claude-rpc 0.3.10 → 0.5.0

package/src/privacy.js

@@ -0,0 +1,231 @@
+// Privacy mode — controls what the Discord card shows about a given cwd.
+// Three layers, highest-priority first:
+//
+//   1. Per-project ./.claude-rpc.json file in the project root.
+//      { "visibility": "hidden|name-only|public", "projectName": "alias" }
+//      Shortcut: { "private": true } == { "visibility": "hidden" }
+//   2. Runtime list at ~/.claude-rpc/private-list.json, toggled by
+//      `claude-rpc private` / `claude-rpc public`.
+//   3. Auto-detection of GitHub private repos via the `gh` CLI when
+//      installed. Best-effort, silently skips when gh isn't available
+//      or auth isn't set up. Cached per-cwd with 5min TTL.
+//
+// "Visibility" levels:
+//   public      everything as-is (default)
+//   name-only   project name kept, but currentFile / currentTool / files
+//               arrays cleared so the card doesn't leak paths
+//   hidden      cwd cleared entirely; daemon then short-circuits to
+//               clearActivity (same effect as hideWhenStale)
+//
+// Aggregates (scanner) and the local TUI/web dashboards are NEVER affected
+// by these flags. Privacy is a one-way valve from local state → Discord.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join, basename, dirname, resolve as resolvePath } from 'node:path';
+import { DATA_DIR } from './paths.js';
+
+const PRIVATE_LIST_PATH = join(DATA_DIR, 'private-list.json');
+const TTL_MS = 5 * 60 * 1000;
+
+const projectFileCache = new Map();   // cwd → { ts, value | null }
+const ghPrivateCache  = new Map();    // cwd → { ts, value: bool | null }
+
+// ── Per-project .claude-rpc.json ────────────────────────────────────────
+
+// Walk up from `cwd` looking for a .claude-rpc.json. Stops at the first
+// match or at a .git directory (the project root). Lets a subdirectory
+// inherit the parent's privacy config.
+function findProjectFile(cwd) {
+  if (!cwd) return null;
+  let dir = cwd;
+  while (true) {
+    const candidate = join(dir, '.claude-rpc.json');
+    if (existsSync(candidate)) return candidate;
+    if (existsSync(join(dir, '.git'))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function readProjectConfig(cwd) {
+  if (!cwd) return null;
+  const cached = projectFileCache.get(cwd);
+  if (cached && Date.now() - cached.ts < TTL_MS) return cached.value;
+  let value = null;
+  const path = findProjectFile(cwd);
+  if (path) {
+    try {
+      const parsed = JSON.parse(readFileSync(path, 'utf8'));
+      if (parsed && typeof parsed === 'object') value = parsed;
+    } catch { /* broken JSON ≡ no override */ }
+  }
+  projectFileCache.set(cwd, { ts: Date.now(), value });
+  return value;
+}
+
+function normalizeProjectConfig(cfg) {
+  if (!cfg) return null;
+  let visibility = cfg.visibility;
+  if (cfg.private === true && !visibility) visibility = 'hidden';
+  if (!['public', 'name-only', 'hidden'].includes(visibility)) visibility = null;
+  return {
+    visibility,
+    projectName: typeof cfg.projectName === 'string' ? cfg.projectName : null,
+  };
+}
+
+// ── Runtime private-list ────────────────────────────────────────────────
+
+function readPrivateList() {
+  if (!existsSync(PRIVATE_LIST_PATH)) return { paths: [] };
+  try {
+    const v = JSON.parse(readFileSync(PRIVATE_LIST_PATH, 'utf8'));
+    if (Array.isArray(v?.paths)) return v;
+  } catch {}
+  return { paths: [] };
+}
+
+function writePrivateList(list) {
+  if (!existsSync(DATA_DIR)) mkdirSync(DATA_DIR, { recursive: true });
+  writeFileSync(PRIVATE_LIST_PATH, JSON.stringify(list, null, 2));
+}
+
+export function addPrivateCwd(cwd) {
+  const list = readPrivateList();
+  const abs = resolvePath(cwd);
+  if (!list.paths.includes(abs)) {
+    list.paths.push(abs);
+    writePrivateList(list);
+  }
+  return list.paths;
+}
+
+export function removePrivateCwd(cwd) {
+  const list = readPrivateList();
+  const abs = resolvePath(cwd);
+  list.paths = list.paths.filter((p) => p !== abs);
+  writePrivateList(list);
+  return list.paths;
+}
+
+export function listPrivateCwds() {
+  return readPrivateList().paths;
+}
+
+function isInPrivateList(cwd) {
+  if (!cwd) return false;
+  const abs = resolvePath(cwd);
+  return readPrivateList().paths.some(
+    (p) => abs === p || abs.startsWith(p + '/') || abs.startsWith(p + '\\')
+  );
+}
+
+// ── GitHub-private detection (best-effort, gh CLI) ──────────────────────
+
+function detectGithubPrivate(cwd) {
+  if (!cwd) return null;
+  const cached = ghPrivateCache.get(cwd);
+  if (cached && Date.now() - cached.ts < TTL_MS) return cached.value;
+  let value = null;
+  try {
+    const out = execFileSync(
+      'gh',
+      ['repo', 'view', '--json', 'isPrivate', '-q', '.isPrivate'],
+      { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500 }
+    ).toString().trim();
+    if (out === 'true') value = true;
+    else if (out === 'false') value = false;
+  } catch { /* gh missing, not auth'd, not a repo, timeout — unknown */ }
+  ghPrivateCache.set(cwd, { ts: Date.now(), value });
+  return value;
+}
+
+// ── Resolution + application ────────────────────────────────────────────
+
+// Resolve effective visibility for a cwd.
+// Returns: { visibility, projectName, reason }
+export function resolveVisibility(cwd, config = {}) {
+  const proj = normalizeProjectConfig(readProjectConfig(cwd));
+  if (proj?.visibility) {
+    return { visibility: proj.visibility, projectName: proj.projectName, reason: '.claude-rpc.json' };
+  }
+  if (isInPrivateList(cwd)) {
+    return { visibility: 'hidden', projectName: proj?.projectName ?? null, reason: 'private-list' };
+  }
+  const patterns = config?.privacy?.patterns || [];
+  if (patterns.length && cwd) {
+    const leaf = basename(cwd);
+    for (const p of patterns) {
+      if (matchesPattern(leaf, p)) {
+        const mode = config?.privacy?.mode || 'hidden';
+        return { visibility: mode, projectName: proj?.projectName ?? null, reason: `config pattern '${p}'` };
+      }
+    }
+  }
+  if (config?.privacy?.autoDetectGithubPrivate !== false) {
+    const isPrivate = detectGithubPrivate(cwd);
+    if (isPrivate === true) {
+      const mode = config?.privacy?.githubPrivateMode || 'hidden';
+      return { visibility: mode, projectName: proj?.projectName ?? null, reason: 'github private repo' };
+    }
+  }
+  return { visibility: 'public', projectName: proj?.projectName ?? null, reason: 'default' };
+}
+
+// Glob-lite. '*' matches any run; otherwise plain text. Case-insensitive.
+function matchesPattern(name, pattern) {
+  if (pattern === name) return true;
+  if (!pattern.includes('*')) return false;
+  const re = new RegExp('^' + pattern.split('*').map(escapeRe).join('.*') + '$', 'i');
+  return re.test(name);
+}
+function escapeRe(s) { return s.replace(/[.+?^${}()|[\]\\]/g, '\\$&'); }
+
+// Apply privacy to a post-applyIdle state. Pure function — no IO.
+export function applyPrivacy(state, config = {}) {
+  if (!state || state.status === 'stale') return state;
+  const { visibility, projectName } = resolveVisibility(state.cwd || '', config);
+
+  if (visibility === 'public') {
+    if (projectName) {
+      return { ...state, cwd: joinCwdAlias(state.cwd, projectName), _privacy: { visibility, alias: true } };
+    }
+    return state;
+  }
+
+  if (visibility === 'name-only') {
+    return {
+      ...state,
+      cwd: projectName ? joinCwdAlias(state.cwd, projectName) : state.cwd,
+      currentTool: null,
+      currentFile: null,
+      filesEdited: [],
+      filesRead: [],
+      filesOpened: [],
+      _privacy: { visibility, alias: !!projectName },
+    };
+  }
+
+  // hidden
+  return {
+    ...state,
+    cwd: '',
+    currentTool: null,
+    currentFile: null,
+    filesEdited: [],
+    filesRead: [],
+    filesOpened: [],
+    _privacy: { visibility, alias: false },
+  };
+}
+
+function joinCwdAlias(cwd, alias) {
+  if (!cwd) return alias;
+  const sep = cwd.includes('\\') ? '\\' : '/';
+  const parts = cwd.split(/[\\/]/).filter(Boolean);
+  if (!parts.length) return alias;
+  parts[parts.length - 1] = alias;
+  return (cwd.startsWith('/') ? '/' : '') + parts.join(sep);
+}

package/src/scanner.js

@@ -1,5 +1,6 @@
 import { readdirSync, readFileSync, statSync, existsSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
 import { join, dirname, basename } from 'node:path';
+import { homedir } from 'node:os';
 import { CLAUDE_PROJECTS, SCAN_CACHE_PATH, AGGREGATE_PATH, DATA_DIR, EVENTS_LOG_PATH } from './paths.js';
 import { languageOf } from './languages.js';
 import { costFor, pricingKeyFor } from './pricing.js';
@@ -327,6 +328,18 @@ function listTranscripts(projectsDir) {
   return results;
 }
 
+// Walk multiple project roots in one pass. Used by scan() to support
+// `additionalProjectsDirs` config + the `claude-rpc backfill <path>` command
+// for ad-hoc imports. Deduplicates by absolute path so overlapping roots
+// don't double-count.
+function listAllTranscripts(dirs) {
+  const all = new Set();
+  for (const d of dirs) {
+    for (const fp of listTranscripts(d)) all.add(fp);
+  }
+  return Array.from(all);
+}
+
 function isSubagentPath(p) {
   return /[\\/]subagents[\\/]/.test(p);
 }
@@ -350,6 +363,47 @@ function readTranscriptCwd(path, mtimeMs) {
   return cwd;
 }
 
+// Per-transcript token cache. Reading a multi-MB .jsonl on every push tick
+// (4s) would be wasteful, so we only re-parse when the file's mtime has
+// advanced since the last read.
+const sessionTokenCache = new Map();  // path → { mtime, tokens }
+
+// Sum input/output/cache tokens from a single transcript JSONL.
+//
+// We need this because Claude Code's hook payloads don't carry usage data —
+// tokens are an assistant-message field, not a tool-call field, so PostToolUse
+// hooks fire with no `usage` block to capture. The live transcript is the
+// only source of truth for the current session's running token count.
+//
+// Returns null when the file can't be read; { input, output, cacheRead,
+// cacheWrite } otherwise. Cached by mtime — repeat calls with no file
+// activity are O(1).
+export function readSessionTokens(path) {
+  let st;
+  try { st = statSync(path); } catch { return null; }
+  const cached = sessionTokenCache.get(path);
+  if (cached && cached.mtime === st.mtimeMs) return cached.tokens;
+
+  const tokens = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+  try {
+    const raw = readFileSync(path, 'utf8');
+    for (const line of raw.split('\n')) {
+      if (!line) continue;
+      const r = safeJson(line);
+      if (!r || r.type !== 'assistant') continue;
+      const u = r.message?.usage;
+      if (!u) continue;
+      tokens.input      += u.input_tokens || 0;
+      tokens.output     += u.output_tokens || 0;
+      tokens.cacheRead  += u.cache_read_input_tokens || 0;
+      tokens.cacheWrite += u.cache_creation_input_tokens || 0;
+    }
+  } catch { return null; }
+
+  sessionTokenCache.set(path, { mtime: st.mtimeMs, tokens });
+  return tokens;
+}
+
 // Detect live sessions by transcript mtime. Returns array of { path, project, cwd, mtime, ageSec }.
 // A session is "live" if its .jsonl was modified within thresholdMs.
 export function findLiveSessions({ projectsDir = CLAUDE_PROJECTS, thresholdMs = 90_000 } = {}) {
@@ -681,12 +735,45 @@ function aggregateFrom(cache) {
   return agg;
 }
 
+// Known alternate locations Claude Code transcripts could live in besides
+// ~/.claude/projects. Returned filtered to those that actually exist. Most
+// installs only use the default; this is for older Claude Code versions,
+// XDG-strict setups, or restored backups.
+export function discoverAltProjectDirs() {
+  const home = homedir();
+  const candidates = [
+    join(home, '.config', 'claude', 'projects'),
+    join(home, '.local', 'share', 'claude', 'projects'),
+    join(home, 'AppData', 'Roaming', 'claude', 'projects'),
+    join(home, 'AppData', 'Local', 'claude', 'projects'),
+    join(home, 'Library', 'Application Support', 'claude', 'projects'),
+  ];
+  return candidates.filter((p) => existsSync(p) && p !== CLAUDE_PROJECTS);
+}
+
 // Incremental scan: re-parse only changed files. Returns {aggregate, scanned, skipped, removed}.
-export function scan({ projectsDir = CLAUDE_PROJECTS, onProgress, force = false } = {}) {
+//
+// Accepts either:
+//   { projectsDir: '/path' }       — single root (legacy)
+//   { projectsDirs: ['a', 'b'] }   — multi-root (backfill/import)
+// When neither is set, defaults to [CLAUDE_PROJECTS, ...discoverAltProjectDirs()].
+// Auto-discovery is cheap (existsSync per known location) so it runs every
+// scan — a freshly-restored backup at one of the alt paths gets picked up
+// without any user action.
+export function scan({ projectsDir, projectsDirs, onProgress, force = false, extraDirs = [] } = {}) {
+  const dirs = [];
+  if (projectsDirs && projectsDirs.length) dirs.push(...projectsDirs);
+  else if (projectsDir) dirs.push(projectsDir);
+  else {
+    dirs.push(CLAUDE_PROJECTS);
+    dirs.push(...discoverAltProjectDirs());
+  }
+  for (const d of extraDirs) if (!dirs.includes(d)) dirs.push(d);
+
   const cache = readCache();
   cache.files = cache.files || {};
   const seen = new Set();
-  const transcripts = listTranscripts(projectsDir);
+  const transcripts = listAllTranscripts(dirs);
   let scanned = 0;
   let skipped = 0;
   for (const fp of transcripts) {
@@ -709,13 +796,22 @@ export function scan({ projectsDir = CLAUDE_PROJECTS, onProgress, force = false
       // skip corrupt file but keep prior cache entry
     }
   }
-  // Remove cache entries for deleted transcripts
+  // Remove cache entries for transcripts that disappeared from disk. Only
+  // wipe entries whose root is one of the dirs we just scanned — otherwise
+  // a one-off backfill against a subset of dirs would nuke cache for
+  // unrelated paths.
   let removed = 0;
+  const sep = process.platform === 'win32' ? '\\' : '/';
+  const dirPrefixes = dirs.map((d) => d.replace(/[/\\]+$/, '') + sep);
   for (const key of Object.keys(cache.files)) {
-    if (!seen.has(key)) { delete cache.files[key]; removed += 1; }
+    if (seen.has(key)) continue;
+    if (dirPrefixes.some((p) => key.startsWith(p))) {
+      delete cache.files[key];
+      removed += 1;
+    }
   }
   writeCache(cache);
   const aggregate = aggregateFrom(cache);
   writeAggregate(aggregate);
-  return { aggregate, scanned, skipped, removed, total: transcripts.length };
+  return { aggregate, scanned, skipped, removed, total: transcripts.length, dirs };
 }

package/src/server/api.js

@@ -0,0 +1,172 @@
+// Data-shape helpers used by the dashboard's /api routes. Pure functions
+// over the aggregate + state files; no HTTP concerns. Tested separately
+// from the routing layer.
+
+import { readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import { readState } from '../state.js';
+import { buildVars, fillTemplate, applyIdle, framePasses } from '../format.js';
+import { readAggregate, findLiveSessions, dayKey } from '../scanner.js';
+import { CONFIG_PATH } from '../paths.js';
+
+export function loadConfig() {
+  try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf8')); } catch { return {}; }
+}
+
+export function rangeToDays(range) {
+  if (range === 'all') return Infinity;
+  if (range === '1y') return 365;
+  const n = parseInt(range, 10);
+  return Number.isFinite(n) && n > 0 ? n : 90;
+}
+
+// Filter byDay to a windowed slice; also recompute roll-ups (top files etc.)
+// scoped to that window. Returns a shape similar to the aggregate but trimmed.
+export function windowedAggregate(agg, range) {
+  if (!agg) return null;
+  const days = rangeToDays(range);
+  if (!Number.isFinite(days)) return agg; // 'all' → pass through
+
+  const today = new Date(); today.setHours(0, 0, 0, 0);
+  const keepKeys = new Set();
+  for (let i = 0; i < days; i++) {
+    const d = new Date(today); d.setDate(d.getDate() - i);
+    keepKeys.add(dayKey(d.getTime()));
+  }
+
+  const byDay = {};
+  let activeMs = 0, prompts = 0, toolCalls = 0, lines = 0, linesRem = 0, cost = 0, sessions = 0;
+  let inputTokens = 0, outputTokens = 0, cacheReadTokens = 0, cacheWriteTokens = 0;
+  for (const [k, day] of Object.entries(agg.byDay || {})) {
+    if (!keepKeys.has(k)) continue;
+    byDay[k] = day;
+    activeMs += day.activeMs || 0;
+    prompts += day.userMessages || 0;
+    toolCalls += day.toolCalls || 0;
+    lines += day.linesAdded || 0;
+    linesRem += day.linesRemoved || 0;
+    cost += day.cost || 0;
+    sessions += day.sessions || 0;
+    inputTokens += day.inputTokens || 0;
+    outputTokens += day.outputTokens || 0;
+    cacheReadTokens += day.cacheReadTokens || 0;
+    cacheWriteTokens += day.cacheWriteTokens || 0;
+  }
+
+  return {
+    range,
+    byDay,
+    activeMs,
+    userMessages: prompts,
+    toolCalls,
+    linesAdded: lines,
+    linesRemoved: linesRem,
+    linesNet: lines - linesRem,
+    estimatedCost: cost,
+    sessions,
+    inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens,
+    grandTokens: inputTokens + outputTokens + cacheReadTokens + cacheWriteTokens,
+    // Pass-through global keys for context.
+    streak: agg.streak,
+    longestStreak: agg.longestStreak,
+    daysSinceFirst: agg.daysSinceFirst,
+    peakHour: agg.peakHour,
+    bestDay: agg.bestDay,
+    projects: agg.projects || {},
+    toolBreakdown: agg.toolBreakdown || {},
+    topEditedFiles: agg.topEditedFiles || [],
+    languages: agg.languages || {},
+    bashCommands: agg.bashCommands || {},
+    webDomains: agg.webDomains || {},
+    subagents: agg.subagents || {},
+    costByModel: agg.costByModel || {},
+    modelsUsed: agg.modelsUsed || {},
+    mcpToolCalls: agg.mcpToolCalls || 0,
+    builtinToolCalls: agg.builtinToolCalls || 0,
+    byHour: agg.byHour || {},
+    byWeekday: agg.byWeekday || {},
+    notifications: agg.notifications || 0,
+  };
+}
+
+// Live snapshot: current state + lifetime aggregate + rendered rotation frames.
+// Used by GET /api/state — the SSE 'state' event tells the client to refetch.
+export function snapshot() {
+  const config = loadConfig();
+  const live = findLiveSessions({ thresholdMs: 90_000 });
+  let state = readState();
+  state.liveSessions = live;
+  state = applyIdle(state, config);
+  const aggregate = readAggregate() || {};
+  const vars = buildVars(state, config, aggregate);
+  const p = config.presence || {};
+  const frames = (p.rotation || []).map((f) => ({
+    details: fillTemplate(f.details || '', vars),
+    state: fillTemplate(f.state || '', vars),
+    passes: framePasses(f, vars),
+    requires: f.requires || null,
+  }));
+  return {
+    now: Date.now(),
+    state,
+    aggregate: {
+      sessions: aggregate.sessions,
+      subagentRuns: aggregate.subagentRuns,
+      userMessages: aggregate.userMessages,
+      toolCalls: aggregate.toolCalls,
+      uniqueFiles: aggregate.uniqueFiles,
+      activeMs: aggregate.activeMs,
+      wallMs: aggregate.wallMs,
+      inputTokens: aggregate.inputTokens,
+      outputTokens: aggregate.outputTokens,
+      cacheReadTokens: aggregate.cacheReadTokens,
+      cacheWriteTokens: aggregate.cacheWriteTokens,
+      byDay: aggregate.byDay || {},
+      byHour: aggregate.byHour || {},
+      byWeekday: aggregate.byWeekday || {},
+      projects: aggregate.projects || {},
+      toolBreakdown: aggregate.toolBreakdown || {},
+      topEditedFiles: (aggregate.topEditedFiles || []).slice(0, 12).map((e) => ({ file: basename(e.path), path: e.path, count: e.count })),
+      streak: aggregate.streak,
+      longestStreak: aggregate.longestStreak,
+      daysSinceFirst: aggregate.daysSinceFirst,
+      bestDay: aggregate.bestDay,
+      peakHour: aggregate.peakHour,
+      linesAdded: aggregate.linesAdded || 0,
+      linesRemoved: aggregate.linesRemoved || 0,
+      linesNet: aggregate.linesNet || 0,
+      languages: aggregate.languages || {},
+      bashCommands: aggregate.bashCommands || {},
+      webDomains: aggregate.webDomains || {},
+      subagents: aggregate.subagents || {},
+      mcpToolCalls: aggregate.mcpToolCalls || 0,
+      builtinToolCalls: aggregate.builtinToolCalls || 0,
+      estimatedCost: aggregate.estimatedCost || 0,
+      costByModel: aggregate.costByModel || {},
+      modelsUsed: aggregate.modelsUsed || {},
+      notifications: aggregate.notifications || 0,
+    },
+    vars,
+    frames,
+  };
+}
+
+export function projectDrilldown(name) {
+  const agg = readAggregate() || {};
+  const projects = agg.projects || {};
+  const project = projects[name];
+  if (!project) return null;
+  return {
+    name,
+    ...project,
+    files: (agg.topEditedFiles || []).slice(0, 25),
+    tools: agg.toolBreakdown || {},
+  };
+}
+
+export function dayDetail(dayKeyStr) {
+  const agg = readAggregate() || {};
+  const day = (agg.byDay || {})[dayKeyStr];
+  if (!day) return null;
+  return { day: dayKeyStr, ...day };
+}

package/src/server/index.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+// Local web dashboard for Claude RPC.
+//
+// Split layout (since the v0.4 refactor):
+//   server/index.js   — this file: HTTP lifecycle, request dispatch, SIGINT
+//   server/api.js     — data helpers (snapshot, windowedAggregate, drilldowns)
+//   server/routes.js  — declarative /api/* route table
+//   server/sse.js     — SSE broadcast + file watchers
+//   server/page.js    — all browser-side assets (HTML/CSS/JS strings)
+//
+// Zero deps, vanilla browser JS, SVG charts. Designed to run alongside the
+// daemon on localhost:47474 so the user can poke at their own data.
+
+import { createServer } from 'node:http';
+import { exec } from 'node:child_process';
+import { ROUTES, JSON_HEADERS } from './routes.js';
+import { projectDrilldown, dayDetail } from './api.js';
+import { sseClients, watchSources } from './sse.js';
+import { buildHtml } from './page.js';
+
+// Pre-compose the HTML once at startup — the only dynamic bit is the port
+// (used in a breadcrumb), which is fixed for the life of the daemon.
+const HTML = buildHtml({ port: Number(process.env.CLAUDE_RPC_PORT) || 47474 });
+
+const PORT = Number(process.env.CLAUDE_RPC_PORT) || 47474;
+
+function parseUrl(rawUrl) {
+  const url = new URL(rawUrl, 'http://x');
+  return { path: url.pathname, query: Object.fromEntries(url.searchParams) };
+}
+
+const server = createServer((req, res) => {
+  const { path, query } = parseUrl(req.url);
+  const key = `${req.method} ${path}`;
+
+  // SSE endpoint — client subscribes once, gets pushed updates on file
+  // changes (debounced 200ms in sse.js).
+  if (req.method === 'GET' && path === '/events') {
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-store',
+      'connection': 'keep-alive',
+    });
+    res.write(': hello\n\n');
+    sseClients.add(res);
+    req.on('close', () => sseClients.delete(res));
+    return;
+  }
+
+  // Project drilldown. Path-prefix dispatch (the project name is in the
+  // URL itself, not in a query string).
+  if (req.method === 'GET' && path.startsWith('/api/project/')) {
+    const name = decodeURIComponent(path.slice('/api/project/'.length));
+    const result = projectDrilldown(name);
+    res.writeHead(result ? 200 : 404, JSON_HEADERS);
+    res.end(JSON.stringify(result || { error: 'not found' }));
+    return;
+  }
+
+  // Day detail. Same pattern — day key in the URL path.
+  if (req.method === 'GET' && path.startsWith('/api/day/')) {
+    const day = decodeURIComponent(path.slice('/api/day/'.length));
+    const result = dayDetail(day);
+    res.writeHead(result ? 200 : 404, JSON_HEADERS);
+    res.end(JSON.stringify(result || { error: 'not found' }));
+    return;
+  }
+
+  // Static /api/* endpoints (state, aggregate, insights, badge.svg, card.svg).
+  const handler = ROUTES.get(key);
+  if (handler) return handler(req, res, { query });
+
+  // Page.
+  if (req.method === 'GET' && (path === '/' || path === '/index.html')) {
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+    res.end(HTML);
+    return;
+  }
+
+  res.writeHead(404).end('not found');
+});
+
+watchSources();
+
+server.listen(PORT, '127.0.0.1', () => {
+  const url = `http://127.0.0.1:${PORT}`;
+  console.log(`◆ Claude RPC dashboard: ${url}`);
+  console.log('  Ctrl-C to stop.');
+  if (!process.env.CLAUDE_RPC_NO_OPEN) {
+    const opener = process.platform === 'win32' ? `start "" "${url}"`
+      : process.platform === 'darwin' ? `open "${url}"`
+      : `xdg-open "${url}"`;
+    exec(opener, () => {});
+  }
+});
+
+process.on('SIGINT', () => process.exit(0));
+process.on('SIGTERM', () => process.exit(0));