aztrx-cli 0.4.2 → 0.4.4

package/dist/core/resolver.js

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { TraceMap, originalPositionFor, } from "@jridgewell/trace-mapping";
+import { FlattenMap, originalPositionFor, } from "@jridgewell/trace-mapping";
 /** Framework-internal frames to skip when hunting the throw site. */
 const FRAMEWORK_FRAME = /node_modules|webpack-runtime|\.next[\\/]|next[\\/]dist[\\/]/;
 /**
@@ -80,6 +80,15 @@ function isFile(p) {
         return false;
     }
 }
+/** True only for a real directory. */
+function isDirectory(p) {
+    try {
+        return fs.existsSync(p) && fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
 /** Secret-bearing filenames that must never be read, even inside the repo — a
  * hostile sourcemap could otherwise point `source` at `.env`, an npmrc, or a
  * private key and exfiltrate it into the report / PR comment. */
@@ -135,6 +144,8 @@ function sourceCandidates(source, repoRoot) {
         .replace(/^webpack:\/\/[^/]+\//, "") // webpack://namespace/src/...
         .replace(/^webpack:\/\//, "")
         .replace(/^\/@fs\//, "")
+        .replace(/^file:\/\/\/([A-Za-z]:)/, "$1") // file:///C:/x → C:/x
+        .replace(/^file:\/\//, "")
         .replace(/^\//, "")
         .split("?")[0];
     const prefixes = ["", "apps/web/", "src/", "app/"];
@@ -150,13 +161,25 @@ function locateFile(candidates) {
     return null;
 }
 export async function resolveFrame(frame, repoRoot) {
+    const viaServerAction = await tryServerActionSourceMap(frame, repoRoot);
+    if (viaServerAction)
+        return viaServerAction;
     const viaMap = await trySourceMap(frame, repoRoot);
     if (viaMap)
         return viaMap;
     // Fallback: dev servers (Vite, Next) serve real source files at their URL
     // path, so the bundle URL is already the source path — no sourcemap needed.
     const relative = normalizeFrameUrl(frame.url);
-    const directPath = resolveWithin(repoRoot, relative);
+    let directPath = resolveWithin(repoRoot, relative);
+    // A frame URL pointing at a directory — e.g. an inline `<script>` whose V8
+    // frame carries the page URL (`http://localhost:3000/`, normalized to "") —
+    // resolves to the repo root. Map it to `index.html`, mirroring the static
+    // serve fallback, so the crash gets a real filename + snippet + own-code flag.
+    if (directPath && isDirectory(directPath)) {
+        const withIndex = resolveWithin(repoRoot, relative, "index.html");
+        if (withIndex)
+            directPath = withIndex;
+    }
     if (!directPath) {
         return {
             message: frame.message,
@@ -227,6 +250,35 @@ function isLoopback(host) {
     const h = host.replace(/^\[|\]$/g, "").toLowerCase();
     return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "0.0.0.0";
 }
+/** Shared tail of sourcemap resolution: run `originalPositionFor` through a
+ * (possibly sectioned) map, resolve the `source` it names to a repo file, and
+ * build the `MappedError`. Returns null when the position maps to no known
+ * source. */
+function resolveFromMap(rawMap, line, column, message, repoRoot) {
+    const map = new FlattenMap(rawMap);
+    const pos = originalPositionFor(map, { line, column });
+    if (!pos.source || pos.line == null)
+        return null;
+    const absolute = locateFile(sourceCandidates(pos.source, repoRoot));
+    if (!absolute) {
+        return {
+            message,
+            sourceFile: pos.source,
+            line: pos.line,
+            column: pos.column ?? 0,
+            codeSnippet: `<file not accessible locally: ${pos.source}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
+    return {
+        message,
+        sourceFile: path.relative(repoRoot, absolute),
+        line: pos.line,
+        column: pos.column ?? 0,
+        codeSnippet: extractSnippet(absolute, pos.line),
+        resolvedFrom: "sourcemap",
+    };
+}
 async function trySourceMap(frame, repoRoot) {
     const mapUrl = stripQuery(frame.url) + ".map";
     // SSRF guard: the sourcemap URL is derived from an untrusted stack frame, so
@@ -252,29 +304,38 @@ async function trySourceMap(frame, repoRoot) {
         return null;
     }
     try {
-        const map = new TraceMap(rawMap);
-        const pos = originalPositionFor(map, { line: frame.line, column: frame.column });
-        if (!pos.source || pos.line == null)
-            return null;
-        const absolute = locateFile(sourceCandidates(pos.source, repoRoot));
-        if (!absolute) {
-            return {
-                message: frame.message,
-                sourceFile: pos.source,
-                line: pos.line,
-                column: pos.column ?? 0,
-                codeSnippet: `<file not accessible locally: ${pos.source}>`,
-                resolvedFrom: "unresolved",
-            };
-        }
-        return {
-            message: frame.message,
-            sourceFile: path.relative(repoRoot, absolute),
-            line: pos.line,
-            column: pos.column ?? 0,
-            codeSnippet: extractSnippet(absolute, pos.line),
-            resolvedFrom: "sourcemap",
-        };
+        return resolveFromMap(rawMap, frame.line, frame.column, frame.message, repoRoot);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Map a Next.js Server Action throw site to its original source. The browser
+ * sees the throw as `about://React/Server/<url-encoded chunk path>?<n>:<line>:<col>`,
+ * where the encoded path is the compiled Turbopack chunk on disk. That chunk's
+ * `.map` is a *sectioned* (indexed) sourcemap whose sections point at the real
+ * source (e.g. `app/actions.ts`); `FlattenMap` walks the sections for us.
+ */
+async function tryServerActionSourceMap(frame, repoRoot) {
+    const marker = "about://React/Server/";
+    if (!frame.url.startsWith(marker))
+        return null;
+    let chunkPath;
+    try {
+        chunkPath = stripQuery(decodeURIComponent(frame.url.slice(marker.length)));
+    }
+    catch {
+        return null;
+    }
+    if (!isFile(chunkPath))
+        return null;
+    const mapPath = chunkPath + ".map";
+    if (!isFile(mapPath) || isSensitive(mapPath))
+        return null;
+    try {
+        const rawMap = JSON.parse(fs.readFileSync(mapPath, "utf-8"));
+        return resolveFromMap(rawMap, frame.line, frame.column, frame.message, repoRoot);
     }
     catch {
         return null;

package/dist/core/summarize.js

@@ -118,11 +118,11 @@ function buildLlmPrompt(findings, lang, hasHealed) {
         `A QA tool scanned a web app and found the following findings:`,
         rows,
         "",
-        `Write a short, friendly, plain-language summary for a developer (${lang}): what was found, what each problem means in simple words, and — per the note below — whether fixes are ready. Do not invent details that are not listed. Keep it to a few short paragraphs or a tight bullet list.`,
+        `Write a short, friendly summary for a developer (${lang}) in Markdown — use headings, bold, bullet lists, and short \`\`\`code\`\`\` snippets where helpful. Explain what was found, what each problem means in simple words, and — per the note below — whether fixes are ready. Do not invent details that are not listed. Keep it concise.`,
         fixLine,
     ].join("\n");
 }
-const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise, human-language summary for a developer. Never invent details absent from the data. Respond in the requested language only.";
+const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise Markdown summary for a developer (headings, bold, bullet lists, short code snippets). Never invent details absent from the data. Respond in the requested language only.";
 async function summarizeFindingsLlm(findings, lang) {
     const hasHealed = findings.some((f) => f.heal?.status === "healed");
     const text = (await complete({

package/dist/core/swarm.js

@@ -11,11 +11,11 @@
  */
 import * as fs from "fs";
 import * as path from "path";
-import { chromium } from "playwright";
+import { launchChromium } from "./browser.js";
 import { EventBus } from "./eventBus.js";
 import { attachInterceptor } from "./interceptor.js";
 import { establishLogin } from "./auth.js";
-import { SignalClassifier } from "./classifier.js";
+import { SignalClassifier, collapseSignals } from "./classifier.js";
 import { ActionRecorder } from "./recorder.js";
 import { walkDom } from "./domWalker.js";
 import { fuzz } from "./fuzzer.js";
@@ -75,6 +75,20 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
     const context = await browser.newContext(opts.storageState ? { storageState: opts.storageState } : {});
     const page = await context.newPage();
     attachInterceptor(page, workerBus);
+    // Collect every same-origin URL the page issues — including `fetch()` fired
+    // from click handlers — so the folded HTTP fuzzer can probe endpoints a fresh
+    // page never sees (performance resources only capture on-load fetches).
+    const observedUrls = new Set();
+    const targetOrigin = new URL(opts.url).origin;
+    page.on("request", (req) => {
+        try {
+            if (new URL(req.url()).origin === targetOrigin)
+                observedUrls.add(req.url());
+        }
+        catch {
+            // malformed URL — skip
+        }
+    });
     if (opts.guardOn) {
         await attachNetworkGuard(page, {
             allowHosts: opts.allowHosts,
@@ -94,10 +108,9 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
         // Settle for hydration and mount-time effects before acting.
         await page.waitForTimeout(2000);
     }
-    // Auto-login (best-effort). The server-side HTTP fuzzer uses Node-side fetch,
-    // so it doesn't benefit from a browser session — skip it there.
+    // Auto-login (best-effort).
     let replayStorageState;
-    if (loaded && strategy.kind !== "http-fuzz" && opts.login && opts.loginEmail && opts.loginPassword) {
+    if (loaded && opts.login && opts.loginEmail && opts.loginPassword) {
         const res = await establishLogin(page, {
             email: opts.loginEmail,
             password: opts.loginPassword,
@@ -134,21 +147,27 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
     let sawLoginForm = false;
     if (loaded) {
         if (strategy.kind === "walk") {
-            const wr = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun });
+            const wr = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun, allowDestructive: opts.allowDestructive });
             actions = wr.actions;
             sawLoginForm = wr.sawLoginForm;
         }
-        else if (strategy.kind === "fuzz") {
-            const fr = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun });
+        else {
+            const fr = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun, allowDestructive: opts.allowDestructive });
             actions = fr.actions;
             newCoverage = fr.newCoverage;
         }
-        else {
-            actions = await httpFuzz(page, opts.url, workerBus, {
+        // Folded HTTP fuzzer: post-pass on this same page, seeded with every URL the
+        // walk/fuzz actually issued — including JS-fetch-only endpoints a standalone
+        // worker (snapshot before clicks) would never discover.
+        if (opts.httpFuzz) {
+            actions += await httpFuzz(page, opts.url, workerBus, {
                 maxRequests: opts.maxActions,
                 dryRun: opts.dryRun,
                 allowHosts: opts.allowHosts,
                 mutations: opts.httpFuzzMutations,
+                allowDestructive: opts.allowDestructive,
+                seedUrls: [...observedUrls],
+                navigate: false,
             });
         }
     }
@@ -175,12 +194,11 @@ export function mergeFindings(arrays) {
     }
     return [...byFingerprint.values()];
 }
-/** Build the worker roster for a run. `workers = 1` with no http-fuzz is the
- * legacy single pass; `--http-fuzz` and/or `workers > 1` fan out. */
+/** Build the worker roster for a run. `workers = 1` is the legacy single pass;
+ * `workers > 1` fans out. `--http-fuzz` is not a worker here — it folds into
+ * whichever pass runs (see `detectWorker`). */
 function buildStrategies(opts) {
     const strategies = [];
-    if (opts.httpFuzz)
-        strategies.push({ kind: "http-fuzz" });
     const w = Math.max(1, opts.workers);
     if (w === 1) {
         strategies.push(opts.fuzz ? { kind: "fuzz", seed: opts.seed } : { kind: "walk" });
@@ -202,8 +220,6 @@ function strategyLabel(s) {
     switch (s.kind) {
         case "walk":
             return "walk";
-        case "http-fuzz":
-            return "http-fuzz";
         case "fuzz":
             return `fuzz seed ${s.seed}`;
     }
@@ -211,7 +227,7 @@ function strategyLabel(s) {
 /** Launch one browser, run the worker roster concurrently, merge findings. */
 export async function swarmDetect(opts) {
     const strategies = buildStrategies(opts);
-    const browser = await chromium.launch({ headless: true });
+    const browser = await launchChromium();
     try {
         const settled = await Promise.allSettled(strategies.map((strategy, i) => detectWorker(browser, {
             url: opts.url,
@@ -228,6 +244,8 @@ export async function swarmDetect(opts) {
             crashTest: i === 0 ? opts.crashTest : false,
             saveAuthState: i === 0,
             httpFuzzMutations: opts.httpFuzzMutations,
+            httpFuzz: opts.httpFuzz,
+            allowDestructive: opts.allowDestructive,
             baseline: opts.baseline,
             log: (m) => opts.log(strategies.length > 1 ? `[w${i}] ${m}` : m),
         }, strategy, opts.forwardBus)));
@@ -242,7 +260,9 @@ export async function swarmDetect(opts) {
         for (const r of results)
             if (r.replayStorageState)
                 replayStorageState = r.replayStorageState;
-        const findings = mergeFindings(results.map((r) => r.findings));
+        // Merge identical fingerprints across workers, then collapse distinct
+        // capture paths of the same fault (5xx + console + timeout + throw) into one.
+        const findings = collapseSignals(mergeFindings(results.map((r) => r.findings)));
         const totalActions = results.reduce((sum, r) => sum + r.actions, 0);
         const totalCoverage = results.reduce((sum, r) => sum + r.newCoverage, 0);
         return {

package/dist/core/ui.js

@@ -52,6 +52,7 @@ h1 .brand-sub{color:var(--dim)}
 .sev{font:600 11px/1 ui-monospace,monospace;text-transform:uppercase;letter-spacing:.08em;color:var(--sev);border:1px solid var(--sev);border-radius:999px;padding:3px 9px;flex:none}
 h2{font-size:15px;margin:0;font-weight:600;word-break:break-word}
 .loc{color:var(--dim);font-size:12.5px;margin-top:8px}
+.dx{color:var(--azure);font-size:12.5px;margin-top:6px}
 .snippet{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:12px 0 0;white-space:pre}
 .server{color:var(--amber);font-size:12.5px;margin-top:8px}
 .server-body{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:8px 0 0;white-space:pre;max-height:240px;overflow-y:auto}

package/dist/ui/app.js

@@ -2,6 +2,8 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { useEffect, useMemo, useReducer, useRef, useState } from "react";
 import { render, Box, Text, useApp } from "ink";
 import { VERSION } from "../core/version.js";
+import { diagnoseFinding } from "../core/diagnose.js";
+import { diffHunks } from "../core/diff.js";
 // Palette — mirrors web/app/globals.css "crash seismograph" tokens, mapped to
 // the nearest ANSI colors so the terminal panel reads as the same instrument.
 const C = {
@@ -47,6 +49,11 @@ function reducer(state, msg) {
         }
         case "repro":
             return { ...state, repros: { ...state.repros, [msg.repro.finding.fingerprint]: msg.repro } };
+        case "heal":
+            return {
+                ...state,
+                findings: state.findings.map((f) => f.fingerprint === msg.heal.finding.fingerprint ? msg.heal.finding : f),
+            };
         default:
             return state;
     }
@@ -78,6 +85,7 @@ function useAztrx(bus) {
             bus.on("noise", () => dispatch({ type: "noise" })),
             bus.on("route", (r) => dispatch({ type: "route", url: r.url })),
             bus.on("repro", (r) => dispatch({ type: "repro", repro: r })),
+            bus.on("heal", (h) => dispatch({ type: "heal", heal: h })),
         ];
         return () => offs.forEach((off) => off());
     }, [bus]);
@@ -107,11 +115,28 @@ function ReproBadge({ repro }) {
     return (_jsxs(Text, { color: color, children: ["[", repro.verdict, " ", repro.reproductions, "/", repro.runs, "]"] }));
 }
 function FindingRow({ finding, repro }) {
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(SeverityMark, { severity: finding.severity }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.fg, children: firstLine(finding.rawMessage) })] }), finding.mappedLocation ? (_jsxs(Text, { color: C.dim, children: ["   ", finding.mappedLocation.filePath, ":", finding.mappedLocation.line, ":", finding.mappedLocation.column] })) : null, repro ? (_jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "   " }), _jsx(ReproBadge, { repro: repro }), _jsxs(Text, { color: C.dim, children: ["  ", "spec ", repro.specPath, " \u00B7 ", repro.steps, "/", repro.totalSteps, " steps"] })] })) : null] }));
+    const dx = diagnoseFinding(finding);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(SeverityMark, { severity: finding.severity }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.fg, children: firstLine(finding.rawMessage) })] }), finding.mappedLocation ? (_jsxs(Text, { color: C.dim, children: ["   ", finding.mappedLocation.filePath, ":", finding.mappedLocation.line, ":", finding.mappedLocation.column] })) : null, dx ? (_jsxs(Text, { color: C.azure, children: ["   ↳ ", dx] })) : null, repro ? (_jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "   " }), _jsx(ReproBadge, { repro: repro }), _jsxs(Text, { color: C.dim, children: ["  ", "spec ", repro.specPath, " \u00B7 ", repro.steps, "/", repro.totalSteps, " steps"] })] })) : null, finding.heal ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { color: finding.heal.status === "healed" ? C.green : C.amber, children: ["   ", finding.heal.status === "healed" ? "✓" : "◐", " ", finding.heal.status, finding.heal.model ? ` · ${finding.heal.model}` : ""] }), finding.heal.status === "healed" && finding.heal.hunks.length > 0 ? (_jsx(DiffView, { hunks: finding.heal.hunks, filePath: finding.heal.filePath })) : null] })) : null] }));
+}
+const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+function DiffView({ hunks, filePath }) {
+    const groups = diffHunks(hunks);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { color: C.dim, children: ["   ", filePath] }), groups.map((group, gi) => (_jsx(Box, { flexDirection: "column", children: group.map((l, i) => (_jsxs(Box, { children: [_jsxs(Text, { color: l.type === "add" ? C.green : C.red, children: ["     ", l.type === "add" ? "+" : "-", " "] }), _jsx(Text, { children: l.tokens.map((t, j) => {
+                                if (t.kind === "del")
+                                    return _jsx(Text, { backgroundColor: "red", color: "white", children: t.text }, j);
+                                if (t.kind === "add")
+                                    return _jsx(Text, { backgroundColor: "green", color: "black", children: t.text }, j);
+                                return _jsx(Text, { color: l.type === "add" ? C.green : C.red, children: t.text }, j);
+                            }) })] }, i))) }, gi)))] }));
 }
 function AztrxApp({ bus, done, targetUrl, repoRoot, mode }) {
     const { exit } = useApp();
     const { state, rate } = useAztrx(bus);
+    const [spin, setSpin] = useState(0);
+    useEffect(() => {
+        const id = setInterval(() => setSpin((s) => (s + 1) % SPINNER.length), 80);
+        return () => clearInterval(id);
+    }, []);
     useEffect(() => {
         let cancelled = false;
         const finish = () => {
@@ -125,7 +150,7 @@ function AztrxApp({ bus, done, targetUrl, repoRoot, mode }) {
     }, [done, exit]);
     const phase = PHASE_LABEL[state.phase];
     const currentRoute = state.routes[state.routes.length - 1] ?? targetUrl;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsxs(Text, { color: C.dim, children: ["   v", VERSION] })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: phase.color, children: phase.text }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: C.azure, bold: true, children: "Aztrx AI" }), _jsx(Text, { color: C.dim, children: " \u2014 Runtime Detector" }), _jsxs(Text, { color: C.dim, children: ["   v", VERSION] })] }), _jsxs(Text, { color: C.dim, children: ["  target  ", targetUrl, "     repo  ", repoRoot] }), _jsxs(Text, { color: C.dim, children: ["  mode    ", mode] }), _jsx(Text, { color: C.dim, children: "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500" }), _jsxs(Box, { marginTop: 1, children: [_jsxs(Text, { color: phase.color, children: [state.phase === "done" ? "✓" : SPINNER[spin], "  ", phase.text.replace(/^[◉✓]\s*/, "")] }), _jsx(Text, { color: C.dim, children: "  " }), _jsx(Text, { color: C.azureBright, bold: true, children: rate.toFixed(1) }), _jsx(Text, { color: C.dim, children: " ops/s \u00B7 " }), _jsx(Text, { color: C.fg, children: state.actions }), _jsx(Text, { color: C.dim, children: " actions \u00B7 " }), _jsx(Text, { color: C.fg, children: state.clicks }), _jsx(Text, { color: C.dim, children: " clicks" })] }), _jsxs(Box, { children: [_jsx(Text, { color: C.dim, children: "  route   " }), _jsx(Text, { color: C.muted, children: currentRoute }), _jsxs(Text, { color: C.dim, children: [" \u00B7 ", state.routes.length, " route(s)"] })] }), state.findings.length > 0 ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { color: C.muted, bold: true, children: ["findings (", state.findings.length, ")"] }), state.findings.map((f) => (_jsx(FindingRow, { finding: f, repro: state.repros[f.fingerprint] }, f.fingerprint)))] })) : null, state.noise > 0 ? (_jsxs(Text, { color: C.dim, children: ["  \u25B8 ", state.noise, " noise event(s) suppressed"] })) : null] }));
 }
 /** Mount the live terminal panel and resolve once the run (or a failure) ends. */
 export function renderTui(props) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aztrx-cli",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "private": false,
   "description": "Aztrx AI — runtime stress-tester for web apps. Detect bugs, then prove them with an executable repro.",
   "license": "Apache-2.0",
@@ -38,6 +38,7 @@
     "build": "tsc",
     "dev": "node dist/cli.js",
     "bench": "npm run build && tsx bench/run.ts",
+    "test": "tsx --test \"tests/**/*.test.ts\"",
     "typecheck": "tsc --noEmit && tsc -p server/tsconfig.json",
     "server": "tsx server/index.ts",
     "server:typecheck": "tsc -p server/tsconfig.json",
@@ -46,14 +47,17 @@
   "dependencies": {
     "@jridgewell/trace-mapping": "^0.3.25",
     "commander": "^12.1.0",
+    "gifenc": "^1.0.3",
     "ink": "^5.2.0",
     "picocolors": "^1.1.1",
-    "playwright": "^1.49.0",
+    "playwright": "1.62.1",
+    "pngjs": "^7.0.0",
     "react": "^18.3.1",
     "typescript": "^5.7.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
+    "@types/pngjs": "^6.0.5",
     "@types/react": "^18.3.12",
     "tsx": "^4.19.0"
   }