claude-inspect 0.6.0 → 0.8.0

package/README.de.md

@@ -41,7 +41,8 @@ beim Login und nach Abstürzen neu und läuft ohne Token (nur von localhost erre
 Manuell gestartet gibt `claude-inspect` eine URL mit Zufallstoken (`?t=…`) aus; der Browser merkt
 es sich als Cookie. `--token` für einen festen Token, `--no-auth` für keinen, `--port` für einen
 anderen Port, `CLAUDE_CONFIG_DIR=/pfad` für ein anderes Datenverzeichnis, `--no-cpu-log` ohne
-CPU-Protokoll, `CLAUDE_INSPECT_DATA_DIR=/pfad` für einen anderen Ablageort des CPU-Protokolls.
+CPU-Protokoll, `--no-analyze` ohne *Analyze with Claude*, `CLAUDE_INSPECT_DATA_DIR=/pfad` für einen
+anderen Ablageort von CPU-Protokoll und Analysen.
 
 Aus den Quellen: `git clone …`, `npm install`, `npm run build`, `npm start`
 (`npm run dev` + `npm run dev:web` für die Entwicklung mit Hot-Reload).
@@ -73,6 +74,18 @@ Aus den Quellen: `git clone …`, `npm install`, `npm run build`, `npm start`
   Windows `%LOCALAPPDATA%\claude-inspect\cpu`), damit der Verlauf nach Sessionende abrufbar bleibt.
   Dateien älter als 30 Tage werden gelöscht. Gemessen wird nur, solange claude-inspect läuft;
   Prozesse, die kürzer als 3 s leben, fehlen. Abschalten mit `--no-cpu-log`.
+- **Analyze with Claude**: Knopf auf jeder Session. Im Pop-up wählt man, worauf geachtet wird
+  (Auftrag erfüllt, Effizienz & Kosten, Fehler & Umwege, Datenschutz, Sicherheit & riskante
+  Aktionen, Agenten & Delegation, Setup-Verbesserungen), dazu optional eine eigene Frage, Modell
+  und Antwortsprache. claude-inspect baut einen kompakten Bericht über die Session samt Subagenten
+  und gestarteten Sitzungen (Anfragen, Antworten, jeder Tool-Aufruf mit Status, Dauer und Kosten,
+  dazu automatische Befunde wie wiederholte Fehler, mehrfach gelesene Dateien, Zugriffe auf
+  sensible Dateien, Uploads, riskante Befehle), maskiert Geheimnisse und lässt ihn vom lokalen
+  `claude -p` auswerten – ohne Tools, MCP-Server und Einstellungen, nicht als Session gespeichert.
+  Die Antwort erscheint live im Tab *Analysis* und wird im Datenverzeichnis (`reviews/`) abgelegt.
+  Läuft über die eigene Claude-Code-Anmeldung und zählt zum Abo-Verbrauch; *View what is sent*
+  zeigt den genauen Bericht. Das ist die einzige Funktion, die Daten verschickt, und nur auf Klick.
+  `--no-analyze` blendet den Knopf aus.
 - **Abo-Budget**: Kosten als geschätzter Anteil am Wochenlimit und am 5-Stunden-Fenster des Tarifs
   (Max 20x, Max 5x, Pro). Der Tarif wird aus `~/.claude.json` erkannt (gelesen wird nur das
   Rate-Limit-Tier) und lässt sich im Browser umstellen. Anthropic nennt keine Dollar- oder
@@ -121,7 +134,13 @@ Neue Dateiformate: siehe [docs/FORMATS.md](https://github.com/brokoskokoli/claud
 
 ## Speicher & Leistung
 
-Außer dem CPU-Log im eigenen Datenverzeichnis wird nichts auf Platte geschrieben. Beim Start liest der Server nur Prozess-, Job- und
+Außer CPU-Log und Analysen im eigenen Datenverzeichnis wird nichts auf Platte geschrieben. Beim Start liest der Server nur Prozess-, Job- und
 Kopfdaten (unter 1 s); die komplette History (hier ~600 MB) wird im Hintergrund in
 2–3 s aggregiert und danach nur noch inkrementell nachgeführt. Vollständige Verläufe
 werden erst beim Öffnen geladen und mit einer Obergrenze im Speicher gehalten.
+
+Solange ein Dashboard-Tab sichtbar ist, aktualisiert sich alles live (CPU alle 3 s). Ist kein Tab
+sichtbar (geschlossen oder 15 s im Hintergrund), wechselt der Server in einen Sparbetrieb:
+Prozessliste alle 30 s, CPU alle 15 s, alles andere alle 2 Minuten – etwa 1 % eines Kerns
+(gemessen mit ~1.600 Transcripts und mehreren laufenden Agenten). Beim Zurückwechseln wird sofort
+nachgeladen.

package/README.md

@@ -23,7 +23,8 @@ No Claude Code data at hand? `npx claude-inspect demo --open` starts it with a f
 Permanent install with autostart: see [Installation](#installation).
 
 It is **read-only and passive** towards `~/.claude`: no hooks, no settings changes, no proxy, no data leaves
-your machine. The only thing it writes is a CPU log in its own data directory (see *CPU usage*).
+your machine. The only things it writes go to its own data directory: a CPU log (see *CPU usage*) and the
+results of *Analyze with Claude* – the one feature that sends data, and only when you click it.
 
 > Website: [brokoskokoli.github.io/claude_inspect](https://brokoskokoli.github.io/claude_inspect/) · Deutsch: [README.de.md](https://github.com/brokoskokoli/claude_inspect/blob/main/README.de.md) · Design notes (German): [KONZEPT.md](https://github.com/brokoskokoli/claude_inspect/blob/main/KONZEPT.md) · [Contributing](https://github.com/brokoskokoli/claude_inspect/blob/main/CONTRIBUTING.md)
 
@@ -52,6 +53,7 @@ becomes hard to tell *who is doing what*. claude-inspect answers:
 | **Spawn linking** | Links sessions started by `claude -p …` to the calling tool use via the process tree (exact), `--session-id`, prompt text, `--agent`, time window and working directory – with a confidence label. |
 | **Cost per agent tree** | Cost tab per session: API list-price estimate for the main agent plus all its subagents and spawned `claude` sessions, per agent and per model with input, output and cache tokens, plus a cost timeline with the most expensive moments. |
 | **Plan budget** | Cost as an estimated share of your plan's weekly limit and 5-hour window (Max 20x, Max 5x, Pro). The plan is detected from `~/.claude.json` (only the rate-limit tier is read) and can be changed in the browser. Anthropic publishes no dollar or token limits; the values are calibrated from real `/usage` readings against the API equivalent spent in the same time – to recalibrate with your own data (e.g. including a server's copy of `~/.claude`), see [Calibrating the plan budgets](https://github.com/brokoskokoli/claude_inspect/blob/main/CONTRIBUTING.md#calibrating-the-plan-budgets). Max 5x/20x are measured, Pro is extrapolated. |
+| **Analyze with Claude** | Button on every session: pick what to check – task outcome, efficiency & cost, errors & dead ends, privacy & data protection, security & risky actions, agents & delegation, setup improvements – plus an optional own question, model and answer language. claude-inspect builds a condensed digest of the session and all its subagents and spawned sessions (requests, answers, every tool call with status, duration and cost, plus computed observations such as repeated failures, repeated reads, access to sensitive files, uploads and risky commands), masks secrets, and runs your local `claude -p` on it – no tools, no MCP servers, no settings, not saved as a session. The answer streams into the *Analysis* tab and is stored in the data directory (`reviews/`). It runs on your own Claude Code login and counts towards your plan usage; *View what is sent* shows the exact digest. `--no-analyze` removes the button. |
 | **Statistics** | API list-price estimate, tokens per model/day/project, cache share, activity heatmap, tool statistics with error rate and p95 duration. |
 | **CPU usage** | CPU of each Claude Code process plus all its subprocesses (shells, builds, test runners, MCP servers …), measured every 3 s from the process table. Sparkline on the dashboard card, a *CPU* tab per session with a stacked chart by process name and the processes that used the most CPU time. Recorded as one CSV per session in the app data directory (`~/Library/Application Support/claude-inspect/cpu` on macOS, `~/.local/share/claude-inspect/cpu` on Linux, `%LOCALAPPDATA%\claude-inspect\cpu` on Windows), so it stays available after the session ended; files older than 30 days are deleted. Only measured while claude-inspect runs; processes that live less than 3 s are missed. `--no-cpu-log` turns recording off. |
 | **Tool explorer & files** | Every tool call across all sessions, filterable; which files agents read, edited or wrote. |
@@ -106,7 +108,7 @@ After `npm install -g claude-inspect@latest`, run `claude-inspect service instal
 Started manually, `claude-inspect` prints a URL with a random access token (`?t=…`) that the browser
 keeps as a cookie. Use `--token <t>` for a fixed token or `--no-auth` for none, `--port` for another port,
 `CLAUDE_CONFIG_DIR=/path/to/.claude` for another data directory, `--no-cpu-log` to not record CPU usage,
-`CLAUDE_INSPECT_DATA_DIR=/path` for another place for the CPU log. `claude-inspect --help` lists everything.
+`--no-analyze` to hide *Analyze with Claude*, `CLAUDE_INSPECT_DATA_DIR=/path` for another place for the CPU log and analyses. `claude-inspect --help` lists everything.
 
 ### Try it without your own data
 
@@ -143,6 +145,7 @@ FormatRegistry → versioned decoders → normalized model → REST + SSE → Sv
 
 - **Per-record format detection:** every decoder scores a record (`type`, version range, structure); the best one wins, a fallback keeps unknown records. Adding support for a new Claude Code version = adding a decoder file. See [docs/FORMATS.md](https://github.com/brokoskokoli/claude_inspect/blob/main/docs/FORMATS.md).
 - **In memory only:** startup reads process/job data and file heads (< 1 s); the full history (hundreds of MB) is aggregated in the background in a few seconds and then followed incrementally.
+- **Light in the background:** while a dashboard tab is visible, it updates live (CPU every 3 s). With no visible tab (closed or in the background for 15 s) it switches to a saving mode – process list every 30 s, CPU every 15 s, everything else every 2 minutes – and uses about 1 % of one core (measured with ~1,600 transcripts and several agents running). Switching back to the tab catches up immediately.
 - **Privacy & security:** listens on `127.0.0.1` only (never reachable from the network), rejects requests whose `Host` header isn't `localhost`/`127.0.0.1` (DNS rebinding), sends no CORS headers (other websites in your browser can't read the API), is read-only towards `~/.claude` (the CPU log goes to its own data directory and contains only timestamps, PIDs, program names and CPU percentages – no command lines), never reads credential files (`*.key`, `daemon/auth`, `ide/*.lock`, …) and masks token/secret fields in the raw view. The access token is an extra layer against *other local processes or users* on the same machine; on a single-user machine `--no-auth` (used by the autostart service) is a reasonable trade-off. Cost figures are estimates from public API list prices – with a subscription you do not pay these amounts directly.
 
 ## Development

package/dist/app/server/cli/demo.js

@@ -360,6 +360,8 @@ export async function runDemo(opts) {
     sessionFile(docsProc.pid, { sessionId: s.docsId, cwd: s.DOCS, startedAt: s.docs.o.start, kind: 'interactive', entrypoint: 'cli', name: 'docs', nameSource: 'user', status: 'idle' });
     console.log(`Demo data in ${ROOT}`);
     // config.ts reads CLAUDE_CONFIG_DIR on import – set it before loading the server
+    // "Analyze with Claude" starts the real claude – it needs the user's own config dir (login)
+    process.env.CLAUDE_INSPECT_CLAUDE_CONFIG_DIR = process.env.CLAUDE_CONFIG_DIR ?? '';
     process.env.CLAUDE_CONFIG_DIR = ROOT;
     process.env.CLAUDE_INSPECT_DATA_DIR = `${ROOT}-data`;
     demoCpu(`${ROOT}-data`, s);

package/dist/app/server/cli.js

@@ -12,6 +12,10 @@ import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
+import v8 from 'node:v8';
+// Läuft dauerhaft im Hintergrund: kleiner Heap statt Höchsttempo. Gemessen mit ~1.600 Transcripts
+// 140 statt 700 MB Speicher, der erste Scan dauert dafür ~20 % länger. Keine harte Grenze.
+v8.setFlagsFromString('--optimize-for-size');
 const env = process.env;
 function version() {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -41,12 +45,14 @@ Options:
   --token <t>      fixed access token instead of a random one      env: CLAUDE_INSPECT_TOKEN
   --no-auth        no token (still only reachable from localhost)  env: CLAUDE_INSPECT_NO_AUTH=1
   --no-cpu-log     don't record CPU usage to the data directory     env: CLAUDE_INSPECT_NO_CPU_LOG=1
+  --no-analyze     hide "Analyze with Claude" (never runs claude)   env: CLAUDE_INSPECT_NO_ANALYZE=1
   --out <dir>      demo: only write the demo data to <dir>
   -v, --version    print the version
   -h, --help       show this help
 
 Data directory: $CLAUDE_CONFIG_DIR or ~/.claude (read only)
-CPU log:        $CLAUDE_INSPECT_DATA_DIR/cpu (default: the platform's app data directory)`;
+CPU log:        $CLAUDE_INSPECT_DATA_DIR/cpu (default: the platform's app data directory)
+Analyses:       $CLAUDE_INSPECT_DATA_DIR/reviews`;
 const { values, positionals } = parseArgs({
     allowPositionals: true,
     options: {
@@ -56,6 +62,7 @@ const { values, positionals } = parseArgs({
         token: { type: 'string', default: env.CLAUDE_INSPECT_TOKEN },
         'no-auth': { type: 'boolean', default: env.CLAUDE_INSPECT_NO_AUTH === '1' },
         'no-cpu-log': { type: 'boolean', default: env.CLAUDE_INSPECT_NO_CPU_LOG === '1' },
+        'no-analyze': { type: 'boolean', default: env.CLAUDE_INSPECT_NO_ANALYZE === '1' },
         out: { type: 'string' },
         help: { type: 'boolean', short: 'h', default: false },
         version: { type: 'boolean', short: 'v', default: false },
@@ -79,7 +86,7 @@ else if (cmd === 'demo') {
 }
 else if (cmd === undefined) {
     const { runServer } = await import('./run.js');
-    await runServer({ port: port(7717), open: values.open, dev: values.dev, noAuth: values['no-auth'], token: values.token, noCpuLog: values['no-cpu-log'] });
+    await runServer({ port: port(7717), open: values.open, dev: values.dev, noAuth: values['no-auth'], token: values.token, noCpuLog: values['no-cpu-log'], noAnalyze: values['no-analyze'] });
 }
 else {
     console.error(`Unknown command "${cmd}".\n\n${HELP}`);

package/dist/app/server/cpu-monitor.js

@@ -14,13 +14,20 @@ const MIN_PCT = 1;
 const IDLE_WRITE_MS = 30_000;
 /** Dateien, die so lange nicht mehr geschrieben wurden, werden gelöscht (wie Claude Codes eigene Aufräumfrist). */
 const RETENTION_MS = 30 * 24 * 3600_000;
+/**
+ * Messabstand im Sparbetrieb (kein Tab offen). Gemessen wird verbrauchte CPU-Zeit, längere
+ * Abstände liefern also korrekte Mittelwerte – nur gröber. Spart vor allem die ps-Aufrufe.
+ */
+const IDLE_INTERVAL_MS = 15_000;
 /**
  * Misst in festen Abständen die CPU-Auslastung jedes Claude-Prozesses samt Unterprozessen.
  * Liest die Prozesstabelle (ps bzw. /proc), schreibt nur ins eigene Datenverzeichnis.
  */
 export class CpuMonitor {
     opts;
+    /** Messabstand bei offenem Tab */
     intervalMs = process.platform === 'win32' ? 10_000 : 3_000;
+    currentMs = Math.max(IDLE_INTERVAL_MS, this.intervalMs);
     dir = join(DATA_DIR, 'cpu');
     cores = availableParallelism();
     prev;
@@ -40,13 +47,26 @@ export class CpuMonitor {
     }
     start() {
         void this.tick();
-        this.timer = setInterval(() => void this.tick(), this.intervalMs);
+        this.timer = setInterval(() => void this.tick(), this.currentMs);
         if (this.opts.log) {
             void this.cleanup();
             this.cleanupTimer = setInterval(() => void this.cleanup(), 6 * 3600_000);
             this.cleanupTimer.unref();
         }
     }
+    /** Sparbetrieb ein/aus (kein Tab offen → seltener messen) */
+    setIdle(idle) {
+        const ms = idle ? Math.max(IDLE_INTERVAL_MS, this.intervalMs) : this.intervalMs;
+        if (ms === this.currentMs)
+            return;
+        this.currentMs = ms;
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        if (!idle)
+            void this.tick();
+        this.timer = setInterval(() => void this.tick(), ms);
+    }
     stop() {
         clearInterval(this.timer);
         clearInterval(this.cleanupTimer);
@@ -137,7 +157,7 @@ export class CpuMonitor {
                 continue;
             sessions[id] = { pct: sampleTotal(last), spark: b.samples.slice(-SPARK_POINTS).map(sampleTotal) };
         }
-        return { t: this.lastT, intervalMs: this.intervalMs, cores: this.cores, sessions };
+        return { t: this.lastT, intervalMs: this.currentMs, cores: this.cores, sessions };
     }
     async history(sessionId) {
         let samples = [];
@@ -153,7 +173,7 @@ export class CpuMonitor {
         // Messungen, die (noch) nicht in der Datei stehen, aus dem Speicher ergänzen
         const lastT = samples[samples.length - 1]?.t ?? 0;
         samples.push(...(this.buffers.get(sessionId)?.samples.filter((s) => s.t > lastT) ?? []));
-        const h = cpuHistory(samples, { intervalMs: this.intervalMs, gapMs: IDLE_WRITE_MS + 5 * this.intervalMs });
+        const h = cpuHistory(samples, { intervalMs: this.intervalMs, gapMs: IDLE_WRITE_MS + 5 * this.intervalMs, maxStepMs: 2 * IDLE_INTERVAL_MS });
         return { sessionId, logging: this.opts.log, file: samples.length ? file : undefined, cores: this.cores, ...h };
     }
 }

package/dist/app/server/history/aggregator.js

@@ -5,6 +5,22 @@ import { toolSummary } from '../../shared/tools.js';
 import { registry } from '../formats/index.js';
 import { subagentDir } from '../sources/subagents.js';
 import { JsonlTail } from '../util/jsonl.js';
+/** Wiederkehrende Texte (Modell- und Tool-Namen) nur einmal im Speicher halten. */
+const interned = new Map();
+function intern(s) {
+    let v = interned.get(s);
+    if (v === undefined)
+        interned.set(s, (v = s));
+    return v;
+}
+/**
+ * Eigene Kopie eines gekürzten Strings. V8 legt Teilstrings als Verweis auf den Ausgangstext an –
+ * eine 200-Zeichen-Zusammenfassung hielte sonst den kompletten (evtl. mehrere KB großen) Befehl fest.
+ */
+function own(s) {
+    return s.length < 13 ? s : Buffer.from(s, 'utf8').toString('utf8');
+}
+const CHUNK_BYTES = 2 * 1024 * 1024;
 const FILE_TOOLS = {
     Read: 'reads',
     Edit: 'edits',
@@ -32,18 +48,22 @@ export class HistoryIndex {
      */
     async refresh(transcripts, projectOf, full) {
         const seen = new Set();
+        // Sessions ohne Änderung in der letzten Stunde: Subagenten nicht neu einlesen, nur behalten
+        const untouched = new Set();
         for (const f of transcripts) {
             const project = await projectOf(f);
             seen.add(f.path);
             await this.scan(f.path, f.size, f.sessionId, undefined, project);
             if (!full && Date.now() - f.mtime > 3600_000) {
-                for (const p of this.files.keys())
-                    if (p.startsWith(subagentDir(f.path)))
-                        seen.add(p);
+                untouched.add(f.sessionId);
                 continue;
             }
             await this.scanSubagents(f, project, seen);
         }
+        // ein Durchgang statt Sessions × Dateien (war bei ~1.500 Sessions der größte CPU-Verbraucher)
+        for (const [p, a] of this.files)
+            if (a.agentId && untouched.has(a.sessionId))
+                seen.add(p);
         // Von Claude Code aufgeräumte Dateien vergessen
         for (const p of [...this.files.keys()])
             if (!seen.has(p))
@@ -106,19 +126,22 @@ export class HistoryIndex {
         }
         agg.size = size;
         agg.project = project;
-        let lines;
-        try {
-            ({ lines } = await agg.tail.readNew());
-        }
-        catch {
-            return;
-        }
-        for (const l of lines) {
-            if (l.value === undefined)
-                continue;
-            const { out } = registry.decode('transcript', l.value, path, l.line, { silent: true });
-            for (const e of out)
-                this.fold(agg, e);
+        // in Stücken lesen: große Transcripts (50–100 MB) nicht komplett geparst im Speicher halten
+        for (let more = true; more;) {
+            let lines;
+            try {
+                ({ lines, more } = await agg.tail.readNew(undefined, CHUNK_BYTES));
+            }
+            catch {
+                return;
+            }
+            for (const l of lines) {
+                if (l.value === undefined)
+                    continue;
+                const { out } = registry.decode('transcript', l.value, path, l.line, { silent: true });
+                for (const e of out)
+                    this.fold(agg, e);
+            }
         }
     }
     fold(agg, e) {
@@ -140,8 +163,8 @@ export class HistoryIndex {
                     agentId: agg.agentId,
                     project: agg.project,
                     toolUseId: e.toolUseId,
-                    name: e.name,
-                    summary: toolSummary(e.name, e.input).slice(0, 200),
+                    name: intern(e.name),
+                    summary: own(toolSummary(e.name, e.input).slice(0, 200)),
                     ts: Number.isNaN(ts) ? 0 : ts,
                     file,
                 });
@@ -164,7 +187,9 @@ export class HistoryIndex {
                 break;
         }
         if ((e.kind === 'assistant-text' || e.kind === 'thinking' || e.kind === 'tool-use') && e.usage && e.messageId && e.model && e.model !== '<synthetic>') {
-            agg.usage.set(e.messageId, { model: e.model, ts: Number.isNaN(ts) ? 0 : ts, usage: e.usage });
+            const tokens = emptyTotals();
+            addUsage(tokens, e.usage);
+            agg.usage.set(e.messageId, { model: intern(e.model), ts: Number.isNaN(ts) ? 0 : ts, tokens });
         }
     }
     // ---------------------------------------------------------------------------
@@ -205,8 +230,7 @@ export class HistoryIndex {
             for (const u of a.usage.values()) {
                 if (u.ts < since)
                     continue;
-                const one = emptyTotals();
-                addUsage(one, u.usage);
+                const one = u.tokens;
                 let m = byModel.get(u.model);
                 if (!m)
                     byModel.set(u.model, (m = emptyTotals()));
@@ -303,12 +327,9 @@ export class HistoryIndex {
                 let t = out.get(u.model);
                 if (!t)
                     out.set(u.model, (t = emptyTotals()));
-                addUsage(t, u.usage);
-                if (each) {
-                    const one = emptyTotals();
-                    addUsage(one, u.usage);
-                    each(u.model, u.ts, one);
-                }
+                mergeTotals(t, u.tokens);
+                if (each)
+                    each(u.model, u.ts, { ...u.tokens });
             }
         }
         return out;

package/dist/app/server/history/search.js

@@ -1,8 +1,11 @@
 import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { toolSummary } from '../../shared/tools.js';
 import { paths } from '../config.js';
 import { registry } from '../formats/index.js';
 import { pathTail } from '../sources/projects.js';
+const home = homedir();
+const tildify = (p) => (home && p.startsWith(home) ? '~' + p.slice(home.length) : p);
 function snippet(text, needle, radius = 90) {
     const i = text.toLowerCase().indexOf(needle);
     if (i < 0)
@@ -33,7 +36,7 @@ function searchable(e) {
  * nach dem Suchbegriff durchsucht, nur Trefferzeilen werden dekodiert.
  * Neueste Dateien zuerst; bricht bei `limit` Treffern oder nach `budgetMs` ab.
  */
-export async function search(query, files, knownSessions, limit = 200, budgetMs = 6000, perFile = 5) {
+export async function search(query, files, knownSessions, limit = 200, budgetMs = 15_000, perFile = 5) {
     const t0 = Date.now();
     const needle = query.trim().toLowerCase();
     const hits = [];
@@ -41,6 +44,16 @@ export async function search(query, files, knownSessions, limit = 200, budgetMs
     let truncated = false;
     if (needle.length < 2)
         return { query, hits, scannedFiles: 0, totalFiles: files.length, truncated, ms: 0 };
+    // Dateinamen und Pfade der Transcripts (z. B. "agent-a1b2….jsonl", Session-Id, Pfadteile)
+    const pathNeedle = (needle.startsWith('~') && home ? home.toLowerCase() + needle.slice(1) : needle).replace(/\\/g, '/');
+    for (const f of files) {
+        const p = f.path.replace(/\\/g, '/');
+        if (!p.toLowerCase().includes(pathNeedle))
+            continue;
+        hits.push({ sessionId: f.sessionId, agentId: f.agentId, project: f.project, title: f.title, line: 0, kind: 'file', snippet: tildify(f.path) });
+        if (hits.length >= 50)
+            break;
+    }
     outer: for (const f of files) {
         if (Date.now() - t0 > budgetMs) {
             truncated = true;

package/dist/app/server/http.js

@@ -66,6 +66,43 @@ export function startServer(inspector, opts) {
         res.writeHead(200, { 'content-type': MIME[extname(file)] ?? 'application/octet-stream' });
         createReadStream(file).pipe(res);
     }
+    /**
+     * Die einzigen schreibenden Aufrufe: Analyse starten/abbrechen. Nur mit JSON-Body (erzwingt bei
+     * fremden Seiten einen CORS-Preflight, den der Server nie erlaubt) und lokalem Origin.
+     */
+    async function post(req, res, p) {
+        const origin = req.headers.origin;
+        if (origin && !/^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(origin))
+            return json(res, 403, { error: 'origin not allowed' });
+        if (!(req.headers['content-type'] ?? '').startsWith('application/json'))
+            return json(res, 415, { error: 'JSON expected' });
+        let raw = '';
+        for await (const c of req) {
+            raw += c;
+            if (raw.length > 100_000)
+                return json(res, 413, { error: 'too large' });
+        }
+        let body;
+        try {
+            body = JSON.parse(raw || '{}');
+        }
+        catch {
+            return json(res, 400, { error: 'invalid JSON' });
+        }
+        let m = /^\/api\/review\/([\w-]+)$/.exec(p);
+        if (m) {
+            try {
+                return json(res, 200, await inspector.startReview(m[1], body));
+            }
+            catch (e) {
+                return json(res, 400, { error: e.message });
+            }
+        }
+        m = /^\/api\/review-cancel\/([\w-]+)$/.exec(p);
+        if (m)
+            return json(res, 200, { cancelled: inspector.reviewer?.cancel(m[1]) ?? false });
+        return json(res, 405, { error: 'read-only' });
+    }
     const server = createServer(async (req, res) => {
         try {
             const url = new URL(req.url ?? '/', 'http://localhost');
@@ -81,6 +118,8 @@ export function startServer(inspector, opts) {
                 res.setHeader('set-cookie', `${COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=31536000`);
             }
             const p = url.pathname;
+            if (req.method === 'POST')
+                return await post(req, res, p);
             if (req.method !== 'GET')
                 return json(res, 405, { error: 'read-only' });
             if (p === '/api/dashboard')
@@ -90,7 +129,11 @@ export function startServer(inspector, opts) {
                 res.write(`event: dashboard\ndata: ${JSON.stringify(await inspector.getDashboard())}\n\n`);
                 res.write(`event: cpu\ndata: ${JSON.stringify(inspector.cpuSnapshot())}\n\n`);
                 sseClients.add(res);
-                req.on('close', () => sseClients.delete(res));
+                inspector.setViewers(sseClients.size);
+                req.on('close', () => {
+                    sseClients.delete(res);
+                    inspector.setViewers(sseClients.size);
+                });
                 return;
             }
             if (p === '/api/sessions') {
@@ -160,6 +203,19 @@ export function startServer(inspector, opts) {
                 const cost = await inspector.sessionCost(m[1]);
                 return cost ? json(res, 200, cost) : json(res, 404, { error: 'unknown session' });
             }
+            m = /^\/api\/review\/([\w-]+)$/.exec(p);
+            if (m) {
+                const st = await inspector.reviewState(m[1]);
+                return st ? json(res, 200, st) : json(res, 404, { error: 'unknown session' });
+            }
+            m = /^\/api\/review\/([\w-]+)\/digest$/.exec(p);
+            if (m) {
+                const d = await inspector.reviewDigest(m[1]);
+                if (!d)
+                    return json(res, 404, { error: 'unknown session' });
+                res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' });
+                return res.end(d.text);
+            }
             m = /^\/api\/flow\/([\w-]+)$/.exec(p);
             if (m) {
                 const flow = await inspector.flow(m[1]);