rrweb-stack

Two OSS products on one rrweb-based substrate. Both ship as npm packages today.

Above: npx @tracelane/cli init in a real WebdriverIO project — detect runner, install, edit wdio.conf.ts, ignore reports dir.

Above: peek sessions list then peek sessions show ... --format markdown — a recorded browser session as queryable structured output, AI-ready.

What's where

tracelane

Docs: tracelane.cubenest.in (source under apps/tracelane-docs/). The tracelane-wdio README is the right starting point.

peek

Docs: peek.cubenest.in (source under apps/peek-docs/).

peek requires Node.js ≥ 22. Its native better-sqlite3 dependency only ships prebuilt binaries for Node 22+; on older Node (notably Windows, which has no C/C++ toolchain by default) the install falls back to compiling from source and fails.

Related MCP server: AgentWatch

Shared substrate

@cubenest/rrweb-core — vendored PostHog rrweb fork, PII masking primitives, large-DOM throttling, screenshot fallback, network/console capture abstractions, compression helpers. Used by both products. The fork is pinned by SHA + the substrate's NOTICE attributes both PostHog's plugin lineage and the upstream rrweb roots.

Why two products, one repo

Same recording engine, same trust model, two different consumer surfaces:

• tracelane ships test-time captures into a self-contained HTML artifact your team and AI agents can read offline.

• peek ships live-browser captures into an MCP server your AI coding agent can query — and, with your explicit per-origin consent, drive the live page through.

peek's live read + act tools are gated by a five-level per-origin permission model (0 Off → 1 Read-only → 2 Suggest-only → 3 Act-with-confirm → 4 YOLO, the default is Level 1) with a destructive-action blocklist that always prompts. No telemetry, no cloud — everything stays in ~/.peek.

Shared upstream means one fork to track, one masking surface to harden, one license + DCO + security policy.

Pre-launch state

Pre-1.0. Alpha packages live on npm. Branch protection is on main (PR + CI + DCO + linear history). All workflows use Trusted Publishing OIDC + SLSA provenance. Renovate runs with a 7-day cooldown (21 days for the @posthog/rrweb lineage) and config:best-practices. tracelane has publicly launched (npm alpha + a live demo report); peek is alpha on npm and its Chrome MV3 extension is available on the Chrome Web Store.

Security

Report a vulnerability via SECURITY.md. The shared threat model for both products lives in docs/SECURITY-NOTES.md.

License

Apache-2.0. See LICENSE.

Contributing

Apache 2.0. DCO sign-off required on all contributions. See CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md.

Sponsor / support

• GitHub Sponsors — github.com/sponsors/harry-harish (opening for launch)

• The work is open-source and sustainable; sponsorship keeps it that way. See docs/SUSTAINABILITY.md for the maintenance cadence.