@mingozhou/dsh-replay 0.4.1 → 0.4.2

package/lib/types/src/client/api.d.ts

@@ -2,10 +2,49 @@ import type { ParsedSession, SessionHeader } from '../core/types.js';
 export interface SessionEntry {
     header: SessionHeader;
     title?: string;
+    live?: boolean;
+}
+export interface SessionSummaryData {
+    events: number;
+    turns: number;
+    steps: number;
+    toolCalls: number;
+    toolErrors: number;
+    durationMs: number;
+    models: string[];
+    tokens: {
+        input: number;
+        output: number;
+        cacheRead: number;
+        cacheWrite: number;
+        reasoning: number;
+        billedInput: number;
+    };
+    modelTotals: Record<string, {
+        input: number;
+        output: number;
+        cacheRead: number;
+        cacheWrite: number;
+        reasoning: number;
+        billedInput: number;
+    }>;
+    findings: number;
+    critical: number;
+    serious: number;
+    warning: number;
+    info: number;
+}
+export interface SessionSummaryEntry {
+    header: SessionHeader;
+    title?: string;
+    live?: boolean;
+    summary?: SessionSummaryData;
+    error?: string;
 }
 export interface ReplayApi {
     listSessions: () => Promise<SessionEntry[]>;
     getSession: (id: string) => Promise<ParsedSession>;
+    getSummaries?: (limit?: number) => Promise<SessionSummaryEntry[]>;
     /** Source of the standalone viewer bundle, for HTML export (optional). */
     getViewerSource?: () => Promise<string>;
 }
@@ -15,6 +54,7 @@ export declare class HttpReplayApi implements ReplayApi {
     private fetchJson;
     listSessions(): Promise<SessionEntry[]>;
     getSession(id: string): Promise<ParsedSession>;
+    getSummaries(limit?: number): Promise<SessionSummaryEntry[]>;
     getViewerSource(): Promise<string>;
 }
 /** Demo/testing implementation over raw JSONL texts keyed by session id. */
@@ -36,8 +76,12 @@ export declare class StaticReplayApi implements ReplayApi {
     getViewerSource(): Promise<string>;
     listSessions(): Promise<SessionEntry[]>;
     getSession(id: string): Promise<ParsedSession>;
+    getSummaries(limit?: number): Promise<SessionSummaryEntry[]>;
 }
 export declare function formatDuration(ms: number): string;
 export declare function formatTokens(n: number): string;
+/** Clock offset from the session start: mm:ss, or h:mm:ss for long sessions. */
 export declare function formatClock(time: number, startTime: number): string;
+/** Human relative time for the session picker ("3 days ago", "2 months ago"). */
+export declare function formatRelativeTime(time: number, now?: number, lang?: 'en' | 'zh'): string;
 export declare function shortId(id: string): string;

package/lib/types/src/client/components/AuditView.d.ts

@@ -1,8 +1,9 @@
 import React from 'react';
 import type { AuditReport } from '../../core/audit.js';
 import type { TimelineModel } from '../../core/timeline.js';
-export declare function AuditView({ report, model, onJump, }: {
+export declare function AuditView({ report, model, onJump, sessionId, }: {
     report: AuditReport;
     model: TimelineModel;
     onJump: (seq: number) => void;
+    sessionId?: string;
 }): React.ReactElement;

package/lib/types/src/client/components/CompareView.d.ts

@@ -1,9 +1,10 @@
 import React from 'react';
 import type { ParsedSession } from '../../core/types.js';
 import { type ReplayApi, type SessionEntry } from '../api.js';
-export declare function CompareView({ api, session, entries, title, }: {
+export declare function CompareView({ api, session, entries, title, onOpenSession, }: {
     api: ReplayApi;
     session: ParsedSession;
     entries: SessionEntry[];
     title?: string;
+    onOpenSession?: (id: string) => void;
 }): React.ReactElement;

package/lib/types/src/client/components/DashboardView.d.ts

@@ -0,0 +1,8 @@
+import React from 'react';
+import { type SessionEntry, type SessionSummaryEntry } from '../api.js';
+export declare function DashboardView({ entries, summaries, loading, onPick, }: {
+    entries: SessionEntry[];
+    summaries: SessionSummaryEntry[];
+    loading: boolean;
+    onPick: (id: string) => void;
+}): React.ReactElement;

package/lib/types/src/client/components/ExportDialog.d.ts

@@ -0,0 +1,9 @@
+import React from 'react';
+import type { ParsedSession } from '../../core/types.js';
+import { type ReplayApi } from '../api.js';
+export declare function ExportDialog({ api, session, title, onClose, }: {
+    api: ReplayApi;
+    session: ParsedSession;
+    title?: string;
+    onClose: () => void;
+}): React.ReactElement;

package/lib/types/src/client/components/ReplayApp.d.ts

@@ -1,12 +1,14 @@
 import React from 'react';
 import { type ReplayApi } from '../api.js';
 import { type Lang } from '../i18n.js';
-export declare function ReplayApp({ api, sessionId, initialLang, onSwitchSession, }: {
+export declare function ReplayApp({ api, sessionId, initialLang, onSwitchSession, standalone, }: {
     api: ReplayApi;
-    /** Omit to start on the session picker (modal / standalone modes). */
+    /** Omit to start on the session archive (modal / standalone modes). */
     sessionId?: string;
     /** Override the detected language ('en' | 'zh'). */
     initialLang?: Lang;
     /** Optional host-provided navigation; falls back to internal state. */
     onSwitchSession?: (id: string) => void;
+    /** Exported HTML viewer: one session, no archive/forks/compare/export. */
+    standalone?: boolean;
 }): React.ReactElement;

package/lib/types/src/client/components/ReplayModal.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
 import type { ReplayApi } from '../api.js';
-/** Full-screen modal hosting the replay app, opened from the sidebar button. */
+/** Full-screen modal hosting the session review app, opened from the sidebar. */
 export declare function ReplayModal({ api, onClose, closeLabel, }: {
     api: ReplayApi;
     onClose: () => void;

package/lib/types/src/client/components/SessionPicker.d.ts

@@ -1,6 +1,7 @@
 import React from 'react';
-import { type ReplayApi } from '../api.js';
-export declare function SessionPicker({ api, onPick, }: {
-    api: ReplayApi;
+import { type SessionEntry } from '../api.js';
+export declare function SessionPicker({ entries, loading, onPick, }: {
+    entries: SessionEntry[];
+    loading?: boolean;
     onPick: (id: string) => void;
 }): React.ReactElement;

package/lib/types/src/client/components/TimelineView.d.ts

@@ -1,6 +1,7 @@
 import React from 'react';
 import type { TimelineModel } from '../../core/timeline.js';
-export declare function TimelineView({ model, jumpToSeq, }: {
+export declare function TimelineView({ model, jumpToSeq, jumpNonce, }: {
     model: TimelineModel;
     jumpToSeq?: number;
+    jumpNonce?: number;
 }): React.ReactElement;

package/lib/types/src/client/export.d.ts

@@ -9,5 +9,10 @@ export interface ExportSession {
     events: ParsedSession['events'];
     title?: string;
 }
-export declare function buildReplayHtml(viewerSource: string, sessions: ExportSession[]): string;
+export interface BuildReplayOptions {
+    lang?: 'en' | 'zh';
+    title?: string;
+}
+export declare function buildReplayHtml(viewerSource: string, sessions: ExportSession[], options?: BuildReplayOptions): string;
 export declare function downloadReplayHtml(html: string, filename: string): void;
+export declare function formatBytes(bytes: number): string;

package/lib/types/src/client/i18n.d.ts

@@ -1,7 +1,10 @@
 /**
- * Lightweight EN/中文 i18n for the replay UI. The dictionary is plain data;
+ * Lightweight EN/中文 i18n for the review UI. The dictionary is plain data;
  * `useI18n()` provides `t(key, params)` plus the current language and setter.
  * Language resolution: explicit choice (persisted) > browser language > en.
+ *
+ * A tiny external store keeps the sidebar button, the modal chrome and the
+ * embedded app in sync when the language is toggled from any of them.
  */
 import React from 'react';
 export type Lang = 'en' | 'zh';
@@ -9,6 +12,10 @@ export type T = (key: string, params?: Record<string, string | number>) => strin
 export declare function makeT(lang: Lang): T;
 export declare function detectLang(): Lang;
 export declare function persistLang(lang: Lang): void;
+export declare function getLang(): Lang;
+export declare function setLang(lang: Lang): void;
+export declare function subscribeLang(listener: () => void): () => void;
+export declare function useLang(): Lang;
 export interface I18n {
     lang: Lang;
     t: T;

package/lib/types/src/client/pricing.d.ts

@@ -0,0 +1,6 @@
+import { type PricingEntry, type PricingRate } from '../core/cost.js';
+export declare function getPricing(): PricingEntry[];
+export declare function setRate(label: string, rate: PricingRate): void;
+export declare function resetPricing(): void;
+export declare function subscribePricing(listener: () => void): () => void;
+export declare function usePricing(): PricingEntry[];

package/lib/types/src/core/audit.d.ts

@@ -3,14 +3,24 @@
  * with a severity, grouped for the audit view. Rules are data, not code —
  * extend `DEFAULT_RULES` or pass your own list.
  *
+ * Design goals, in order:
+ *  1. Signal, not activity. A clean session should produce zero findings;
+ *     routine file writes and ordinary network reads are not "risks".
+ *  2. Windows is a first-class platform. `pwsh`, PowerShell aliases and
+ *     Windows paths are scanned just like bash on Unix.
+ *  3. Baseline is not a finding. Every session starts with a permission
+ *     preset and sandbox mode; only a later *change* is interesting.
+ *
  * Severity vocabulary mirrors a standard status palette:
  * 'critical' | 'serious' | 'warning' | 'info'.
  */
 import type { ParsedSession, SessionEvent } from './types.js';
 export type Severity = 'critical' | 'serious' | 'warning' | 'info';
+export type AuditCategory = 'shell' | 'file' | 'network' | 'approval' | 'config' | 'error' | 'secret';
 export interface AuditFinding {
     ruleId: string;
     severity: Severity;
+    category?: AuditCategory;
     seq: number;
     time: number;
     /** English title (stable fallback). */
@@ -22,6 +32,7 @@ export interface AuditFinding {
 }
 export interface AuditRule {
     id: string;
+    category?: AuditCategory;
     severity: Severity | ((event: SessionEvent) => Severity);
     /** Return a finding title when the event matches, undefined otherwise. */
     match: (event: SessionEvent) => {
@@ -29,11 +40,18 @@ export interface AuditRule {
         detail?: string;
         messageKey?: string;
         params?: Record<string, string>;
+        category?: AuditCategory;
     } | undefined;
 }
 export interface AuditReport {
     findings: AuditFinding[];
     counts: Record<Severity, number>;
+    /** Number of raw events scanned. */
+    scanned: number;
+    /** Number of rules evaluated. */
+    rules: number;
+    /** Baseline/duplicate config events deliberately ignored. */
+    suppressed: number;
 }
 export declare const DEFAULT_RULES: AuditRule[];
 export declare function auditSession(session: ParsedSession, rules?: AuditRule[]): AuditReport;

package/lib/types/src/core/compare.d.ts

@@ -1,4 +1,4 @@
-import type { ParsedSession } from './types.js';
+import type { ParsedSession, SessionEvent } from './types.js';
 export interface CompareStats {
     id: string;
     title?: string;
@@ -15,6 +15,7 @@ export interface CompareStats {
     models: string[];
     toolMix: Record<string, number>;
 }
+export type CompareRelation = 'same' | 'a-parent-of-b' | 'b-parent-of-a' | 'siblings' | 'none';
 export interface CompareResult {
     a: CompareStats;
     b: CompareStats;
@@ -22,10 +23,14 @@ export interface CompareResult {
     toolNames: string[];
     /** First seq at which the two logs differ (comparing type+data), if computable. */
     divergenceSeq?: number;
-    /** True when one session is an ancestor/fork relative of the other. */
+    /** The first differing event on each side, for a side-by-side context view. */
+    divergenceA?: SessionEvent;
+    divergenceB?: SessionEvent;
+    /** True when one session is an ancestor/relative of the other (any depth). */
     related: boolean;
+    relation: CompareRelation;
 }
 export declare function compareSessions(a: ParsedSession, b: ParsedSession, titles?: {
     a?: string;
     b?: string;
-}): CompareResult;
+}, parentOf?: (id: string) => string | undefined): CompareResult;

package/lib/types/src/core/cost.d.ts

@@ -1,8 +1,8 @@
 /**
  * Cost estimation from token totals. Prices are USD per 1M tokens and are
- * ESTIMATES — provider list prices change; override the table if you need
- * exact numbers. Cache-write falls back to the input rate when a provider
- * doesn't price it separately.
+ * ESTIMATES — provider list prices change; the UI lets you override them.
+ * Cache-write falls back to the input rate when a provider doesn't price it
+ * separately.
  */
 import type { TokenTotals } from './timeline.js';
 export interface PricingRate {
@@ -19,6 +19,9 @@ export interface PricingEntry {
     match: RegExp;
     rate: PricingRate;
     label: string;
+    /** ISO date the default rates were last checked. */
+    updatedAt?: string;
+    source?: string;
 }
 /** Editable defaults — first match wins, most specific first. */
 export declare const DEFAULT_PRICING: PricingEntry[];
@@ -26,5 +29,20 @@ export interface CostEstimate {
     usd: number;
     label: string;
 }
+export interface CostPart extends CostEstimate {
+    model: string;
+    totals: TokenTotals;
+}
+export interface CostEstimateDetailed extends CostEstimate {
+    parts: CostPart[];
+}
 export declare function estimateCost(totals: TokenTotals, models: string[], pricing?: PricingEntry[]): CostEstimate | undefined;
+/**
+ * Per-model cost. A session can switch models mid-run; charging every token at
+ * the first matching rate over- or under-estimates the bill.
+ */
+export declare function estimateCostDetailed(modelTotals: Record<string, TokenTotals>, pricing?: PricingEntry[]): CostEstimateDetailed | undefined;
 export declare function formatUsd(usd: number): string;
+/** Approximate CNY amount at a caller-supplied exchange rate. */
+export declare function formatCny(usd: number, rate?: number): string;
+export declare function formatMoney(usd: number, currency: 'USD' | 'CNY', rate?: number): string;

package/lib/types/src/core/index.d.ts

@@ -5,3 +5,4 @@ export * from './audit.js';
 export * from './forktree.js';
 export * from './compare.js';
 export * from './cost.js';
+export * from './redact.js';

package/lib/types/src/core/redact.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Secret redaction for anything that leaves the process: exported HTML,
+ * audit details pasted into a report, and screenshots of the UI.
+ *
+ * This is deliberately conservative and pattern-based. It is a safety net,
+ * not a guarantee: the export dialog still warns that session logs can contain
+ * arbitrary user data.
+ */
+import type { ParsedSession } from './types.js';
+export interface RedactionResult {
+    text: string;
+    count: number;
+    kinds: string[];
+}
+/** Mask secrets in one string. */
+export declare function redactText(input: string): RedactionResult;
+/**
+ * True when the text looks like it contains a credential. Deliberately
+ * narrower than `redactText`: an email address or a home path is privacy
+ * sensitive, but not a reason to raise a critical audit finding.
+ */
+export declare function containsSecret(input: string): boolean;
+/**
+ * Deep-redact a JSON-like value. Keys are preserved; string values are
+ * redacted. Depth is bounded so a hostile log cannot exhaust the stack.
+ */
+export declare function redactValue<T>(value: T, depth?: number): {
+    value: T;
+    count: number;
+};
+export interface RedactSessionResult {
+    session: ParsedSession;
+    count: number;
+    kinds: string[];
+}
+/**
+ * Clone and redact a parsed session. Event envelopes (seq/time/type) are
+ * preserved so the viewer still works; only payload strings are masked.
+ */
+export declare function redactSession(session: ParsedSession): RedactSessionResult;

package/lib/types/src/core/timeline.d.ts

@@ -12,6 +12,8 @@ export interface ToolCallInfo {
     /** Raw argument JSON string exactly as the model produced it. */
     argumentsRaw: string;
     argumentsPretty?: string;
+    /** Short, human-readable summary (command/path/url/query) for the rail. */
+    summary?: string;
     resultText?: string;
     error?: {
         name: string;
@@ -75,6 +77,8 @@ export interface TimelineModel {
     /** Flat, seq-ordered list of everything renderable. */
     items: TimelineItem[];
     totals: TokenTotals;
+    /** Token totals split by model, for cache-aware multi-model cost. */
+    modelTotals: Record<string, TokenTotals>;
     /** Per assistant-step usage samples in order, for the token strip. */
     usageSamples: {
         seq: number;
@@ -93,4 +97,9 @@ export interface TimelineModel {
     /** Latest `session/title` event payload, when the log carries one. */
     title?: string;
 }
+/**
+ * Turn tool arguments into a label a human can scan. The raw JSON stays
+ * available in the detail panel; the rail should not be a wall of escapes.
+ */
+export declare function summarizeToolArguments(name: string, raw: string): string;
 export declare function buildTimeline(session: ParsedSession): TimelineModel;

package/lib/types/src/index.d.ts

@@ -4,11 +4,17 @@
  * Registers a small read-only HTTP API on the harness web server that the
  * browser half (and nothing else) consumes:
  *
- *   GET /replay/api/sessions            → { sessions: [{ header, title }] }
+ *   GET /replay/api/sessions            → { sessions: [{ header, title, live }] }
  *   GET /replay/api/session/<id>        → { header, events }
+ *   GET /replay/api/summary?limit=30    → aggregate stats for the dashboard
+ *   GET /replay/api/viewer.js           → standalone viewer bundle
  *
  * Reads go through `ctx.sessionQuery` (live-preferred corpus), so an open
  * session replays with its in-memory state, not a stale disk artifact.
+ *
+ * The API is intentionally loopback-only by default: session logs can contain
+ * secrets, and this route is registered directly on the web server rather than
+ * through the authenticated Connection fetch bridge.
  */
 import type { Context } from '@deepseek-ai/cordis';
 export declare const name = "dsh-replay";
@@ -16,5 +22,50 @@ export declare const inject: string[];
 export interface Config {
     /** URL prefix for the replay API (exact-prefix route). */
     routePrefix?: string;
+    /** Allow non-loopback clients. Off by default because the route is unauthenticated. */
+    allowRemote?: boolean;
+    /** Maximum sessions included in one dashboard summary request. */
+    summaryLimit?: number;
+}
+export interface SessionEntry {
+    header: Record<string, unknown>;
+    title?: string;
+    live?: boolean;
+}
+export interface SessionSummary {
+    header: Record<string, unknown>;
+    title?: string;
+    live?: boolean;
+    summary?: {
+        events: number;
+        turns: number;
+        steps: number;
+        toolCalls: number;
+        toolErrors: number;
+        durationMs: number;
+        models: string[];
+        tokens: {
+            input: number;
+            output: number;
+            cacheRead: number;
+            cacheWrite: number;
+            reasoning: number;
+            billedInput: number;
+        };
+        modelTotals: Record<string, {
+            input: number;
+            output: number;
+            cacheRead: number;
+            cacheWrite: number;
+            reasoning: number;
+            billedInput: number;
+        }>;
+        findings: number;
+        critical: number;
+        serious: number;
+        warning: number;
+        info: number;
+    };
+    error?: string;
 }
 export declare function apply(ctx: Context, config?: Config): void;