@mingozhou/dsh-replay 0.3.3

package/src/client/viewer-entry.tsx

@@ -0,0 +1,66 @@
+/**
+ * Standalone viewer entry — bundled (react inlined) into lib/viewer.js and
+ * embedded into exported HTML files. Reads `window.__DSHR_DATA__`:
+ *   { sessions: [{ header, events, title? }] }
+ */
+import React, { useState } from 'react'
+import { createRoot } from 'react-dom/client'
+import type { SessionEvent, SessionHeader } from '../core/types.js'
+import { StaticReplayApi } from './api.js'
+import { ReplayApp } from './components/ReplayApp.js'
+// eslint-disable-next-line import/no-unresolved
+import cssText from './styles.css'
+
+interface ViewerData {
+  sessions: { header: SessionHeader; events: SessionEvent[]; title?: string }[]
+}
+
+const data = (window as unknown as { __DSHR_DATA__?: ViewerData }).__DSHR_DATA__ ?? { sessions: [] }
+const api = StaticReplayApi.fromParsed(data.sessions)
+const first = data.sessions[0]?.header.id
+
+function ViewerShell(): React.ReactElement {
+  const [dark, setDark] = useState(
+    globalThis.matchMedia?.('(prefers-color-scheme: dark)').matches ?? false,
+  )
+  return (
+    <div data-theme={dark ? 'dark' : 'light'} style={{ height: '100%', display: 'flex', flexDirection: 'column' }}>
+      <div
+        style={{
+          display: 'flex', alignItems: 'center', gap: 10, padding: '8px 14px', fontSize: 13,
+          borderBottom: '1px solid ' + (dark ? '#2c2c2a' : '#e1e0d9'),
+          background: dark ? '#0d0d0d' : '#f9f9f7', color: dark ? '#fff' : '#0b0b0b',
+        }}
+      >
+        <strong>dsh-replay</strong>
+        <span style={{ opacity: 0.6 }}>exported session replay</span>
+        <span style={{ flex: 1 }} />
+        <a
+          href="https://github.com/MingoZhou/dsh-replay"
+          target="_blank"
+          rel="noreferrer"
+          style={{ color: 'inherit', opacity: 0.7 }}
+        >
+          GitHub
+        </a>
+        <button
+          onClick={() => setDark(d => !d)}
+          style={{
+            font: 'inherit', cursor: 'pointer', border: '1px solid ' + (dark ? '#2c2c2a' : '#e1e0d9'),
+            borderRadius: 6, padding: '2px 9px', background: 'transparent', color: 'inherit',
+          }}
+        >
+          {dark ? 'light' : 'dark'}
+        </button>
+      </div>
+      <div style={{ flex: 1, minHeight: 0 }}>
+        <ReplayApp api={api} sessionId={first} />
+      </div>
+    </div>
+  )
+}
+
+const style = document.createElement('style')
+style.textContent = (cssText as unknown as string) + '\nhtml, body, #root { height: 100%; margin: 0; }'
+document.head.append(style)
+createRoot(document.getElementById('root')!).render(<ViewerShell />)

package/src/core/audit.ts

@@ -0,0 +1,227 @@
+/**
+ * Security-audit pass over a decoded session: classify events into findings
+ * with a severity, grouped for the audit view. Rules are data, not code —
+ * extend `DEFAULT_RULES` or pass your own list.
+ *
+ * Severity vocabulary mirrors a standard status palette:
+ * 'critical' | 'serious' | 'warning' | 'info'.
+ */
+import type { ParsedSession, SessionEvent } from './types.js'
+
+export type Severity = 'critical' | 'serious' | 'warning' | 'info'
+
+export interface AuditFinding {
+  ruleId: string
+  severity: Severity
+  seq: number
+  time: number
+  /** English title (stable fallback). */
+  title: string
+  detail?: string
+  /** Structured message id + params, so UIs can localize findings. */
+  messageKey?: string
+  params?: Record<string, string>
+}
+
+export interface AuditRule {
+  id: string
+  severity: Severity | ((event: SessionEvent) => Severity)
+  /** Return a finding title when the event matches, undefined otherwise. */
+  match: (event: SessionEvent) => {
+    title: string
+    detail?: string
+    messageKey?: string
+    params?: Record<string, string>
+  } | undefined
+}
+
+export interface AuditReport {
+  findings: AuditFinding[]
+  counts: Record<Severity, number>
+}
+
+function get(obj: unknown, key: string): unknown {
+  return typeof obj === 'object' && obj !== null ? (obj as Record<string, unknown>)[key] : undefined
+}
+
+function str(value: unknown): string {
+  return typeof value === 'string' ? value : JSON.stringify(value) ?? ''
+}
+
+const SHELL_TOOLS = /^(bash|shell|exec|run_command|terminal|subprocess)/iu
+const WRITE_TOOLS = /^(write|edit|create_file|str_replace|apply_patch|notebook_edit|fs_write|mv|rm|delete)/iu
+const NETWORK_TOOLS = /^(fetch|web_fetch|http|curl|download|web_search|browser)/iu
+
+const DANGEROUS_SHELL = [
+  { re: /\brm\s+(-[a-z]*[rf][a-z]*\s+)+/iu, why: 'recursive/forced delete', key: 'rm-rf' },
+  { re: /\bsudo\b/u, why: 'privilege escalation', key: 'sudo' },
+  { re: /\bchmod\s+([0-7]{3,4}|\+x)/u, why: 'permission change', key: 'chmod' },
+  { re: /\b(curl|wget)\b[^|;&]*\|\s*(ba)?sh\b/iu, why: 'pipe remote script to shell', key: 'curl-pipe' },
+  { re: /\bgit\s+push\s+.*--force/iu, why: 'force push', key: 'force-push' },
+  { re: /\b(dd|mkfs|fdisk)\b/u, why: 'raw disk operation', key: 'disk' },
+  { re: /(\bssh\b|\bscp\b|\brsync\b.*@)/u, why: 'remote host access', key: 'remote' },
+  { re: /\b(export|echo)\b.*\b(API_?KEY|TOKEN|SECRET|PASSWORD)\b/iu, why: 'credential material in command', key: 'creds' },
+]
+
+const SENSITIVE_PATH = /(\.env\b|\.ssh\/|id_rsa|\.aws\/|credentials|\.npmrc|\.netrc|secrets?\.|\.pem\b)/iu
+
+export const DEFAULT_RULES: AuditRule[] = [
+  {
+    id: 'shell-exec',
+    severity: event => {
+      const args = str(get(event.data, 'arguments'))
+      return DANGEROUS_SHELL.some(p => p.re.test(args)) ? 'critical' : 'warning'
+    },
+    match: event => {
+      if (event.type !== 'tool/call') return undefined
+      const name = str(get(event.data, 'name'))
+      if (!SHELL_TOOLS.test(name)) return undefined
+      const args = str(get(event.data, 'arguments'))
+      const hit = DANGEROUS_SHELL.find(p => p.re.test(args))
+      return {
+        title: hit ? `shell: ${hit.why}` : `shell command via ${name}`,
+        detail: args.slice(0, 400),
+        messageKey: hit ? 'f.shell.dangerous' : 'f.shell.plain',
+        params: (hit ? { whyKey: hit.key, why: hit.why } : { name }) as Record<string, string>,
+      }
+    },
+  },
+  {
+    id: 'file-write',
+    severity: event =>
+      SENSITIVE_PATH.test(str(get(event.data, 'arguments'))) ? 'critical' : 'info',
+    match: event => {
+      if (event.type !== 'tool/call') return undefined
+      const name = str(get(event.data, 'name'))
+      if (!WRITE_TOOLS.test(name)) return undefined
+      const args = str(get(event.data, 'arguments'))
+      const sensitive = SENSITIVE_PATH.test(args)
+      return {
+        title: sensitive ? `file write touches sensitive path` : `file mutation via ${name}`,
+        detail: args.slice(0, 400),
+        messageKey: sensitive ? 'f.file.sensitive' : 'f.file.write',
+        params: { name },
+      }
+    },
+  },
+  {
+    id: 'sensitive-read',
+    severity: 'serious',
+    match: event => {
+      if (event.type !== 'tool/call') return undefined
+      const args = str(get(event.data, 'arguments'))
+      const name = str(get(event.data, 'name'))
+      if (WRITE_TOOLS.test(name) || SHELL_TOOLS.test(name)) return undefined
+      if (!SENSITIVE_PATH.test(args)) return undefined
+      return {
+        title: `access to sensitive path via ${name}`,
+        detail: args.slice(0, 400),
+        messageKey: 'f.read.sensitive',
+        params: { name },
+      }
+    },
+  },
+  {
+    id: 'network',
+    severity: 'info',
+    match: event => {
+      if (event.type !== 'tool/call') return undefined
+      const name = str(get(event.data, 'name'))
+      if (!NETWORK_TOOLS.test(name)) return undefined
+      return {
+        title: `network access via ${name}`,
+        detail: str(get(event.data, 'arguments')).slice(0, 400),
+        messageKey: 'f.network',
+        params: { name },
+      }
+    },
+  },
+  {
+    id: 'approval-denied',
+    severity: 'warning',
+    match: event => {
+      if (event.type !== 'approval/decided') return undefined
+      const outcome = str(get(event.data, 'outcome') ?? get(event.data, 'decision'))
+      if (!/den|reject|refus/iu.test(outcome)) return undefined
+      return { title: 'user denied an approval', detail: outcome, messageKey: 'f.approval.denied' }
+    },
+  },
+  {
+    id: 'sandbox-change',
+    severity: 'serious',
+    match: event =>
+      event.type === 'sandbox/mode'
+        ? { title: 'sandbox mode changed', detail: JSON.stringify(event.data), messageKey: 'f.sandbox.change' }
+        : undefined,
+  },
+  {
+    id: 'permission-change',
+    severity: 'serious',
+    match: event =>
+      event.type === 'permission/preset'
+        ? { title: 'permission preset changed', detail: JSON.stringify(event.data), messageKey: 'f.permission.change' }
+        : undefined,
+  },
+  {
+    id: 'subagent',
+    severity: 'info',
+    match: event =>
+      event.type === 'subagent/descriptor'
+        ? {
+            title: `subagent spawned (${str(get(event.data, 'mode'))})`,
+            detail: str(get(event.data, 'persona') ?? get(event.data, 'label') ?? ''),
+            messageKey: 'f.subagent',
+            params: { mode: str(get(event.data, 'mode')) },
+          }
+        : undefined,
+  },
+  {
+    id: 'tool-error',
+    severity: 'warning',
+    match: event => {
+      if (event.type !== 'tool/result') return undefined
+      const error = get(event.data, 'error')
+      if (error === undefined) return undefined
+      return {
+        title: `tool failed: ${str(get(error, 'name'))}`,
+        detail: str(get(error, 'code')),
+        messageKey: 'f.tool.error',
+        params: { name: str(get(error, 'name')) },
+      }
+    },
+  },
+  {
+    id: 'turn-error',
+    severity: 'warning',
+    match: event => {
+      if (event.type !== 'turn/end') return undefined
+      const kind = str(get(get(event.data, 'reason'), 'kind'))
+      if (kind === 'completed' || kind === '') return undefined
+      return { title: `turn ended abnormally: ${kind}`, messageKey: 'f.turn.error', params: { kind } }
+    },
+  },
+]
+
+const SEVERITY_ORDER: Severity[] = ['critical', 'serious', 'warning', 'info']
+
+export function auditSession(
+  session: ParsedSession,
+  rules: AuditRule[] = DEFAULT_RULES,
+): AuditReport {
+  const findings: AuditFinding[] = []
+  for (const event of session.events) {
+    for (const rule of rules) {
+      const hit = rule.match(event)
+      if (hit === undefined) continue
+      const severity = typeof rule.severity === 'function' ? rule.severity(event) : rule.severity
+      findings.push({ ruleId: rule.id, severity, seq: event.seq, time: event.time, ...hit })
+    }
+  }
+  findings.sort(
+    (a, b) =>
+      SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity) || a.seq - b.seq,
+  )
+  const counts: Record<Severity, number> = { critical: 0, serious: 0, warning: 0, info: 0 }
+  for (const finding of findings) counts[finding.severity]++
+  return { findings, counts }
+}

package/src/core/cost.ts

@@ -0,0 +1,61 @@
+/**
+ * Cost estimation from token totals. Prices are USD per 1M tokens and are
+ * ESTIMATES — provider list prices change; override the table if you need
+ * exact numbers. Cache-write falls back to the input rate when a provider
+ * doesn't price it separately.
+ */
+import type { TokenTotals } from './timeline.js'
+
+export interface PricingRate {
+  /** USD per 1M uncached input tokens. */
+  input: number
+  /** USD per 1M cache-read tokens. */
+  cacheRead: number
+  /** USD per 1M cache-write tokens (defaults to `input`). */
+  cacheWrite?: number
+  /** USD per 1M output tokens. */
+  output: number
+}
+
+export interface PricingEntry {
+  match: RegExp
+  rate: PricingRate
+  label: string
+}
+
+/** Editable defaults — first match wins, most specific first. */
+export const DEFAULT_PRICING: PricingEntry[] = [
+  { match: /deepseek.*pro/iu, rate: { input: 1.1, cacheRead: 0.27, output: 4.4 }, label: 'DeepSeek Pro' },
+  { match: /deepseek/iu, rate: { input: 0.27, cacheRead: 0.07, output: 1.1 }, label: 'DeepSeek' },
+  { match: /claude|anthropic/iu, rate: { input: 3, cacheRead: 0.3, cacheWrite: 3.75, output: 15 }, label: 'Claude' },
+  { match: /gpt|^o\d|openai|codex/iu, rate: { input: 2.5, cacheRead: 1.25, output: 10 }, label: 'OpenAI' },
+  { match: /gemini/iu, rate: { input: 1.25, cacheRead: 0.31, output: 10 }, label: 'Gemini' },
+]
+
+export interface CostEstimate {
+  usd: number
+  label: string
+}
+
+export function estimateCost(
+  totals: TokenTotals,
+  models: string[],
+  pricing: PricingEntry[] = DEFAULT_PRICING,
+): CostEstimate | undefined {
+  const entry = pricing.find(p => models.some(m => p.match.test(m)))
+  if (entry === undefined) return undefined
+  const { rate } = entry
+  const usd =
+    (totals.input * rate.input +
+      totals.cacheRead * rate.cacheRead +
+      totals.cacheWrite * (rate.cacheWrite ?? rate.input) +
+      totals.output * rate.output) /
+    1_000_000
+  return { usd, label: entry.label }
+}
+
+export function formatUsd(usd: number): string {
+  if (usd >= 1) return `$${usd.toFixed(2)}`
+  if (usd >= 0.01) return `$${usd.toFixed(3)}`
+  return `$${usd.toFixed(4)}`
+}

package/src/core/decode.ts

@@ -0,0 +1,125 @@
+/**
+ * Decode a DeepSeek Harness session log (JSONL text or pre-parsed records)
+ * into a `ParsedSession`: header + flat, seq-ordered `SessionEvent[]`.
+ *
+ * Handles the two wire realities documented in the harness:
+ *  - the header line (`type: 'session'`) is not an event;
+ *  - runs of streaming chunks may be packed into `*-chunks` rows
+ *    (`seq0`/`time0`/`dt[]`) that expand back into `assistant/chunk` events.
+ *
+ * A torn final line (crash tail without newline) is tolerated and reported
+ * in `malformed`, mirroring the harness's own committed-bytes semantics.
+ */
+import type {
+  ChunkRowBase,
+  ParsedSession,
+  SessionEvent,
+  SessionHeader,
+  StorageRecord,
+} from './types.js'
+
+const CHUNK_ROW_TYPES = new Set(['text-chunks', 'reasoning-chunks', 'tool-call-chunks'])
+
+export function isChunkRow(record: StorageRecord): record is ChunkRowBase {
+  return CHUNK_ROW_TYPES.has(record.type)
+}
+
+/** Expand one packed chunk row into its constituent `assistant/chunk` events. */
+export function expandChunkRow(row: ChunkRowBase): SessionEvent[] {
+  const { seq0, time0, data } = row
+  const { turn, step, index, dt } = data
+  const events: SessionEvent[] = []
+  const count = (row.type === 'tool-call-chunks' ? data.args?.length : data.texts?.length) ?? 0
+  let time = time0
+  for (let k = 0; k < count; k++) {
+    if (k > 0) time += dt[k - 1] ?? 0
+    let chunk: Record<string, unknown>
+    if (row.type === 'text-chunks') {
+      chunk = { type: 'text-delta', index, text: data.texts![k] }
+    } else if (row.type === 'reasoning-chunks') {
+      chunk = { type: 'reasoning-delta', index, text: data.texts![k] }
+    } else {
+      chunk = {
+        type: 'tool-call-delta',
+        index,
+        id: data.id,
+        ...(k === 0 && data.name !== undefined ? { name: data.name } : {}),
+        args: data.args![k],
+      }
+    }
+    events.push({
+      type: 'assistant/chunk',
+      seq: seq0 + k,
+      time,
+      data: { turn, step, chunk } as SessionEvent['data'],
+    })
+  }
+  return events
+}
+
+/** Decode one storage record (already JSON.parsed) into 0..n events. */
+export function decodeStorageRecord(record: StorageRecord): SessionEvent[] {
+  if (isChunkRow(record)) return expandChunkRow(record)
+  return [record]
+}
+
+function isHeaderLine(value: Record<string, unknown>): boolean {
+  return value['type'] === 'session' && typeof value['id'] === 'string'
+}
+
+/**
+ * Parse raw JSONL text (uncompressed). The first line must be the session
+ * header; every further line is a `StorageRecord`.
+ */
+export function parseSessionJsonl(text: string): ParsedSession {
+  const lines = text.split('\n')
+  const malformed: ParsedSession['malformed'] = []
+  let header: SessionHeader | undefined
+  const events: SessionEvent[] = []
+  const endsWithNewline = text.endsWith('\n')
+
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i]
+    if (raw.trim() === '') continue
+    const isLastLine = i === lines.length - 1
+    let value: Record<string, unknown>
+    try {
+      value = JSON.parse(raw) as Record<string, unknown>
+    } catch (error) {
+      if (isLastLine && !endsWithNewline) {
+        malformed.push({ line: i + 1, raw, error: 'torn tail (uncommitted final record)' })
+      } else {
+        malformed.push({ line: i + 1, raw, error: String(error) })
+      }
+      continue
+    }
+    if (header === undefined) {
+      if (!isHeaderLine(value)) {
+        malformed.push({ line: i + 1, raw, error: 'expected session header line' })
+        continue
+      }
+      header = value as unknown as SessionHeader
+      continue
+    }
+    try {
+      events.push(...decodeStorageRecord(value as unknown as StorageRecord))
+    } catch (error) {
+      malformed.push({ line: i + 1, raw, error: String(error) })
+    }
+  }
+
+  if (header === undefined) {
+    throw new Error('session log has no header line')
+  }
+  events.sort((a, b) => a.seq - b.seq)
+  return { header, events, malformed }
+}
+
+/** Build a ParsedSession from an already-materialized header + events (e.g. an API response). */
+export function fromInspection(
+  header: SessionHeader,
+  records: StorageRecord[],
+): ParsedSession {
+  const events = records.flatMap(decodeStorageRecord).sort((a, b) => a.seq - b.seq)
+  return { header, events, malformed: [] }
+}

package/src/core/forktree.ts

@@ -0,0 +1,104 @@
+/**
+ * Build the session lineage forest from headers (`parentSession` +
+ * `seedLength`), the durable fork/resume metadata the harness keeps
+ * out-of-log. Produces a forest plus a deterministic tidy layout
+ * (depth = x, DFS row = y) the SVG view renders directly.
+ */
+import type { SessionHeader } from './types.js'
+
+export interface ForkNode {
+  id: string
+  header: SessionHeader
+  title?: string
+  children: ForkNode[]
+  /** Inclusive source event count inherited from the parent (undefined for roots). */
+  seedLength?: number
+  depth: number
+  /** Row index assigned by DFS layout. */
+  row: number
+  /** True when parentSession points at a header we never saw. */
+  orphan?: boolean
+}
+
+export interface ForkForest {
+  roots: ForkNode[]
+  nodes: Map<string, ForkNode>
+  rowCount: number
+  maxDepth: number
+}
+
+export interface SessionListEntry {
+  header: SessionHeader
+  title?: string
+}
+
+export function buildForkForest(entries: SessionListEntry[]): ForkForest {
+  const nodes = new Map<string, ForkNode>()
+  for (const { header, title } of entries) {
+    nodes.set(header.id, {
+      id: header.id,
+      header,
+      title,
+      children: [],
+      seedLength: header.seedLength,
+      depth: 0,
+      row: 0,
+    })
+  }
+  const roots: ForkNode[] = []
+  for (const node of nodes.values()) {
+    const parentId = node.header.parentSession
+    if (parentId === undefined) {
+      roots.push(node)
+      continue
+    }
+    const parent = nodes.get(parentId)
+    if (parent === undefined) {
+      node.orphan = true
+      roots.push(node)
+    } else {
+      parent.children.push(node)
+    }
+  }
+  const byCreated = (a: ForkNode, b: ForkNode): number =>
+    a.header.createdAt - b.header.createdAt || a.id.localeCompare(b.id)
+  roots.sort(byCreated)
+  for (const node of nodes.values()) node.children.sort(byCreated)
+
+  // Cycle guard (corrupt lineage should degrade, not hang): DFS with visited set.
+  let row = 0
+  let maxDepth = 0
+  const visited = new Set<string>()
+  const assign = (node: ForkNode, depth: number): void => {
+    if (visited.has(node.id)) return
+    visited.add(node.id)
+    node.depth = depth
+    node.row = row++
+    maxDepth = Math.max(maxDepth, depth)
+    for (const child of node.children) assign(child, depth + 1)
+  }
+  for (const root of roots) assign(root, 0)
+  // Lineage cycles have no root: promote one unvisited member per cycle.
+  for (const node of nodes.values()) {
+    if (!visited.has(node.id)) {
+      node.orphan = true
+      roots.push(node)
+      assign(node, 0)
+    }
+  }
+  return { roots, nodes, rowCount: row, maxDepth }
+}
+
+/** Path from root to the given session (inclusive), for breadcrumbs. */
+export function lineageOf(forest: ForkForest, id: string): ForkNode[] {
+  const path: ForkNode[] = []
+  let current = forest.nodes.get(id)
+  const guard = new Set<string>()
+  while (current !== undefined && !guard.has(current.id)) {
+    guard.add(current.id)
+    path.unshift(current)
+    const parentId = current.header.parentSession
+    current = parentId === undefined ? undefined : forest.nodes.get(parentId)
+  }
+  return path
+}

package/src/core/index.ts

@@ -0,0 +1,7 @@
+export * from './types.js'
+export * from './decode.js'
+export * from './timeline.js'
+export * from './audit.js'
+export * from './forktree.js'
+export * from './compare.js'
+export * from './cost.js'