fuzzah

Use when reviewing, triaging, or classifying AFL++ crashes in ~/fuzzing/targets/*/crashes-triaged/. Triggers on "review crashes", "triage crashes", "look at the crashes", "what bugs did we find", "classify crashes", "which crashes matter". Reads INDEX.md + trace.txt per hash, classifies by bug type and severity, inspects source at the top frame, and outputs a prioritized action table.

List all unique triaged crashes for a fuzz target from its INDEX.md. Use when the operator asks "what crashes do we have", "list crashes for <target>", or invokes $fuzz-crashes <target>. Equivalent of /fuzz-crashes in Claude Code.

Launch the fuhq browser dashboard for live fuzz state, per-target views, and per-crash drill-down. Use when the operator asks for the dashboard, browser UI, fuhq, or invokes $fuzz-dashboard. Equivalent of /fuzz-dashboard in Claude Code.

Show fuzz rig status for a single target — live fuzzer count, execs/sec, coverage, crashes, disk. Use when the operator asks for the status of a specific target or invokes $fuzz-status <target>. Equivalent of /fuzz-status in Claude Code. For a multi-target summary, use $check-in instead.

Use when standing up a new AFL++ fuzz target. Triggers on "add new target", "set up fuzzing for X", "fuzz <name>", "new fuzz target", "start fuzzing <library>". Walks the full pipeline (seeds → 3 builds → cmin → triage → systemd) adapted to the target's build system (cmake / autoconf / meson / custom). Uses the fuzzah kit's `target-template/` as the starting point.

Deep-dive a specific crash by hash. Loads meta.json + trace.txt and applies the fuzz-crash-review per-crash workflow (classify by signal class, inspect top-frame source, recommend action). Use when the operator asks to review, triage, or explain a specific crash hash, or invokes $fuzz-review <hash> <target>. Equivalent of /fuzz-review in Claude Code.

Cross-target fuzz dashboard. Prints live fuzzer counts, execs/sec, unique crash counts, and a breakdown of crashes by workflow state (new → reviewed → repro-ok → reported). Use when the operator asks for a health snapshot, wants to know where to focus today, or invokes $check-in. Equivalent of /check-in in Claude Code.

System-domain health snapshot of the fuzz rig — host memory/disk/swap, systemd unit state, worker counts with uptime, OOM-kill events from dmesg, watchdog respawn rate, spurious kernel signals. Orthogonal to $check-in (which only covers fuzz-domain state). Use when the operator asks about VM/host health, OOM investigation, why workers keep dying, or invokes $rig-check. Equivalent of /rig-check in Claude Code.