aztrx-cli 0.2.3 → 0.3.0

package/README.md

@@ -47,7 +47,7 @@ aztrx-cli run http://localhost:3000
 ## Fix it, not just find it
 
 The only feature that needs a key. `--fix` hands the crash to an LLM and applies a
-verified patch to your working tree. Set `ANTHROPIC_API_KEY` and run:
+verified patch to your working tree. Anthropic by default — set `ANTHROPIC_API_KEY`:
 
 ```bash
 export ANTHROPIC_API_KEY="your-api-key"
@@ -55,6 +55,16 @@ npx aztrx-cli run http://localhost:3000 --fix          # find → explain → he
 npx aztrx-cli run http://localhost:3000 --fix --yes    # non-interactive (CI)
 ```
 
+Or use **any model** — Grok, DeepSeek, Gemini, GPT, Kimi, Mistral, OpenRouter, or a
+local Ollama/vLLM. Point it at any OpenAI-compatible `/v1` endpoint:
+
+```bash
+export AZTRX_API_BASE="https://openrouter.ai/api/v1"   # or api.openai.com/v1, api.x.ai/v1, ...
+export AZTRX_API_KEY="your-key"
+export AZTRX_MODEL="anthropic/claude-sonnet-5"         # any model the provider serves
+npx aztrx-cli run http://localhost:3000 --fix
+```
+
 `--fix` chains find → explain → heal, then asks *"Apply the fix?"* (`y/N`). On yes, the
 verified patch lands in your working tree — `git diff` shows the result. Aztrx AI never
 commits.
@@ -138,8 +148,8 @@ and niche tuning knobs).
 | `--workers <n>` | Number of parallel detection workers | `1` |
 | `--swarm` | Hidden alias for `--workers auto` | — |
 | `--repro-runs <n>` | Flake-rate replay iterations | `3` |
-| `--heal-model <model>` | Fallback LLM tier | `claude-sonnet-5` |
-| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5` |
+| `--heal-model <model>` | Fallback LLM tier | `claude-sonnet-5` / `$AZTRX_MODEL` |
+| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5` / `$AZTRX_FAST_MODEL` |
 | `--test-command <cmd>` | Test command run against a healed patch | `npm test` (auto-detected) |
 | `--test-timeout <ms>` | Timeout for the heal test gate | `300000` |
 | `--no-test` | Skip the test gate during healing | — |
@@ -196,7 +206,7 @@ jobs:
     permissions: { contents: read, pull-requests: write }
     steps:
       - uses: actions/checkout@v4
-      - uses: DanisChaparov/aztrx@14a187d686710cf59392505075a54b00838fceae
+      - uses: DanisChaparov/aztrx@ee586a4410240efb7ed211ab0e1bf9d188361efa
         with:
           url: http://localhost:3000
           start-command: npm run dev          # optional — boot the app in the background
@@ -210,7 +220,7 @@ Or as a reusable workflow:
 on: pull_request
 jobs:
   aztrx:
-    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@14a187d686710cf59392505075a54b00838fceae
+    uses: DanisChaparov/aztrx/.github/workflows/aztrx-pr.yml@ee586a4410240efb7ed211ab0e1bf9d188361efa
     with:
       url: http://localhost:3000
       start-command: npm run dev
@@ -261,7 +271,7 @@ jobs:
             sleep 2
           done
       - name: Generate badge
-        run: npx --yes aztrx-cli@0.2.3 run http://localhost:3000 --badge badge.svg
+        run: npx --yes aztrx-cli@0.3.0 run http://localhost:3000 --badge badge.svg
       - name: Commit badge
         run: |
           git config user.name "github-actions[bot]"
@@ -279,12 +289,13 @@ are, and the run still exits 0 so the commit step always runs. Swap `push` for a
 
 ## Smart Cloud Router
 
-`--heal` is backed by a two-tier router. The fast/cheap model
-(`claude-haiku-4-5`) generates first; its patch is gated, compiled, and replayed
-against the repro. If the bug still reproduces — or the patch fails a gate —
-aztrx falls back to `claude-sonnet-5` and tries again. Most one-line fixes never
-pay for the big model. Tiers are configurable via `AZTRX_FAST_MODEL` /
-`AZTRX_MODEL` or `--heal-fast-model` / `--heal-model`.
+`--heal` is backed by a two-tier router: a fast/cheap model generates first, its patch
+is gated, compiled, and replayed against the repro, and if the bug still reproduces (or
+the patch fails a gate) aztrx falls back to the stronger model and tries again. Most
+one-line fixes never pay for the big model. With Anthropic the defaults are
+`claude-haiku-4-5` → `claude-sonnet-5`; with any other provider you pick both via
+`AZTRX_FAST_MODEL` / `AZTRX_MODEL` (or `--heal-fast-model` / `--heal-model`). When only
+one model is set, the router collapses to a single tier.
 
 ## Security & data flow
 
@@ -320,7 +331,7 @@ LLM call.
   CORS.
 - **`.aztrx/` is gitignored** on `init` — repro specs, reports, and patches stay
   out of history.
-- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.2.3` (never
+- **Pinned supply chain.** The GitHub Action pins `aztrx-cli@0.3.0` (never
   `@latest`).
 
 ## Telemetry & privacy

package/dist/cli.js

@@ -122,8 +122,8 @@ program
     .addOption(opt("--fix", "find → explain → heal → apply: one-command fix", "fix"))
     .addOption(opt("--heal", "closed-loop healing for crash/error findings (implies --repro)", "fix"))
     .addOption(opt("--magic-fix", "alias for --fix (deprecated)").hideHelp())
-    .addOption(opt("--heal-model <model>", "LLM model for healing — the fallback tier (default claude-sonnet-5)", "advanced"))
-    .addOption(opt("--heal-fast-model <model>", "fast/cheap first tier for the smart router (default claude-haiku-4-5)", "advanced"))
+    .addOption(opt("--heal-model <model>", "LLM model for healing (default: claude-sonnet-5 or $AZTRX_MODEL)", "advanced"))
+    .addOption(opt("--heal-fast-model <model>", "fast/cheap first tier (default: claude-haiku-4-5 or $AZTRX_FAST_MODEL)", "advanced"))
     .addOption(opt("--test-command <cmd>", "test command run against a healed patch (default: npm test, auto-detected)", "advanced"))
     .addOption(opt("--test-timeout <ms>", "timeout for the heal test gate, ms", "advanced").default("300000"))
     .addOption(opt("--no-test", "skip the test gate during healing", "advanced"))
@@ -258,9 +258,9 @@ program
             }
         }
     }
-    if (!useUi) {
-        suggestNext(findings, opts);
-    }
+    // Suggest the next flag (e.g. --fix) after the run, in both the live TUI
+    // and plain paths. In the TUI this prints after the panel has finished.
+    suggestNext(findings, opts);
     // Drain any in-flight telemetry uploads (each bounded) before exit, so a
     // pending `--share-data` dispatch isn't killed mid-flight. Never affects
     // the exit code.

package/dist/core/heal/index.js

@@ -20,6 +20,7 @@ import * as path from "path";
 import { redact, unredact } from "./redact.js";
 import { auditPatch } from "./gates.js";
 import { generatePatch, modelTiers } from "./llm.js";
+import { hasLlmKey } from "../llm.js";
 import { applyHunks, createWorktree, diffWorktree, runTests, typecheckWorktree, writeWorktreeFile } from "./sandbox.js";
 import { bootServer, detectStartCommand } from "./boot.js";
 import { verifyFix } from "./verify.js";
@@ -121,18 +122,18 @@ export async function heal(finding, opts) {
     const ctx = { finding, filePath, fileContent: original, redactedContent: red.text };
     // No transport configured (and no injected generator) → nothing to try. A
     // higher model tier can't fix a missing key, so bail before paying anything.
-    if (!opts.patchFn && !process.env.ANTHROPIC_API_KEY) {
+    if (!opts.patchFn && !hasLlmKey()) {
         return {
             ...base,
             status: "no-llm",
-            error: "heal: ANTHROPIC_API_KEY is not set (and no patchFn was injected)",
+            error: "heal: no LLM API key is set (set ANTHROPIC_API_KEY, AZTRX_API_KEY, or AZTRX_API_BASE)",
         };
     }
     // The Smart Cloud Router tier plan: fast/cheap first, Sonnet as the fallback.
     // An injected patchFn collapses to a single tier (there is no model to route).
     const tiers = opts.patchFn
-        ? [{ model: opts.model ?? "claude-sonnet-5", label: "sonnet" }]
-        : modelTiers(opts.model);
+        ? [{ model: opts.model ?? "default", label: "sonnet" }]
+        : modelTiers(opts.model, opts.fastModel);
     const wt = await createWorktree(opts.repoRoot, finding.id);
     // The winning (or last) patch + verification, held back for the final save.
     let savedPatch = null;

package/dist/core/heal/llm.js

@@ -7,25 +7,23 @@
  * module's callers.
  */
 import { redact } from "./redact.js";
-const DEFAULT_MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
-/** Cheap/fast first tier for the Smart Cloud Router. The idea: most one-line
- * fixes are trivial, so try the small model before paying for the big one. */
-const FAST_MODEL = process.env.AZTRX_FAST_MODEL || "claude-haiku-4-5-20251001";
-const API_URL = "https://api.anthropic.com/v1/messages";
+import { complete, primaryModel, fastModel } from "../llm.js";
 /**
  * The Smart Cloud Router's tier plan: fast/cheap first, then the capable model
  * as the fallback. Collapses to a single tier when the two resolve to the same
  * model (e.g. `AZTRX_FAST_MODEL=claude-sonnet-5`). Consumers loop over this in
  * order and stop at the first `healed` result.
  */
-export function modelTiers(fallbackModel) {
-    const fast = process.env.AZTRX_FAST_MODEL || FAST_MODEL;
-    const sonnet = fallbackModel || DEFAULT_MODEL;
-    if (fast === sonnet)
-        return [{ model: sonnet, label: "sonnet" }];
+export function modelTiers(fallbackModel, fastFallback) {
+    const fast = fastFallback || fastModel();
+    const primary = fallbackModel || primaryModel();
+    if (!primary)
+        return []; // no model configured — the caller reports no-llm
+    if (!fast || fast === primary)
+        return [{ model: primary, label: "sonnet" }];
     return [
         { model: fast, label: "fast" },
-        { model: sonnet, label: "sonnet" },
+        { model: primary, label: "sonnet" },
     ];
 }
 const SYSTEM = `You are a meticulous bug-fixing engineer. You are given a single source file and a runtime error that occurs in it. Produce a MINIMAL fix as a Search & Replace diff.
@@ -76,33 +74,12 @@ export function parsePatch(raw) {
 export async function generatePatch(ctx, opts = {}) {
     if (opts.patchFn)
         return opts.patchFn(ctx);
-    const key = process.env.ANTHROPIC_API_KEY;
-    if (!key) {
-        throw new Error("heal: ANTHROPIC_API_KEY is not set (and no patchFn was injected)");
-    }
-    const res = await fetch(API_URL, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            "x-api-key": key,
-            "anthropic-version": "2023-06-01",
-        },
-        body: JSON.stringify({
-            model: opts.model ?? DEFAULT_MODEL,
-            max_tokens: 2048,
-            temperature: 0,
-            system: SYSTEM,
-            messages: [{ role: "user", content: buildPrompt(ctx) }],
-        }),
+    const text = await complete({
+        system: SYSTEM,
+        prompt: buildPrompt(ctx),
+        model: opts.model,
+        maxTokens: 2048,
+        temperature: 0,
     });
-    if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new Error(`heal: LLM request failed (${res.status}): ${body.slice(0, 300)}`);
-    }
-    const data = (await res.json());
-    const text = (data.content ?? [])
-        .filter((c) => c.type === "text")
-        .map((c) => c.text ?? "")
-        .join("\n");
     return parsePatch(text);
 }

package/dist/core/llm.js

@@ -0,0 +1,121 @@
+/**
+ * Provider-agnostic LLM client. Two transports behind one `complete()`:
+ *
+ *   - Anthropic Messages API (default) — key from `ANTHROPIC_API_KEY` (or
+ *     `AZTRX_API_KEY`), primary model defaults to `claude-sonnet-5`.
+ *   - Any OpenAI-compatible `/chat/completions` endpoint — selected by setting
+ *     `AZTRX_API_BASE`. That single flag unlocks OpenAI, Grok, DeepSeek, Gemini,
+ *     Kimi, Mistral, OpenRouter, and local models (Ollama / vLLM / LM Studio)
+ *     with their existing keys.
+ *
+ * `AZTRX_MODEL` / `AZTRX_FAST_MODEL` pick the model(s); they default sensibly
+ * for Anthropic and must be set explicitly when a custom base URL is used.
+ */
+/** Resolve the active provider from the environment. */
+export function resolveSettings() {
+    const base = process.env.AZTRX_API_BASE?.trim();
+    if (base) {
+        return {
+            provider: "openai",
+            apiKey: process.env.AZTRX_API_KEY || process.env.OPENAI_API_KEY,
+            baseUrl: base.replace(/\/+$/, ""),
+        };
+    }
+    return {
+        provider: "anthropic",
+        apiKey: process.env.ANTHROPIC_API_KEY || process.env.AZTRX_API_KEY,
+    };
+}
+/** Is any provider configured? Used to decide whether to attempt an LLM call. */
+export function hasLlmKey() {
+    return Boolean(resolveSettings().apiKey);
+}
+/** The primary model for the active provider. */
+export function primaryModel() {
+    const s = resolveSettings();
+    if (s.provider === "anthropic")
+        return process.env.AZTRX_MODEL || "claude-sonnet-5";
+    return process.env.AZTRX_MODEL || "";
+}
+/** The cheap/fast first tier, or undefined when the provider has none. */
+export function fastModel() {
+    const s = resolveSettings();
+    if (s.provider === "anthropic")
+        return process.env.AZTRX_FAST_MODEL || "claude-haiku-4-5-20251001";
+    return process.env.AZTRX_FAST_MODEL || undefined;
+}
+/** Run one completion against the active provider and return the text. */
+export async function complete(opts) {
+    const s = resolveSettings();
+    const model = opts.model || primaryModel();
+    if (!model) {
+        throw new Error("no model configured — set AZTRX_MODEL (e.g. AZTRX_MODEL=gpt-4o)");
+    }
+    if (!s.apiKey) {
+        throw new Error(s.provider === "anthropic"
+            ? "ANTHROPIC_API_KEY is not set"
+            : "AZTRX_API_KEY (or OPENAI_API_KEY) is not set");
+    }
+    return s.provider === "anthropic"
+        ? anthropicComplete(s, model, opts)
+        : openaiComplete(s, model, opts);
+}
+async function anthropicComplete(s, model, opts) {
+    const res = await fetch("https://api.anthropic.com/v1/messages", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-api-key": s.apiKey,
+            "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+            model,
+            max_tokens: opts.maxTokens ?? 2048,
+            temperature: opts.temperature ?? 0,
+            system: opts.system,
+            messages: [{ role: "user", content: opts.prompt }],
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`LLM request failed (${res.status}): ${body.slice(0, 300)}`);
+    }
+    const data = (await res.json());
+    return (data.content ?? [])
+        .filter((c) => c.type === "text")
+        .map((c) => c.text ?? "")
+        .join("\n");
+}
+async function openaiComplete(s, model, opts) {
+    const res = await fetch(`${s.baseUrl}/chat/completions`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${s.apiKey}`,
+        },
+        body: JSON.stringify({
+            model,
+            max_tokens: opts.maxTokens ?? 2048,
+            temperature: opts.temperature ?? 0,
+            messages: [
+                { role: "system", content: opts.system },
+                { role: "user", content: opts.prompt },
+            ],
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`LLM request failed (${res.status}): ${body.slice(0, 300)}`);
+    }
+    const data = (await res.json());
+    const content = data.choices?.[0]?.message?.content;
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .filter((c) => typeof c === "object" && c !== null && c.type === "text")
+            .map((c) => c.text ?? "")
+            .join("\n");
+    }
+    return "";
+}

package/dist/core/modernize.js

@@ -12,8 +12,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as ts from "typescript";
-const MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
-const API_URL = "https://api.anthropic.com/v1/messages";
+import { complete, hasLlmKey } from "./llm.js";
 export function detectLang(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     if ([".ts", ".tsx", ".mts", ".cts"].includes(ext))
@@ -86,39 +85,20 @@ export async function modernizeFile(repoRoot, filePath) {
     catch (e) {
         return { ok: false, original: "", changes: [], error: `cannot read ${filePath}: ${e.message}` };
     }
-    const key = process.env.ANTHROPIC_API_KEY;
-    if (!key) {
-        return { ok: false, original, changes: [], lang, error: "ANTHROPIC_API_KEY is not set" };
+    if (!hasLlmKey()) {
+        return { ok: false, original, changes: [], lang, error: "no LLM API key is set (set ANTHROPIC_API_KEY, AZTRX_API_KEY, or AZTRX_API_BASE)" };
     }
     let reply;
     try {
-        const res = await fetch(API_URL, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                "x-api-key": key,
-                "anthropic-version": "2023-06-01",
-            },
-            body: JSON.stringify({
-                model: MODEL,
-                max_tokens: 8192,
-                temperature: 0,
-                system: SYSTEM,
-                messages: [{ role: "user", content: buildPrompt(original, lang) }],
-            }),
+        reply = await complete({
+            system: SYSTEM,
+            prompt: buildPrompt(original, lang),
+            maxTokens: 8192,
+            temperature: 0,
         });
-        if (!res.ok) {
-            const body = await res.text().catch(() => "");
-            return { ok: false, original, changes: [], lang, error: `LLM request failed (${res.status}): ${body.slice(0, 300)}` };
-        }
-        const data = (await res.json());
-        reply = (data.content ?? [])
-            .filter((c) => c.type === "text")
-            .map((c) => c.text ?? "")
-            .join("\n");
     }
     catch (e) {
-        return { ok: false, original, changes: [], lang, error: `LLM request failed: ${e.message}` };
+        return { ok: false, original, changes: [], lang, error: e.message };
     }
     let parsed;
     try {

package/dist/core/networkGuard.js

@@ -11,7 +11,7 @@ export async function attachNetworkGuard(page, opts) {
             host = new URL(url).hostname.toLowerCase();
         }
         catch {
-            await route.abort();
+            await route.abort("blockedbyclient");
             return;
         }
         if (host === "localhost" || host === "127.0.0.1" || host === "::1") {
@@ -25,7 +25,7 @@ export async function attachNetworkGuard(page, opts) {
             }
         }
         opts.onBlock?.(url);
-        await route.abort();
+        await route.abort("blockedbyclient");
     });
 }
 /** Builds the allow-list: target origin + each `--allow-host`. */

package/dist/core/summarize.js

@@ -11,8 +11,7 @@
  * The offer-to-apply line is emitted only when verified fixes are actually ready,
  * so `--explain` (no healing) never promises a fix it doesn't have.
  */
-const MODEL = process.env.AZTRX_MODEL || "claude-sonnet-5";
-const API_URL = "https://api.anthropic.com/v1/messages";
+import { complete, hasLlmKey } from "./llm.js";
 function normalizeLang(lang) {
     return lang === "ru" ? "ru" : "en";
 }
@@ -126,31 +125,12 @@ function buildLlmPrompt(findings, lang, hasHealed) {
 const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise, human-language summary for a developer. Never invent details absent from the data. Respond in the requested language only.";
 async function summarizeFindingsLlm(findings, lang) {
     const hasHealed = findings.some((f) => f.heal?.status === "healed");
-    const res = await fetch(API_URL, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            "x-api-key": process.env.ANTHROPIC_API_KEY,
-            "anthropic-version": "2023-06-01",
-        },
-        body: JSON.stringify({
-            model: MODEL,
-            max_tokens: 1024,
-            temperature: 0.2,
-            system: SYSTEM,
-            messages: [{ role: "user", content: buildLlmPrompt(findings, lang, hasHealed) }],
-        }),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new Error(`summarize: LLM request failed (${res.status}): ${body.slice(0, 300)}`);
-    }
-    const data = (await res.json());
-    const text = (data.content ?? [])
-        .filter((c) => c.type === "text")
-        .map((c) => c.text ?? "")
-        .join("\n")
-        .trim();
+    const text = (await complete({
+        system: SYSTEM,
+        prompt: buildLlmPrompt(findings, lang, hasHealed),
+        maxTokens: 1024,
+        temperature: 0.2,
+    })).trim();
     return text || summarizeFindingsTemplate(findings, lang);
 }
 /**
@@ -162,7 +142,7 @@ export async function summarizeFindings(findings, opts = {}) {
     const lang = normalizeLang(opts.lang);
     if (findings.length === 0)
         return summarizeFindingsTemplate(findings, lang);
-    if (!process.env.ANTHROPIC_API_KEY)
+    if (!hasLlmKey())
         return summarizeFindingsTemplate(findings, lang);
     try {
         return await summarizeFindingsLlm(findings, lang);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",