agenticreplay 0.1.0 → 0.1.2

package/packages/shell-shim/test/transport-race.test.ts

@@ -1,109 +0,0 @@
-import { existsSync } from 'node:fs';
-import { lstat, mkdir, mkdtemp, readFile, rename, rm, symlink, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-const attack = vi.hoisted(() => ({
-  kind: '',
-  phase: 'acl',
-  target: '',
-  transport: '',
-  displaced: '',
-}));
-
-vi.mock('node:fs/promises', async (importOriginal) => {
-  const fs = await importOriginal<typeof import('node:fs/promises')>();
-  return {
-    ...fs,
-    writeFile: async (...args: Parameters<typeof fs.writeFile>) => {
-      const path = String(args[0]);
-      if (
-        attack.kind &&
-        ((attack.phase === 'frames' && path.endsWith('shell-frames.jsonl')) ||
-          (attack.phase === 'shims' && path.endsWith('sh.cmd')))
-      ) {
-        if (attack.phase === 'frames') {
-          attack.transport = path.slice(0, -'shell-frames.jsonl'.length - 1);
-        }
-        attack.displaced = `${attack.transport}.displaced`;
-        await fs.rename(attack.transport, attack.displaced);
-        await fs.symlink(attack.target, attack.transport, 'junction');
-        attack.kind = '';
-      }
-      return fs.writeFile(...args);
-    },
-  };
-});
-
-vi.mock('@agenticreplay/core', async (importOriginal) => {
-  const core = await importOriginal<typeof import('@agenticreplay/core')>();
-  return {
-    ...core,
-    restrictToOwner: async (path: string, mode: 0o600 | 0o700) => {
-      if (attack.phase === 'shims' && path.includes('agenticreplay-shell-'))
-        attack.transport = path;
-      if (attack.kind && attack.phase === 'acl' && path.includes('agenticreplay-shell-')) {
-        attack.transport = path;
-        attack.displaced = `${path}.displaced`;
-        await rename(path, attack.displaced);
-        if (attack.kind === 'junction') await symlink(attack.target, path, 'junction');
-        else if (attack.kind === 'directory') await mkdir(path);
-        else throw new Error('injected ACL failure');
-      }
-      await core.restrictToOwner(path, mode);
-    },
-  };
-});
-
-const { installShellShim } = await import('../src/index.js');
-
-describe.runIf(process.platform === 'win32')('shell transport replacement', () => {
-  let root: string;
-
-  afterEach(async () => {
-    attack.kind = '';
-    attack.phase = 'acl';
-    // All targets are test-created children or the exact mkdtemp captured above. Never recurse
-    // through the injected junction; the attacker's marker must survive installation failure.
-    if (attack.transport && existsSync(attack.transport)) {
-      if ((await lstat(attack.transport)).isSymbolicLink()) await rm(attack.transport);
-      else await rm(attack.transport, { recursive: true, force: true });
-    }
-    if (attack.displaced) await rm(attack.displaced, { recursive: true, force: true });
-    if (root) await rm(root, { recursive: true, force: true });
-    attack.transport = '';
-    attack.displaced = '';
-  });
-
-  it.each(['junction', 'directory', 'missing'])(
-    'refuses a %s swapped in during ACL setup',
-    async (kind) => {
-      root = await mkdtemp(join(tmpdir(), 'agenticreplay-transport-race-'));
-      attack.target = join(root, 'attacker');
-      await mkdir(attack.target);
-      await writeFile(join(attack.target, 'keep'), 'attacker data');
-      attack.kind = kind;
-
-      await expect(installShellShim({ runDir: root })).rejects.toThrow();
-      expect(existsSync(join(attack.target, 'shell-frames.jsonl'))).toBe(false);
-      expect(await readFile(join(attack.target, 'keep'), 'utf8')).toBe('attacker data');
-      expect(existsSync(join(root, 'shims'))).toBe(false);
-    },
-  );
-
-  it.each(['frames', 'shims'])(
-    'refuses a replacement during %s creation after narrowing',
-    async (phase) => {
-      root = await mkdtemp(join(tmpdir(), 'agenticreplay-transport-race-'));
-      attack.target = join(root, 'attacker');
-      await mkdir(attack.target);
-      await writeFile(join(attack.target, 'keep'), 'attacker data');
-      attack.phase = phase;
-      attack.kind = 'junction';
-
-      await expect(installShellShim({ runDir: root })).rejects.toThrow(/is a link|was replaced/);
-      expect(await readFile(join(attack.target, 'keep'), 'utf8')).toBe('attacker data');
-    },
-  );
-});

package/packages/shell-shim/tsconfig.json

@@ -1,13 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src"
-  },
-  "include": ["src/**/*.ts"],
-  "references": [
-    {
-      "path": "../schema"
-    }
-  ]
-}

package/packages/viewer/package.json

@@ -1,25 +0,0 @@
-{
-  "name": "@agenticreplay/viewer",
-  "version": "0.5.0",
-  "type": "module",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/askdkc/AgenticReplay.git",
-    "directory": "packages/viewer"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": "./dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "dependencies": {
-    "@agenticreplay/schema": "0.5.0"
-  },
-  "engines": {
-    "node": ">=24.0.0"
-  }
-}

package/packages/viewer/src/bundle.ts

@@ -1,36 +0,0 @@
-/**
- * Minifies the client runtime for inlining.
- *
- * esbuild is a repo-root build tool, not a dependency of this package: a published
- * `@agenticreplay/viewer` ships `dist` only and must render without it. So the import is dynamic
- * and guarded, and the readable source is a first-class fallback rather than an error path —
- * `renderTraceHtml` stays synchronous and correct either way.
- */
-
-import { CLIENT_SOURCE } from './client/main.js';
-
-/** The client runtime as a single minified IIFE with no imports. */
-export async function bundleViewerScript(): Promise<string> {
-  try {
-    const esbuild = await import('esbuild');
-    const result = await esbuild.build({
-      stdin: {
-        contents: CLIENT_SOURCE,
-        loader: 'js',
-        sourcefile: 'agenticreplay-viewer-client.js',
-      },
-      bundle: true,
-      format: 'iife',
-      target: 'es2019',
-      minify: true,
-      write: false,
-      legalComments: 'none',
-    });
-    const text = result.outputFiles?.[0]?.text;
-    return text ? text.trim() : CLIENT_SOURCE;
-  } catch {
-    // No esbuild (published install, offline CI): ship the readable source. Same behaviour,
-    // a few kilobytes larger. Never a reason to fail an export.
-    return CLIENT_SOURCE;
-  }
-}

package/packages/viewer/src/client/main.ts

@@ -1,248 +0,0 @@
-/**
- * The viewer's entire client runtime, held as source text so that `renderTraceHtml` stays
- * synchronous and the published package carries no build-time coupling to its own sources.
- * `bundleViewerScript()` in `../bundle.ts` minifies this with esbuild when it is available.
- *
- * Two rules keep the XSS surface at exactly one function (`escapeHtml`, server side):
- *   1. this script never turns a string into markup — no innerHTML, no insertAdjacentHTML;
- *   2. no trace content is ever interpolated into it.
- * Plain ES2019, no framework, no polyfills, no network.
- */
-export const CLIENT_SOURCE = `
-(function () {
-  'use strict';
-
-  var root = document.documentElement;
-  var rows = [].slice.call(document.querySelectorAll('.row'));
-  var panes = [].slice.call(document.querySelectorAll('.pane'));
-  var filterBox = document.getElementById('agenticreplay-filter');
-  var countBox = document.getElementById('agenticreplay-count');
-  var themeBtn = document.getElementById('agenticreplay-theme');
-  var playBtn = document.getElementById('agenticreplay-play');
-  var speedBtn = document.getElementById('agenticreplay-speed');
-  var progressBar = document.getElementById('agenticreplay-progress');
-  var playhead = document.getElementById('agenticreplay-playhead');
-  // Guarded rather than assumed: this script is also evaluated outside a full browser global
-  // (its own test harness runs it against a DOM stub), and motion is the first thing that should
-  // degrade, never the navigation.
-  var mq = typeof window !== 'undefined' && window.matchMedia;
-  var reduced = mq ? window.matchMedia('(prefers-reduced-motion: reduce)').matches : false;
-  var SPEEDS = [1, 4, 16];
-  var speedIndex = 0;
-  var timer = null;
-  var playing = false;
-  var haystack = rows.map(function (row) { return (row.textContent || '').toLowerCase(); });
-  var selected = rows.length ? 0 : -1;
-
-  function shown() {
-    return rows.filter(function (row) { return !row.hidden; });
-  }
-
-  function select(index, moveFocus) {
-    if (index < 0 || index >= rows.length) return;
-    var back = selected >= 0 && index < selected;
-    for (var i = 0; i < rows.length; i++) {
-      var on = i === index;
-      rows[i].setAttribute('aria-selected', on ? 'true' : 'false');
-      rows[i].tabIndex = on ? 0 : -1;
-      if (panes[i]) panes[i].hidden = !on;
-    }
-    selected = index;
-    if (!reduced && panes[index]) {
-      // Restart the animation on every move: removing then forcing layout is the only reliable
-      // way to replay a CSS animation on an element that never left the DOM.
-      var pane = panes[index];
-      pane.removeAttribute('data-dir');
-      void pane.offsetWidth;
-      pane.setAttribute('data-dir', back ? 'up' : 'down');
-    }
-    if (moveFocus) rows[index].focus();
-    rows[index].scrollIntoView({ block: 'nearest' });
-    movePlayhead();
-    updateProgress();
-  }
-
-  function movePlayhead() {
-    if (!playhead || selected < 0) return;
-    var row = rows[selected];
-    playhead.style.height = row.offsetHeight + 'px';
-    playhead.style.transform = 'translateY(' + row.offsetTop + 'px)';
-    playhead.setAttribute('data-on', 'true');
-  }
-
-  function updateProgress() {
-    if (!progressBar || !rows.length) return;
-    var fraction = rows.length < 2 ? 1 : selected / (rows.length - 1);
-    progressBar.style.transform = 'scaleX(' + (selected < 0 ? 0 : fraction) + ')';
-  }
-
-  /**
-   * Hold on each row for as long as the recording says the gap was, compressed. A uniform tick
-   * would be simpler and would throw away the only thing playback adds over pressing j: the feel
-   * of where the run stalled and where it span.
-   */
-  function delayFor(index) {
-    var list = shown();
-    var at = list.indexOf(rows[index]);
-    if (at <= 0) return 0;
-    var previous = Number(list[at - 1].getAttribute('data-mono')) || 0;
-    var current = Number(list[at].getAttribute('data-mono')) || 0;
-    var gapMs = Math.max(0, (current - previous) / 1000);
-    var compressed = Math.sqrt(gapMs / SPEEDS[speedIndex]) * 24;
-    return Math.min(1000, Math.max(60, Math.round(compressed)));
-  }
-
-  function pulse(index) {
-    if (reduced || !rows[index]) return;
-    if (rows[index].getAttribute('data-tone') !== 'attention') return;
-    rows[index].removeAttribute('data-pulse');
-    void rows[index].offsetWidth;
-    rows[index].setAttribute('data-pulse', 'true');
-  }
-
-  function setPlaying(on, stepNow) {
-    playing = on;
-    if (playBtn) playBtn.setAttribute('aria-pressed', on ? 'true' : 'false');
-    if (!on && timer) { clearTimeout(timer); timer = null; }
-    if (!on) return;
-    // Stepping immediately is what makes pressing play feel responsive — except on a restart,
-    // where we have just moved to the first row and stepping now would skip straight past it.
-    if (stepNow === false) timer = setTimeout(tick, delayFor(selected));
-    else tick();
-  }
-
-  function tick() {
-    if (!playing) return;
-    var list = shown();
-    if (!list.length) { setPlaying(false); return; }
-    var at = selected < 0 ? -1 : list.indexOf(rows[selected]);
-    if (at >= list.length - 1) { setPlaying(false); return; }
-    var nextIndex = rows.indexOf(list[at + 1]);
-    select(nextIndex, false);
-    pulse(nextIndex);
-    timer = setTimeout(tick, delayFor(nextIndex));
-  }
-
-  function togglePlay() {
-    if (playing) { setPlaying(false); return; }
-    var list = shown();
-    if (!list.length) return;
-    // Reaching the end and pressing play again starts over, rather than doing nothing.
-    var atEnd = selected < 0 || list.indexOf(rows[selected]) >= list.length - 1;
-    if (atEnd) {
-      select(rows.indexOf(list[0]), false);
-      setPlaying(true, false);
-      return;
-    }
-    setPlaying(true);
-  }
-
-  /** Any manual navigation takes the wheel back. */
-  function interrupt() {
-    if (playing) setPlaying(false);
-  }
-
-  function step(delta) {
-    interrupt();
-    var list = shown();
-    if (!list.length) return;
-    var at = selected < 0 ? -1 : list.indexOf(rows[selected]);
-    var next = at < 0 ? 0 : Math.min(list.length - 1, Math.max(0, at + delta));
-    select(rows.indexOf(list[next]), true);
-  }
-
-  function jump(toEnd) {
-    interrupt();
-    var list = shown();
-    if (!list.length) return;
-    select(rows.indexOf(toEnd ? list[list.length - 1] : list[0]), true);
-  }
-
-  function applyFilter() {
-    var q = (filterBox ? filterBox.value : '').toLowerCase().trim();
-    var visible = 0;
-    for (var i = 0; i < rows.length; i++) {
-      var on = q === '' || haystack[i].indexOf(q) >= 0;
-      rows[i].hidden = !on;
-      if (on) visible++;
-    }
-    if (countBox) {
-      countBox.textContent = q === ''
-        ? rows.length + (rows.length === 1 ? ' event' : ' events')
-        : visible + ' of ' + rows.length;
-    }
-    if (visible && selected >= 0 && rows[selected].hidden) select(rows.indexOf(shown()[0]), false);
-    else movePlayhead();
-  }
-
-  for (var i = 0; i < rows.length; i++) {
-    (function (index) {
-      rows[index].addEventListener('click', function () { interrupt(); select(index, false); });
-    })(i);
-  }
-
-  if (filterBox) filterBox.addEventListener('input', function () { interrupt(); applyFilter(); });
-
-  document.addEventListener('keydown', function (e) {
-    if (e.ctrlKey || e.metaKey || e.altKey) return;
-    var tag = e.target && e.target.tagName;
-    if (tag === 'INPUT' || tag === 'TEXTAREA') {
-      if (e.key === 'Escape') {
-        e.preventDefault();
-        if (filterBox) { filterBox.value = ''; applyFilter(); filterBox.blur(); }
-        if (rows.length) select(selected < 0 ? 0 : selected, true);
-      } else if (e.key === 'Enter' || e.key === 'ArrowDown') {
-        e.preventDefault();
-        var list = shown();
-        if (list.length) select(rows.indexOf(list[0]), true);
-      }
-      return;
-    }
-    if (e.key === ' ' || e.key === 'Spacebar') { e.preventDefault(); togglePlay(); }
-    else if (e.key === '/') { e.preventDefault(); if (filterBox) filterBox.focus(); }
-    else if (e.key === 'j' || e.key === 'ArrowDown') { e.preventDefault(); step(1); }
-    else if (e.key === 'k' || e.key === 'ArrowUp') { e.preventDefault(); step(-1); }
-    else if (e.key === 'Home') { e.preventDefault(); jump(false); }
-    else if (e.key === 'End') { e.preventDefault(); jump(true); }
-  });
-
-  function readTheme() {
-    try { return localStorage.getItem('agenticreplay-theme'); } catch (err) { return null; }
-  }
-  function writeTheme(value) {
-    try {
-      if (value) localStorage.setItem('agenticreplay-theme', value);
-      else localStorage.removeItem('agenticreplay-theme');
-    } catch (err) { /* private mode, blocked storage: the page still works */ }
-  }
-  function applyTheme(value) {
-    if (value === 'dark' || value === 'light') root.setAttribute('data-theme', value);
-    else root.removeAttribute('data-theme');
-    if (themeBtn) themeBtn.textContent = value || 'auto';
-  }
-
-  applyTheme(readTheme());
-  if (themeBtn) {
-    themeBtn.addEventListener('click', function () {
-      var current = root.getAttribute('data-theme');
-      var next = current === 'dark' ? 'light' : current === 'light' ? null : 'dark';
-      applyTheme(next);
-      writeTheme(next);
-    });
-  }
-
-  if (playBtn) playBtn.addEventListener('click', togglePlay);
-  if (speedBtn) {
-    speedBtn.addEventListener('click', function () {
-      speedIndex = (speedIndex + 1) % SPEEDS.length;
-      speedBtn.textContent = SPEEDS[speedIndex] + '\u00d7';
-    });
-  }
-  if (typeof window !== 'undefined' && window.addEventListener) {
-    window.addEventListener('resize', movePlayhead);
-  }
-
-  applyFilter();
-  if (rows.length) { movePlayhead(); updateProgress(); }
-})();
-`;

package/packages/viewer/src/credit.ts

@@ -1,24 +0,0 @@
-/**
- * The credit line every artefact agenticreplay hands out carries.
- *
- * Two surfaces show it — the exported HTML page (`html.ts`) and the SVG cards the CLI renders
- * (`cli/src/share-card.ts`) — and they have to agree, because a run someone forwards is often the
- * first time anyone sees this project's name. It lived as a duplicated literal in both packages
- * until they had to say something longer than the repo URL; one constant is what stops them
- * drifting the next time it changes.
- *
- * Split into two halves because the media differ: the HTML footer is one line with no width to
- * respect, while a 720px card sets the halves against opposite margins. Together they are 97
- * characters, which is why the card sets them a size smaller than its other rows — at 11px they
- * leave 24px between them, and a monospace fallback advancing 0.66em rather than the usual 0.6em
- * overlaps them by 40px. At 10px the gap is 82px and no plausible fallback closes it.
- */
-
-/** Who made the thing you are looking at. */
-export const CREDIT_MADE_BY = 'Recorded with AgenticReplay';
-
-/** Where to go next. Deliberately the repository, not a product page. */
-export const CREDIT_REPO = 'github.com/askdkc/AgenticReplay';
-
-/** Both halves, for a surface with room for one line. */
-export const CREDIT_LINE = `${CREDIT_MADE_BY} · ${CREDIT_REPO}`;