Claude Session Manager v1.0.0

First public release of Claude Session Manager — a self-hosted web tool for browsing, searching, and auditing Claude Code conversation history.

Highlights

• Premium web UI — generous spacing, gradient brand, JetBrains Mono code, dark mode
• 4 chat view modes — Full, Dialog, Compact, Changes (file diffs only)
• Full-text search — MiniSearch in-memory index across every conversation
• Command audit panel — chronological timeline of every Bash/Edit/Write/Read tool call with per-tool filtering
• Executive dashboard — KPI cards (projects, sessions, messages) + top-projects breakdown
• Live updates — SSE-powered real-time refresh via chokidar
• Auth — JWT + bcrypt (12 rounds), 5-failure lockout
• Soft-delete + trash — `~/.claude` is never modified; deletes go to a separate trash directory
• Bilingual — English / 中文 one-click toggle

Pre-built Binaries (no Node required)

Bun-compiled standalone executables. Download → extract → run:

Platform	File	Size
Linux x64	`csm-linux-x64.tar.gz`	38 MB
Linux arm64	`csm-linux-arm64.tar.gz`	38 MB
macOS Intel	`csm-darwin-x64.tar.gz`	24 MB
macOS Apple Silicon	`csm-darwin-arm64.tar.gz`	22 MB
Windows x64	`csm-windows-x64.zip`	40 MB

```bash
tar -xzf csm-linux-x64.tar.gz
cd csm-linux-x64
./csm # default port 3727
./csm --port 8080 --read-only true # custom flags
```

Then open `http://your-server:3727\` and set your password on first visit.

Each archive contains the `csm` binary, a `dist/client/` SPA folder, and a short `README.txt`. Verify downloads against `SHA256SUMS`.

Other deployment options

• Docker: `docker compose up -d` (mounts `~/.claude` read-only by default)
• PM2: `pm2 start ecosystem.config.cjs && pm2 save && pm2 startup`
• systemd: see `scripts/csm.service`
• From source: `npm install && npm run build && npm start`

See the README for full docs.

Security notes

• `/.claude` is read-only at the application layer — only the trash directory under `/.claude-session-manager/` is ever written to
• All project/session IDs go through strict whitelist validation (no path traversal)
• Markdown rendered via DOMPurify, helmet security headers on every response
• Set `CSM_SECRET` to a long random string in production