@dutodev/cli 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import {
+  C,
+  TRUNCATED_NOTE,
+  bodyNote,
   formatBytes,
   formatDuration,
   formatTime,
@@ -7,7 +10,7 @@ import {
   normalizeName,
   statusColor,
   validateName
-} from "./chunk-26EQC6HB.js";
+} from "./chunk-74IJFYGT.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -30,6 +33,7 @@ function paint(tone, text, stream) {
 var mark = () => `${paint("signal", "\u25B0")} ${paint("strong", "duto")}`;
 var ok = (msg) => `${paint("signal", "\u2714")} ${msg}`;
 var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
+var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
 
 // src/index.ts
 import { hostname } from "os";
@@ -517,6 +521,921 @@ function findConfig(cwd) {
   }
 }
 
+// src/inspector/jsonView.ts
+function jsonSyntaxError(text) {
+  try {
+    JSON.parse(text);
+    return null;
+  } catch (e) {
+    const message2 = String(e && e.message ? e.message : e);
+    const m = /position (\d+)/.exec(message2);
+    if (m) return { position: Number(m[1]), message: message2 };
+    const lc = /line (\d+) column (\d+)/.exec(message2);
+    if (lc) {
+      let idx = 0;
+      for (let ln = 1; ln < Number(lc[1]); ln++) {
+        const nl = text.indexOf("\n", idx);
+        if (nl < 0) return { position: text.length, message: message2 };
+        idx = nl + 1;
+      }
+      return { position: Math.min(idx + Number(lc[2]) - 1, text.length), message: message2 };
+    }
+    return { position: text.length, message: message2 };
+  }
+}
+function jsonTokens(text) {
+  const out = [];
+  let depth = 0;
+  let i = 0;
+  while (i < text.length) {
+    const c = text.charAt(i);
+    let j = i + 1;
+    let kind;
+    if (c === " " || c === "\n" || c === "	" || c === "\r") {
+      while (j < text.length && " \n	\r".indexOf(text.charAt(j)) >= 0) j++;
+      kind = "space";
+    } else if (c === '"') {
+      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
+      j = Math.min(j + 1, text.length);
+      let k = j;
+      while (k < text.length && " \n	\r".indexOf(text.charAt(k)) >= 0) k++;
+      kind = text.charAt(k) === ":" ? "key" : "string";
+    } else if ("{}[],:".indexOf(c) >= 0) {
+      kind = "punct";
+      if (c === "}" || c === "]") depth = Math.max(0, depth - 1);
+    } else {
+      while (j < text.length && ' \n	\r{}[],:"'.indexOf(text.charAt(j)) < 0) j++;
+      const word = text.slice(i, j);
+      kind = word === "true" || word === "false" || word === "null" ? "literal" : "number";
+    }
+    out.push({ kind, text: text.slice(i, j), depth });
+    if (kind === "punct" && (c === "{" || c === "[")) depth++;
+    i = j;
+  }
+  return out;
+}
+function jsonIndent(text) {
+  let out = "";
+  let depth = 0;
+  let i = 0;
+  const ws = " \n	\r";
+  while (i < text.length) {
+    const c = text.charAt(i);
+    if (ws.indexOf(c) >= 0) {
+      i++;
+    } else if (c === '"') {
+      let j = i + 1;
+      while (j < text.length && text.charAt(j) !== '"') j += text.charAt(j) === "\\" ? 2 : 1;
+      out += text.slice(i, j + 1);
+      i = j + 1;
+    } else if (c === "{" || c === "[") {
+      let j = i + 1;
+      while (j < text.length && ws.indexOf(text.charAt(j)) >= 0) j++;
+      if (text.charAt(j) === (c === "{" ? "}" : "]")) {
+        out += c + text.charAt(j);
+        i = j + 1;
+      } else {
+        depth++;
+        out += c + "\n" + "  ".repeat(depth);
+        i++;
+      }
+    } else if (c === "}" || c === "]") {
+      depth = Math.max(0, depth - 1);
+      out += "\n" + "  ".repeat(depth) + c;
+      i++;
+    } else if (c === ",") {
+      out += ",\n" + "  ".repeat(depth);
+      i++;
+    } else if (c === ":") {
+      out += ": ";
+      i++;
+    } else {
+      let j = i + 1;
+      while (j < text.length && (ws + '{}[],:"').indexOf(text.charAt(j)) < 0) j++;
+      out += text.slice(i, j);
+      i = j;
+    }
+  }
+  return out;
+}
+
+// src/inspector/page.ts
+var BG = "#111413";
+var BAR = "#0b0d0c";
+var LINE = "#222826";
+var ROW_LINE = "#1a1f1d";
+var INPUT_LINE = "#2a312e";
+var TEXT = "#e7e9e6";
+var SELECTED = "#16201e";
+var JSON_KEY = "#93c5fd";
+var JSON_STRING = "#fdba74";
+var JSON_VALUE = "#c4b5fd";
+var MONO = '"JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace';
+var STYLE = `
+:root { color-scheme: dark; }
+* { box-sizing: border-box; }
+html, body { height: 100%; }
+body { margin: 0; background: ${BG}; color: ${TEXT}; font-family: ${MONO}; font-size: 13px; line-height: 1.45; }
+button { font: inherit; color: inherit; background: none; border: 0; padding: 0; cursor: pointer; }
+:focus-visible { outline: 1px solid ${C.signal}; outline-offset: -1px; }
+.app { display: flex; flex-direction: column; height: 100vh; }
+.top { display: flex; justify-content: space-between; gap: 16px; padding: 8px 12px; background: ${BAR}; border-bottom: 1px solid ${LINE}; color: ${C.muted}; }
+.top b { color: ${C.signal}; font-weight: 600; }
+.tunnels { display: flex; flex-wrap: wrap; gap: 4px 14px; justify-content: flex-end; min-width: 0; }
+.tunnels .k { color: ${C.strong}; }
+.banner { padding: 6px 12px; background: ${BAR}; border-bottom: 1px solid ${C.err}; color: ${C.err}; }
+.main { flex: 1; min-height: 0; display: grid; grid-template-columns: 320px 1fr; }
+.side { display: flex; flex-direction: column; min-height: 0; border-right: 1px solid ${LINE}; }
+.search { margin: 8px 12px; padding: 5px 8px; border: 1px solid ${INPUT_LINE}; border-radius: 5px; background: ${BG}; color: ${TEXT}; font: inherit; outline: none; }
+.search:focus { border-color: ${C.signal}; }
+.search::placeholder { color: ${C.muted}; }
+.list { flex: 1; min-height: 0; overflow-y: auto; outline: none; }
+.row { display: grid; grid-template-columns: 14px 42px minmax(0, 1fr) 34px 56px; gap: 8px; padding: 5px 12px; border-bottom: 1px solid ${ROW_LINE}; align-items: center; cursor: pointer; white-space: nowrap; }
+.list.multi .row { grid-template-columns: 14px 56px 42px minmax(0, 1fr) 34px 56px; }
+.row:hover { background: #141917; }
+.row.sel { background: ${SELECTED}; box-shadow: inset 2px 0 0 ${C.signal}; }
+.row span { overflow: hidden; text-overflow: ellipsis; }
+.row .dur { text-align: right; }
+.m { font-weight: 700; }
+.mut { color: ${C.muted}; }
+.empty { padding: 12px; color: ${C.muted}; }
+.detail { display: flex; flex-direction: column; min-height: 0; min-width: 0; }
+.pane { flex: 1; }
+.head { padding: 8px 12px; overflow-wrap: anywhere; }
+.head b { color: ${C.strong}; }
+.tabs { display: flex; gap: 14px; padding: 8px 12px 0; border-bottom: 1px solid ${LINE}; }
+.tab { color: ${C.muted}; padding-bottom: 6px; border-bottom: 2px solid transparent; }
+.tab:hover { color: ${TEXT}; }
+.tab.on { color: ${C.strong}; border-bottom-color: ${C.signal}; }
+.content { flex: 1; min-height: 0; overflow: auto; }
+.content pre { margin: 0; padding: 10px 12px; line-height: 1.55; white-space: pre-wrap; overflow-wrap: anywhere; font: inherit; }
+.note { padding: 10px 12px; color: ${C.muted}; }
+.trunc { padding: 0 12px 10px; color: ${C.warn}; }
+.jerr { padding: 10px 12px 0; color: ${C.err}; }
+.bad { background: ${C.err}40; color: ${C.strong}; }
+.k { color: ${JSON_KEY}; } .s { color: ${JSON_STRING}; } .n { color: ${JSON_VALUE}; }
+.fold.closed > .inner { display: none; }
+.fold > .sum { display: none; color: ${C.muted}; }
+.fold.closed > .sum { display: inline; }
+.open { cursor: pointer; }
+.open:hover { color: ${C.signal}; }
+table { border-collapse: collapse; margin: 6px 12px 10px; }
+th, td { text-align: left; vertical-align: top; padding: 3px 16px 3px 0; border-bottom: 1px solid ${ROW_LINE}; overflow-wrap: anywhere; }
+th { color: ${JSON_KEY}; font-weight: 400; white-space: nowrap; }
+.sect { padding: 10px 12px 0; color: ${C.muted}; }
+.btns { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; padding: 8px 12px; border-top: 1px solid ${LINE}; }
+.btn { border: 1px solid ${INPUT_LINE}; border-radius: 5px; padding: 3px 8px; }
+.btn:hover:not(:disabled) { border-color: ${C.muted}; }
+.btn.pri { border-color: ${C.signal}; color: ${C.signal}; }
+.btn:disabled { color: ${C.muted}; border-color: ${ROW_LINE}; cursor: default; }
+.msg { color: ${C.muted}; }
+.msg.err { color: ${C.err}; }
+[hidden] { display: none !important; }
+@media (max-width: 720px) {
+  .main { grid-template-columns: 1fr; grid-template-rows: 40vh 1fr; }
+  .side { border-right: 0; border-bottom: 1px solid ${LINE}; }
+}
+`;
+var SCRIPT = String.raw`"use strict";
+var jsonSyntaxError = (${jsonSyntaxError.toString()});
+var jsonTokens = (${jsonTokens.toString()});
+var jsonIndent = (${jsonIndent.toString()});
+var COLORS = ${JSON.stringify(C)};
+var TOKEN = new URLSearchParams(location.search).get("t") || "";
+var TABS = ["Corpo", "Cabeçalhos", "Resposta", "Raw"];
+
+var state = { items: [], tunnels: [], selected: null, detail: null, detailKey: "", tab: "Corpo", ended: false };
+var listSeq = 0, detailSeq = 0, msgTimer = null;
+var es = null, lost = false, replaying = false;
+function fail(e) { if (!state.ended) console.error(e); }
+
+function $(id) { return document.getElementById(id); }
+function el(tag, cls, text) {
+  var e = document.createElement(tag);
+  if (cls) e.className = cls;
+  if (text !== undefined && text !== null) e.textContent = String(text);
+  return e;
+}
+function clear(node) { while (node.firstChild) node.removeChild(node.firstChild); }
+
+function banner(text) {
+  var b = $("banner");
+  b.textContent = text || "";
+  b.hidden = !text;
+}
+function ended() {
+  state.ended = true;
+  banner("Sessão encerrada; abra o inspetor de novo pela tecla i.");
+  if (es) es.close();
+}
+
+function api(path, method) {
+  return fetch(path, { method: method || "GET", headers: { "X-Duto-Inspetor": TOKEN }, cache: "no-store" }).then(function (r) {
+    if (r.status === 403) { ended(); throw new Error("403"); }
+    return r.json().then(function (body) { return { status: r.status, body: body }; });
+  });
+}
+
+function statusInfo(it) {
+  if (it.status !== null && it.status !== undefined) {
+    var s = it.status;
+    var color = s >= 500 ? COLORS.err : s >= 400 ? COLORS.warn : s >= 300 ? COLORS.signal : COLORS.ok;
+    return { text: String(s), color: color };
+  }
+  if (it.error) return { text: "erro", color: COLORS.err };
+  return { text: "…", color: COLORS.muted };
+}
+function duration(it) { return it.durationMs === null || it.durationMs === undefined ? "" : it.durationMs + " ms"; }
+function size(n) {
+  if (n < 1024) return n + " B";
+  if (n < 1024 * 1024) return (n / 1024).toFixed(1).replace(".", ",") + " KB";
+  return (n / 1024 / 1024).toFixed(1).replace(".", ",") + " MB";
+}
+function methodOf(it) { return it.websocket ? "WS" : it.method; }
+function header(h, name) {
+  for (var k in h) if (k.toLowerCase() === name) return h[k];
+  return "";
+}
+
+// Mesma regra do filtro da tela do terminal.
+function visible() {
+  var f = $("filter").value.trim().toLowerCase();
+  if (!f) return state.items;
+  return state.items.filter(function (it) {
+    return (it.tunnel + " " + (it.websocket ? "ws" : it.method) + " " + it.path + " " + (it.status === null || it.status === undefined ? "" : it.status)).toLowerCase().indexOf(f) >= 0;
+  });
+}
+
+function renderTop() {
+  var n = state.items.length;
+  $("count").textContent = n + (n === 1 ? " requisição" : " requisições");
+  var box = $("tunnels");
+  clear(box);
+  state.tunnels.forEach(function (t) {
+    var s = el("span");
+    s.appendChild(el("span", "k", t.key));
+    s.appendChild(document.createTextNode(" " + (t.url || "sem endereço ainda")));
+    box.appendChild(s);
+  });
+}
+
+function renderList() {
+  var list = $("list");
+  var multi = state.tunnels.length > 1;
+  list.classList.toggle("multi", multi);
+  clear(list);
+  var items = visible();
+  if (items.length === 0) {
+    list.appendChild(el("div", "empty", state.items.length === 0 ? "Nenhuma requisição ainda." : "Nada casa com o filtro."));
+    return;
+  }
+  items.forEach(function (it) {
+    var row = el("div", "row" + (it.id === state.selected ? " sel" : ""));
+    row.setAttribute("role", "option");
+    row.setAttribute("aria-selected", it.id === state.selected ? "true" : "false");
+    row.dataset.id = String(it.id);
+    row.appendChild(el("span", "mut", it.replayOf !== undefined ? "↻" : ""));
+    if (multi) row.appendChild(el("span", "mut", it.tunnel));
+    row.appendChild(el("span", "m", methodOf(it)));
+    var p = el("span", "", it.path);
+    p.title = it.path;
+    row.appendChild(p);
+    var st = statusInfo(it);
+    var s = el("span", "", st.text);
+    s.style.color = st.color;
+    row.appendChild(s);
+    row.appendChild(el("span", "mut dur", duration(it)));
+    row.addEventListener("click", function () { select(it.id); });
+    list.appendChild(row);
+  });
+}
+
+function loadList() {
+  var seq = ++listSeq;
+  return Promise.all([api("/api/requisicoes"), api("/api/sessao")]).then(function (rs) {
+    if (seq !== listSeq) return;
+    state.items = rs[0].body.items || [];
+    state.tunnels = rs[1].body.tunnels || [];
+    renderTop();
+    if (state.selected === null && state.items.length > 0) return select(state.items[0].id);
+    renderList();
+  }).catch(fail);
+}
+
+function select(id) {
+  if (state.selected !== id) {
+    state.selected = id;
+    state.detail = null;
+    state.detailKey = "";
+    hideMsg();
+  }
+  renderList();
+  var row = document.querySelector('.row[data-id="' + id + '"]');
+  if (row) row.scrollIntoView({ block: "nearest" });
+  return loadDetail(id);
+}
+
+function loadDetail(id) {
+  var seq = ++detailSeq;
+  return api("/api/requisicoes/" + id).then(function (r) {
+    if (seq !== detailSeq || state.selected !== id) return;
+    var key = JSON.stringify(r.body);
+    if (key === state.detailKey) return; // nada mudou: mantém dobras e rolagem
+    state.detailKey = key;
+    state.detail = r.status === 200 ? r.body : null;
+    if (r.status !== 200) renderGone(r.body && r.body.error ? r.body.error : "Essa requisição já saiu da lista.");
+    else renderDetail();
+  }).catch(fail);
+}
+
+function renderGone(text) {
+  $("detail").hidden = true;
+  $("none").hidden = false;
+  $("none").textContent = text;
+}
+
+function renderDetail() {
+  var d = state.detail;
+  if (!d) return;
+  $("none").hidden = true;
+  $("detail").hidden = false;
+
+  var head = $("head");
+  clear(head);
+  head.appendChild(el("b", "", methodOf(d) + " " + d.path));
+  head.appendChild(document.createTextNode(" "));
+  var st = statusInfo(d);
+  var s = el("span", "", st.text);
+  s.style.color = st.color;
+  head.appendChild(s);
+  var parts = [];
+  if (duration(d)) parts.push(duration(d));
+  parts.push(size(d.bytes));
+  parts.push(d.tunnel);
+  if (d.replayOf !== undefined) parts.push("↻ reenvio de #" + d.replayOf);
+  head.appendChild(el("span", "mut", " · " + parts.join(" · ")));
+  if (d.error) head.appendChild(el("div", "msg err", d.error));
+
+  var tabs = document.querySelectorAll(".tab");
+  for (var i = 0; i < tabs.length; i++) {
+    var on = tabs[i].dataset.tab === state.tab;
+    tabs[i].classList.toggle("on", on);
+    tabs[i].setAttribute("aria-selected", on ? "true" : "false");
+  }
+  renderContent();
+  renderButtons();
+}
+
+function renderContent() {
+  var d = state.detail;
+  var box = $("content");
+  var top = box.scrollTop;
+  clear(box);
+  if (state.tab === "Corpo") renderBody(box, d.reqBody, d.reqNote, d.reqTruncatedNote, d.reqHeaders);
+  else if (state.tab === "Cabeçalhos") box.appendChild(table(d.reqHeaders));
+  else if (state.tab === "Resposta") {
+    box.appendChild(el("div", "sect", "Cabeçalhos"));
+    box.appendChild(table(d.resHeaders));
+    box.appendChild(el("div", "sect", "Corpo"));
+    renderBody(box, d.resBody, d.resNote, d.resTruncatedNote, d.resHeaders);
+  } else {
+    var lines = [d.method + " " + d.path + " HTTP/1.1"];
+    for (var k in d.reqHeaders) lines.push(k + ": " + d.reqHeaders[k]);
+    lines.push("");
+    lines.push(d.reqNote !== null ? d.reqNote : d.reqBody || "");
+    box.appendChild(el("pre", "", lines.join("\n")));
+  }
+  box.scrollTop = top;
+}
+
+function table(h) {
+  var keys = Object.keys(h || {});
+  if (keys.length === 0) return el("div", "note", "Sem cabeçalhos.");
+  var t = el("table");
+  keys.forEach(function (k) {
+    var tr = el("tr");
+    tr.appendChild(el("th", "", k));
+    tr.appendChild(el("td", "", h[k]));
+    t.appendChild(tr);
+  });
+  return t;
+}
+
+function renderBody(box, body, note, truncNote, headers) {
+  if (note !== null) {
+    box.appendChild(el("div", "note", note));
+    return;
+  }
+  if (body === null || body === undefined) {
+    box.appendChild(el("div", "note", "Sem corpo."));
+  } else if (header(headers, "content-type").toLowerCase().indexOf("json") >= 0) {
+    var err = jsonSyntaxError(body);
+    if (err === null) box.appendChild(jsonTree(jsonIndent(body)));
+    else {
+      box.appendChild(el("div", "jerr", err.message));
+      var pre = el("pre");
+      var at = Math.min(err.position, Math.max(0, body.length - 1));
+      pre.appendChild(document.createTextNode(body.slice(0, at)));
+      pre.appendChild(el("span", "bad", body.slice(at, at + 1) || " "));
+      pre.appendChild(document.createTextNode(body.slice(at + 1)));
+      box.appendChild(pre);
+    }
+  } else {
+    box.appendChild(el("pre", "", body));
+  }
+  if (truncNote !== null) box.appendChild(el("div", "trunc", truncNote));
+}
+
+var KIND = { key: "k", string: "s", number: "n", literal: "n", punct: "", space: "" };
+
+// JSON colorido; clicar no { ou [ recolhe para "{ ▸ N campos }".
+function jsonTree(text) {
+  var pre = el("pre");
+  var stack = [{ node: pre }];
+  jsonTokens(text).forEach(function (t) {
+    var top = stack[stack.length - 1];
+    if (top.wrap && t.kind !== "space" && !(t.kind === "punct" && (t.text === "}" || t.text === "]"))) top.has = true;
+    if (t.kind === "punct" && (t.text === "{" || t.text === "[")) {
+      var wrap = el("span", "fold");
+      var open = el("span", "open", t.text);
+      var inner = el("span", "inner");
+      var sum = el("span", "sum");
+      wrap.appendChild(open);
+      wrap.appendChild(inner);
+      wrap.appendChild(sum);
+      top.node.appendChild(wrap);
+      open.addEventListener("click", function () { if (wrap.dataset.n) wrap.classList.toggle("closed"); });
+      stack.push({ node: inner, wrap: wrap, open: open, sum: sum, depth: t.depth, obj: t.text === "{", count: 0, has: false });
+      return;
+    }
+    if (t.kind === "punct" && (t.text === "}" || t.text === "]") && stack.length > 1) {
+      var c = stack.pop();
+      var n = c.has ? c.count + 1 : 0;
+      if (n > 0) {
+        c.wrap.dataset.n = String(n);
+        c.open.title = "recolher ou abrir";
+        c.sum.textContent = " ▸ " + n + (c.obj ? (n === 1 ? " campo " : " campos ") : n === 1 ? " item " : " itens ");
+      } else c.open.className = "";
+      c.wrap.appendChild(document.createTextNode(t.text));
+      return;
+    }
+    if (top.wrap && t.kind === "punct" && t.text === "," && t.depth === top.depth + 1) top.count++;
+    var cls = KIND[t.kind];
+    top.node.appendChild(cls ? el("span", cls, t.text) : document.createTextNode(t.text));
+  });
+  return pre;
+}
+
+function renderButtons() {
+  var d = state.detail;
+  var replay = $("replay");
+  replay.disabled = d.replayBlocked !== null || replaying;
+  replay.title = d.replayBlocked || "";
+  replay.parentNode.title = d.replayBlocked || "";
+
+  var copyBody = $("copyBody");
+  var b = copyable(d);
+  copyBody.disabled = b.text === null;
+  copyBody.title = b.text === null ? b.note || "" : "";
+  copyBody.parentNode.title = copyBody.title;
+
+  var curl = $("copyCurl");
+  curl.disabled = d.curl === null;
+  curl.title = d.curl === null ? d.curlNote || "" : "";
+  curl.parentNode.title = curl.title;
+  var notes = [];
+  if (d.curl !== null && d.curlNote) notes.push(d.curlNote);
+  var tunnel = state.tunnels.filter(function (t) { return t.key === d.tunnel; })[0];
+  if (d.curl !== null && tunnel && tunnel.auth) notes.push("Troque SENHA pela senha do túnel.");
+  $("curlNote").textContent = notes.join(" ");
+}
+
+// "Copiar corpo" copia o corpo da aba ativa: a resposta na aba Resposta, senão a requisição.
+function copyable(d) {
+  return state.tab === "Resposta" ? { text: d.resBody, note: d.resNote } : { text: d.reqBody, note: d.reqNote };
+}
+
+function showMsg(text, isErr) {
+  var m = $("msg");
+  m.textContent = text;
+  m.className = "msg" + (isErr ? " err" : "");
+  m.hidden = false;
+  if (msgTimer) clearTimeout(msgTimer);
+  msgTimer = null;
+}
+function hideMsg() {
+  if (msgTimer) clearTimeout(msgTimer);
+  msgTimer = null;
+  $("msg").hidden = true;
+}
+
+function copy(text) {
+  navigator.clipboard.writeText(text).then(function () {
+    showMsg("Copiado.", false);
+    msgTimer = setTimeout(hideMsg, 2000);
+  }, function () {
+    showMsg("Não deu para copiar.", true);
+  });
+}
+
+function replay() {
+  var d = state.detail;
+  if (!d || state.ended) return;
+  if (d.replayBlocked !== null) return showMsg(d.replayBlocked, true);
+  if (replaying) return;
+  replaying = true;
+  $("replay").disabled = true;
+  api("/api/requisicoes/" + d.id + "/reenviar", "POST").then(function (r) {
+    replaying = false;
+    if (state.detail) renderButtons();
+    if (r.body && r.body.ok) {
+      hideMsg();
+      return loadList().then(function () { return select(r.body.id); });
+    }
+    showMsg(r.body && r.body.reason ? r.body.reason : "Não deu para reenviar.", true);
+  }).catch(function (e) {
+    replaying = false;
+    if (state.detail) renderButtons();
+    fail(e);
+  });
+}
+
+function move(delta) {
+  var items = visible();
+  if (items.length === 0) return;
+  var i = -1;
+  for (var j = 0; j < items.length; j++) if (items[j].id === state.selected) i = j;
+  var next = i < 0 ? 0 : Math.max(0, Math.min(items.length - 1, i + delta));
+  if (items[next].id !== state.selected) select(items[next].id);
+}
+
+function connect() {
+  if (state.ended) return;
+  es = new EventSource("/api/eventos?t=" + encodeURIComponent(TOKEN));
+  es.addEventListener("open", function () {
+    if (state.ended) return;
+    banner("");
+    // Reconectou: o que mudou no meio do caminho não chegou por evento.
+    if (lost) {
+      lost = false;
+      loadList();
+      if (state.selected !== null) loadDetail(state.selected);
+    }
+  });
+  es.addEventListener("error", function () {
+    if (state.ended) return;
+    lost = true;
+    banner("Desconectado da sessão.");
+    // Resposta não 200 (ex.: 403 de outra sessão) fecha o EventSource de vez.
+    if (es.readyState === 2) probe();
+  });
+  es.addEventListener("mudou", function (ev) {
+    var ids = [];
+    try { ids = JSON.parse(ev.data).ids || []; } catch (e) {}
+    loadList();
+    // Lista vazia de ids: algo mudou fora da assinatura; busca o detalhe de novo também.
+    if (state.selected !== null && (ids.length === 0 || ids.indexOf(state.selected) >= 0)) loadDetail(state.selected);
+  });
+}
+
+// EventSource fechado: a API diz se a sessão acabou (403 → ended) ou se dá para reconectar.
+function probe() {
+  api("/api/sessao").then(function () {
+    if (!state.ended) setTimeout(connect, 3000);
+  }, function () {
+    if (!state.ended) setTimeout(connect, 3000);
+  });
+}
+
+function init() {
+  var tabs = document.querySelectorAll(".tab");
+  for (var i = 0; i < tabs.length; i++) {
+    tabs[i].addEventListener("click", function (ev) {
+      state.tab = ev.currentTarget.dataset.tab;
+      if (state.detail) renderDetail();
+    });
+  }
+  $("filter").addEventListener("input", renderList);
+  $("replay").addEventListener("click", replay);
+  $("copyBody").addEventListener("click", function () {
+    var b = state.detail ? copyable(state.detail) : { text: null };
+    if (b.text !== null && b.text !== undefined) copy(b.text);
+  });
+  $("copyCurl").addEventListener("click", function () { if (state.detail && state.detail.curl !== null) copy(state.detail.curl); });
+
+  document.addEventListener("keydown", function (ev) {
+    if (ev.ctrlKey || ev.metaKey || ev.altKey) return;
+    var inFilter = document.activeElement === $("filter");
+    if (ev.key === "ArrowDown" || ev.key === "ArrowUp") {
+      ev.preventDefault();
+      move(ev.key === "ArrowDown" ? 1 : -1);
+    } else if (ev.key === "Escape") {
+      if ($("filter").value) {
+        $("filter").value = "";
+        renderList();
+      }
+      if (inFilter) $("filter").blur();
+    } else if (ev.key === "/" && !inFilter) {
+      ev.preventDefault();
+      $("filter").focus();
+    } else if ((ev.key === "r" || ev.key === "R") && !inFilter && !ev.repeat) {
+      replay();
+    }
+  });
+
+  loadList();
+  connect();
+}
+
+init();
+`;
+function inspectorPage(nonce) {
+  const tabs = ["Corpo", "Cabe\xE7alhos", "Resposta", "Raw"].map((t, i) => `<button type="button" class="tab${i === 0 ? " on" : ""}" role="tab" data-tab="${t}">${t}</button>`).join("");
+  return `<!doctype html>
+<html lang="pt-BR">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>duto \xB7 inspetor</title>
+<link rel="icon" href="data:,">
+<style nonce="${nonce}">${STYLE}</style>
+</head>
+<body>
+<div class="app">
+  <div class="top"><span><b>\u25B0 duto</b> \xB7 inspetor \xB7 <span id="count">0 requisi\xE7\xF5es</span></span><span class="tunnels" id="tunnels"></span></div>
+  <div class="banner" id="banner" role="status" hidden></div>
+  <div class="main">
+    <div class="side">
+      <input class="search" id="filter" type="search" placeholder="filtrar\u2026" aria-label="Filtrar requisi\xE7\xF5es" autocomplete="off" spellcheck="false">
+      <div class="list" id="list" role="listbox" aria-label="Requisi\xE7\xF5es"></div>
+    </div>
+    <div class="detail">
+      <div class="empty" id="none">Escolha uma requisi\xE7\xE3o na lista.</div>
+      <div class="detail pane" id="detail" hidden>
+        <div class="head" id="head"></div>
+        <div class="tabs" role="tablist">${tabs}</div>
+        <div class="content" id="content"></div>
+        <div class="btns">
+          <span><button type="button" class="btn pri" id="replay">\u21BB Reenviar</button></span>
+          <span><button type="button" class="btn" id="copyBody">Copiar corpo</button></span>
+          <span><button type="button" class="btn" id="copyCurl">Copiar como curl</button></span>
+          <span class="msg" id="curlNote"></span>
+          <span class="msg" id="msg" role="status" hidden></span>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+<script nonce="${nonce}">${SCRIPT}</script>
+</body>
+</html>
+`;
+}
+
+// src/inspector/server.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// src/session/replay.ts
+var tunnelClosedReason = (tunnel2) => `O t\xFAnel ${tunnel2} n\xE3o est\xE1 aberto nesta sess\xE3o.`;
+function replayBlock(r) {
+  if (!r) return "Essa requisi\xE7\xE3o j\xE1 saiu da lista.";
+  if (r.websocket) return "WebSocket n\xE3o d\xE1 para reenviar.";
+  if (r.noReplay) return r.noReplay;
+  if (r.access?.kind === "denied") return "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
+  if (!r.reqComplete) return "A requisi\xE7\xE3o ainda n\xE3o chegou inteira.";
+  if (r.reqTruncated) return "Corpo acima de 64 KB; n\xE3o d\xE1 para reenviar.";
+  if (r.reqBodyBytes > 0 && r.reqRaw === null) return "Corpo bin\xE1rio n\xE3o \xE9 guardado; n\xE3o d\xE1 para reenviar.";
+  return null;
+}
+var DROP = /* @__PURE__ */ new Set(["connection", "keep-alive", "transfer-encoding", "expect", "content-length", "upgrade", "te", "trailer", "proxy-connection"]);
+function replayHeaders(r) {
+  const out = {};
+  for (const [k, v] of Object.entries(r.reqHeaders)) if (!DROP.has(k.toLowerCase())) out[k] = v;
+  const hadLength = Object.keys(r.reqHeaders).some((k) => k.toLowerCase() === "content-length");
+  if (r.reqBodyBytes > 0 || hadLength) out["content-length"] = String(r.reqRaw?.length ?? 0);
+  return out;
+}
+
+// src/inspector/curl.ts
+var SKIP = /* @__PURE__ */ new Set(["host", "content-length", "transfer-encoding", "connection", "keep-alive", "expect", "upgrade", "te", "trailer", "proxy-connection"]);
+var TUNNEL_ADDED = /* @__PURE__ */ new Set(["cdn-loop", "x-forwarded-for", "x-forwarded-proto", "x-real-ip", "true-client-ip"]);
+var skip = (name) => {
+  const k = name.toLowerCase();
+  return SKIP.has(k) || TUNNEL_ADDED.has(k) || k.startsWith("cf-");
+};
+function shellQuote(s) {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+function toCurl(r, o) {
+  const parts = [`curl -X ${shellQuote(r.method)} ${shellQuote(o.publicUrl.replace(/\/+$/, "") + r.path)}`];
+  for (const [k, v] of Object.entries(r.reqHeaders)) {
+    if (!skip(k)) parts.push(`-H ${shellQuote(`${k}: ${v}`)}`);
+  }
+  if (o.authUser !== null) parts.push(`-H ${shellQuote(`X-Duto-Auth: ${o.authUser}:SENHA`)}`);
+  if (r.reqBody !== null) parts.push(`--data-binary ${shellQuote(r.reqBody)}`);
+  return parts.join(" \\\n  ");
+}
+
+// src/inspector/server.ts
+var DEFAULT_PORT = 4141;
+var PORT_TRIES = 20;
+var NO_TOKEN = "Abra o inspetor pela tecla i da tela do duto ou pelo endere\xE7o impresso no terminal.";
+var GONE = "Essa requisi\xE7\xE3o j\xE1 saiu da lista.";
+var NO_URL = "O t\xFAnel ainda n\xE3o tem endere\xE7o p\xFAblico.";
+var CURL_BYTES = "O corpo do curl pode n\xE3o ser id\xEAntico ao recebido (bytes fora de UTF-8).";
+var sha = (s) => createHash2("sha256").update(s).digest();
+var same = (a, b) => timingSafeEqual(sha(a), sha(b));
+var first = (v) => Array.isArray(v) ? v[0] : v;
+function listItem(r) {
+  return {
+    id: r.id,
+    tunnel: r.tunnel,
+    method: r.method,
+    path: r.path,
+    status: r.status,
+    durationMs: r.durationMs,
+    bytes: r.bytes,
+    startedAt: r.startedAt,
+    websocket: r.websocket,
+    ...r.replayOf !== void 0 && { replayOf: r.replayOf },
+    ...r.error !== void 0 && { error: r.error }
+  };
+}
+function detail(r, session) {
+  const tunnel2 = session.getState().tunnels.find((t) => t.key === r.tunnel);
+  const tunnelOpen = !!tunnel2 && (tunnel2.status === "live" || tunnel2.status === "no-listener");
+  let curl = null;
+  let curlNote = null;
+  if (!tunnel2?.url) curlNote = NO_URL;
+  else {
+    curl = toCurl(r, { publicUrl: tunnel2.url, authUser: session.authUser(r.tunnel) });
+    if (r.reqRaw && !Buffer.from(r.reqBody ?? "", "utf8").equals(r.reqRaw)) curlNote = CURL_BYTES;
+  }
+  return {
+    ...listItem(r),
+    reqHeaders: r.reqHeaders,
+    resHeaders: r.resHeaders,
+    reqBody: r.reqBody,
+    resBody: r.resBody,
+    reqNote: bodyNote(r, "req"),
+    resNote: bodyNote(r, "res"),
+    reqTruncatedNote: r.reqTruncated ? TRUNCATED_NOTE : null,
+    resTruncatedNote: r.resTruncated ? TRUNCATED_NOTE : null,
+    replayBlocked: replayBlock(r) ?? (tunnelOpen ? null : tunnelClosedReason(r.tunnel)),
+    curl,
+    curlNote
+  };
+}
+var sig = (r) => `${r.status}|${r.durationMs}|${r.bytes}|${r.resBody?.length ?? -1}|${r.reqComplete}|${r.error ?? ""}|${Object.keys(r.resHeaders).length > 0}`;
+async function startInspector(o) {
+  const { session } = o;
+  const eventMs = o.eventMs ?? 150;
+  const pingMs = o.pingMs ?? 25e3;
+  const token = randomBytes(24).toString("base64url");
+  let port = 0;
+  const clients = /* @__PURE__ */ new Set();
+  let seen = /* @__PURE__ */ new Map();
+  let timer = null;
+  const prime = () => seen = new Map(session.records.list().map((r) => [r.id, sig(r)]));
+  const flush = () => {
+    timer = null;
+    const next = /* @__PURE__ */ new Map();
+    const ids = [];
+    for (const r of session.records.list()) {
+      const s = sig(r);
+      next.set(r.id, s);
+      if (seen.get(r.id) !== s) ids.push(r.id);
+    }
+    seen = next;
+    const msg = `event: mudou
+data: ${JSON.stringify({ ids })}
+
+`;
+    for (const c of clients) c.write(msg);
+  };
+  const schedule = () => {
+    if (clients.size > 0 && !timer) timer = setTimeout(flush, eventMs);
+  };
+  const unsubs = [session.records.subscribe(schedule), session.subscribe(schedule)];
+  const pinger = setInterval(() => {
+    for (const c of clients) c.write(": ping\n\n");
+  }, pingMs);
+  pinger.unref();
+  const base = (res) => {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("X-Frame-Options", "DENY");
+  };
+  const text = (res, status, body) => {
+    res.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end(body);
+  };
+  const json = (res, status, body) => {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(JSON.stringify(body));
+  };
+  const handle = (req, res) => {
+    base(res);
+    const host = first(req.headers.host)?.toLowerCase();
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) return text(res, 403, "Host n\xE3o permitido.");
+    let url2;
+    try {
+      url2 = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+    } catch {
+      return text(res, 404, "N\xE3o encontrado.");
+    }
+    const path = url2.pathname;
+    const method = req.method ?? "GET";
+    const queryToken = url2.searchParams.get("t") ?? "";
+    const headerToken = first(req.headers["x-duto-inspetor"]) ?? "";
+    if (method === "GET" && path === "/") {
+      if (!same(queryToken, token)) return text(res, 403, NO_TOKEN);
+      const nonce = randomBytes(16).toString("base64url");
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Content-Security-Policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`
+      });
+      return void res.end(o.page(nonce));
+    }
+    const isEvents = method === "GET" && path === "/api/eventos";
+    const detailId = /^\/api\/requisicoes\/([1-9]\d{0,15})(\/reenviar)?$/.exec(path);
+    const known = method === "GET" && (path === "/api/sessao" || path === "/api/requisicoes" || detailId && !detailId[2]) || isEvents || method === "POST" && detailId && detailId[2];
+    if (!known) return text(res, 404, "N\xE3o encontrado.");
+    if (!same(headerToken, token) && !(isEvents && same(queryToken, token))) return json(res, 403, { error: NO_TOKEN });
+    if (isEvents) {
+      res.writeHead(200, { "Content-Type": "text/event-stream; charset=utf-8", Connection: "keep-alive" });
+      res.write(": duto\n\n");
+      if (clients.size === 0) prime();
+      clients.add(res);
+      res.on("close", () => clients.delete(res));
+      return;
+    }
+    if (path === "/api/sessao") {
+      return json(res, 200, { tunnels: session.getState().tunnels.map((t) => ({ key: t.key, url: t.url, auth: !!t.auth })) });
+    }
+    if (path === "/api/requisicoes") return json(res, 200, { items: session.records.list().map(listItem) });
+    const id = Number(detailId[1]);
+    if (!Number.isSafeInteger(id)) return json(res, 404, { error: GONE });
+    if (method === "POST") return json(res, 200, session.replay(id));
+    const r = session.records.get(id);
+    if (!r) return json(res, 404, { error: GONE });
+    return json(res, 200, detail(r, session));
+  };
+  const server = createServer((req, res) => {
+    try {
+      handle(req, res);
+    } catch {
+      if (!res.headersSent) text(res, 500, "Erro interno.");
+      else res.end();
+    }
+  });
+  const listen = (p) => new Promise((resolve, reject) => {
+    const onError = (e) => reject(e);
+    server.once("error", onError);
+    server.listen(p, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve();
+    });
+  });
+  const want = o.port ?? DEFAULT_PORT;
+  try {
+    let bound = false;
+    if (want !== 0) {
+      for (let p = want; p <= want + PORT_TRIES && !bound; p++) {
+        try {
+          await listen(p);
+          bound = true;
+        } catch (e) {
+          if (e.code !== "EADDRINUSE") throw e;
+        }
+      }
+    }
+    if (!bound) await listen(0);
+  } catch (e) {
+    for (const u of unsubs) u();
+    clearInterval(pinger);
+    throw e;
+  }
+  port = server.address().port;
+  const url = `http://127.0.0.1:${port}`;
+  return {
+    port,
+    url,
+    openUrl: `${url}/?t=${token}`,
+    close: () => new Promise((resolve) => {
+      for (const u of unsubs) u();
+      clearInterval(pinger);
+      if (timer) clearTimeout(timer);
+      for (const c of clients) c.end();
+      clients.clear();
+      server.close(() => resolve());
+      server.closeAllConnections();
+    })
+  };
+}
+
 // src/session/session.ts
 import { spawn } from "child_process";
 
@@ -540,11 +1459,11 @@ async function isPortListening(port, timeoutMs = 500) {
 }
 
 // src/session/auth.ts
-import { createHash as createHash2, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TUNNEL_COOKIE = "__Host-duto_tunel";
 var QR_TTL_MS = 5 * 6e4;
-var sha = (s) => createHash2("sha256").update(s).digest();
-var same = (a, b) => timingSafeEqual(sha(a), sha(b));
+var sha2 = (s) => createHash3("sha256").update(s).digest();
+var same2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
 function splitPair(raw) {
   const i = raw.indexOf(":");
   return i < 0 ? null : { user: raw.slice(0, i), password: raw.slice(i + 1) };
@@ -553,11 +1472,11 @@ function parseBasic(value) {
   const m = /^basic +([A-Za-z0-9+/]+={0,2})$/i.exec(value?.trim() ?? "");
   return m ? splitPair(Buffer.from(m[1], "base64").toString("utf8")) : null;
 }
-var first = (v) => Array.isArray(v) ? v[0] : v;
+var first2 = (v) => Array.isArray(v) ? v[0] : v;
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
-  if (first(h["sec-fetch-site"])?.toLowerCase() === "same-site") return false;
-  const origin = first(h.origin);
+  if (first2(h["sec-fetch-site"])?.toLowerCase() === "same-site") return false;
+  const origin = first2(h.origin);
   if (origin === void 0) return true;
   let host;
   try {
@@ -580,27 +1499,27 @@ var TunnelAuth = class {
     this.credentials = o.credentials;
     this.allow = o.allow;
     this.now = o.now ?? Date.now;
-    this.secret = o.secret ?? randomBytes(32);
+    this.secret = o.secret ?? randomBytes2(32);
     this.qrUser = o.credentials[0]?.user ?? "";
   }
   access(h) {
     if (this.allow) {
-      const ip = first(h["cf-connecting-ip"]);
+      const ip = first2(h["cf-connecting-ip"]);
       const reason = this.allow.match(ip);
       if (reason) return { kind: "allow", reason };
     }
     const cookieUser = this.cookieUser(h.cookie);
     if (cookieUser && sameHostOrigin(h)) return { kind: "user", user: cookieUser };
-    const duto = first(h["x-duto-auth"]);
-    const cand = duto !== void 0 ? splitPair(duto) : parseBasic(first(h.authorization));
+    const duto = first2(h["x-duto-auth"]);
+    const cand = duto !== void 0 ? splitPair(duto) : parseBasic(first2(h.authorization));
     if (cand && this.checkPassword(cand.user, cand.password)) return { kind: "user", user: cand.user };
     return { kind: "denied" };
   }
   checkPassword(user, password) {
     let ok2 = false;
     for (const c of this.credentials) {
-      const userOk = same(c.user, user);
-      const passOk = same(c.password, password);
+      const userOk = same2(c.user, user);
+      const passOk = same2(c.password, password);
       if (userOk && passOk) ok2 = true;
     }
     return ok2;
@@ -612,19 +1531,19 @@ var TunnelAuth = class {
     return `${TUNNEL_COOKIE}=; Max-Age=0; Secure; HttpOnly; SameSite=Lax; Path=/`;
   }
   issueQrToken() {
-    this.qr = { token: randomBytes(24).toString("base64url"), expiresAt: this.now() + QR_TTL_MS };
+    this.qr = { token: randomBytes2(24).toString("base64url"), expiresAt: this.now() + QR_TTL_MS };
     return { ...this.qr };
   }
   consumeQrToken(token) {
     const qr = this.qr;
-    if (!qr || !same(qr.token, token)) return false;
+    if (!qr || !same2(qr.token, token)) return false;
     this.qr = null;
     return this.now() <= qr.expiresAt;
   }
   strip(h) {
     const out = { ...h };
     delete out["x-duto-auth"];
-    const basic = parseBasic(first(h.authorization));
+    const basic = parseBasic(first2(h.authorization));
     if (basic && this.checkPassword(basic.user, basic.password)) delete out.authorization;
     if (h.cookie !== void 0) {
       const parts = (Array.isArray(h.cookie) ? h.cookie.join("; ") : h.cookie).split(";").map((p) => p.trim()).filter(Boolean);
@@ -648,10 +1567,10 @@ var TunnelAuth = class {
     for (const p of list) {
       const item = p.trim();
       if (!item.startsWith(`${TUNNEL_COOKIE}=`)) continue;
-      const [b64, sig, ...resto] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
-      if (!b64 || !sig || resto.length) continue;
+      const [b64, sig2, ...resto] = item.slice(TUNNEL_COOKIE.length + 1).split(".");
+      if (!b64 || !sig2 || resto.length) continue;
       const user = Buffer.from(b64, "base64url").toString("utf8");
-      if (same(sig, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
+      if (same2(sig2, this.sign(user)) && this.credentials.some((c) => c.user === user)) return user;
     }
     return null;
   }
@@ -682,7 +1601,7 @@ function cors401(origin) {
 }
 
 // src/session/proxy.ts
-import { Agent, createServer, request } from "http";
+import { Agent, createServer as createServer2, request } from "http";
 import { connect as connect2 } from "net";
 
 // src/session/errorPage.ts
@@ -788,7 +1707,9 @@ ${o.error ? `<p class="error" role="alert">Usu\xE1rio ou senha incorretos.</p>
 }
 
 // src/session/proxy.ts
-var TEXT = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
+var DENIED_NO_REPLAY = "Barrada pela senha do t\xFAnel; n\xE3o d\xE1 para reenviar.";
+var PREFLIGHT_NO_REPLAY = "Preflight de CORS n\xE3o d\xE1 para reenviar.";
+var TEXT2 = /^(text\/|application\/(json|xml|javascript|x-www-form-urlencoded|graphql)|[^;]*\+(json|xml))/i;
 var MAX_BODY = 64 * 1024;
 var LOCAL_AGENT = new Agent({ keepAlive: false });
 function flat(h) {
@@ -805,8 +1726,11 @@ var Capture = class {
   max;
   chunks = [];
   size = 0;
+  /** Bytes vistos, capturados ou não. */
+  total = 0;
   truncated = false;
   push(c) {
+    this.total += c.length;
     if (!this.enabled) return;
     const room = this.max - this.size;
     if (room <= 0) {
@@ -818,6 +1742,9 @@ var Capture = class {
     this.chunks.push(part);
     this.size += part.length;
   }
+  raw() {
+    return this.enabled && this.size > 0 ? Buffer.concat(this.chunks) : null;
+  }
   text() {
     return this.enabled && this.size > 0 ? Buffer.concat(this.chunks).toString("utf8") : null;
   }
@@ -986,7 +1913,7 @@ async function startProxy(o) {
       await new Promise((r) => setTimeout(r, 50));
     }
   }
-  function record(req, route, headers, websocket, access) {
+  function record(req, route, headers, websocket, access, noReplay) {
     const id = nextId++;
     const started = Date.now();
     o.store.add({
@@ -1003,12 +1930,78 @@ async function startProxy(o) {
       resHeaders: {},
       reqBody: null,
       resBody: null,
+      reqRaw: null,
+      reqBodyBytes: 0,
+      reqTruncated: false,
+      reqComplete: false,
       truncated: false,
-      ...access && { access }
+      resTruncated: false,
+      ...access && { access },
+      ...noReplay && { noReplay }
     });
     return { id, started };
   }
-  const server = createServer(async (req, res) => {
+  function trackResponse(id, started, up, reqCap) {
+    const resCap = new Capture(TEXT2.test(up.headers["content-type"] ?? ""), max);
+    let bytes = 0;
+    up.on("data", (c) => {
+      bytes += c.length;
+      resCap.push(c);
+    });
+    up.on(
+      "end",
+      () => o.store.update(id, {
+        status: up.statusCode ?? null,
+        durationMs: Date.now() - started,
+        bytes,
+        resHeaders: flat(up.headers),
+        resBody: resCap.text(),
+        truncated: !!reqCap?.truncated || resCap.truncated,
+        resTruncated: resCap.truncated,
+        ...reqCap && { reqBody: reqCap.text(), reqRaw: reqCap.truncated ? null : reqCap.raw(), reqBodyBytes: reqCap.total, reqTruncated: reqCap.truncated }
+      })
+    );
+  }
+  function replay(id) {
+    const r = o.store.get(id);
+    const blocked = replayBlock(r);
+    if (blocked || !r) return { ok: false, reason: blocked ?? "Essa requisi\xE7\xE3o j\xE1 saiu da lista." };
+    const route = [...o.routes.values()].find((x) => x.tunnel === r.tunnel);
+    if (!route) return { ok: false, reason: tunnelClosedReason(r.tunnel) };
+    const newId = nextId++;
+    const started = Date.now();
+    const headers = replayHeaders(r);
+    o.store.add({
+      id: newId,
+      tunnel: r.tunnel,
+      method: r.method,
+      path: r.path,
+      status: null,
+      durationMs: null,
+      bytes: 0,
+      startedAt: started,
+      websocket: false,
+      reqHeaders: headers,
+      resHeaders: {},
+      reqBody: r.reqBody,
+      resBody: null,
+      reqRaw: r.reqRaw,
+      reqBodyBytes: r.reqBodyBytes,
+      reqTruncated: false,
+      reqComplete: true,
+      truncated: false,
+      resTruncated: false,
+      replayOf: r.id
+    });
+    void (async () => {
+      const host = await localHost(route.port);
+      const upstream = request({ host, port: route.port, agent: LOCAL_AGENT, method: r.method, path: r.path, headers }, (up) => trackResponse(newId, started, up));
+      upstream.on("error", (err) => o.store.update(newId, { status: 503, durationMs: Date.now() - started, error: err.message || err.code || err.name }));
+      upstream.end(r.reqRaw ?? void 0);
+    })();
+    return { ok: true, id: newId };
+  }
+  const server = createServer2(async (req, res) => {
     req.pause();
     const route = await routeFor(req);
     if (!route) {
@@ -1031,13 +2024,13 @@ async function startProxy(o) {
     const headers = delivered(req.headers, route);
     if (access?.kind === "denied") {
       const html = wantsHtml(req.headers.accept);
-      const { id: id2, started: started2 } = record(req, route, headers, false, html ? void 0 : access);
+      const { id: id2, started: started2 } = record(req, route, headers, false, html ? void 0 : access, DENIED_NO_REPLAY);
       const { status, out, body } = deny(req, res, html);
       o.store.update(id2, { status, durationMs: Date.now() - started2, bytes: Buffer.byteLength(body), resHeaders: out });
       return;
     }
-    const { id, started } = record(req, route, headers, false, access);
-    const reqCap = new Capture(TEXT.test(req.headers["content-type"] ?? ""), max);
+    const { id, started } = record(req, route, headers, false, access, preflight ? PREFLIGHT_NO_REPLAY : void 0);
+    const reqCap = new Capture(TEXT2.test(req.headers["content-type"] ?? ""), max);
     req.pause();
     const host = await localHost(route.port);
     const upstream = request(
@@ -1051,35 +2044,19 @@ async function startProxy(o) {
           up.resume();
           return;
         }
-        const resCap = new Capture(TEXT.test(up.headers["content-type"] ?? ""), max);
-        let bytes = 0;
         if (route.host && route.rewriteRedirects !== false && typeof up.headers.location === "string") {
           up.headers.location = rewriteLocation(up.headers.location, route.host, hostOf(req));
         }
         res.writeHead(up.statusCode ?? 502, up.statusMessage, up.headers);
-        up.on("data", (c) => {
-          bytes += c.length;
-          resCap.push(c);
-        });
+        trackResponse(id, started, up, reqCap);
         up.pipe(res);
-        up.on(
-          "end",
-          () => o.store.update(id, {
-            status: up.statusCode ?? null,
-            durationMs: Date.now() - started,
-            bytes,
-            resHeaders: flat(up.headers),
-            reqBody: reqCap.text(),
-            resBody: resCap.text(),
-            truncated: reqCap.truncated || resCap.truncated
-          })
-        );
       }
     );
     res.on("close", () => {
       if (!res.writableFinished) upstream.destroy();
     });
     upstream.on("error", (err) => {
+      req.resume();
       if (res.destroyed && res.writableFinished === false && !res.headersSent) return;
       const html = wantsHtml(req.headers.accept);
       const msg = html ? unavailablePage({ tunnel: route.tunnel, port: route.port, retry: req.method === "GET" }) : `Nada escutando em localhost:${route.port}. Suba o servidor e tente de novo.`;
@@ -1089,6 +2066,7 @@ async function startProxy(o) {
       } else res.destroy();
       o.store.update(id, { status: 503, durationMs: Date.now() - started, bytes: res.headersSent ? 0 : Buffer.byteLength(msg), error: err.message || err.code || err.name, reqBody: reqCap.text() });
     });
+    req.on("end", () => o.store.update(id, { reqComplete: true, reqRaw: reqCap.truncated ? null : reqCap.raw(), reqBodyBytes: reqCap.total, reqTruncated: reqCap.truncated, reqBody: reqCap.text() }));
     if (preflight) {
       req.resume();
       upstream.end();
@@ -1103,7 +2081,7 @@ async function startProxy(o) {
     if (!route) return void client.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
     const access = route.auth?.access(req.headers);
     const headers = delivered(req.headers, route);
-    const { id, started } = record(req, route, headers, true, access);
+    const { id, started } = record(req, route, headers, true, access, access?.kind === "denied" ? DENIED_NO_REPLAY : void 0);
     if (access?.kind === "denied") {
       client.end(WS_DENIED);
       o.store.update(id, { status: 401, durationMs: Date.now() - started });
@@ -1122,8 +2100,8 @@ async function startProxy(o) {
       target.write(`${raw}\r
 `);
       if (head.length) target.write(head);
-      target.once("data", (first2) => {
-        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first2.toString("latin1"))?.[1] ?? 0) || null;
+      target.once("data", (first3) => {
+        const status = Number(/^HTTP\/\d\.\d (\d{3})/.exec(first3.toString("latin1"))?.[1] ?? 0) || null;
         o.store.update(id, { status, durationMs: Date.now() - started });
       });
       target.pipe(client);
@@ -1146,6 +2124,7 @@ async function startProxy(o) {
   });
   return {
     port: server.address().port,
+    replay,
     close: () => new Promise((resolve) => {
       for (const s of sockets) s.destroy();
       server.close(() => resolve());
@@ -1241,6 +2220,9 @@ var RecordStore = class {
     Object.assign(r, patch);
     this.emit();
   }
+  get(id) {
+    return this.items.find((x) => x.id === id);
+  }
   /** Mais recentes primeiro. Mesma referência até a próxima mudança (serve de snapshot para a tela). */
   list() {
     this.snapshot ??= [...this.items].reverse();
@@ -1337,6 +2319,10 @@ var Session = class {
     const { token, expiresAt } = auth.issueQrToken();
     return { url: `${t.url}/__duto/qr/${token}`, expiresAt };
   }
+  /** Primeiro usuário configurado do túnel, ou null quando ele não tem senha. */
+  authUser(key) {
+    return this.auths.get(key)?.qrUser ?? null;
+  }
   /** Cria o TunnelAuth na primeira abertura (precisa do allow resolvido) e o mantém depois. */
   async authFor(key) {
     const existing = this.auths.get(key);
@@ -1348,6 +2334,10 @@ var Session = class {
     this.auths.set(key, auth);
     return auth;
   }
+  /** Reenvia uma requisição da lista ao serviço local. */
+  replay(id) {
+    return this.proxy ? this.proxy.replay(id) : { ok: false, reason: "Sess\xE3o ainda n\xE3o come\xE7ou." };
+  }
   async stop() {
     if (this.stopped) return;
     this.stopped = true;
@@ -1600,11 +2590,24 @@ async function runSession(specs, source, flags) {
     fail2(err instanceof Error ? err.message : String(err));
   }
   const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
-  if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-DKIFHB6J.js");
-    process.exit(await runFullscreen(session, specs, "0.5.0"));
+  let inspector = null;
+  let inspectorError;
+  if (flags.inspect !== false) {
+    try {
+      inspector = await startInspector({ session, page: inspectorPage });
+    } catch (err) {
+      inspectorError = err instanceof Error ? err.message : String(err);
+    }
   }
-  console.log(`${mark()} ${paint("muted", `${"0.5.0"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
+  if (wantsUi(flags)) {
+    const { runFullscreen } = await import("./fullscreen-YK365XSO.js");
+    const code = await runFullscreen(session, specs, "0.7.0", inspector, inspectorError);
+    await inspector?.close().catch(() => void 0);
+    process.exit(code);
+  }
+  console.log(`${mark()} ${paint("muted", `${"0.7.0"} \xB7 ${source} \xB7 Ctrl+C para encerrar`)}`);
+  if (inspector) console.log(paint("muted", `inspetor: ${inspector.openUrl}`));
+  if (inspectorError) console.log(warn(`inspetor n\xE3o subiu: ${inspectorError}`));
   const stopLog = runPlain(session, (l) => console.log(l));
   const stopped = new Promise((resolve) => {
     const onSignal = () => {
@@ -1621,6 +2624,7 @@ async function runSession(specs, source, flags) {
   await stopped;
   stopLog();
   await session.stop();
+  await inspector?.close().catch(() => void 0);
   process.exit(0);
 }
 async function tunnel(rawPort, flags) {
@@ -1658,8 +2662,8 @@ ${paint("signal", "Dica:")} crie um duto.yml com os t\xFAneis do projeto e rode
   return runSession([{ name, port, ...host ? { host } : {}, ...keepRedirects ? { rewriteRedirects: false } : {}, ...auth.length ? { auth } : {}, ...allow.length ? { allow } : {} }], "linha de comando", flags);
 }
 var cli = cac("duto");
-cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
-cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia").action((port, opts) => tunnel(port, opts));
+cli.command("[port]", "Sem porta: abre os t\xFAneis do duto.yml. Com porta: abre um t\xFAnel para ela").option("--name <nome>", "Nome do endere\xE7o fixo (ex.: web \u2192 https://web-<usu\xE1rio>.duto.dev)").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico (ex.: meuapp.test)").option("--no-rewrite-redirects", "Com --host: n\xE3o troca o host local pelo p\xFAblico nos redirecionamentos").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia: s\xF3 um log das requisi\xE7\xF5es (\xFAtil em scripts)").option("--no-inspect", "N\xE3o sobe o inspetor no navegador (127.0.0.1:4141)").option("--ui", "For\xE7a a tela cheia (no Windows ela vem desligada)").action((port, opts) => tunnel(port, opts));
+cli.command("http <port>", "O mesmo que duto <porta> (para quem vem do ngrok)").option("--name <nome>", "Nome do endere\xE7o fixo").option("--host <host>", "Host que o servi\xE7o local recebe no lugar do p\xFAblico").option("--no-rewrite-redirects", "Com --host: mant\xE9m os redirecionamentos como o servi\xE7o mandou").option("--auth <usuario:senha>", "Pede usu\xE1rio e senha para abrir o endere\xE7o (repet\xEDvel)").option("--permitir <faixa>", "Com --auth: IP, faixa (CIDR) ou nome (stripe, github) que entra sem senha (repet\xEDvel)").option("--no-ui", "Sem tela cheia").option("--no-inspect", "N\xE3o sobe o inspetor no navegador (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
 cli.command("login <token>", "Salva o authtoken (pegue em https://duto.dev)").action(async (token) => {
   try {
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
@@ -1698,7 +2702,7 @@ cli.help(
     body: s.body.replace(/^\s*For more info, run any command with the `--help` flag:/m, "  Mais detalhes de um comando: duto <comando> --help").replace("Display this message", "Mostra esta ajuda").replace("Display version number", "Mostra a vers\xE3o")
   }))
 );
-cli.version("0.5.0");
+cli.version("0.7.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();