true;
                 await replayActions(page, actions);
                 await page.waitForTimeout(300);
-                return { reproduced: fingerprints.has(targetFingerprint) };
+                const reproduced = opts?.targetType
+                    ? types.has(opts.targetType)
+                    : fingerprints.has(targetFingerprint);
+                return { reproduced };
             }
             catch (e) {
                 lastError = e;

package/dist/core/report.js

@@ -1,9 +1,15 @@
 import * as fs from "fs";
 import * as path from "path";
 import { BASE_CSS, SEVERITY_COLOR, seismograph } from "./ui.js";
+import { sanitizeSecrets } from "./heal/redact.js";
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+/** HTML-escape AND scrub secrets — the report renders untrusted stack/snippet
+ * text, so a secret that survives into it must not reach the file. */
+function clean(s) {
+    return escapeHtml(sanitizeSecrets(s));
+}
 const SEV_ORDER = ["crash", "error", "warning", "noise"];
 /**
  * F-report — standalone offline HTML report. Self-contained (inline CSS, no
@@ -19,17 +25,23 @@ export function renderReport(targetUrl, findings) {
     const cards = sorted
         .map((f) => {
         const loc = f.mappedLocation
-            ? `${escapeHtml(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
+            ? `${clean(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
+            : "";
+        const snippet = f.mappedLocation ? clean(f.mappedLocation.codeContext) : "";
+        const serverErr = f.serverError
+            ? `<div class="server">server: ${clean(f.serverError.message)}</div>` +
+                (f.serverError.body
+                    ? `<pre class="server-body">${clean(f.serverError.body)}</pre>`
+                    : "")
             : "";
-        const snippet = f.mappedLocation ? escapeHtml(f.mappedLocation.codeContext) : "";
         const repro = f.repro
             ? `<div class="repro ${f.repro.verdict}">${f.repro.verdict} · ${f.repro.reproductions}/${f.repro.runs} runs · ${f.repro.actions.length} step(s) · <code>${escapeHtml(path.basename(f.repro.specPath))}</code></div>`
             : "";
         const steps = f.actionHistory.length
             ? `<details><summary>action history (${f.actionHistory.length})</summary><ol>${f.actionHistory
                 .map((a) => {
-                const detail = a.value ? ` <span>${escapeHtml(a.value)}</span>` : "";
-                const sel = a.selectors[0] ? ` ${escapeHtml(a.selectors[0])}` : "";
+                const detail = a.value ? ` <span>${clean(a.value)}</span>` : "";
+                const sel = a.selectors[0] ? ` ${clean(a.selectors[0])}` : "";
                 return `<li><code>${escapeHtml(a.type)}${detail}</code>${sel}</li>`;
             })
                 .join("")}</ol></details>`
@@ -38,10 +50,11 @@ export function renderReport(targetUrl, findings) {
     <article class="finding">
       <header>
         <span class="sev" style="--sev:${SEVERITY_COLOR[f.severity]}">${escapeHtml(f.severity)}</span>
-        <h2>${escapeHtml(f.rawMessage.split("\n")[0])}</h2>
+        <h2>${clean(f.rawMessage.split("\n")[0])}</h2>
       </header>
       ${loc ? `<div class="loc">${loc}</div>` : ""}
       ${snippet ? `<pre class="snippet">${snippet}</pre>` : ""}
+      ${serverErr}
       ${f.occurrences > 1 ? `<div class="occ">seen ×${f.occurrences}</div>` : ""}
       ${repro}
       ${steps}
@@ -63,7 +76,7 @@ export function renderReport(targetUrl, findings) {
     <div class="brand-row">
       <h1><span class="brand">aztrx</span> <span class="brand-sub">report</span></h1>
     </div>
-    <div class="target">${escapeHtml(targetUrl)}</div>
+    <div class="target">${clean(targetUrl)}</div>
   </div>
   <div class="bar">
     <span class="count">crash <b class="crash">${counts.crash ?? 0}</b></span>

package/dist/core/resolver.js

@@ -16,6 +16,35 @@ export function extractFrame(text) {
         message: text.split("\n")[0].trim().slice(0, 200),
     };
 }
+/** True if `p` looks like an absolute source path — a `file://` URL, a POSIX
+ * absolute path, or a Windows drive path. Rejects bare relative tokens like
+ * `route.ts` so a stray `foo:12:34` in a stack body is never mistaken for a file. */
+function isServerPath(p) {
+    return p.startsWith("file://") || p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
+}
+/**
+ * Pull the first server-side source frame out of a raw server stack (a 500 body,
+ * a Next.js dev error page, etc.). V8 emits one frame per line as
+ * `at <fn> (<path>:<line>:<col>)` or `at <path>:<line>:<col>`; we take the first
+ * frame whose path is not inside node_modules. Best-effort — returns null when
+ * the body carries no stack trace (e.g. an explicit
+ * `NextResponse.json(..., { status: 500 })`).
+ */
+export function extractServerFrame(stack) {
+    for (const raw of stack.split("\n")) {
+        const line = raw.trim();
+        const m = line.match(/\(?([^\s()"']+):(\d+):(\d+)\)?$/);
+        if (!m)
+            continue;
+        const filePath = m[1];
+        if (!isServerPath(filePath))
+            continue;
+        if (filePath.includes("node_modules"))
+            continue;
+        return { filePath, line: parseInt(m[2], 10), column: parseInt(m[3], 10) };
+    }
+    return null;
+}
 function stripQuery(url) {
     return url.split("?")[0];
 }
@@ -29,6 +58,55 @@ function isFile(p) {
         return false;
     }
 }
+/** Secret-bearing filenames that must never be read, even inside the repo — a
+ * hostile sourcemap could otherwise point `source` at `.env`, an npmrc, or a
+ * private key and exfiltrate it into the report / PR comment. */
+function isSensitive(p) {
+    const name = path.basename(p).toLowerCase();
+    // Dotfiles that hold secrets.
+    if (name === ".env" ||
+        name.startsWith(".env.") ||
+        name === ".npmrc" ||
+        name === ".yarnrc" ||
+        name === ".netrc" ||
+        name === ".htpasswd" ||
+        name === ".git-credentials") {
+        return true;
+    }
+    // SSH / private keys.
+    if (/^id_(rsa|ed25519|ecdsa|dsa)(\..*)?$/.test(name))
+        return true;
+    // Certificate and keystore material.
+    if (/\.(pem|key|p12|pfx|jks|keystore|p8)$/.test(name))
+        return true;
+    // Names that advertise secrets.
+    if (/(credential|secret|service[-_]?account|private[-_]?key)/.test(name))
+        return true;
+    return false;
+}
+/** Resolve `segments` under `root`, returning null if the result escapes the
+ * root — via `..` traversal or a symlink pointing outside it. This is the
+ * boundary that keeps sourcemap- and URL-derived paths from reading (or,
+ * downstream, healing) arbitrary files outside the repo. */
+function resolveWithin(root, ...segments) {
+    const candidate = path.resolve(root, ...segments);
+    const rel = path.relative(root, candidate);
+    if (rel.startsWith("..") || path.isAbsolute(rel))
+        return null;
+    // Symlink escape: when the file exists, its real path must also stay inside.
+    try {
+        const realRoot = fs.realpathSync(root);
+        const realTarget = fs.realpathSync(candidate);
+        const realRel = path.relative(realRoot, realTarget);
+        if (realRel.startsWith("..") || path.isAbsolute(realRel))
+            return null;
+    }
+    catch {
+        // realpath fails for not-yet-existing candidates — the lexical check above
+        // already ran and is sufficient for those.
+    }
+    return candidate;
+}
 /** Turns a sourcemap `source` value into candidate absolute paths to probe. */
 function sourceCandidates(source, repoRoot) {
     const cleaned = source
@@ -38,11 +116,13 @@ function sourceCandidates(source, repoRoot) {
         .replace(/^\//, "")
         .split("?")[0];
     const prefixes = ["", "apps/web/", "src/", "app/"];
-    return prefixes.map((p) => path.resolve(repoRoot, p, cleaned));
+    return prefixes
+        .map((p) => resolveWithin(repoRoot, p, cleaned))
+        .filter((c) => c !== null);
 }
 function locateFile(candidates) {
     for (const c of candidates) {
-        if (isFile(c))
+        if (isFile(c) && !isSensitive(c))
             return c;
     }
     return null;
@@ -56,18 +136,91 @@ export async function resolveFrame(frame, repoRoot) {
     const relative = stripQuery(frame.url)
         .replace(/^https?:\/\/[^/]+\//, "")
         .replace(/^\//, "");
-    const directPath = path.resolve(repoRoot, relative);
+    const directPath = resolveWithin(repoRoot, relative);
+    if (!directPath) {
+        return {
+            message: frame.message,
+            sourceFile: relative,
+            line: frame.line,
+            column: frame.column,
+            codeSnippet: `<file not accessible locally: ${relative}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
     return {
         message: frame.message,
         sourceFile: path.relative(repoRoot, directPath),
         line: frame.line,
         column: frame.column,
         codeSnippet: extractSnippet(directPath, frame.line),
-        resolvedFrom: isFile(directPath) ? "direct" : "unresolved",
+        resolvedFrom: isFile(directPath) && !isSensitive(directPath) ? "direct" : "unresolved",
     };
 }
+/**
+ * Resolve a server-side source frame (a filesystem path) to a repo-relative
+ * source location + snippet. Mirrors `resolveFrame`'s containment rules: a path
+ * outside the repo — via `..` traversal or a symlink pointing out — is never
+ * read. Server frames carry no sourcemap; a directly-readable file maps
+ * `resolvedFrom: "direct"`.
+ */
+export function resolveServerFrame(frame, repoRoot) {
+    let p = frame.filePath.replace(/^file:\/\//, "");
+    if (/^\/[A-Za-z]:[\\/]/.test(p))
+        p = p.slice(1); // /C:/x → C:/x (Windows-on-POSIX)
+    const abs = path.resolve(p);
+    const rel = path.relative(repoRoot, abs);
+    let contained = !(rel.startsWith("..") || path.isAbsolute(rel));
+    if (contained) {
+        try {
+            const realRoot = fs.realpathSync(repoRoot);
+            const realTarget = fs.realpathSync(abs);
+            const realRel = path.relative(realRoot, realTarget);
+            if (realRel.startsWith("..") || path.isAbsolute(realRel))
+                contained = false;
+        }
+        catch {
+            // realpath fails for a not-yet-existing candidate — the lexical check above suffices.
+        }
+    }
+    if (!contained) {
+        return {
+            message: frame.filePath,
+            sourceFile: abs,
+            line: frame.line,
+            column: frame.column,
+            codeSnippet: `<file not accessible locally: ${abs}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
+    const resolvedFrom = isFile(abs) && !isSensitive(abs) ? "direct" : "unresolved";
+    return {
+        message: frame.filePath,
+        sourceFile: rel,
+        line: frame.line,
+        column: frame.column,
+        codeSnippet: extractSnippet(abs, frame.line),
+        resolvedFrom,
+    };
+}
+/** True for a loopback hostname — the only place a sourcemap URL may point. */
+function isLoopback(host) {
+    const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "0.0.0.0";
+}
 async function trySourceMap(frame, repoRoot) {
     const mapUrl = stripQuery(frame.url) + ".map";
+    // SSRF guard: the sourcemap URL is derived from an untrusted stack frame, so
+    // refuse to fetch anything that isn't the local machine (this tool inspects
+    // local dev servers) before a single byte leaves the process.
+    let host;
+    try {
+        host = new URL(mapUrl).hostname;
+    }
+    catch {
+        return null;
+    }
+    if (!isLoopback(host))
+        return null;
     let rawMap;
     try {
         const res = await fetch(mapUrl);
@@ -108,7 +261,7 @@ async function trySourceMap(frame, repoRoot) {
     }
 }
 export function extractSnippet(filePath, targetLine, window = 4) {
-    if (!isFile(filePath))
+    if (!isFile(filePath) || isSensitive(filePath))
         return `<file not accessible locally: ${filePath}>`;
     const lines = fs.readFileSync(filePath, "utf-8").split("\n");
     const start = Math.max(0, targetLine - window - 1);

package/dist/core/specCompiler.js

@@ -10,10 +10,11 @@ const js = (s) => JSON.stringify(s);
 export function compileSpec(finding, actions, url) {
     const title = finding.rawMessage.split("\n")[0].slice(0, 80) || "unknown error";
     const needle = finding.rawMessage.split("\n")[0].slice(0, 120);
+    const hasRequest = actions.some((a) => a.type === "request");
     const out = [];
     out.push(`import { test, expect } from "@playwright/test";`);
     out.push(``);
-    out.push(`// Aztrx repro — ${finding.id}`);
+    out.push(`// Aztrx AI repro — ${finding.id}`);
     out.push(`// severity: ${finding.severity}   type: ${finding.type}`);
     if (finding.mappedLocation) {
         out.push(`// source: ${finding.mappedLocation.filePath}:${finding.mappedLocation.line}:${finding.mappedLocation.column}`);
@@ -32,6 +33,16 @@ export function compileSpec(finding, actions, url) {
             out.push(`  await page.mouse.wheel(0, ${a.value === "up" ? -600 : 600});`);
             continue;
         }
+        if (a.type === "request" && a.request) {
+            out.push(`  {`);
+            out.push(`    const status = await page.evaluate(async (r) => {`);
+            out.push(`      try { const resp = await fetch(r.url, { method: r.method, headers: r.headers, body: r.body }); return resp.status; }`);
+            out.push(`      catch { return 0; }`);
+            out.push(`    }, ${JSON.stringify(a.request)});`);
+            out.push(`    expect(status).toBeGreaterThanOrEqual(500);`);
+            out.push(`  }`);
+            continue;
+        }
         const sel = a.selectors[0];
         if (!sel) {
             out.push(`  // (skipped — no reliable selector for this step)`);
@@ -56,7 +67,11 @@ export function compileSpec(finding, actions, url) {
                 break;
         }
     }
-    out.push(`  await expect.poll(() => errors.join("\\n"), { timeout: 5000 }).toContain(${js(needle)});`);
+    if (!hasRequest) {
+        // A server-side 5xx produces no `pageerror`/`console.error` — the per-request
+        // status assertion above is the proof instead, so skip the error poll.
+        out.push(`  await expect.poll(() => errors.join("\\n"), { timeout: 5000 }).toContain(${js(needle)});`);
+    }
     out.push(`});`);
     return out.join("\n") + "\n";
 }

package/dist/core/studio.js

@@ -29,7 +29,6 @@ function sseHandler(req, res, eventsFile) {
         "Content-Type": "text/event-stream; charset=utf-8",
         "Cache-Control": "no-cache",
         Connection: "keep-alive",
-        "Access-Control-Allow-Origin": "*",
     });
     res.write(`data: ${JSON.stringify({ type: "hello" })}\n\n`);
     let offset = 0;
@@ -166,7 +165,7 @@ function dashboardHtml() {
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Aztrx Studio</title>
+<title>Aztrx AI Studio</title>
 <style>${BASE_CSS}</style>
 </head>
 <body>
@@ -209,8 +208,8 @@ export function startStudio(opts) {
             return sendFile(res, path.join(aztrxDir, "repro", path.basename(url)), "text/plain; charset=utf-8");
         return send(res, 404, "text/plain; charset=utf-8", "not found");
     });
-    server.listen(port, () => {
-        console.log(pc.cyan("\n⚡ Aztrx Studio"));
+    server.listen(port, "127.0.0.1", () => {
+        console.log(pc.cyan("\nAztrx AI Studio"));
         console.log(pc.dim(`   → http://localhost:${port}`));
         console.log(pc.dim(`   watching ${path.relative(process.cwd(), eventsFile)}`));
         console.log(pc.dim("   Ctrl+C to stop\n"));

package/dist/core/ui.js

@@ -53,6 +53,8 @@ h1 .brand-sub{color:var(--dim)}
 h2{font-size:15px;margin:0;font-weight:600;word-break:break-word}
 .loc{color:var(--dim);font-size:12.5px;margin-top:8px}
 .snippet{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:12px 0 0;white-space:pre}
+.server{color:var(--amber);font-size:12.5px;margin-top:8px}
+.server-body{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:8px 0 0;white-space:pre;max-height:240px;overflow-y:auto}
 .occ{color:var(--dim);font-size:12px;margin-top:8px}
 .repro{display:inline-flex;align-items:center;gap:8px;font-size:12px;margin-top:12px;padding:4px 10px;border-radius:6px;border:1px solid}
 .repro.deterministic{color:var(--green);border-color:rgba(67,229,138,.35);background:rgba(67,229,138,.07)}

package/dist/ui/app.js

@@ -17,12 +17,13 @@ const PHASE_LABEL = {
     launch: { text: "◉ launching browser…", color: C.azure },
     walk: { text: "◉ walking the DOM…", color: C.azure },
     fuzz: { text: "◉ fuzzing (chaos)…", color: C.azure },
+    "http-fuzz": { text: "◉ fuzzing (HTTP mutations)…", color: C.azure },
     repro: { text: "◉ minimize → compile → validate…", color: C.azure },
     heal: { text: "◉ healing (redact → generate → gate → sandbox → verify)…", color: C.azure },
     done: { text: "✓ done", color: C.green },
 };
 // Actions that mutate app state — the ones that "count" toward ops/sec.
-const EFFECTIVE = new Set(["click", "input", "select", "keypress"]);
+const EFFECTIVE = new Set(["click", "input", "select", "keypress", "request"]);
 function reducer(state, msg) {
     switch (msg.type) {
         case "phase":
@@ -122,7 +123,7 @@ function AztrxApp({ bus, done, targetUrl, repoRoot, mode }) {
     }, [done, exit]);
     const phase = PHASE_LABEL[state.phase];
     const currentRoute = state.routes[state.routes.length - 1] ?? targetUrl;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "\u26A1 Aztrx" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsx(Text, { color: C.dim, children: "   v0.1.0" })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsx(Text, { color: C.dim, children: "   v0.1.1" })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
 }
 /** Mount the live terminal panel and resolve once the run (or a failure) ends. */
 export function renderTui(props) {

package/media/logo.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 36">
+  <rect width="32" height="32" rx="7" fill="#000000"/>
+  <path d="M4 6 H16" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M7 11 H19" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M15 16 H27" fill="none" stroke="#ffffff" stroke-width="3.5" stroke-linecap="round"/>
+  <circle cx="28.5" cy="16" r="1.8" fill="#ffffff"/>
+  <path d="M13 21 H25" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M16 26 H28" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+</svg>

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "aztrx-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
-  "description": "Aztrx — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
+  "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
   "author": "Danis Chaparov <d.chaparov@gmail.com>",
   "type": "module",
   "bin": { "aztrx-cli": "dist/cli.js" },
   "main": "dist/core/orchestrator.js",
-  "files": ["dist", "README.md", "LICENSE"],
+  "files": ["dist", "README.md", "LICENSE", "media"],
   "engines": { "node": ">=18" },
   "keywords": ["testing", "playwright", "stress-test", "fuzzing", "web-app", "debugging", "repro", "qa", "e2e"],
   "repository": {