aztrx-cli 0.4.2 → 0.4.4

package/dist/core/patrol/pr.js

@@ -0,0 +1,233 @@
+/**
+ * PR opener for `aztrx patrol`. Like `fixPr.openFixPr`, but built for an
+ * autonomous loop, so it adds two things a human-driven flow doesn't need:
+ *
+ *   - **Dedup**: a fingerprint-stable branch name (`aztrx/fix-<fp8>`) plus a
+ *     `gh pr list --head` check, so a re-scan never opens a second PR for a bug
+ *     that already has one open.
+ *   - **Scoped staging**: stages only the files the patch touched (`git add --
+ *     <files>`), never `git add -A` — an autonomous run must not sweep up the
+ *     user's unrelated uncommitted work into a PR.
+ *
+ * The caller is responsible for applying patches first (`applyVerifiedPatches`).
+ */
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { createHash } from "crypto";
+import { diagnoseFinding } from "../diagnose.js";
+import { sanitizeSecrets } from "../heal/redact.js";
+const exec = promisify(execFile);
+export function branchFor(fp) {
+    return `aztrx/fix-${fp.slice(0, 8)}`;
+}
+/** Stable branch name for a *set* of fingerprints — the same set always maps to
+ * the same branch, so a re-scan of an unchanged batch doesn't open a duplicate PR. */
+export function branchForSet(fps) {
+    const h = createHash("sha1").update([...fps].sort().join("\n")).digest("hex").slice(0, 8);
+    return `aztrx/fix-batch-${h}`;
+}
+function headTitle(f) {
+    return f.rawMessage.split("\n")[0].slice(0, 60);
+}
+/** A local/loopback/private target is a dev box; only a publicly-routable host is
+ * a deployed app, so a crash there is "live in production" and worth flagging.
+ * Covers loopback, RFC1918 private ranges (10/8, 172.16/12, 192.168/16),
+ * link-local (169.254/16), and mDNS/internal suffixes (.local, .internal). */
+export function isLocalUrl(url) {
+    try {
+        const host = new URL(url).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+        if (host === "localhost" || host === "::1" || host === "::" || host === "0.0.0.0")
+            return true;
+        if (host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".localhost")) {
+            return true;
+        }
+        const octets = host.split(".");
+        if (octets.length === 4 && octets.every((o) => /^\d{1,3}$/.test(o) && Number(o) <= 255)) {
+            const [a, b] = octets.map(Number);
+            if (a === 10)
+                return true; // 10.0.0.0/8
+            if (a === 172 && b >= 16 && b <= 31)
+                return true; // 172.16.0.0/12
+            if (a === 192 && b === 168)
+                return true; // 192.168.0.0/16
+            if (a === 127)
+                return true; // 127.0.0.0/8
+            if (a === 169 && b === 254)
+                return true; // 169.254.0.0/16 link-local
+            return false;
+        }
+        return false;
+    }
+    catch {
+        return true; // unparseable target → assume local, don't scare-monger
+    }
+}
+/** Per-finding "before/after" narrative: the crash ("before"), a one-line *why*
+ * from the deterministic diagnosis, and the healed fix explanation ("after").
+ * Plain words rather than a stack trace, so a reviewer who never ran the scan
+ * still understands the PR at a glance. Untrusted text is secret-scrubbed. */
+function findingBlock(f, i) {
+    const head = sanitizeSecrets(f.rawMessage.split("\n")[0].trim());
+    const loc = f.mappedLocation
+        ? `\`${f.mappedLocation.filePath}:${f.mappedLocation.line}\``
+        : "unknown location";
+    const why = diagnoseFinding(f);
+    const fix = f.heal?.status === "healed" && f.heal.explanation
+        ? sanitizeSecrets(f.heal.explanation.trim())
+        : "";
+    const repro = f.repro?.verdict
+        ? `_repro: ${f.repro.verdict} ${f.repro.reproductions}/${f.repro.runs}_`
+        : "";
+    const lines = [`### ${i}. ${head.length > 96 ? head.slice(0, 93) + "…" : head}`];
+    lines.push(`- **Where:** ${loc}`);
+    if (why)
+        lines.push(`- **Why:** ${why}`);
+    if (fix)
+        lines.push(`- **The fix:** ${fix.length > 400 ? fix.slice(0, 397) + "…" : fix}`);
+    if (repro)
+        lines.push(`- ${repro}`);
+    return lines.join("\n");
+}
+const PROD_BANNER = "> ⚠️ **This crash is live in production right now** — the target isn't a local dev server.";
+const VERIFIED_NOTE = "Verified: AST-gated, compiled, run against the test suite, and replayed against the repro before this PR. Opened automatically by `aztrx patrol`.";
+async function hasOpenPr(repoRoot, branch) {
+    try {
+        const { stdout } = await exec("gh", ["pr", "list", "--head", branch, "--state", "open", "--json", "number"], { cwd: repoRoot });
+        const list = JSON.parse(stdout || "[]");
+        return Array.isArray(list) && list.length > 0;
+    }
+    catch {
+        // gh missing / unauthenticated — surface on the create step instead.
+        return false;
+    }
+}
+async function currentBranch(repoRoot) {
+    try {
+        const { stdout } = await exec("git", ["-C", repoRoot, "rev-parse", "--abbrev-ref", "HEAD"]);
+        return stdout.trim() || "main";
+    }
+    catch {
+        return "main";
+    }
+}
+async function safeCheckout(repoRoot, branch) {
+    await exec("git", ["-C", repoRoot, "checkout", branch]).catch(() => { });
+}
+/**
+ * Pure URL builder: turns a `git remote` origin URL into a raw-content URL for a
+ * repo-relative path, so the PR body can inline an image
+ * (`![…](https://github.com/<owner>/<repo>/raw/<branch>/<path>)`). Handles the
+ * three common remote shapes (`https://`, `git@github.com:`, `ssh://git@…`) and a
+ * trailing `.git`. Returns "" when the remote isn't GitHub.
+ */
+export function githubRawUrl(remote, branch, repoPath) {
+    const m = /github\.com[:/]([^/]+)\/([^/\s]+?)(?:\.git)?$/.exec(remote.trim());
+    if (!m)
+        return "";
+    return `https://github.com/${m[1]}/${m[2]}/raw/${branch}/${repoPath}`;
+}
+/**
+ * Reads the `origin` remote and delegates to {@link githubRawUrl}. Returns "" when
+ * `git` is missing or the remote isn't GitHub — the media is still committed to
+ * the branch, just not inlined.
+ */
+async function rawUrlFor(repoRoot, branch, repoPath) {
+    try {
+        const { stdout } = await exec("git", ["-C", repoRoot, "remote", "get-url", "origin"]);
+        return githubRawUrl(stdout, branch, repoPath);
+    }
+    catch {
+        return "";
+    }
+}
+/** Shared git plumbing: (re)create the branch at HEAD, stage only the touched
+ * files, commit, open the PR, and return to the original branch. The caller has
+ * already done its own dedup + title/body. */
+async function createPr(repoRoot, branch, title, body, files) {
+    const originalBranch = await currentBranch(repoRoot);
+    try {
+        // `-B` (re)creates the branch at HEAD — idempotent against a stale local
+        // branch left over from a previously failed PR attempt.
+        await exec("git", ["-C", repoRoot, "checkout", "-B", branch]);
+        if (files.length) {
+            await exec("git", ["-C", repoRoot, "add", "--", ...files]);
+        }
+        else {
+            await exec("git", ["-C", repoRoot, "add", "-A"]);
+        }
+        await exec("git", ["-C", repoRoot, "commit", "-m", title]);
+    }
+    catch (e) {
+        await safeCheckout(repoRoot, originalBranch);
+        return { ok: false, branch, error: `git failed: ${e.message}` };
+    }
+    try {
+        const { stdout } = await exec("gh", ["pr", "create", "--title", title, "--body", body], {
+            cwd: repoRoot,
+        });
+        await safeCheckout(repoRoot, originalBranch);
+        return { ok: true, branch, url: stdout.trim() };
+    }
+    catch (e) {
+        await safeCheckout(repoRoot, originalBranch);
+        return {
+            ok: false,
+            branch,
+            error: `gh pr create failed (is gh installed and authenticated?): ${e.message}`,
+        };
+    }
+}
+export async function openPatrolPr(repoRoot, finding, url, files, mediaPath) {
+    const branch = branchFor(finding.fingerprint);
+    if (await hasOpenPr(repoRoot, branch)) {
+        return { ok: false, skipped: true, branch, error: "PR already open for this finding" };
+    }
+    const mediaBody = mediaPath ? await rawUrlFor(repoRoot, branch, mediaPath) : "";
+    const block = findingBlock(finding, 1);
+    const body = [
+        "## Aztrx AI — autonomous fix",
+        "",
+        ...(isLocalUrl(url) ? [] : [PROD_BANNER, ""]),
+        `Found against ${url}:`,
+        "",
+        mediaBody ? `${block}\n\n![Recorded repro](${mediaBody})` : block,
+        "",
+        VERIFIED_NOTE,
+    ].join("\n");
+    return createPr(repoRoot, branch, `fix: ${headTitle(finding)}`, body, mediaPath ? [...files, mediaPath] : files);
+}
+/** One PR carrying a whole batch of fixes. Branch is stable across the *set*, so
+ * an unchanged batch re-scan dedups to the same PR. */
+export async function openPatrolBatchPr(repoRoot, findings, url, files, mediaPaths) {
+    const branch = branchForSet(findings.map((f) => f.fingerprint));
+    if (await hasOpenPr(repoRoot, branch)) {
+        return { ok: false, skipped: true, branch, error: "batch PR already open" };
+    }
+    const n = findings.length;
+    // Resolve each finding's media to a raw URL ("" when absent / non-GitHub), kept
+    // parallel to `findings` so each inline image lands under its own bug's block.
+    const mediaBodies = [];
+    for (let i = 0; i < findings.length; i++) {
+        const mp = mediaPaths?.[i];
+        mediaBodies.push(mp ? await rawUrlFor(repoRoot, branch, mp) : "");
+    }
+    const blocks = findings.map((f, i) => {
+        const block = findingBlock(f, i + 1);
+        return mediaBodies[i] ? `${block}\n\n![Recorded repro](${mediaBodies[i]})` : block;
+    });
+    const body = [
+        "## Aztrx AI — autonomous fix (batch)",
+        "",
+        ...(isLocalUrl(url) ? [] : [PROD_BANNER, ""]),
+        `Found ${n} bug${n === 1 ? "" : "s"} against ${url}:`,
+        "",
+        blocks.join("\n\n"),
+        "",
+        VERIFIED_NOTE,
+    ].join("\n");
+    const staged = mediaPaths
+        ? [...files, ...mediaPaths.filter((p) => !!p)]
+        : files;
+    const title = `fix: ${n} bug${n === 1 ? "" : "s"} (${headTitle(findings[0])})`;
+    return createPr(repoRoot, branch, title, body, staged);
+}

package/dist/core/patrol/record.js

@@ -0,0 +1,103 @@
+/**
+ * Recorded repro (Phase 3) — turns a reproducible bug into a shareable
+ * "before/after" proof: an animated GIF and a static crash screenshot, both
+ * destined for the patrol PR body.
+ *
+ * The capture is deliberately OFF the hot path. Verification replays a bug many
+ * times (ddmin + validator), but the recording runs once, only when a PR is about
+ * to open — so it launches its own browser instead of reusing ReplayEngine's.
+ *
+ * GIF encoding is pure-JS (`gifenc` + `pngjs`), no ffmpeg, so it works for every
+ * `npm install aztrx-cli` user rather than only machines with ffmpeg on PATH.
+ */
+import { createRequire } from "node:module";
+import { mkdirSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import { chromium } from "playwright";
+import { PNG } from "pngjs";
+import { replayActions } from "../replay.js";
+const require = createRequire(import.meta.url);
+const { GIFEncoder, quantize, applyPalette } = require("gifenc");
+/**
+ * Captures one PNG screenshot before the replay and one after each action, so
+ * the crash (or its absence) is visible in the sequence. Replays `replayActions`
+ * one action at a time — reusing the exact detection semantics, not a parallel
+ * reimplementation that could drift.
+ */
+export async function captureReproFrames(url, actions, opts = {}) {
+    const browser = await chromium.launch({ headless: true });
+    try {
+        const page = await browser.newPage({
+            viewport: opts.viewport ?? { width: 720, height: 430 },
+        });
+        await page.goto(url, { waitUntil: "load", timeout: 30000 }).catch(() => { });
+        await page.waitForTimeout(opts.settleMs ?? 1200);
+        const frames = [await page.screenshot()];
+        for (const action of actions) {
+            await replayActions(page, [action]);
+            await page.waitForTimeout(opts.stepMs ?? 300);
+            frames.push(await page.screenshot());
+        }
+        return frames;
+    }
+    finally {
+        await browser.close().catch(() => { });
+    }
+}
+/** Encodes a sequence of PNG frames into an animated GIF (pure JS, no ffmpeg). */
+export function encodeGif(frames, opts = {}) {
+    if (frames.length === 0)
+        return Buffer.alloc(0);
+    const delay = opts.delay ?? 400;
+    const maxColors = opts.maxColors ?? 256;
+    const decoded = frames.map((f) => PNG.sync.read(f));
+    const { width, height } = decoded[0];
+    // One global palette across every frame → compact file, no per-frame flicker.
+    const combined = new Uint8Array(decoded.reduce((n, d) => n + d.data.length, 0));
+    let off = 0;
+    for (const d of decoded) {
+        combined.set(d.data, off);
+        off += d.data.length;
+    }
+    const palette = quantize(combined, maxColors);
+    const indexes = decoded.map((d) => applyPalette(d.data, palette));
+    const gif = GIFEncoder();
+    indexes.forEach((index, i) => {
+        gif.writeFrame(index, width, height, {
+            palette: i === 0 ? palette : undefined,
+            delay,
+        });
+    });
+    gif.finish();
+    return Buffer.from(gif.bytes());
+}
+/** The static "crash shot": the final frame, when the crash has fully rendered. */
+export function crashFrame(frames) {
+    return frames[frames.length - 1];
+}
+/**
+ * Produces the recorded-repro GIF for a finding and writes it to
+ * `aztrx-media/<fp8>.gif`. That dir is deliberate: `media/` is in the npm
+ * `files` allowlist (so demo.gif/logo ship), but patrol GIFs must not publish —
+ * they're per-run artifacts. The path is committed to the PR branch so the PR
+ * body can inline it via a raw URL.
+ *
+ * Returns the repo-relative path, or null when there is nothing to record (no
+ * repro, or capture/encode failed) — the caller opens the PR regardless.
+ */
+export async function recordFindingGif(repoRoot, url, finding) {
+    // Skip `navigate` actions — captureReproFrames navigates itself, so replaying a
+    // leading navigate would just add a duplicate frame of the same page.
+    const actions = (finding.repro?.actions ?? []).filter((a) => a.type !== "navigate");
+    if (actions.length === 0)
+        return null;
+    const frames = await captureReproFrames(url, actions);
+    if (frames.length < 2)
+        return null; // a single frame isn't an animation
+    const gif = encodeGif(frames, { delay: 700 });
+    const rel = path.join("aztrx-media", `${finding.fingerprint.slice(0, 8)}.gif`);
+    const abs = path.resolve(repoRoot, rel);
+    mkdirSync(path.dirname(abs), { recursive: true });
+    writeFileSync(abs, gif);
+    return rel;
+}

package/dist/core/patrol/state.js

@@ -0,0 +1,78 @@
+/**
+ * Cross-run memory for `aztrx patrol`. Where `RunLog` is append-only and reset
+ * every run, this is a small index of "have I seen this fingerprint before, and
+ * what happened to it?" — the thing that stops an autonomous loop from re-fixing
+ * the same bug and re-opening the same PR on every cycle.
+ *
+ * Lives at `.aztrx/patrol.json` (already gitignored via `.aztrx/`). A fingerprint
+ * absent from the map is implicitly "new".
+ */
+import * as fs from "fs";
+import * as path from "path";
+export class PatrolState {
+    file;
+    cooldownMs;
+    data;
+    constructor(repoRoot, url, cooldownMs = 30 * 60 * 1000) {
+        const dir = path.join(repoRoot, ".aztrx");
+        fs.mkdirSync(dir, { recursive: true });
+        this.file = path.join(dir, "patrol.json");
+        this.cooldownMs = cooldownMs;
+        this.data = this.read();
+        this.data.url = url;
+    }
+    read() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.file, "utf-8"));
+            return { url: raw.url ?? "", fingerprints: raw.fingerprints ?? {} };
+        }
+        catch {
+            return { url: "", fingerprints: {} };
+        }
+    }
+    /**
+     * A fingerprint is "handled" while its PR is open, or while an `unfixed` mark
+     * is still within its cooldown. Once the cooldown lapses, an `unfixed` bug
+     * becomes retry-eligible again — it stops being "handled" and `run()` heals it
+     * afresh rather than skipping it forever.
+     */
+    isHandled(fp, now = Date.now()) {
+        const e = this.data.fingerprints[fp];
+        if (!e)
+            return false;
+        if (e.status === "pr-opened")
+            return true;
+        return now - Date.parse(e.lastSeen) < this.cooldownMs;
+    }
+    /** Every currently-handled fingerprint, so the supervisor can tell `run()` to skip healing them. */
+    handled(now = Date.now()) {
+        return Object.keys(this.data.fingerprints).filter((fp) => this.isHandled(fp, now));
+    }
+    markPr(fp, prUrl, branch) {
+        this.data.fingerprints[fp] = {
+            status: "pr-opened",
+            firstSeen: this.firstSeen(fp),
+            lastSeen: new Date().toISOString(),
+            prUrl,
+            branch,
+            attempts: this.attempts(fp) + 1,
+        };
+    }
+    markUnfixed(fp) {
+        this.data.fingerprints[fp] = {
+            status: "unfixed",
+            firstSeen: this.firstSeen(fp),
+            lastSeen: new Date().toISOString(),
+            attempts: this.attempts(fp) + 1,
+        };
+    }
+    firstSeen(fp) {
+        return this.data.fingerprints[fp]?.firstSeen ?? new Date().toISOString();
+    }
+    attempts(fp) {
+        return this.data.fingerprints[fp]?.attempts ?? 0;
+    }
+    save() {
+        fs.writeFileSync(this.file, JSON.stringify(this.data, null, 2) + "\n", "utf-8");
+    }
+}

package/dist/core/renderMarkdown.js

@@ -0,0 +1,92 @@
+/**
+ * Minimal Markdown → ANSI renderer for the `--explain` / `--fix` human-language
+ * summary. Handles the small dialect Aztrx emits: headings, bold/`code` inline,
+ * bullet and numbered lists, and fenced code blocks with a light JS/TS syntax
+ * highlight. Plain prose without markdown passes through unchanged.
+ */
+import pc from "picocolors";
+const KEYWORDS = new Set([
+    "const", "let", "var", "function", "return", "if", "else", "for", "while", "do",
+    "new", "class", "extends", "super", "import", "export", "from", "async", "await",
+    "try", "catch", "finally", "throw", "switch", "case", "break", "continue",
+    "default", "typeof", "instanceof", "in", "of", "delete", "void", "this", "null",
+    "undefined", "true", "false", "static", "get", "set", "interface", "type",
+    "enum", "readonly", "as", "satisfies", "yield",
+]);
+/** Single-pass tokenizer. Classify by first char: `/` comment, quote/backtick
+ * string, digit number, letter keyword, else plain identifier. */
+const TOKEN = /(\/\/[^\n]*|\/\*[\s\S]*?\*\/|'(?:\\.|[^'\\\n])*'|"(?:\\.|[^"\\\n])*"|`(?:\\.|[^`\\])*`|\b\d+(?:\.\d+)?\b|\b[A-Za-z_$][\w$]*\b)/g;
+function highlight(code) {
+    return code.replace(TOKEN, (raw) => {
+        const c = raw[0];
+        if (c === "/")
+            return pc.dim(pc.gray(raw));
+        if (c === "'" || c === '"' || c === "`")
+            return pc.green(raw);
+        if (c >= "0" && c <= "9")
+            return pc.yellow(raw);
+        if (KEYWORDS.has(raw))
+            return pc.magenta(raw);
+        return raw;
+    });
+}
+/** Inline formatting: `code`, **bold**. */
+function renderInline(text) {
+    return text
+        .replace(/`([^`\n]+)`/g, (_, s) => pc.cyan(s))
+        .replace(/\*\*([^*]+)\*\*/g, (_, s) => pc.bold(s))
+        .replace(/__([^_]+)__/g, (_, s) => pc.bold(s));
+}
+export function renderMarkdown(md) {
+    const lines = md.split("\n");
+    const out = [];
+    let inCode = false;
+    let code = [];
+    const flushCode = () => {
+        if (!code.length)
+            return;
+        for (const l of code)
+            out.push("  " + pc.dim("│") + " " + highlight(l));
+        out.push("");
+        code = [];
+    };
+    for (const raw of lines) {
+        if (raw.trim().startsWith("```")) {
+            if (inCode) {
+                flushCode();
+                inCode = false;
+            }
+            else {
+                inCode = true;
+            }
+            continue;
+        }
+        if (inCode) {
+            code.push(raw);
+            continue;
+        }
+        const heading = raw.match(/^(#{1,4})\s+(.*)$/);
+        if (heading) {
+            out.push(pc.bold(pc.underline(renderInline(heading[2]))));
+            out.push("");
+            continue;
+        }
+        const bullet = raw.match(/^\s*[-*+]\s+(.*)$/);
+        if (bullet) {
+            out.push("  " + pc.cyan("•") + " " + renderInline(bullet[1]));
+            continue;
+        }
+        const numbered = raw.match(/^\s*(\d+)[.)]\s+(.*)$/);
+        if (numbered) {
+            out.push("  " + pc.cyan(numbered[1] + ".") + " " + renderInline(numbered[2]));
+            continue;
+        }
+        out.push(renderInline(raw));
+    }
+    flushCode();
+    while (out.length && out[0] === "")
+        out.shift();
+    while (out.length && out[out.length - 1] === "")
+        out.pop();
+    return out.join("\n");
+}

package/dist/core/replay.js

@@ -1,5 +1,5 @@
-import { chromium } from "playwright";
 import { EventBus } from "./eventBus.js";
+import { launchChromium } from "./browser.js";
 import { attachInterceptor } from "./interceptor.js";
 import { fingerprintOf } from "./classifier.js";
 /** Replays a recorded action sequence against a page. Best-effort: a selector
@@ -79,7 +79,7 @@ export class ReplayEngine {
     }
     async getBrowser() {
         if (!this.browser)
-            this.browser = await chromium.launch({ headless: true });
+            this.browser = await launchChromium();
         return this.browser;
     }
     async run(url, actions, targetFingerprint, opts) {

package/dist/core/report.js

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { BASE_CSS, SEVERITY_COLOR, seismograph } from "./ui.js";
 import { sanitizeSecrets } from "./heal/redact.js";
+import { diagnoseFinding } from "./diagnose.js";
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -16,7 +17,7 @@ const SEV_ORDER = ["crash", "error", "warning", "noise"];
  * CDN), rendered in the shared "crash seismograph" identity: one red spike per
  * crash, severity chips, and colored repro verdicts.
  */
-export function renderReport(targetUrl, findings) {
+export function renderReport(targetUrl, findings, lang) {
     const sorted = [...findings].sort((a, b) => SEV_ORDER.indexOf(a.severity) - SEV_ORDER.indexOf(b.severity));
     const counts = { crash: 0, error: 0, warning: 0 };
     for (const f of sorted)
@@ -28,6 +29,7 @@ export function renderReport(targetUrl, findings) {
             ? `${clean(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
             : "";
         const snippet = f.mappedLocation ? clean(f.mappedLocation.codeContext) : "";
+        const dx = diagnoseFinding(f, lang);
         const serverErr = f.serverError
             ? `<div class="server">server: ${clean(f.serverError.message)}</div>` +
                 (f.serverError.body
@@ -53,6 +55,7 @@ export function renderReport(targetUrl, findings) {
         <h2>${clean(f.rawMessage.split("\n")[0])}</h2>
       </header>
       ${loc ? `<div class="loc">${loc}</div>` : ""}
+      ${dx ? `<div class="dx">↳ ${clean(dx)}</div>` : ""}
       ${snippet ? `<pre class="snippet">${snippet}</pre>` : ""}
       ${serverErr}
       ${f.occurrences > 1 ? `<div class="occ">seen ×${f.occurrences}</div>` : ""}
@@ -88,10 +91,10 @@ export function renderReport(targetUrl, findings) {
 </body>
 </html>`;
 }
-export function writeReport(repoRoot, targetUrl, findings) {
+export function writeReport(repoRoot, targetUrl, findings, lang) {
     const dir = path.join(repoRoot, ".aztrx");
     fs.mkdirSync(dir, { recursive: true });
     const file = path.join(dir, "report.html");
-    fs.writeFileSync(file, renderReport(targetUrl, findings), "utf-8");
+    fs.writeFileSync(file, renderReport(targetUrl, findings, lang), "utf-8");
     return file;
 }