aztrx-cli 0.1.0 → 0.2.0

package/dist/core/modernize.js

@@ -0,0 +1,144 @@
+/**
+ * F-modernize — the "code translator". Rewrites a legacy JS/TS file into modern
+ * idiomatic form (const/let over var, async/await over callbacks and promise
+ * chains, arrow functions, optional chaining) while preserving behavior. This is
+ * a *static* transform, unlike the rest of Aztrx's runtime detection, so it's its
+ * own command rather than a `run` flag.
+ *
+ * Safety model: the model's output is gated by a re-parse (`ts.transpileModule`
+ * reports syntax errors without running a full tsc), and the caller applies it to
+ * the working tree only after the user confirms — never automatically.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import * as ts from "typescript";
+const MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
+const API_URL = "https://api.anthropic.com/v1/messages";
+export function detectLang(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if ([".ts", ".tsx", ".mts", ".cts"].includes(ext))
+        return "ts";
+    if ([".js", ".jsx", ".mjs", ".cjs"].includes(ext))
+        return "js";
+    return null;
+}
+/** Syntax gate: does the output still parse? In-process (no tsc subprocess). */
+export function parseGate(source, lang) {
+    const result = ts.transpileModule(source, {
+        compilerOptions: {
+            target: ts.ScriptTarget.ES2022,
+            module: ts.ModuleKind.ESNext,
+            allowJs: true,
+            jsx: ts.JsxEmit.Preserve,
+        },
+        reportDiagnostics: true,
+    });
+    const errors = (result.diagnostics ?? [])
+        .filter((d) => d.category === ts.DiagnosticCategory.Error)
+        .map((d) => ts.flattenDiagnosticMessageText(d.messageText, "\n"));
+    return { ok: errors.length === 0, errors };
+}
+const SYSTEM = "You are a careful code-modernization engineer. You rewrite legacy JavaScript/TypeScript into modern idiomatic form while preserving behavior exactly. You never change logic, control flow, or behavior — only syntax and idioms.";
+function buildPrompt(source, lang) {
+    const language = lang === "ts" ? "TypeScript" : "JavaScript";
+    return [
+        `Rewrite the following ${language} file into modern idiomatic form:`,
+        `- prefer const/let over var`,
+        `- prefer async/await over callbacks and promise .then chains`,
+        `- prefer arrow functions, optional chaining, and nullish coalescing where they do not change behavior`,
+        `- do NOT change any logic, control flow, or behavior — only modernize syntax and idioms`,
+        `- do NOT add imports; only remove an import if it is genuinely unused`,
+        ``,
+        `Return ONLY a JSON object, no markdown fences, no prose. Shape:`,
+        `{ "modernized": "<the full modernized file content>", "changes": ["short human-readable change", "..."] }`,
+        ``,
+        `--- file (${language}) ---`,
+        source,
+        `--- end file ---`,
+    ].join("\n");
+}
+function parseReply(raw) {
+    let text = raw.trim();
+    const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/i);
+    if (fence)
+        text = fence[1].trim();
+    const start = text.indexOf("{");
+    const end = text.lastIndexOf("}");
+    if (start >= 0 && end > start)
+        text = text.slice(start, end + 1);
+    const data = JSON.parse(text);
+    const modernized = typeof data.modernized === "string" ? data.modernized : "";
+    const changes = Array.isArray(data.changes)
+        ? data.changes.filter((c) => typeof c === "string").slice(0, 20)
+        : [];
+    return { modernized, changes };
+}
+export async function modernizeFile(repoRoot, filePath) {
+    const lang = detectLang(filePath);
+    if (!lang) {
+        return { ok: false, original: "", changes: [], error: `unsupported file type (only JS/TS): ${filePath}` };
+    }
+    const abs = path.resolve(repoRoot, filePath);
+    let original;
+    try {
+        original = fs.readFileSync(abs, "utf-8");
+    }
+    catch (e) {
+        return { ok: false, original: "", changes: [], error: `cannot read ${filePath}: ${e.message}` };
+    }
+    const key = process.env.ANTHROPIC_API_KEY;
+    if (!key) {
+        return { ok: false, original, changes: [], lang, error: "ANTHROPIC_API_KEY is not set" };
+    }
+    let reply;
+    try {
+        const res = await fetch(API_URL, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "x-api-key": key,
+                "anthropic-version": "2023-06-01",
+            },
+            body: JSON.stringify({
+                model: MODEL,
+                max_tokens: 8192,
+                temperature: 0,
+                system: SYSTEM,
+                messages: [{ role: "user", content: buildPrompt(original, lang) }],
+            }),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            return { ok: false, original, changes: [], lang, error: `LLM request failed (${res.status}): ${body.slice(0, 300)}` };
+        }
+        const data = (await res.json());
+        reply = (data.content ?? [])
+            .filter((c) => c.type === "text")
+            .map((c) => c.text ?? "")
+            .join("\n");
+    }
+    catch (e) {
+        return { ok: false, original, changes: [], lang, error: `LLM request failed: ${e.message}` };
+    }
+    let parsed;
+    try {
+        parsed = parseReply(reply);
+    }
+    catch {
+        return { ok: false, original, changes: [], lang, error: "could not parse the model reply" };
+    }
+    if (!parsed.modernized.trim()) {
+        return { ok: false, original, changes: [], lang, error: "model returned an empty file" };
+    }
+    const gate = parseGate(parsed.modernized, lang);
+    if (!gate.ok) {
+        return {
+            ok: false,
+            original,
+            changes: parsed.changes,
+            lang,
+            error: `modernized output does not parse: ${gate.errors[0] ?? "syntax error"}`,
+        };
+    }
+    return { ok: true, original, modernized: parsed.modernized, changes: parsed.changes, lang };
+}

package/dist/core/orchestrator.js

@@ -1,14 +1,9 @@
 import * as path from "path";
-import { chromium } from "playwright";
 import pc from "picocolors";
 import { EventBus } from "./eventBus.js";
-import { attachInterceptor } from "./interceptor.js";
-import { SignalClassifier, loadBaseline } from "./classifier.js";
-import { ActionRecorder } from "./recorder.js";
-import { walkDom } from "./domWalker.js";
-import { fuzz } from "./fuzzer.js";
+import { loadBaseline } from "./classifier.js";
 import { attachNetworkGuard, allowHostsFrom } from "./networkGuard.js";
-import { resolveFrame } from "./resolver.js";
+import { swarmDetect } from "./swarm.js";
 import { ReplayEngine } from "./replay.js";
 import { minimize } from "./minimizer.js";
 import { writeSpec } from "./specCompiler.js";
@@ -30,14 +25,21 @@ function printFinding(f, write) {
         write(pc.dim(`   ${f.mappedLocation.filePath}:${f.mappedLocation.line}:${f.mappedLocation.column}`));
         write(pc.dim(f.mappedLocation.codeContext));
     }
+    if (f.serverError) {
+        write(pc.dim(`   server: ${f.serverError.message}`));
+    }
     if (f.occurrences > 1)
         write(pc.dim(`   (×${f.occurrences})`));
     write("");
 }
 /** Human-readable run mode, surfaced in the cloud dashboard. */
 function runMode(o) {
+    if ((o.workers ?? 1) > 1)
+        return `swarm (${o.workers} workers)`;
     if (o.fuzz)
         return `fuzz (seed ${o.seed ?? 42})`;
+    if (o.httpFuzz)
+        return "http fuzz";
     if (o.heal)
         return "repro → heal";
     if (o.repro)
@@ -55,7 +57,7 @@ function runMode(o) {
 export async function run(options) {
     const { url, repoRoot } = options;
     const maxActions = options.maxActions ?? 100;
-    const guardOn = Boolean(options.fuzz || options.repro);
+    const guardOn = Boolean(options.fuzz || options.repro || (options.workers ?? 1) > 1);
     const allowHosts = allowHostsFrom(url, options.allowHosts ?? []);
     const ui = options.ui === true;
     const bus = options.bus ?? new EventBus();
@@ -64,7 +66,7 @@ export async function run(options) {
             console.log(parts.join(" "));
     };
     const emitPhase = (phase, detail) => bus.emit("phase", { phase, detail, ts: Date.now() });
-    say(pc.cyan("\n⚡ Aztrx v0.1.0 — Runtime Detector"));
+    say(pc.cyan("\nAztrx AI v0.1.1 — Runtime Detector"));
     say(pc.dim(`Target: ${url}`));
     say(pc.dim(`Repo:   ${repoRoot}`));
     if (options.fuzz)
@@ -77,86 +79,64 @@ export async function run(options) {
         say(pc.dim(`Auth:   ${options.storageState}`));
     say("");
     emitPhase("launch", url);
-    const classifier = new SignalClassifier(await loadBaseline(repoRoot));
-    const recorder = new ActionRecorder();
     const runLog = new RunLog(repoRoot);
     runLog.reset();
     runLog.append({ type: "run_start", url, ts: Date.now() });
-    bus.on("action", (a) => recorder.record(a));
-    bus.on("telemetry", async (payload) => {
-        const finding = classifier.classify(payload);
-        if (!finding)
-            return;
-        finding.actionHistory = recorder.snapshot();
-        if (finding.severity === "noise") {
-            bus.emit("noise", { ts: Date.now() });
-            return;
-        }
-        runLog.append({ type: "finding", finding });
-        if (payload.url && payload.line) {
-            const resolved = await resolveFrame({ url: payload.url, line: payload.line, column: payload.column ?? 0, message: payload.rawMessage }, repoRoot);
-            finding.mappedLocation = {
-                filePath: resolved.sourceFile,
-                line: resolved.line,
-                column: resolved.column,
-                codeContext: resolved.codeSnippet,
-                isOwnCode: resolved.resolvedFrom !== "unresolved",
-            };
-        }
-        bus.emit("finding", finding);
-        printFinding(finding, say);
-    });
-    const browser = await chromium.launch({ headless: true });
-    const context = await browser.newContext(options.storageState ? { storageState: options.storageState } : {});
-    const page = await context.newPage();
-    attachInterceptor(page, bus);
-    if (guardOn) {
-        await attachNetworkGuard(page, {
-            allowHosts,
-            onBlock: (u) => say(pc.dim(`  [guard] blocked ${u}`)),
-        });
+    const baseline = await loadBaseline(repoRoot);
+    const workers = options.workers ?? 1;
+    // F-swarm — parallel detection. One worker is the legacy pass; `--http-fuzz`
+    // or `workers > 1` fan out into a swarm. Findings come back merged by
+    // fingerprint, with per-worker action history already attached.
+    if (workers > 1 || options.httpFuzz) {
+        emitPhase("swarm", `${workers} worker(s)`);
     }
-    page.on("framenavigated", (frame) => {
-        if (frame === page.mainFrame())
-            bus.emit("route", { url: frame.url(), ts: Date.now() });
-    });
-    let loaded = true;
-    await page.goto(url, { waitUntil: "load", timeout: 30000 }).catch((e) => {
-        loaded = false;
-        say(pc.red("Failed to load target: ") + pc.dim(e.message));
+    else if (options.fuzz) {
+        emitPhase("fuzz");
+    }
+    else {
+        emitPhase("walk");
+    }
+    const { findings, replayStorageState: swarmAuthState, totalActions, workerCount, } = await swarmDetect({
+        url,
+        repoRoot,
+        maxActions,
+        dryRun: options.dryRun,
+        fuzz: options.fuzz,
+        httpFuzz: options.httpFuzz,
+        httpFuzzMutations: options.httpFuzzMutations,
+        seed: options.seed ?? 42,
+        workers,
+        allowHosts,
+        storageState: options.storageState,
+        login: options.login,
+        loginEmail: options.loginEmail,
+        loginPassword: options.loginPassword,
+        loginUrl: options.loginUrl,
+        crashTest: options.crashTest,
+        baseline,
+        guardOn,
+        log: say,
     });
-    if (loaded) {
-        // Settle: wait for hydration and mount-time effects (async fetches,
-        // unhandled rejections, React warnings) to fire before we act. A page whose
-        // only bugs are mount-time would otherwise be closed before they happen —
-        // and a page with no interactive elements fuzzes zero actions, so it relies
-        // on this window.
-        await page.waitForTimeout(2000);
+    // Replays reuse the swarm-captured auth state, or the explicit --storage-state.
+    const replayStorageState = swarmAuthState ?? options.storageState;
+    // Surface the merged findings to the live panel, run log, and console.
+    for (const f of findings) {
+        bus.emit("finding", f);
+        runLog.append({ type: "finding", finding: f });
+        printFinding(f, say);
     }
-    if (loaded && options.crashTest) {
-        await page.evaluate(() => {
-            setTimeout(() => {
-                throw new Error("Aztrx test: Cannot read properties of undefined (reading 'token')");
-            }, 300);
-        });
-        await page.waitForTimeout(800);
+    if (workerCount > 1) {
+        say(pc.dim(`\nSwarm: ${totalActions} action(s) across ${workerCount} worker(s).\n`));
     }
-    if (loaded) {
-        emitPhase(options.fuzz ? "fuzz" : "walk");
-        const acted = options.fuzz
-            ? await fuzz(page, bus, { seed: options.seed, maxActions, dryRun: options.dryRun })
-            : await walkDom(page, bus, { maxActions, dryRun: options.dryRun });
-        say(pc.dim(`\n${options.fuzz ? "Fuzzed" : "Walked"} ${acted} action(s).\n`));
+    else {
+        say(pc.dim(`\n${options.fuzz ? "Fuzzed" : "Walked"} ${totalActions} action(s).\n`));
     }
-    await page.waitForTimeout(500);
-    await browser.close();
-    const findings = classifier.findings();
     // F7 → F8 → F9: minimize each finding, compile an executable spec, validate
     // the flake rate. Only crash/error findings with a recorded action history.
     if (options.repro) {
         const engine = new ReplayEngine({
             attachGuard: async (p) => attachNetworkGuard(p, { allowHosts }),
-            storageState: options.storageState,
+            storageState: replayStorageState,
         });
         try {
             const targets = findings.filter((f) => (f.severity === "crash" || f.severity === "error") && f.actionHistory.length > 0);
@@ -240,11 +220,16 @@ export async function run(options) {
     // the patch is only ever handed to a human for review, never committed.
     if (options.heal) {
         const healTargets = findings.filter((f) => (f.severity === "crash" || f.severity === "error") &&
+            // A `network_5xx` finding heals only when its 500 body leaked a server
+            // stack (→ an own-code source location); heal then boots the patched app
+            // to verify. `network_timeout` stays excluded — it needs a time-based
+            // repro first.
+            f.type !== "network_timeout" &&
             f.mappedLocation?.isOwnCode &&
             f.repro &&
             f.repro.verdict !== "unreliable");
         if (healTargets.length) {
-            say(pc.cyan("— Closed-loop healing (redact → generate → gate → sandbox → verify) —"));
+            say(pc.cyan("— Closed-loop healing (redact → generate → gate → sandbox → test → verify) —"));
             emitPhase("heal");
             for (const f of healTargets) {
                 say(pc.dim(`  healing: ${f.rawMessage.split("\n")[0].slice(0, 60)}`));
@@ -257,6 +242,10 @@ export async function run(options) {
                         allowHosts: [...allowHosts],
                         model: options.healModel,
                         fastModel: options.healFastModel,
+                        testCommand: options.testCommand,
+                        testTimeoutMs: options.testTimeoutMs,
+                        skipTest: options.skipTest,
+                        startCommand: options.startCommand,
                     });
                     f.heal = result;
                     bus.emit("heal", {

package/dist/core/pr.js

@@ -1,5 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
+import { sanitizeSecrets } from "./heal/redact.js";
 /**
  * F-report — the PR bot's markdown comment. Same findings as the HTML report,
  * reshaped for a GitHub PR: a status badge, one `<details>` per finding, the
@@ -14,12 +15,6 @@ const SEV_BADGE = {
     warning: "f5a623",
     noise: "5b6573",
 };
-const SEV_ICON = {
-    crash: "💥",
-    error: "🚨",
-    warning: "⚠️",
-    noise: "·",
-};
 /** Shields.io badge-path escaping: literal `-` → `--`, `/` → `%2F`, space → `_`. */
 function shield(s) {
     return s.replace(/-/g, "--").replace(/\//g, "%2F").replace(/ /g, "_");
@@ -30,6 +25,28 @@ function badge(label, value, color) {
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+/** Wrap `code` in a backtick fence one longer than any run inside it, so the
+ * content can never close the fence (blocks markdown breakout from a hostile
+ * sourcemap snippet or patch). */
+function fence(code, lang = "") {
+    const runs = code.match(/`+/g) ?? [];
+    const maxRun = runs.reduce((m, r) => Math.max(m, r.length), 0);
+    const delim = "`".repeat(Math.max(3, maxRun + 1));
+    return `${delim}${lang}\n${code.trimEnd()}\n${delim}`;
+}
+/** Inline code that can't be broken out of — backticks/newlines are stripped. */
+function inlineCode(s) {
+    return "`" + s.replace(/`/g, "").replace(/[\r\n]/g, " ") + "`";
+}
+/** Scrub secrets and strip markdown-breakout chars for anything inlined into a
+ * heading or inline-code span. The PR comment renders untrusted stack/snippet
+ * text — a secret in it (or a stray backtick) must never leak or break out. */
+function cleanInline(s) {
+    return sanitizeSecrets(s).replace(/`/g, "").replace(/[\r\n]/g, " ");
+}
+/** Hard cap on the server body inlined into a PR comment — a 500 page can be
+ * huge, and only the first line or two are ever diagnostic. */
+const SERVER_BODY_CAP = 2000;
 function readIfExists(p) {
     try {
         return fs.readFileSync(p, "utf-8");
@@ -39,8 +56,8 @@ function readIfExists(p) {
     }
 }
 function describeAction(a) {
-    const sel = a.selectors[0] ? ` \`${a.selectors[0]}\`` : "";
-    const val = a.value ? ` \`${a.value}\`` : "";
+    const sel = a.selectors[0] ? ` ${inlineCode(sanitizeSecrets(a.selectors[0]))}` : "";
+    const val = a.value ? ` ${inlineCode(sanitizeSecrets(a.value))}` : "";
     return `**${a.type}**${val}${sel}`;
 }
 function healBlock(f) {
@@ -52,6 +69,7 @@ function healBlock(f) {
         unfixed: { text: "unfixed", color: "f5a623" },
         rejected: { text: "rejected", color: "ff5a5f" },
         "compile-failed": { text: "compile-failed", color: "ff5a5f" },
+        "test-failed": { text: "test-failed", color: "ff5a5f" },
         "apply-failed": { text: "apply-failed", color: "ff5a5f" },
         skipped: { text: "skipped", color: "5b6573" },
         "no-llm": { text: "no-llm", color: "5b6573" },
@@ -63,13 +81,14 @@ function healBlock(f) {
     // The saved unified diff is only produced for a patch that reached verify.
     const diff = h.patchPath ? readIfExists(path.resolve(h.patchPath)) : null;
     if (diff) {
-        body.push("```diff");
-        body.push(diff.trimEnd());
-        body.push("```");
+        body.push(fence(diff, "diff"));
     }
     else if (h.explanation) {
         body.push(`> ${h.explanation}`);
     }
+    if (h.test?.ran) {
+        body.push(`**tests** ${inlineCode(h.test.command)} — ${h.test.ok ? "passed" : "failed"}`);
+    }
     if (h.error)
         body.push(`\n_${escapeHtml(h.error)}_`);
     return `\n<details>\n<summary>${badge("heal", meta.text, meta.color)} proposed patch${via}${tiers}</summary>\n\n${body.join("\n")}\n</details>`;
@@ -83,20 +102,25 @@ function reproBlock(f) {
         ? `\n${r.actions.map((a, i) => `${i + 1}. ${describeAction(a)}`).join("\n")}`
         : "";
     const spec = readIfExists(path.resolve(r.specPath));
-    const specBlock = spec ? `\n\`\`\`ts\n${spec.trimEnd()}\n\`\`\`` : "";
+    const specBlock = spec ? `\n${fence(spec, "ts")}` : "";
     return `\n<details>\n<summary>▶ ${verdict} · ${r.actions.length} step(s)</summary>\n\n**Reproduce**${steps}${specBlock}\n</details>`;
 }
 function findingBlock(f) {
     const sev = f.severity;
-    const icon = SEV_ICON[sev] ?? "·";
-    const first = f.rawMessage.split("\n")[0];
+    const first = sanitizeSecrets(f.rawMessage.split("\n")[0]);
     const loc = f.mappedLocation
-        ? `\n**Location** \`${f.mappedLocation.filePath}:${f.mappedLocation.line}:${f.mappedLocation.column}\``
+        ? `\n**Location** \`${cleanInline(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}\``
         : "";
     const snippet = f.mappedLocation?.codeContext
-        ? `\n\n\`\`\`${path.extname(f.mappedLocation.filePath).replace(".", "") || "ts"}\n${f.mappedLocation.codeContext.trimEnd()}\n\`\`\``
+        ? `\n\n${fence(sanitizeSecrets(f.mappedLocation.codeContext), path.extname(f.mappedLocation.filePath).replace(".", "") || "ts")}`
+        : "";
+    const serverErr = f.serverError
+        ? `\n**Server** ${escapeHtml(sanitizeSecrets(f.serverError.message))}` +
+            (f.serverError.body
+                ? `\n\n${fence(sanitizeSecrets(f.serverError.body.slice(0, SERVER_BODY_CAP)), "text")}`
+                : "")
         : "";
-    return `<details open>\n<summary>${icon} <code>${escapeHtml(sev)}</code> — ${escapeHtml(first)}</summary>\n${loc}${snippet}${reproBlock(f)}${healBlock(f)}\n</details>`;
+    return `<details open>\n<summary><code>${escapeHtml(sev)}</code> — ${escapeHtml(first)}</summary>\n${loc}${snippet}${serverErr}${reproBlock(f)}${healBlock(f)}\n</details>`;
 }
 export function renderPrComment(targetUrl, findings, opts = {}) {
     void opts;
@@ -120,13 +144,13 @@ export function renderPrComment(targetUrl, findings, opts = {}) {
         .join("  ");
     const body = sorted.length
         ? sorted.map(findingBlock).join("\n\n")
-        : "> ✅ No crash, error, or warning surfaced — the app survived this pass.";
+        : "> No crash, error, or warning surfaced — the app survived this pass.";
     return `<!-- aztrx -->
-## ⚡ Aztrx — runtime stress-test
+## Aztrx AI — runtime stress-test
 
 ${summaryBadges}
 
-**Target** \`${targetUrl}\` · **${counts.crash ?? 0} crash** · **${counts.error ?? 0} error** · **${counts.warning ?? 0} warning**
+**Target** \`${cleanInline(targetUrl)}\` · **${counts.crash ?? 0} crash** · **${counts.error ?? 0} error** · **${counts.warning ?? 0} warning**
 
 ---
 

package/dist/core/prompt.js

@@ -0,0 +1,22 @@
+/**
+ * A single yes/no confirmation for `--fix`. Kept tiny and side-effect free:
+ *
+ *   - `--yes` short-circuits to `true` (scripts/CI).
+ *   - a non-TTY stdout without `--yes` short-circuits to `false` — an unattended
+ *     run never mutates the working tree, it just leaves the `.patch` files.
+ *   - otherwise prompts on stdin, defaulting to "no".
+ */
+import * as readline from "readline";
+export function promptYesNo(question, opts = {}) {
+    if (opts.yes === true)
+        return Promise.resolve(true);
+    if (process.stdout.isTTY !== true)
+        return Promise.resolve(false);
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question + " ", (answer) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(answer.trim()));
+        });
+    });
+}

package/dist/core/replay.js

@@ -26,6 +26,22 @@ export async function replayActions(page, actions) {
             await page.waitForTimeout(30);
             continue;
         }
+        if (a.type === "request" && a.request) {
+            // Issue the request in-page so the attached interceptor sees the response
+            // and emits `network_5xx` — that is how a server finding reproduces here.
+            await page
+                .evaluate(async (r) => {
+                try {
+                    await fetch(r.url, { method: r.method, headers: r.headers, body: r.body });
+                }
+                catch {
+                    // ignore — the 5xx (or its absence) is observed by the interceptor
+                }
+            }, a.request)
+                .catch(() => { });
+            await page.waitForTimeout(50);
+            continue;
+        }
         for (const sel of a.selectors) {
             const loc = page.locator(sel).first();
             const n = await loc.count().catch(() => 0);
@@ -66,7 +82,7 @@ export class ReplayEngine {
             this.browser = await chromium.launch({ headless: true });
         return this.browser;
     }
-    async run(url, actions, targetFingerprint) {
+    async run(url, actions, targetFingerprint, opts) {
         // The browser is reused across replays for speed, but after enough page
         // loads a renderer can crash. Relaunch once and retry so a single crash
         // doesn't take down the whole repro pipeline.
@@ -80,7 +96,18 @@ export class ReplayEngine {
                 page = await context.newPage();
                 const bus = new EventBus();
                 const fingerprints = new Set();
-                bus.on("telemetry", (p) => fingerprints.add(fingerprintOf(p)));
+                const types = new Set();
+                // For type-based verification (server findings), ignore telemetry from the
+                // initial load + settle window — only the replayed requests count. Client
+                // verification stays fingerprint-exact and keeps collecting from page
+                // attach, so a mount-time client bug still verifies.
+                let collecting = !opts?.targetType;
+                bus.on("telemetry", (p) => {
+                    if (!collecting)
+                        return;
+                    fingerprints.add(fingerprintOf(p));
+                    types.add(p.type);
+                });
                 attachInterceptor(page, bus);
                 if (this.opts.attachGuard)
                     await this.opts.attachGuard(page);
@@ -89,9 +116,14 @@ export class ReplayEngine {
                 // `load` event plus a settle window, and a replay that clicks before React
                 // attaches its handlers won't reproduce the crash (false "unreliable").
                 await page.waitForTimeout(2000);
+                if (opts?.targetType)
+                    collecting = true;
                 await replayActions(page, actions);
                 await page.waitForTimeout(300);
-                return { reproduced: fingerprints.has(targetFingerprint) };
+                const reproduced = opts?.targetType
+                    ? types.has(opts.targetType)
+                    : fingerprints.has(targetFingerprint);
+                return { reproduced };
             }
             catch (e) {
                 lastError = e;

package/dist/core/report.js

@@ -1,9 +1,15 @@
 import * as fs from "fs";
 import * as path from "path";
 import { BASE_CSS, SEVERITY_COLOR, seismograph } from "./ui.js";
+import { sanitizeSecrets } from "./heal/redact.js";
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+/** HTML-escape AND scrub secrets — the report renders untrusted stack/snippet
+ * text, so a secret that survives into it must not reach the file. */
+function clean(s) {
+    return escapeHtml(sanitizeSecrets(s));
+}
 const SEV_ORDER = ["crash", "error", "warning", "noise"];
 /**
  * F-report — standalone offline HTML report. Self-contained (inline CSS, no
@@ -19,17 +25,23 @@ export function renderReport(targetUrl, findings) {
     const cards = sorted
         .map((f) => {
         const loc = f.mappedLocation
-            ? `${escapeHtml(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
+            ? `${clean(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
+            : "";
+        const snippet = f.mappedLocation ? clean(f.mappedLocation.codeContext) : "";
+        const serverErr = f.serverError
+            ? `<div class="server">server: ${clean(f.serverError.message)}</div>` +
+                (f.serverError.body
+                    ? `<pre class="server-body">${clean(f.serverError.body)}</pre>`
+                    : "")
             : "";
-        const snippet = f.mappedLocation ? escapeHtml(f.mappedLocation.codeContext) : "";
         const repro = f.repro
             ? `<div class="repro ${f.repro.verdict}">${f.repro.verdict} · ${f.repro.reproductions}/${f.repro.runs} runs · ${f.repro.actions.length} step(s) · <code>${escapeHtml(path.basename(f.repro.specPath))}</code></div>`
             : "";
         const steps = f.actionHistory.length
             ? `<details><summary>action history (${f.actionHistory.length})</summary><ol>${f.actionHistory
                 .map((a) => {
-                const detail = a.value ? ` <span>${escapeHtml(a.value)}</span>` : "";
-                const sel = a.selectors[0] ? ` ${escapeHtml(a.selectors[0])}` : "";
+                const detail = a.value ? ` <span>${clean(a.value)}</span>` : "";
+                const sel = a.selectors[0] ? ` ${clean(a.selectors[0])}` : "";
                 return `<li><code>${escapeHtml(a.type)}${detail}</code>${sel}</li>`;
             })
                 .join("")}</ol></details>`
@@ -38,10 +50,11 @@ export function renderReport(targetUrl, findings) {
     <article class="finding">
       <header>
         <span class="sev" style="--sev:${SEVERITY_COLOR[f.severity]}">${escapeHtml(f.severity)}</span>
-        <h2>${escapeHtml(f.rawMessage.split("\n")[0])}</h2>
+        <h2>${clean(f.rawMessage.split("\n")[0])}</h2>
       </header>
       ${loc ? `<div class="loc">${loc}</div>` : ""}
       ${snippet ? `<pre class="snippet">${snippet}</pre>` : ""}
+      ${serverErr}
       ${f.occurrences > 1 ? `<div class="occ">seen ×${f.occurrences}</div>` : ""}
       ${repro}
       ${steps}
@@ -63,7 +76,7 @@ export function renderReport(targetUrl, findings) {
     <div class="brand-row">
       <h1><span class="brand">aztrx</span> <span class="brand-sub">report</span></h1>
     </div>
-    <div class="target">${escapeHtml(targetUrl)}</div>
+    <div class="target">${clean(targetUrl)}</div>
   </div>
   <div class="bar">
     <span class="count">crash <b class="crash">${counts.crash ?? 0}</b></span>