aztrx-cli 0.4.3 → 0.4.4

package/dist/core/patrol/record.js

@@ -0,0 +1,103 @@
+/**
+ * Recorded repro (Phase 3) — turns a reproducible bug into a shareable
+ * "before/after" proof: an animated GIF and a static crash screenshot, both
+ * destined for the patrol PR body.
+ *
+ * The capture is deliberately OFF the hot path. Verification replays a bug many
+ * times (ddmin + validator), but the recording runs once, only when a PR is about
+ * to open — so it launches its own browser instead of reusing ReplayEngine's.
+ *
+ * GIF encoding is pure-JS (`gifenc` + `pngjs`), no ffmpeg, so it works for every
+ * `npm install aztrx-cli` user rather than only machines with ffmpeg on PATH.
+ */
+import { createRequire } from "node:module";
+import { mkdirSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import { chromium } from "playwright";
+import { PNG } from "pngjs";
+import { replayActions } from "../replay.js";
+const require = createRequire(import.meta.url);
+const { GIFEncoder, quantize, applyPalette } = require("gifenc");
+/**
+ * Captures one PNG screenshot before the replay and one after each action, so
+ * the crash (or its absence) is visible in the sequence. Replays `replayActions`
+ * one action at a time — reusing the exact detection semantics, not a parallel
+ * reimplementation that could drift.
+ */
+export async function captureReproFrames(url, actions, opts = {}) {
+    const browser = await chromium.launch({ headless: true });
+    try {
+        const page = await browser.newPage({
+            viewport: opts.viewport ?? { width: 720, height: 430 },
+        });
+        await page.goto(url, { waitUntil: "load", timeout: 30000 }).catch(() => { });
+        await page.waitForTimeout(opts.settleMs ?? 1200);
+        const frames = [await page.screenshot()];
+        for (const action of actions) {
+            await replayActions(page, [action]);
+            await page.waitForTimeout(opts.stepMs ?? 300);
+            frames.push(await page.screenshot());
+        }
+        return frames;
+    }
+    finally {
+        await browser.close().catch(() => { });
+    }
+}
+/** Encodes a sequence of PNG frames into an animated GIF (pure JS, no ffmpeg). */
+export function encodeGif(frames, opts = {}) {
+    if (frames.length === 0)
+        return Buffer.alloc(0);
+    const delay = opts.delay ?? 400;
+    const maxColors = opts.maxColors ?? 256;
+    const decoded = frames.map((f) => PNG.sync.read(f));
+    const { width, height } = decoded[0];
+    // One global palette across every frame → compact file, no per-frame flicker.
+    const combined = new Uint8Array(decoded.reduce((n, d) => n + d.data.length, 0));
+    let off = 0;
+    for (const d of decoded) {
+        combined.set(d.data, off);
+        off += d.data.length;
+    }
+    const palette = quantize(combined, maxColors);
+    const indexes = decoded.map((d) => applyPalette(d.data, palette));
+    const gif = GIFEncoder();
+    indexes.forEach((index, i) => {
+        gif.writeFrame(index, width, height, {
+            palette: i === 0 ? palette : undefined,
+            delay,
+        });
+    });
+    gif.finish();
+    return Buffer.from(gif.bytes());
+}
+/** The static "crash shot": the final frame, when the crash has fully rendered. */
+export function crashFrame(frames) {
+    return frames[frames.length - 1];
+}
+/**
+ * Produces the recorded-repro GIF for a finding and writes it to
+ * `aztrx-media/<fp8>.gif`. That dir is deliberate: `media/` is in the npm
+ * `files` allowlist (so demo.gif/logo ship), but patrol GIFs must not publish —
+ * they're per-run artifacts. The path is committed to the PR branch so the PR
+ * body can inline it via a raw URL.
+ *
+ * Returns the repo-relative path, or null when there is nothing to record (no
+ * repro, or capture/encode failed) — the caller opens the PR regardless.
+ */
+export async function recordFindingGif(repoRoot, url, finding) {
+    // Skip `navigate` actions — captureReproFrames navigates itself, so replaying a
+    // leading navigate would just add a duplicate frame of the same page.
+    const actions = (finding.repro?.actions ?? []).filter((a) => a.type !== "navigate");
+    if (actions.length === 0)
+        return null;
+    const frames = await captureReproFrames(url, actions);
+    if (frames.length < 2)
+        return null; // a single frame isn't an animation
+    const gif = encodeGif(frames, { delay: 700 });
+    const rel = path.join("aztrx-media", `${finding.fingerprint.slice(0, 8)}.gif`);
+    const abs = path.resolve(repoRoot, rel);
+    mkdirSync(path.dirname(abs), { recursive: true });
+    writeFileSync(abs, gif);
+    return rel;
+}

package/dist/core/patrol/state.js

@@ -0,0 +1,78 @@
+/**
+ * Cross-run memory for `aztrx patrol`. Where `RunLog` is append-only and reset
+ * every run, this is a small index of "have I seen this fingerprint before, and
+ * what happened to it?" — the thing that stops an autonomous loop from re-fixing
+ * the same bug and re-opening the same PR on every cycle.
+ *
+ * Lives at `.aztrx/patrol.json` (already gitignored via `.aztrx/`). A fingerprint
+ * absent from the map is implicitly "new".
+ */
+import * as fs from "fs";
+import * as path from "path";
+export class PatrolState {
+    file;
+    cooldownMs;
+    data;
+    constructor(repoRoot, url, cooldownMs = 30 * 60 * 1000) {
+        const dir = path.join(repoRoot, ".aztrx");
+        fs.mkdirSync(dir, { recursive: true });
+        this.file = path.join(dir, "patrol.json");
+        this.cooldownMs = cooldownMs;
+        this.data = this.read();
+        this.data.url = url;
+    }
+    read() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.file, "utf-8"));
+            return { url: raw.url ?? "", fingerprints: raw.fingerprints ?? {} };
+        }
+        catch {
+            return { url: "", fingerprints: {} };
+        }
+    }
+    /**
+     * A fingerprint is "handled" while its PR is open, or while an `unfixed` mark
+     * is still within its cooldown. Once the cooldown lapses, an `unfixed` bug
+     * becomes retry-eligible again — it stops being "handled" and `run()` heals it
+     * afresh rather than skipping it forever.
+     */
+    isHandled(fp, now = Date.now()) {
+        const e = this.data.fingerprints[fp];
+        if (!e)
+            return false;
+        if (e.status === "pr-opened")
+            return true;
+        return now - Date.parse(e.lastSeen) < this.cooldownMs;
+    }
+    /** Every currently-handled fingerprint, so the supervisor can tell `run()` to skip healing them. */
+    handled(now = Date.now()) {
+        return Object.keys(this.data.fingerprints).filter((fp) => this.isHandled(fp, now));
+    }
+    markPr(fp, prUrl, branch) {
+        this.data.fingerprints[fp] = {
+            status: "pr-opened",
+            firstSeen: this.firstSeen(fp),
+            lastSeen: new Date().toISOString(),
+            prUrl,
+            branch,
+            attempts: this.attempts(fp) + 1,
+        };
+    }
+    markUnfixed(fp) {
+        this.data.fingerprints[fp] = {
+            status: "unfixed",
+            firstSeen: this.firstSeen(fp),
+            lastSeen: new Date().toISOString(),
+            attempts: this.attempts(fp) + 1,
+        };
+    }
+    firstSeen(fp) {
+        return this.data.fingerprints[fp]?.firstSeen ?? new Date().toISOString();
+    }
+    attempts(fp) {
+        return this.data.fingerprints[fp]?.attempts ?? 0;
+    }
+    save() {
+        fs.writeFileSync(this.file, JSON.stringify(this.data, null, 2) + "\n", "utf-8");
+    }
+}

package/dist/core/renderMarkdown.js

@@ -0,0 +1,92 @@
+/**
+ * Minimal Markdown → ANSI renderer for the `--explain` / `--fix` human-language
+ * summary. Handles the small dialect Aztrx emits: headings, bold/`code` inline,
+ * bullet and numbered lists, and fenced code blocks with a light JS/TS syntax
+ * highlight. Plain prose without markdown passes through unchanged.
+ */
+import pc from "picocolors";
+const KEYWORDS = new Set([
+    "const", "let", "var", "function", "return", "if", "else", "for", "while", "do",
+    "new", "class", "extends", "super", "import", "export", "from", "async", "await",
+    "try", "catch", "finally", "throw", "switch", "case", "break", "continue",
+    "default", "typeof", "instanceof", "in", "of", "delete", "void", "this", "null",
+    "undefined", "true", "false", "static", "get", "set", "interface", "type",
+    "enum", "readonly", "as", "satisfies", "yield",
+]);
+/** Single-pass tokenizer. Classify by first char: `/` comment, quote/backtick
+ * string, digit number, letter keyword, else plain identifier. */
+const TOKEN = /(\/\/[^\n]*|\/\*[\s\S]*?\*\/|'(?:\\.|[^'\\\n])*'|"(?:\\.|[^"\\\n])*"|`(?:\\.|[^`\\])*`|\b\d+(?:\.\d+)?\b|\b[A-Za-z_$][\w$]*\b)/g;
+function highlight(code) {
+    return code.replace(TOKEN, (raw) => {
+        const c = raw[0];
+        if (c === "/")
+            return pc.dim(pc.gray(raw));
+        if (c === "'" || c === '"' || c === "`")
+            return pc.green(raw);
+        if (c >= "0" && c <= "9")
+            return pc.yellow(raw);
+        if (KEYWORDS.has(raw))
+            return pc.magenta(raw);
+        return raw;
+    });
+}
+/** Inline formatting: `code`, **bold**. */
+function renderInline(text) {
+    return text
+        .replace(/`([^`\n]+)`/g, (_, s) => pc.cyan(s))
+        .replace(/\*\*([^*]+)\*\*/g, (_, s) => pc.bold(s))
+        .replace(/__([^_]+)__/g, (_, s) => pc.bold(s));
+}
+export function renderMarkdown(md) {
+    const lines = md.split("\n");
+    const out = [];
+    let inCode = false;
+    let code = [];
+    const flushCode = () => {
+        if (!code.length)
+            return;
+        for (const l of code)
+            out.push("  " + pc.dim("│") + " " + highlight(l));
+        out.push("");
+        code = [];
+    };
+    for (const raw of lines) {
+        if (raw.trim().startsWith("```")) {
+            if (inCode) {
+                flushCode();
+                inCode = false;
+            }
+            else {
+                inCode = true;
+            }
+            continue;
+        }
+        if (inCode) {
+            code.push(raw);
+            continue;
+        }
+        const heading = raw.match(/^(#{1,4})\s+(.*)$/);
+        if (heading) {
+            out.push(pc.bold(pc.underline(renderInline(heading[2]))));
+            out.push("");
+            continue;
+        }
+        const bullet = raw.match(/^\s*[-*+]\s+(.*)$/);
+        if (bullet) {
+            out.push("  " + pc.cyan("•") + " " + renderInline(bullet[1]));
+            continue;
+        }
+        const numbered = raw.match(/^\s*(\d+)[.)]\s+(.*)$/);
+        if (numbered) {
+            out.push("  " + pc.cyan(numbered[1] + ".") + " " + renderInline(numbered[2]));
+            continue;
+        }
+        out.push(renderInline(raw));
+    }
+    flushCode();
+    while (out.length && out[0] === "")
+        out.shift();
+    while (out.length && out[out.length - 1] === "")
+        out.pop();
+    return out.join("\n");
+}

package/dist/core/report.js

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import { BASE_CSS, SEVERITY_COLOR, seismograph } from "./ui.js";
 import { sanitizeSecrets } from "./heal/redact.js";
+import { diagnoseFinding } from "./diagnose.js";
 function escapeHtml(s) {
     return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -16,7 +17,7 @@ const SEV_ORDER = ["crash", "error", "warning", "noise"];
  * CDN), rendered in the shared "crash seismograph" identity: one red spike per
  * crash, severity chips, and colored repro verdicts.
  */
-export function renderReport(targetUrl, findings) {
+export function renderReport(targetUrl, findings, lang) {
     const sorted = [...findings].sort((a, b) => SEV_ORDER.indexOf(a.severity) - SEV_ORDER.indexOf(b.severity));
     const counts = { crash: 0, error: 0, warning: 0 };
     for (const f of sorted)
@@ -28,6 +29,7 @@ export function renderReport(targetUrl, findings) {
             ? `${clean(f.mappedLocation.filePath)}:${f.mappedLocation.line}:${f.mappedLocation.column}`
             : "";
         const snippet = f.mappedLocation ? clean(f.mappedLocation.codeContext) : "";
+        const dx = diagnoseFinding(f, lang);
         const serverErr = f.serverError
             ? `<div class="server">server: ${clean(f.serverError.message)}</div>` +
                 (f.serverError.body
@@ -53,6 +55,7 @@ export function renderReport(targetUrl, findings) {
         <h2>${clean(f.rawMessage.split("\n")[0])}</h2>
       </header>
       ${loc ? `<div class="loc">${loc}</div>` : ""}
+      ${dx ? `<div class="dx">↳ ${clean(dx)}</div>` : ""}
       ${snippet ? `<pre class="snippet">${snippet}</pre>` : ""}
       ${serverErr}
       ${f.occurrences > 1 ? `<div class="occ">seen ×${f.occurrences}</div>` : ""}
@@ -88,10 +91,10 @@ export function renderReport(targetUrl, findings) {
 </body>
 </html>`;
 }
-export function writeReport(repoRoot, targetUrl, findings) {
+export function writeReport(repoRoot, targetUrl, findings, lang) {
     const dir = path.join(repoRoot, ".aztrx");
     fs.mkdirSync(dir, { recursive: true });
     const file = path.join(dir, "report.html");
-    fs.writeFileSync(file, renderReport(targetUrl, findings), "utf-8");
+    fs.writeFileSync(file, renderReport(targetUrl, findings, lang), "utf-8");
     return file;
 }

package/dist/core/resolver.js

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
-import { TraceMap, originalPositionFor, } from "@jridgewell/trace-mapping";
+import { FlattenMap, originalPositionFor, } from "@jridgewell/trace-mapping";
 /** Framework-internal frames to skip when hunting the throw site. */
 const FRAMEWORK_FRAME = /node_modules|webpack-runtime|\.next[\\/]|next[\\/]dist[\\/]/;
 /**
@@ -80,6 +80,15 @@ function isFile(p) {
         return false;
     }
 }
+/** True only for a real directory. */
+function isDirectory(p) {
+    try {
+        return fs.existsSync(p) && fs.statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
 /** Secret-bearing filenames that must never be read, even inside the repo — a
  * hostile sourcemap could otherwise point `source` at `.env`, an npmrc, or a
  * private key and exfiltrate it into the report / PR comment. */
@@ -135,6 +144,8 @@ function sourceCandidates(source, repoRoot) {
         .replace(/^webpack:\/\/[^/]+\//, "") // webpack://namespace/src/...
         .replace(/^webpack:\/\//, "")
         .replace(/^\/@fs\//, "")
+        .replace(/^file:\/\/\/([A-Za-z]:)/, "$1") // file:///C:/x → C:/x
+        .replace(/^file:\/\//, "")
         .replace(/^\//, "")
         .split("?")[0];
     const prefixes = ["", "apps/web/", "src/", "app/"];
@@ -150,13 +161,25 @@ function locateFile(candidates) {
     return null;
 }
 export async function resolveFrame(frame, repoRoot) {
+    const viaServerAction = await tryServerActionSourceMap(frame, repoRoot);
+    if (viaServerAction)
+        return viaServerAction;
     const viaMap = await trySourceMap(frame, repoRoot);
     if (viaMap)
         return viaMap;
     // Fallback: dev servers (Vite, Next) serve real source files at their URL
     // path, so the bundle URL is already the source path — no sourcemap needed.
     const relative = normalizeFrameUrl(frame.url);
-    const directPath = resolveWithin(repoRoot, relative);
+    let directPath = resolveWithin(repoRoot, relative);
+    // A frame URL pointing at a directory — e.g. an inline `<script>` whose V8
+    // frame carries the page URL (`http://localhost:3000/`, normalized to "") —
+    // resolves to the repo root. Map it to `index.html`, mirroring the static
+    // serve fallback, so the crash gets a real filename + snippet + own-code flag.
+    if (directPath && isDirectory(directPath)) {
+        const withIndex = resolveWithin(repoRoot, relative, "index.html");
+        if (withIndex)
+            directPath = withIndex;
+    }
     if (!directPath) {
         return {
             message: frame.message,
@@ -227,6 +250,35 @@ function isLoopback(host) {
     const h = host.replace(/^\[|\]$/g, "").toLowerCase();
     return h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "0.0.0.0";
 }
+/** Shared tail of sourcemap resolution: run `originalPositionFor` through a
+ * (possibly sectioned) map, resolve the `source` it names to a repo file, and
+ * build the `MappedError`. Returns null when the position maps to no known
+ * source. */
+function resolveFromMap(rawMap, line, column, message, repoRoot) {
+    const map = new FlattenMap(rawMap);
+    const pos = originalPositionFor(map, { line, column });
+    if (!pos.source || pos.line == null)
+        return null;
+    const absolute = locateFile(sourceCandidates(pos.source, repoRoot));
+    if (!absolute) {
+        return {
+            message,
+            sourceFile: pos.source,
+            line: pos.line,
+            column: pos.column ?? 0,
+            codeSnippet: `<file not accessible locally: ${pos.source}>`,
+            resolvedFrom: "unresolved",
+        };
+    }
+    return {
+        message,
+        sourceFile: path.relative(repoRoot, absolute),
+        line: pos.line,
+        column: pos.column ?? 0,
+        codeSnippet: extractSnippet(absolute, pos.line),
+        resolvedFrom: "sourcemap",
+    };
+}
 async function trySourceMap(frame, repoRoot) {
     const mapUrl = stripQuery(frame.url) + ".map";
     // SSRF guard: the sourcemap URL is derived from an untrusted stack frame, so
@@ -252,29 +304,38 @@ async function trySourceMap(frame, repoRoot) {
         return null;
     }
     try {
-        const map = new TraceMap(rawMap);
-        const pos = originalPositionFor(map, { line: frame.line, column: frame.column });
-        if (!pos.source || pos.line == null)
-            return null;
-        const absolute = locateFile(sourceCandidates(pos.source, repoRoot));
-        if (!absolute) {
-            return {
-                message: frame.message,
-                sourceFile: pos.source,
-                line: pos.line,
-                column: pos.column ?? 0,
-                codeSnippet: `<file not accessible locally: ${pos.source}>`,
-                resolvedFrom: "unresolved",
-            };
-        }
-        return {
-            message: frame.message,
-            sourceFile: path.relative(repoRoot, absolute),
-            line: pos.line,
-            column: pos.column ?? 0,
-            codeSnippet: extractSnippet(absolute, pos.line),
-            resolvedFrom: "sourcemap",
-        };
+        return resolveFromMap(rawMap, frame.line, frame.column, frame.message, repoRoot);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Map a Next.js Server Action throw site to its original source. The browser
+ * sees the throw as `about://React/Server/<url-encoded chunk path>?<n>:<line>:<col>`,
+ * where the encoded path is the compiled Turbopack chunk on disk. That chunk's
+ * `.map` is a *sectioned* (indexed) sourcemap whose sections point at the real
+ * source (e.g. `app/actions.ts`); `FlattenMap` walks the sections for us.
+ */
+async function tryServerActionSourceMap(frame, repoRoot) {
+    const marker = "about://React/Server/";
+    if (!frame.url.startsWith(marker))
+        return null;
+    let chunkPath;
+    try {
+        chunkPath = stripQuery(decodeURIComponent(frame.url.slice(marker.length)));
+    }
+    catch {
+        return null;
+    }
+    if (!isFile(chunkPath))
+        return null;
+    const mapPath = chunkPath + ".map";
+    if (!isFile(mapPath) || isSensitive(mapPath))
+        return null;
+    try {
+        const rawMap = JSON.parse(fs.readFileSync(mapPath, "utf-8"));
+        return resolveFromMap(rawMap, frame.line, frame.column, frame.message, repoRoot);
     }
     catch {
         return null;

package/dist/core/summarize.js

@@ -118,11 +118,11 @@ function buildLlmPrompt(findings, lang, hasHealed) {
         `A QA tool scanned a web app and found the following findings:`,
         rows,
         "",
-        `Write a short, friendly, plain-language summary for a developer (${lang}): what was found, what each problem means in simple words, and — per the note below — whether fixes are ready. Do not invent details that are not listed. Keep it to a few short paragraphs or a tight bullet list.`,
+        `Write a short, friendly summary for a developer (${lang}) in Markdown — use headings, bold, bullet lists, and short \`\`\`code\`\`\` snippets where helpful. Explain what was found, what each problem means in simple words, and — per the note below — whether fixes are ready. Do not invent details that are not listed. Keep it concise.`,
         fixLine,
     ].join("\n");
 }
-const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise, human-language summary for a developer. Never invent details absent from the data. Respond in the requested language only.";
+const SYSTEM = "You are the plain-spoken explainer for a QA tool called Aztrx AI. You turn raw runtime-finding data into a concise Markdown summary for a developer (headings, bold, bullet lists, short code snippets). Never invent details absent from the data. Respond in the requested language only.";
 async function summarizeFindingsLlm(findings, lang) {
     const hasHealed = findings.some((f) => f.heal?.status === "healed");
     const text = (await complete({

package/dist/core/swarm.js

@@ -15,7 +15,7 @@ import { launchChromium } from "./browser.js";
 import { EventBus } from "./eventBus.js";
 import { attachInterceptor } from "./interceptor.js";
 import { establishLogin } from "./auth.js";
-import { SignalClassifier } from "./classifier.js";
+import { SignalClassifier, collapseSignals } from "./classifier.js";
 import { ActionRecorder } from "./recorder.js";
 import { walkDom } from "./domWalker.js";
 import { fuzz } from "./fuzzer.js";
@@ -75,6 +75,20 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
     const context = await browser.newContext(opts.storageState ? { storageState: opts.storageState } : {});
     const page = await context.newPage();
     attachInterceptor(page, workerBus);
+    // Collect every same-origin URL the page issues — including `fetch()` fired
+    // from click handlers — so the folded HTTP fuzzer can probe endpoints a fresh
+    // page never sees (performance resources only capture on-load fetches).
+    const observedUrls = new Set();
+    const targetOrigin = new URL(opts.url).origin;
+    page.on("request", (req) => {
+        try {
+            if (new URL(req.url()).origin === targetOrigin)
+                observedUrls.add(req.url());
+        }
+        catch {
+            // malformed URL — skip
+        }
+    });
     if (opts.guardOn) {
         await attachNetworkGuard(page, {
             allowHosts: opts.allowHosts,
@@ -94,10 +108,9 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
         // Settle for hydration and mount-time effects before acting.
         await page.waitForTimeout(2000);
     }
-    // Auto-login (best-effort). The server-side HTTP fuzzer uses Node-side fetch,
-    // so it doesn't benefit from a browser session — skip it there.
+    // Auto-login (best-effort).
     let replayStorageState;
-    if (loaded && strategy.kind !== "http-fuzz" && opts.login && opts.loginEmail && opts.loginPassword) {
+    if (loaded && opts.login && opts.loginEmail && opts.loginPassword) {
         const res = await establishLogin(page, {
             email: opts.loginEmail,
             password: opts.loginPassword,
@@ -134,21 +147,27 @@ export async function detectWorker(browser, opts, strategy, forwardBus) {
     let sawLoginForm = false;
     if (loaded) {
         if (strategy.kind === "walk") {
-            const wr = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun });
+            const wr = await walkDom(page, workerBus, { maxActions: opts.maxActions, dryRun: opts.dryRun, allowDestructive: opts.allowDestructive });
             actions = wr.actions;
             sawLoginForm = wr.sawLoginForm;
         }
-        else if (strategy.kind === "fuzz") {
-            const fr = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun });
+        else {
+            const fr = await fuzz(page, workerBus, { seed: strategy.seed, maxActions: opts.maxActions, dryRun: opts.dryRun, allowDestructive: opts.allowDestructive });
             actions = fr.actions;
             newCoverage = fr.newCoverage;
         }
-        else {
-            actions = await httpFuzz(page, opts.url, workerBus, {
+        // Folded HTTP fuzzer: post-pass on this same page, seeded with every URL the
+        // walk/fuzz actually issued — including JS-fetch-only endpoints a standalone
+        // worker (snapshot before clicks) would never discover.
+        if (opts.httpFuzz) {
+            actions += await httpFuzz(page, opts.url, workerBus, {
                 maxRequests: opts.maxActions,
                 dryRun: opts.dryRun,
                 allowHosts: opts.allowHosts,
                 mutations: opts.httpFuzzMutations,
+                allowDestructive: opts.allowDestructive,
+                seedUrls: [...observedUrls],
+                navigate: false,
             });
         }
     }
@@ -175,12 +194,11 @@ export function mergeFindings(arrays) {
     }
     return [...byFingerprint.values()];
 }
-/** Build the worker roster for a run. `workers = 1` with no http-fuzz is the
- * legacy single pass; `--http-fuzz` and/or `workers > 1` fan out. */
+/** Build the worker roster for a run. `workers = 1` is the legacy single pass;
+ * `workers > 1` fans out. `--http-fuzz` is not a worker here — it folds into
+ * whichever pass runs (see `detectWorker`). */
 function buildStrategies(opts) {
     const strategies = [];
-    if (opts.httpFuzz)
-        strategies.push({ kind: "http-fuzz" });
     const w = Math.max(1, opts.workers);
     if (w === 1) {
         strategies.push(opts.fuzz ? { kind: "fuzz", seed: opts.seed } : { kind: "walk" });
@@ -202,8 +220,6 @@ function strategyLabel(s) {
     switch (s.kind) {
         case "walk":
             return "walk";
-        case "http-fuzz":
-            return "http-fuzz";
         case "fuzz":
             return `fuzz seed ${s.seed}`;
     }
@@ -228,6 +244,8 @@ export async function swarmDetect(opts) {
             crashTest: i === 0 ? opts.crashTest : false,
             saveAuthState: i === 0,
             httpFuzzMutations: opts.httpFuzzMutations,
+            httpFuzz: opts.httpFuzz,
+            allowDestructive: opts.allowDestructive,
             baseline: opts.baseline,
             log: (m) => opts.log(strategies.length > 1 ? `[w${i}] ${m}` : m),
         }, strategy, opts.forwardBus)));
@@ -242,7 +260,9 @@ export async function swarmDetect(opts) {
         for (const r of results)
             if (r.replayStorageState)
                 replayStorageState = r.replayStorageState;
-        const findings = mergeFindings(results.map((r) => r.findings));
+        // Merge identical fingerprints across workers, then collapse distinct
+        // capture paths of the same fault (5xx + console + timeout + throw) into one.
+        const findings = collapseSignals(mergeFindings(results.map((r) => r.findings)));
         const totalActions = results.reduce((sum, r) => sum + r.actions, 0);
         const totalCoverage = results.reduce((sum, r) => sum + r.newCoverage, 0);
         return {

package/dist/core/ui.js

@@ -52,6 +52,7 @@ h1 .brand-sub{color:var(--dim)}
 .sev{font:600 11px/1 ui-monospace,monospace;text-transform:uppercase;letter-spacing:.08em;color:var(--sev);border:1px solid var(--sev);border-radius:999px;padding:3px 9px;flex:none}
 h2{font-size:15px;margin:0;font-weight:600;word-break:break-word}
 .loc{color:var(--dim);font-size:12.5px;margin-top:8px}
+.dx{color:var(--azure);font-size:12.5px;margin-top:6px}
 .snippet{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:12px 0 0;white-space:pre}
 .server{color:var(--amber);font-size:12.5px;margin-top:8px}
 .server-body{background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:12px 14px;overflow-x:auto;font:12px/1.6 ui-monospace,monospace;color:var(--muted);margin:8px 0 0;white-space:pre;max-height:240px;overflow-y:auto}