aztrx-cli 0.1.0

package/dist/core/classifier.js

@@ -0,0 +1,139 @@
+import * as fs from "fs";
+import * as path from "path";
+import { createHash } from "crypto";
+// Unambiguous framework files. NOTE: `/_next/static/chunks/` is NOT here —
+// in Next.js dev, user code is served from there too, so URL path alone can't
+// distinguish it. This is an approximation; the sourcemap resolver does the
+// precise own-code mapping separately.
+const DEP_FRAGMENTS = [
+    "node_modules",
+    "react-dom",
+    "react.development",
+    "react.production",
+    "scheduler.development",
+    "scheduler.production",
+    "next/dist",
+    "webpack-internal",
+];
+const NOISE_FRAGMENTS = [
+    "Download the React DevTools",
+    "react_devtools_backend",
+];
+// Dev-tooling artifacts that are not the app under test — the Next.js dev
+// overlay's "launch editor" source-resolver request, etc. Suppressed regardless
+// of signal type so they neither count as findings nor enter the repro pipeline.
+const DEV_TOOLING_NOISE = ["__nextjs_launch-editor"];
+// React 18/19 hydration mismatches (Next.js 15 App Router included). These are
+// boundary-level divergences between server and client render that stress runs
+// surface constantly but that aren't deterministic bugs in the app's logic —
+// letting them through would poison the repro pipeline. Suppressed as noise.
+const HYDRATION_NOISE = [
+    "Hydration failed",
+    "There was an error while hydrating",
+    "Text content does not match server-rendered HTML",
+    "A tree hydrated but some attributes of the server rendered HTML",
+    "An error occurred during hydration",
+    "Hydration completed but contained mismatches",
+];
+function normalize(message) {
+    return message
+        .replace(/\b\d+\b/g, "<N>")
+        .replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<UUID>")
+        .replace(/\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/g, "<TS>")
+        .replace(/0x[0-9a-f]+/gi, "<HEX>")
+        .replace(/\s+/g, " ");
+}
+function extractFrameUrls(stack) {
+    const urls = [];
+    const re = /https?:\/\/[^\s)"']+?:\d+:\d+/g;
+    let m;
+    while ((m = re.exec(stack)) !== null)
+        urls.push(m[0]);
+    return urls;
+}
+function isDepFrame(frame) {
+    return DEP_FRAGMENTS.some((d) => frame.includes(d));
+}
+function stripPos(frame) {
+    return frame.replace(/:\d+:\d+$/, "");
+}
+function hasOwnFrame(stack) {
+    const frames = extractFrameUrls(stack);
+    if (frames.length === 0)
+        return false;
+    return frames.some((f) => !isDepFrame(f));
+}
+export function fingerprintOf(payload) {
+    const frames = extractFrameUrls(payload.rawStack);
+    const own = frames.filter((f) => !isDepFrame(f)).slice(0, 3).map(stripPos);
+    const key = `${payload.type}|${normalize(payload.rawMessage)}|${own.join("|")}`;
+    return createHash("sha1").update(key).digest("hex").slice(0, 12);
+}
+function classifySeverity(payload, isOwnCode) {
+    if (DEV_TOOLING_NOISE.some((n) => payload.rawMessage.includes(n)))
+        return "noise";
+    if (HYDRATION_NOISE.some((n) => payload.rawMessage.includes(n)))
+        return "noise";
+    switch (payload.type) {
+        case "uncaught_exception":
+            return isOwnCode ? "crash" : "error";
+        case "unhandled_rejection":
+        case "network_5xx":
+        case "network_timeout":
+            return "error";
+        case "console_error":
+            if (NOISE_FRAGMENTS.some((n) => payload.rawMessage.includes(n)))
+                return "noise";
+            return "warning";
+    }
+}
+/**
+ * F3 — Signal classifier. Fingerprints, dedups, assigns severity, and
+ * suppresses a baseline of already-known fingerprints. Returns a Finding on
+ * first sight, `null` on duplicate or suppressed.
+ */
+export class SignalClassifier {
+    seen = new Map();
+    baseline = new Set();
+    constructor(baselineFingerprints = []) {
+        for (const f of baselineFingerprints)
+            this.baseline.add(f);
+    }
+    classify(payload) {
+        const fingerprint = fingerprintOf(payload);
+        if (this.baseline.has(fingerprint))
+            return null;
+        const existing = this.seen.get(fingerprint);
+        if (existing) {
+            existing.occurrences += 1;
+            return null; // dedup — count, don't re-emit
+        }
+        const isOwnCode = hasOwnFrame(payload.rawStack);
+        const finding = {
+            id: fingerprint,
+            fingerprint,
+            occurrences: 1,
+            severity: classifySeverity(payload, isOwnCode),
+            type: payload.type,
+            rawMessage: payload.rawMessage,
+            rawStack: payload.rawStack,
+            actionHistory: [],
+        };
+        this.seen.set(fingerprint, finding);
+        return finding;
+    }
+    /** Unique findings, noise suppressed. */
+    findings() {
+        return [...this.seen.values()].filter((f) => f.severity !== "noise");
+    }
+}
+export async function loadBaseline(repoRoot) {
+    const p = path.join(repoRoot, ".aztrx", "baseline.json");
+    try {
+        const arr = JSON.parse(fs.readFileSync(p, "utf-8"));
+        return Array.isArray(arr) ? arr.filter((x) => typeof x === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/core/cloud/index.js

@@ -0,0 +1,103 @@
+/**
+ * F12 — opt-in cloud sync. Streams a completed run's findings to the Aztrx
+ * ingest API (`POST /api/runs`) for the team dashboard and server-side
+ * deduplication by crash fingerprint. Mirrors the telemetry module's contract:
+ * fire-and-forget, bounded by a short abort, and never affects the exit code.
+ * Everything is sanitized before packaging (secrets, URLs, repo paths).
+ */
+import * as fs from "fs";
+import { detectFrameworkMeta } from "../init.js";
+import { createSanitizer } from "../telemetry/sanitize.js";
+const DEFAULT_CLOUD_URL = process.env.AZTRX_CLOUD_URL || "https://api.aztrx.app";
+const UPLOAD_TIMEOUT_MS = 2000;
+/** In-flight uploads, drained by `flushCloud()` before the CLI exits. */
+const pendingUploads = [];
+function readFileIfExists(p) {
+    try {
+        return fs.readFileSync(p, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
+function buildPayload(findings, opts) {
+    const sanitize = createSanitizer(opts.repoRoot);
+    const meta = detectFrameworkMeta(opts.repoRoot);
+    const cloudFindings = [];
+    for (const f of findings) {
+        if (f.severity !== "crash" && f.severity !== "error")
+            continue;
+        const specRaw = f.repro?.specPath ? readFileIfExists(f.repro.specPath) : null;
+        const patchRaw = f.heal?.status === "healed" && f.heal.patchPath
+            ? readFileIfExists(f.heal.patchPath)
+            : null;
+        cloudFindings.push({
+            fingerprint: f.fingerprint,
+            severity: f.severity,
+            type: f.type,
+            message: sanitize.text(f.rawMessage),
+            location: f.mappedLocation
+                ? {
+                    file: sanitize.text(f.mappedLocation.filePath),
+                    line: f.mappedLocation.line,
+                    column: f.mappedLocation.column,
+                }
+                : undefined,
+            repro: f.repro
+                ? {
+                    verdict: f.repro.verdict,
+                    rate: f.repro.rate,
+                    runs: f.repro.runs,
+                    reproductions: f.repro.reproductions,
+                    spec: specRaw ? sanitize.text(specRaw) : null,
+                }
+                : undefined,
+            patch: patchRaw ? sanitize.text(patchRaw) : null,
+            model_tier: f.heal?.model ?? null,
+        });
+    }
+    return {
+        schema: "aztrx.run/1",
+        sentAt: new Date().toISOString(),
+        framework: meta.framework,
+        framework_version: meta.version,
+        target: sanitize.url(opts.url),
+        mode: opts.mode,
+        counts: opts.counts,
+        findings: cloudFindings,
+    };
+}
+/** Fire-and-forget upload. Never rejects; bounded by a short abort. */
+export function dispatchUpload(payload, endpoint, apiKey) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), UPLOAD_TIMEOUT_MS);
+    const headers = { "content-type": "application/json" };
+    if (apiKey)
+        headers["x-api-key"] = apiKey;
+    return fetch(`${endpoint}/api/runs`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload),
+        signal: ctrl.signal,
+    })
+        .then(() => { })
+        .catch(() => { })
+        .finally(() => clearTimeout(timer));
+}
+/** Build the sanitized payload and detach an upload. A clean run (zero
+ * findings) still uploads — the dashboard tracks green runs too. */
+export function submitRun(findings, opts) {
+    const endpoint = opts.endpoint ?? DEFAULT_CLOUD_URL;
+    const apiKey = opts.apiKey ?? process.env.AZTRX_API_KEY;
+    const payload = buildPayload(findings, opts);
+    pendingUploads.push(dispatchUpload(payload, endpoint, apiKey));
+}
+/** Await all in-flight uploads (each already bounded). Called right before the
+ * CLI exits so a pending `--upload` isn't killed mid-flight; never affects exit
+ * code. */
+export async function flushCloud() {
+    while (pendingUploads.length) {
+        const batch = pendingUploads.splice(0);
+        await Promise.allSettled(batch);
+    }
+}

package/dist/core/domWalker.js

@@ -0,0 +1,80 @@
+import { selectorCascade } from "./recorder.js";
+// F6 guard-rail (part 1): never click anything that looks destructive. The
+// full deny-list (config regexps, data-aztrx-skip) is a later pass.
+export const DESTRUCTIVE = /(delete|remove|logout|sign\s?out|log\s?out|pay|checkout|submit\s?order|purchase|buy|удалить|оплатить|выйти|выход)/i;
+export const TEXT_INPUT_TYPES = new Set(["text", "search", "email", "tel", "url", "number", ""]);
+export const SELECTOR = 'a, button, input, select, textarea, [role="button"], [onclick]';
+/**
+ * F5-lite — discover interactive elements and act on them, tripping runtime
+ * errors for the interceptor to catch. This is the deterministic "walk every
+ * button" seed of the Chaos Fuzzer; rage-clicks, form fuzzing, and network
+ * jitter come next.
+ */
+export async function walkDom(page, bus, opts = {}) {
+    const max = opts.maxActions ?? 100;
+    const startUrl = page.url();
+    let actions = 0;
+    const handles = await page.$$(SELECTOR);
+    for (const handle of handles) {
+        if (actions >= max)
+            break;
+        if (page.url() !== startUrl)
+            break; // navigated — bail this pass
+        const visible = await handle.isVisible().catch(() => false);
+        const enabled = await handle.isEnabled().catch(() => false);
+        if (!visible || !enabled)
+            continue;
+        let tag;
+        try {
+            tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+        }
+        catch {
+            continue; // element unreadable mid-query — skip
+        }
+        let label = "";
+        try {
+            label = await handle.evaluate((el) => {
+                const t = el.innerText ||
+                    el.getAttribute("aria-label") ||
+                    el.getAttribute("value") ||
+                    el.getAttribute("placeholder") ||
+                    "";
+                return t.trim();
+            });
+        }
+        catch {
+            label = ""; // degraded — no label to filter on
+        }
+        if (DESTRUCTIVE.test(label))
+            continue;
+        if (tag === "a") {
+            const href = (await handle.getAttribute("href")) ?? "";
+            if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
+                continue;
+        }
+        if (tag === "input") {
+            const type = (await handle.getAttribute("type")) ?? "";
+            if (!TEXT_INPUT_TYPES.has(type))
+                continue; // skip password/hidden/submit/checkbox/etc.
+        }
+        const selectors = await selectorCascade(page, handle);
+        if (tag === "input" || tag === "textarea") {
+            const action = { type: "input", selectors, value: "test", timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun)
+                await handle.fill("test").catch(() => { });
+        }
+        else {
+            const action = { type: "click", selectors, timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun)
+                await handle.click({ timeout: 1500 }).catch(() => { });
+        }
+        actions++;
+        await page.waitForTimeout(120);
+    }
+    return actions;
+}
+export function originOf(url) {
+    return url.match(/^https?:\/\/[^/]+/)?.[0] ?? "";
+}

package/dist/core/eventBus.js

@@ -0,0 +1,22 @@
+/**
+ * Minimal typed event bus — the single backbone the modules communicate over,
+ * so the Orchestrator can be swapped for a cloud sink later without touching
+ * any module (hexagonal, per PRD §2.2).
+ */
+export class EventBus {
+    handlers = new Map();
+    on(event, handler) {
+        let set = this.handlers.get(event);
+        if (!set) {
+            set = new Set();
+            this.handlers.set(event, set);
+        }
+        set.add(handler);
+        return () => {
+            set.delete(handler);
+        };
+    }
+    emit(event, payload) {
+        this.handlers.get(event)?.forEach((h) => h(payload));
+    }
+}

package/dist/core/events.js

@@ -0,0 +1,25 @@
+import * as fs from "fs";
+import * as path from "path";
+/**
+ * Append-only JSON-lines run log. Every run writes its lifecycle + findings
+ * here so a live surface (Local Studio, later the cloud sink) can tail it
+ * without coupling to the orchestrator's console output.
+ */
+export class RunLog {
+    file;
+    constructor(repoRoot) {
+        const dir = path.join(repoRoot, ".aztrx");
+        fs.mkdirSync(dir, { recursive: true });
+        this.file = path.join(dir, "events.jsonl");
+    }
+    append(event) {
+        fs.appendFileSync(this.file, JSON.stringify(event) + "\n", "utf-8");
+    }
+    /** Truncate so the log represents the latest run only (live-tail semantics). */
+    reset() {
+        fs.writeFileSync(this.file, "", "utf-8");
+    }
+    get path() {
+        return this.file;
+    }
+}

package/dist/core/fuzzer.js

@@ -0,0 +1,175 @@
+import { selectorCascade } from "./recorder.js";
+import { SELECTOR, DESTRUCTIVE, TEXT_INPUT_TYPES, originOf } from "./domWalker.js";
+import { mulberry32 } from "./rng.js";
+const GARBAGE = [
+    "<script>alert(1)</script>",
+    "'; DROP TABLE users;--",
+    "a".repeat(4096),
+    "😀".repeat(64),
+    String.fromCharCode(0) + "null-byte",
+    "NaN",
+    "-1",
+    "0",
+    "99999999999999999999",
+    "\n\t\r  whitespace",
+    "\"'`${}[]()",
+    "undefined",
+];
+// Keys most likely to trip state-dependent bugs: Enter submits, Escape closes
+// modals, Backspace/Tab mutate focused fields, arrows scroll/select.
+const KEYS = ["Enter", "Escape", "Backspace", "Tab", "ArrowDown", "ArrowUp", " ", "Delete"];
+function pick(rnd, arr) {
+    return arr[Math.floor(rnd() * arr.length)];
+}
+/**
+ * F5 — chaos fuzzer. Seeded random walk with a richer vocabulary than the
+ * deterministic walk: clicks (occasionally doubled), hover, keypresses, select
+ * option changes, scrolls, and garbage-filled text inputs — tripping runtime
+ * errors for the interceptor. Skips anything the destructive deny-list flags,
+ * and never follows off-origin links.
+ */
+export async function fuzz(page, bus, opts = {}) {
+    const max = opts.maxActions ?? 100;
+    const rnd = mulberry32(opts.seed ?? 42);
+    const startUrl = page.url();
+    let acted = 0;
+    for (let i = 0; i < max; i++) {
+        if (page.url() !== startUrl) {
+            await page.goto(startUrl, { waitUntil: "domcontentloaded" }).catch(() => { });
+        }
+        // Occasional page-level scroll — reaches lazy-loaded / intersection-gated UI.
+        if (rnd() < 0.08) {
+            const dir = rnd() < 0.5 ? "up" : "down";
+            const action = { type: "scroll", selectors: [], value: dir, timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun)
+                await page.mouse.wheel(0, dir === "up" ? -600 : 600).catch(() => { });
+            acted++;
+            await page.waitForTimeout(40);
+            continue;
+        }
+        const handles = await page.$$(SELECTOR);
+        const visible = [];
+        for (const h of handles) {
+            const v = await h.isVisible().catch(() => false);
+            const e = await h.isEnabled().catch(() => false);
+            if (v && e)
+                visible.push(h);
+        }
+        if (visible.length === 0)
+            break;
+        const handle = pick(rnd, visible);
+        let tag;
+        try {
+            tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+        }
+        catch {
+            continue; // element detached/unreadable mid-query — skip
+        }
+        let label = "";
+        try {
+            label = await handle.evaluate((el) => {
+                const t = el.innerText ||
+                    el.getAttribute("aria-label") ||
+                    el.getAttribute("value") ||
+                    el.getAttribute("placeholder") ||
+                    "";
+                return t.trim();
+            });
+        }
+        catch {
+            label = ""; // degraded — no label to filter on
+        }
+        if (DESTRUCTIVE.test(label))
+            continue;
+        if (tag === "a") {
+            const href = (await handle.getAttribute("href")) ?? "";
+            if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
+                continue;
+        }
+        // Text inputs — mostly pour garbage in, sometimes hit keys or hover.
+        if (tag === "input" || tag === "textarea") {
+            const type = (await handle.getAttribute("type")) ?? "";
+            if (!TEXT_INPUT_TYPES.has(type))
+                continue;
+            const selectors = await selectorCascade(page, handle);
+            const roll = rnd();
+            if (roll < 0.6) {
+                const value = pick(rnd, GARBAGE);
+                const action = { type: "input", selectors, value, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.fill(value).catch(() => { });
+            }
+            else if (roll < 0.85) {
+                const key = pick(rnd, KEYS);
+                const action = { type: "keypress", selectors, value: key, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun) {
+                    await handle.focus().catch(() => { });
+                    await page.keyboard.press(key).catch(() => { });
+                }
+            }
+            else {
+                const action = { type: "hover", selectors, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.hover().catch(() => { });
+            }
+            acted++;
+            await page.waitForTimeout(60);
+            continue;
+        }
+        // Select — actually change the option, a common source of state bugs.
+        if (tag === "select") {
+            let options = [];
+            try {
+                options = await handle.evaluate((el) => Array.from(el.options).map((o) => o.value || o.textContent?.trim() || ""));
+            }
+            catch {
+                continue; // options unreadable — skip this select
+            }
+            if (options.length > 0) {
+                const value = pick(rnd, options);
+                const selectors = await selectorCascade(page, handle);
+                const action = { type: "select", selectors, value, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.selectOption(value).catch(() => { });
+                acted++;
+                await page.waitForTimeout(60);
+            }
+            continue;
+        }
+        // Clickable — mostly click, otherwise hover or keyboard-navigate.
+        const selectors = await selectorCascade(page, handle);
+        const roll = rnd();
+        if (roll < 0.55) {
+            const action = { type: "click", selectors, timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun) {
+                await handle.click({ timeout: 1000 }).catch(() => { });
+                if (rnd() < 0.15)
+                    await handle.click({ timeout: 1000 }).catch(() => { }); // double-click
+            }
+        }
+        else if (roll < 0.85) {
+            const action = { type: "hover", selectors, timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun)
+                await handle.hover().catch(() => { });
+        }
+        else {
+            const key = pick(rnd, KEYS);
+            const action = { type: "keypress", selectors, value: key, timestamp: Date.now() };
+            bus.emit("action", action);
+            if (!opts.dryRun) {
+                await handle.focus().catch(() => { });
+                await page.keyboard.press(key).catch(() => { });
+            }
+        }
+        acted++;
+        await page.waitForTimeout(60);
+    }
+    return acted;
+}