@mingozhou/dsh-replay 0.4.1 → 0.4.2

package/src/core/redact.ts

@@ -0,0 +1,182 @@
+/**
+ * Secret redaction for anything that leaves the process: exported HTML,
+ * audit details pasted into a report, and screenshots of the UI.
+ *
+ * This is deliberately conservative and pattern-based. It is a safety net,
+ * not a guarantee: the export dialog still warns that session logs can contain
+ * arbitrary user data.
+ */
+import type { ParsedSession, SessionEvent } from './types.js'
+
+export interface RedactionResult {
+  text: string
+  count: number
+  kinds: string[]
+}
+
+interface Rule {
+  kind: string
+  re: RegExp
+  // String.replace callbacks receive the match plus arbitrary capture/offset args.
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  replacement: string | ((substring: string, ...args: any[]) => string)
+}
+
+const RULES: Rule[] = [
+  { kind: 'openai-key', re: /\bsk-[A-Za-z0-9_-]{16,}\b/g, replacement: '[REDACTED:openai-key]' },
+  {
+    kind: 'github-token',
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
+    replacement: '[REDACTED:github-token]',
+  },
+  { kind: 'aws-key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: '[REDACTED:aws-key]' },
+  { kind: 'google-key', re: /\bAIza[0-9A-Za-z_-]{20,}\b/g, replacement: '[REDACTED:google-key]' },
+  { kind: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, replacement: '[REDACTED:slack-token]' },
+  {
+    kind: 'private-key',
+    re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    replacement: '[REDACTED:private-key]',
+  },
+  {
+    kind: 'jwt',
+    re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    replacement: '[REDACTED:jwt]',
+  },
+  {
+    kind: 'env-assignment',
+    re: /(\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE|CREDENTIAL)[A-Z0-9_]*\s*=\s*)(["']?)([^\s"'\\]{4,})\2/g,
+    replacement: (_m, prefix: string, quote: string) => `${prefix}${quote}[REDACTED]${quote}`,
+  },
+  {
+    kind: 'key-value',
+    re: /(["']?(?:api[_-]?key|secret|token|password|passwd|authorization|jwt[_-]?secret)["']?\s*[:=]\s*["']?)([^"'\s,}]{4,})/gi,
+    replacement: (_m, prefix: string) => `${prefix}[REDACTED]`,
+  },
+  { kind: 'bearer', re: /(\bBearer\s+)[A-Za-z0-9._~+/-]{8,}/gi, replacement: '$1[REDACTED]' },
+  {
+    kind: 'basic-auth-url',
+    re: /(https?:\/\/[^/\s:@]+:)([^@\s/]+)(@)/g,
+    replacement: '$1[REDACTED]$3',
+  },
+  { kind: 'windows-user', re: /([A-Za-z]:\\Users\\)([^\\\s"']+)/g, replacement: '$1[user]' },
+  { kind: 'unix-home', re: /(\/(?:home|Users)\/)([^/\s"']+)/g, replacement: '$1[user]' },
+  { kind: 'email', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, replacement: '[email]' },
+  { kind: 'session-id', re: /\bsession-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\b/gi, replacement: 'session-[id]' },
+]
+
+const CREDENTIAL_KINDS = new Set([
+  'openai-key',
+  'github-token',
+  'aws-key',
+  'google-key',
+  'slack-token',
+  'private-key',
+  'jwt',
+  'env-assignment',
+  'key-value',
+  'bearer',
+  'basic-auth-url',
+])
+
+/** Mask secrets in one string. */
+export function redactText(input: string): RedactionResult {
+  let text = input
+  let count = 0
+  const kinds = new Set<string>()
+  for (const rule of RULES) {
+    rule.re.lastIndex = 0
+    const matches = text.match(rule.re)
+    if (matches === null) continue
+    count += matches.length
+    kinds.add(rule.kind)
+    rule.re.lastIndex = 0
+    text = text.replace(rule.re, rule.replacement as string)
+  }
+  return { text, count, kinds: [...kinds] }
+}
+
+/**
+ * True when the text looks like it contains a credential. Deliberately
+ * narrower than `redactText`: an email address or a home path is privacy
+ * sensitive, but not a reason to raise a critical audit finding.
+ */
+export function containsSecret(input: string): boolean {
+  for (const rule of RULES) {
+    if (!CREDENTIAL_KINDS.has(rule.kind)) continue
+    rule.re.lastIndex = 0
+    const hit = rule.re.test(input)
+    rule.re.lastIndex = 0
+    if (hit) return true
+  }
+  return false
+}
+
+/**
+ * Deep-redact a JSON-like value. Keys are preserved; string values are
+ * redacted. Depth is bounded so a hostile log cannot exhaust the stack.
+ */
+export function redactValue<T>(value: T, depth = 0): { value: T; count: number } {
+  if (depth > 20) return { value, count: 0 }
+  if (typeof value === 'string') {
+    const result = redactText(value)
+    return { value: result.text as unknown as T, count: result.count }
+  }
+  if (Array.isArray(value)) {
+    let count = 0
+    const next = value.map(item => {
+      const result = redactValue(item, depth + 1)
+      count += result.count
+      return result.value
+    })
+    return { value: next as unknown as T, count }
+  }
+  if (typeof value === 'object' && value !== null) {
+    let count = 0
+    const next: Record<string, unknown> = {}
+    for (const [key, item] of Object.entries(value)) {
+      const result = redactValue(item, depth + 1)
+      count += result.count
+      next[key] = result.value
+    }
+    return { value: next as unknown as T, count }
+  }
+  return { value, count: 0 }
+}
+
+export interface RedactSessionResult {
+  session: ParsedSession
+  count: number
+  kinds: string[]
+}
+
+/**
+ * Clone and redact a parsed session. Event envelopes (seq/time/type) are
+ * preserved so the viewer still works; only payload strings are masked.
+ */
+export function redactSession(session: ParsedSession): RedactSessionResult {
+  let count = 0
+  const kinds = new Set<string>()
+  const header = { ...session.header }
+  for (const key of ['cwd', 'title'] as const) {
+    const value = (header as Record<string, unknown>)[key]
+    if (typeof value === 'string') {
+      const result = redactText(value)
+      ;(header as Record<string, unknown>)[key] = result.text
+      count += result.count
+      for (const kind of result.kinds) kinds.add(kind)
+    }
+  }
+  const events: SessionEvent[] = session.events.map(event => {
+    const data = redactValue(event.data)
+    count += data.count
+    if (data.count > 0) {
+      for (const rule of RULES) {
+        rule.re.lastIndex = 0
+        if (rule.re.test(JSON.stringify(event.data))) kinds.add(rule.kind)
+        rule.re.lastIndex = 0
+      }
+    }
+    return { ...event, data: data.value }
+  })
+  return { session: { ...session, header, events }, count, kinds: [...kinds] }
+}

package/src/core/timeline.ts

@@ -20,6 +20,8 @@ export interface ToolCallInfo {
   /** Raw argument JSON string exactly as the model produced it. */
   argumentsRaw: string
   argumentsPretty?: string
+  /** Short, human-readable summary (command/path/url/query) for the rail. */
+  summary?: string
   resultText?: string
   error?: { name: string; code: string }
   callSeq: number
@@ -85,6 +87,8 @@ export interface TimelineModel {
   /** Flat, seq-ordered list of everything renderable. */
   items: TimelineItem[]
   totals: TokenTotals
+  /** Token totals split by model, for cache-aware multi-model cost. */
+  modelTotals: Record<string, TokenTotals>
   /** Per assistant-step usage samples in order, for the token strip. */
   usageSamples: { seq: number; turn: number; step: number; usage: TokenUsage }[]
   toolCalls: ToolCallInfo[]
@@ -102,11 +106,44 @@ export interface TimelineModel {
 function contentText(message: MessageLike | undefined): string {
   if (!message?.content) return ''
   return message.content
-    .filter((b: ContentBlock) => typeof b.text === 'string')
+    .filter((b: ContentBlock) => typeof b.text === 'string' && b.type !== 'reasoning')
     .map((b: ContentBlock) => b.text)
     .join('')
 }
 
+function contentReasoning(message: MessageLike | undefined): string {
+  if (!message?.content) return ''
+  return message.content
+    .filter((b: ContentBlock) => b.type === 'reasoning' && typeof b.text === 'string')
+    .map((b: ContentBlock) => b.text)
+    .join('')
+}
+
+function oneLine(text: string, max: number): string {
+  return truncate(text.replaceAll(/\s+/gu, ' ').trim(), max)
+}
+
+/**
+ * Turn tool arguments into a label a human can scan. The raw JSON stays
+ * available in the detail panel; the rail should not be a wall of escapes.
+ */
+export function summarizeToolArguments(name: string, raw: string): string {
+  let args: Record<string, unknown> | undefined
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    if (typeof parsed === 'object' && parsed !== null) args = parsed as Record<string, unknown>
+  } catch {
+    args = undefined
+  }
+  if (args === undefined) return oneLine(raw, 64)
+  const keys = ['command', 'cmd', 'script', 'path', 'file_path', 'filePath', 'url', 'query', 'pattern', 'description']
+  for (const key of keys) {
+    const value = args[key]
+    if (typeof value === 'string' && value.trim() !== '') return oneLine(value, 64)
+  }
+  return name
+}
+
 function truncate(text: string, max = 96): string {
   const oneLine = text.replaceAll(/\s+/gu, ' ').trim()
   return oneLine.length > max ? `${oneLine.slice(0, max - 1)}…` : oneLine
@@ -193,10 +230,13 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
   const toolCallsBySeq = new Map<string, ToolCallInfo>()
   const toolCalls: ToolCallInfo[] = []
   const usageByStep = new Map<string, TokenUsage>()
+  const usageModelByStep = new Map<string, string>()
+  const modelTotals: Record<string, TokenTotals> = {}
   const models = new Set<string>()
   const shadowed = shadowedSeqs(events)
   let seedBoundarySeq: number | undefined
   let activeTurn: number | undefined
+  let activeModel: string | undefined
   let sessionTitle: string | undefined
 
   const ensureTurn = (turn: number, event: SessionEvent): TurnModel => {
@@ -264,15 +304,21 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
         const message = get(d, 'message') as MessageLike
         const usage = get(d, 'usage') as TokenUsage | undefined
         const text = contentText(message)
+        const reasoningText = contentReasoning(message)
         const source = message?.source as Record<string, unknown> | undefined
-        if (typeof source?.['model'] === 'string') models.add(source['model'])
+        if (typeof source?.['model'] === 'string') {
+          activeModel = source['model']
+          models.add(activeModel)
+        }
         if (usage) {
-          usageByStep.set(`${String(turn)}/${String(step)}`, usage)
+          const key = `${String(turn)}/${String(step)}`
+          usageByStep.set(key, usage)
+          if (activeModel !== undefined) usageModelByStep.set(key, activeModel)
         }
         push({
           kind: 'assistant', seq: event.seq, time: event.time,
           turn: turn as number, step: step as number, type: event.type,
-          label: truncate(text) || '(assistant message)', text, usage, event,
+          label: truncate(text) || '(assistant message)', text, reasoningText, usage, event,
         })
         break
       }
@@ -280,16 +326,23 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
         const chunk = get(d, 'chunk')
         if (get(chunk, 'type') === 'usage') {
           const usage = get(chunk, 'usage') as TokenUsage
-          usageByStep.set(`${String(turn)}/${String(step)}`, usage)
+          const key = `${String(turn)}/${String(step)}`
+          usageByStep.set(key, usage)
+          if (activeModel !== undefined && !usageModelByStep.has(key)) {
+            usageModelByStep.set(key, activeModel)
+          }
         }
         break
       }
       case 'tool/call': {
+        const raw = String(get(d, 'arguments') ?? '')
+        const name = String(get(d, 'name') ?? '')
         const info: ToolCallInfo = {
           callId: String(get(d, 'callId') ?? ''),
-          name: String(get(d, 'name') ?? ''),
-          argumentsRaw: String(get(d, 'arguments') ?? ''),
-          argumentsPretty: tryPretty(String(get(d, 'arguments') ?? '')),
+          name,
+          argumentsRaw: raw,
+          argumentsPretty: tryPretty(raw),
+          summary: summarizeToolArguments(name, raw),
           callSeq: event.seq,
           callTime: event.time,
         }
@@ -298,7 +351,8 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
         push({
           kind: 'tool', seq: event.seq, time: event.time,
           turn: turn as number, step: step as number, type: event.type,
-          label: `${info.name}(${truncate(info.argumentsRaw, 48)})`, toolCall: info, event,
+          label: info.summary === name ? name : `${name} · ${info.summary}`,
+          toolCall: info, event,
         })
         break
       }
@@ -309,9 +363,10 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
         const info = toolCallsBySeq.get(callId)
         const block = message?.content?.[0]
         const resultText =
-          typeof get(block, 'text') === 'string'
+          contentText(message) ||
+          (typeof get(block, 'text') === 'string'
             ? (get(block, 'text') as string)
-            : contentText({ content: get(block, 'content') as ContentBlock[] | undefined })
+            : contentText({ content: get(block, 'content') as ContentBlock[] | undefined }))
         const error = get(d, 'error') as { name: string; code: string } | undefined
         if (info) {
           info.resultSeq = event.seq
@@ -329,9 +384,35 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
           label: 'seed boundary (fork/resume point)', event,
         })
         break
+      case 'system/message': {
+        const message = get(d, 'message') as MessageLike
+        const text = contentText(message)
+        push({
+          kind: 'meta', seq: event.seq, time: event.time,
+          turn: typeof turn === 'number' ? turn : undefined,
+          step: typeof step === 'number' ? step : undefined,
+          type: event.type, label: 'system prompt', text, event,
+        })
+        break
+      }
+      case 'model/selection': {
+        const model = get(d, 'model')
+        if (typeof model === 'string' && model !== '') {
+          activeModel = model
+          models.add(model)
+          push({
+            kind: 'meta', seq: event.seq, time: event.time, type: event.type,
+            label: `model selected: ${model}`, event,
+          })
+        }
+        break
+      }
       case 'request/context': {
         const model = get(d, 'model')
-        if (typeof model === 'string') models.add(model)
+        if (typeof model === 'string') {
+          activeModel = model
+          models.add(model)
+        }
         break
       }
       case 'session/title': {
@@ -356,13 +437,26 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
 
   // Fold usage samples (already last-wins per turn/step via the map).
   const totals: TokenTotals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, billedInput: 0 }
+  const emptyTotals = (): TokenTotals => ({
+    input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, billedInput: 0,
+  })
   for (const [key, usage] of usageByStep) {
     const [turnStr, stepStr] = key.split('/')
+    const billed = usage.inputTokens + (usage.cacheReadTokens ?? 0) + (usage.cacheWriteTokens ?? 0)
     totals.input += usage.inputTokens
     totals.output += usage.outputTokens
     totals.cacheRead += usage.cacheReadTokens ?? 0
     totals.cacheWrite += usage.cacheWriteTokens ?? 0
     totals.reasoning += usage.reasoningTokens ?? 0
+    const modelName = usageModelByStep.get(key) ?? activeModel ?? 'unknown'
+    const modelTotal = modelTotals[modelName] ?? emptyTotals()
+    modelTotal.input += usage.inputTokens
+    modelTotal.output += usage.outputTokens
+    modelTotal.cacheRead += usage.cacheReadTokens ?? 0
+    modelTotal.cacheWrite += usage.cacheWriteTokens ?? 0
+    modelTotal.reasoning += usage.reasoningTokens ?? 0
+    modelTotal.billedInput += billed
+    modelTotals[modelName] = modelTotal
     const turnModel = turns.get(Number(turnStr))
     const stepModel = turnModel?.steps.find(s => s.step === Number(stepStr))
     if (stepModel) stepModel.usage = usage
@@ -383,6 +477,7 @@ export function buildTimeline(session: ParsedSession): TimelineModel {
     turns: orderedTurns,
     items,
     totals,
+    modelTotals,
     usageSamples,
     toolCalls,
     durationMs: endTime - startTime,