aztrx-cli 0.1.0 → 0.2.0

package/dist/core/resolver.js

@@ -16,6 +16,35 @@ export function extractFrame(text) {
         message: text.split("\n")[0].trim().slice(0, 200),
     };
 }
+/** True if `p` looks like an absolute source path — a `file://` URL, a POSIX
+ * absolute path, or a Windows drive path. Rejects bare relative tokens like
+ * `route.ts` so a stray `foo:12:34` in a stack body is never mistaken for a file. */
+function isServerPath(p) {
+    return p.startsWith("file://") || p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
+}
+/**
+ * Pull the first server-side source frame out of a raw server stack (a 500 body,
+ * a Next.js dev error page, etc.). V8 emits one frame per line as
+ * `at <fn> (<path>:<line>:<col>)` or `at <path>:<line>:<col>`; we take the first
+ * frame whose path is not inside node_modules. Best-effort — returns null when
+ * the body carries no stack trace (e.g. an explicit
+ * `NextResponse.json(..., { status: 500 })`).
+ */
+export function extractServerFrame(stack) {
+    for (const raw of stack.split("\n")) {
+        const line = raw.trim();
+        const m = line.match(/\(?([^\s()"']+):(\d+):(\d+)\)?$/);
+        if (!m)
+            continue;
+        const filePath = m[1];
+        if (!isServerPath(filePath))
+            continue;
+        if (filePath.includes("node_modules"))
+            continue;
+        return { filePath, line: parseInt(m[2], 10), column: parseInt(m[3], 10) };
+    }
+    return null;
+}
 function stripQuery(url) {
     return url.split("?")[0];
 }
@@ -29,6 +58,55 @@ function isFile(p) {
         return false;
     }
 }
+/** Secret-bearing filenames that must never be read, even inside the repo — a
+ * hostile sourcemap could otherwise point `source` at `.env`, an npmrc, or a
+ * private key and exfiltrate it into the report / PR comment. */
+function isSensitive(p) {
+    const name = path.basename(p).toLowerCase();
+    // Dotfiles that hold secrets.
+    if (name === ".env" ||
+        name.startsWith(".env.") ||
+        name === ".npmrc" ||
+        name === ".yarnrc" ||
+        name === ".netrc" ||
+        name === ".htpasswd" ||
+        name === ".git-credentials") {
+        return true;
+    }
+    // SSH / private keys.
+    if (/^id_(rsa|ed25519|ecdsa|dsa)(\..*)?$/.test(name))
+        return true;
+    // Certificate and keystore material.
+    if (/\.(pem|key|p12|pfx|jks|keystore|p8)$/.test(name))
+        return true;
+    // Names that advertise secrets.
+    if (/(credential|secret|service[-_]?account|private[-_]?key)/.test(name))
+        return true;
+    return false;
+}
+/** Resolve `segments` under `root`, returning null if the result escapes the
+ * root — via `..` traversal or a symlink pointing outside it. This is the
+ * boundary that keeps sourcemap- and URL-derived paths from reading (or,
+ * downstream, healing) arbitrary files outside the repo. */
+function resolveWithin(root, ...segments) {
+    const candidate = path.resolve(root, ...segments);
+    const rel = path.relative(root, candidate);
+    if (rel.startsWith("..") || path.isAbsolute(rel))
+        return null;
+    // Symlink escape: when the file exists, its real path must also stay inside.
+    try {
+        const realRoot = fs.realpathSync(root);
+        const realTarget = fs.realpathSync(candidate);
+        const realRel = path.relative(realRoot, realTarget);
+        if (realRel.startsWith("..") || path.isAbsolute(realRel))
+            return null;
+    }
+    catch {
+        // realpath fails for not-yet-existing candidates — the lexical check above
+        // already ran and is sufficient for those.
+    }
+    return candidate;
+}
 /** Turns a sourcemap `source` value into candidate absolute paths to probe. */
 function sourceCandidates(source, repoRoot) {
     const cleaned = source
@@ -38,11 +116,13 @@ function sourceCandidates(source, repoRoot) {
         .replace(/^\//, "")
         .split("?")[0];
     const prefixes = ["", "apps/web/", "src/", "app/"];
-    return prefixes.map((p) => path.resolve(repoRoot, p, cleaned));
+    return prefixes
+        .map((p) => resolveWithin(repoRoot, p, cleaned))
+        .filter((c) => c !== null);
 }
 function locateFile(candidates) {
     for (const c of candidates) {
-        if (isFile(c))
+        if (isFile(c) && !isSensitive(c))
             return c;
     }
     return null;
@@ -56,18 +136,91 @@ export async function resolveFrame(frame, repoRoot) {
     const relative = stripQuery(frame.url)
         .replace(/^https?:\/\/[^/]+\//, "")
         .replace(/^\//, "");
-    const directPath = path.resolve(repoRoot, relative);
+    const directPath = resolveWithin(repoRoot, relative);
+    if (!directPath) {
+        return {
+            message: frame.message,
+            sourceFile: relative,
+            line: frame.line,
+            column: frame.column,
+            codeSnippet: `<file not accessible locally: ${relative}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
     return {
         message: frame.message,
         sourceFile: path.relative(repoRoot, directPath),
         line: frame.line,
         column: frame.column,
         codeSnippet: extractSnippet(directPath, frame.line),
-        resolvedFrom: isFile(directPath) ? "direct" : "unresolved",
+        resolvedFrom: isFile(directPath) && !isSensitive(directPath) ? "direct" : "unresolved",
     };
 }
+/**
+ * Resolve a server-side source frame (a filesystem path) to a repo-relative
+ * source location + snippet. Mirrors `resolveFrame`'s containment rules: a path
+ * outside the repo — via `..` traversal or a symlink pointing out — is never
+ * read. Server frames carry no sourcemap; a directly-readable file maps
+ * `resolvedFrom: "direct"`.
+ */
+export function resolveServerFrame(frame, repoRoot) {
+    let p = frame.filePath.replace(/^file:\/\//, "");
+    if (/^\/[A-Za-z]:[\\/]/.test(p))
+        p = p.slice(1); // /C:/x → C:/x (Windows-on-POSIX)
+    const abs = path.resolve(p);
+    const rel = path.relative(repoRoot, abs);
+    let contained = !(rel.startsWith("..") || path.isAbsolute(rel));
+    if (contained) {
+        try {
+            const realRoot = fs.realpathSync(repoRoot);
+            const realTarget = fs.realpathSync(abs);
+            const realRel = path.relative(realRoot, realTarget);
+            if (realRel.startsWith("..") || path.isAbsolute(realRel))
+                contained = false;
+        }
+        catch {
+            // realpath fails for a not-yet-existing candidate — the lexical check above suffices.
+        }
+    }
+    if (!contained) {
+        return {
+            message: frame.filePath,
+            sourceFile: abs,
+            line: frame.line,
+            column: frame.column,
+            codeSnippet: `<file not accessible locally: ${abs}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
+    const resolvedFrom = isFile(abs) && !isSensitive(abs) ? "direct" : "unresolved";
+    return {
+        message: frame.filePath,
+        sourceFile: rel,
+        line: frame.line,
+        column: frame.column,
+        codeSnippet: extractSnippet(abs, frame.line),
+        resolvedFrom,
+    };
+}
+/** True for a loopback hostname — the only place a sourcemap URL may point. */
+function isLoopback(host) {
+    const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "0.0.0.0";
+}
 async function trySourceMap(frame, repoRoot) {
     const mapUrl = stripQuery(frame.url) + ".map";
+    // SSRF guard: the sourcemap URL is derived from an untrusted stack frame, so
+    // refuse to fetch anything that isn't the local machine (this tool inspects
+    // local dev servers) before a single byte leaves the process.
+    let host;
+    try {
+        host = new URL(mapUrl).hostname;
+    }
+    catch {
+        return null;
+    }
+    if (!isLoopback(host))
+        return null;
     let rawMap;
     try {
         const res = await fetch(mapUrl);
@@ -108,7 +261,7 @@ async function trySourceMap(frame, repoRoot) {
     }
 }
 export function extractSnippet(filePath, targetLine, window = 4) {
-    if (!isFile(filePath))
+    if (!isFile(filePath) || isSensitive(filePath))
         return `<file not accessible locally: ${filePath}>`;
     const lines = fs.readFileSync(filePath, "utf-8").split("\n");
     const start = Math.max(0, targetLine - window - 1);

package/dist/core/specCompiler.js

@@ -10,10 +10,11 @@ const js = (s) => JSON.stringify(s);
 export function compileSpec(finding, actions, url) {
     const title = finding.rawMessage.split("\n")[0].slice(0, 80) || "unknown error";
     const needle = finding.rawMessage.split("\n")[0].slice(0, 120);
+    const hasRequest = actions.some((a) => a.type === "request");
     const out = [];
     out.push(`import { test, expect } from "@playwright/test";`);
     out.push(``);
-    out.push(`// Aztrx repro — ${finding.id}`);
+    out.push(`// Aztrx AI repro — ${finding.id}`);
     out.push(`// severity: ${finding.severity}   type: ${finding.type}`);
     if (finding.mappedLocation) {
         out.push(`// source: ${finding.mappedLocation.filePath}:${finding.mappedLocation.line}:${finding.mappedLocation.column}`);
@@ -32,6 +33,16 @@ export function compileSpec(finding, actions, url) {
             out.push(`  await page.mouse.wheel(0, ${a.value === "up" ? -600 : 600});`);
             continue;
         }
+        if (a.type === "request" && a.request) {
+            out.push(`  {`);
+            out.push(`    const status = await page.evaluate(async (r) => {`);
+            out.push(`      try { const resp = await fetch(r.url, { method: r.method, headers: r.headers, body: r.body }); return resp.status; }`);
+            out.push(`      catch { return 0; }`);
+            out.push(`    }, ${JSON.stringify(a.request)});`);
+            out.push(`    expect(status).toBeGreaterThanOrEqual(500);`);
+            out.push(`  }`);
+            continue;
+        }
         const sel = a.selectors[0];
         if (!sel) {
             out.push(`  // (skipped — no reliable selector for this step)`);
@@ -56,7 +67,11 @@ export function compileSpec(finding, actions, url) {
                 break;
         }
     }
-    out.push(`  await expect.poll(() => errors.join("\\n"), { timeout: 5000 }).toContain(${js(needle)});`);
+    if (!hasRequest) {
+        // A server-side 5xx produces no `pageerror`/`console.error` — the per-request
+        // status assertion above is the proof instead, so skip the error poll.
+        out.push(`  await expect.poll(() => errors.join("\\n"), { timeout: 5000 }).toContain(${js(needle)});`);
+    }
     out.push(`});`);
     return out.join("\n") + "\n";
 }

package/dist/core/studio.js

@@ -29,7 +29,6 @@ function sseHandler(req, res, eventsFile) {
         "Content-Type": "text/event-stream; charset=utf-8",
         "Cache-Control": "no-cache",
         Connection: "keep-alive",
-        "Access-Control-Allow-Origin": "*",
     });
     res.write(`data: ${JSON.stringify({ type: "hello" })}\n\n`);
     let offset = 0;
@@ -166,7 +165,7 @@ function dashboardHtml() {
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Aztrx Studio</title>
+<title>Aztrx AI Studio</title>
 <style>${BASE_CSS}</style>
 </head>
 <body>
@@ -209,8 +208,8 @@ export function startStudio(opts) {
             return sendFile(res, path.join(aztrxDir, "repro", path.basename(url)), "text/plain; charset=utf-8");
         return send(res, 404, "text/plain; charset=utf-8", "not found");
     });
-    server.listen(port, () => {
-        console.log(pc.cyan("\n⚡ Aztrx Studio"));
+    server.listen(port, "127.0.0.1", () => {
+        console.log(pc.cyan("\nAztrx AI Studio"));
         console.log(pc.dim(`   → http://localhost:${port}`));
         console.log(pc.dim(`   watching ${path.relative(process.cwd(), eventsFile)}`));
         console.log(pc.dim("   Ctrl+C to stop\n"));

package/dist/core/summarize.js

@@ -0,0 +1,173 @@
+/**
+ * F13 — the "X-ray report": a plain-language summary of a run's findings,
+ * instead of a wall of stack traces. Two engines behind one entry point:
+ *
+ *   - LLM (Anthropic Messages API) when `ANTHROPIC_API_KEY` is set — friendly
+ *     prose in the requested language, mirroring the transport in `heal/llm.ts`.
+ *   - deterministic template when there is no key (or the call fails) — a
+ *     readable, structured list that needs no network.
+ *
+ * An empty run short-circuits to the template (no reason to pay for "all clear").
+ * The offer-to-apply line is emitted only when verified fixes are actually ready,
+ * so `--explain` (no healing) never promises a fix it doesn't have.
+ */
+const MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
+const API_URL = "https://api.anthropic.com/v1/messages";
+function normalizeLang(lang) {
+    return lang === "ru" ? "ru" : "en";
+}
+/** Russian plural form picker: [one, few, many]. */
+function ruPlural(n, forms) {
+    const mod10 = n % 10;
+    const mod100 = n % 100;
+    if (mod10 === 1 && mod100 !== 11)
+        return forms[0];
+    if (mod10 >= 2 && mod10 <= 4 && (mod100 < 12 || mod100 > 14))
+        return forms[1];
+    return forms[2];
+}
+const PHRASES = {
+    en: {
+        none: "No problems found — the app survived this pass.",
+        found: (n) => `I scanned your code and found ${n} problem${n === 1 ? "" : "s"}:`,
+        offer: (n) => `I've prepared ${n} verified fix${n === 1 ? "" : "es"}.`,
+        severity: { crash: "crash", error: "error", warning: "warning", noise: "noise" },
+        type: {
+            uncaught_exception: "uncaught exception",
+            unhandled_rejection: "unhandled promise rejection",
+            console_error: "console error",
+            network_5xx: "server error (5xx)",
+            network_timeout: "network timeout",
+        },
+        repro: "repro",
+        fix: "fix",
+        healed: "healed",
+    },
+    ru: {
+        none: "Проблем не найдено — приложение пережило этот проход.",
+        found: (n) => `Привет! Я просканировал твой код и нашёл ${n} ${ruPlural(n, ["проблему", "проблемы", "проблем"])}:`,
+        offer: (n) => `Я подготовил ${n} ${ruPlural(n, ["исправление", "исправления", "исправлений"])}, каждое проверено тестами.`,
+        severity: { crash: "краш", error: "ошибка", warning: "предупреждение", noise: "шум" },
+        type: {
+            uncaught_exception: "необработанное исключение",
+            unhandled_rejection: "необработанный reject промиса",
+            console_error: "ошибка в консоли",
+            network_5xx: "ошибка сервера (5xx)",
+            network_timeout: "таймаут сети",
+        },
+        repro: "воспроизведение",
+        fix: "фикс",
+        healed: "вылечено",
+    },
+};
+function location(f) {
+    const m = f.mappedLocation;
+    if (!m || !m.filePath)
+        return "";
+    return `${m.filePath}:${m.line}:${m.column}`;
+}
+function shortMessage(f) {
+    const line = f.rawMessage.split("\n")[0].trim();
+    return line.length > 120 ? line.slice(0, 117) + "…" : line;
+}
+/** One bullet for the template engine: location, kind, and the one-line message. */
+function describeFinding(f, p) {
+    const loc = location(f);
+    const head = loc ? `${loc} — ` : "";
+    const kind = `${p.type[f.type]} (${p.severity[f.severity]})`;
+    const lines = [`${head}${kind}: "${shortMessage(f)}"`];
+    const tail = [];
+    if (f.repro && f.repro.verdict !== "unreliable") {
+        tail.push(`${p.repro}: ${f.repro.verdict} (${f.repro.reproductions}/${f.repro.runs})`);
+    }
+    if (f.heal) {
+        tail.push(`${p.fix}: ${f.heal.status === "healed" ? p.healed : f.heal.status}`);
+    }
+    if (tail.length)
+        lines.push(`  ${tail.join(" · ")}`);
+    return lines.join("\n");
+}
+/** Deterministic, offline summary. Used as the no-key fallback and for empty runs. */
+export function summarizeFindingsTemplate(findings, lang = "en") {
+    const p = PHRASES[lang];
+    if (findings.length === 0)
+        return p.none;
+    const healed = findings.filter((f) => f.heal?.status === "healed");
+    const bullets = findings
+        .map((f, i) => `  ${i + 1}. ${describeFinding(f, p)}`)
+        .join("\n");
+    const lines = [p.found(findings.length), "", bullets];
+    if (healed.length)
+        lines.push("", p.offer(healed.length));
+    return lines.join("\n");
+}
+function buildLlmPrompt(findings, lang, hasHealed) {
+    const rows = findings
+        .map((f) => {
+        const loc = location(f) || "(no source location)";
+        const repro = f.repro ? `${f.repro.verdict} ${f.repro.reproductions}/${f.repro.runs}` : "none";
+        const heal = f.heal
+            ? f.heal.status + (f.heal.explanation ? ` — ${f.heal.explanation}` : "")
+            : "n/a";
+        return `- ${loc} | ${f.type} | severity=${f.severity} | "${shortMessage(f)}" | repro=${repro} | heal=${heal}`;
+    })
+        .join("\n");
+    const fixLine = hasHealed
+        ? "Verified fixes ARE ready to apply — mention that they are prepared."
+        : "No fixes were prepared — do not offer to apply anything.";
+    return [
+        `A QA tool scanned a web app and found the following findings:`,
+        rows,
+        "",
+        `Write a short, friendly, plain-language summary for a developer (${lang}): what was found, what each problem means in simple words, and — per the note below — whether fixes are ready. Do not invent details that are not listed. Keep it to a few short paragraphs or a tight bullet list.`,
+        fixLine,
+    ].join("\n");
+}
+const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise, human-language summary for a developer. Never invent details absent from the data. Respond in the requested language only.";
+async function summarizeFindingsLlm(findings, lang) {
+    const hasHealed = findings.some((f) => f.heal?.status === "healed");
+    const res = await fetch(API_URL, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-api-key": process.env.ANTHROPIC_API_KEY,
+            "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+            model: MODEL,
+            max_tokens: 1024,
+            temperature: 0.2,
+            system: SYSTEM,
+            messages: [{ role: "user", content: buildLlmPrompt(findings, lang, hasHealed) }],
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`summarize: LLM request failed (${res.status}): ${body.slice(0, 300)}`);
+    }
+    const data = (await res.json());
+    const text = (data.content ?? [])
+        .filter((c) => c.type === "text")
+        .map((c) => c.text ?? "")
+        .join("\n")
+        .trim();
+    return text || summarizeFindingsTemplate(findings, lang);
+}
+/**
+ * Entry point. Empty run → template (no API cost). Otherwise LLM when a key is
+ * present; falls back to the deterministic template on any transport failure, so
+ * the report never crashes the run.
+ */
+export async function summarizeFindings(findings, opts = {}) {
+    const lang = normalizeLang(opts.lang);
+    if (findings.length === 0)
+        return summarizeFindingsTemplate(findings, lang);
+    if (!process.env.ANTHROPIC_API_KEY)
+        return summarizeFindingsTemplate(findings, lang);
+    try {
+        return await summarizeFindingsLlm(findings, lang);
+    }
+    catch {
+        return summarizeFindingsTemplate(findings, lang);
+    }
+}