claude-inspect 0.1.0

package/dist/app/server/history/aggregator.js

@@ -0,0 +1,318 @@
+import { readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { addUsage, emptyTotals, estimateCost, mergeTotals } from '../../shared/pricing.js';
+import { toolSummary } from '../../shared/tools.js';
+import { registry } from '../formats/index.js';
+import { subagentDir } from '../sources/subagents.js';
+import { JsonlTail } from '../util/jsonl.js';
+const FILE_TOOLS = {
+    Read: 'reads',
+    Edit: 'edits',
+    MultiEdit: 'edits',
+    NotebookEdit: 'edits',
+    Write: 'writes',
+};
+function dayKey(ts) {
+    const d = new Date(ts);
+    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+}
+function p95(values) {
+    if (!values.length)
+        return undefined;
+    const s = [...values].sort((a, b) => a - b);
+    return s[Math.min(s.length - 1, Math.floor(s.length * 0.95))];
+}
+export class HistoryIndex {
+    files = new Map();
+    ready = false;
+    totalFiles = 0;
+    /**
+     * @param projectOf liefert den Projektnamen einer Session (aus der Zusammenfassung)
+     * @param full      beim ersten Lauf auch alle Subagent-Verzeichnisse durchsuchen
+     */
+    async refresh(transcripts, projectOf, full) {
+        const seen = new Set();
+        for (const f of transcripts) {
+            const project = await projectOf(f);
+            seen.add(f.path);
+            await this.scan(f.path, f.size, f.sessionId, undefined, project);
+            if (!full && Date.now() - f.mtime > 3600_000) {
+                for (const p of this.files.keys())
+                    if (p.startsWith(subagentDir(f.path)))
+                        seen.add(p);
+                continue;
+            }
+            const dir = subagentDir(f.path);
+            let names = [];
+            try {
+                names = await readdir(dir);
+            }
+            catch {
+                /* keine Subagenten */
+            }
+            for (const n of names) {
+                const m = /^agent-(.+)\.jsonl$/.exec(n);
+                if (!m)
+                    continue;
+                const path = join(dir, n);
+                seen.add(path);
+                try {
+                    await this.scan(path, (await stat(path)).size, f.sessionId, m[1], project);
+                }
+                catch {
+                    /* gelöscht */
+                }
+            }
+        }
+        // Von Claude Code aufgeräumte Dateien vergessen
+        for (const p of [...this.files.keys()])
+            if (!seen.has(p))
+                this.files.delete(p);
+        this.totalFiles = this.files.size;
+        this.ready = true;
+    }
+    async scan(path, size, sessionId, agentId, project) {
+        let agg = this.files.get(path);
+        if (agg && agg.size === size)
+            return;
+        if (!agg || size < agg.size) {
+            agg = { path, size: 0, sessionId, agentId, project, tail: new JsonlTail(path), usage: new Map(), calls: [], callIdx: new Map(), prompts: [] };
+            this.files.set(path, agg);
+        }
+        agg.size = size;
+        agg.project = project;
+        let lines;
+        try {
+            ({ lines } = await agg.tail.readNew());
+        }
+        catch {
+            return;
+        }
+        for (const l of lines) {
+            if (l.value === undefined)
+                continue;
+            const { out } = registry.decode('transcript', l.value, path, l.line, { silent: true });
+            for (const e of out)
+                this.fold(agg, e);
+        }
+    }
+    fold(agg, e) {
+        const ts = e.timestamp ? Date.parse(e.timestamp) : NaN;
+        if (!Number.isNaN(ts)) {
+            if (agg.firstTs === undefined || ts < agg.firstTs)
+                agg.firstTs = ts;
+            if (agg.lastTs === undefined || ts > agg.lastTs)
+                agg.lastTs = ts;
+        }
+        switch (e.kind) {
+            case 'tool-use': {
+                if (agg.callIdx.has(e.toolUseId))
+                    break; // doppelte Records (Resume/Fork)
+                const file = typeof e.input.file_path === 'string' ? e.input.file_path : typeof e.input.notebook_path === 'string' ? e.input.notebook_path : undefined;
+                agg.callIdx.set(e.toolUseId, agg.calls.length);
+                agg.calls.push({
+                    sessionId: agg.sessionId,
+                    agentId: agg.agentId,
+                    project: agg.project,
+                    toolUseId: e.toolUseId,
+                    name: e.name,
+                    summary: toolSummary(e.name, e.input).slice(0, 200),
+                    ts: Number.isNaN(ts) ? 0 : ts,
+                    file,
+                });
+                break;
+            }
+            case 'tool-result': {
+                const i = agg.callIdx.get(e.toolUseId);
+                if (i === undefined)
+                    break;
+                const c = agg.calls[i];
+                if (!Number.isNaN(ts) && c.ts)
+                    c.durationMs = Math.max(0, ts - c.ts);
+                c.isError = e.isError || undefined;
+                c.denied = e.denied ? true : undefined;
+                break;
+            }
+            case 'user-text':
+                if (!agg.agentId && !e.isMeta && !e.isCompactSummary && e.text && !e.text.startsWith('<') && !Number.isNaN(ts))
+                    agg.prompts.push(ts);
+                break;
+        }
+        if ((e.kind === 'assistant-text' || e.kind === 'thinking' || e.kind === 'tool-use') && e.usage && e.messageId && e.model && e.model !== '<synthetic>') {
+            agg.usage.set(e.messageId, { model: e.model, ts: Number.isNaN(ts) ? 0 : ts, usage: e.usage });
+        }
+    }
+    // ---------------------------------------------------------------------------
+    selected(f) {
+        const since = f.days ? Date.now() - f.days * 86_400_000 : 0;
+        const aggs = [...this.files.values()].filter((a) => (!f.project || a.project === f.project) && (a.lastTs ?? 0) >= since);
+        return { aggs, since };
+    }
+    stats(filter = {}) {
+        const { aggs, since } = this.selected(filter);
+        const byModel = new Map();
+        const days = new Map();
+        const projects = new Map();
+        const heat = Array.from({ length: 7 }, () => new Array(24).fill(0));
+        const tools = new Map();
+        const sessions = new Set();
+        const total = emptyTotals();
+        let costUSD = 0;
+        let prompts = 0;
+        let toolCalls = 0;
+        let from;
+        let to;
+        const day = (ts) => {
+            const k = dayKey(ts);
+            let d = days.get(k);
+            if (!d)
+                days.set(k, (d = { day: k, byModel: {}, prompts: 0, toolCalls: 0, sessions: 0, sessionSet: new Set() }));
+            return d;
+        };
+        const proj = (a) => {
+            let p = projects.get(a.project);
+            if (!p)
+                projects.set(a.project, (p = { project: a.project, sessions: 0, toolCalls: 0, outputTokens: 0, costUSD: 0, sessionSet: new Set() }));
+            return p;
+        };
+        for (const a of aggs) {
+            const p = proj(a);
+            for (const u of a.usage.values()) {
+                if (u.ts < since)
+                    continue;
+                const one = emptyTotals();
+                addUsage(one, u.usage);
+                let m = byModel.get(u.model);
+                if (!m)
+                    byModel.set(u.model, (m = emptyTotals()));
+                mergeTotals(m, one);
+                mergeTotals(total, one);
+                const cost = estimateCost(u.model, one) ?? 0;
+                costUSD += cost;
+                p.outputTokens += one.output;
+                p.costUSD += cost;
+                if (u.ts) {
+                    const d = day(u.ts);
+                    const dm = (d.byModel[u.model] ??= { output: 0, costUSD: 0 });
+                    dm.output += one.output;
+                    dm.costUSD += cost;
+                    d.sessionSet.add(a.sessionId);
+                    const dt = new Date(u.ts);
+                    heat[(dt.getDay() + 6) % 7][dt.getHours()]++;
+                    from = from === undefined ? u.ts : Math.min(from, u.ts);
+                    to = to === undefined ? u.ts : Math.max(to, u.ts);
+                }
+                sessions.add(a.sessionId);
+                p.sessionSet.add(a.sessionId);
+                p.lastActivity = !p.lastActivity || u.ts > Date.parse(p.lastActivity) ? new Date(u.ts).toISOString() : p.lastActivity;
+            }
+            for (const t of a.prompts) {
+                if (t < since)
+                    continue;
+                prompts++;
+                day(t).prompts++;
+            }
+            for (const c of a.calls) {
+                if (c.ts < since)
+                    continue;
+                toolCalls++;
+                p.toolCalls++;
+                if (c.ts)
+                    day(c.ts).toolCalls++;
+                let t = tools.get(c.name);
+                if (!t)
+                    tools.set(c.name, (t = { count: 0, errors: 0, denied: 0, durations: [] }));
+                t.count++;
+                if (c.isError)
+                    t.errors++;
+                if (c.denied)
+                    t.denied++;
+                if (c.durationMs !== undefined)
+                    t.durations.push(c.durationMs);
+            }
+        }
+        return {
+            ready: this.ready,
+            scannedFiles: this.files.size,
+            totalFiles: this.totalFiles,
+            from: from ? new Date(from).toISOString() : undefined,
+            to: to ? new Date(to).toISOString() : undefined,
+            totals: { sessions: sessions.size, prompts, toolCalls, costUSD, tokens: total },
+            byModel: [...byModel.entries()]
+                .map(([model, tokens]) => ({ model, tokens, costUSD: estimateCost(model, tokens) }))
+                .sort((a, b) => (b.costUSD ?? 0) - (a.costUSD ?? 0)),
+            byDay: [...days.values()]
+                .map(({ sessionSet, ...d }) => ({ ...d, sessions: sessionSet.size }))
+                .sort((a, b) => a.day.localeCompare(b.day)),
+            byProject: [...projects.values()]
+                .map(({ sessionSet, ...p }) => ({ ...p, sessions: sessionSet.size }))
+                .filter((p) => p.sessions > 0 || p.toolCalls > 0)
+                .sort((a, b) => b.costUSD - a.costUSD),
+            tools: [...tools.entries()]
+                .map(([name, t]) => ({
+                name,
+                count: t.count,
+                errors: t.errors,
+                denied: t.denied,
+                avgMs: t.durations.length ? t.durations.reduce((x, y) => x + y, 0) / t.durations.length : undefined,
+                p95Ms: p95(t.durations),
+            }))
+                .sort((a, b) => b.count - a.count),
+            heat,
+        };
+    }
+    toolCalls(q) {
+        const { aggs, since } = this.selected(q);
+        const needle = q.q?.toLowerCase();
+        const names = new Set();
+        const rows = [];
+        for (const a of aggs) {
+            if (q.sessionId && a.sessionId !== q.sessionId)
+                continue;
+            for (const c of a.calls) {
+                names.add(c.name);
+                if (c.ts < since)
+                    continue;
+                if (q.name && c.name !== q.name)
+                    continue;
+                if (q.errorsOnly && !c.isError && !c.denied)
+                    continue;
+                if (q.file && c.file !== q.file)
+                    continue;
+                if (needle && !`${c.summary} ${c.file ?? ''}`.toLowerCase().includes(needle))
+                    continue;
+                rows.push(c);
+            }
+        }
+        rows.sort((x, y) => y.ts - x.ts);
+        const offset = q.offset ?? 0;
+        return { total: rows.length, rows: rows.slice(offset, offset + (q.limit ?? 100)), names: [...names].sort() };
+    }
+    fileStats(filter) {
+        const { aggs, since } = this.selected(filter);
+        const needle = filter.q?.toLowerCase();
+        const m = new Map();
+        for (const a of aggs) {
+            for (const c of a.calls) {
+                const kind = FILE_TOOLS[c.name];
+                if (!kind || !c.file || c.ts < since)
+                    continue;
+                if (needle && !c.file.toLowerCase().includes(needle))
+                    continue;
+                let f = m.get(c.file);
+                if (!f)
+                    m.set(c.file, (f = { path: c.file, project: a.project, reads: 0, edits: 0, writes: 0, sessions: 0, lastTs: 0, sessionSet: new Set() }));
+                f[kind]++;
+                f.sessionSet.add(a.sessionId);
+                f.lastTs = Math.max(f.lastTs, c.ts);
+            }
+        }
+        const files = [...m.values()]
+            .map(({ sessionSet, ...f }) => ({ ...f, sessions: sessionSet.size }))
+            .sort((a, b) => b.edits + b.writes - (a.edits + a.writes) || b.lastTs - a.lastTs);
+        return { total: files.length, files: files.slice(0, filter.limit ?? 300) };
+    }
+    projects() {
+        return [...new Set([...this.files.values()].map((a) => a.project))].sort();
+    }
+}

package/dist/app/server/history/search.js

@@ -0,0 +1,138 @@
+import { readFile } from 'node:fs/promises';
+import { toolSummary } from '../../shared/tools.js';
+import { paths } from '../config.js';
+import { registry } from '../formats/index.js';
+function snippet(text, needle, radius = 90) {
+    const i = text.toLowerCase().indexOf(needle);
+    if (i < 0)
+        return text.slice(0, radius * 2);
+    const start = Math.max(0, i - radius);
+    const end = Math.min(text.length, i + needle.length + radius);
+    return (start > 0 ? '…' : '') + text.slice(start, end).replace(/\s+/g, ' ') + (end < text.length ? '…' : '');
+}
+/** Durchsuchbarer Text eines Eintrags – Anhänge und Zustands-Records bewusst nicht. */
+function searchable(e) {
+    switch (e.kind) {
+        case 'user-text':
+        case 'assistant-text':
+        case 'thinking':
+            return e.text;
+        case 'tool-use':
+            return `${toolSummary(e.name, e.input)}\n${JSON.stringify(e.input)}`;
+        case 'tool-result':
+            return e.parts.map((p) => (p.type === 'text' ? p.text : '')).join('\n');
+        case 'system':
+            return e.text;
+        default:
+            return undefined;
+    }
+}
+/**
+ * Volltextsuche direkt über die JSONL-Dateien (kein Index): Rohtext wird
+ * nach dem Suchbegriff durchsucht, nur Trefferzeilen werden dekodiert.
+ * Neueste Dateien zuerst; bricht bei `limit` Treffern oder nach `budgetMs` ab.
+ */
+export async function search(query, files, knownSessions, limit = 200, budgetMs = 6000, perFile = 5) {
+    const t0 = Date.now();
+    const needle = query.trim().toLowerCase();
+    const hits = [];
+    let scanned = 0;
+    let truncated = false;
+    if (needle.length < 2)
+        return { query, hits, scannedFiles: 0, totalFiles: files.length, truncated, ms: 0 };
+    outer: for (const f of files) {
+        if (Date.now() - t0 > budgetMs) {
+            truncated = true;
+            break;
+        }
+        let text;
+        try {
+            text = await readFile(f.path, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        scanned++;
+        const lower = text.toLowerCase();
+        let pos = lower.indexOf(needle);
+        let lineNo = 0;
+        let counted = 0;
+        let lastLine = -1;
+        let inFile = 0;
+        while (pos !== -1 && inFile < perFile) {
+            for (let i = text.indexOf('\n', counted); i !== -1 && i < pos; i = text.indexOf('\n', i + 1)) {
+                lineNo++;
+                counted = i + 1;
+            }
+            const lineStart = counted;
+            const lineEnd = text.indexOf('\n', pos);
+            if (lineNo !== lastLine) {
+                lastLine = lineNo;
+                try {
+                    const raw = JSON.parse(text.slice(lineStart, lineEnd === -1 ? undefined : lineEnd));
+                    const { out } = registry.decode('transcript', raw, f.path, lineNo, { silent: true });
+                    for (const e of out) {
+                        const s = searchable(e);
+                        if (!s || !s.toLowerCase().includes(needle))
+                            continue;
+                        hits.push({
+                            sessionId: f.sessionId,
+                            agentId: f.agentId,
+                            project: f.project,
+                            title: f.title,
+                            line: lineNo,
+                            kind: e.kind,
+                            toolName: e.kind === 'tool-use' ? e.name : undefined,
+                            toolUseId: e.kind === 'tool-use' || e.kind === 'tool-result' ? e.toolUseId : undefined,
+                            ts: e.timestamp,
+                            snippet: snippet(s, needle),
+                        });
+                        inFile++;
+                        break;
+                    }
+                }
+                catch {
+                    /* defekte Zeile */
+                }
+                if (hits.length >= limit) {
+                    truncated = true;
+                    break outer;
+                }
+            }
+            if (lineEnd === -1)
+                break;
+            pos = lower.indexOf(needle, lineEnd);
+        }
+    }
+    // Prompts aus history.jsonl, deren Session-Transcript nicht mehr existiert
+    if (hits.length < limit) {
+        try {
+            const lines = (await readFile(paths.history, 'utf8')).split('\n');
+            for (let i = lines.length - 1; i >= 0 && hits.length < limit; i--) {
+                if (!lines[i].toLowerCase().includes(needle))
+                    continue;
+                try {
+                    const p = registry.decode('history', JSON.parse(lines[i]), paths.history, i, { silent: true }).out;
+                    if (!p.display.toLowerCase().includes(needle) || (p.sessionId && knownSessions.has(p.sessionId)))
+                        continue;
+                    hits.push({
+                        sessionId: p.sessionId ?? '',
+                        project: p.project?.split('/').pop() ?? '?',
+                        title: 'transcript no longer exists',
+                        line: i,
+                        kind: 'history-prompt',
+                        ts: p.timestamp ? new Date(p.timestamp).toISOString() : undefined,
+                        snippet: snippet(p.display, needle),
+                    });
+                }
+                catch {
+                    /* defekte Zeile */
+                }
+            }
+        }
+        catch {
+            /* keine history.jsonl */
+        }
+    }
+    return { query, hits, scannedFiles: scanned, totalFiles: files.length, truncated, ms: Date.now() - t0 };
+}

package/dist/app/server/http.js

@@ -0,0 +1,169 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { extname, join, normalize } from 'node:path';
+import { sanitize } from './util/sanitize.js';
+const MIME = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.json': 'application/json',
+};
+export function startServer(inspector, opts) {
+    const token = opts.token || randomBytes(18).toString('base64url');
+    const COOKIE = 'ci_token';
+    const authed = (req, url) => {
+        if (opts.noAuth)
+            return true;
+        const given = url.searchParams.get('t') ?? /(?:^|;\s*)ci_token=([^;]+)/.exec(req.headers.cookie ?? '')?.[1] ?? '';
+        const a = Buffer.from(given);
+        const b = Buffer.from(token);
+        return a.length === b.length && timingSafeEqual(a, b);
+    };
+    // Schutz gegen DNS-Rebinding: nur lokale Host-Header akzeptieren.
+    const hostOk = (req) => {
+        const host = (req.headers.host ?? '').replace(/:\d+$/, '');
+        return host === '127.0.0.1' || host === 'localhost' || host === '[::1]';
+    };
+    const json = (res, status, body) => {
+        res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+        res.end(JSON.stringify(body));
+    };
+    const sseClients = new Set();
+    inspector.on('event', (ev) => {
+        const msg = `event: ${ev.type}\ndata: ${JSON.stringify(ev.data)}\n\n`;
+        for (const c of sseClients)
+            c.write(msg);
+    });
+    setInterval(() => {
+        for (const c of sseClients)
+            c.write(': ping\n\n');
+    }, 20_000).unref();
+    async function serveStatic(res, pathname) {
+        const rel = normalize(decodeURIComponent(pathname)).replace(/^(\.\.[/\\])+/, '');
+        let file = join(opts.webRoot, rel);
+        if (!file.startsWith(opts.webRoot))
+            return json(res, 403, { error: 'forbidden' });
+        try {
+            if (!(await stat(file)).isFile())
+                throw new Error();
+        }
+        catch {
+            file = join(opts.webRoot, 'index.html'); // SPA-Fallback
+        }
+        try {
+            await stat(file);
+        }
+        catch {
+            res.writeHead(503, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('UI not built. Run `npm run build` first (or `npm run dev:web` for development).');
+            return;
+        }
+        res.writeHead(200, { 'content-type': MIME[extname(file)] ?? 'application/octet-stream' });
+        createReadStream(file).pipe(res);
+    }
+    const server = createServer(async (req, res) => {
+        try {
+            const url = new URL(req.url ?? '/', 'http://localhost');
+            if (!hostOk(req))
+                return json(res, 403, { error: 'host not allowed' });
+            if (!authed(req, url)) {
+                res.writeHead(401, { 'content-type': 'text/plain; charset=utf-8' });
+                return res.end('Not authorized – open the URL with ?t=… printed in the console.');
+            }
+            // Token aus der URL in ein Cookie übernehmen, damit Folgeaufrufe ohne ?t= funktionieren.
+            if (!opts.noAuth && url.searchParams.has('t')) {
+                // persistent for a year, so a bookmark without ?t= keeps working after browser restarts
+                res.setHeader('set-cookie', `${COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=31536000`);
+            }
+            const p = url.pathname;
+            if (req.method !== 'GET')
+                return json(res, 405, { error: 'read-only' });
+            if (p === '/api/dashboard')
+                return json(res, 200, await inspector.getDashboard());
+            if (p === '/api/stream') {
+                res.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-store', connection: 'keep-alive' });
+                res.write(`event: dashboard\ndata: ${JSON.stringify(await inspector.getDashboard())}\n\n`);
+                sseClients.add(res);
+                req.on('close', () => sseClients.delete(res));
+                return;
+            }
+            if (p === '/api/sessions') {
+                const offset = Number(url.searchParams.get('offset') ?? 0);
+                const limit = Math.min(Number(url.searchParams.get('limit') ?? 50), 500);
+                return json(res, 200, await inspector.sessions(offset, limit, url.searchParams.get('q') ?? undefined));
+            }
+            let m = /^\/api\/session\/([\w-]+)$/.exec(p);
+            if (m) {
+                const d = await inspector.sessionDetail(m[1]);
+                return d ? json(res, 200, d) : json(res, 404, { error: 'unknown session' });
+            }
+            m = /^\/api\/transcript\/([\w-]+)$/.exec(p);
+            if (m) {
+                const agent = url.searchParams.get('agent') || undefined;
+                const from = Number(url.searchParams.get('from') ?? 0);
+                const page = await inspector.transcript(m[1], agent, from);
+                return page ? json(res, 200, page) : json(res, 404, { error: 'unknown transcript' });
+            }
+            m = /^\/api\/raw\/([\w-]+)$/.exec(p);
+            if (m) {
+                const agent = url.searchParams.get('agent') || undefined;
+                const line = await inspector.rawLine(m[1], agent, Number(url.searchParams.get('line')));
+                if (line === undefined)
+                    return json(res, 404, { error: 'unknown line' });
+                try {
+                    // Auch in der Rohansicht Geheimnisse maskieren, aber nichts kürzen.
+                    return json(res, 200, sanitize(JSON.parse(line), { maxString: Number.MAX_SAFE_INTEGER }));
+                }
+                catch {
+                    return json(res, 200, { unparsable: line });
+                }
+            }
+            if (p === '/api/formats')
+                return json(res, 200, inspector.formats());
+            // --- History (Phase 4) ---
+            const sp = url.searchParams;
+            const filter = {
+                project: sp.get('project') || undefined,
+                days: sp.get('days') ? Number(sp.get('days')) : undefined,
+            };
+            if (p === '/api/stats')
+                return json(res, 200, await inspector.historyStats(filter));
+            if (p === '/api/projects')
+                return json(res, 200, await inspector.historyProjects());
+            if (p === '/api/tools') {
+                return json(res, 200, await inspector.toolCalls({
+                    ...filter,
+                    name: sp.get('name') || undefined,
+                    q: sp.get('q') || undefined,
+                    sessionId: sp.get('session') || undefined,
+                    file: sp.get('file') || undefined,
+                    errorsOnly: sp.get('errors') === '1',
+                    offset: Number(sp.get('offset') ?? 0),
+                    limit: Math.min(Number(sp.get('limit') ?? 100), 1000),
+                }));
+            }
+            if (p === '/api/files')
+                return json(res, 200, await inspector.fileStats({ ...filter, q: sp.get('q') || undefined }));
+            if (p === '/api/search')
+                return json(res, 200, await inspector.search(sp.get('q') ?? ''));
+            m = /^\/api\/flow\/([\w-]+)$/.exec(p);
+            if (m) {
+                const flow = await inspector.flow(m[1]);
+                return flow ? json(res, 200, flow) : json(res, 404, { error: 'unknown session' });
+            }
+            if (p.startsWith('/api/'))
+                return json(res, 404, { error: 'not found' });
+            return serveStatic(res, p);
+        }
+        catch (e) {
+            json(res, 500, { error: e.message });
+        }
+    });
+    server.listen(opts.port, opts.host);
+    return { server, token };
+}