Punchbacks

Turn yourself into the ultimate AI harness. In one click, Punchbacks turns any app bug into a reproducible test, live preview, browser-verified fix, and evidence-backed pull request. Punchback bugs!

Comment

Show us the bug. Test the fix.

Punchbacks is a self-resolving feedback layer for web applications. A user demonstrates a real bug inside the product via voice. Punchbacks captures privacy-filtered browser evidence, proves the failure with Playwright, lets GPT-5.6 investigate and repair an isolated checkout, opens a draft pull request, verifies the Vercel/Cloudflare preview, and returns it to the original reporter/creates a draft PR for the final decision.

The result is not simply “AI wrote a patch.” It is an evidence-backed repair with a reproducible failure, an immutable regression test, a bounded diff, passing project checks, a working preview, and human confirmation. Punchbacks never merges a pull request or deploys to production.

And it doesn't solve just frontend bugs, it codes and solves whole app bugs! I plan to extend this, so that users can also build new features in this new way. #SayNoToIDE

The problem

For Companies: Bug reporting is still a lossy chain of handoffs. A user encounters a problem and sends a vague message or screenshot. Support asks questions. Product rewrites the report. Engineering tries to reproduce it. An AI coding agent may then receive an incomplete prompt and produce a plausible patch, but the person who experienced the bug is rarely part of the verification loop.

Session-replay tools preserve evidence but stop before the fix. Coding agents can produce fixes but usually start from second-hand text and stop at code. Punchbacks connects those systems into one closed loop:

real user failure → reproducible test → bounded AI repair → draft PR → isolated preview → automated replay → reporter confirmation

The person who experienced the bug becomes the acceptance test.

For Indie Hackers and Engineers: Fixing bugs with AI still means switching between the app, agent, terminal, and preview. Repeatedly copying context and manually verifying each patch. Punchbacks closes that loop, turning a browser bug into a reproduced, repaired, and browser-verified pull request.

What it does

  1. Capture the truth. An embeddable, framework-independent recorder collects semantic actions, rrweb replay events, console errors, safe network metadata, browser context, and the reporter’s actual and expected behavior. Passwords, authorization data, configured private selectors, bodies, and sensitive query values are masked before upload.

  2. Let the reporter narrate. The reporter can speak while demonstrating the failure. A dedicated RealtimeSTT WebSocket service shows live interim transcription; optional AI structuring separates the final transcript into editable “What happened?” and “What should happen?” fields. Raw microphone audio remains ephemeral and is never stored.

  3. Reproduce before repairing. Punchbacks turns the evidence into an immutable Playwright regression test. The worker first runs it against the reported base revision and proceeds only when it fails for the declared expected/observed reason. The agent cannot edit the test later.

  4. Repair behind glass. GPT-5.6 investigates a disposable OpenSandbox checkout using restricted AI SDK tools. Host policy controls paths, commands, egress, runtime, cancellation, tool calls, changed files, diff size, and patch attempts. Repository content is treated as untrusted guidance and cannot override the runner policy.

  5. Require receipts. The immutable regression test, targeted tests, configured full suite, type-check, build, diff limits, and secret scan must pass before Punchbacks pushes a branch and opens one idempotent draft PR.

  6. Verify the real experience. Punchbacks finds the non-production Vercel deployment for the exact PR head SHA, destroys the credential-bearing repair environment, and starts a clean browser-verification sandbox containing only the reproduction test. The original reporter receives the preview and chooses It’s fixed or Still broken.

Try the live loop

Go to https://punchbacks.com, record a bug, and come back in about five minutes to see a draft PR opened in the Punchbacks repository.

Repository and complete setup guides: https://github.com/DarthBenro008/punchbacks

How I built it

Punchbacks is a Bun/Turborepo monorepo with:

  • TanStack Start, React 19, Tailwind CSS 4, Motion, and Base UI-backed shadcn components for the product experience
  • Hono and Better Auth for the control plane and GitHub authentication
  • PostgreSQL, Drizzle ORM, and pg-boss for durable state transitions, event replay, migrations, rate limiting, and jobs
  • AI SDK for the policy-backed GPT-5.6 repair loop and encrypted BYOK support for OpenAI, Anthropic, and OpenCode Go
  • OpenSandbox sibling containers for TTL-bound repair and browser-verification workloads
  • Playwright, rrweb, semantic browser traces, and Server-Sent Events for evidence, reproduction, replay, and live activity
  • GitHub App automation for repository discovery, draft PRs, checks, deployments, and webhook handling
  • RealtimeSTT for concurrent browser-streamed voice reporting
  • Docker Compose for the full stack and Caddy for production HTTPS/WSS routing

Customer provider keys are AES-256-GCM encrypted, write-only through the API, decrypted only when a worker constructs the selected model, and never passed to OpenSandbox. Tracking tokens are stored only as hashes. Public reporter views exclude repository identity, source, internal logs, and unrelated evidence.

How Codex and GPT-5.6 shaped the project

Punchbacks was built in a single, ongoing Codex conversation during OpenAI Build Week. I started with the PRD and kept going through architecture, implementation, redesigns, browser debugging, Docker logs, database issues, provider failures, sandbox problems, test regressions, documentation, and hardening the golden path. In total, the project used around 350-400 million tokens

I thank the codex team for the $100 free credits and legend Tibo with his reset timings which helped me build this. (congrats openai for 10M users!)

Building and iterating across that many connected systems manually would have taken far longer than the Build Week window.

Codex and GPT-5.6 helped most with the work that benefits from long-running context and fast feedback like translating the PRD into schemas, migrations, APIs, state transitions, jobs, and service boundaries, building the recorder, replay workspace, agent, integrations, sandbox runner, MCP server, BYOK vault, and RealtimeSTT path and tracing failures across the browser, PostgreSQL, Docker services, providers, and ephemeral sandboxes.

When something broke, it helped turn the evidence into focused fixes, regression tests, documentation, and commits. I used gpt5.6 in punchbacks and dogfeeded punchbacks into punchbacks! a self loop!

The product, engineering, and design direction was mine. I defined the core thesis in a PRD format.

a reported issue should become the acceptance test for its own fix. I made the major stack and product calls like using Bun and TanStack Start, Base UI-backed shadcn components, Drizzle/PostgreSQL with pg-boss, isolated OpenSandbox execution, AI SDK with customer-owned provider keys, and a dedicated RealtimeSTT service instead of unreliable browser-native speech recognition.

I also directed the brand, visual language, motion, onboarding, and recorder experience. And I set the safety line: Punchbacks can investigate, reproduce, patch, test, and prepare a preview, but people remain in control of merges and production.

GPT-5.6 was not a one-shot code generator, the '/goal' helped me a lot. It was a reasoning and implementation partner throughout the process. Holding architectural context, proposing bounded designs, making connected monorepo changes, reading runtime evidence, and revising work based on my judgment.

It also helped me create the whole youtube video in less than 5 hours!

gpt5.6-sol performs these operations very very well

  • Testing: generates Playwright reproductions and verifies fixes.
  • Agentic workflows: uses GPT‑5.6‑sol to investigate and repair repositories.
  • DevOps: opens PRs, detects previews, runs checks, and verifies deployments.

Challenges I overcame

The hardest work lived between services rather than inside one component: keeping an immutable reproduction test while allowing useful agent tools; moving short-lived GitHub credentials through OpenSandbox Credential Vault without exposing them in commands or logs; matching a Vercel deployment to the exact PR SHA; maintaining durable, replayable report transitions; preserving realtime transcript history across interim/final events and WebSocket reconnects; and making GitHub OAuth work correctly behind a same-origin reverse proxy.

Each of these failures was reproduced against the running system and converted into a policy check, regression test, or operational guide.

What I am proud of

Punchbacks is a complete product loop rather than a disconnected agent demo. It combines a polished reporter experience, maintainer control plane, durable orchestration, isolated execution, encrypted customer credentials, live evidence, real GitHub automation, preview verification, and a final human acceptance gate.

It also remains deliberately bounded. A report can be non-reproducible. A repair can fail policy or test gates. A reporter can reject the preview. Those are valid outcomes and safer than claiming success because an AI produced a diff.

What is next

Next steps include organizations and multi-member projects, more deployment providers, framework-specific recorder adapters, hosted and private runner options, duplicate-report clustering, richer policy controls, SSO, and confirmation-gated MCP repair actions. The central rule will stay the same: no fix is complete until the evidence passes and the original reporter agrees.

Built With

  • ai-sdk
  • bun
  • caddy
  • codex
  • docker
  • drizzle-orm
  • github-apps
  • hono
  • openai-gpt-5.6
  • opensandbox
  • pg-boss
  • playwright
  • postgresql
  • react
  • realtimestt
  • rrweb
  • tailwind-css
  • tanstack-start
  • typescript
  • vercel
Share this project:

Updates