[jamby77]

Summary

Last of three stacked PRs for the Session Explorer. This PR adds the Session Explorer page and a gated end-to-end test against seeded library data. It also carries the fixes from a whole-branch review, some of which touch API code from the earlier PRs.

Stack: fixtures → api → web

Changes

• /session-explorer page with a sidebar entry:
  • namespace setup with preview and a custom schema form;
  • a session list sortable by last access, size or TTL, with an Oversize badge for Pro;
  • a message timeline with tool calls;
  • per-key structured and raw views;
  • an incomplete-timeline banner with reasons;
  • JSON export.
• session-explorer.e2e-spec.ts: seeds every library, boots the API against 6380 and checks each preset end to end. It is skipped unless RUN_SESSION_EXPLORER_E2E=true.
• Review fixes:
  • session regexes are rejected for repeated alternation, large or optional repeats, or more than 3 unbounded repeats; keys over 512 characters are skipped;
  • list, sorted-set and stream reads size their windows to the byte cap, and streams page by id;
  • preview follows the SCAN cursor for up to 10 pages per node and says when the search was partial;
  • reads use a dedicated connection with CLIENT NO-TOUCH ON, so viewing a session doesn't reset key idle times (best effort on servers before 7.2);
  • failed nodes are counted once across scan and read.

Checklist

• Unit / integration tests added
• Docs added / updated
• Roborev review passed — run roborev review --branch or /roborev-review-branch in Claude Code (internal)
• Competitive analysis done / discussed (internal)
• Blog post about it discussed (internal)

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches Valkey read paths (NO-TOUCH connections, SCAN/paging, adaptive fetches) and user-supplied session regex validation; mis-counting or regex edge cases could affect preview completeness or reject valid custom schemas.

Overview
Adds a Session Explorer UI at /session-explorer (sidebar entry): namespace create/edit with live preview and custom schema fields, sortable session list with optional oversize badges, merged message timeline with tool calls, per-key structured/raw views, incomplete-session warnings, and JSON export via a new sessionExplorerApi + React Query hooks.

API hardening and behavior (carried with this stack): custom sessionRegex validation now blocks catastrophic backtracking (nested/alternation repeats, >3 unbounded repeats, repeat expansion budget, lookarounds/backreferences) and matches keys with Node’s linear regex flag; keys over 512 chars skip regex. Preview SCANs up to 10 pages per primary and returns exhausted when the search was partial or a node failed. Valkey reads use duplicated connections with CLIENT NO-TOUCH ON; list/zset/hash/stream reads use byte-cap–aware fetch windows and paged streams. Session failedNodes is deduplicated across scan vs read (max, not sum).

Adds gated session-explorer.e2e-spec.ts (fixture seed + HTTP checks per preset) and expands unit tests for regex safety, primary nodes, reader paging, and web components.

^{Reviewed by Cursor Bugbot for commit 04255a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3cf2e222-50f4-4b3b-90d5-d160036497da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale Bugbot comment from a previous run.

[jamby77]

I checked the new ReDoS validator, the NO-TOUCH reader lifecycle (standalone, the cluster 'myself' node, the fallback, release), list/zset/stream byte-cap paging, preview SCAN paging, server-side Pro gating, export, and connection/namespace state resets. Paging, connection cleanup and gating hold up. The validator still accepts a regex that backtracks for a very long time, and two smaller UI issues are listed below.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[jamby77]

Re-checked the stack at 5f47de2. All seven earlier findings are fixed:

• non-text content blocks and Anthropic/LlamaIndex tool calls (e82dca8);
• matched-key cap in keysForSession (253dea0);
• byte-sized HSCAN windows (0b65436);
• the three bounded-repeat ReDoS patterns, the placeholder, and the stale preview (5f47de2).

I ran the validator in Node: those three patterns are now rejected, and the presets' own regexes plus ^chat:(?<session>[^:]+)$ still pass. One gap is left in the same guard:

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 04255a9. Configure here.}