repoburg 1.3.255 → 1.3.256

package/daemon/dist/tabtape/api/router.spec.js

@@ -0,0 +1,604 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const path_1 = __importDefault(require("path"));
+const zlib_1 = __importDefault(require("zlib"));
+const ws_1 = __importDefault(require("ws"));
+const buffer_1 = require("../buffer/buffer");
+const log_1 = require("../log");
+const reader_1 = require("../query/reader");
+const redact_1 = require("../redact");
+const record_1 = require("../store/record");
+const store_1 = require("../store/store");
+const tmp_1 = require("../testing/tmp");
+const follow_1 = require("./follow");
+const router_1 = require("./router");
+const ws_2 = require("./ws");
+const MOUNT = '/tabtape';
+const servers = [];
+async function serve(o = {}) {
+    const dir = (0, tmp_1.tempDir)();
+    const st = store_1.Store.open({ dir, maxBytes: 1 << 20, segmentBytes: o.segmentBytes ?? 1 << 16, logger: log_1.silentLogger });
+    const buffers = o.buffers ? buffer_1.BufferStore.open({ dir: path_1.default.join(dir, 'buffer'), maxBytes: 1 << 20, logger: log_1.silentLogger }) : null;
+    let stopNow;
+    const stop = new Promise((r) => (stopNow = r));
+    const followers = new follow_1.Followers();
+    const router = (0, router_1.createApiRouter)({
+        st,
+        rd: new reader_1.Reader(st),
+        buffers,
+        version: o.version ?? 'test',
+        baseURL: 'http://127.0.0.1:9998/tabtape',
+        mount: MOUNT,
+        redact: new redact_1.RedactHeaders(),
+        uiDist: o.uiDist ?? null,
+        viewer: () => o.viewer ?? null,
+        mcp: o.mcp ?? null,
+        recordToken: o.recordToken ?? '',
+        followers,
+        stop,
+        logger: log_1.silentLogger,
+        maxBatchBytes: o.maxBatchBytes,
+        timeZone: 'UTC',
+        keepAliveMs: o.keepAliveMs,
+    });
+    const upgrades = new ws_2.FollowUpgrade({ st, followers, stop, mount: MOUNT, logger: log_1.silentLogger, keepAliveMs: o.keepAliveMs });
+    const app = (0, express_1.default)();
+    app.use(MOUNT, router);
+    app.use((_req, res) => res.status(418).end('not tabtape'));
+    const server = http_1.default.createServer(app);
+    server.on('upgrade', (req, socket, head) => (upgrades.matches(req) ? upgrades.handle(req, socket, head) : socket.destroy()));
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const s = {
+        port: server.address().port,
+        st,
+        stop: stopNow,
+        close: async () => {
+            stopNow();
+            upgrades.close();
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+            buffers?.close();
+            await st.close();
+        },
+    };
+    servers.push(s);
+    return s;
+}
+afterEach(async () => {
+    while (servers.length)
+        await servers.pop().close();
+    (0, tmp_1.cleanupTempDirs)();
+});
+const client = { 'X-Tabtape-Client': 'test' };
+function request(s, method, p, o = {}) {
+    return new Promise((resolve, reject) => {
+        const req = http_1.default.request({ host: '127.0.0.1', port: s.port, method, path: p, headers: { Host: o.host ?? `127.0.0.1:${s.port}`, ...o.headers } }, (res) => {
+            const parts = [];
+            res.on('data', (c) => parts.push(c));
+            res.on('end', () => {
+                const raw = Buffer.concat(parts);
+                resolve({ status: res.statusCode ?? 0, headers: res.headers, body: raw.toString('utf8'), raw });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.end(o.body);
+    });
+}
+const get = (s, p) => request(s, 'GET', MOUNT + p);
+function appendEvent(st, id, ts) {
+    st.append(id, [(0, record_1.parseRecord)(`{"ts":${ts},"type":"event","data":{"name":"click","pad":"${'x'.repeat(300)}"}}`)]);
+}
+describe('sessions API', () => {
+    it('runs a session through its lifecycle', async () => {
+        const s = await serve();
+        let r = await request(s, 'POST', `${MOUNT}/api/sessions`, {
+            headers: client,
+            body: '{"id":"s1","startedAt":1000,"url":"https://a.test/","title":"A","userAgent":"UA"}',
+        });
+        expect(r.status).toBe(201);
+        const batch = '{"ts":1001,"type":"rrweb","data":{"type":4,"data":{"width":800,"height":600}}}\n' + '{"ts":1002,"type":"event","data":{"name":"click","url":"https://a.test/"}}\n';
+        r = await request(s, 'POST', `${MOUNT}/api/sessions/s1/events`, { headers: client, body: batch });
+        expect(r.status).toBe(200);
+        const ack = JSON.parse(r.body);
+        expect(ack.accepted).toBe(2);
+        expect(ack.bytes).toBeGreaterThan(0);
+        r = await get(s, '/api/sessions');
+        const list = JSON.parse(r.body);
+        expect(list.length).toBe(1);
+        expect([list[0].id, list[0].counts.total, list[0].counts.clicks, list[0].title]).toEqual(['s1', 2, 1, 'A']);
+        r = await get(s, '/api/sessions/s1/events');
+        expect(r.status).toBe(200);
+        expect(r.headers['content-type']).toBe('application/x-ndjson');
+        const lines = r.body.trim().split('\n');
+        expect(lines.length).toBe(2);
+        expect(lines[0].startsWith('{"sid":"s1","ts":1001,')).toBe(true);
+        r = await request(s, 'POST', `${MOUNT}/api/sessions/s1/end`, { headers: client, body: '{"endedAt":1500}' });
+        expect(r.status).toBe(200);
+        r = await get(s, '/api/sessions/s1');
+        expect(JSON.parse(r.body).endedAt).toBe(1500);
+        r = await request(s, 'DELETE', `${MOUNT}/api/sessions/s1`, { headers: client });
+        expect(r.status).toBe(204);
+        r = await get(s, '/api/sessions/s1/events');
+        expect(r.status).toBe(404);
+    });
+    it('reports health', async () => {
+        const s = await serve({ version: '1.2.3' });
+        const h = JSON.parse((await get(s, '/api/health')).body);
+        expect([h.ok, h.version, h.maxBytes]).toEqual([true, '1.2.3', 1 << 20]);
+        expect(h.redactHeaders).toContain('authorization');
+    });
+    it('serves loopback hosts only, never tunnel traffic', async () => {
+        const s = await serve();
+        expect((await request(s, 'GET', `${MOUNT}/api/sessions`, { host: 'evil.example:9998' })).status).toBe(403);
+        expect((await request(s, 'GET', `${MOUNT}/api/sessions`, { host: 'workstation.repoburg.com' })).status).toBe(403);
+        for (const host of ['localhost:9998', '127.0.0.1:9998', '[::1]:9998', 'LOCALHOST']) {
+            expect((await request(s, 'GET', `${MOUNT}/api/sessions`, { host })).status).toBe(200);
+        }
+        const tunneled = await request(s, 'GET', `${MOUNT}/api/sessions`, { headers: { 'CF-Ray': '8a1b2c3d4e5f-AMS' } });
+        expect(tunneled.status).toBe(403);
+    });
+    it('requires the client header on writes', async () => {
+        const s = await serve();
+        expect((await request(s, 'POST', `${MOUNT}/api/sessions/s1/events`, { body: '{"ts":1,"type":"rrweb"}' })).status).toBe(403);
+        expect((await request(s, 'DELETE', `${MOUNT}/api/sessions/s1`)).status).toBe(403);
+    });
+    it('answers CORS for the extension only', async () => {
+        const s = await serve();
+        let r = await request(s, 'OPTIONS', `${MOUNT}/api/sessions/s1/events`, {
+            headers: { Origin: 'chrome-extension://abcdef', 'Access-Control-Request-Method': 'POST', 'Access-Control-Request-Headers': 'content-type,x-tabtape-client' },
+        });
+        expect(r.status).toBe(204);
+        expect(r.headers['access-control-allow-origin']).toBe('chrome-extension://abcdef');
+        for (const origin of ['https://evil.example', 'http://localhost:3000', 'https://workstation.repoburg.com']) {
+            r = await request(s, 'GET', `${MOUNT}/api/sessions`, { headers: { Origin: origin } });
+            expect(r.status).toBe(200);
+            expect(r.headers['access-control-allow-origin']).toBeUndefined();
+        }
+    });
+    it('validates ingested batches', async () => {
+        const s = await serve({ maxBatchBytes: 200 });
+        const cases = [
+            ['/api/sessions/s1/events', '{"ts":1,"type":"rrweb"}\nnot json\n', 400],
+            ['/api/sessions/bad.id/events', '{"ts":1,"type":"rrweb"}', 400],
+            ['/api/sessions/s1/events', `{"ts":1,"type":"rrweb","data":"${'x'.repeat(300)}"}`, 413],
+            ['/api/sessions/s1/events', '', 200],
+        ];
+        for (const [p, body, want] of cases) {
+            expect((await request(s, 'POST', MOUNT + p, { headers: client, body })).status).toBe(want);
+        }
+    });
+    it('answers 404 for unknown sessions', async () => {
+        const s = await serve();
+        expect((await get(s, '/api/sessions/nope')).status).toBe(404);
+        expect((await get(s, '/api/sessions/nope/events')).status).toBe(404);
+        expect((await request(s, 'POST', `${MOUNT}/api/sessions/nope/end`, { headers: client, body: '{}' })).status).toBe(404);
+        expect((await request(s, 'DELETE', `${MOUNT}/api/sessions/nope`, { headers: client })).status).toBe(404);
+    });
+    it('downloads the JSONL gzip-compressed', async () => {
+        const s = await serve({ segmentBytes: 1 << 10 });
+        for (let i = 0; i < 3; i++)
+            appendEvent(s.st, 'a', i);
+        const plain = (await get(s, '/api/sessions/a/events')).raw;
+        const gz = await get(s, '/api/sessions/a/events?gzip=1');
+        expect(gz.status).toBe(200);
+        expect(gz.headers['content-disposition']).toBe('attachment; filename="a.jsonl.gz"');
+        expect(zlib_1.default.gunzipSync(gz.raw).equals(plain)).toBe(true);
+        expect((await get(s, '/api/sessions/nope/events?gzip=1')).status).toBe(404);
+    });
+});
+describe('replay UI', () => {
+    it('serves the build, or a placeholder', async () => {
+        const dist = (0, tmp_1.tempDir)();
+        fs_1.default.mkdirSync(path_1.default.join(dist, 'app', 'assets'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(dist, 'app', 'index.html'), '<html>replay ui</html>');
+        fs_1.default.writeFileSync(path_1.default.join(dist, 'app', 'assets', 'app.js'), 'console.log(1)');
+        const s = await serve({ uiDist: dist });
+        let r = await get(s, '/');
+        expect(r.status).toBe(200);
+        expect(r.body).toContain('replay ui');
+        expect((await get(s, '/assets/app.js')).body).toBe('console.log(1)');
+        r = await request(s, 'GET', MOUNT);
+        expect(r.status).toBe(301);
+        expect(r.headers.location).toBe(`${MOUNT}/`);
+        const bare = await serve({ uiDist: (0, tmp_1.tempDir)() });
+        r = await get(bare, '/');
+        expect(r.status).toBe(200);
+        expect(r.body).toContain('npm run build');
+    });
+    it('keeps everything under the mount to itself', async () => {
+        const s = await serve();
+        expect((await get(s, '/nope')).status).toBe(404);
+        expect((await request(s, 'GET', '/elsewhere')).status).toBe(418);
+    });
+});
+describe('record links', () => {
+    it('verifies tokens', async () => {
+        const s = await serve({ recordToken: 'tok-123' });
+        const verify = async (body, headers = client) => (await request(s, 'POST', `${MOUNT}/api/record/verify`, { body, headers })).status;
+        expect(await verify('{"token":"tok-123"}')).toBe(204);
+        for (const body of ['{"token":"tok-12"}', '{"token":""}', '{}'])
+            expect(await verify(body)).toBe(403);
+        expect(await verify('{"token":"tok-123"}', {})).toBe(403); // a web page cannot send the client header
+        expect(await verify('not json')).toBe(400);
+        const off = await serve();
+        expect((await request(off, 'POST', `${MOUNT}/api/record/verify`, { body: '{"token":""}', headers: client })).status).toBe(403);
+    });
+    it('serves the record page under the mount', async () => {
+        const s = await serve({ recordToken: 'tok' });
+        for (const p of ['/record?token=tok&name=x', '/record/stop?token=tok', '/record?stopped=s1']) {
+            const r = await get(s, p);
+            expect(r.status).toBe(200);
+            expect(r.headers['content-type']).toMatch(/^text\/html/);
+            expect(r.body).toContain('<script src="/tabtape/record/record.js"></script>');
+            expect(r.headers['referrer-policy']).toBe('no-referrer');
+            expect(r.headers['cache-control']).toBe('no-store');
+            expect(r.headers['content-security-policy']).toContain("script-src 'self'");
+        }
+        const js = await get(s, '/record/record.js');
+        expect(js.headers['content-type']).toMatch(/^text\/javascript/);
+        expect(js.body).toContain('No tabtape extension answered');
+        expect(js.body).toContain('const MOUNT = "/tabtape"');
+    });
+});
+describe('MCP mount', () => {
+    it('needs no client header but a loopback host', async () => {
+        let called = false;
+        const s = await serve({
+            mcp: {
+                handle: async (_req, res) => {
+                    called = true;
+                    res.writeHead(202);
+                    res.end();
+                },
+            },
+        });
+        expect((await request(s, 'POST', `${MOUNT}/mcp`, { body: '{}' })).status).toBe(202);
+        expect(called).toBe(true);
+        expect((await request(s, 'POST', `${MOUNT}/mcp`, { body: '{}', host: 'evil.example' })).status).toBe(403);
+    });
+});
+describe('buffer API', () => {
+    it('buffers, saves and deletes', async () => {
+        const s = await serve({ buffers: true });
+        const now = Date.now();
+        const batch = `{"ts":${now},"type":"rrweb","data":{"type":4,"data":{"width":800,"height":600},"timestamp":${now}}}\n` +
+            `{"ts":${now},"type":"event","data":{"name":"page_view","kind":"load","url":"http://localhost/","title":"Home"}}`;
+        expect((await request(s, 'POST', `${MOUNT}/api/buffers/tab-1/events?window=60000`, { body: batch })).status).toBe(403);
+        expect((await request(s, 'POST', `${MOUNT}/api/buffers/tab-1/events?window=60000`, { body: batch, headers: client })).status).toBe(200);
+        const list = JSON.parse((await get(s, '/api/buffers')).body);
+        expect(list.length).toBe(1);
+        expect([list[0].windowMs, list[0].title]).toEqual([60000, 'Home']);
+        let r = await request(s, 'POST', `${MOUNT}/api/buffers/tab-1/save`, { body: '{"minutes":2}', headers: client });
+        expect(r.status).toBe(201);
+        const sess = JSON.parse(r.body);
+        expect([sess.source, sess.title]).toEqual(['buffer', 'Home']);
+        expect((await get(s, `/api/sessions/${sess.id}`)).status).toBe(200);
+        expect((await request(s, 'DELETE', `${MOUNT}/api/buffers/tab-1`, { headers: client })).status).toBe(204);
+        r = await request(s, 'POST', `${MOUNT}/api/buffers/tab-1/save`, { body: '{}', headers: client });
+        expect(r.status).toBe(404);
+    });
+});
+// ---------- live viewing ----------
+/** A live HTTP stream, line by line. */
+function openFollow(s, id) {
+    return new Promise((resolve, reject) => {
+        const req = http_1.default.get({ host: '127.0.0.1', port: s.port, path: `${MOUNT}/api/sessions/${id}/events?follow=1` }, (res) => {
+            let buf = '';
+            const queue = [];
+            let waiting = null;
+            let ended = false;
+            const push = () => {
+                while (waiting && (queue.length || ended)) {
+                    const w = waiting;
+                    waiting = null;
+                    w(queue.length ? queue.shift() : null);
+                }
+            };
+            res.setEncoding('utf8');
+            res.on('data', (c) => {
+                buf += c;
+                let i;
+                while ((i = buf.indexOf('\n')) >= 0) {
+                    queue.push(buf.slice(0, i));
+                    buf = buf.slice(i + 1);
+                }
+                push();
+            });
+            res.on('close', () => {
+                ended = true;
+                push();
+            });
+            resolve({
+                status: res.statusCode ?? 0,
+                next: () => new Promise((r, rej) => {
+                    const timer = setTimeout(() => rej(new Error('no line within 5s')), 5000);
+                    waiting = (v) => {
+                        clearTimeout(timer);
+                        r(v);
+                    };
+                    push();
+                }),
+                close: () => req.destroy(),
+            });
+        });
+        req.on('error', reject);
+    });
+}
+async function nextRecord(f) {
+    for (;;) {
+        const l = await f.next();
+        if (l !== '')
+            return l;
+    }
+}
+const control = (line) => {
+    try {
+        const v = JSON.parse(line ?? '');
+        return v.type === 'tabtape' ? v.data.event : '';
+    }
+    catch {
+        return '';
+    }
+};
+describe('live viewing over HTTP', () => {
+    it('streams existing, then new lines, then ends', async () => {
+        const s = await serve({ segmentBytes: 1 << 10 });
+        for (let i = 0; i < 5; i++)
+            appendEvent(s.st, 'a', i); // several segments
+        const plain = (await get(s, '/api/sessions/a/events')).body;
+        const f = await openFollow(s, 'a');
+        let backlog = '';
+        for (;;) {
+            const l = await nextRecord(f);
+            if (control(l) === 'live')
+                break;
+            backlog += l + '\n';
+        }
+        expect(backlog).toBe(plain);
+        appendEvent(s.st, 'a', 10);
+        expect(await nextRecord(f)).toContain('"ts":10,');
+        s.st.end('a', 0);
+        expect(control(await nextRecord(f))).toBe('ended');
+        expect(await f.next()).toBeNull();
+    });
+    it('sends keep-alives on idle streams', async () => {
+        const s = await serve({ keepAliveMs: 50 });
+        appendEvent(s.st, 'a', 1);
+        const f = await openFollow(s, 'a');
+        await nextRecord(f);
+        expect(control(await nextRecord(f))).toBe('live');
+        expect(await f.next()).toBe('');
+        appendEvent(s.st, 'a', 2);
+        expect(await nextRecord(f)).toContain('"ts":2,');
+        f.close();
+    });
+    it('limits viewers and reports them to the extension', async () => {
+        const s = await serve();
+        appendEvent(s.st, 'a', 1);
+        appendEvent(s.st, 'b', 1);
+        const open = [];
+        for (let i = 0; i < follow_1.MAX_FOLLOWERS; i++) {
+            const f = await openFollow(s, i % 2 ? 'b' : 'a');
+            expect(f.status).toBe(200);
+            await nextRecord(f);
+            open.push(f);
+        }
+        const extra = await openFollow(s, 'a');
+        expect(extra.status).toBe(429);
+        const r = await request(s, 'POST', `${MOUNT}/api/sessions/a/events`, { headers: client, body: '{"ts":5,"type":"event","data":{}}' });
+        expect(JSON.parse(r.body).followers).toBe(follow_1.MAX_FOLLOWERS / 2);
+        open[0].close();
+        const deadline = Date.now() + 5000;
+        for (;;) {
+            const f = await openFollow(s, 'a');
+            if (f.status === 200) {
+                f.close();
+                break;
+            }
+            if (Date.now() > deadline)
+                throw new Error('no slot freed after a viewer left');
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        }
+        for (const f of open)
+            f.close();
+    });
+    it('ends on delete and shutdown', async () => {
+        const s = await serve();
+        appendEvent(s.st, 'a', 1);
+        appendEvent(s.st, 'b', 1);
+        const a = await openFollow(s, 'a');
+        const b = await openFollow(s, 'b');
+        await nextRecord(a);
+        await nextRecord(b);
+        expect(control(await nextRecord(a))).toBe('live');
+        expect(control(await nextRecord(b))).toBe('live');
+        s.st.delete('a');
+        expect(await nextRecord(a)).toBeNull();
+        s.stop();
+        expect(await nextRecord(b)).toBeNull();
+        expect((await openFollow(s, 'nope')).status).toBe(404);
+    });
+    it('reports data deleted before the viewer read it', async () => {
+        const s = await serve({ segmentBytes: 1 << 10 });
+        for (let i = 0; i < 8; i++)
+            appendEvent(s.st, 'a', i);
+        const { segments } = s.st.snapshot('a');
+        expect(segments.length).toBeGreaterThanOrEqual(2);
+        const f = new follow_1.Follower();
+        const sink = () => { };
+        expect(await f.send(segments.slice(0, 1), sink)).toBe(false);
+        // Pretend the viewer read only half of the first segment, which the ring buffer then deleted.
+        f.off = Math.floor(f.off / 2);
+        expect(await f.send(segments.slice(1), sink)).toBe(true);
+        expect(await f.send(segments.slice(1), sink)).toBe(false);
+    });
+});
+function openWS(s, id, origin) {
+    return new Promise((resolve, reject) => {
+        const ws = new ws_1.default(`ws://127.0.0.1:${s.port}${MOUNT}/api/sessions/${id}/events?follow=1`, {
+            origin: origin ?? `http://127.0.0.1:${s.port}`,
+        });
+        const lines = [];
+        let wake = null;
+        const closed = new Promise((r) => ws.on('close', (code, reason) => r({ code, reason: reason.toString() })));
+        ws.on('message', (data) => {
+            const text = data.toString();
+            expect(text.endsWith('\n')).toBe(true); // complete lines only
+            for (const l of text.split('\n').slice(0, -1))
+                lines.push(l);
+            wake?.();
+        });
+        ws.on('unexpected-response', (_req, res) => reject(new Error(`HTTP ${res.statusCode}`)));
+        ws.on('open', () => resolve({
+            ws,
+            lines,
+            closed,
+            nextLine: async () => {
+                const deadline = Date.now() + 5000;
+                while (!lines.length) {
+                    if (Date.now() > deadline)
+                        throw new Error('no line within 5s');
+                    await new Promise((r) => {
+                        wake = r;
+                        setTimeout(r, 50);
+                    });
+                }
+                return lines.shift();
+            },
+        }));
+        ws.on('error', () => { });
+    });
+}
+describe('live viewing over WebSocket', () => {
+    it('streams the session like the HTTP stream', async () => {
+        const s = await serve({ segmentBytes: 1 << 10 });
+        for (let i = 0; i < 5; i++)
+            appendEvent(s.st, 'a', i);
+        // A record far larger than a read chunk still arrives whole.
+        s.st.append('a', [(0, record_1.parseRecord)(`{"ts":6,"type":"rrweb","data":{"type":3,"pad":"${'y'.repeat(600000)}"}}`)]);
+        const plain = (await get(s, '/api/sessions/a/events')).body;
+        const c = await openWS(s, 'a');
+        let backlog = '';
+        for (;;) {
+            const l = await c.nextLine();
+            if (control(l) === 'live')
+                break;
+            backlog += l + '\n';
+        }
+        expect(backlog).toBe(plain);
+        appendEvent(s.st, 'a', 10);
+        expect(await c.nextLine()).toContain('"ts":10,');
+        s.st.end('a', 0);
+        expect(control(await c.nextLine())).toBe('ended');
+        expect((await c.closed).code).toBe(1000);
+    });
+    it('checks the origin and the host', async () => {
+        const s = await serve();
+        appendEvent(s.st, 'a', 1);
+        await expect(openWS(s, 'a', 'https://evil.example')).rejects.toThrow('HTTP 403');
+        await expect(openWS(s, 'a', 'http://localhost:3000')).rejects.toThrow('HTTP 403');
+        const ext = await openWS(s, 'a', 'chrome-extension://abcdef');
+        ext.ws.close();
+    });
+    it('closes with 4404 and 4429', async () => {
+        const s = await serve();
+        const missing = await openWS(s, 'nope');
+        expect((await missing.closed).code).toBe(4404);
+        appendEvent(s.st, 'a', 1);
+        const open = [];
+        for (let i = 0; i < follow_1.MAX_FOLLOWERS; i++) {
+            const c = await openWS(s, 'a');
+            await c.nextLine();
+            open.push(c);
+        }
+        const extra = await openWS(s, 'a');
+        const closed = await extra.closed;
+        expect(closed.code).toBe(4429);
+        expect(closed.reason).toContain(`at most ${follow_1.MAX_FOLLOWERS}`);
+        for (const c of open)
+            c.ws.close();
+    });
+    it('closes with 1000 on delete and 1001 on shutdown', async () => {
+        const s = await serve();
+        appendEvent(s.st, 'a', 1);
+        appendEvent(s.st, 'b', 1);
+        const a = await openWS(s, 'a');
+        const b = await openWS(s, 'b');
+        await a.nextLine();
+        await b.nextLine();
+        s.st.delete('a');
+        expect((await a.closed).code).toBe(1000);
+        s.stop();
+        expect((await b.closed).code).toBe(1001);
+    });
+});
+describe('features', () => {
+    async function seed(s) {
+        let r = await request(s, 'POST', `${MOUNT}/api/sessions`, {
+            headers: client,
+            body: '{"id":"s1","startedAt":1000,"url":"https://a.test/","title":"A","userAgent":"Chrome/141 Mac OS X"}',
+        });
+        expect(r.status).toBe(201);
+        const batch = [
+            '{"ts":1000,"type":"rrweb","data":{"type":4,"data":{"href":"https://a.test/","width":800,"height":600},"timestamp":1000}}',
+            '{"ts":1000,"type":"rrweb","data":{"type":2,"data":{"node":{"type":0,"childNodes":[],"id":1}},"timestamp":1000}}',
+            '{"ts":1500,"type":"event","data":{"name":"click","url":"https://a.test/","target":{"tag":"button","selector":"#pay","text":"Pay"}}}',
+            '{"ts":1600,"type":"network","data":{"kind":"fetch","method":"POST","url":"https://a.test/api/pay","status":500,"reqHeaders":{"authorization":"Bearer t0ken"},"resBody":"{\\"error\\":\\"card_declined\\"}"}}',
+            '{"ts":2000,"type":"rrweb","data":{"type":3,"data":{"source":1,"positions":[]},"timestamp":2000}}',
+        ].join('\n');
+        r = await request(s, 'POST', `${MOUNT}/api/sessions/s1/events`, { headers: client, body: batch });
+        expect(r.status).toBe(200);
+    }
+    it('writes reproduction steps', async () => {
+        const s = await serve();
+        await seed(s);
+        let r = await get(s, '/api/sessions/s1/repro');
+        expect(r.status).toBe(200);
+        expect(r.headers['content-type']).toMatch(/^text\/markdown/);
+        expect(r.body).toContain('1. Clicked "Pay"');
+        expect(r.body).toContain('**500**');
+        expect(r.body).toContain('http://127.0.0.1:9998/tabtape/#/s/s1?t=');
+        r = await get(s, '/api/sessions/s1/repro?format=json&lang=tr&from=100');
+        const res = JSON.parse(r.body);
+        expect(res.steps).toBe(1);
+        expect(res.markdown).toContain('tıklandı');
+        expect(res.link.endsWith('?t=100')).toBe(true);
+        expect((await get(s, '/api/sessions/s1/repro?from=-1')).status).toBe(400);
+        expect((await get(s, '/api/sessions/nope/repro')).status).toBe(404);
+    });
+    it('exports HTML', async () => {
+        let s = await serve();
+        await seed(s);
+        expect((await get(s, '/api/sessions/s1/export')).status).toBe(503);
+        s = await serve({ viewer: { js: Buffer.from('1'), css: Buffer.from('') } });
+        await seed(s);
+        const r = await get(s, '/api/sessions/s1/export?bodies=0');
+        expect(r.status).toBe(200);
+        expect(r.headers['content-disposition']).toBe('attachment; filename="tabtape-s1.html"');
+        expect(r.body).toContain('id="tabtape-data"');
+        const est = JSON.parse((await get(s, '/api/sessions/s1/export?bodies=0&estimate=1')).body);
+        expect(Math.abs(est.bytes - r.raw.length)).toBeLessThanOrEqual(100);
+    });
+    it('exports HAR without secrets by default', async () => {
+        const s = await serve();
+        s.st.append('a', [
+            (0, record_1.parseRecord)('{"ts":1,"type":"network","data":{"kind":"fetch","method":"GET","url":"http://x/api","status":200,"reqHeaders":{"authorization":"Bearer test-token"}}}'),
+        ]);
+        let r = await get(s, '/api/sessions/a/har');
+        expect(r.status).toBe(200);
+        expect(r.body).toContain('"version": "1.2"');
+        expect(r.body).toContain('http://x/api');
+        expect(r.body).not.toContain('test-token');
+        r = await get(s, '/api/sessions/a/har?secrets=1');
+        expect(r.body).toContain('test-token');
+        expect((await get(s, '/api/sessions/nope/har')).status).toBe(404);
+        expect((await get(s, '/api/sessions/a/har?from=x')).status).toBe(400);
+    });
+});

package/daemon/dist/tabtape/api/static.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uiRouter = uiRouter;
+exports.viewerLoader = viewerLoader;
+/**
+ * The replay UI and the offline viewer, built by tabtape/ui:
+ *   <dist>/app      the replay UI (Vite, base /tabtape/)
+ *   <dist>/export   viewer.js + viewer.css, inlined into "Download HTML" files
+ * Without a build, a page explaining how to build it is served instead.
+ */
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const PLACEHOLDER = `<!doctype html>
+<meta charset="utf-8" />
+<title>tabtape</title>
+<style>body{font:15px system-ui,sans-serif;max-width:560px;margin:80px auto;color:#18181b}code{background:#f4f4f5;padding:2px 6px;border-radius:4px}</style>
+<h1>tabtape is running</h1>
+<p>The replay UI is not built. In the Repoburg repository run <code>cd tabtape &amp;&amp; npm install &amp;&amp; npm run build</code>, then reload this page.</p>
+`;
+/** Serves the replay UI from <dist>/app, or the placeholder page. */
+function uiRouter(dist) {
+    const router = express_1.default.Router();
+    const appDir = dist ? path_1.default.join(dist, 'app') : null;
+    // Checked per request: building the UI does not need a daemon restart.
+    const built = () => !!appDir && fs_1.default.existsSync(path_1.default.join(appDir, 'index.html'));
+    if (appDir) {
+        const serve = express_1.default.static(appDir, { fallthrough: true, index: 'index.html' });
+        router.use((req, res, next) => (built() ? serve(req, res, next) : next()));
+    }
+    router.get(['/', '/index.html'], (_req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+        res.end(PLACEHOLDER);
+    });
+    return router;
+}
+/**
+ * Loads the offline viewer that HTML exports embed; null when the UI was
+ * built without it. Re-read when the build changes.
+ */
+function viewerLoader(dist) {
+    let cached = null;
+    return () => {
+        if (!dist)
+            return null;
+        const js = path_1.default.join(dist, 'export', 'viewer.js');
+        let stat;
+        try {
+            stat = fs_1.default.statSync(js);
+        }
+        catch {
+            cached = null;
+            return null;
+        }
+        if (cached && cached.mtimeMs === stat.mtimeMs)
+            return cached.assets;
+        let css = Buffer.alloc(0);
+        try {
+            css = fs_1.default.readFileSync(path_1.default.join(dist, 'export', 'viewer.css'));
+        }
+        catch {
+            // no CSS: the viewer still works
+        }
+        cached = { mtimeMs: stat.mtimeMs, assets: { js: fs_1.default.readFileSync(js), css } };
+        return cached.assets;
+    };
+}