aztrx-cli 0.2.1 → 0.2.3

package/README.md

@@ -196,7 +196,7 @@ jobs:
     permissions: { contents: read, pull-requests: write }
     steps:
       - uses: actions/checkout@v4
-      - uses: DanisChaparov/aztrx@94d1173e6b363bc60e2237775cca11addd39b10f
+      - uses: DanisChaparov/aztrx@14a187d686710cf59392505075a54b00838fceae
         with:
           url: http://localhost:3000
           start-command: npm run dev          # optional — boot the app in the background
@@ -210,7 +210,7 @@ Or as a reusable workflow:
 on: pull_request
 jobs:
   aztrx:
-    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@94d1173e6b363bc60e2237775cca11addd39b10f
+    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@14a187d686710cf59392505075a54b00838fceae
     with:
       url: http://localhost:3000
       start-command: npm run dev
@@ -261,7 +261,7 @@ jobs:
             sleep 2
           done
       - name: Generate badge
-        run: npx --yes aztrx-cli@0.2.1 run http://localhost:3000 --badge badge.svg
+        run: npx --yes aztrx-cli@0.2.3 run http://localhost:3000 --badge badge.svg
       - name: Commit badge
         run: |
           git config user.name "github-actions[bot]"
@@ -320,7 +320,7 @@ LLM call.
   CORS.
 - **`.aztrx/` is gitignored** on `init` — repro specs, reports, and patches stay
   out of history.
-- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.2.1` (never
+- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.2.3` (never
   `@latest`).
 
 ## Telemetry & privacy

package/dist/core/domWalker.js

@@ -14,64 +14,92 @@ export async function walkDom(page, bus, opts = {}) {
     const max = opts.maxActions ?? 100;
     const startUrl = page.url();
     let actions = 0;
-    const handles = await page.$$(SELECTOR);
-    for (const handle of handles) {
-        if (actions >= max)
-            break;
-        if (page.url() !== startUrl)
-            break; // navigated — bail this pass
-        const visible = await handle.isVisible().catch(() => false);
-        const enabled = await handle.isEnabled().catch(() => false);
-        if (!visible || !enabled)
-            continue;
-        let tag;
-        try {
-            tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+    const seen = new Set();
+    // Re-scan the DOM after every action (the page may have mutated or navigated)
+    // rather than walking a stale snapshot. Mirrors the fuzzer's recover-and-iterate
+    // loop, but deterministically (document order) and without re-clicking elements
+    // it has already acted on.
+    while (actions < max) {
+        if (page.url() !== startUrl) {
+            // A previous action navigated away — return to the starting page.
+            await page.goto(startUrl, { waitUntil: "domcontentloaded" }).catch(() => { });
+            await page.waitForTimeout(300);
         }
-        catch {
-            continue; // element unreadable mid-query — skip
-        }
-        let label = "";
+        let handles;
         try {
-            label = await handle.evaluate((el) => {
-                const t = el.innerText ||
-                    el.getAttribute("aria-label") ||
-                    el.getAttribute("value") ||
-                    el.getAttribute("placeholder") ||
-                    "";
-                return t.trim();
-            });
+            handles = await page.$$(SELECTOR);
         }
         catch {
-            label = ""; // degraded — no label to filter on
-        }
-        if (DESTRUCTIVE.test(label))
+            // A navigation raced the re-scan — reset to the start page and retry.
+            await page.goto(startUrl, { waitUntil: "domcontentloaded" }).catch(() => { });
+            await page.waitForTimeout(300);
             continue;
-        if (tag === "a") {
-            const href = (await handle.getAttribute("href")) ?? "";
-            if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
-                continue;
-        }
-        if (tag === "input") {
-            const type = (await handle.getAttribute("type")) ?? "";
-            if (!TEXT_INPUT_TYPES.has(type))
-                continue; // skip password/hidden/submit/checkbox/etc.
-        }
-        const selectors = await selectorCascade(page, handle);
-        if (tag === "input" || tag === "textarea") {
-            const action = { type: "input", selectors, value: "test", timestamp: Date.now() };
-            bus.emit("action", action);
-            if (!opts.dryRun)
-                await handle.fill("test").catch(() => { });
         }
-        else {
-            const action = { type: "click", selectors, timestamp: Date.now() };
-            bus.emit("action", action);
-            if (!opts.dryRun)
-                await handle.click({ timeout: 1500 }).catch(() => { });
+        let acted = false;
+        for (const handle of handles) {
+            if (actions >= max)
+                break;
+            const visible = await handle.isVisible().catch(() => false);
+            const enabled = await handle.isEnabled().catch(() => false);
+            if (!visible || !enabled)
+                continue;
+            let tag;
+            try {
+                tag = await handle.evaluate((el) => el.tagName.toLowerCase());
+            }
+            catch {
+                continue; // element unreadable mid-query — skip
+            }
+            let label = "";
+            try {
+                label = await handle.evaluate((el) => {
+                    const t = el.innerText ||
+                        el.getAttribute("aria-label") ||
+                        el.getAttribute("value") ||
+                        el.getAttribute("placeholder") ||
+                        "";
+                    return t.trim();
+                });
+            }
+            catch {
+                label = ""; // degraded — no label to filter on
+            }
+            if (DESTRUCTIVE.test(label))
+                continue;
+            if (tag === "a") {
+                const href = (await handle.getAttribute("href")) ?? "";
+                if (/^https?:\/\//.test(href) && !href.startsWith(originOf(startUrl)))
+                    continue;
+            }
+            if (tag === "input") {
+                const type = (await handle.getAttribute("type")) ?? "";
+                if (!TEXT_INPUT_TYPES.has(type))
+                    continue; // skip password/hidden/submit/checkbox/etc.
+            }
+            const selectors = await selectorCascade(page, handle);
+            const signature = selectors.join("|") || `${tag}:${label}`;
+            if (seen.has(signature))
+                continue; // already acted on this element
+            seen.add(signature);
+            if (tag === "input" || tag === "textarea") {
+                const action = { type: "input", selectors, value: "test", timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.fill("test").catch(() => { });
+            }
+            else {
+                const action = { type: "click", selectors, timestamp: Date.now() };
+                bus.emit("action", action);
+                if (!opts.dryRun)
+                    await handle.click({ timeout: 1500 }).catch(() => { });
+            }
+            actions++;
+            acted = true;
+            await page.waitForTimeout(120);
+            break; // re-scan next iteration — the DOM may have changed
         }
-        actions++;
-        await page.waitForTimeout(120);
+        if (!acted)
+            break; // nothing left to act on
     }
     return actions;
 }

package/dist/core/interceptor.js

@@ -83,9 +83,15 @@ export function attachInterceptor(page, bus) {
     });
     page.on("requestfailed", (req) => {
         const f = req.failure();
+        const errText = f?.errorText ?? "unknown";
+        // Cancelled/blocked requests are not bugs — a video preload dropped when the
+        // walk navigates away, a `mailto:` click, or an adblocker all surface as
+        // `requestfailed`. Skip them so they don't become false-positive errors.
+        if (/ERR_ABORTED|ERR_BLOCKED_BY_CLIENT|ERR_BLOCKED_BY_RESPONSE/.test(errText))
+            return;
         bus.emit("telemetry", {
             type: "network_timeout",
-            rawMessage: `Request failed: ${req.url()} (${f?.errorText ?? "unknown"})`,
+            rawMessage: `Request failed: ${req.url()} (${errText})`,
             rawStack: "",
         });
     });

package/dist/core/orchestrator.js

@@ -117,6 +117,7 @@ export async function run(options) {
         baseline,
         guardOn,
         log: say,
+        forwardBus: bus,
     });
     // Replays reuse the swarm-captured auth state, or the explicit --storage-state.
     const replayStorageState = swarmAuthState ?? options.storageState;

package/dist/core/swarm.js

@@ -213,7 +213,7 @@ export async function swarmDetect(opts) {
             httpFuzzMutations: opts.httpFuzzMutations,
             baseline: opts.baseline,
             log: (m) => opts.log(strategies.length > 1 ? `[w${i}] ${m}` : m),
-        }, strategy)));
+        }, strategy, opts.forwardBus)));
         const results = [];
         settled.forEach((r, i) => {
             if (r.status === "fulfilled")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",