vis-timeline loaded from unpkg.com CDN (unpinned, no SRI) — vendor locally for offline/privacy

Summary

The interactive timeline loads the vis-timeline library (JS + CSS) from the unpkg.com CDN at runtime, unpinned and without Subresource Integrity. For a tool whose entire purpose is rendering private Claude Code logs offline, this is the only network egress in the generated output, and it has two downsides:

1. Privacy — when the user clicks the Timeline button, the generated file:// page (rendered from private logs) makes requests to a third-party CDN, revealing the user's IP and a request timestamp. No transcript content is sent, but the request itself leaks that the user is viewing a transcript.
2. Supply-chain / integrity — the URLs are unversioned (https://unpkg.com/vis-timeline/...), so they resolve to whatever the CDN serves at open time, with no integrity= hash. Arbitrary remote JS is pulled into a file:// page that has access to local files.

Affected code

claude_code_log/html/templates/components/timeline.html:

link.href   = 'https://unpkg.com/vis-timeline/styles/vis-timeline-graph2d.min.css';  // ~line 355
script.src  = 'https://unpkg.com/vis-timeline/standalone/umd/vis-timeline-graph2d.min.js'; // ~line 360

Loaded lazily inside loadVisTimeline(), which is called from toggleTimeline() (user-triggered on the Timeline button click — not on page load).

Note

The rest of the tool has zero network egress (no telemetry, no requests/urllib, purely local read → local HTML write). This CDN load is the one exception, and it undercuts the offline guarantee.

Suggested fix

Vendor vis-timeline locally: download the pinned standalone JS + CSS, verify the download against the published release checksum, commit it into the template assets (or inline it into the generated HTML), and remove the unpkg URLs. This keeps the tool fully offline and removes the unpinned-remote-code risk.

(A weaker alternative — pin an exact version and add integrity=/crossorigin — still hits the network and still leaks the request on click, so vendoring is preferred for this tool's posture.)

Start in claude_code_log/html/templates/components/timeline.html and inspect loadVisTimeline(), which toggleTimeline() calls from the Timeline button. Replace the unpkg.com JS and CSS loads with pinned local assets, then confirm generated file:// output has no CDN requests and the vendored files match the published release checksum.