aztrx-cli 0.4.1 → 0.4.3

package/README.md

@@ -114,7 +114,7 @@ jobs:
     permissions: { contents: read, pull-requests: write }
     steps:
       - uses: actions/checkout@v4
-      - uses: Aztrx-AI/aztrx@98dbad0f7b6681c7670f7068d01dc0d54813a55f
+      - uses: Aztrx-AI/aztrx@v0.4.3
         with:
           url: http://localhost:3000
           start-command: npm run dev          # optional — boot the app in the background
@@ -137,9 +137,11 @@ niche tuning knobs).
 | --- | --- | --- |
 | `--fuzz` | Seeded chaos fuzzing instead of the deterministic walk | — |
 | `--http-fuzz` | Server-side mutation fuzzing — hostile requests against the target origin | — |
+| `--http-fuzz-mutations` | With `--http-fuzz`: also send POST/PUT body mutations (default: GET-only) | — |
 | `--repro` | Minimize (ddmin) → emit Playwright spec → validate flake rate | — |
 | `--heal` | Generate + verify a fix (implies `--repro`) | — |
 | `--fix` | Find → explain → heal → apply — the one-command fix (free for null/undefined derefs) | — |
+| `--magic-fix` | Hidden alias for `--fix` (deprecated) | — |
 | `--explain` | Print a human-language summary of the findings | — |
 | `--yes` / `-y` | Auto-apply verified fixes without prompting (with `--fix`) | — |
 | `--pr` | Open a merge-ready PR with the verified fixes (with `--fix`) | — |
@@ -150,10 +152,10 @@ niche tuning knobs).
 | `--max-actions <n>` | Max actions per pass | `100` |
 | `--seed <n>` | PRNG seed for deterministic fuzz | `42` |
 | `--workers <n>` | Number of parallel detection workers | `1` |
-| `--swarm` | Hidden alias for `--workers auto` | — |
+| `--swarm` | Auto-size the swarm to CPU cores (capped at 8) | — |
 | `--repro-runs <n>` | Flake-rate replay iterations | `3` |
 | `--heal-model <model>` | Fallback LLM tier | `claude-sonnet-5` / `$AZTRX_MODEL` |
-| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5` / `$AZTRX_FAST_MODEL` |
+| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5-20251001` / `$AZTRX_FAST_MODEL` |
 | `--test-command <cmd>` | Test command run against a healed patch | `npm test` (auto-detected) |
 | `--test-timeout <ms>` | Timeout for the heal test gate | `300000` |
 | `--no-test` | Skip the test gate during healing | — |
@@ -166,7 +168,11 @@ niche tuning knobs).
 | `--repo <path>` | Root path for sourcemap → source resolution | cwd |
 | `--allow-host <host>` | Add a host to the network allow-list (repeatable) | — |
 | `--storage-state <path>` | Playwright storage-state for authenticated pages | — |
+| `--auth <path>` | Hidden alias for `--storage-state` | — |
 | `--login` | Auto-login before the pass (needs `AZTRX_AUTH_EMAIL`/`AZTRX_AUTH_PASSWORD`) | — |
+| `--login-email <email>` | Email for `--login` (default: `$AZTRX_AUTH_EMAIL`) | — |
+| `--login-password <pass>` | Password for `--login` (default: `$AZTRX_AUTH_PASSWORD`) | — |
+| `--login-url <url>` | Explicit login page URL for `--login` (default: current page) | — |
 | `--fail-on` | Exit `1` if any crash/error finding is present | — |
 | `--dry-run` | Log planned actions without executing them | — |
 | `--crash-test` | Throw a deliberate error to verify capture | — |
@@ -182,7 +188,7 @@ Every run writes self-contained artifacts inside `.aztrx/` (gitignored):
 .aztrx/
 ├── report.html                  # interactive triage report
 ├── repro/<id>.spec.ts           # minimal, executable Playwright repro
-├── heal/fix.patch               # gated, compiler-checked fix
+├── heal/<id>.patch              # gated, compiler-checked fix (one per finding)
 ├── events.jsonl                 # run log (streamed by `aztrx-cli studio`)
 ├── pr-comment.md                # GitHub PR markdown (with --pr-comment)
 └── badge.svg                    # status badge (with --badge)

package/dist/cli.js

@@ -64,8 +64,15 @@ async function detectUrl(repoRoot) {
 function suggestNext(findings, opts) {
     if (opts.dryRun || opts.crashTest || findings.length === 0)
         return;
-    const crashOrError = findings.some((f) => f.severity === "crash" || f.severity === "error");
     const alreadyFixing = opts.heal || opts.fix || opts.magicFix;
+    // Server-side 5xx → point at the server fuzzer. `--fix` patches frontend code,
+    // so it can't help with a 502/500 from the server.
+    const serverError = findings.some((f) => f.type === "network_5xx");
+    if (serverError && !opts.httpFuzz) {
+        console.log(pc.dim("Tip: these are server-side 5xx — run with --http-fuzz to map the server attack surface"));
+        return;
+    }
+    const crashOrError = findings.some((f) => f.severity === "crash" || f.severity === "error");
     if (crashOrError && !alreadyFixing) {
         if (opts.repro) {
             console.log(pc.dim("Tip: run with --fix to attempt a closed-loop fix"));
@@ -73,11 +80,6 @@ function suggestNext(findings, opts) {
         else {
             console.log(pc.dim("Tip: run with --repro to prove these with a runnable spec, or --fix to fix them end-to-end"));
         }
-        return;
-    }
-    const serverError = findings.some((f) => f.type === "network_5xx");
-    if (serverError && !opts.httpFuzz) {
-        console.log(pc.dim("Tip: run with --http-fuzz to map the server-side attack surface"));
     }
 }
 program

package/dist/core/browser.js

@@ -0,0 +1,47 @@
+/**
+ * Chromium launcher with a first-run safety net. Playwright no longer downloads
+ * its browser builds on `npm install`, so a fresh `npx aztrx-cli run` would
+ * otherwise die on a bare "Executable doesn't exist". This detects that specific
+ * failure, installs the Chromium build that matches the bundled Playwright
+ * version, and retries once — keeping the zero-setup promise.
+ */
+import { spawn } from "child_process";
+import { createRequire } from "module";
+import path from "path";
+import pc from "picocolors";
+import { chromium } from "playwright";
+const require = createRequire(import.meta.url);
+/** True when the driver can't find its browser build (the "run playwright install" case). */
+function isMissingBrowser(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return /Executable doesn't exist|playwright install/i.test(msg);
+}
+/** Install the Chromium build that matches the bundled Playwright version. */
+function installChromium() {
+    const pkgPath = require.resolve("playwright/package.json");
+    const cli = path.join(path.dirname(pkgPath), "cli.js");
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [cli, "install", "chromium"], {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        // Route progress to stderr so it never corrupts the Ink TUI on stdout.
+        child.stdout?.on("data", (d) => process.stderr.write(d));
+        child.stderr?.on("data", (d) => process.stderr.write(d));
+        child.on("error", reject);
+        child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`playwright install exited ${code}`)));
+    });
+}
+/** Launch Chromium headlessly, installing its browser build first when absent. */
+export async function launchChromium(options = {}) {
+    const launch = () => chromium.launch({ headless: true, ...options });
+    try {
+        return await launch();
+    }
+    catch (err) {
+        if (!isMissingBrowser(err))
+            throw err;
+        process.stderr.write(pc.dim("First run: downloading the Chromium browser (~150 MB)…\n"));
+        await installChromium();
+        return await launch();
+    }
+}

package/dist/core/orchestrator.js

@@ -227,15 +227,15 @@ export async function run(options) {
     // it in a sandboxed worktree, and verify the bug stops reproducing. Opt-in;
     // the patch is only ever handed to a human for review, never committed.
     if (options.heal) {
-        const healTargets = findings.filter((f) => (f.severity === "crash" || f.severity === "error") &&
+        const reproducible = findings.filter((f) => (f.severity === "crash" || f.severity === "error") &&
             // A `network_5xx` finding heals only when its 500 body leaked a server
             // stack (→ an own-code source location); heal then boots the patched app
             // to verify. `network_timeout` stays excluded — it needs a time-based
             // repro first.
             f.type !== "network_timeout" &&
-            f.mappedLocation?.isOwnCode &&
             f.repro &&
             f.repro.verdict !== "unreliable");
+        const healTargets = reproducible.filter((f) => f.mappedLocation?.isOwnCode);
         if (healTargets.length) {
             say(pc.cyan("— Closed-loop healing (redact → generate → gate → sandbox → test → verify) —"));
             emitPhase("heal");
@@ -295,6 +295,11 @@ export async function run(options) {
                 }
             }
         }
+        else if (reproducible.length > 0) {
+            // Reproducible crashes, but none mapped to source (wrong --repo?) — tell the
+            // user rather than silently doing nothing.
+            say(pc.yellow(`Found ${reproducible.length} reproducible crash(es) but couldn't map them to source files. Run from your project root (or pass --repo <dir>) so --fix can read the code.`));
+        }
     }
     const reportPath = writeReport(repoRoot, url, findings);
     say(pc.dim(`Report: ${path.relative(repoRoot, reportPath)}`));

package/dist/core/replay.js

@@ -1,5 +1,5 @@
-import { chromium } from "playwright";
 import { EventBus } from "./eventBus.js";
+import { launchChromium } from "./browser.js";
 import { attachInterceptor } from "./interceptor.js";
 import { fingerprintOf } from "./classifier.js";
 /** Replays a recorded action sequence against a page. Best-effort: a selector
@@ -79,7 +79,7 @@ export class ReplayEngine {
     }
     async getBrowser() {
         if (!this.browser)
-            this.browser = await chromium.launch({ headless: true });
+            this.browser = await launchChromium();
         return this.browser;
     }
     async run(url, actions, targetFingerprint, opts) {

package/dist/core/swarm.js

@@ -11,7 +11,7 @@
  */
 import * as fs from "fs";
 import * as path from "path";
-import { chromium } from "playwright";
+import { launchChromium } from "./browser.js";
 import { EventBus } from "./eventBus.js";
 import { attachInterceptor } from "./interceptor.js";
 import { establishLogin } from "./auth.js";
@@ -211,7 +211,7 @@ function strategyLabel(s) {
 /** Launch one browser, run the worker roster concurrently, merge findings. */
 export async function swarmDetect(opts) {
     const strategies = buildStrategies(opts);
-    const browser = await chromium.launch({ headless: true });
+    const browser = await launchChromium();
     try {
         const settled = await Promise.allSettled(strategies.map((strategy, i) => detectWorker(browser, {
             url: opts.url,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
@@ -48,7 +48,7 @@
     "commander": "^12.1.0",
     "ink": "^5.2.0",
     "picocolors": "^1.1.1",
-    "playwright": "^1.49.0",
+    "playwright": "1.62.1",
     "react": "^18.3.1",
     "typescript": "^5.7.0"
   },