itworksbut 0.7.0 → 0.7.2

package/README.md

@@ -270,6 +270,6 @@ Each check is a plain ESM module with an `id`, metadata, and async `run(context)
 
 ## What It Does Not Guarantee
 
-ItWorksBut is a static heuristic scanner, not a pentest, SAST replacement, dependency vulnerability database, or runtime security monitor. Findings intentionally use wording such as "possible", "potential", and "appears to" when a check is heuristic.
+ItWorksBut is a static heuristic scanner. Findings intentionally use wording such as "possible", "potential", and "appears to" when a check is heuristic.
 
 Use it as a CI guardrail for common project hygiene and security mistakes. For production systems, combine it with code review, tests, dependency scanning, secrets scanning, threat modeling, and focused security assessment.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "itworksbut",
-    "version": "0.7.0",
+    "version": "0.7.2",
     "description": "Static CI checks for common security, repo, dependency, build, and deployment risks in JavaScript vibe coding projects.",
     "type": "module",
     "bin": {
@@ -13,7 +13,7 @@
         "itworksbut.config.json"
     ],
     "engines": {
-        "node": ">=20"
+        "node": ">=26"
     },
     "scripts": {
         "test": "node --test",
@@ -36,7 +36,10 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "artillery": "^2.0.30",
+        "@smithy/config-resolver": "4.5.3",
+        "@smithy/node-config-provider": "4.4.3",
+        "@smithy/property-provider": "4.2.3",
+        "artillery": "2.0.30",
         "boxen": "^8.0.1",
         "chalk": "^5.6.2",
         "cli-table3": "^0.6.5",

package/src/cli/terminal.js

@@ -1,95 +1,109 @@
-import boxen from "boxen";
-import chalk, { Chalk } from "chalk";
-import figlet from "figlet";
-import gradient from "gradient-string";
-import ora from "ora";
+import boxen from 'boxen';
+import chalk, { Chalk } from 'chalk';
+import figlet from 'figlet';
+import gradient from 'gradient-string';
+import ora from 'ora';
 
 const SPINNER_TEXT = {
-  git: "Checking git hygiene",
-  env: "Sniffing for secrets",
-  dependencies: "Interrogating package.json",
-  ci: "Inspecting CI rituals",
-  node: "Poking the Node.js backend",
-  web: "Looking for frontend footguns",
-  api: "Testing the API trust issues",
-  database: "Watching SQL strings misbehave",
-  electron: "Opening the Electron danger drawer",
-  tauri: "Reading Tauri permissions",
-  default: "Looking for things that work but should not ship"
+    git: 'Checking git hygiene',
+    env: 'Sniffing for secrets',
+    dependencies: 'Interrogating package.json',
+    ci: 'Inspecting CI rituals',
+    node: 'Poking the Node.js backend',
+    web: 'Looking for frontend footguns',
+    api: 'Testing the API trust issues',
+    database: 'Watching SQL strings misbehave',
+    electron: 'Opening the Electron danger drawer',
+    tauri: 'Reading Tauri permissions',
+    stress: 'Running controlled API stress test',
+    default: 'Looking for things that work but should not ship',
 };
 
 export function isFancyOutputEnabled(options = {}, env = process.env, stdout = process.stdout) {
-  return Boolean(stdout.isTTY) && !env.CI && !options.json && !options.sarif && !options.todo && !options.noColor;
+    return Boolean(stdout.isTTY) && !env.CI && !options.json && !options.sarif && !options.todo && !options.noColor;
 }
 
 export function isColorEnabled(options = {}, env = process.env, stdout = process.stdout) {
-  if (options.noColor || options.json || options.sarif || options.todo) return false;
-  if (env.FORCE_COLOR && env.FORCE_COLOR !== "0") return true;
-  if (env.CI) return false;
-  return Boolean(stdout.isTTY);
+    if (options.noColor || options.json || options.sarif || options.todo) return false;
+    if (env.FORCE_COLOR && env.FORCE_COLOR !== '0') return true;
+    if (env.CI) return false;
+    return Boolean(stdout.isTTY);
 }
 
 export function getChalk(options = {}) {
-  if (!isColorEnabled(options)) return new Chalk({ level: 0 });
-  return chalk;
+    if (!isColorEnabled(options)) return new Chalk({ level: 0 });
+    return chalk;
 }
 
 export function shouldUseSpinner(options = {}, env = process.env, stdout = process.stdout) {
-  return (
-    Boolean(stdout.isTTY) &&
-    !env.CI &&
-    !options.json &&
-    !options.sarif &&
-    !options.todo &&
-    !options.quiet
-  );
+    return Boolean(stdout.isTTY) && !env.CI && !options.json && !options.sarif && !options.todo && !options.quiet;
 }
 
 export function createScanSpinner(options = {}) {
-  if (!shouldUseSpinner(options)) return null;
-  return ora({
-    text: SPINNER_TEXT.default,
-    stream: process.stderr,
-    color: "cyan"
-  });
+    if (!shouldUseSpinner(options)) return null;
+    return ora({
+        text: SPINNER_TEXT.default,
+        stream: process.stderr,
+        color: 'cyan',
+    });
+}
+
+export function createStressSpinner(options = {}) {
+    if (!shouldUseSpinner(options)) return null;
+    return ora({
+        text: SPINNER_TEXT.stress,
+        stream: process.stderr,
+        color: 'cyan',
+    });
 }
 
 export function printIntro(options = {}) {
-  if (options.json || options.sarif || options.todo || options.noBanner || options.quiet || process.env.CI || !process.stdout.isTTY) {
-    return;
-  }
+    if (
+        options.json ||
+        options.sarif ||
+        options.todo ||
+        options.noBanner ||
+        options.quiet ||
+        process.env.CI ||
+        !process.stdout.isTTY
+    ) {
+        return;
+    }
 
-  const colors = getChalk(options);
-  const title = renderTitle(options.noColor);
-  const claim = `${colors.bold("AI-built? Nice.")}\n${colors.yellow("Now let's see what breaks before production.")}`;
+    const colors = getChalk(options);
+    const stress = options.command === 'stress';
+    const title = renderTitle('ItWorksBut', options.noColor);
+    const claim = stress
+        ? `${colors.bold('Controlled API stress test.')}\n${colors.yellow('Only run this against systems you own or are authorized to test.')}`
+        : `${colors.bold('AI-built? Nice.')}\n${colors.yellow("Now let's see what breaks before production.")}`;
 
-  process.stdout.write(`${title}\n`);
-  process.stdout.write(
-    `${boxen(claim, {
-      padding: 1,
-      margin: 1,
-      borderStyle: "round",
-      borderColor: options.noColor ? undefined : "cyan"
-    })}\n`
-  );
+    process.stdout.write(`${title}\n`);
+    process.stdout.write(
+        `${boxen(claim, {
+            padding: 1,
+            margin: 1,
+            borderStyle: 'round',
+            borderColor: options.noColor ? undefined : 'cyan',
+        })}\n`,
+    );
 }
 
-function renderTitle(noColor) {
-  let title = "ItWorksBut";
-  try {
-    title = figlet.textSync("ItWorksBut", {
-      font: "ANSI Shadow",
-      horizontalLayout: "default",
-      verticalLayout: "default"
-    });
-  } catch {
-    title = "ItWorksBut";
-  }
+function renderTitle(value, noColor) {
+    let title = value;
+    try {
+        title = figlet.textSync(value, {
+            font: 'ANSI Shadow',
+            horizontalLayout: 'default',
+            verticalLayout: 'default',
+        });
+    } catch {
+        title = 'ItWorksBut';
+    }
 
-  try {
-    if (noColor) return title;
-    return gradient.rainbow(title);
-  } catch {
-    return title;
-  }
+    try {
+        if (noColor) return title;
+        return gradient.rainbow(title);
+    } catch {
+        return title;
+    }
 }

package/src/commands/stress.js

@@ -6,16 +6,31 @@ import { runArtillery } from "../stress/artilleryRunner.js";
 import { parseArtilleryResult } from "../stress/stressResultParser.js";
 import { reportStressConsole } from "../stress/stressRenderer.js";
 import { writeStressMarkdownReport } from "../reporters/stressMarkdownReport.js";
+import { createStressSpinner, printIntro } from "../cli/terminal.js";
 
 export async function runStressCommand(args, options = {}) {
   if (args.todo || args.sarif) {
     throw new Error("The stress command supports console output, --json, and --report.");
   }
 
-  const result = await runStress({
+  const stressOptions = {
     rootPath: path.resolve(args.path || "."),
     ...validateStressOptions(args)
-  }, options);
+  };
+
+  printIntro(args);
+
+  const spinner = createStressSpinner(args);
+  if (spinner) spinner.start();
+
+  let result;
+  try {
+    result = await runStress(stressOptions, options);
+    if (spinner) spinner.succeed("Stress test complete. Now the pressure readings.");
+  } catch (error) {
+    if (spinner) spinner.fail("Stress test stopped before results were printed.");
+    throw error;
+  }
 
   if (args.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
@@ -36,9 +51,10 @@ export async function runStressCommand(args, options = {}) {
 
 export async function runStress(options, runnerOptions = {}) {
   const startedAt = new Date();
-  const discovery = await discoverEndpoints(options.rootPath);
+  const discovery = withExplicitTargetEndpoint(await discoverEndpoints(options.rootPath), options.targetPath);
   const baseDetails = {
     target: options.target,
+    artilleryTarget: options.artilleryTarget || options.target,
     duration: options.duration,
     arrivalRate: options.arrivalRate,
     maxVusers: options.maxVusers,
@@ -77,7 +93,7 @@ export async function runStress(options, runnerOptions = {}) {
   }
 
   const config = createArtilleryConfig({
-    target: options.target,
+    target: options.artilleryTarget || options.target,
     duration: options.duration,
     arrivalRate: options.arrivalRate,
     maxVusers: options.maxVusers,
@@ -112,3 +128,30 @@ function stressResult(result) {
     ...result
   };
 }
+
+function withExplicitTargetEndpoint(discovery, targetPath) {
+  if (!targetPath) return discovery;
+  if (discovery.endpoints.some((endpoint) => endpoint.method === "GET" && endpoint.path === targetPath)) {
+    return discovery;
+  }
+
+  const explicitEndpoint = {
+    method: "GET",
+    path: targetPath,
+    source: "--target",
+    type: "explicit-target",
+    dynamic: false,
+    status: "selected"
+  };
+
+  return {
+    status: "pass",
+    endpoints: sortEndpoints([...discovery.endpoints, explicitEndpoint]),
+    safeEndpoints: sortEndpoints([...discovery.safeEndpoints, explicitEndpoint]),
+    skippedEndpoints: discovery.skippedEndpoints
+  };
+}
+
+function sortEndpoints(endpoints) {
+  return [...endpoints].sort((a, b) => `${a.method} ${a.path}`.localeCompare(`${b.method} ${b.path}`));
+}

package/src/stress/discoverEndpoints.js

@@ -2,10 +2,11 @@ import path from "node:path";
 import { DEFAULT_IGNORE } from "../core/config.js";
 import { walkProject } from "../core/fileWalker.js";
 import { readFileSafe } from "../utils/fs.js";
+import { isServerOrApiFile } from "../checks/helpers.js";
 
-const HTTP_METHODS = ["get", "head", "post", "put", "patch", "delete"];
+const HTTP_METHODS = ["get", "head", "post", "put", "patch", "delete", "options"];
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-const ROUTE_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
+const ROUTE_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"]);
 const DISCOVERY_IGNORE = [
   ...DEFAULT_IGNORE,
   "test/**",
@@ -28,15 +29,23 @@ export async function discoverEndpoints(rootPath) {
 
 export async function discoverEndpointsFromFiles({ rootPath, files, readFile }) {
   const endpoints = [];
+  const fileContents = [];
 
   for (const file of files.filter(isSourceFile)) {
     const content = await readFile(file);
     if (content === null || content === undefined) continue;
+    fileContents.push({ file, content });
+  }
+
+  const mountPrefixes = collectMountPrefixes(fileContents);
 
+  for (const { file, content } of fileContents) {
     endpoints.push(...discoverExpressEndpoints(file, content));
+    endpoints.push(...discoverMountedRouterEndpoints(file, content, mountPrefixes));
+    endpoints.push(...discoverFastifyRouteObjects(file, content));
     endpoints.push(...discoverFetchReferences(file, content));
-    endpoints.push(...discoverNextAppRouterEndpoints(file, content));
-    endpoints.push(...discoverNextPagesRouterEndpoints(file, content));
+    endpoints.push(...discoverFileConventionEndpoints(file, content));
+    endpoints.push(...discoverApiCandidateFileEndpoints(file, content));
   }
 
   return classifyEndpoints(dedupeEndpoints(endpoints), rootPath);
@@ -50,7 +59,10 @@ export function classifyEndpoints(endpoints) {
     let status = "selected";
     let reason;
 
-    if (unsafe) {
+    if (method === "OPTIONS") {
+      status = "skipped";
+      reason = "unsupported method";
+    } else if (unsafe) {
       status = "skipped";
       reason = "unsafe method";
     } else if (dynamic) {
@@ -80,7 +92,7 @@ export function classifyEndpoints(endpoints) {
 function discoverExpressEndpoints(file, content) {
   const endpoints = [];
   const methods = HTTP_METHODS.join("|");
-  const regex = new RegExp(`\\b(?:app|router|server)\\s*\\.\\s*(${methods})\\s*\\(\\s*(['"\`])([^'"\`]+)\\2`, "gi");
+  const regex = new RegExp(`\\b[A-Za-z_$][\\w$]*\\s*\\.\\s*(${methods})\\s*\\(\\s*(['"\`])([^'"\`]+)\\2`, "gi");
   let match;
 
   while ((match = regex.exec(content)) !== null) {
@@ -92,6 +104,43 @@ function discoverExpressEndpoints(file, content) {
   return endpoints;
 }
 
+function discoverMountedRouterEndpoints(file, content, mountPrefixes) {
+  if (mountPrefixes.length === 0) return [];
+
+  const endpoints = [];
+  const methods = HTTP_METHODS.join("|");
+  const regex = new RegExp(`\\b(?:router|Router|apiRouter|routes|route)\\s*\\.\\s*(${methods})\\s*\\(\\s*(['"\`])([^'"\`]+)\\2`, "gi");
+  let match;
+
+  while ((match = regex.exec(content)) !== null) {
+    const routePath = normalizeRoutePath(match[3]);
+    if (!routePath || routePath.startsWith("/api")) continue;
+    for (const prefix of mountPrefixes) {
+      endpoints.push(endpoint(match[1], joinRoutePath(prefix, routePath), file, "mounted-router"));
+    }
+  }
+
+  return endpoints;
+}
+
+function discoverFastifyRouteObjects(file, content) {
+  const endpoints = [];
+  const regex = /\bfastify\s*\.\s*route\s*\(\s*\{([\s\S]*?)\}\s*\)/gi;
+  let match;
+
+  while ((match = regex.exec(content)) !== null) {
+    const objectText = match[1];
+    const methodMatch = objectText.match(/\bmethod\s*:\s*(['"`])(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\1/i);
+    const urlMatch = objectText.match(/\b(?:url|path)\s*:\s*(['"`])([^'"`]+)\1/i);
+    if (!methodMatch || !urlMatch) continue;
+    const routePath = normalizeRoutePath(urlMatch[2]);
+    if (!routePath) continue;
+    endpoints.push(endpoint(methodMatch[2], routePath, file, "fastify-route-object"));
+  }
+
+  return endpoints;
+}
+
 function discoverFetchReferences(file, content) {
   const endpoints = [];
   const regex = /\bfetch\s*\(\s*(['"`])(\/api\/[^'"`]+)\1/gi;
@@ -106,12 +155,22 @@ function discoverFetchReferences(file, content) {
   return endpoints;
 }
 
+function discoverFileConventionEndpoints(file, content) {
+  return [
+    ...discoverNextAppRouterEndpoints(file, content),
+    ...discoverNextPagesRouterEndpoints(file, content),
+    ...discoverSvelteKitEndpoints(file, content),
+    ...discoverNitroEndpoints(file, content),
+    ...discoverAstroApiEndpoints(file, content)
+  ];
+}
+
 function discoverNextAppRouterEndpoints(file, content) {
   const normalized = normalizeFilePath(file);
-  const match = normalized.match(/(?:^|\/)(?:src\/)?app\/api\/(.+)\/route\.(?:js|jsx|ts|tsx|mjs|cjs)$/);
+  const match = normalized.match(/(?:^|\/)(?:src\/)?app\/(.+)\/route\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$/);
   if (!match) return [];
 
-  const routePath = normalizeRoutePath(`/api/${routeSegmentsToPath(match[1])}`);
+  const routePath = normalizeRoutePath(`/${routeSegmentsToPath(match[1])}`);
   const exportedMethods = discoverExportedRouteMethods(content);
   const methods = exportedMethods.length > 0 ? exportedMethods : ["GET"];
 
@@ -120,7 +179,7 @@ function discoverNextAppRouterEndpoints(file, content) {
 
 function discoverNextPagesRouterEndpoints(file, content) {
   const normalized = normalizeFilePath(file);
-  const match = normalized.match(/(?:^|\/)(?:src\/)?pages\/api\/(.+)\.(?:js|jsx|ts|tsx|mjs|cjs)$/);
+  const match = normalized.match(/(?:^|\/)(?:src\/)?pages\/api\/(.+)\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$/);
   if (!match) return [];
 
   const routePath = normalizeRoutePath(`/api/${routeSegmentsToPath(match[1])}`);
@@ -130,9 +189,58 @@ function discoverNextPagesRouterEndpoints(file, content) {
   return methods.map((method) => endpoint(method, routePath, file, "next-pages-router"));
 }
 
+function discoverSvelteKitEndpoints(file, content) {
+  const normalized = normalizeFilePath(file);
+  const match = normalized.match(/(?:^|\/)(?:src\/)?routes\/(.+)\/\+server\.(?:js|ts|mjs|cjs|mts|cts)$/);
+  if (!match) return [];
+
+  const routePath = normalizeRoutePath(`/${routeSegmentsToPath(match[1])}`);
+  const exportedMethods = discoverExportedRouteMethods(content);
+  const methods = exportedMethods.length > 0 ? exportedMethods : ["GET"];
+
+  return methods.map((method) => endpoint(method, routePath, file, "sveltekit-server-route"));
+}
+
+function discoverNitroEndpoints(file, content) {
+  const normalized = normalizeFilePath(file);
+  const match = normalized.match(/(?:^|\/)(?:src\/)?server\/api\/(.+?)(?:\.(get|head|post|put|patch|delete|options))?\.(?:js|ts|mjs|cjs|mts|cts)$/i);
+  if (!match) return [];
+
+  const routePath = normalizeRoutePath(`/api/${routeSegmentsToPath(match[1])}`);
+  const methods = match[2] ? [match[2].toUpperCase()] : discoverMethodGuards(content);
+
+  return (methods.length > 0 ? methods : ["GET"]).map((method) => endpoint(method, routePath, file, "nitro-server-api"));
+}
+
+function discoverAstroApiEndpoints(file, content) {
+  const normalized = normalizeFilePath(file);
+  const match = normalized.match(/(?:^|\/)(?:src\/)?pages\/api\/(.+)\.(?:js|ts|mjs|cjs|mts|cts)$/);
+  if (!match) return [];
+
+  const routePath = normalizeRoutePath(`/api/${routeSegmentsToPath(match[1])}`);
+  const exportedMethods = discoverExportedRouteMethods(content);
+  const methods = exportedMethods.length > 0 ? exportedMethods : ["GET"];
+
+  return methods.map((method) => endpoint(method, routePath, file, "astro-api-route"));
+}
+
+function discoverApiCandidateFileEndpoints(file, content) {
+  if (!isSastApiCandidate(file, content)) return [];
+  if (hasExplicitRouteDeclaration(content) || isFileConventionRoute(file)) return [];
+
+  const routePath = inferRoutePathFromFile(file);
+  if (!routePath) return [];
+
+  const methods = discoverExportedRouteMethods(content);
+  const guardedMethods = discoverMethodGuards(content);
+  const inferredMethods = methods.length > 0 ? methods : guardedMethods;
+
+  return (inferredMethods.length > 0 ? inferredMethods : ["GET"]).map((method) => endpoint(method, routePath, file, "sast-api-candidate"));
+}
+
 function discoverExportedRouteMethods(content) {
   const methods = new Set();
-  const regex = /\bexport\s+(?:async\s+)?function\s+(GET|HEAD|POST|PUT|PATCH|DELETE)\b/g;
+  const regex = /\bexport\s+(?:async\s+)?function\s+(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\b/g;
   let match;
 
   while ((match = regex.exec(content)) !== null) {
@@ -144,7 +252,7 @@ function discoverExportedRouteMethods(content) {
 
 function discoverMethodGuards(content) {
   const methods = new Set();
-  const regex = /\b(?:req|request)\.method\s*(?:===|!==|==|!=)\s*['"`](GET|HEAD|POST|PUT|PATCH|DELETE)['"`]/gi;
+  const regex = /\b(?:req|request)\.method\s*(?:===|!==|==|!=)\s*['"`](GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)['"`]/gi;
   let match;
 
   while ((match = regex.exec(content)) !== null) {
@@ -154,6 +262,25 @@ function discoverMethodGuards(content) {
   return [...methods];
 }
 
+function collectMountPrefixes(fileContents) {
+  const prefixes = new Set();
+  const useRegex = /\b[A-Za-z_$][\w$]*\s*\.\s*use\s*\(\s*(['"`])([^'"`]+)\1\s*,/gi;
+  const registerRegex = /\b[A-Za-z_$][\w$]*\s*\.\s*register\s*\([^)]*\{[^}]*\bprefix\s*:\s*(['"`])([^'"`]+)\1/gi;
+
+  for (const { content } of fileContents) {
+    for (const regex of [useRegex, registerRegex]) {
+      regex.lastIndex = 0;
+      let match;
+      while ((match = regex.exec(content)) !== null) {
+        const prefix = normalizeRoutePath(match[2]);
+        if (prefix && prefix !== "/") prefixes.add(prefix);
+      }
+    }
+  }
+
+  return [...prefixes].sort();
+}
+
 function endpoint(method, routePath, file, type) {
   return {
     method: method.toUpperCase(),
@@ -177,6 +304,55 @@ function isSourceFile(file) {
   return ROUTE_EXTENSIONS.has(path.extname(normalized));
 }
 
+function isSastApiCandidate(file, content) {
+  const normalized = normalizeFilePath(file);
+  return (
+    isServerOrApiFile(normalized) ||
+    normalized.startsWith("api/") ||
+    normalized.startsWith("routes/") ||
+    normalized.startsWith("handlers/") ||
+    normalized.startsWith("controllers/") ||
+    normalized.includes("/handlers/") ||
+    normalized.includes("/controllers/")
+  ) && /\b(?:req|request|res|response|ctx|context|NextRequest|NextResponse|Response|json)\b/.test(content);
+}
+
+function hasExplicitRouteDeclaration(content) {
+  const methods = HTTP_METHODS.join("|");
+  return new RegExp(`\\b[A-Za-z_$][\\w$]*\\s*\\.\\s*(?:${methods}|route)\\s*\\(`, "i").test(content);
+}
+
+function isFileConventionRoute(file) {
+  const normalized = normalizeFilePath(file);
+  return (
+    /(?:^|\/)(?:src\/)?app\/.+\/route\./.test(normalized) ||
+    /(?:^|\/)(?:src\/)?pages\/api\/.+\./.test(normalized) ||
+    /(?:^|\/)(?:src\/)?routes\/.+\/\+server\./.test(normalized) ||
+    /(?:^|\/)(?:src\/)?server\/api\/.+\./.test(normalized)
+  );
+}
+
+function inferRoutePathFromFile(file) {
+  const normalized = normalizeFilePath(file);
+  const withoutExtension = normalized.replace(/\.(?:js|jsx|ts|tsx|mjs|cjs|mts|cts)$/, "");
+  const patterns = [
+    { regex: /(?:^|\/)(?:src\/)?api\/(.+)$/, prefix: "/api/" },
+    { regex: /(?:^|\/)(?:src\/)?server\/api\/(.+)$/, prefix: "/api/" },
+    { regex: /(?:^|\/)(?:src\/)?routes\/(.+)$/, prefix: "/" },
+    { regex: /(?:^|\/)(?:src\/)?server\/routes\/(.+)$/, prefix: "/" },
+    { regex: /(?:^|\/)(?:src\/)?handlers\/(.+)$/, prefix: "/" },
+    { regex: /(?:^|\/)(?:src\/)?controllers\/(.+)$/, prefix: "/" }
+  ];
+
+  for (const { regex, prefix } of patterns) {
+    const match = withoutExtension.match(regex);
+    if (!match) continue;
+    return normalizeRoutePath(`${prefix}${routeSegmentsToPath(match[1])}`);
+  }
+
+  return null;
+}
+
 function normalizeFilePath(file) {
   return String(file).replace(/\\/g, "/");
 }
@@ -187,11 +363,17 @@ function normalizeRoutePath(value) {
   return pathValue.replace(/\/+/g, "/").replace(/\/$/, "") || "/";
 }
 
+function joinRoutePath(prefix, routePath) {
+  return normalizeRoutePath(`${prefix}/${routePath.replace(/^\//, "")}`);
+}
+
 function routeSegmentsToPath(value) {
   return value
     .split("/")
     .filter(Boolean)
-    .map((segment) => segment.replace(/^\[(\.\.\.)?(.+)]$/, ":$2"))
+    .filter((segment) => !segment.startsWith("(") && !segment.startsWith("@") && !segment.startsWith("_"))
+    .map((segment) => segment.replace(/^\[\[?\.\.\.(.+)]]?$/, ":$1").replace(/^\[(.+)]$/, ":$1"))
+    .filter((segment) => segment !== "index")
     .join("/");
 }
 

package/src/stress/stressRenderer.js

@@ -1,80 +1,94 @@
-import { getChalk } from "../cli/terminal.js";
+import { getChalk, isFancyOutputEnabled } from '../cli/terminal.js';
 
 export function reportStressConsole(result, options = {}) {
-  const colors = getChalk(options);
-  const details = result.details || {};
+    const colors = getChalk(options);
+    const details = result.details || {};
+    const rich = isFancyOutputEnabled(options);
 
-  if (!options.quiet) {
-    process.stdout.write(`${colors.bold("ItWorksBut Stress")}\n\n`);
-    process.stdout.write("Only run this against systems you own or are explicitly authorized to test.\n\n");
-    process.stdout.write(`Target: ${details.target}\n`);
-    process.stdout.write(`Duration: ${details.duration}s\n`);
-    process.stdout.write(`Arrival rate: ${details.arrivalRate} req/s\n`);
-    process.stdout.write(`Max virtual users: ${details.maxVusers}\n\n`);
+    if (!options.quiet) {
+        if (!rich) process.stdout.write(`${colors.bold('ItWorksBut Stress')}\n\n`);
+        process.stdout.write('Only run this against systems you own or are explicitly authorized to test.\n\n');
+        process.stdout.write(`Target: ${details.target}\n`);
+        process.stdout.write(`Duration: ${details.duration}s\n`);
+        process.stdout.write(`Arrival rate: ${details.arrivalRate} req/s\n`);
+        process.stdout.write(`Max virtual users: ${details.maxVusers}\n\n`);
 
-    writeDiscovery(details, colors);
-    writeEndpoints(details, colors);
-  }
+        writeDiscovery(details, colors);
+        writeEndpoints(details, colors);
+    }
 
-  writeSummary(result, colors);
+    writeSummary(result, colors);
 }
 
 function writeDiscovery(details, colors) {
-  const found = details.endpointsFound || 0;
-  const safe = details.safeEndpoints || 0;
-  const skipped = details.skippedEndpoints?.length || 0;
-  const unsafe = details.skippedEndpoints?.filter((endpoint) => endpoint.reason === "unsafe method").length || 0;
-  const dynamic = details.skippedEndpoints?.filter((endpoint) => endpoint.reason === "dynamic route requires parameter").length || 0;
+    const found = details.endpointsFound || 0;
+    const safe = details.safeEndpoints || 0;
+    const skipped = details.skippedEndpoints?.length || 0;
+    const unsafe = details.skippedEndpoints?.filter(endpoint => endpoint.reason === 'unsafe method').length || 0;
+    const dynamic =
+        details.skippedEndpoints?.filter(endpoint => endpoint.reason === 'dynamic route requires parameter').length ||
+        0;
 
-  process.stdout.write(`${colors.green("✓")} Endpoint discovery: ${found} ${found === 1 ? "endpoint" : "endpoints"} found\n`);
-  process.stdout.write(`${colors.green("✓")} Safe endpoints: ${safe} GET/HEAD ${safe === 1 ? "endpoint" : "endpoints"} selected\n`);
-  if (skipped > 0) {
-    process.stdout.write(`- Skipped: ${unsafe} unsafe methods, ${dynamic} dynamic routes\n`);
-  }
-  process.stdout.write("\n");
+    process.stdout.write(
+        `${colors.green('✓')} Endpoint discovery: ${found} ${found === 1 ? 'endpoint' : 'endpoints'} found\n`,
+    );
+    process.stdout.write(
+        `${colors.green('✓')} Safe endpoints: ${safe} GET/HEAD ${safe === 1 ? 'endpoint' : 'endpoints'} selected\n`,
+    );
+    if (skipped > 0) {
+        process.stdout.write(`- Skipped: ${unsafe} unsafe methods, ${dynamic} dynamic routes\n`);
+    }
+    process.stdout.write('\n');
 }
 
 function writeEndpoints(details, colors) {
-  const testedEndpoints = details.testedEndpoints || [];
-  if (testedEndpoints.length === 0) {
-    process.stdout.write("Running Artillery: skipped\n\n");
-    return;
-  }
+    const testedEndpoints = details.testedEndpoints || [];
+    if (testedEndpoints.length === 0) {
+        process.stdout.write('Running Artillery: skipped\n\n');
+        return;
+    }
 
-  process.stdout.write("Running Artillery: complete\n\n");
-  for (const endpoint of testedEndpoints) {
-    const symbol = endpoint.status === "pass" ? colors.green("✓") : endpoint.status === "warn" ? colors.yellow("⚠") : colors.red("✕");
-    process.stdout.write(`${symbol} ${endpoint.method} ${endpoint.path}\n`);
-    process.stdout.write(`  p95: ${formatMs(endpoint.p95)}\n`);
-    process.stdout.write(`  p99: ${formatMs(endpoint.p99)}\n`);
-    process.stdout.write(`  errors: ${endpoint.errors}\n`);
-    process.stdout.write(`  error rate: ${formatPercent(endpoint.errorRate)}\n\n`);
-  }
+    process.stdout.write('Running Artillery: complete\n\n');
+    for (const endpoint of testedEndpoints) {
+        const symbol =
+            endpoint.status === 'pass'
+                ? colors.green('✓')
+                : endpoint.status === 'warn'
+                  ? colors.yellow('⚠')
+                  : colors.red('✕');
+        process.stdout.write(`${symbol} ${endpoint.method} ${endpoint.path}\n`);
+        process.stdout.write(`  p95: ${formatMs(endpoint.p95)}\n`);
+        process.stdout.write(`  p99: ${formatMs(endpoint.p99)}\n`);
+        process.stdout.write(`  errors: ${endpoint.errors}\n`);
+        process.stdout.write(`  error rate: ${formatPercent(endpoint.errorRate)}\n\n`);
+    }
 }
 
 function writeSummary(result, colors) {
-  const details = result.details || {};
-  const warnings = details.warnings || 0;
-  const failed = details.failed || 0;
-  const tested = details.testedEndpoints?.length || 0;
-  const skipped = details.skippedEndpoints?.length || 0;
+    const details = result.details || {};
+    const warnings = details.warnings || 0;
+    const failed = details.failed || 0;
+    const tested = details.testedEndpoints?.length || 0;
+    const skipped = details.skippedEndpoints?.length || 0;
 
-  process.stdout.write("Summary:\n");
-  process.stdout.write(`${colors.green("✓")} Tested endpoints: ${tested}\n`);
-  process.stdout.write(`${colors.yellow("⚠")} Warnings: ${warnings}\n`);
-  process.stdout.write(`${colors.red("✕")} Failed: ${failed}\n`);
-  process.stdout.write(`- Skipped: ${skipped}\n`);
-  process.stdout.write(`- Status: ${result.status}\n`);
-  process.stdout.write(`- ${result.summary}\n`);
-  if (details.artilleryError) {
-    process.stdout.write(`- Artillery error: ${details.artilleryError}\n`);
-  }
+    process.stdout.write('Summary:\n');
+    process.stdout.write(`${colors.green('✓')} Tested endpoints: ${tested}\n`);
+    process.stdout.write(`${colors.yellow('⚠')} Warnings: ${warnings}\n`);
+    process.stdout.write(`${colors.red('✕')} Failed: ${failed}\n`);
+    process.stdout.write(`- Skipped: ${skipped}\n`);
+    process.stdout.write(`- Status: ${result.status}\n`);
+    process.stdout.write(`- ${result.summary}\n`);
+    if (details.artilleryError) {
+        process.stdout.write(`- Artillery error: ${details.artilleryError}\n`);
+    }
 }
 
 function formatMs(value) {
-  return value === null || value === undefined ? "n/a" : `${Math.round(value)} ms`;
+    return value === null || value === undefined ? 'n/a' : `${Math.round(value)} ms`;
 }
 
 function formatPercent(value) {
-  return `${Number(value || 0).toFixed(Number.isInteger(value) ? 0 : 2).replace(/\.00$/, "")}%`;
+    return `${Number(value || 0)
+        .toFixed(Number.isInteger(value) ? 0 : 2)
+        .replace(/\.00$/, '')}%`;
 }

package/src/utils/targetSafety.js

@@ -15,6 +15,8 @@ export const STRESS_LIMITS = {
 
 export function validateStressOptions(args = {}) {
   const target = normalizeTarget(args.target || STRESS_DEFAULTS.target);
+  const parsedTarget = new URL(target);
+  const targetPath = getExplicitTargetPath(parsedTarget);
   const duration = parsePositiveNumber(args.duration, STRESS_DEFAULTS.duration, "duration");
   const arrivalRate = parsePositiveNumber(args.arrivalRate, STRESS_DEFAULTS.arrivalRate, "arrival-rate");
   const maxVusers = parsePositiveInteger(args.maxVusers, STRESS_DEFAULTS.maxVusers, "max-vusers");
@@ -32,6 +34,8 @@ export function validateStressOptions(args = {}) {
 
   return {
     target,
+    artilleryTarget: targetPath ? parsedTarget.origin : target,
+    targetPath,
     duration,
     arrivalRate,
     maxVusers,
@@ -66,6 +70,12 @@ function normalizeTarget(value) {
   return parsed.toString().replace(/\/$/, "");
 }
 
+function getExplicitTargetPath(parsed) {
+  const pathname = parsed.pathname.replace(/\/$/, "") || "/";
+  if (pathname === "/" && !parsed.search) return null;
+  return `${pathname}${parsed.search}`;
+}
+
 function parsePositiveNumber(value, fallback, label) {
   if (value === undefined || value === null || value === "") return fallback;
   const number = Number(value);