aztrx-cli 0.4.1 → 0.4.2

package/dist/cli.js

@@ -64,8 +64,15 @@ async function detectUrl(repoRoot) {
 function suggestNext(findings, opts) {
     if (opts.dryRun || opts.crashTest || findings.length === 0)
         return;
-    const crashOrError = findings.some((f) => f.severity === "crash" || f.severity === "error");
     const alreadyFixing = opts.heal || opts.fix || opts.magicFix;
+    // Server-side 5xx → point at the server fuzzer. `--fix` patches frontend code,
+    // so it can't help with a 502/500 from the server.
+    const serverError = findings.some((f) => f.type === "network_5xx");
+    if (serverError && !opts.httpFuzz) {
+        console.log(pc.dim("Tip: these are server-side 5xx — run with --http-fuzz to map the server attack surface"));
+        return;
+    }
+    const crashOrError = findings.some((f) => f.severity === "crash" || f.severity === "error");
     if (crashOrError && !alreadyFixing) {
         if (opts.repro) {
             console.log(pc.dim("Tip: run with --fix to attempt a closed-loop fix"));
@@ -73,11 +80,6 @@ function suggestNext(findings, opts) {
         else {
             console.log(pc.dim("Tip: run with --repro to prove these with a runnable spec, or --fix to fix them end-to-end"));
         }
-        return;
-    }
-    const serverError = findings.some((f) => f.type === "network_5xx");
-    if (serverError && !opts.httpFuzz) {
-        console.log(pc.dim("Tip: run with --http-fuzz to map the server-side attack surface"));
     }
 }
 program

package/dist/core/orchestrator.js

@@ -227,15 +227,15 @@ export async function run(options) {
     // it in a sandboxed worktree, and verify the bug stops reproducing. Opt-in;
     // the patch is only ever handed to a human for review, never committed.
     if (options.heal) {
-        const healTargets = findings.filter((f) => (f.severity === "crash" || f.severity === "error") &&
+        const reproducible = findings.filter((f) => (f.severity === "crash" || f.severity === "error") &&
             // A `network_5xx` finding heals only when its 500 body leaked a server
             // stack (→ an own-code source location); heal then boots the patched app
             // to verify. `network_timeout` stays excluded — it needs a time-based
             // repro first.
             f.type !== "network_timeout" &&
-            f.mappedLocation?.isOwnCode &&
             f.repro &&
             f.repro.verdict !== "unreliable");
+        const healTargets = reproducible.filter((f) => f.mappedLocation?.isOwnCode);
         if (healTargets.length) {
             say(pc.cyan("— Closed-loop healing (redact → generate → gate → sandbox → test → verify) —"));
             emitPhase("heal");
@@ -295,6 +295,11 @@ export async function run(options) {
                 }
             }
         }
+        else if (reproducible.length > 0) {
+            // Reproducible crashes, but none mapped to source (wrong --repo?) — tell the
+            // user rather than silently doing nothing.
+            say(pc.yellow(`Found ${reproducible.length} reproducible crash(es) but couldn't map them to source files. Run from your project root (or pass --repo <dir>) so --fix can read the code.`));
+        }
     }
     const reportPath = writeReport(repoRoot, url, findings);
     say(pc.dim(`Report: ${path.relative(repoRoot, reportPath)}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",