aztrx-cli 0.3.0 → 0.4.1

package/dist/core/heal/llm.js

@@ -19,12 +19,19 @@ export function modelTiers(fallbackModel, fastFallback) {
     const primary = fallbackModel || primaryModel();
     if (!primary)
         return []; // no model configured — the caller reports no-llm
-    if (!fast || fast === primary)
-        return [{ model: primary, label: "sonnet" }];
-    return [
-        { model: fast, label: "fast" },
-        { model: primary, label: "sonnet" },
-    ];
+    const tiers = [];
+    if (fast && fast !== primary)
+        tiers.push({ model: fast, label: "fast" });
+    tiers.push({ model: primary, label: "sonnet" });
+    // Extra models for multi-model consensus (`AZTRX_CONSENSUS_MODELS`), deduped.
+    for (const m of (process.env.AZTRX_CONSENSUS_MODELS || "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)) {
+        if (!tiers.some((t) => t.model === m))
+            tiers.push({ model: m, label: "sonnet" });
+    }
+    return tiers;
 }
 const SYSTEM = `You are a meticulous bug-fixing engineer. You are given a single source file and a runtime error that occurs in it. Produce a MINIMAL fix as a Search & Replace diff.
 
@@ -71,9 +78,48 @@ export function parsePatch(raw) {
         .map((e) => ({ search: e.search, replace: e.replace }));
     return { explanation: typeof data.explanation === "string" ? data.explanation : "", hunks };
 }
+/** Sentinel model name for the free, no-key rule-based fixer. */
+export const RULE_TIER = "__rule__";
+// Matches "Cannot read properties of undefined|null (reading 'X')".
+const NULL_DEREF = /Cannot read properties of (undefined|null)(?: \(reading '([^']+)'\))?/;
+/**
+ * Rule-based fix for the most common crash — a null/undefined property access.
+ * Adds `?.` (optional chaining) at the failing access. Returns null when the
+ * error isn't a null/undefined deref or the line can't be located. Free and
+ * offline: no LLM, no key, no network — so `--fix` works out of the box for the
+ * most frequent frontend crashes.
+ */
+export function generateRulePatch(ctx) {
+    const m = ctx.finding.rawMessage.match(NULL_DEREF);
+    if (!m)
+        return null;
+    const kind = m[1]; // "undefined" | "null"
+    const prop = m[2]; // the property that was read
+    const line = ctx.finding.mappedLocation?.line;
+    if (!prop || line == null)
+        return null;
+    const src = ctx.fileContent.split("\n")[line - 1];
+    if (!src || !src.includes("." + prop))
+        return null;
+    // Optional-chain every `.identifier` access on the line (not just the failing
+    // one) so a chain like `d.agents.map(…)` becomes `d?.agents?.map(…)`.
+    const replace = src.replace(/\.(?=[a-zA-Z_$])/g, "?.");
+    if (replace === src)
+        return null;
+    return {
+        explanation: `Guard against a ${kind} access on \`.${prop}\` with optional chaining.`,
+        hunks: [{ search: src, replace }],
+    };
+}
 export async function generatePatch(ctx, opts = {}) {
     if (opts.patchFn)
         return opts.patchFn(ctx);
+    if (opts.model === RULE_TIER) {
+        const rulePatch = generateRulePatch(ctx);
+        if (rulePatch)
+            return rulePatch;
+        throw new Error("no rule-based fix applicable");
+    }
     const text = await complete({
         system: SYSTEM,
         prompt: buildPrompt(ctx),

package/dist/core/interceptor.js

@@ -32,18 +32,21 @@ export function attachInterceptor(page, bus) {
         if (msg.type() !== "error")
             return;
         const text = msg.text();
-        // The init script routes `unhandledrejection` through console.error with a
-        // fixed prefix; recover the true signal type so Server Action failures and
-        // other promise rejections classify as "error", not "warning".
-        const type = text.startsWith("Unhandled Promise Rejection:")
-            ? "unhandled_rejection"
-            : "console_error";
+        // Pull the real Error (and its stack) out of the console args. React 18 and
+        // Next.js log a thrown error as `console.error(error)` — the Error object is
+        // an argument, not part of `msg.text()`. Match on `:line:col` (not "http")
+        // so Next.js dev stacks (`webpack-internal:///…`) are recognised too.
         let source = text;
+        let hasErrorArg = false;
         for (const arg of msg.args()) {
             try {
-                const s = await arg.evaluate((a) => a instanceof Error ? a.stack || String(a) : String(a));
-                if (s.includes("http")) {
-                    source = s;
+                const info = await arg.evaluate((a) => a instanceof Error
+                    ? { isError: true, value: a.stack || String(a) }
+                    : { isError: false, value: String(a) });
+                if (info.isError)
+                    hasErrorArg = true;
+                if (/:\d+:\d+/.test(info.value)) {
+                    source = info.value;
                     break;
                 }
             }
@@ -51,6 +54,11 @@ export function attachInterceptor(page, bus) {
                 // non-serializable arg — keep msg.text()
             }
         }
+        // A rejection the init script forwarded, or a thrown Error logged by React —
+        // both are real errors, not benign console warnings.
+        const type = text.startsWith("Unhandled Promise Rejection:") || hasErrorArg
+            ? "unhandled_rejection"
+            : "console_error";
         const loc = msg.location();
         const frame = extractFrame(source) ??
             ({ url: loc.url, line: loc.lineNumber, column: loc.columnNumber, message: text.split("\n")[0].slice(0, 200) });

package/dist/core/llm.js

@@ -44,6 +44,26 @@ export function fastModel() {
         return process.env.AZTRX_FAST_MODEL || "claude-haiku-4-5-20251001";
     return process.env.AZTRX_FAST_MODEL || undefined;
 }
+/** Human-readable description of the active provider + model, e.g. `grok-2 via https://api.x.ai/v1`. */
+export function describeLlm(model) {
+    const s = resolveSettings();
+    const m = model || primaryModel();
+    if (s.provider === "anthropic")
+        return `${m} (Anthropic)`;
+    return `${m} via ${s.baseUrl}`;
+}
+// Announce the resolved model once per distinct (provider, model), so the two-tier
+// router shows each tier as it's tried without spamming. Written to stderr so it never
+// corrupts the Ink TUI (which renders on stdout).
+const announced = new Set();
+function announce(model, provider, baseUrl) {
+    const key = `${provider}:${model}`;
+    if (announced.has(key))
+        return;
+    announced.add(key);
+    const label = provider === "anthropic" ? `${model} (Anthropic)` : `${model} via ${baseUrl}`;
+    process.stderr.write(`LLM: ${label}\n`);
+}
 /** Run one completion against the active provider and return the text. */
 export async function complete(opts) {
     const s = resolveSettings();
@@ -56,18 +76,24 @@ export async function complete(opts) {
             ? "ANTHROPIC_API_KEY is not set"
             : "AZTRX_API_KEY (or OPENAI_API_KEY) is not set");
     }
+    announce(model, s.provider, s.baseUrl);
     return s.provider === "anthropic"
         ? anthropicComplete(s, model, opts)
         : openaiComplete(s, model, opts);
 }
 async function anthropicComplete(s, model, opts) {
+    const headers = {
+        "content-type": "application/json",
+        "x-api-key": s.apiKey,
+        "anthropic-version": "2023-06-01",
+    };
+    // Identity-linked API keys must name the workspace they act in.
+    const workspaceId = process.env.ANTHROPIC_WORKSPACE_ID;
+    if (workspaceId)
+        headers["anthropic-workspace-id"] = workspaceId;
     const res = await fetch("https://api.anthropic.com/v1/messages", {
         method: "POST",
-        headers: {
-            "content-type": "application/json",
-            "x-api-key": s.apiKey,
-            "anthropic-version": "2023-06-01",
-        },
+        headers,
         body: JSON.stringify({
             model,
             max_tokens: opts.maxTokens ?? 2048,

package/dist/core/modernize.js

@@ -86,7 +86,7 @@ export async function modernizeFile(repoRoot, filePath) {
         return { ok: false, original: "", changes: [], error: `cannot read ${filePath}: ${e.message}` };
     }
     if (!hasLlmKey()) {
-        return { ok: false, original, changes: [], lang, error: "no LLM API key is set (set ANTHROPIC_API_KEY, AZTRX_API_KEY, or AZTRX_API_BASE)" };
+        return { ok: false, original, changes: [], lang, error: "modernize needs a model. Add a key: Anthropic → ANTHROPIC_API_KEY, or any provider → AZTRX_API_BASE + AZTRX_API_KEY + AZTRX_MODEL" };
     }
     let reply;
     try {

package/dist/core/orchestrator.js

@@ -97,7 +97,7 @@ export async function run(options) {
     else {
         emitPhase("walk");
     }
-    const { findings, replayStorageState: swarmAuthState, totalActions, workerCount, } = await swarmDetect({
+    const { findings, replayStorageState: swarmAuthState, totalActions, totalCoverage, workerCount, roles, sawLoginForm, } = await swarmDetect({
         url,
         repoRoot,
         maxActions,
@@ -128,10 +128,16 @@ export async function run(options) {
         printFinding(f, say);
     }
     if (workerCount > 1) {
-        say(pc.dim(`\nSwarm: ${totalActions} action(s) across ${workerCount} worker(s).\n`));
+        say(pc.dim(`\nSwarm: ${totalActions} action(s) across ${workerCount} worker(s) — ${roles.join(", ")}.\n`));
+    }
+    else if (options.fuzz) {
+        say(pc.dim(`\nFuzzed ${totalActions} action(s) — covered ${totalCoverage} new code range(s).\n`));
     }
     else {
-        say(pc.dim(`\n${options.fuzz ? "Fuzzed" : "Walked"} ${totalActions} action(s).\n`));
+        say(pc.dim(`\nWalked ${totalActions} action(s).\n`));
+    }
+    if (sawLoginForm && !options.login) {
+        say(pc.yellow("Hint: this app has a login form — re-run with --login to test the authenticated app."));
     }
     // F7 → F8 → F9: minimize each finding, compile an executable spec, validate
     // the flake rate. Only crash/error findings with a recorded action history.
@@ -310,14 +316,19 @@ export async function run(options) {
     // F12 — opt-in cloud sync. Streams the sanitized run results to the ingest
     // API for the team dashboard; dedup happens server-side by fingerprint.
     if (options.upload) {
-        submitRun(findings, {
-            repoRoot,
-            url,
-            apiKey: options.apiKey,
-            endpoint: options.cloudUrl,
-            mode: runMode(options),
-            counts,
-        });
+        if (options.apiKey || process.env.AZTRX_API_KEY) {
+            submitRun(findings, {
+                repoRoot,
+                url,
+                apiKey: options.apiKey,
+                endpoint: options.cloudUrl,
+                mode: runMode(options),
+                counts,
+            });
+        }
+        else {
+            say(pc.yellow("Upload skipped: no API key. Set --api-key or AZTRX_API_KEY to stream findings to the dashboard."));
+        }
     }
     runLog.append({ type: "run_end", counts, ts: Date.now() });
     say(pc.dim("────────────────────────────────────────────"));

package/dist/core/prompt.js

@@ -20,3 +20,15 @@ export function promptYesNo(question, opts = {}) {
         });
     });
 }
+/** A single-line text prompt. Returns "" when stdout isn't a TTY (unattended run). */
+export function promptInput(question) {
+    if (process.stdout.isTTY !== true)
+        return Promise.resolve("");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question + " ", (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}

package/dist/core/resolver.js

@@ -1,20 +1,28 @@
 import * as fs from "fs";
 import * as path from "path";
 import { TraceMap, originalPositionFor, } from "@jridgewell/trace-mapping";
+/** Framework-internal frames to skip when hunting the throw site. */
+const FRAMEWORK_FRAME = /node_modules|webpack-runtime|\.next[\\/]|next[\\/]dist[\\/]/;
 /**
- * Pulls the first `url:line:col` frame out of a stack string. Handles React
- * Error Boundary console text, which embeds the original stack in its body.
+ * Pulls the first *user-code* frame out of a stack string. Iterates every line,
+ * skips framework internals (webpack runtime, node_modules, next/dist), and
+ * returns the first frame in the user's own code — so a Next.js dev stack like
+ * `webpack-internal:///(app-pages-browser)/./app/page.tsx:29:21` resolves to the
+ * user's file, not `intercept-console-error.js`.
  */
 export function extractFrame(text) {
-    const match = text.match(/(https?:\/\/[^\s)"']+?):(\d+):(\d+)/);
-    if (!match)
-        return null;
-    return {
-        url: match[1],
-        line: parseInt(match[2], 10),
-        column: parseInt(match[3], 10),
-        message: text.split("\n")[0].trim().slice(0, 200),
-    };
+    const message = text.split("\n")[0].trim().slice(0, 200);
+    for (const raw of text.split("\n")) {
+        // V8 frame: "at fn (url:line:col)" or "at url:line:col".
+        const m = raw.trim().match(/^(?:at\s+)?(?:\S+\s+\()?(.+?):(\d+):(\d+)\)?$/);
+        if (!m)
+            continue;
+        const url = m[1];
+        if (!url || FRAMEWORK_FRAME.test(url))
+            continue;
+        return { url, line: parseInt(m[2], 10), column: parseInt(m[3], 10), message };
+    }
+    return null;
 }
 /** True if `p` looks like an absolute source path — a `file://` URL, a POSIX
  * absolute path, or a Windows drive path. Rejects bare relative tokens like
@@ -48,6 +56,20 @@ export function extractServerFrame(stack) {
 function stripQuery(url) {
     return url.split("?")[0];
 }
+/** Normalize a stack-frame URL to a repo-relative source path. Handles the
+ * dev-server schemes (`webpack-internal:///(ns)/./src/…`, `webpack://ns/src/…`),
+ * `file://`, and plain `https://host/path` bundle URLs. */
+function normalizeFrameUrl(url) {
+    return stripQuery(url)
+        .replace(/^webpack-internal:\/\/\/[^/]+\/\.\//, "")
+        .replace(/^webpack:\/\/[^/]+\//, "")
+        .replace(/^webpack:\/\//, "")
+        .replace(/^\/@fs\//, "")
+        .replace(/^file:\/\/\/([A-Za-z]:)/, "$1") // file:///C:/x → C:/x
+        .replace(/^file:\/\//, "")
+        .replace(/^https?:\/\/[^/]+\//, "")
+        .replace(/^\//, "");
+}
 /** True only for a real, readable regular file — directories and unreadable
  * paths return false so readers never hit `EISDIR` / permission errors. */
 function isFile(p) {
@@ -131,11 +153,9 @@ export async function resolveFrame(frame, repoRoot) {
     const viaMap = await trySourceMap(frame, repoRoot);
     if (viaMap)
         return viaMap;
-    // Fallback: Vite dev serves real source files at their URL path, so the
-    // bundle URL is already the source path — no sourcemap needed.
-    const relative = stripQuery(frame.url)
-        .replace(/^https?:\/\/[^/]+\//, "")
-        .replace(/^\//, "");
+    // Fallback: dev servers (Vite, Next) serve real source files at their URL
+    // path, so the bundle URL is already the source path — no sourcemap needed.
+    const relative = normalizeFrameUrl(frame.url);
     const directPath = resolveWithin(repoRoot, relative);
     if (!directPath) {
         return {

package/dist/core/specCompiler.js

@@ -82,3 +82,34 @@ export function writeSpec(repoRoot, finding, actions, url) {
     fs.writeFileSync(file, compileSpec(finding, actions, url), "utf-8");
     return file;
 }
+/**
+ * Install validated repro specs into the project's test directory so a fixed
+ * bug can't silently regress — the "immunity" step after find → prove → fix.
+ * Copies each deterministic/flaky repro into `<dir>/aztrx-<fingerprint>.spec.ts`
+ * and returns the written paths. `dir` defaults to an existing test dir, else a
+ * gitignored fallback.
+ */
+export function writeRegressionSpecs(repoRoot, findings, dir) {
+    const target = path.resolve(repoRoot, dir || detectTestDir(repoRoot));
+    fs.mkdirSync(target, { recursive: true });
+    const written = [];
+    for (const f of findings) {
+        if (!f.repro?.specPath || f.repro.verdict === "unreliable")
+            continue;
+        const src = path.resolve(repoRoot, f.repro.specPath);
+        if (!fs.existsSync(src))
+            continue;
+        const dest = path.join(target, `aztrx-${f.fingerprint.slice(0, 8)}.spec.ts`);
+        fs.copyFileSync(src, dest);
+        written.push(dest);
+    }
+    return written;
+}
+/** Prefer an existing test dir, else a gitignored fallback. */
+function detectTestDir(repoRoot) {
+    for (const d of ["e2e", "tests", "test", "__tests__"]) {
+        if (fs.existsSync(path.join(repoRoot, d)))
+            return d;
+    }
+    return ".aztrx/regression";
+}

package/dist/core/swarm.js

@@ -130,12 +130,18 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
         await page.waitForTimeout(800);
     }
     let actions = 0;
+    let newCoverage = 0;
+    let sawLoginForm = false;
     if (loaded) {
         if (strategy.kind === "walk") {
-            actions = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun });
+            const wr = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun });
+            actions = wr.actions;
+            sawLoginForm = wr.sawLoginForm;
         }
         else if (strategy.kind === "fuzz") {
-            actions = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun });
+            const fr = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun });
+            actions = fr.actions;
+            newCoverage = fr.newCoverage;
         }
         else {
             actions = await httpFuzz(page, opts.url, workerBus, {
@@ -148,7 +154,7 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
     }
     await page.waitForTimeout(500);
     await context.close();
-    return { findings: classifier.findings(), actions, replayStorageState };
+    return { findings: classifier.findings(), actions, newCoverage, sawLoginForm, replayStorageState };
 }
 /** Dedup findings across workers by fingerprint: sum occurrences, keep the richest. */
 export function mergeFindings(arrays) {
@@ -191,6 +197,17 @@ function buildStrategies(opts) {
     }
     return strategies;
 }
+/** Human-readable label for a worker's role in the swarm. */
+function strategyLabel(s) {
+    switch (s.kind) {
+        case "walk":
+            return "walk";
+        case "http-fuzz":
+            return "http-fuzz";
+        case "fuzz":
+            return `fuzz seed ${s.seed}`;
+    }
+}
 /** Launch one browser, run the worker roster concurrently, merge findings. */
 export async function swarmDetect(opts) {
     const strategies = buildStrategies(opts);
@@ -227,7 +244,16 @@ export async function swarmDetect(opts) {
                 replayStorageState = r.replayStorageState;
         const findings = mergeFindings(results.map((r) => r.findings));
         const totalActions = results.reduce((sum, r) => sum + r.actions, 0);
-        return { findings, replayStorageState, totalActions, workerCount: strategies.length };
+        const totalCoverage = results.reduce((sum, r) => sum + r.newCoverage, 0);
+        return {
+            findings,
+            replayStorageState,
+            totalActions,
+            totalCoverage,
+            workerCount: strategies.length,
+            roles: strategies.map(strategyLabel),
+            sawLoginForm: results.some((r) => r.sawLoginForm),
+        };
     }
     finally {
         await browser.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
@@ -32,7 +32,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/DanisChaparov/aztrx.git"
+    "url": "https://github.com/Aztrx-AI/aztrx.git"
   },
   "scripts": {
     "build": "tsc",