feat(graph-viewer): surface API/syscall calls with decoded args

[ricardojrdez]

Why

The behavior-graph JSON keeps each resolved API/syscall call — with its decoded arguments, return value, category and sequence — in a separate top-level events array (see BehaviorGraph.to_json). The viewer only consumed nodes/links, so an api/syscall node showed its name (GetCurrentProcess, OpenProcessToken) but never its arguments. This makes the args visible.

What

Reads data.events and adds (all pure additions — existing node/link/edge rendering is untouched):

• "API calls" sidebar panel — lists every call as #seq name [category] args -> ret, shown only when the JSON carries events.
• Click a row → centers and highlights the matching node (kind-aware id, so both api:<name> and syscall:<name> nodes resolve).
• Richer tooltip — hovering an api/syscall node now appends each decoded call (name(args) -> 0xret).

Field handling matches the serializer (graph.py): each event has seq, kind ("api"/"syscall"), name, site, plus category/args/ret/log from the probes. When a producer omits the one-line log, the viewer synthesizes name(args) from args.

Validation

No JS runtime in CI for this file, so checked locally: node --check on the extracted inline script passes, and a small d3/document-stub harness run of buildApiLog() against events mirroring the serializer output renders e.g.:

#2 OpenProcessToken [process] (0xffffffff, 0x28, 0x6ffd1c) -> 1
#3 NtClose [handle] (0x28)

with the panel shown, the count set, and EVENTS_BY_NAME indexed by name.

Follow-up to #12 (this tool).

🤖 Generated with Claude Code