repoburg 1.3.255 → 1.3.256

package/daemon/dist/tabtape/mcp/server.spec.js

@@ -0,0 +1,722 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_1 = __importDefault(require("http"));
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const log_1 = require("../log");
+const reader_1 = require("../query/reader");
+const redact_1 = require("../redact");
+const record_1 = require("../store/record");
+const store_1 = require("../store/store");
+const qt = __importStar(require("../testing/querytest"));
+const tmp_1 = require("../testing/tmp");
+const server_1 = require("./server");
+const t0 = qt.T0;
+const site = 'http://localhost:7788';
+const base = 'http://127.0.0.1:9998/tabtape';
+function demo(st, id, startedAt) {
+    qt.start(st, id, startedAt, site + '/', 'Acme Shop');
+    const u = site + '/';
+    qt.append(st, id, qt.pageView(startedAt, 'start', u, 'Acme Shop'), qt.rrMeta(startedAt + 10, u, 1440, 900), qt.rrFull(startedAt + 10), qt.click(startedAt + 1000, u, { tag: 'button', id: 'load-products', selector: 'button#load-products', text: 'Load products' }), qt.net(startedAt + 1100, { kind: 'fetch', method: 'GET', url: site + '/api/products', status: 200, duration: 8, resBody: '[{"name":"Trail shoes"}]' }), qt.net(startedAt + 2000, {
+        kind: 'fetch',
+        method: 'POST',
+        url: site + '/api/login',
+        status: 200,
+        reqHeaders: { authorization: 'Bearer test-token', 'content-type': 'application/json' },
+        reqBody: '{"email":"a@b.c","password":"********"}',
+        resBody: '{"ok":true}',
+    }), qt.click(startedAt + 3000, u, { tag: 'button', id: 'broken', selector: 'button#broken', text: 'Broken API' }), qt.net(startedAt + 3100, {
+        kind: 'fetch',
+        method: 'GET',
+        url: site + '/api/broken',
+        status: 500,
+        duration: 12,
+        resBody: '{"error":"kaboom","detail":"database connection refused"}',
+    }), qt.click(startedAt + 4000, u, { tag: 'button', id: 'throw', selector: 'button#throw', text: 'Throw error' }), qt.consoleRec(startedAt + 4010, {
+        level: 'error',
+        source: 'uncaught',
+        text: 'Boom from test page',
+        stack: 'Error: Boom from test page\n    at index.html:88:40',
+        url: site + '/',
+        line: 88,
+    }), qt.consoleRec(startedAt + 4500, { level: 'log', source: 'console', text: 'hello from the page' }), qt.pageView(startedAt + 6000, 'load', site + '/b.html', 'Page B'), qt.rrInc(startedAt + 6500));
+    st.end(id, startedAt + 7000);
+}
+/** Run after each test, last added first: clients close before their servers. */
+const cleanups = [];
+afterEach(async () => {
+    while (cleanups.length)
+        await cleanups.pop()();
+    await qt.closeTestStores();
+    (0, tmp_1.cleanupTempDirs)();
+});
+function mcpFor(st, opts = {}) {
+    return new server_1.TabtapeMcp(st, new reader_1.Reader(st), {
+        version: 'test',
+        baseURL: base,
+        redact: new redact_1.RedactHeaders(),
+        showSecrets: false,
+        token: '',
+        recordToken: '',
+        logger: log_1.silentLogger,
+        timeZone: 'UTC',
+        now: () => t0 + 60000,
+        ...opts,
+    });
+}
+/** Serves mcp on an ephemeral port and returns its endpoint. */
+async function listen(mcp) {
+    const srv = http_1.default.createServer((req, res) => {
+        void mcp.handle(req, res);
+    });
+    await new Promise((resolve) => srv.listen(0, '127.0.0.1', resolve));
+    cleanups.push(() => new Promise((resolve) => {
+        srv.closeAllConnections();
+        srv.close(() => resolve());
+    }));
+    return `http://127.0.0.1:${srv.address().port}/tabtape/mcp`;
+}
+async function connect(url, token) {
+    const client = new index_js_1.Client({ name: 'test', version: '1' });
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(url), token !== undefined ? { requestInit: { headers: { Authorization: `Bearer ${token}` } } } : undefined);
+    await client.connect(transport);
+    cleanups.push(() => client.close());
+    return client;
+}
+async function setup(opts = {}) {
+    const st = qt.testStore();
+    demo(st, 's-old', t0 - 3600000);
+    demo(st, 's1', t0);
+    const url = await listen(mcpFor(st, opts));
+    const client = await connect(url);
+    // From now on the client checks every result against its tool's output schema.
+    await client.listTools();
+    return { st, url, client };
+}
+async function call(e, name, args) {
+    const res = await e.client.callTool({ name, arguments: args });
+    const content = (res.content ?? []);
+    return {
+        text: content
+            .filter((c) => c.type === 'text')
+            .map((c) => c.text ?? '')
+            .join(''),
+        data: res.structuredContent ?? {},
+        isError: res.isError === true,
+    };
+}
+function raw(url, method, headers, body) {
+    return new Promise((resolve, reject) => {
+        const req = http_1.default.request(url, { method, headers, agent: false }, (res) => {
+            let data = '';
+            res.setEncoding('utf8');
+            res.on('data', (chunk) => (data += chunk));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, headers: res.headers, body: data }));
+        });
+        req.on('error', reject);
+        req.end(body);
+    });
+}
+const PING = '{"jsonrpc":"2.0","id":1,"method":"ping"}';
+/** The text of a resource's contents. */
+const textOf = (c) => ('text' in c ? c.text : '');
+describe('TabtapeMcp', () => {
+    it('lists the tools as read-only', async () => {
+        const e = await setup();
+        const res = await e.client.listTools();
+        const names = res.tools.map((t) => t.name);
+        expect(names).toEqual([
+            'get_console',
+            'get_context_at',
+            'get_network',
+            'get_record_link',
+            'get_repro_steps',
+            'get_request',
+            'get_session_summary',
+            'list_sessions',
+        ]);
+        for (const tool of res.tools) {
+            expect([tool.name, tool.annotations]).toEqual([tool.name, { idempotentHint: false, openWorldHint: false, readOnlyHint: true }]);
+            expect(tool.outputSchema?.type).toBe('object');
+            expect(tool.inputSchema.additionalProperties).toBe(false);
+        }
+        const net = res.tools.find((t) => t.name === 'get_network');
+        expect(net?.inputSchema.required).toEqual(['session_id']);
+        expect(net?.inputSchema.properties?.include_bodies).toEqual({
+            type: 'boolean',
+            description: 'also return request and response bodies, cut to 2000 characters (use get_request for the full body)',
+        });
+        expect(e.client.getServerVersion()).toMatchObject({ name: 'tabtape', title: 'tabtape session recorder', version: 'test' });
+        expect(e.client.getInstructions()).toBe(server_1.INSTRUCTIONS);
+        expect(e.client.getServerCapabilities()).toMatchObject({ tools: {}, resources: {}, prompts: {} });
+    });
+    it('summarizes the latest session', async () => {
+        const e = await setup();
+        const { text, data, isError } = await call(e, 'get_session_summary', { session_id: 'latest' });
+        expect(isError).toBe(false);
+        const order = [
+            'Session s1',
+            'Page viewed /',
+            'Clicked "Load products" (button#load-products)',
+            'Clicked "Broken API"',
+            'GET http://localhost:7788/api/broken → 500',
+            'Uncaught error: Boom from test page at /:88',
+            'Page viewed /b.html',
+        ];
+        let pos = 0;
+        for (const want of order) {
+            const i = text.indexOf(want, pos);
+            if (i < 0)
+                throw new Error(`summary is missing ${JSON.stringify(want)} after position ${pos}:\n${text}`);
+            pos = i;
+        }
+        expect(text).toContain(base + '/#/s/s1?t=3090');
+        expect(text).not.toContain('"node"');
+        expect(text).not.toContain('childNodes');
+        expect(data.items).toHaveLength(7);
+        expect(data.total).toBe(7);
+        expect(data.session).toMatchObject({
+            id: 's1',
+            startedAt: '2025-10-05T07:47:12Z',
+            durationMs: 7000,
+            title: 'Acme Shop',
+            browser: 'Chrome 141 · macOS',
+            pages: 2,
+            clicks: 3,
+            errors: 1,
+            failedRequests: 1,
+            replay: base + '/#/s/s1?t=0',
+        });
+        expect(text.startsWith('# Session s1\n"Acme Shop" · http://localhost:7788/\nStarted 2025-10-05 07:47:12 · duration 00:07 · Chrome 141 · macOS\n')).toBe(true);
+        expect(text).toContain('00:03.090  net-error GET http://localhost:7788/api/broken → 500  [n');
+    });
+    it('returns failed requests with bodies on request', async () => {
+        const e = await setup();
+        let { text, data } = await call(e, 'get_network', { session_id: 's1', status: 'failed', include_bodies: true });
+        expect(data.requests).toHaveLength(1);
+        expect(text).toContain('/api/broken');
+        expect(text).toContain('kaboom');
+        expect(data.requests[0].resBody).toContain('kaboom');
+        ({ text } = await call(e, 'get_network', { session_id: 's1' }));
+        expect(text).not.toContain('kaboom');
+        ({ text, data } = await call(e, 'get_network', { session_id: 's1', status: '>=600' }));
+        expect(text).toBe('0 request(s) in session s1:\nNo requests match.\n');
+        expect(data).toEqual({ requests: null, matched: 0 });
+    });
+    it('redacts secrets in request details', async () => {
+        const e = await setup();
+        const { data } = await call(e, 'get_network', { session_id: 's1', url_contains: 'LOGIN' });
+        const id = data.requests[0].id;
+        const { text, isError, data: detail } = await call(e, 'get_request', { session_id: 's1', request_id: id });
+        expect(isError).toBe(false);
+        expect(text).toContain('authorization: [redacted]');
+        expect(text).not.toContain('test-token');
+        expect(text).toContain('"password":"********"');
+        expect(detail.reqHeaders).toEqual({ authorization: '[redacted]', 'content-type': 'application/json' });
+        expect(detail.reqBodyLength).toBe(39);
+        const open = await setup({ showSecrets: true });
+        const shown = await call(open, 'get_request', { session_id: 's1', request_id: id });
+        expect(shown.text).toContain('Bearer test-token');
+    });
+    it('shows the context before an error', async () => {
+        const e = await setup();
+        const { data } = await call(e, 'get_console', { session_id: 's1', level: 'error' });
+        expect(data.messages).toHaveLength(1);
+        expect(data.messages[0]).toMatchObject({ level: 'error', source: 'uncaught', location: '/:88', stack: 'Error: Boom from test page\nat index.html:88:40' });
+        const id = data.messages[0].id;
+        let { text } = await call(e, 'get_context_at', { session_id: 's1', at: id });
+        const click = text.indexOf('Clicked "Throw error"');
+        const boom = text.indexOf('▶ ');
+        expect(click).toBeGreaterThanOrEqual(0);
+        expect(boom).toBeGreaterThan(click);
+        ({ text } = await call(e, 'get_context_at', { session_id: 's1', at: '00:03.990', before: '1', after: '0.1' }));
+        expect(text).toContain('requested moment');
+        expect(text).not.toContain('Load products');
+    });
+    it('suggests recent sessions for an unknown id', async () => {
+        const e = await setup();
+        const { text, isError } = await call(e, 'get_session_summary', { session_id: 'abc123' });
+        expect(isError).toBe(true);
+        expect(text).toBe('session "abc123" not found. Recent sessions: s1, s-old (or use "latest")');
+    });
+    it('filters the list by time and writes repro steps', async () => {
+        const e = await setup();
+        let { text, data } = await call(e, 'list_sessions', { since: '30m' });
+        expect(data.sessions).toHaveLength(1);
+        expect(text).toContain('s1');
+        expect(text).toBe('1 recording(s), newest first:\n' +
+            '- s1 · 2025-10-05 07:47:12 · 00:07 · "Acme Shop" · http://localhost:7788/\n' +
+            '  2 pages, 3 clicks, 1 errors, 1 failed requests\n' +
+            `  ${base}/#/s/s1?t=0\n`);
+        // The structured content is the Go server's JSON: keys sorted, empty fields left out.
+        expect(JSON.stringify(data)).toBe('{"matched":1,"sessions":[{"browser":"Chrome 141 · macOS","clicks":3,"durationMs":7000,"errors":1,"failedRequests":1,' +
+            `"id":"s1","pages":2,"replay":"${base}/#/s/s1?t=0","startedAt":"2025-10-05T07:47:12Z","title":"Acme Shop","url":"http://localhost:7788/"}]}`);
+        ({ text, data } = await call(e, 'list_sessions', { limit: 1 }));
+        expect(text.startsWith('2 recording(s), newest first (showing 1; narrow with query, since or limit):\n')).toBe(true);
+        expect(data.matched).toBe(2);
+        ({ text } = await call(e, 'get_repro_steps', { session_id: 's1' }));
+        expect(text).toContain('Clicked "Broken API"');
+        expect(text).toContain('**500**');
+        expect(text).toContain('#/s/s1?t=3090');
+        const empty = await call(e, 'get_repro_steps', { session_id: 's1', from: '00:05', to: '00:04' });
+        expect([empty.isError, empty.text]).toEqual([true, 'empty range: to must be after from']);
+    });
+    it('cuts large results', async () => {
+        const e = await setup();
+        const recs = [];
+        for (let i = 0; i < 2000; i++) {
+            recs.push(qt.net(t0 + 7000 + i, { kind: 'fetch', method: 'GET', url: `${site}/api/item/${i}?${'q'.repeat(40)}`, status: 200 }));
+        }
+        qt.append(e.st, 's1', ...recs);
+        const first = await call(e, 'get_network', { session_id: 's1', limit: 500 });
+        expect(Buffer.byteLength(first.text)).toBeLessThanOrEqual(30000);
+        expect(typeof first.data.next_cursor).toBe('string');
+        expect(first.text).toContain(`… more requests. Call again with cursor "${first.data.next_cursor}"`);
+        const next = await call(e, 'get_network', { session_id: 's1', limit: 500, cursor: first.data.next_cursor });
+        expect(next.text).not.toBe(first.text);
+        expect(Buffer.byteLength(next.text)).toBeLessThanOrEqual(30000);
+        expect(next.text).toContain(`, from #${Number(first.data.next_cursor) + 1}:`);
+        const bad = await call(e, 'get_network', { session_id: 's1', cursor: 'x' });
+        expect([bad.isError, bad.text]).toEqual([true, 'invalid cursor "x": pass next_cursor from the previous result']);
+    });
+    it('serves resources, the template and the prompt', async () => {
+        const e = await setup();
+        const res = await e.client.listResources();
+        expect(res.resources.map((r) => r.uri)).toEqual(['tabtape://session/s-old', 'tabtape://session/s1']);
+        expect(res.resources[1]).toMatchObject({
+            name: 's1',
+            title: 'Oct 5 07:47 · Acme Shop',
+            description: 'tabtape recording of http://localhost:7788/',
+            mimeType: 'text/markdown',
+        });
+        const read = await e.client.readResource({ uri: 'tabtape://session/s1' });
+        expect(read.contents[0]).toMatchObject({ uri: 'tabtape://session/s1', mimeType: 'text/markdown' });
+        expect(textOf(read.contents[0])).toContain('Broken API');
+        const latest = await e.client.readResource({ uri: 'tabtape://session/latest' });
+        expect(textOf(latest.contents[0])).toContain('# Session s1');
+        // The Go SDK answers unknown resources with invalid params (SEP-2164).
+        await expect(e.client.readResource({ uri: 'tabtape://session/nope' })).rejects.toMatchObject({
+            code: -32602,
+            data: { uri: 'tabtape://session/nope' },
+        });
+        await expect(e.client.readResource({ uri: 'file:///etc/passwd' })).rejects.toMatchObject({ code: -32602 });
+        const templates = await e.client.listResourceTemplates();
+        expect(templates.resourceTemplates).toEqual([
+            {
+                name: 'session',
+                title: 'tabtape recording',
+                description: 'Summary of a recorded session: pages, clicks, changes, errors and failed requests with replay links.',
+                mimeType: 'text/markdown',
+                uriTemplate: 'tabtape://session/{id}',
+            },
+        ]);
+        const prompts = await e.client.listPrompts();
+        expect(prompts.prompts.map((p) => p.name)).toEqual(['debug_latest']);
+        const prompt = await e.client.getPrompt({ name: 'debug_latest' });
+        expect(prompt.messages).toHaveLength(1);
+        expect(prompt.messages[0].content).toMatchObject({ type: 'text' });
+        await expect(e.client.getPrompt({ name: 'other' })).rejects.toBeInstanceOf(types_js_1.McpError);
+    });
+    it('pages resources', async () => {
+        const st = qt.testStore();
+        for (let i = 0; i < 1001; i++)
+            st.start({ id: `r${String(i).padStart(4, '0')}`, startedAt: t0 + i });
+        const client = await connect(await listen(mcpFor(st)));
+        const first = await client.listResources();
+        expect(first.resources).toHaveLength(1000);
+        expect(typeof first.nextCursor).toBe('string');
+        const second = await client.listResources({ cursor: first.nextCursor });
+        expect(second.resources.map((r) => r.uri)).toEqual(['tabtape://session/r1000']);
+        expect(second.nextCursor).toBeUndefined();
+    });
+    it('rejects browser requests and checks the token', async () => {
+        const e = await setup();
+        const evil = await raw(e.url, 'POST', { Origin: 'https://evil.example', 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }, PING);
+        expect([evil.status, evil.body]).toEqual([403, 'browser requests are not allowed\n']);
+        const st = qt.testStore();
+        const url = await listen(mcpFor(st, { token: 's3cret' }));
+        const anon = await raw(url, 'POST', { 'Content-Type': 'application/json' }, '{}');
+        expect([anon.status, anon.headers['www-authenticate'], anon.body]).toEqual([401, 'Bearer realm="tabtape"', 'missing or wrong bearer token\n']);
+        const wrong = await raw(url, 'POST', { 'Content-Type': 'application/json', Authorization: 'Bearer s3cre' }, '{}');
+        expect(wrong.status).toBe(401);
+        const lower = await raw(url, 'POST', { 'Content-Type': 'application/json', Authorization: 'bearer s3cret' }, '{}');
+        expect(lower.status).toBe(401);
+        const client = await connect(url, 's3cret');
+        await expect(client.listTools()).resolves.toBeDefined();
+    });
+    it('answers like the stateless Go SDK handler before reading messages', async () => {
+        const e = await setup();
+        const json = { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' };
+        for (const method of ['GET', 'DELETE', 'PUT']) {
+            const r = await raw(e.url, method, { Accept: 'text/event-stream', 'Mcp-Session-Id': 'abc' });
+            expect([method, r.status, r.headers.allow, r.body]).toEqual([method, 405, 'POST', 'Method Not Allowed\n']);
+        }
+        const evilHost = await raw(e.url, 'POST', { ...json, Host: 'evil.example:9998' }, PING);
+        expect([evilHost.status, evilHost.body]).toEqual([403, 'Forbidden: invalid Host header "evil.example:9998"\n']);
+        for (const host of ['localhost:9998', '127.0.0.2', '[::1]:9998']) {
+            expect([host, (await raw(e.url, 'POST', { ...json, Host: host }, PING)).status]).toEqual([host, 200]);
+        }
+        const version = await raw(e.url, 'POST', { ...json, 'Mcp-Protocol-Version': '1999-01-01' }, PING);
+        expect([version.status, version.body.startsWith('Bad Request: Unsupported protocol version (supported versions: 2025-06-18,')]).toEqual([400, true]);
+        const noType = await raw(e.url, 'POST', { Accept: json.Accept }, PING);
+        expect([noType.status, noType.body]).toEqual([415, "Content-Type must be 'application/json'\n"]);
+        const noAccept = await raw(e.url, 'POST', { 'Content-Type': 'application/json' }, PING);
+        expect([noAccept.status, noAccept.body]).toEqual([400, "Accept must contain both 'application/json' and 'text/event-stream'\n"]);
+        const lastEvent = await raw(e.url, 'POST', { ...json, 'Last-Event-ID': '1' }, PING);
+        expect([lastEvent.status, lastEvent.body]).toEqual([400, "can't send Last-Event-ID for POST request\n"]);
+        const empty = await raw(e.url, 'POST', json, '');
+        expect([empty.status, empty.body]).toEqual([400, 'POST requires a non-empty body\n']);
+        const bad = await raw(e.url, 'POST', json, '{not json');
+        expect([bad.status, bad.body.startsWith('malformed payload: ')]).toEqual([400, true]);
+        const big = await raw(e.url, 'POST', json, ' '.repeat((4 << 20) + 1));
+        expect([big.status, big.body]).toEqual([413, 'request body exceeds 4194304 bytes\n']);
+        const batch = '[' + PING + ',{"jsonrpc":"2.0","id":2,"method":"ping"}]';
+        const lateBatch = await raw(e.url, 'POST', { ...json, 'Mcp-Protocol-Version': '2025-06-18' }, batch);
+        expect([lateBatch.status, lateBatch.body]).toEqual([400, 'JSON-RPC batching is not supported in 2025-06-18 and later (request version: 2025-06-18)\n']);
+        const oldBatch = await raw(e.url, 'POST', json, batch);
+        expect([oldBatch.status, JSON.parse(oldBatch.body)]).toEqual([
+            200,
+            [
+                { jsonrpc: '2.0', id: 1, result: {} },
+                { jsonrpc: '2.0', id: 2, result: {} },
+            ],
+        ]);
+        // Parameters, case and wildcards do not matter, and a stateless server answers without initialize.
+        const ping = await raw(e.url, 'POST', { 'Content-Type': 'Application/JSON; charset=utf-8', Accept: 'application/json;q=0.9, TEXT/*' }, PING);
+        expect([ping.status, ping.headers['content-type'], JSON.parse(ping.body)]).toEqual([200, 'application/json', { jsonrpc: '2.0', id: 1, result: {} }]);
+        expect((await raw(e.url, 'POST', { 'Content-Type': 'application/json', Accept: '*/*' }, PING)).status).toBe(200);
+    });
+    it('validates tool arguments', async () => {
+        const e = await setup();
+        const missing = await call(e, 'get_session_summary', {});
+        expect(missing).toMatchObject({ isError: true, text: 'validating "arguments": validating root: required: missing properties: ["session_id"]' });
+        const extra = await call(e, 'list_sessions', { querry: 'x' });
+        expect(extra).toMatchObject({ isError: true, text: 'validating "arguments": validating root: unexpected additional properties ["querry"]' });
+        const wrongType = await call(e, 'list_sessions', { limit: '5', querry: 'x' }); // types are checked first
+        expect(wrongType).toMatchObject({
+            isError: true,
+            text: 'validating "arguments": validating root: validating /properties/limit: type: 5 has type "string", want "integer"',
+        });
+        const fraction = await call(e, 'get_request', { session_id: 's1', request_id: 'x', body_offset: 1.5 });
+        expect(fraction.text).toBe('validating "arguments": validating root: validating /properties/body_offset: type: 1.5 has type "number", want "integer"');
+        const nullValue = await call(e, 'get_network', { session_id: null });
+        expect(nullValue.text).toBe('validating "arguments": validating root: validating /properties/session_id: type: <invalid reflect.Value> has type "null", want "string"');
+        const big = await call(e, 'list_sessions', { query: 1e7 });
+        expect(big.text).toBe('validating "arguments": validating root: validating /properties/query: type: 1e+07 has type "integer", want "string"');
+        const several = await call(e, 'get_request', { b: 1, a: 2 });
+        expect(several.text).toBe('validating "arguments": validating root: unexpected additional properties ["a" "b"]');
+        await expect(e.client.callTool({ name: 'nope', arguments: {} })).rejects.toMatchObject({ code: -32602 });
+        const unknown = await call(e, 'get_request', { session_id: 's1', request_id: ' nope ' });
+        expect(unknown.text).toBe('request " nope " not found in session s1; ids come from get_network or get_session_summary');
+        const badAt = await call(e, 'get_context_at', { session_id: 's1', at: 'soon' });
+        expect(badAt.text).toBe('cannot find "soon": pass a time like 01:23.4 or an id from another tool');
+        const badKind = await call(e, 'get_network', { session_id: 's1', kind: 'Image' });
+        expect(badKind.text).toBe('unknown kind "Image"; use fetch, xhr, beacon, api, document, resource or websocket');
+        const badLevel = await call(e, 'get_console', { session_id: 's1', level: 'fatal' });
+        expect(badLevel.text).toBe('unknown level "fatal"; use error, warn, warn+, info, log, debug or trace');
+    });
+    it('resolves latest to the recording in progress', async () => {
+        const st = qt.testStore();
+        demo(st, 's-done', t0);
+        qt.start(st, 's-live', t0 - 60000, site + '/', 'Live');
+        let now = t0 + 60000;
+        const client = await connect(await listen(mcpFor(st, { now: () => now })));
+        qt.append(st, 's-live', qt.pageView(t0, 'start', site + '/', 'Live'));
+        // Written just now (the store clock is Date.now, so look from there).
+        now = Date.now() + 1000;
+        let res = await client.callTool({ name: 'get_session_summary', arguments: { session_id: 'LATEST' } });
+        expect(JSON.stringify(res.structuredContent)).toContain('"id":"s-live"');
+        expect(JSON.stringify(res.structuredContent)).toContain('"live":true');
+        now = Date.now() + 31000;
+        res = await client.callTool({ name: 'get_session_summary', arguments: { session_id: '' } });
+        expect(JSON.stringify(res.structuredContent)).toContain('"id":"s-done"');
+        const empty = await connect(await listen(mcpFor(qt.testStore())));
+        const none = await empty.callTool({ name: 'list_sessions', arguments: {} });
+        expect(none.content[0].text).toBe('No recordings match. Start one from the tabtape extension (⌥⇧R).:\n');
+        expect(none.structuredContent).toEqual({ sessions: null, matched: 0 });
+        const latest = await empty.callTool({ name: 'get_session_summary', arguments: { session_id: 'latest' } });
+        expect(latest.content[0].text).toBe('there are no recordings yet: start one from the tabtape extension');
+        const byId = await empty.callTool({ name: 'get_session_summary', arguments: { session_id: 'x' } });
+        expect(byId.content[0].text).toBe('session "x" not found, and there are no recordings yet');
+    });
+    it('reports the user, tracked events and performance', async () => {
+        const e = await setup();
+        const u = site + '/';
+        qt.append(e.st, 's1', qt.identify(t0 + 500, u, 'u_demo'), qt.track(t0 + 1500, u, 'demo_clicked', { n: 1 }), qt.loaf(t0 + 2990, 612, { url: site + '/slow.js', fn: 'handleClick', duration: 600 }), qt.vital(t0 + 3500, 'INP', 240, 'needs-improvement'), qt.vital(t0 + 3600, 'INP', 640, 'poor', { target: 'button#slow' }), qt.vital(t0 + 3700, 'CLS', 0.02, 'good'));
+        let { text, data } = await call(e, 'list_sessions', { user: 'U_DEMO' });
+        expect(data.sessions).toHaveLength(1);
+        expect(text).toContain('s1');
+        expect(text).toContain('user u_demo');
+        ({ text } = await call(e, 'list_sessions', { user: 'nobody' }));
+        expect(text).toContain('No recordings match');
+        ({ text } = await call(e, 'get_session_summary', { session_id: 's1' }));
+        for (const want of [
+            'User: u_demo',
+            'custom    Event demo_clicked (n: 1)',
+            'identify  Identified user u_demo',
+            'freeze    Page froze for 612 ms (longest script: slow.js handleClick)',
+            'vital     INP 640 ms (poor) on button#slow',
+        ]) {
+            expect(text).toContain(want);
+        }
+        expect(text).not.toContain('240 ms');
+        expect(text).not.toContain('CLS');
+        ({ text } = await call(e, 'get_context_at', { session_id: 's1', at: '00:03.000' }));
+        expect(text).toContain('CLS 0.02 (good)');
+    });
+    it('reports deep mode network data and store state', async () => {
+        const e = await setup();
+        const recs = [
+            qt.net(t0 + 1000, {
+                id: 'cdp-1',
+                kind: 'fetch',
+                method: 'GET',
+                url: 'http://127.0.0.1:7789/api/cors',
+                source: 'cdp',
+                error: 'net::ERR_FAILED',
+                corsErrorStatus: { corsError: 'MissingAllowOriginHeader', failedParameter: '' },
+                duration: 4,
+            }),
+            qt.net(t0 + 1100, {
+                id: 'cdp-2',
+                kind: 'fetch',
+                method: 'GET',
+                url: site + '/api/set-cookie',
+                status: 200,
+                source: 'cdp',
+                protocol: 'http/1.1',
+                remoteAddress: '127.0.0.1:7788',
+                duration: 12,
+                timing: { dns: 1, connect: 2, wait: 8, receive: 1 },
+                reqHeaders: { cookie: 'sid=secret-sid' },
+                blockedSetCookies: [{ name: 'tabtape_demo', reasons: ['SameSiteNoneInsecure'], domain: '', path: '' }],
+            }),
+        ];
+        for (let i = 0; i < 150; i++) {
+            recs.push(qt.ws(t0 + 2000 + i, 'ws-1', i % 2 === 1 ? 'recv' : 'send', `{"n":${Math.floor(i / 2)}}`));
+        }
+        recs.push(qt.net(t0 + 1900, {
+            id: 'ws-1',
+            kind: 'websocket',
+            method: 'GET',
+            url: 'ws://localhost:7788/echo',
+            status: 101,
+            source: 'cdp',
+            duration: 900,
+            closedAt: t0 + 2800,
+            frames: { sent: 75, received: 75, sentBytes: 600, receivedBytes: 600, dropped: 0, dataOmitted: 0 },
+        }), qt.stateRec(t0 + 3000, { store: 'cart', kind: 'init', state: { cart: { items: [] } } }));
+        for (let i = 0; i < 12; i++) {
+            recs.push(qt.stateRec(t0 + 3100 + i * 10, {
+                store: 'cart',
+                kind: 'action',
+                action: 'cart/add',
+                changes: [{ path: `/cart/items/${i}`, value: { id: i }, deleted: false }],
+            }));
+        }
+        recs.push(qt.stateRec(t0 + 3300, { store: 'counter', kind: 'action', action: 'increment', burst: true }));
+        qt.append(e.st, 's1', ...recs);
+        let { text, data } = await call(e, 'get_session_summary', { session_id: 's1' });
+        for (const want of [
+            'Network recorded in deep mode',
+            '1 WebSocket connection',
+            'State: 13 action(s) in store(s) cart, counter',
+            'failed (CORS: the response has no Access-Control-Allow-Origin header)',
+        ]) {
+            expect(text).toContain(want);
+        }
+        ({ text, data } = await call(e, 'get_network', { session_id: 's1', kind: 'websocket' }));
+        expect(data.requests).toHaveLength(1);
+        expect(text).toContain('WS 101');
+        expect(text).toContain('75↑ 75↓ messages');
+        expect(data.requests[0].frames).toEqual({ sent: 75, received: 75, sentBytes: 600, receivedBytes: 600 });
+        const wsID = data.requests[0].id;
+        ({ text, data } = await call(e, 'get_request', { session_id: 's1', request_id: wsID }));
+        expect(text).toContain('Messages 1–100 of 150');
+        expect(text).toContain('↑ 7 B  {"n":0}');
+        expect(text).toContain('WebSocket closed after 900 ms · 75↑ 75↓ messages, 1.2 KB');
+        expect(data.next_frames_offset).toBe(100);
+        expect(data.messagesTotal).toBe(150);
+        expect(data.messages[0]).toMatchObject({ dir: 'send', opcode: 1, size: 7, data: '{"n":0}' });
+        ({ text } = await call(e, 'get_request', { session_id: 's1', request_id: wsID, frames_offset: 100 }));
+        expect(text).toContain('Messages 101–150 of 150');
+        expect(text).toContain('{"n":74}');
+        expect(text).not.toContain('more messages');
+        ({ text, data } = await call(e, 'get_request', { session_id: 's1', request_id: 'cdp-2' }));
+        for (const want of [
+            'Recorded in deep mode (Chrome DevTools Protocol) · http/1.1 · 127.0.0.1:7788',
+            'Timing: DNS 1 ms · connect 2 ms · wait 8 ms · download 1 ms',
+            'Set-Cookie rejected: tabtape_demo — SameSite=None requires Secure [SameSiteNoneInsecure]',
+            'cookie: [redacted]',
+        ]) {
+            expect(text).toContain(want);
+        }
+        expect(text).not.toContain('secret-sid');
+        expect(data).toMatchObject({
+            recorded: 'deep mode (Chrome DevTools Protocol)',
+            protocol: 'http/1.1',
+            timing: { dns: 1, connect: 2, wait: 8, receive: 1 },
+            blockedSetCookies: [{ name: 'tabtape_demo', reasons: ['SameSiteNoneInsecure'] }],
+        });
+        ({ text } = await call(e, 'get_request', { session_id: 's1', request_id: 'cdp-1' }));
+        expect(text).toContain('Why it failed: CORS: the response has no Access-Control-Allow-Origin header');
+        ({ text, data } = await call(e, 'get_context_at', { session_id: 's1', at: '00:03.250' }));
+        expect(data.stateActions).toHaveLength(10);
+        expect(text).toContain('Last 10 store action(s) up to 00:03.250');
+        expect(text).toContain('/cart/items/11 = {"id":11}');
+        expect(text).not.toContain('/cart/items/1 =');
+        ({ text } = await call(e, 'get_context_at', { session_id: 's1', at: '00:04' }));
+        expect(text).toContain('increment');
+        expect(text).toContain('type only');
+    });
+    it('pages long bodies', async () => {
+        const e = await setup();
+        const body = 'é'.repeat(25000) + 'END';
+        qt.append(e.st, 's1', qt.net(t0 + 5000, { id: 'big', kind: 'fetch', method: 'GET', url: site + '/api/big', status: 200, resBody: body }));
+        let { text, data } = await call(e, 'get_request', { session_id: 's1', request_id: 'big' });
+        expect(data).toMatchObject({ resBodyLength: 25003, next_body_offset: 20000 });
+        expect(data.resBody).toHaveLength(20000);
+        expect(text).toContain('Response body (characters 0–20000 of 25003):');
+        expect(text).toContain('… the body continues. Call again with body_offset 20000.');
+        ({ text, data } = await call(e, 'get_request', { session_id: 's1', request_id: 'big', body_offset: 20000 }));
+        expect(data.next_body_offset).toBeUndefined();
+        expect(text).toContain('Response body (characters 20000–25003 of 25003):');
+        expect(data.resBody.endsWith('END')).toBe(true);
+    });
+});
+describe('get_record_link', () => {
+    it('builds start and stop links', async () => {
+        const e = await setup({ recordToken: 'tok-123' });
+        let { text, data, isError } = await call(e, 'get_record_link', { name: ' checkout: coupon ', url: site + '/cart?x=1' });
+        expect(isError).toBe(false);
+        const start = new URL(data.start);
+        expect(start.origin + start.pathname).toBe(base + '/record');
+        expect([start.searchParams.get('token'), start.searchParams.get('name'), start.searchParams.get('url')]).toEqual([
+            'tok-123',
+            'checkout: coupon',
+            site + '/cart?x=1',
+        ]);
+        expect(data.start).toBe(`${base}/record?name=checkout%3A+coupon&token=tok-123&url=http%3A%2F%2Flocalhost%3A7788%2Fcart%3Fx%3D1`);
+        expect(data.stop).toBe(base + '/record/stop?token=tok-123');
+        for (const want of [
+            'Start: ' + data.start,
+            'Stop: ' + base + '/record/stop?token=tok-123',
+            'The tab then opens ' + site + '/cart?x=1',
+            'extension is not loaded',
+            'The links stop working when the Repoburg daemon restarts.',
+        ]) {
+            expect(text).toContain(want);
+        }
+        // Without a url the tab stays on the confirmation page.
+        ({ text, data } = await call(e, 'get_record_link'));
+        const bare = new URL(data.start);
+        expect([bare.searchParams.has('name'), bare.searchParams.has('url'), bare.searchParams.get('token')]).toEqual([false, false, 'tok-123']);
+        expect(text).toContain('"Recording <session id>"');
+    });
+    it('rejects other pages and works only with a token', async () => {
+        const e = await setup({ recordToken: 'tok' });
+        for (const u of ['javascript:alert(1)', 'chrome://settings', 'not a url', 'http://a b/', 'http://host:port/', 'http://x/%zz']) {
+            const res = await call(e, 'get_record_link', { url: u });
+            expect([u, res.isError, res.text]).toEqual([u, true, `url ${JSON.stringify(u)}: only http, https and file pages can be recorded`]);
+        }
+        for (const u of ['HTTPS://example.com/a?b=%zz', 'file:///tmp/page.html', 'http://[::1]:8080/']) {
+            expect([u, (await call(e, 'get_record_link', { url: u })).isError]).toEqual([u, false]);
+        }
+        const off = await setup();
+        const res = await call(off, 'get_record_link');
+        expect([res.isError, res.text]).toEqual([true, 'record links are turned off in this Repoburg daemon']);
+    });
+    it('marks sessions started by automation', async () => {
+        const e = await setup();
+        e.st.start({ id: 's-auto', startedAt: t0 + 1000, title: 'checkout: coupon', source: 'automation' });
+        const { text } = await call(e, 'list_sessions', { query: 'coupon' });
+        expect(text).toContain('"checkout: coupon"');
+        expect(text).toContain('started by automation');
+    });
+});
+/**
+ * MCP-R12: get_network on a 200 MB session in under 2 s, index built on the
+ * first call. Slow to set up, so opt-in:
+ *
+ *   TABTAPE_LARGE=1 NODE_OPTIONS=--experimental-vm-modules npx jest src/tabtape/mcp -t 'large session'
+ */
+(process.env.TABTAPE_LARGE ? it : it.skip)('answers quickly on a large session', async () => {
+    const st = store_1.Store.open({ dir: (0, tmp_1.tempDir)(), maxBytes: 1 << 30, segmentBytes: 16 << 20, logger: log_1.silentLogger });
+    cleanups.push(() => st.close());
+    const snapshot = 'x'.repeat(60000);
+    let batch = [];
+    let total = 0;
+    let ts = t0;
+    for (let i = 0; total < 200 << 20; i++) {
+        let line;
+        if (i % 40 === 0) {
+            line = JSON.stringify({ ts, type: 'rrweb', data: { type: 2, data: { node: { text: snapshot } }, timestamp: ts } });
+        }
+        else if (i % 4 === 0) {
+            line = JSON.stringify({
+                ts,
+                type: 'network',
+                data: { kind: 'fetch', method: 'GET', url: `http://app.test/api/item/${i}`, status: 200 + ((i % 7) * 50), duration: 12, resBody: 'y'.repeat(2000) },
+            });
+        }
+        else {
+            line = JSON.stringify({ ts, type: 'rrweb', data: { type: 3, data: { source: 0, adds: [{ node: { text: 'z'.repeat(1500) } }] }, timestamp: ts } });
+        }
+        batch.push((0, record_1.parseRecord)(line));
+        total += line.length;
+        ts += 20;
+        if (batch.length === 2000) {
+            st.append('big', batch);
+            batch = [];
+        }
+    }
+    st.append('big', batch);
+    const client = await connect(await listen(mcpFor(st)));
+    const sess = st.get('big');
+    for (const run of ['cold (builds the index)', 'warm']) {
+        const started = Date.now();
+        const res = await client.callTool({ name: 'get_network', arguments: { session_id: 'big', status: '>=400' } });
+        const elapsed = Date.now() - started;
+        const text = res.content[0].text;
+        console.log(`${run}: get_network on a ${(sess.bytes / (1 << 20)).toFixed(0)} MB session took ${elapsed} ms, ${text.length} chars`);
+        expect(elapsed).toBeLessThan(2000);
+        expect(Buffer.byteLength(text)).toBeLessThanOrEqual(30000);
+    }
+}, 120000);