repoburg 1.3.255 → 1.3.257

package/daemon/dist/tabtape/har/har.spec.js

@@ -0,0 +1,325 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const reader_1 = require("../query/reader");
+const redact_1 = require("../redact");
+const qt = __importStar(require("../testing/querytest"));
+const tmp_1 = require("../testing/tmp");
+const har_1 = require("./har");
+/** TABTAPE_UPDATE_GOLDEN=1 rewrites the golden files; review the diff. */
+const UPDATE = process.env.TABTAPE_UPDATE_GOLDEN === '1';
+const T = qt.T0;
+afterEach(async () => {
+    await qt.closeTestStores();
+    (0, tmp_1.cleanupTempDirs)();
+});
+const blocked = (name, ...reasons) => ({ name, reasons });
+async function session() {
+    const st = qt.testStore();
+    const id = 's1';
+    qt.start(st, id, 1000, 'http://localhost:7788/', 'Demo');
+    qt.append(st, id, qt.rrMeta(1000, 'http://localhost:7788/', 1280, 800), qt.rrFull(1000), qt.pageView(1000, 'load', 'http://localhost:7788/', 'Demo'), qt.net(900, { id: 'd1', kind: 'navigation', method: 'GET', url: 'http://localhost:7788/', status: 200, duration: 40, navType: 'navigate' }), qt.net(1050, { id: 'r1', kind: 'resource', method: 'GET', url: 'http://localhost:7788/logo.svg', initiator: 'img', duration: 5.4, transferSize: 300 }), qt.net(1100, {
+        id: 'f1',
+        kind: 'fetch',
+        method: 'GET',
+        url: '/api/data?x=1&y=two%20words',
+        status: 200,
+        statusText: 'OK',
+        duration: 50,
+        ttfb: 20,
+        reqHeaders: { authorization: 'Bearer test-token', 'x-test': '1' },
+        resHeaders: { 'content-type': 'application/json', 'set-cookie': 'a=1; Path=/' },
+        resBody: '{"ok":true}',
+        resSize: 11,
+    }), qt.net(1200, {
+        id: 'x1',
+        kind: 'xhr',
+        method: 'post',
+        url: 'http://localhost:7788/api/broken',
+        status: 500,
+        statusText: 'Internal Server Error',
+        duration: 12,
+        reqHeaders: { 'content-type': 'application/json' },
+        reqBody: '{"a":1}',
+        resBody: 'x',
+        resBodyTruncated: true,
+    }), qt.net(1300, { id: 'f2', kind: 'fetch', method: 'GET', url: 'http://localhost:9/down', error: 'TypeError: Failed to fetch', duration: 3 }), qt.net(1900, { id: 'n1', kind: 'navigation', method: 'GET', url: 'http://localhost:7788/b.html', status: 200, duration: 80, ttfb: 30, navType: 'navigate' }), qt.pageView(2000, 'load', 'http://localhost:7788/b.html', 'B'), qt.net(2100, { id: 'b1', kind: 'beacon', method: 'POST', url: '/collect', reqBodyNote: 'Blob, 12 bytes', pending: true }), qt.rrInc(2500));
+    return new reader_1.Reader(st).view(id);
+}
+async function deepSession() {
+    const st = qt.testStore();
+    const id = 'd1';
+    qt.start(st, id, 1000, 'http://localhost:7788/ws.html', 'WS');
+    qt.append(st, id, qt.rrMeta(1000, 'http://localhost:7788/ws.html', 1280, 800), qt.rrFull(1000), qt.pageView(1000, 'load', 'http://localhost:7788/ws.html', 'WS'), qt.net(1100, {
+        id: 'cdp-1',
+        kind: 'fetch',
+        method: 'GET',
+        url: 'http://localhost:7788/api/products',
+        status: 200,
+        statusText: 'OK',
+        source: 'cdp',
+        resourceType: 'fetch',
+        protocol: 'http/1.1',
+        remoteAddress: '127.0.0.1:7788',
+        duration: 42,
+        ttfb: 30,
+        timing: { blocked: 1.5, dns: 2, connect: 3, ssl: -1, send: 0.5, wait: 30, receive: 5 },
+        reqHeaders: { cookie: 'sid=abc; theme=dark', accept: '*/*' },
+        resHeaders: { 'content-type': 'application/json', 'set-cookie': 'tabtape_demo=1; SameSite=None\nok=1; Path=/' },
+        resBody: '[{"name":"Trail shoes"}]',
+        resSize: 24,
+        transferSize: 180,
+        blockedSetCookies: [blocked('tabtape_demo', 'SameSiteNoneInsecure')],
+    }), qt.net(1200, {
+        id: 'cdp-2',
+        kind: 'fetch',
+        method: 'GET',
+        url: 'http://127.0.0.1:7789/api/cors',
+        source: 'cdp',
+        resourceType: 'fetch',
+        error: 'net::ERR_FAILED',
+        corsErrorStatus: { corsError: 'MissingAllowOriginHeader' },
+        duration: 4,
+    }), qt.net(1250, {
+        id: 'cdp-3',
+        kind: 'resource',
+        method: 'GET',
+        url: 'http://localhost:7788/logo.svg',
+        status: 200,
+        source: 'cdp',
+        resourceType: 'image',
+        initiator: 'image',
+        cache: 'memory',
+        duration: 0.4,
+    }), qt.net(1300, {
+        id: 'cdp-4',
+        kind: 'fetch',
+        method: 'GET',
+        url: 'http://localhost:7788/api/worker-data',
+        status: 200,
+        source: 'cdp',
+        resourceType: 'fetch',
+        worker: { type: 'worker', url: 'http://localhost:7788/worker.js' },
+        duration: 8,
+    }), qt.ws(1450, 'ws-1', 'send', '{"n":1}'), qt.ws(1460, 'ws-1', 'recv', '{"n":1}'), { ts: 1470, type: 'ws', data: { conn: 'ws-1', dir: 'recv', opcode: 2, size: 1024 } }, 
+    // Written when the socket closes, with the open time as ts.
+    qt.net(1400, {
+        id: 'ws-1',
+        kind: 'websocket',
+        method: 'GET',
+        url: 'ws://localhost:7788/echo',
+        status: 101,
+        statusText: 'Switching Protocols',
+        source: 'cdp',
+        resourceType: 'websocket',
+        duration: 600,
+        closedAt: 2000,
+        reqHeaders: { upgrade: 'websocket', cookie: 'sid=abc' },
+        resHeaders: { upgrade: 'websocket' },
+        frames: { sent: 1, received: 2, sentBytes: 7, receivedBytes: 1031 },
+    }), qt.rrInc(2500));
+    return new reader_1.Reader(st).view(id);
+}
+/** A session with a Meta + full snapshot at T and the given records. */
+async function sessionWith(...recs) {
+    const st = qt.testStore();
+    qt.start(st, 's1', T, 'http://app.test/', 'App');
+    qt.append(st, 's1', qt.rrMeta(T, 'http://app.test/', 800, 600), qt.rrFull(T), qt.pageView(T, 'load', 'http://app.test/', 'App'), ...recs);
+    return new reader_1.Reader(st).view('s1');
+}
+/** The HAR as the API writes it. */
+async function build(v, opts = {}) {
+    const har = await (0, har_1.buildHar)(v, { redact: new redact_1.RedactHeaders(), ...opts, version: 'test' });
+    return JSON.stringify(har, null, 2) + '\n';
+}
+async function parse(v, opts = {}) {
+    return JSON.parse(await build(v, opts));
+}
+function golden(name, got) {
+    const file = path_1.default.join(__dirname, 'testdata', name);
+    if (UPDATE)
+        fs_1.default.writeFileSync(file, got);
+    expect(got).toBe(fs_1.default.readFileSync(file, 'utf8'));
+}
+function byURL(h) {
+    return new Map(h.log.entries.map((e) => [e.request.url, e]));
+}
+function entryFor(h, url) {
+    const e = byURL(h).get(url);
+    if (!e)
+        throw new Error(`no entry for ${url}`);
+    return e;
+}
+describe('buildHar', () => {
+    it('matches the golden file', async () => {
+        golden('session.har', await build(await session()));
+    });
+    it('leaves sensitive headers out unless asked', async () => {
+        const v = await session();
+        expect(await build(v)).not.toContain('test-token');
+        expect(await build(v, { secrets: true })).toContain('test-token');
+    });
+    it('selects a range and the pages its entries belong to', async () => {
+        // 1_150–1_950 ms → offsets 150–950: the XHR, the failed fetch and the
+        // document request of page B.
+        const h = await parse(await session(), { from: 150, to: 950 });
+        expect(h.log.entries.map((e) => e.request.url).join(' ')).toBe('http://localhost:7788/api/broken http://localhost:9/down http://localhost:7788/b.html');
+        expect(h.log.pages.map((p) => p.id).join(' ')).toBe('page_1 page_2');
+    });
+    it('converts deep mode records', async () => {
+        const got = await build(await deepSession());
+        golden('deep.har', got);
+        const h = JSON.parse(got);
+        const products = entryFor(h, 'http://localhost:7788/api/products');
+        expect(products.timings).toMatchObject({ dns: 2, connect: 3, ssl: -1, wait: 30 });
+        expect(products.time).toBe(42); // the recorded split's sum
+        expect([products.request.httpVersion, products.serverIPAddress]).toEqual(['HTTP/1.1', '127.0.0.1']);
+        expect(products.comment).toContain('Set-Cookie tabtape_demo rejected: SameSite=None requires Secure');
+        const cors = entryFor(h, 'http://127.0.0.1:7789/api/cors');
+        expect(cors.response.status).toBe(0);
+        expect(cors.comment).toContain('no Access-Control-Allow-Origin header');
+        expect(entryFor(h, 'http://localhost:7788/logo.svg')._fromCache).toBe('memory');
+        const ws = entryFor(h, 'ws://localhost:7788/echo');
+        expect(ws._resourceType).toBe('websocket');
+        expect((ws._webSocketMessages ?? []).map((m) => [m.type, m.opcode])).toEqual([
+            ['send', 1],
+            ['receive', 1],
+            ['receive', 2],
+        ]);
+        expect(got).not.toContain('sid=abc'); // cookie values stay out of the default (sanitized) HAR
+    });
+    it('lists cookies when secrets are kept', async () => {
+        const h = await parse(await deepSession(), { secrets: true });
+        const products = entryFor(h, 'http://localhost:7788/api/products');
+        expect(products.request.headers.map((x) => x.name)).toEqual(['accept', 'cookie']);
+        expect(products.request.cookies).toEqual([
+            { name: 'sid', value: 'abc' },
+            { name: 'theme', value: 'dark' },
+        ]);
+        expect(products.response.headers.map((x) => x.name)).toEqual(['content-type', 'set-cookie']);
+        expect(products.response.cookies).toEqual([
+            { name: 'tabtape_demo', value: '1' },
+            { name: 'ok', value: '1' },
+        ]);
+        expect(entryFor(h, 'ws://localhost:7788/echo').request.cookies).toEqual([{ name: 'sid', value: 'abc' }]);
+        expect(h.log.comment).not.toContain('Sensitive headers');
+    });
+    it('names resource types and protocols and resolves redirects', async () => {
+        const res = (ts, id, url, more = {}) => qt.net(ts, { id, kind: 'resource', method: 'GET', url, ...more });
+        const h = await parse(await sessionWith(qt.net(T + 1, { id: 'a', kind: 'navigation', method: 'GET', url: 'http://app.test/old', status: 302, protocol: 'h2', resHeaders: { Location: '/new?x=1' } }), res(T + 2, 'b', 'http://app.test/site', { mime: 'text/css; charset=utf-8', protocol: 'h3-29' }), res(T + 3, 'c', 'http://app.test/app.JS?v=2', { protocol: 'HTTP/1.1' }), res(T + 4, 'd', 'http://app.test/font', { initiator: 'css', protocol: 'spdy' }), 
+        // A malformed media type is ignored, as by mime.ParseMediaType.
+        res(T + 5, 'e', 'http://app.test/x.png', { mime: 'text/html; charset' }), res(T + 6, 'f', 'http://app.test/thing'), 
+        // Go's url.Parse: an opaque URL has no path, so no extension.
+        res(T + 7, 'g', 'data:text/plain,hello.js')));
+        const types = h.log.entries.map((e) => [e.request.url, e._resourceType, e.request.httpVersion]);
+        expect(types).toEqual([
+            ['http://app.test/old', 'document', 'HTTP/2'],
+            ['http://app.test/site', 'stylesheet', 'HTTP/3'],
+            ['http://app.test/app.JS?v=2', 'script', 'HTTP/1.1'],
+            ['http://app.test/font', 'stylesheet', 'spdy'],
+            ['http://app.test/x.png', 'image', ''],
+            ['http://app.test/thing', 'other', ''],
+            ['data:text/plain,hello.js', 'other', ''],
+        ]);
+        expect(h.log.entries[0].response.redirectURL).toBe('http://app.test/new?x=1');
+    });
+    it('notes open sockets, blocked cookies and truncated bodies', async () => {
+        const h = await parse(await sessionWith(qt.net(T + 1, { id: 'w', kind: 'websocket', method: 'GET', url: 'wss://app.test/live', status: 101, pending: true, duration: 250 }), qt.ws(T + 2, 'w', 'recv', 'hi'), { ts: T + 3, type: 'ws', data: { conn: 'w', dir: 'recv', opcode: 1, size: 2, error: 'decode failed' } }, qt.net(T + 4, {
+            id: 'p',
+            kind: 'fetch',
+            method: 'put',
+            url: 'http://app.test/api?q=100%&a+b=c%20d',
+            status: 200,
+            duration: 20,
+            ttfb: 50,
+            reqBody: 'héllo',
+            resBody: 'é😀',
+            resBodyTruncated: true,
+            blockedCookies: [blocked('sid', 'SameSiteLax', 'Weird')],
+        })));
+        const ws = entryFor(h, 'wss://app.test/live');
+        expect(ws.comment).toBe('Still open when the recording stopped');
+        expect([ws.time, ws.timings.wait, ws.timings.receive]).toEqual([250, 0, 250]);
+        expect(ws._webSocketMessages).toEqual([{ type: 'receive', time: (T + 2) / 1000, opcode: 1, data: 'hi' }]); // not the failed frame
+        const p = entryFor(h, 'http://app.test/api?q=100%&a+b=c%20d');
+        expect(p.request.method).toBe('PUT');
+        expect(p.request.queryString).toEqual([
+            { name: 'q', value: '100%' }, // a malformed escape keeps the raw pair
+            { name: 'a b', value: 'c d' },
+        ]);
+        expect(p.request.bodySize).toBe(6); // bytes
+        expect(p.request.postData).toEqual({ mimeType: 'application/octet-stream', text: 'héllo' });
+        expect(p.response.content).toEqual({ size: 0, mimeType: 'x-unknown', text: 'é😀', comment: 'Truncated by tabtape after 2 characters' });
+        expect([p.timings.wait, p.timings.receive, p.time]).toEqual([20, 0, 20]); // ttfb beyond the duration is ignored
+        expect(p.comment).toBe('Cookie sid not sent: SameSite=Lax: not sent on cross-site requests [SameSiteLax]; Weird');
+    });
+    it('describes sessions where deep mode ended', async () => {
+        const h = await parse(await sessionWith(qt.net(T + 1, { id: 'x', kind: 'fetch', method: 'GET', url: 'http://app.test/a', source: 'cdp', resourceType: 'fetch' }), qt.net(T + 2, { id: 'y', kind: 'fetch', method: 'GET', url: 'http://app.test/b' })));
+        expect(h.log.comment?.startsWith('Recorded by tabtape in deep mode')).toBe(true);
+        expect(h.log.comment).toContain(' Deep mode ended during the recording: later requests were captured in the page');
+        expect(h.log.comment).toMatch(/Sensitive headers were left out: authorization, cookie, proxy-authorization, set-cookie, x-api-key\.$/);
+    });
+    it('names the browser and the creator', async () => {
+        const st = qt.testStore();
+        const uas = {
+            edge: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.3537.57',
+            firefox: 'Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0',
+            safari: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15',
+            other: 'curl/8.7.1',
+        };
+        const rd = new reader_1.Reader(st);
+        const got = {};
+        for (const [id, userAgent] of Object.entries(uas)) {
+            st.start({ id, startedAt: T, url: 'http://app.test/', title: 'App', userAgent });
+            qt.append(st, id, qt.rrMeta(T, 'http://app.test/', 800, 600), qt.rrFull(T));
+            got[id] = (await (0, har_1.buildHar)(await rd.view(id), { redact: new redact_1.RedactHeaders(), version: '' })).log.browser;
+        }
+        expect(got).toEqual({
+            edge: { name: 'Microsoft Edge', version: '141.0.3537.57' },
+            firefox: { name: 'Firefox', version: '131.0' },
+            safari: { name: 'Safari', version: '17.4' },
+            other: undefined,
+        });
+        const h = await (0, har_1.buildHar)(await rd.view('other'), { redact: new redact_1.RedactHeaders(), version: '' });
+        expect('browser' in h.log).toBe(false);
+        expect(h.log.creator).toEqual({ name: 'tabtape', version: 'dev' });
+        expect(h.log.pages).toEqual([]);
+    });
+});

package/daemon/dist/tabtape/index.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TABTAPE_VERSION = exports.TABTAPE_MOUNT = void 0;
+exports.resolveTabtapeUiDist = resolveTabtapeUiDist;
+exports.createTabtape = createTabtape;
+const path_1 = __importDefault(require("path"));
+const buffer_1 = require("./buffer/buffer");
+const config_1 = require("./config");
+const lock_1 = require("./lock");
+const log_1 = require("./log");
+const server_1 = require("./mcp/server");
+const reader_1 = require("./query/reader");
+const redact_1 = require("./redact");
+const store_1 = require("./store/store");
+const follow_1 = require("./api/follow");
+const record_1 = require("./api/record");
+const router_1 = require("./api/router");
+const static_1 = require("./api/static");
+const ws_1 = require("./api/ws");
+var config_2 = require("./config");
+Object.defineProperty(exports, "TABTAPE_MOUNT", { enumerable: true, get: function () { return config_2.TABTAPE_MOUNT; } });
+Object.defineProperty(exports, "TABTAPE_VERSION", { enumerable: true, get: function () { return config_2.TABTAPE_VERSION; } });
+/**
+ * Resolve the replay UI build ABSOLUTELY from the daemon's module directory
+ * (daemon/src in dev, daemon/dist in prod) — never against the process cwd
+ * (pm2 God-daemon-cwd bug class). Works for the published layout too
+ * (repoburg/daemon/dist -> repoburg/tabtape/ui/dist).
+ */
+function resolveTabtapeUiDist(fromDir) {
+    return path_1.default.resolve(fromDir, '../../tabtape/ui/dist');
+}
+/** Opens the stores (repairing and trimming them) and builds the routes. */
+function createTabtape(opts) {
+    const config = opts.config ?? (0, config_1.loadConfig)();
+    const mount = opts.mount ?? config_1.TABTAPE_MOUNT;
+    const logger = opts.logger ?? (0, log_1.consoleLogger)();
+    const lock = (0, lock_1.lockDir)(config.dataDir);
+    let st;
+    let buffers;
+    try {
+        st = store_1.Store.open({
+            dir: config.dataDir,
+            maxBytes: config.maxBytes,
+            segmentBytes: config.segmentBytes,
+            compress: config.compress,
+            logger,
+        });
+    }
+    catch (err) {
+        lock.release();
+        throw err;
+    }
+    try {
+        buffers = buffer_1.BufferStore.open({ dir: path_1.default.join(config.dataDir, 'buffer'), maxBytes: config.bufferBytes, logger });
+    }
+    catch (err) {
+        void st.close().finally(() => lock.release());
+        throw err;
+    }
+    const rd = new reader_1.Reader(st);
+    const redact = new redact_1.RedactHeaders(config.redactHeaders);
+    // Record links carry this token; the MCP tool get_record_link hands it
+    // out. A new one each start: links from an earlier run stop working.
+    const recordToken = (0, record_1.newRecordToken)();
+    const mcp = new server_1.TabtapeMcp(st, rd, {
+        version: config_1.TABTAPE_VERSION,
+        baseURL: opts.baseURL,
+        redact,
+        showSecrets: config.showSecrets,
+        token: config.mcpToken,
+        recordToken,
+        logger,
+    });
+    let stopNow;
+    const stop = new Promise((resolve) => {
+        stopNow = resolve;
+    });
+    const followers = new follow_1.Followers();
+    const router = (0, router_1.createApiRouter)({
+        st,
+        rd,
+        buffers,
+        version: config_1.TABTAPE_VERSION,
+        baseURL: opts.baseURL,
+        mount,
+        redact,
+        uiDist: opts.uiDist,
+        viewer: (0, static_1.viewerLoader)(opts.uiDist),
+        mcp,
+        recordToken,
+        followers,
+        stop,
+        logger,
+        keepAliveMs: opts.keepAliveMs,
+    });
+    const upgrades = new ws_1.FollowUpgrade({ st, followers, stop, mount, logger, keepAliveMs: opts.keepAliveMs });
+    const stats = st.stats();
+    logger.info('recording sessions', {
+        ui: `${opts.baseURL}/`,
+        mcp: `${opts.baseURL}/mcp`,
+        data: config.dataDir,
+        used: (0, config_1.formatSize)(stats.totalBytes),
+        max: (0, config_1.formatSize)(config.maxBytes),
+        compress: config.compress,
+        sessions: stats.sessions,
+    });
+    let closed = null;
+    return {
+        router,
+        mount,
+        config,
+        handlesUpgrade: (req) => upgrades.matches(req),
+        handleUpgrade: (req, socket, head) => upgrades.handle(req, socket, head),
+        close: () => {
+            if (!closed) {
+                closed = (async () => {
+                    stopNow();
+                    upgrades.close();
+                    buffers.close();
+                    try {
+                        await st.close();
+                    }
+                    finally {
+                        lock.release();
+                    }
+                })();
+            }
+            return closed;
+        },
+    };
+}

package/daemon/dist/tabtape/index.spec.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const path_1 = __importDefault(require("path"));
+const ws_1 = __importDefault(require("ws"));
+const config_1 = require("./config");
+const index_1 = require("./index");
+const log_1 = require("./log");
+const tmp_1 = require("./testing/tmp");
+describe('loadConfig', () => {
+    it('reads the environment', () => {
+        const c = (0, config_1.loadConfig)({
+            REPOBURG_TABTAPE_DATA: '/x',
+            REPOBURG_TABTAPE_MAX_SIZE: '1GB',
+            REPOBURG_TABTAPE_COMPRESS: 'off',
+            REPOBURG_TABTAPE_MCP_SHOW_SECRETS: '1',
+            REPOBURG_TABTAPE_MCP_TOKEN: 't',
+        }, '/home/me');
+        expect(c).toMatchObject({ dataDir: '/x', maxBytes: 1 << 30, segmentBytes: 16 << 20, compress: 'off', showSecrets: true, mcpToken: 't' });
+        expect((0, config_1.loadConfig)({}, '/home/me').dataDir).toBe(path_1.default.join('/home/me', '.repoburg', 'tabtape'));
+        // Small caps keep eviction granular.
+        expect((0, config_1.loadConfig)({ REPOBURG_TABTAPE_MAX_SIZE: '1MB' }, '/h').segmentBytes).toBe(256 << 10);
+        expect(() => (0, config_1.loadConfig)({ REPOBURG_TABTAPE_COMPRESS: 'zstd' }, '/h')).toThrow(/REPOBURG_TABTAPE_COMPRESS/);
+        expect(() => (0, config_1.loadConfig)({ REPOBURG_TABTAPE_MAX_SIZE: 'lots' }, '/h')).toThrow(/REPOBURG_TABTAPE_MAX_SIZE/);
+    });
+});
+describe('createTabtape', () => {
+    let tabtape = null;
+    let server = null;
+    afterEach(async () => {
+        server?.closeAllConnections();
+        await new Promise((r) => (server ? server.close(() => r()) : r()));
+        await tabtape?.close();
+        tabtape = null;
+        server = null;
+        (0, tmp_1.cleanupTempDirs)();
+    });
+    it('mounts like the daemon and serves API, WebSocket and UI', async () => {
+        const dataDir = (0, tmp_1.tempDir)();
+        const uiDist = (0, tmp_1.tempDir)();
+        fs_1.default.mkdirSync(path_1.default.join(uiDist, 'app'));
+        fs_1.default.writeFileSync(path_1.default.join(uiDist, 'app', 'index.html'), '<html>replay</html>');
+        tabtape = (0, index_1.createTabtape)({
+            baseURL: 'http://127.0.0.1:9998/tabtape',
+            uiDist,
+            config: (0, config_1.loadConfig)({ REPOBURG_TABTAPE_DATA: dataDir }),
+            logger: log_1.silentLogger,
+        });
+        const app = (0, express_1.default)();
+        app.use(index_1.TABTAPE_MOUNT, tabtape.router);
+        server = http_1.default.createServer(app);
+        const tt = tabtape;
+        server.on('upgrade', (req, socket, head) => (tt.handlesUpgrade(req) ? tt.handleUpgrade(req, socket, head) : socket.destroy()));
+        await new Promise((r) => server.listen(0, '127.0.0.1', r));
+        const base = `http://127.0.0.1:${server.address().port}${index_1.TABTAPE_MOUNT}`;
+        const health = await (await fetch(`${base}/api/health`)).json();
+        expect(health.ok).toBe(true);
+        expect(health.dir).toBe(dataDir);
+        expect(health.buffers.maxBytes).toBe(100 << 20);
+        expect(await (await fetch(`${base}/`)).text()).toContain('replay');
+        const post = await fetch(`${base}/api/sessions/s1/events`, {
+            method: 'POST',
+            headers: { 'X-Tabtape-Client': 'test' },
+            body: '{"ts":1,"type":"event","data":{"name":"click"}}\n',
+        });
+        expect(post.status).toBe(200);
+        expect(fs_1.default.existsSync(path_1.default.join(dataDir, 'sessions', 's1', 'meta.json'))).toBe(true);
+        const ws = new ws_1.default(`${base.replace('http', 'ws')}/api/sessions/s1/events?follow=1`, { origin: new URL(base).origin });
+        const first = await new Promise((resolve, reject) => {
+            ws.once('message', (d) => resolve(d.toString()));
+            ws.once('error', reject);
+        });
+        expect(first).toContain('"sid":"s1"');
+        const closed = new Promise((r) => ws.once('close', (code) => r(code)));
+        await tabtape.close();
+        expect(await closed).toBe(1001);
+    });
+    it('keeps one process per data directory', async () => {
+        const dataDir = (0, tmp_1.tempDir)();
+        const open = () => (0, index_1.createTabtape)({ baseURL: 'http://127.0.0.1:9998/tabtape', uiDist: null, config: (0, config_1.loadConfig)({ REPOBURG_TABTAPE_DATA: dataDir }), logger: log_1.silentLogger });
+        const first = open();
+        expect(() => open()).toThrow(/already open/);
+        await first.close();
+        // A lock left behind by a process that is gone is taken over.
+        fs_1.default.writeFileSync(path_1.default.join(dataDir, '.lock'), '999999999');
+        tabtape = open();
+        expect(fs_1.default.readFileSync(path_1.default.join(dataDir, '.lock'), 'utf8')).toBe(String(process.pid));
+        // A live process (this test's parent) holds it: refused.
+        await tabtape.close();
+        fs_1.default.writeFileSync(path_1.default.join(dataDir, '.lock'), String(process.ppid));
+        expect(() => open()).toThrow(`in use by process ${process.ppid}`);
+        fs_1.default.rmSync(path_1.default.join(dataDir, '.lock'));
+        tabtape = null;
+    });
+    it('resolves the UI build from the daemon directory', () => {
+        expect((0, index_1.resolveTabtapeUiDist)('/repo/daemon/dist')).toBe(path_1.default.resolve('/repo/tabtape/ui/dist'));
+        expect((0, index_1.resolveTabtapeUiDist)('/repo/daemon/src')).toBe(path_1.default.resolve('/repo/tabtape/ui/dist'));
+    });
+});

package/daemon/dist/tabtape/lock.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockDir = lockDir;
+/**
+ * One process per data directory. Opening the stores repairs segment tails
+ * and clears the buffer directory, which would corrupt the data of a daemon
+ * that is still using it (a second daemon started by mistake, a test harness
+ * pointed at the real directory).
+ */
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const LOCK_NAME = '.lock';
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM'; // exists, owned by someone else
+    }
+}
+/** Takes <dir>/.lock for this process; throws when a live process holds it. A stale lock is taken over. */
+function lockDir(dir) {
+    fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o755 });
+    const file = path_1.default.join(dir, LOCK_NAME);
+    for (let attempt = 0;; attempt++) {
+        try {
+            fs_1.default.writeFileSync(file, String(process.pid), { flag: 'wx', mode: 0o644 });
+            break;
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST' || attempt > 0)
+                throw err;
+            let pid = 0;
+            try {
+                pid = Number(fs_1.default.readFileSync(file, 'utf8').trim());
+            }
+            catch {
+                // unreadable: stale
+            }
+            if (pid === process.pid)
+                throw new Error(`${dir} is already open in this process`);
+            if (Number.isSafeInteger(pid) && pid > 0 && alive(pid)) {
+                throw new Error(`${dir} is in use by process ${pid} (another Repoburg daemon?)`);
+            }
+            fs_1.default.rmSync(file, { force: true }); // left behind by a process that is gone
+        }
+    }
+    let released = false;
+    return {
+        release: () => {
+            if (released)
+                return;
+            released = true;
+            try {
+                if (fs_1.default.readFileSync(file, 'utf8').trim() === String(process.pid))
+                    fs_1.default.unlinkSync(file);
+            }
+            catch {
+                // already gone
+            }
+        },
+    };
+}

package/daemon/dist/tabtape/log.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.silentLogger = void 0;
+exports.consoleLogger = consoleLogger;
+function format(prefix, msg, fields) {
+    if (!fields)
+        return `${prefix} ${msg}`;
+    const parts = Object.entries(fields).map(([k, v]) => {
+        const s = v instanceof Error ? v.message : typeof v === 'string' ? v : JSON.stringify(v);
+        return `${k}=${s}`;
+    });
+    return `${prefix} ${msg} ${parts.join(' ')}`;
+}
+/** Console logger; debug lines only with REPOBURG_TABTAPE_DEBUG=1. */
+function consoleLogger(prefix = '[tabtape]', debugEnabled = process.env.REPOBURG_TABTAPE_DEBUG === '1') {
+    return {
+        debug: (msg, fields) => {
+            if (debugEnabled)
+                console.log(format(prefix, msg, fields));
+        },
+        info: (msg, fields) => console.log(format(prefix, msg, fields)),
+        warn: (msg, fields) => console.warn(format(prefix, msg, fields)),
+        error: (msg, fields) => console.error(format(prefix, msg, fields)),
+    };
+}
+/** Drops everything; for tests. */
+exports.silentLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};