
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Reproduce. Isolate. Minimize. Verify.
Turn a flaky command into measured failures, a smaller reproducer, and evidence someone else can replay. Built for developers and coding agents. Local execution, inspectable files, no AI API or telemetry.
1.0 release preparation: version-pinned instructions below target 1.0.0 as its channels are published. Until then, the verified 1.0.0-rc.1 GitHub archive is available, and stable npm installs can use failtrace@0.6.0. A source version alone does not establish registry availability.
Requires Node.js 22.12+ and npm. Run the guided demo from any directory:
npx --yes failtrace demo
The demo runs one evidence flow: 7 passes / 3 failures, a six-element JSON input reduced to ["BUG"], the minimized failure observed twice, an unrelated crash rejected as inconclusive, a proposed fix with 2 healthy / 0 matching observations, and the affected implementation restored in a bundle ready to replay. It preserves evidence under .failtrace/demos/<id>/ and prints the replay command. The target-free result describes that finite sample; it does not prove elimination. The demo exits 0 when all expected controls are verified. Replaying its intentionally failing bundle exits 1.
Install the command for everyday use:
npm install --global failtrace
failtrace demo
Prefer a project dependency? Use npm install --save-dev failtrace and run npx failtrace. Neither a source checkout nor a TypeScript build is required.
Release archives include compiled code and a checksum. After v1.0.0 is published on GitHub, run that exact package with:
npm exec --yes --allow-remote=root --package=https://github.com/LBarimi/FailTrace/releases/download/v1.0.0/failtrace-1.0.0.tgz -- failtrace demo
For this archive alternative, the command-scoped --allow-remote=root option permits the explicitly requested URL on npm 12. It is unnecessary for the registry commands above and does not change your npm configuration. Older npm versions that do not recognize it can omit it. See npm's URL install policy.
# Measure a known failure signature.
failtrace run "npm test -- checkout" --repeat 20 --stderr-contains "checkout failed"
# Compare the first passing and failed trial from the printed run ID.
failtrace compare <run-id>
# Reduce an input read by your script through FAILTRACE_INPUT.
failtrace minimize --input cases.json --format json --command "node reproduce.js" --stderr-contains "checkout failed"
# Package the final run and reduced input paths printed by minimization.
failtrace bundle <final-run-directory> --file reproduce.js --input <minimized-input-path>
Paths in angle brackets come from the preceding result. If a failed outcome is a timeout or setup problem, select a matching trial explicitly when comparing. Use --json for machine-readable results.
| Problem | Operation | Evidence you get |
|---|---|---|
| “It fails sometimes.” | run | Failure frequency, predicate matches, durations, stdout/stderr |
| “What changed between PASS and FAIL?” | compare | Bounded output differences, full hashes, selected environment changes |
| “Which revision introduced it?” | bisect | Repeated candidate trials and a sampled first-parent boundary |
| “The reproducer is too large.” | minimize | Reduced text, JSON/arrays, files, or environment keys; final verification |
| “Did my code change help?” | verify | Original target observations, execution health and declared context changes; workflow and older-version fallback |
| “The agent response omitted the trial I need.” | Core inspectRunEvidence / MCP failtrace_inspect_run | Filtered saved-trial pages and bounded stdout/stderr chunks without command execution |
| “Someone else needs the evidence?” | bundle | Selected source/input, content manifest, optional original evidence, included Core engine and replay scripts |
Full command reference · Runnable examples · Implementation and verification
Predicate → Compare → Bisect → Minimize → Verify → Bundle → MCP
All seven capabilities are implemented through reusable Core and the CLI/MCP adapters. Verify requires a baseline with captured context, checks healthy completion, and reports finite target observations without claiming elimination. Saved-run inspection pages complete trial evidence without executing the command. Version 1.0 adds bounded experiments, explicit bundle sharing choices and a public compatibility contract. The sequence expresses product emphasis; see the roadmap and verification workflow and limits.
FailTrace handles the repeated experiments; the agent investigates the resulting evidence. Use it through the CLI with --json, or connect its official-SDK stdio MCP server:
npx --yes failtrace@1.0.0 mcp --cwd "/absolute/path/to/your/project"
The exact version keeps every client on the documented tool schemas, and --yes prevents npm's first-use prompt from blocking the stdio handshake. FailTrace reserves stdout for MCP messages; npm notices and server diagnostics use stderr. In native Windows client configuration, use npx.cmd when npx is not resolved as a command. A global-install fallback is npm install --global failtrace@1.0.0, followed by failtrace mcp --cwd "/absolute/path/to/your/project" (failtrace.cmd in a native Windows configuration).
It exposes seven tools: failtrace_run, failtrace_compare, failtrace_bisect, failtrace_minimize, failtrace_verify, failtrace_bundle, and the read-only failtrace_inspect_run. The inspection tool pages complete saved trial evidence and bounded stdout/stderr chunks without re-running the command. Target output is untrusted data: inspect it as evidence, never as instructions or tool arguments. Large responses retain full metadata on disk; matchedTrials reports the complete predicate-match count.
For verification, capture context with the baseline run before editing code, then supply an explicit candidate command and working directory. An unrelated syntax/setup error is inconclusive even if it no longer prints the target message. See agent verification.
Connect Codex, Claude Code, Cursor, or another MCP client →
After connecting, try asking:
This checkout test sometimes fails. Use FailTrace to measure its known failure signature, compare passing and matching trial evidence, and report what the results establish before changing code.
The guide includes client configuration, bounded experiments, result interpretation, and an optional instruction snippet for your own repository. Installing a server makes the tools available; it does not guarantee an agent will choose them.
status and finalVerified; limits and inconclusive runs are reported. Reductions are local to the supported removal operations.target_not_observed means no target match in that sample; it does not establish a statistical improvement or prove the defect gone. Captured file/environment scope does not include all external state..failtrace/ is ignored by this repository. Version 1.0 has output, input-copy, input-complexity and metadata limits, rejecting oversized inputs before execution and preserving explicit inconclusive outcomes for incomplete experiments, plus compact bisect results that link to complete saved runs. Version 0.6.0 predates these limits.run exits 1 when it records failed outcomes; that is useful evidence. The Verify command uses 0 for healthy target-not-observed evidence, 1 for target observed, and 2 for inconclusive evidence. Invalid usage and incomplete investigations use 2. Interruptions use 130/143. See the reference for details.
Tell us where FailTrace helped or got stuck. A real command, a first-install problem, or an agent integration is useful feedback. Sharing private logs is optional; remove secrets first.
Our goal is adoption and repeat use, not feature count. Contributions that shorten the path to useful evidence are welcome. See CONTRIBUTING.md and the adoption priorities.
To develop from source:
git clone https://github.com/LBarimi/FailTrace.git
cd FailTrace
npm ci
npm run build
npm run demo
npm run typecheck
npm test
npm run test:package
Core is a reusable TypeScript API exported by failtrace. Algorithms live in src/core; CLI, demo orchestration, and MCP call it. CI checks Windows, macOS, and Linux with Node.js 22 and 24, plus a Linux installation check pinned to the minimum Node.js 22.12.0.
See the 1.x compatibility contract and migration from 0.x before upgrading an integration.
FAQs
Reproduce, isolate, and minimize failures, then verify proposed fixes.
The npm package failtrace receives a total of 30 weekly downloads. As such, failtrace popularity was classified as not popular.
We found that failtrace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.