winx-code-agent 0.2.352

Remote-first Rust MCP runtime with Streamable HTTP, durable PTYs, and guarded agent tools
Documentation
name: Fuzz campaign

# Compile-only fuzz checks run in CI; this workflow actually exercises the
# parsers. Each target gets a bounded libFuzzer run with a corpus that is
# carried between runs through the actions cache, so coverage accumulates.
# Crashes upload the reproducer and fail the job; turn every confirmed crash
# into a normal regression test.

on:
  schedule:
    - cron: "0 3 * * 1" # weekly, Monday 03:00 UTC
  workflow_dispatch:
    inputs:
      seconds:
        description: "Seconds per target"
        default: "600"
        required: false

permissions:
  contents: read

jobs:
  fuzz:
    name: Fuzz ${{ matrix.target }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        target:
          - bash_command_json
          - bash_parser
          - edit_blocks
          - edit_files_wire
          - terminal
          - thread_id
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup nightly Rust
        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # v1
        with:
          toolchain: nightly

      - name: Rust cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: fuzz-nightly
          workspaces: fuzz -> fuzz/target
          cache-bin: true

      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked --version 0.13.2

      - name: Restore corpus
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: fuzz/corpus/${{ matrix.target }}
          key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
          restore-keys: |
            fuzz-corpus-${{ matrix.target }}-

      - name: Run target
        env:
          SECONDS_PER_TARGET: ${{ github.event.inputs.seconds || '600' }}
        run: |
          mkdir -p "fuzz/corpus/${{ matrix.target }}"
          cargo +nightly fuzz run "${{ matrix.target }}" -- \
            -max_total_time="$SECONDS_PER_TARGET" \
            -rss_limit_mb=2048 \
            -timeout=20 \
            -print_final_stats=1

      - name: Minimize corpus
        if: success()
        run: cargo +nightly fuzz cmin "${{ matrix.target }}"

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-crash-${{ matrix.target }}
          path: fuzz/artifacts/${{ matrix.target }}
          if-no-files-found: ignore