tooling: add the thunder-perf-hunt performance/a11y/bug-hunt skill#1061
Open
cjroth wants to merge 4 commits into
Open
tooling: add the thunder-perf-hunt performance/a11y/bug-hunt skill#1061cjroth wants to merge 4 commits into
cjroth wants to merge 4 commits into
Conversation
A two-layer harness that boots a Docker-free stack (pglite + anonymous auth) and drives headless Chromium + Firefox against the app to hunt Core Web Vitals regressions, unnecessary React re-renders, long tasks/LoAF, layout thrash, memory leaks, bundle bloat, functional bugs (curiosity-driven state-graph crawler), and a11y violations — then adversarially verifies each finding before proposing fixes. - scripts/: deterministic Bun + Playwright probes emitting compact JSON (run.ts, report.ts, explore.ts, analyze-bundle.ts + lib/ and probes/). - SKILL.md + references/: the agentic Scout -> Triage -> adversarial Verify -> Fix -> PR workflow and per-lens playbooks. - calibration.json + LEARNINGS.md: the learned-overlay + self-improvement log, including this session's tuning (idle-restore render probe fix, a streaming scenario via the dev Message Simulator, explore.ts honoring calibration exclusions, and false-positive suppressions). - Adds axe-core (devDependency) for the a11y probe; .gitignore ignores the .perf-hunt/ run artifacts and .pglite/ throwaway data. Binds to dedicated ports (:1431/:8010) so it never collides with make dev or the e2e suite. See SKILL.md to run it.
Semgrep Security ScanNo security issues found. |
PR Metrics
Updated Tue, 07 Jul 2026 06:27:22 GMT · run #2216 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: 212c7ba58263 · mode: deep · deferred 0 item(s) already reported by other bots (best-effort dedup)
- explore.ts: give each browser its own state graph (nodes/edges + the MAX_STATES budget) so a browser running after another gets a full crawl instead of short-circuiting on states an earlier browser already filled. signature() is browser-independent, so the shared graph was starving the second browser (Firefox). Findings/seenFindingKeys stay shared so a bug seen in both browsers is still reported once. - a11y.ts: drop the hardcoded /home/chris axe-core fallback path (leaked a username and silently broke a11y coverage on other machines); require.resolve already resolves it from the installed devDependency.
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: ebc3a1319ab2 · mode: deep · deferred 0 item(s) already reported by other bots (best-effort dedup)
- boot.ts: spawn backend/frontend with stdout/stderr 'ignore' instead of 'pipe'. Readiness is polled via waitForUrl and nothing drains the streams, so a chatty Vite/backend would fill the ~64KB OS pipe buffer and hang mid-sweep (looking like a scenario timeout). - heap.ts/types.ts/report.ts: rename detachedNodesDelta -> domNodesDelta (it's the total live DOM-node delta, not detached nodes) and make the byte threshold the sole leak trigger — a positive node delta alone was over-reporting leaks on healthy pages after a navigate cycle. - SKILL.md: fix SETUP step 1 to use the working bun playwright-core invocation instead of `bunx playwright install`, which the Prerequisites note explicitly warns fails in this bun-only repo.
There was a problem hiding this comment.
🔭 thunder-deep-review (advisory)
Complements the other bots — surfaces only what they did not flag. Never approves, never requests changes, never gates merge.
head: 820e1afd9b2f · mode: deep · deferred 0 item(s) already reported by other bots (best-effort dedup)
…sers mergeAcrossBrowsers keyed only on category + attribution, so the same component/selector/asset flagged on two different scenarios collapsed into one finding — the first-seen severity/evidence won and the rest were lost, under-reporting for a deliberately recall-biased tool. Fold the scenario into the merge key so only true cross-browser duplicates of one issue on one scenario merge, and keep the max severity on merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the thunder-perf-hunt skill — a two-layer harness for hunting performance, functional-bug, and a11y issues in the web app.
:1431/:8010) and drive headless Chromium + Firefox, emitting compact JSON —run.ts(perf/a11y/console sweep),report.ts(thresholded findings),explore.ts(curiosity-driven state-graph crawler),analyze-bundle.ts, pluslib/andprobes/.SKILL.md+references/— the Scout → Triage → adversarial Verify → Fix → PR workflow (separate discovery from verification; reproduce + attribute before believing), with per-lens playbooks (metrics/thresholds, re-render, fix, a11y, gecko-profiler, verification rubric, self-improve).calibration.json(false-positive exclusions + discovered scenarios) andLEARNINGS.md(the self-improvement log).Why it's safe / self-contained
make dev(1420/8000) and e2e bands, so it never collides with a dev server or the e2e suite; reuses an already-serving stack if present.axe-core(devDependency, for the a11y probe)..gitignoreignores the.perf-hunt/run artifacts and.pglite/throwaway data, so runs never dirty the tree.What this session produced with it
Four fix PRs (#1057 a11y; #1058/#1059/#1060 bundle — entry chunk 788.5 → 633.9 KB gzip, ~−20%), each adversarially verified. This PR also folds in the harness self-improvements from those runs (idle-restore render-probe fix that eliminated 107 false positives, a streaming scenario via the dev Message Simulator,
explore.tshonoring calibration exclusions, and documented false-positive suppressions).How to run
See
SKILL.md. Quick start:bun .claude/skills/thunder-perf-hunt/scripts/run.ts --mode sweep --browsers chromium,firefox(browsers install once viabun node_modules/playwright-core/cli.js install chromium firefox).Reviewer notes
src/app changes (those are in fix(a11y): add accessible names to icon-only buttons and unlabeled controls #1057–perf(bundle): stop leaking desktop-only tauri plugins into the web entry #1060).scripts/tsconfig.json(bun x tsc -p .claude/skills/thunder-perf-hunt/scripts/tsconfig.json).