@tonyclaw/agent-inspector 3.0.37 → 3.0.39

package/src/components/providers/SettingsDialog.tsx

@@ -10,6 +10,7 @@ import { useProviders } from "../../lib/useProviders";
 import { useStripConfig } from "../../lib/useStripConfig";
 import { copyTextToClipboard } from "../../lib/clipboard";
 import { fetchJsonWithTimeout } from "../../lib/apiClient";
+import { withBasePath } from "../../lib/basePath";
 import {
   MAX_PROVIDER_TEST_TIMEOUT_SECONDS,
   MAX_SLOW_RESPONSE_THRESHOLD_SECONDS,
@@ -359,7 +360,11 @@ function OnboardingSettingsTab(): JSX.Element {
         value: "agent-inspector onboard --status --opencode-only",
       },
       { id: "opencode-verify", label: "OpenCode verify", value: "opencode mcp list" },
-      { id: "opencode-proxy", label: "OpenCode proxy", value: `LLM_BASE_URL=${origin}/proxy` },
+      {
+        id: "opencode-proxy",
+        label: "OpenCode proxy",
+        value: `LLM_BASE_URL=${origin}${withBasePath("/proxy")}`,
+      },
       {
         id: "mimo-config",
         label: "MiMo Code config",
@@ -371,11 +376,23 @@ function OnboardingSettingsTab(): JSX.Element {
         value: "agent-inspector onboard --status --mimo-only",
       },
       { id: "mimo-verify", label: "MiMo Code verify", value: "mimo mcp list" },
-      { id: "mimo-proxy", label: "MiMo Code proxy", value: `OPENAI_BASE_URL=${origin}/proxy` },
-      { id: "mcp", label: "MCP URL", value: `${origin}/api/mcp` },
-      { id: "proxy", label: "Proxy URL", value: `${origin}/proxy` },
-      { id: "anthropic", label: "Anthropic base", value: `ANTHROPIC_BASE_URL=${origin}/proxy` },
-      { id: "openai", label: "OpenAI base", value: `OPENAI_BASE_URL=${origin}/proxy` },
+      {
+        id: "mimo-proxy",
+        label: "MiMo Code proxy",
+        value: `OPENAI_BASE_URL=${origin}${withBasePath("/proxy")}`,
+      },
+      { id: "mcp", label: "MCP URL", value: `${origin}${withBasePath("/api/mcp")}` },
+      { id: "proxy", label: "Proxy URL", value: `${origin}${withBasePath("/proxy")}` },
+      {
+        id: "anthropic",
+        label: "Anthropic base",
+        value: `ANTHROPIC_BASE_URL=${origin}${withBasePath("/proxy")}`,
+      },
+      {
+        id: "openai",
+        label: "OpenAI base",
+        value: `OPENAI_BASE_URL=${origin}${withBasePath("/proxy")}`,
+      },
     ],
     [origin],
   );
@@ -479,7 +496,7 @@ function McpSettingsTab(): JSX.Element {
     if (typeof window === "undefined") return "http://localhost:9527";
     return window.location.origin;
   }, []);
-  const endpoint = `${origin}/api/mcp`;
+  const endpoint = `${origin}${withBasePath("/api/mcp")}`;
   const values = useMemo(
     () => [
       { id: "mcp-url", label: "Streamable HTTP MCP URL", value: endpoint },

package/src/lib/apiClient.ts

@@ -1,5 +1,6 @@
 /* eslint-disable functional/no-throw-statements */
 import { z } from "zod";
+import { withBasePath } from "./basePath";
 
 const ApiErrorSchema = z.object({
   error: z.string(),
@@ -7,6 +8,12 @@ const ApiErrorSchema = z.object({
 
 const MUTATION_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 
+function withInspectorBasePath(input: RequestInfo | URL): RequestInfo | URL {
+  if (typeof input !== "string") return input;
+  if (!input.startsWith("/") || input.startsWith("//")) return input;
+  return withBasePath(input);
+}
+
 export function withBrowserMutationProof(init?: RequestInit): RequestInit | undefined {
   const method = init?.method?.toUpperCase();
   if (method === undefined || !MUTATION_METHODS.has(method)) return init;
@@ -52,7 +59,7 @@ export async function fetchJson<T>(
   init?: RequestInit,
   errorFallback?: (response: Response) => string,
 ): Promise<T> {
-  const response = await fetch(input, withBrowserMutationProof(init));
+  const response = await fetch(withInspectorBasePath(input), withBrowserMutationProof(init));
   if (!response.ok) {
     const fallback = errorFallback?.(response) ?? `Request failed with status ${response.status}`;
     throw new Error(await readApiError(response, fallback));
@@ -100,7 +107,7 @@ export async function fetchWithTimeout(
   }
 
   try {
-    return await fetch(input, {
+    return await fetch(withInspectorBasePath(input), {
       ...withBrowserMutationProof(init),
       signal: controller.signal,
     });

package/src/lib/basePath.ts

@@ -0,0 +1,83 @@
+/// <reference types="vite/client" />
+
+export const AGENT_INSPECTOR_BASE_PATH_ENV = "AGENT_INSPECTOR_BASE_PATH";
+export const AGENT_INSPECTOR_INTERNAL_STRIPPED_BASE_PATH_ENV =
+  "AGENT_INSPECTOR_INTERNAL_STRIPPED_BASE_PATH";
+export const AGENT_INSPECTOR_BASE_PATH_META_NAME = "agent-inspector-base-path";
+export const DEFAULT_AGENT_INSPECTOR_BASE_PATH = "/inspector";
+
+type BasePathEnv = Readonly<Record<string, string | undefined>>;
+
+function trimSlashes(value: string): string {
+  return value.replace(/^\/+/u, "").replace(/\/+$/u, "");
+}
+
+export function normalizeBasePath(value: string | undefined): string {
+  const trimmed = value?.trim();
+  if (trimmed === undefined || trimmed.length === 0 || trimmed === "/") return "";
+  const path = trimSlashes(trimmed);
+  if (path.length === 0) return "";
+  return `/${path}`;
+}
+
+function readDocumentBasePath(): string | undefined {
+  if (typeof document === "undefined") return undefined;
+  return (
+    document
+      .querySelector(`meta[name="${AGENT_INSPECTOR_BASE_PATH_META_NAME}"]`)
+      ?.getAttribute("content") ?? undefined
+  );
+}
+
+function readProcessBasePath(): string | undefined {
+  if (typeof process === "undefined") return undefined;
+  return process.env[AGENT_INSPECTOR_BASE_PATH_ENV];
+}
+
+export function getConfiguredBasePath(env?: BasePathEnv): string {
+  return normalizeBasePath(
+    env?.[AGENT_INSPECTOR_BASE_PATH_ENV] ??
+      readProcessBasePath() ??
+      readDocumentBasePath() ??
+      import.meta.env?.BASE_URL ??
+      DEFAULT_AGENT_INSPECTOR_BASE_PATH,
+  );
+}
+
+export function getRouterBasePath(env?: BasePathEnv): string {
+  if (env?.[AGENT_INSPECTOR_INTERNAL_STRIPPED_BASE_PATH_ENV] === "1") return "";
+  return getConfiguredBasePath(env);
+}
+
+export function basePathForVite(basePath: string): string {
+  const normalized = normalizeBasePath(basePath);
+  return normalized.length === 0 ? "/" : `${normalized}/`;
+}
+
+export function withBasePath(path: string, basePath = getConfiguredBasePath()): string {
+  const normalized = normalizeBasePath(basePath);
+  if (/^[a-z][a-z0-9+.-]*:/iu.test(path)) return path;
+  if (normalized.length === 0) return path;
+  if (path.length === 0 || path === "/") return normalized;
+  if (path.startsWith(`${normalized}/`) || path === normalized) return path;
+  return path.startsWith("/") ? `${normalized}${path}` : `${normalized}/${path}`;
+}
+
+export function stripBasePath(pathname: string, basePath = getConfiguredBasePath()): string {
+  const normalized = normalizeBasePath(basePath);
+  if (normalized.length === 0) return pathname;
+  if (pathname === normalized) return "/";
+  if (pathname.startsWith(`${normalized}/`)) return pathname.slice(normalized.length);
+  return pathname;
+}
+
+export function appendBasePathToOrigin(origin: string, path: string, basePath: string): string {
+  const normalized = normalizeBasePath(basePath);
+  if (normalized.length === 0 && path === "/") return origin;
+  return `${origin}${withBasePath(path, normalized)}`;
+}
+
+export function stripBasePathFromRequestPath(rawPath: string, basePath: string): string {
+  const url = new URL(rawPath, "http://localhost");
+  return `${stripBasePath(url.pathname, basePath)}${url.search}`;
+}

package/src/lib/sessionUrl.ts

@@ -1,3 +1,5 @@
+import { withBasePath } from "./basePath";
+
 const B64URL_RE = /^[A-Za-z0-9_-]+$/;
 
 function bytesToBinary(bytes: Uint8Array): string {
@@ -39,6 +41,6 @@ export function decodeSessionIdFromPath(encoded: string): string {
   }
 }
 
-export function getSessionPath(sessionId: string): string {
-  return `/session/${encodeSessionIdForPath(sessionId)}`;
+export function getSessionPath(sessionId: string, basePath?: string): string {
+  return withBasePath(`/session/${encodeSessionIdForPath(sessionId)}`, basePath);
 }

package/src/mcp/loopback.ts

@@ -16,6 +16,7 @@
  * — should stay identical so callers don't change.
  */
 
+import { getConfiguredBasePath, withBasePath } from "../lib/basePath";
 import { getCurrentPort } from "../lib/serverPort";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -47,7 +48,7 @@ export async function callApi(path: string, options: CallApiOptions = {}): Promi
     throw new Error(`callApi: path must start with '/', got: ${path}`);
   }
   const port = getCurrentPort();
-  const url = `http://127.0.0.1:${port}${path}`;
+  const url = `http://127.0.0.1:${port}${withBasePath(path, getConfiguredBasePath(process.env))}`;
 
   const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: userSignal, ...rest } = options;
 

package/src/mcp/server.ts

@@ -34,6 +34,7 @@ import {
 } from "../lib/groupContract";
 import { InspectorRunStatusSchema, UpdateInspectorRunInputSchema } from "../lib/runContract";
 import { getCurrentPort, setCurrentPort } from "../lib/serverPort";
+import { getConfiguredBasePath, withBasePath } from "../lib/basePath";
 import { JsonValueSchema } from "../contracts";
 import {
   MAX_PROVIDER_MODEL_NAME_CHARS,
@@ -326,7 +327,10 @@ function jsonResource(uri: URL, data: unknown): ReadResourceResult {
 }
 
 function mcpEndpointUrl(): string {
-  return `http://localhost:${String(getCurrentPort())}/api/mcp`;
+  return `http://localhost:${String(getCurrentPort())}${withBasePath(
+    "/api/mcp",
+    getConfiguredBasePath(process.env),
+  )}`;
 }
 
 function mcpHealth(): Record<string, unknown> {
@@ -338,7 +342,7 @@ function mcpHealth(): Record<string, unknown> {
     },
     transport: {
       primary: "streamable-http",
-      endpoint: "/api/mcp",
+      endpoint: withBasePath("/api/mcp", getConfiguredBasePath(process.env)),
       stateless: true,
     },
     mode: getMcpModeInfo(),

package/src/proxy/identityProxy.ts

@@ -2,6 +2,13 @@ import http from "node:http";
 import { Buffer } from "node:buffer";
 import { timingSafeEqual } from "node:crypto";
 import { isIP } from "node:net";
+import {
+  AGENT_INSPECTOR_BASE_PATH_META_NAME,
+  getConfiguredBasePath,
+  normalizeBasePath,
+  stripBasePath,
+  stripBasePathFromRequestPath,
+} from "../lib/basePath";
 import { lookupClientByPort } from "./socketTracker";
 
 const IDENTITY_HEADERS = {
@@ -68,6 +75,43 @@ const DOCUMENT_CONTENT_SECURITY_POLICY = [
   "worker-src 'self' blob:",
 ].join("; ");
 
+function htmlAttributeEscape(value: string): string {
+  return value
+    .replace(/&/gu, "&")
+    .replace(/"/gu, """)
+    .replace(/</gu, "&lt;")
+    .replace(/>/gu, "&gt;");
+}
+
+export function rewriteHtmlForBasePath(html: string, basePath: string): string {
+  const normalized = normalizeBasePath(basePath);
+  if (normalized.length === 0) return html;
+  const escaped = htmlAttributeEscape(normalized);
+  const meta = `<meta name="${AGENT_INSPECTOR_BASE_PATH_META_NAME}" content="${escaped}">`;
+  const withMeta = html.includes(`name="${AGENT_INSPECTOR_BASE_PATH_META_NAME}"`)
+    ? html
+    : html.replace(/<head(\s[^>]*)?>/iu, (match) => `${match}${meta}`);
+  const escapedBase = normalized.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return withMeta.replace(
+    new RegExp(`\\b(href|src|action)=("|')/(?!/|${escapedBase.slice(1)}(?:/|$))`, "giu"),
+    (_match: string, attr: string, quote: string) => `${attr}=${quote}${normalized}/`,
+  );
+}
+
+function javaScriptStringEscape(value: string): string {
+  return value.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"');
+}
+
+export function rewriteJavaScriptForBasePath(source: string, basePath: string): string {
+  const normalized = normalizeBasePath(basePath);
+  if (normalized.length === 0) return source;
+  const escaped = javaScriptStringEscape(normalized);
+  return source
+    .replace(/\bbasepath:\s*""/gu, `basepath:"${escaped}"`)
+    .replace(/return"\/"\+([A-Za-z_$][\w$]*)/gu, `return"${escaped}/"+$1`)
+    .replace(/(["'])\/assets\//gu, `$1${normalized}/assets/`);
+}
+
 export type IdentityProxyOptions = {
   /** Public port to listen on. Clients point at this. */
   listenPort: number;
@@ -159,7 +203,8 @@ function isSafeMethod(method: string | undefined): boolean {
 }
 
 function isPublicHealthPath(pathname: string): boolean {
-  return pathname === "/livez" || pathname === "/readyz" || pathname === "/api/health";
+  const path = stripBasePath(pathname, getConfiguredBasePath(process.env));
+  return path === "/livez" || path === "/readyz" || path === "/api/health";
 }
 
 function configuredPositiveInteger(value: number | undefined, fallback: number): number {
@@ -182,7 +227,10 @@ export function isBrowserMutationAllowed(input: {
   csrfToken?: string;
 }): boolean {
   if (isSafeMethod(input.method)) return true;
-  const pathname = new URL(input.path, "http://localhost").pathname;
+  const pathname = stripBasePath(
+    new URL(input.path, "http://localhost").pathname,
+    getConfiguredBasePath(process.env),
+  );
   if (pathname === "/proxy" || pathname.startsWith("/proxy/")) return true;
 
   const fetchSite = input.secFetchSite?.toLowerCase();
@@ -219,7 +267,10 @@ export function isIdentityProxyRequestAllowed(input: {
   if (input.options.allowRemoteControl === true) return true;
   if (isLoopbackPeer(input.remoteAddress)) return true;
 
-  const pathname = new URL(input.path, "http://localhost").pathname;
+  const pathname = stripBasePath(
+    new URL(input.path, "http://localhost").pathname,
+    getConfiguredBasePath(process.env),
+  );
   if (pathname === "/proxy" || pathname.startsWith("/proxy/")) {
     if (input.options.allowUnauthenticatedRemoteProxy === true) return true;
     const proxyCredential = bearerToken(input.proxyAuthorization) ?? input.proxyTokenHeader ?? null;
@@ -349,6 +400,9 @@ async function handleRequest(
   res: http.ServerResponse,
   options: IdentityProxyOptions,
 ): Promise<void> {
+  const basePath = getConfiguredBasePath(process.env);
+  const upstreamPath = stripBasePathFromRequestPath(req.url ?? "/", basePath);
+  const requestUrl = new URL(req.url ?? "/", "http://localhost");
   if (!isTrustedIdentityProxyHost(req.headers.host, options)) {
     res.writeHead(400, {
       "content-type": "application/json; charset=utf-8",
@@ -359,6 +413,16 @@ async function handleRequest(
     return;
   }
 
+  if (basePath.length > 0 && requestUrl.pathname.startsWith("/assets/")) {
+    res.writeHead(307, {
+      location: `${basePath}${requestUrl.pathname}${requestUrl.search}`,
+      "cache-control": "no-store",
+    });
+    res.end();
+    req.resume();
+    return;
+  }
+
   if (
     !isBrowserMutationAllowed({
       path: req.url ?? "/",
@@ -443,6 +507,7 @@ async function handleRequest(
   for (const [name, value] of Object.entries(req.headers)) {
     const lowerName = name.toLowerCase();
     if (REQUEST_HOP_BY_HOP.has(lowerName)) continue;
+    if (basePath.length > 0 && lowerName === "accept-encoding") continue;
     if (lowerName.startsWith(IDENTITY_HEADER_PREFIX)) continue;
     if (value === undefined) continue;
     upstreamHeaders[name] = value;
@@ -469,7 +534,7 @@ async function handleRequest(
     {
       hostname: options.upstreamHost,
       port: options.upstreamPort,
-      path: req.url ?? "/",
+      path: upstreamPath,
       method: req.method,
       headers: upstreamHeaders,
     },
@@ -479,19 +544,46 @@ async function handleRequest(
         return;
       }
       const outHeaders: Record<string, string | string[]> = {};
+      const contentType = firstHeader(proxyRes.headers["content-type"]);
+      const shouldRewriteHtml =
+        basePath.length > 0 && contentType?.toLowerCase().includes("text/html") === true;
+      const shouldRewriteJavaScript =
+        basePath.length > 0 &&
+        (contentType?.toLowerCase().includes("javascript") === true ||
+          upstreamPath.split("?", 1)[0]?.endsWith(".js") === true);
+      const shouldRewriteBody = shouldRewriteHtml || shouldRewriteJavaScript;
       for (const [name, value] of Object.entries(proxyRes.headers)) {
-        if (RESPONSE_HOP_BY_HOP.has(name.toLowerCase())) continue;
+        const lowerName = name.toLowerCase();
+        if (RESPONSE_HOP_BY_HOP.has(lowerName)) continue;
+        if (shouldRewriteBody && lowerName === "content-length") continue;
         if (value === undefined) continue;
         outHeaders[name] = value;
       }
       for (const [name, value] of Object.entries(BASE_SECURITY_HEADERS)) {
         outHeaders[name] = value;
       }
-      const contentType = firstHeader(proxyRes.headers["content-type"]);
       if (contentType?.toLowerCase().includes("text/html") === true) {
         outHeaders["content-security-policy"] = DOCUMENT_CONTENT_SECURITY_POLICY;
       }
       res.writeHead(proxyRes.statusCode ?? 502, outHeaders);
+      if (shouldRewriteBody) {
+        const chunks: Buffer[] = [];
+        proxyRes.on("data", (chunk: unknown) => {
+          chunks.push(toBuffer(chunk));
+        });
+        proxyRes.on("end", () => {
+          const body = Buffer.concat(chunks).toString("utf8");
+          res.end(
+            shouldRewriteHtml
+              ? rewriteHtmlForBasePath(body, basePath)
+              : rewriteJavaScriptForBasePath(body, basePath),
+          );
+        });
+        proxyRes.on("error", () => {
+          if (!res.writableEnded) res.destroy();
+        });
+        return;
+      }
       proxyRes.pipe(res);
     },
   );

package/src/proxy/privateDataPath.ts

@@ -21,8 +21,22 @@ const securedPaths = new Set<string>();
 const securedFileIdentities = new Map<string, string>();
 let cachedWindowsSid: string | null = null;
 
+// Always invoke the system copies of `whoami.exe` / `icacls.exe` regardless
+// of PATH ordering. Git Bash and similar shells ship stub binaries (e.g.
+// `/usr/bin/whoami.exe`) that take precedence on the inherited PATH and do
+// not understand Windows ACL arguments, which makes `ensurePrivate*` fail
+// in environments where `C:\Windows\System32` is not first.
+function windowsSystemPath(executable: string): string {
+  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
+  return `${systemRoot}\\System32\\${executable}`;
+}
+
 function runWindowsCommand(executable: string, args: readonly string[]): WindowsCommandResult {
-  const result = spawnSync(executable, [...args], {
+  const resolved =
+    process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable)
+      ? windowsSystemPath(executable)
+      : executable;
+  const result = spawnSync(resolved, [...args], {
     encoding: "utf8",
     shell: false,
     windowsHide: true,

package/src/proxy/sessionInfo.ts

@@ -1,4 +1,5 @@
 import type { SessionInfo, SessionLogSummary, SessionTokenUsage } from "../lib/sessionInfoContract";
+import { getConfiguredBasePath, withBasePath } from "../lib/basePath";
 import { getSessionPath } from "../lib/sessionUrl";
 import type { CapturedLog } from "./schemas";
 import type { SessionSnapshot } from "./sessionSupervisor";
@@ -104,11 +105,17 @@ function buildAbsoluteUrl(baseUrl: string, path: string): string {
 }
 
 function buildApiPath(sessionId: string): string {
-  return buildRelativePath("/api/sessions", new URLSearchParams({ sessionId }));
+  return buildRelativePath(
+    withBasePath("/api/sessions", getConfiguredBasePath(process.env)),
+    new URLSearchParams({ sessionId }),
+  );
 }
 
 function buildCompactLogsPath(sessionId: string): string {
-  return buildRelativePath("/api/logs", new URLSearchParams({ compact: "1", sessionId }));
+  return buildRelativePath(
+    withBasePath("/api/logs", getConfiguredBasePath(process.env)),
+    new URLSearchParams({ compact: "1", sessionId }),
+  );
 }
 
 function collectSortedValues(values: readonly (string | null)[]): string[] {
@@ -204,7 +211,7 @@ export function buildSessionInfo(input: BuildSessionInfoInput): SessionInfo {
   const queuedTasks = input.snapshot?.queuedTasks ?? 0;
   const runningTasks = input.snapshot?.runningTasks ?? 0;
   const lastTaskError = normalizeString(input.snapshot?.lastTaskError);
-  const inspectorPath = getSessionPath(input.sessionId);
+  const inspectorPath = getSessionPath(input.sessionId, getConfiguredBasePath(process.env));
   const apiPath = buildApiPath(input.sessionId);
   const compactLogsPath = buildCompactLogsPath(input.sessionId);
   const latestLogs = summaries.slice(0, latestLogLimit).map((summary, index) => ({

package/src/proxy/upstream.ts

@@ -1,4 +1,5 @@
 import type { ProviderConfig } from "./providers";
+import { getConfiguredBasePath, stripBasePath } from "../lib/basePath";
 import { logger } from "./logger";
 import {
   AUTH_HEADER_X_API_KEY,
@@ -41,7 +42,8 @@ export function describeApiRoute(apiPath: string): ApiRoute {
 }
 
 export function getProxyApiPath(url: URL): string {
-  return url.pathname.replace(/^\/proxy/, "") + url.search;
+  const pathname = stripBasePath(url.pathname, getConfiguredBasePath(process.env));
+  return pathname.replace(/^\/proxy/, "") + url.search;
 }
 
 export function selectUpstreamBase(route: ApiRoute, provider: ProviderConfig | null): string {

package/src/router.tsx

@@ -1,9 +1,15 @@
 import { createRouter } from "@tanstack/react-router";
+import { getRouterBasePath } from "./lib/basePath";
 import { routeTree } from "./routeTree.gen";
 
-export function getRouter() {
+function defaultRouterBasePath(): string {
+  return getRouterBasePath(typeof process === "undefined" ? undefined : process.env);
+}
+
+export function getRouter(basepath = defaultRouterBasePath()) {
   const router = createRouter({
     routeTree,
+    basepath,
     scrollRestoration: false,
   });
   attachServerSsrStoreCompatibility(router);

package/src/routes/__root.tsx

@@ -5,6 +5,11 @@ import { SWRConfig } from "swr";
 import faviconSvg from "../assets/favicon.svg?url";
 import { SafeErrorBoundary, SafeRouteError } from "../components/errors/SafeErrorBoundary";
 import appCss from "../index.css?url";
+import {
+  AGENT_INSPECTOR_BASE_PATH_META_NAME,
+  getConfiguredBasePath,
+  withBasePath,
+} from "../lib/basePath";
 import { installChunkLoadRecovery } from "../lib/chunkLoadRecovery";
 import { THEME_MODE_STORAGE_KEY } from "../lib/themeMode";
 import {
@@ -87,11 +92,12 @@ export const Route = createRootRoute({
     meta: [
       { charSet: "utf-8" },
       { name: "viewport", content: "width=device-width, initial-scale=1" },
+      { name: AGENT_INSPECTOR_BASE_PATH_META_NAME, content: getConfiguredBasePath() },
       { title: "Agent Inspector" },
     ],
     links: [
-      { rel: "stylesheet", href: appCss },
-      { rel: "icon", type: "image/svg+xml", href: faviconSvg },
+      { rel: "stylesheet", href: withBasePath(appCss) },
+      { rel: "icon", type: "image/svg+xml", href: withBasePath(faviconSvg) },
     ],
   }),
   component: RootComponent,
@@ -138,7 +144,7 @@ function RootNotFoundComponent() {
               This route is not part of the Agent Inspector UI or API surface.
             </p>
             <a
-              href="/"
+              href={withBasePath("/")}
               className="bg-primary text-primary-foreground hover:bg-primary/90 mt-6 inline-flex h-9 items-center justify-center rounded-md px-4 text-sm font-medium transition-colors"
             >
               Open Agent Inspector