aztrx-cli 0.2.0 → 0.2.2

package/README.md

@@ -196,7 +196,7 @@ jobs:
     permissions: { contents: read, pull-requests: write }
     steps:
       - uses: actions/checkout@v4
-      - uses: DanisChaparov/aztrx@9b4065c71dcba1c98e20c999f54300c689cbaaa7
+      - uses: DanisChaparov/aztrx@17366eba81e6a790507d82a96eb4d7fd62f02ccd
         with:
           url: http://localhost:3000
           start-command: npm run dev          # optional — boot the app in the background
@@ -210,7 +210,7 @@ Or as a reusable workflow:
 on: pull_request
 jobs:
   aztrx:
-    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@9b4065c71dcba1c98e20c999f54300c689cbaaa7
+    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@17366eba81e6a790507d82a96eb4d7fd62f02ccd
     with:
       url: http://localhost:3000
       start-command: npm run dev
@@ -261,7 +261,7 @@ jobs:
             sleep 2
           done
       - name: Generate badge
-        run: npx --yes aztrx-cli@0.2.0 run http://localhost:3000 --badge badge.svg
+        run: npx --yes aztrx-cli@0.2.2 run http://localhost:3000 --badge badge.svg
       - name: Commit badge
         run: |
           git config user.name "github-actions[bot]"
@@ -320,7 +320,7 @@ LLM call.
   CORS.
 - **`.aztrx/` is gitignored** on `init` — repro specs, reports, and patches stay
   out of history.
-- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.2.0` (never
+- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.2.2` (never
   `@latest`).
 
 ## Telemetry & privacy

package/dist/core/domWalker.js

@@ -14,64 +14,92 @@ export async function walkDom(page, bus, opts = {}) {
     const max = opts.maxActions ?? 100;
     const startUrl = page.url();
     let actions = 0;
-    const handles = await page.$$(SELECTOR);
-    for (const handle of handles) {
-        if (actions >= max)
-            break;
-        if (page.url() !== startUrl)
-            break; // navigated — bail this pass
-        const visible = await handle.isVisible().catch(() => false);
-        const enabled = await handle.isEnabled().catch(() => false);
-        if (!visible || !enabled)
-            continue;
-        let tag;
-        try {
-            tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+    const seen = new Set();
+    // Re-scan the DOM after every action (the page may have mutated or navigated)
+    // rather than walking a stale snapshot. Mirrors the fuzzer's recover-and-iterate
+    // loop, but deterministically (document order) and without re-clicking elements
+    // it has already acted on.
+    while (actions < max) {
+        if (page.url() !== startUrl) {
+            // A previous action navigated away — return to the starting page.
+            await page.goto(startUrl, { waitUntil: "domcontentloaded" }).catch(() => { });
+            await page.waitForTimeout(300);
         }
-        catch {
-            continue; // element unreadable mid-query — skip
-        }
-        let label = "";
+        let handles;
         try {
-            label = await handle.evaluate((el) => {
-                const t = el.innerText ||
-                    el.getAttribute("aria-label") ||
-                    el.getAttribute("value") ||
-                    el.getAttribute("placeholder") ||
-                    "";
-                return t.trim();
-            });
+            handles = await page.$$(SELECTOR);
         }
         catch {
-            label = ""; // degraded — no label to filter on
-        }
-        if (DESTRUCTIVE.test(label))
+            // A navigation raced the re-scan — reset to the start page and retry.
+            await page.goto(startUrl, { waitUntil: "domcontentloaded" }).catch(() => { });
+            await page.waitForTimeout(300);
             continue;
-        if (tag === "a") {
-            const href = (await handle.getAttribute("href")) ?? "";
-            if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
-                continue;
-        }
-        if (tag === "input") {
-            const type = (await handle.getAttribute("type")) ?? "";
-            if (!TEXT_INPUT_TYPES.has(type))
-                continue; // skip password/hidden/submit/checkbox/etc.
-        }
-        const selectors = await selectorCascade(page, handle);
-        if (tag === "input" || tag === "textarea") {
-            const action = { type: "input", selectors, value: "test", timestamp: Date.now() };
-            bus.emit("action", action);
-            if (!opts.dryRun)
-                await handle.fill("test").catch(() => { });
         }
-        else {
-            const action = { type: "click", selectors, timestamp: Date.now() };
-            bus.emit("action", action);
-            if (!opts.dryRun)
-                await handle.click({ timeout: 1500 }).catch(() => { });
+        let acted = false;
+        for (const handle of handles) {
+            if (actions >= max)
+                break;
+            const visible = await handle.isVisible().catch(() => false);
+            const enabled = await handle.isEnabled().catch(() => false);
+            if (!visible || !enabled)
+                continue;
+            let tag;
+            try {
+                tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+            }
+            catch {
+                continue; // element unreadable mid-query — skip
+            }
+            let label = "";
+            try {
+                label = await handle.evaluate((el) => {
+                    const t = el.innerText ||
+                        el.getAttribute("aria-label") ||
+                        el.getAttribute("value") ||
+                        el.getAttribute("placeholder") ||
+                        "";
+                    return t.trim();
+                });
+            }
+            catch {
+                label = ""; // degraded — no label to filter on
+            }
+            if (DESTRUCTIVE.test(label))
+                continue;
+            if (tag === "a") {
+                const href = (await handle.getAttribute("href")) ?? "";
+                if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
+                    continue;
+            }
+            if (tag === "input") {
+                const type = (await handle.getAttribute("type")) ?? "";
+                if (!TEXT_INPUT_TYPES.has(type))
+                    continue; // skip password/hidden/submit/checkbox/etc.
+            }
+            const selectors = await selectorCascade(page, handle);
+            const signature = selectors.join("|") || `${tag}:${label}`;
+            if (seen.has(signature))
+                continue; // already acted on this element
+            seen.add(signature);
+            if (tag === "input" || tag === "textarea") {
+                const action = { type: "input", selectors, value: "test", timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.fill("test").catch(() => { });
+            }
+            else {
+                const action = { type: "click", selectors, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.click({ timeout: 1500 }).catch(() => { });
+            }
+            actions++;
+            acted = true;
+            await page.waitForTimeout(120);
+            break; // re-scan next iteration — the DOM may have changed
         }
-        actions++;
-        await page.waitForTimeout(120);
+        if (!acted)
+            break; // nothing left to act on
     }
     return actions;
 }

package/dist/core/orchestrator.js

@@ -1,5 +1,6 @@
 import * as path from "path";
 import pc from "picocolors";
+import { VERSION } from "./version.js";
 import { EventBus } from "./eventBus.js";
 import { loadBaseline } from "./classifier.js";
 import { attachNetworkGuard, allowHostsFrom } from "./networkGuard.js";
@@ -66,7 +67,7 @@ export async function run(options) {
             console.log(parts.join(" "));
     };
     const emitPhase = (phase, detail) => bus.emit("phase", { phase, detail, ts: Date.now() });
-    say(pc.cyan("\nAztrx AI v0.1.1 — Runtime Detector"));
+    say(pc.cyan(`\nAztrx AI v${VERSION} — Runtime Detector`));
     say(pc.dim(`Target: ${url}`));
     say(pc.dim(`Repo:   ${repoRoot}`));
     if (options.fuzz)
@@ -116,6 +117,7 @@ export async function run(options) {
         baseline,
         guardOn,
         log: say,
+        forwardBus: bus,
     });
     // Replays reuse the swarm-captured auth state, or the explicit --storage-state.
     const replayStorageState = swarmAuthState ?? options.storageState;

package/dist/core/swarm.js

@@ -213,7 +213,7 @@ export async function swarmDetect(opts) {
             httpFuzzMutations: opts.httpFuzzMutations,
             baseline: opts.baseline,
             log: (m) => opts.log(strategies.length > 1 ? `[w${i}] ${m}` : m),
-        }, strategy)));
+        }, strategy, opts.forwardBus)));
         const results = [];
         settled.forEach((r, i) => {
             if (r.status === "fulfilled")

package/dist/core/version.js

@@ -0,0 +1,15 @@
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+// Single source of truth for the CLI's self-reported version. Read from the
+// installed package.json so a future `npm version` bump never drifts from the
+// printed banner — a hardcoded "v0.1.1" previously survived the 0.2.0 bump.
+function readVersion() {
+    try {
+        const url = new URL("../../package.json", import.meta.url);
+        return JSON.parse(readFileSync(fileURLToPath(url), "utf-8")).version;
+    }
+    catch {
+        return "0.0.0"; // cosmetic only — package.json not resolvable (raw dist/ checkout)
+    }
+}
+export const VERSION = readVersion();

package/dist/ui/app.js

@@ -1,6 +1,7 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { render, Box, Text, useApp } from "ink";
+import { VERSION } from "../core/version.js";
 // Palette — mirrors web/app/globals.css "crash seismograph" tokens, mapped to
 // the nearest ANSI colors so the terminal panel reads as the same instrument.
 const C = {
@@ -124,7 +125,7 @@ function AztrxApp({ bus, done, targetUrl, repoRoot, mode }) {
     }, [done, exit]);
     const phase = PHASE_LABEL[state.phase];
     const currentRoute = state.routes[state.routes.length - 1] ?? targetUrl;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsx(Text, { color: C.dim, children: "   v0.1.1" })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsxs(Text, { color: C.dim, children: ["   v", VERSION] })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
 }
 /** Mount the live terminal panel and resolve once the run (or a failure) ends. */
 export function renderTui(props) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",