aztrx-cli 0.4.2 → 0.4.3

package/README.md

@@ -114,7 +114,7 @@ jobs:
     permissions: { contents: read, pull-requests: write }
     steps:
       - uses: actions/checkout@v4
-      - uses: Aztrx-AI/aztrx@98dbad0f7b6681c7670f7068d01dc0d54813a55f
+      - uses: Aztrx-AI/aztrx@v0.4.3
         with:
           url: http://localhost:3000
           start-command: npm run dev          # optional — boot the app in the background
@@ -137,9 +137,11 @@ niche tuning knobs).
 | --- | --- | --- |
 | `--fuzz` | Seeded chaos fuzzing instead of the deterministic walk | — |
 | `--http-fuzz` | Server-side mutation fuzzing — hostile requests against the target origin | — |
+| `--http-fuzz-mutations` | With `--http-fuzz`: also send POST/PUT body mutations (default: GET-only) | — |
 | `--repro` | Minimize (ddmin) → emit Playwright spec → validate flake rate | — |
 | `--heal` | Generate + verify a fix (implies `--repro`) | — |
 | `--fix` | Find → explain → heal → apply — the one-command fix (free for null/undefined derefs) | — |
+| `--magic-fix` | Hidden alias for `--fix` (deprecated) | — |
 | `--explain` | Print a human-language summary of the findings | — |
 | `--yes` / `-y` | Auto-apply verified fixes without prompting (with `--fix`) | — |
 | `--pr` | Open a merge-ready PR with the verified fixes (with `--fix`) | — |
@@ -150,10 +152,10 @@ niche tuning knobs).
 | `--max-actions <n>` | Max actions per pass | `100` |
 | `--seed <n>` | PRNG seed for deterministic fuzz | `42` |
 | `--workers <n>` | Number of parallel detection workers | `1` |
-| `--swarm` | Hidden alias for `--workers auto` | — |
+| `--swarm` | Auto-size the swarm to CPU cores (capped at 8) | — |
 | `--repro-runs <n>` | Flake-rate replay iterations | `3` |
 | `--heal-model <model>` | Fallback LLM tier | `claude-sonnet-5` / `$AZTRX_MODEL` |
-| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5` / `$AZTRX_FAST_MODEL` |
+| `--heal-fast-model <model>` | Fast/cheap first tier | `claude-haiku-4-5-20251001` / `$AZTRX_FAST_MODEL` |
 | `--test-command <cmd>` | Test command run against a healed patch | `npm test` (auto-detected) |
 | `--test-timeout <ms>` | Timeout for the heal test gate | `300000` |
 | `--no-test` | Skip the test gate during healing | — |
@@ -166,7 +168,11 @@ niche tuning knobs).
 | `--repo <path>` | Root path for sourcemap → source resolution | cwd |
 | `--allow-host <host>` | Add a host to the network allow-list (repeatable) | — |
 | `--storage-state <path>` | Playwright storage-state for authenticated pages | — |
+| `--auth <path>` | Hidden alias for `--storage-state` | — |
 | `--login` | Auto-login before the pass (needs `AZTRX_AUTH_EMAIL`/`AZTRX_AUTH_PASSWORD`) | — |
+| `--login-email <email>` | Email for `--login` (default: `$AZTRX_AUTH_EMAIL`) | — |
+| `--login-password <pass>` | Password for `--login` (default: `$AZTRX_AUTH_PASSWORD`) | — |
+| `--login-url <url>` | Explicit login page URL for `--login` (default: current page) | — |
 | `--fail-on` | Exit `1` if any crash/error finding is present | — |
 | `--dry-run` | Log planned actions without executing them | — |
 | `--crash-test` | Throw a deliberate error to verify capture | — |
@@ -182,7 +188,7 @@ Every run writes self-contained artifacts inside `.aztrx/` (gitignored):
 .aztrx/
 ├── report.html                  # interactive triage report
 ├── repro/<id>.spec.ts           # minimal, executable Playwright repro
-├── heal/fix.patch               # gated, compiler-checked fix
+├── heal/<id>.patch              # gated, compiler-checked fix (one per finding)
 ├── events.jsonl                 # run log (streamed by `aztrx-cli studio`)
 ├── pr-comment.md                # GitHub PR markdown (with --pr-comment)
 └── badge.svg                    # status badge (with --badge)

package/dist/core/browser.js

@@ -0,0 +1,47 @@
+/**
+ * Chromium launcher with a first-run safety net. Playwright no longer downloads
+ * its browser builds on `npm install`, so a fresh `npx aztrx-cli run` would
+ * otherwise die on a bare "Executable doesn't exist". This detects that specific
+ * failure, installs the Chromium build that matches the bundled Playwright
+ * version, and retries once — keeping the zero-setup promise.
+ */
+import { spawn } from "child_process";
+import { createRequire } from "module";
+import path from "path";
+import pc from "picocolors";
+import { chromium } from "playwright";
+const require = createRequire(import.meta.url);
+/** True when the driver can't find its browser build (the "run playwright install" case). */
+function isMissingBrowser(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return /Executable doesn't exist|playwright install/i.test(msg);
+}
+/** Install the Chromium build that matches the bundled Playwright version. */
+function installChromium() {
+    const pkgPath = require.resolve("playwright/package.json");
+    const cli = path.join(path.dirname(pkgPath), "cli.js");
+    return new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [cli, "install", "chromium"], {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        // Route progress to stderr so it never corrupts the Ink TUI on stdout.
+        child.stdout?.on("data", (d) => process.stderr.write(d));
+        child.stderr?.on("data", (d) => process.stderr.write(d));
+        child.on("error", reject);
+        child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`playwright install exited ${code}`)));
+    });
+}
+/** Launch Chromium headlessly, installing its browser build first when absent. */
+export async function launchChromium(options = {}) {
+    const launch = () => chromium.launch({ headless: true, ...options });
+    try {
+        return await launch();
+    }
+    catch (err) {
+        if (!isMissingBrowser(err))
+            throw err;
+        process.stderr.write(pc.dim("First run: downloading the Chromium browser (~150 MB)…\n"));
+        await installChromium();
+        return await launch();
+    }
+}

package/dist/core/replay.js

@@ -1,5 +1,5 @@
-import { chromium } from "playwright";
 import { EventBus } from "./eventBus.js";
+import { launchChromium } from "./browser.js";
 import { attachInterceptor } from "./interceptor.js";
 import { fingerprintOf } from "./classifier.js";
 /** Replays a recorded action sequence against a page. Best-effort: a selector
@@ -79,7 +79,7 @@ export class ReplayEngine {
     }
     async getBrowser() {
         if (!this.browser)
-            this.browser = await chromium.launch({ headless: true });
+            this.browser = await launchChromium();
         return this.browser;
     }
     async run(url, actions, targetFingerprint, opts) {

package/dist/core/swarm.js

@@ -11,7 +11,7 @@
  */
 import * as fs from "fs";
 import * as path from "path";
-import { chromium } from "playwright";
+import { launchChromium } from "./browser.js";
 import { EventBus } from "./eventBus.js";
 import { attachInterceptor } from "./interceptor.js";
 import { establishLogin } from "./auth.js";
@@ -211,7 +211,7 @@ function strategyLabel(s) {
 /** Launch one browser, run the worker roster concurrently, merge findings. */
 export async function swarmDetect(opts) {
     const strategies = buildStrategies(opts);
-    const browser = await chromium.launch({ headless: true });
+    const browser = await launchChromium();
     try {
         const settled = await Promise.allSettled(strategies.map((strategy, i) => detectWorker(browser, {
             url: opts.url,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
@@ -48,7 +48,7 @@
     "commander": "^12.1.0",
     "ink": "^5.2.0",
     "picocolors": "^1.1.1",
-    "playwright": "^1.49.0",
+    "playwright": "1.62.1",
     "react": "^18.3.1",
     "typescript": "^5.7.0"
   },