Live demo

Real Turnlog, running in your browser.

This is the actual app — same bundle the CLI serves — with its network layer answered from bundled sample sessions instead of a server. Search it, open a replay, flip the lenses. The real thing reads your own history: npx turnlog.

Canned sample sessions, running in your browser. Writes (pins, names, tags) aren’t persisted here. Real Turnlog reads your own history: npx turnlog

turnlog — live demo sample sessions runs in this tab · no server

The live demo needs a desktop-sized window — the full app UI at phone width would demo clumsiness, not the product. On a laptop this box is the real Turnlog; here, the twenty-second cut on the home page tells the same story.

Or drop a session of your own.

Drag .jsonl files here — they’re parsed in a Web Worker in this tab, replayed in the window above, and never leave your machine. This page cannot transmit them; the proof is below.

Choose session files

This page cannot send your file anywhere.

Not “does not” — cannot. The route is served with a Content-Security-Policy that forbids network connections and form submissions, so the browser itself — not our good intentions — blocks any attempt to transmit. The header, verbatim:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; connect-src 'none'; form-action 'none'; frame-src 'self'; object-src 'none'; base-uri 'self'

To be precise about what that buys: CSP blocks fetch, XHR, beacons, WebSockets, and form posts; it cannot block navigation, so this page keeps links minimal and never encodes anything in URLs. The empty Network tab in devtools is the receipt. There are no analytics on this route — the one script the rest of the site uses is deliberately absent here. The code that touches your file is readable: the parser worker · the API shim.