aztrx-cli 0.1.0 → 0.2.0

package/dist/core/swarm.js

@@ -0,0 +1,235 @@
+/**
+ * F-swarm — parallel detection. Runs N workers at once, each with its own
+ * browser context, event bus, action recorder, and classifier, so the action
+ * history attached to a finding belongs to the worker that saw it (never
+ * interleaved). Workers attack different sides: a deterministic walk, several
+ * chaos-fuzz seeds, and — optionally — the server-side HTTP fuzzer.
+ *
+ * Findings are merged by fingerprint at the end (occurrences summed, the richest
+ * action history / source mapping kept); the caller then runs repro/heal on the
+ * merged set as usual.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { chromium } from "playwright";
+import { EventBus } from "./eventBus.js";
+import { attachInterceptor } from "./interceptor.js";
+import { establishLogin } from "./auth.js";
+import { SignalClassifier } from "./classifier.js";
+import { ActionRecorder } from "./recorder.js";
+import { walkDom } from "./domWalker.js";
+import { fuzz } from "./fuzzer.js";
+import { httpFuzz } from "./httpFuzzer.js";
+import { attachNetworkGuard } from "./networkGuard.js";
+import { resolveFrame, resolveServerFrame } from "./resolver.js";
+/**
+ * Run one worker's detection pass and return its findings. All internal events
+ * flow through a local bus (isolation); only `action`/`route`/`noise` are
+ * forwarded to `forwardBus` so a live panel can aggregate, never per-worker
+ * findings (those are merged by the caller first).
+ */
+export async function detectWorker(browser, opts, strategy, forwardBus) {
+    const workerBus = new EventBus();
+    const recorder = new ActionRecorder();
+    const classifier = new SignalClassifier(opts.baseline);
+    workerBus.on("action", (a) => {
+        recorder.record(a);
+        forwardBus?.emit("action", a);
+    });
+    workerBus.on("route", (r) => forwardBus?.emit("route", r));
+    workerBus.on("noise", (n) => forwardBus?.emit("noise", n));
+    // Classify telemetry with THIS worker's recorder, so action history is correct.
+    workerBus.on("telemetry", async (payload) => {
+        const finding = classifier.classify(payload);
+        if (!finding)
+            return;
+        finding.actionHistory = recorder.snapshot();
+        if (finding.severity === "noise") {
+            workerBus.emit("noise", { ts: Date.now() });
+            return;
+        }
+        if (payload.serverError) {
+            finding.serverError = { message: payload.serverError.message, body: payload.serverError.body };
+        }
+        if (payload.url && payload.line) {
+            const resolved = await resolveFrame({ url: payload.url, line: payload.line, column: payload.column ?? 0, message: payload.rawMessage }, opts.repoRoot);
+            finding.mappedLocation = {
+                filePath: resolved.sourceFile,
+                line: resolved.line,
+                column: resolved.column,
+                codeContext: resolved.codeSnippet,
+                isOwnCode: resolved.resolvedFrom !== "unresolved",
+            };
+        }
+        else if (payload.serverError?.frame) {
+            const resolved = resolveServerFrame(payload.serverError.frame, opts.repoRoot);
+            finding.mappedLocation = {
+                filePath: resolved.sourceFile,
+                line: resolved.line,
+                column: resolved.column,
+                codeContext: resolved.codeSnippet,
+                isOwnCode: resolved.resolvedFrom !== "unresolved",
+            };
+        }
+    });
+    const context = await browser.newContext(opts.storageState ? { storageState: opts.storageState } : {});
+    const page = await context.newPage();
+    attachInterceptor(page, workerBus);
+    if (opts.guardOn) {
+        await attachNetworkGuard(page, {
+            allowHosts: opts.allowHosts,
+            onBlock: (u) => opts.log(`[guard] blocked ${u}`),
+        });
+    }
+    page.on("framenavigated", (frame) => {
+        if (frame === page.mainFrame())
+            workerBus.emit("route", { url: frame.url(), ts: Date.now() });
+    });
+    let loaded = true;
+    await page.goto(opts.url, { waitUntil: "load", timeout: 30000 }).catch((e) => {
+        loaded = false;
+        opts.log(`Failed to load target: ${e.message}`);
+    });
+    if (loaded) {
+        // Settle for hydration and mount-time effects before acting.
+        await page.waitForTimeout(2000);
+    }
+    // Auto-login (best-effort). The server-side HTTP fuzzer uses Node-side fetch,
+    // so it doesn't benefit from a browser session — skip it there.
+    let replayStorageState;
+    if (loaded && strategy.kind !== "http-fuzz" && opts.login && opts.loginEmail && opts.loginPassword) {
+        const res = await establishLogin(page, {
+            email: opts.loginEmail,
+            password: opts.loginPassword,
+            loginUrl: opts.loginUrl,
+        });
+        if (res.ok) {
+            if (opts.saveAuthState) {
+                const state = await context.storageState();
+                const authStatePath = path.join(opts.repoRoot, ".aztrx", "auth-state.json");
+                fs.mkdirSync(path.dirname(authStatePath), { recursive: true });
+                fs.writeFileSync(authStatePath, JSON.stringify(state, null, 2), "utf-8");
+                replayStorageState = authStatePath;
+                opts.log(`[auth] logged in → ${path.relative(opts.repoRoot, authStatePath)}`);
+            }
+            else {
+                opts.log("[auth] logged in");
+            }
+            await page.goto(opts.url, { waitUntil: "load", timeout: 30000 }).catch(() => { });
+        }
+        else {
+            opts.log(`[auth] skipped: ${res.reason}`);
+        }
+    }
+    if (loaded && opts.crashTest) {
+        await page.evaluate(() => {
+            setTimeout(() => {
+                throw new Error("Aztrx test: Cannot read properties of undefined (reading 'token')");
+            }, 300);
+        });
+        await page.waitForTimeout(800);
+    }
+    let actions = 0;
+    if (loaded) {
+        if (strategy.kind === "walk") {
+            actions = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun });
+        }
+        else if (strategy.kind === "fuzz") {
+            actions = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun });
+        }
+        else {
+            actions = await httpFuzz(page, opts.url, workerBus, {
+                maxRequests: opts.maxActions,
+                dryRun: opts.dryRun,
+                allowHosts: opts.allowHosts,
+                mutations: opts.httpFuzzMutations,
+            });
+        }
+    }
+    await page.waitForTimeout(500);
+    await context.close();
+    return { findings: classifier.findings(), actions, replayStorageState };
+}
+/** Dedup findings across workers by fingerprint: sum occurrences, keep the richest. */
+export function mergeFindings(arrays) {
+    const byFingerprint = new Map();
+    for (const arr of arrays) {
+        for (const f of arr) {
+            const existing = byFingerprint.get(f.fingerprint);
+            if (!existing) {
+                byFingerprint.set(f.fingerprint, { ...f, actionHistory: [...f.actionHistory] });
+                continue;
+            }
+            existing.occurrences += f.occurrences;
+            if (!existing.mappedLocation && f.mappedLocation)
+                existing.mappedLocation = f.mappedLocation;
+            if (existing.actionHistory.length < f.actionHistory.length)
+                existing.actionHistory = f.actionHistory;
+        }
+    }
+    return [...byFingerprint.values()];
+}
+/** Build the worker roster for a run. `workers = 1` with no http-fuzz is the
+ * legacy single pass; `--http-fuzz` and/or `workers > 1` fan out. */
+function buildStrategies(opts) {
+    const strategies = [];
+    if (opts.httpFuzz)
+        strategies.push({ kind: "http-fuzz" });
+    const w = Math.max(1, opts.workers);
+    if (w === 1) {
+        strategies.push(opts.fuzz ? { kind: "fuzz", seed: opts.seed } : { kind: "walk" });
+        return strategies;
+    }
+    if (opts.fuzz) {
+        for (let i = 0; i < w; i++)
+            strategies.push({ kind: "fuzz", seed: opts.seed + i });
+    }
+    else {
+        strategies.push({ kind: "walk" });
+        for (let i = 1; i < w; i++)
+            strategies.push({ kind: "fuzz", seed: opts.seed + i });
+    }
+    return strategies;
+}
+/** Launch one browser, run the worker roster concurrently, merge findings. */
+export async function swarmDetect(opts) {
+    const strategies = buildStrategies(opts);
+    const browser = await chromium.launch({ headless: true });
+    try {
+        const settled = await Promise.allSettled(strategies.map((strategy, i) => detectWorker(browser, {
+            url: opts.url,
+            repoRoot: opts.repoRoot,
+            allowHosts: opts.allowHosts,
+            maxActions: opts.maxActions,
+            dryRun: opts.dryRun,
+            guardOn: opts.guardOn,
+            storageState: opts.storageState,
+            login: opts.login,
+            loginEmail: opts.loginEmail,
+            loginPassword: opts.loginPassword,
+            loginUrl: opts.loginUrl,
+            crashTest: i === 0 ? opts.crashTest : false,
+            saveAuthState: i === 0,
+            httpFuzzMutations: opts.httpFuzzMutations,
+            baseline: opts.baseline,
+            log: (m) => opts.log(strategies.length > 1 ? `[w${i}] ${m}` : m),
+        }, strategy)));
+        const results = [];
+        settled.forEach((r, i) => {
+            if (r.status === "fulfilled")
+                results.push(r.value);
+            else
+                opts.log(`worker ${i} failed: ${r.reason?.message ?? String(r.reason)}`);
+        });
+        let replayStorageState;
+        for (const r of results)
+            if (r.replayStorageState)
+                replayStorageState = r.replayStorageState;
+        const findings = mergeFindings(results.map((r) => r.findings));
+        const totalActions = results.reduce((sum, r) => sum + r.actions, 0);
+        return { findings, replayStorageState, totalActions, workerCount: strategies.length };
+    }
+    finally {
+        await browser.close();
+    }
+}

package/dist/core/ui.js

@@ -53,6 +53,8 @@ h1 .brand-sub{color:var(--dim)}
 h2{font-size:15px;margin:0;font-weight:600;word-break:break-word}
 .loc{color:var(--dim);font-size:12.5px;margin-top:8px}
 .snippet{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:12px 0 0;white-space:pre}
+.server{color:var(--amber);font-size:12.5px;margin-top:8px}
+.server-body{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:8px 0 0;white-space:pre;max-height:240px;overflow-y:auto}
 .occ{color:var(--dim);font-size:12px;margin-top:8px}
 .repro{display:inline-flex;align-items:center;gap:8px;font-size:12px;margin-top:12px;padding:4px 10px;border-radius:6px;border:1px solid}
 .repro.deterministic{color:var(--green);border-color:rgba(67,229,138,.35);background:rgba(67,229,138,.07)}

package/dist/ui/app.js

@@ -15,14 +15,16 @@ const C = {
 };
 const PHASE_LABEL = {
     launch: { text: "◉ launching browser…", color: C.azure },
+    swarm: { text: "◉ swarm (parallel workers)…", color: C.azure },
     walk: { text: "◉ walking the DOM…", color: C.azure },
     fuzz: { text: "◉ fuzzing (chaos)…", color: C.azure },
+    "http-fuzz": { text: "◉ fuzzing (HTTP mutations)…", color: C.azure },
     repro: { text: "◉ minimize → compile → validate…", color: C.azure },
     heal: { text: "◉ healing (redact → generate → gate → sandbox → verify)…", color: C.azure },
     done: { text: "✓ done", color: C.green },
 };
 // Actions that mutate app state — the ones that "count" toward ops/sec.
-const EFFECTIVE = new Set(["click", "input", "select", "keypress"]);
+const EFFECTIVE = new Set(["click", "input", "select", "keypress", "request"]);
 function reducer(state, msg) {
     switch (msg.type) {
         case "phase":
@@ -122,7 +124,7 @@ function AztrxApp({ bus, done, targetUrl, repoRoot, mode }) {
     }, [done, exit]);
     const phase = PHASE_LABEL[state.phase];
     const currentRoute = state.routes[state.routes.length - 1] ?? targetUrl;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "\u26A1 Aztrx" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsx(Text, { color: C.dim, children: "   v0.1.0" })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsx(Text, { color: C.dim, children: "   v0.1.1" })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
 }
 /** Mount the live terminal panel and resolve once the run (or a failure) ends. */
 export function renderTui(props) {

package/media/logo.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 36">
+  <rect width="32" height="32" rx="7" fill="#000000"/>
+  <path d="M4 6 H16" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M7 11 H19" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M15 16 H27" fill="none" stroke="#ffffff" stroke-width="3.5" stroke-linecap="round"/>
+  <circle cx="28.5" cy="16" r="1.8" fill="#ffffff"/>
+  <path d="M13 21 H25" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+  <path d="M16 26 H28" fill="none" stroke="#ffffff" stroke-width="3" stroke-linecap="round"/>
+</svg>

package/package.json

@@ -1,16 +1,35 @@
 {
   "name": "aztrx-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
-  "description": "Aztrx — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
+  "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
   "author": "Danis Chaparov <d.chaparov@gmail.com>",
   "type": "module",
-  "bin": { "aztrx-cli": "dist/cli.js" },
+  "bin": {
+    "aztrx-cli": "dist/cli.js"
+  },
   "main": "dist/core/orchestrator.js",
-  "files": ["dist", "README.md", "LICENSE"],
-  "engines": { "node": ">=18" },
-  "keywords": ["testing", "playwright", "stress-test", "fuzzing", "web-app", "debugging", "repro", "qa", "e2e"],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "media"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "testing",
+    "playwright",
+    "stress-test",
+    "fuzzing",
+    "web-app",
+    "debugging",
+    "repro",
+    "qa",
+    "e2e"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/DanisChaparov/aztrx.git"