python-rac 0.2.0__py3-none-any.whl

pyrac/web/workspace.py

@@ -0,0 +1,1905 @@
+"""Local multi-RAS workspace. Endpoints live in memory; no credentials are stored."""
+import html
+import hmac
+import re
+import asyncio
+from uuid import UUID
+from urllib.parse import parse_qs, quote, unquote_to_bytes, urlencode, urlsplit
+
+from ..client import RacClient
+from ..read_service import PROFILE_ACL_LISTS
+from .app import create_app, render_document
+
+
+def _search_text(value):
+    if not isinstance(value, str) or '\x00' in value:
+        return False
+    try:
+        return len(value.encode('utf-8')) <= 1024
+    except UnicodeError:
+        return False
+
+_ENDPOINT = re.compile(r'^/ras/([0-9]+)/?(.*)$')
+_LOOPBACK = re.compile(r'^(localhost|127\.0\.0\.1|\[::1\])(?::[0-9]{1,5})?$')
+_HOST = re.compile(r'^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$')
+_RAS_SERVER = re.compile(r'([A-Za-z0-9][A-Za-z0-9.-]{0,252}):([0-9]+)/(?:(16\.0)|(10\.0)|(auto))\Z')
+
+
+def parse_ras_server(spec):
+    """Parse a startup workspace endpoint without connecting to it."""
+    match = _RAS_SERVER.fullmatch(spec)
+    if match is None or not 1 <= int(match.group(2)) <= 65535:
+        raise ValueError('Invalid RAS endpoint (expected HOST:PORT/16.0|10.0|auto)')
+    return match.group(1), int(match.group(2)), next(part for part in match.groups()[2:] if part)
+
+
+def startup_endpoints(host, port, protocol, specs):
+    endpoints = [(host, port, protocol)]
+    endpoints.extend(parse_ras_server(spec) for spec in specs)
+    if len(endpoints) > 64 or len(set(endpoints)) != len(endpoints):
+        raise ValueError('Invalid RAS endpoint list (maximum 64 unique servers)')
+    return endpoints
+SEARCH_ENDPOINT_TIMEOUT = 30.0
+SEARCH_CLUSTER_GROUPS = {
+    'connections': ('connection', True), 'managers': ('manager', True),
+    'limits': ('name', False), 'counters': ('name', False),
+}
+SEARCH_SERVER_GROUPS = {'rules': ('list_rules', 'rule', 'object-type'),
+                        'service-settings': ('list_service_settings', 'setting', 'service-name')}
+SEARCH_PROFILE_ACL = {'profile-directories': ('directory', 'alias'),
+                      **{'profile-' + kind: (kind, 'name')
+                         for kind in PROFILE_ACL_LISTS if kind != 'directory'}}
+SEARCH_KIND_NAMES = {
+    'clusters': 'Кластеры', 'infobases': 'Базы данных',
+    'agent-admins': 'Администраторы агента',
+    'cluster-admins': 'Администраторы кластера',
+    'profile-directories': 'Каталоги профиля',
+    **{'profile-' + kind: 'Профиль: ' + label for kind, label in {
+        'com': 'COM', 'addin': 'внешние компоненты', 'module': 'модули',
+        'app': 'приложения', 'inet': 'Интернет',
+    }.items()},
+}
+SECTION_NAMES = {
+    'servers': 'Рабочие серверы', 'processes': 'Рабочие процессы',
+    'infobases': 'Базы данных', 'sessions': 'Сеансы',
+    'connections': 'Соединения', 'profiles': 'Профили безопасности',
+    'counters': 'Счётчики', 'limits': 'Ограничения', 'managers': 'Менеджеры',
+    'services': 'Сервисы', 'locks': 'Блокировки', 'rules': 'Правила',
+    'service-settings': 'Настройки сервисов', 'transfer-directories': 'Каталоги переноса',
+    'summary': 'Краткая информация', 'info': 'Сведения',
+    'binary-storages': 'Двоичные хранилища',
+    'directory': 'Каталоги', 'com': 'COM', 'addin': 'Внешние компоненты',
+    'module': 'Модули', 'app': 'Приложения', 'inet': 'Интернет',
+}
+INSPECTOR_SCRIPT = '''"use strict";
+document.addEventListener("DOMContentLoaded", () => {
+  const panel = document.querySelector(".console-inspector");
+  if (!panel) return;
+  const fields = [["RAS", "ras"], ["Protocol", "protocol"], ["Type", "type"],
+                  ["Object", "object"]];
+  function select(row) {
+    document.querySelectorAll(".selectable-row, [data-searchable-row]").forEach(item => {
+      item.classList.toggle("is-selected", item === row);
+      item.setAttribute("aria-selected", item === row ? "true" : "false");
+    });
+    panel.replaceChildren();
+    const title = document.createElement("h2");
+    title.textContent = "Свойства";
+    panel.append(title);
+    const properties = document.createElement("dl");
+    const visible = row.matches("[data-searchable-row]") && !row.hasAttribute("data-inspect-type")
+      ? Array.from(row.querySelectorAll("td")).map((cell, index) => [
+          row.closest("table").querySelectorAll("thead th")[index]?.textContent || "Field",
+          cell.textContent
+        ]).filter(([label]) => label !== "Actions")
+      : fields.map(([label, key]) => [label,
+          row.dataset["inspect" + key[0].toUpperCase() + key.slice(1)] || "—"]);
+    visible.forEach(([label, text]) => {
+      const term = document.createElement("dt");
+      const value = document.createElement("dd");
+      term.textContent = label;
+      value.textContent = text;
+      properties.append(term, value);
+    });
+    panel.append(properties);
+  }
+  document.querySelectorAll(".selectable-row, [data-searchable-row]").forEach(row => {
+    if (row.matches("[data-searchable-row]")) {
+      row.classList.add("selectable-row");
+      row.tabIndex = 0;
+      row.setAttribute("aria-selected", "false");
+    }
+    row.addEventListener("click", event => {
+      if (!event.target.closest("a,button")) select(row);
+    });
+    row.addEventListener("keydown", event => {
+      if (event.target !== row) return;
+      if (event.key === "Enter" || event.key === " ") {
+        event.preventDefault();
+        select(row);
+      }
+    });
+  });
+});
+'''
+
+
+def create_workspace_app(endpoints, *, csrf_token):
+    """Wrap the read-only dashboard without changing its mutation guards."""
+    initial = list(endpoints)
+    if not initial or not isinstance(csrf_token, str) or len(csrf_token) < 16:
+        raise ValueError('Workspace needs an endpoint and CSRF token')
+    if len(initial) > 64 or any(
+            not isinstance(endpoint, (tuple, list)) or len(endpoint) != 3 or
+            not isinstance(endpoint[0], str) or not _HOST.fullmatch(endpoint[0]) or
+            type(endpoint[1]) is not int or not 1 <= endpoint[1] <= 65535 or
+            endpoint[2] not in ('16.0', '10.0', 'auto') for endpoint in initial):
+        raise ValueError('Invalid initial RAS endpoint')
+    servers = dict(enumerate(initial))
+    next_index = len(servers)
+
+    def safe_tree_name(value, fallback):
+        if not isinstance(value, str) or not value.strip() or '\x00' in value:
+            return fallback
+        try:
+            return value if len(value.encode('utf-8')) <= 1024 else fallback
+        except UnicodeError:
+            return fallback
+
+    def navigation(expanded_index=None, clusters=(), expanded_cluster=None, servers_for_cluster=(),
+                   expanded_server=None, processes_for_server=(), expanded_process=None,
+                   connections_for_process=(), profiles_for_cluster=()):
+        from ..read_service import CLUSTER_LISTS, SERVER_LISTS
+        entries = []
+        for index, (host, port, protocol) in servers.items():
+            label = html.escape(f'{host}:{port}')
+            children = ''
+            if index == expanded_index:
+                for cluster_id, name, infobases in clusters:
+                    server_children = ''
+                    if cluster_id == expanded_cluster:
+                        for server_id, server_name in servers_for_cluster:
+                            base = f'/ras/{index}/clusters/{cluster_id}/servers/{server_id}'
+                            processes = (''.join(
+                                f'<li><a href="/ras/{index}/clusters/{cluster_id}/processes/{process_id}">'
+                                f'{"Working process" if pid == "Working process" else "PID " + html.escape(pid)}</a><ul><li><a href="{base}/processes/'
+                                f'{process_id}/connections/tree">Expand connections</a><ul>' +
+                                (''.join(f'<li><a href="/ras/{index}/clusters/{cluster_id}/connections/'
+                                         f'{connection_id}">{html.escape(connection_host)}</a><ul>'
+                                         f'<li><a href="/ras/{index}/clusters/{cluster_id}/connections/'
+                                         f'{connection_id}/locks">Locks</a></li></ul></li>'
+                                         for connection_id, connection_host in connections_for_process)
+                                 if process_id == expanded_process else '') +
+                                f'</ul></li><li><a href="/ras/{index}/clusters/{cluster_id}/processes/'
+                                f'{process_id}/connections">Connections</a></li></ul></li>'
+                                for process_id, pid in processes_for_server)
+                                if server_id == expanded_server else '')
+                            server_children += (f'<li><a href="{base}">{html.escape(server_name)}</a><ul>' +
+                                                f'<li><a href="{base}/processes/tree">Развернуть процессы</a>'
+                                                f'<ul>{processes}</ul></li>' +
+                                                ''.join(f'<li><a href="{base}/{kind}">'
+                                                        f'{SECTION_NAMES.get(kind, kind)}'
+                                                        '</a></li>' for kind in ('processes', *SERVER_LISTS)) +
+                                                '</ul></li>')
+                    bases = ''.join(
+                        (f'<li><a href="/ras/{index}/clusters/{cluster_id}/infobases/{base_id}/summary">'
+                         f'{html.escape(base_name)}</a><ul>' + ''.join(
+                             f'<li><a href="/ras/{index}/clusters/{cluster_id}/infobases/{base_id}/{kind}">'
+                             f'{SECTION_NAMES.get(kind, kind)}</a></li>'
+                             for kind in ('summary', 'info', 'sessions', 'connections',
+                                          'locks', 'binary-storages')) + '</ul></li>' if base_id is not None else
+                         f'<li>{html.escape(base_name)}</li>')
+                        for base_id, base_name in infobases)
+                    profile_children = ''
+                    if cluster_id == expanded_cluster:
+                        for profile_name in profiles_for_cluster:
+                            profile_url = (f'/ras/{index}/clusters/{cluster_id}/profiles/'
+                                           f'{quote(profile_name, safe="")}')
+                            profile_children += (f'<li><a href="/ras/{index}/clusters/{cluster_id}'
+                                                 f'/profiles/overview?{urlencode({"name": profile_name})}">'
+                                                 f'{html.escape(profile_name)}</a><ul>' + ''.join(
+                                                     f'<li><a href="{profile_url}/acl/{kind}">'
+                                                     f'{SECTION_NAMES.get(kind, kind)}</a></li>'
+                                                     for kind in PROFILE_ACL_LISTS) + '</ul></li>')
+                    children += (f'<li><a href="/ras/{index}/clusters/{cluster_id}">'
+                                 f'{html.escape(name)}</a><ul>' + ''.join(
+                                     f'<li><a href="/ras/{index}/clusters/{cluster_id}/{kind}">'
+                                     f'{SECTION_NAMES.get(kind, kind)}</a></li>'
+                                     for kind in CLUSTER_LISTS) +
+                                 f'<li><a href="/ras/{index}/clusters/{cluster_id}/profiles/tree">'
+                                 'Развернуть профили безопасности</a><ul>' + profile_children + '</ul></li>' +
+                                 f'<li><a href="/ras/{index}/clusters/{cluster_id}/servers/tree">'
+                                 'Развернуть рабочие серверы</a><ul>' + server_children + '</ul></li>' +
+                                 f'<li><a href="/ras/{index}/clusters/{cluster_id}/admins">'
+                                 'Администраторы</a></li>' +
+                                 f'<li><a href="/ras/{index}/clusters/{cluster_id}/info">'
+                                 'Сведения о кластере</a></li>' + bases + '</ul></li>')
+            entries.append(f'<li><a class="tree-node" href="/ras/{index}/tree">'
+                           f'{"▾" if index == expanded_index else "▸"} {label}</a><ul>'
+                           f'<li><a href="/ras/{index}/clusters">Кластеры</a></li>' + children +
+                           f'<li><a href="/ras/{index}/agent/admins">Администраторы агента</a></li>'
+                           f'<li><a href="/ras/{index}/agent/version">Версия агента</a></li>'
+                           f'<li><small>{html.escape(protocol)}</small></li></ul></li>')
+        return '<h2>Подключения</h2><a href="/ras"><span class="ui-icon" aria-hidden="true">▣</span> Все серверы RAS</a><ul>' + ''.join(entries) + '</ul>'
+
+    def page(environ, start_response, body, status='200 OK', *, inspector=None,
+             expanded_index=None, clusters=(), expanded_cluster=None, servers_for_cluster=(),
+             expanded_server=None, processes_for_server=(), expanded_process=None,
+             connections_for_process=(), profiles_for_cluster=()):
+        start_response(status, [('Content-Type', 'text/html; charset=utf-8'),
+                                ('Cache-Control', 'no-store'), ('X-Content-Type-Options', 'nosniff'),
+                                ('Referrer-Policy', 'no-referrer'), ('X-Frame-Options', 'DENY')])
+        return [render_document('RAS workspace', body,
+                                workspace_tree=navigation(expanded_index, clusters,
+                                                          expanded_cluster, servers_for_cluster,
+                                                          expanded_server, processes_for_server,
+                                                          expanded_process, connections_for_process,
+                                                          profiles_for_cluster),
+                                inspector=inspector).encode('utf-8')]
+
+    def inventory_filter(label):
+        name = html.escape(label)
+        return ('<label>Search ' + name.lower() +
+                ' <input type="search" aria-label="Search ' + name.lower() +
+                '" oninput="this.closest(\'section\').querySelectorAll(\'[data-searchable-row]\')'
+                '.forEach(row=>row.hidden=!(row.textContent.toLocaleLowerCase().includes('
+                'this.value.toLocaleLowerCase())||row.dataset.searchKey?.toLocaleLowerCase().includes('
+                'this.value.toLocaleLowerCase())))" placeholder="Name or UUID"></label>')
+
+    def workspace(environ, start_response):
+        nonlocal next_index
+        path = environ.get('PATH_INFO', '/')
+        method = environ.get('REQUEST_METHOD', 'GET')
+        if (environ.get('REMOTE_ADDR') not in ('127.0.0.1', '::1') or
+                not _LOOPBACK.fullmatch(environ.get('HTTP_HOST', ''))):
+            start_response('403 Forbidden', [('Content-Type', 'text/plain')])
+            return [b'Local access only']
+        if path == '/ras/inspector.js':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            start_response('200 OK', [('Content-Type', 'text/javascript; charset=utf-8'),
+                                      ('Cache-Control', 'no-store'),
+                                      ('X-Content-Type-Options', 'nosniff')])
+            return [INSPECTOR_SCRIPT.encode('utf-8')]
+        if path == '/ras/remove':
+            if method != 'POST':
+                start_response('405 Method Not Allowed', [('Allow', 'POST')])
+                return [b'']
+            origin = urlsplit(environ.get('HTTP_ORIGIN', ''))
+            if (origin.scheme != 'http' or origin.netloc != environ.get('HTTP_HOST') or
+                    origin.path or origin.query or origin.fragment or
+                    environ.get('CONTENT_TYPE', '').split(';', 1)[0] != 'application/x-www-form-urlencoded'):
+                return page(environ, start_response, '<p>Invalid origin</p>', '403 Forbidden')
+            try:
+                length = int(environ.get('CONTENT_LENGTH', '-1'))
+                if not 0 <= length <= 2048:
+                    raise ValueError('length')
+                raw = environ['wsgi.input'].read(length)
+                if len(raw) != length:
+                    raise ValueError('truncated')
+                fields = parse_qs(raw.decode('utf-8'), strict_parsing=True)
+                if set(fields) != {'csrf_token', 'index', 'confirm'} or any(
+                        len(values) != 1 for values in fields.values()):
+                    raise ValueError('fields')
+                if not hmac.compare_digest(fields['csrf_token'][0], csrf_token):
+                    raise ValueError('token')
+                index_text = fields['index'][0]
+                if not index_text.isascii() or not index_text.isdecimal() or len(index_text) > 16:
+                    raise ValueError('index')
+                index = int(index_text)
+                if index not in servers or len(servers) <= 1:
+                    raise ValueError('index')
+                host, port, protocol = servers[index]
+                if not hmac.compare_digest(fields['confirm'][0], f'{host}:{port}/{protocol}'):
+                    raise ValueError('confirmation')
+                del servers[index]
+            except (ValueError, UnicodeError, KeyError):
+                return page(environ, start_response, '<p>Invalid RAS endpoint</p>', '403 Forbidden')
+            return page(environ, start_response, '<p>RAS endpoint removed from this workspace. '
+                        '<a href="/ras">Back to servers</a></p>')
+        if path == '/ras/clusters':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for row in await client.list_clusters():
+                                    if not isinstance(row, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(row['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    name, object_host = row.get('name'), row.get('host')
+                                    if (not isinstance(name, str) or not name.strip()
+                                            or not _search_text(name)):
+                                        name = (object_host if isinstance(object_host, str)
+                                                and object_host.strip() and _search_text(object_host)
+                                                else 'Unnamed cluster')
+                                    found.append((index, host, port, protocol, cluster, name))
+                    except Exception:
+                        pass  # Keep healthy RAS; do not render exception text.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{cluster}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(name)}</a>'
+                '</td></tr>' for index, host, port, protocol, cluster, name in rows)
+            body = ('<section><h1>Кластеры всех RAS</h1><p>'
+                    '<a href="/ras">Все серверы RAS</a></p>' + inventory_filter('Кластеры') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Протокол</th><th>Кластер</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/servers':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name = record.get('name')
+                                    cluster_host = record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_servers(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                server_id = str(UUID(str(row['server'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            name, server_host = row.get('name'), row.get('host_name')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                name = (server_host if isinstance(server_host, str)
+                                                        and server_host.strip() and _search_text(server_host)
+                                                        else 'Unnamed server')
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, server_id, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve healthy clusters without rendering private errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{server_id}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/servers/{server_id}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, server_id, name in rows)
+            body = ('<section><h1>Working servers across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Working servers') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Working server</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/processes':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name, cluster_host = record.get('name'), record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_processes(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                process = str(UUID(str(row['process'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            pid = row.get('pid')
+                                            name = (f'PID {pid}' if type(pid) is str and pid.isascii()
+                                                    and pid.isdecimal() and len(pid) <= 20
+                                                    else 'Working process')
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, process, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve completed clusters; do not expose private errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{process}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/processes/{process}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, process, name in rows)
+            body = ('<section><h1>Working processes across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Working processes') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Working process</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/sessions':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name, cluster_host = record.get('name'), record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_sessions(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                session = str(UUID(str(row['session_id'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            name = row.get('user_name')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                name = 'Unnamed session'
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, session, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve completed clusters; do not expose private errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{session}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/sessions/{session}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, session, name in rows)
+            body = ('<section><h1>Sessions across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Sessions') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Session</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/connections':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name, cluster_host = record.get('name'), record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_connections(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                connection = str(UUID(str(row['connection'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            name = row.get('host')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                name = 'Unnamed connection'
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, connection, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve completed clusters; do not expose private errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{connection}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/connections/{connection}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, connection, name in rows)
+            body = ('<section><h1>Connections across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Connections') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Connection</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/locks':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name = safe_tree_name(record.get('name'),
+                                                                  safe_tree_name(record.get('host'),
+                                                                                 'Unnamed cluster'))
+                                    try:
+                                        for row in await client.list_locks(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                connection = str(UUID(str(row['connection'])))
+                                                UUID(str(row['object']))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            label = row.get('lock-descr')
+                                            name = (label if isinstance(label, str) and label.strip()
+                                                    and _search_text(label) else 'Lock')
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, connection, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Retain completed clusters; never expose exception text.
+                    return found
+
+                batches = await asyncio.gather(*(list_one(index, *endpoint)
+                                                 for index, endpoint in tuple(servers.items())))
+                return [row for batch in batches for row in batch]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{html.escape(name, quote=True)}">'
+                f'<td>{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/connections/{connection}/locks">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, connection, name in rows)
+            body = ('<section><h1>Locks across RAS</h1><p><a href="/ras">All RAS servers</a>'
+                    '</p>' + inventory_filter('Locks') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Lock</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/services':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name, cluster_host = record.get('name'), record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_services(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            name = row.get('name')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                continue
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve completed clusters without exposing server errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row><td>{html.escape(f"{host}:{port}")}</td>'
+                f'<td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/services">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, name in rows)
+            body = ('<section><h1>Services across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Services') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Service</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/server-inventory':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            kind = parse_qs(environ.get('QUERY_STRING', '')).get('kind', [''])[0]
+            if kind not in (*SEARCH_SERVER_GROUPS, 'transfer-directories'):
+                return page(environ, start_response, '<p>Invalid inventory kind</p>', '400 Bad Request')
+            method_name, selector_key, label_key = SEARCH_SERVER_GROUPS.get(
+                kind, ('list_service_data_dirs_for_transfer', 'service-name', 'service-name'))
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for cluster_row in await client.list_clusters():
+                                    if not isinstance(cluster_row, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(cluster_row['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name = safe_tree_name(cluster_row.get('name'),
+                                                                  safe_tree_name(cluster_row.get('host'),
+                                                                                 'Unnamed cluster'))
+                                    try:
+                                        working_servers = await client.list_servers(UUID(cluster))
+                                    except Exception:
+                                        continue
+                                    for server_row in working_servers:
+                                        if not isinstance(server_row, dict):
+                                            continue
+                                        try:
+                                            server_id = str(UUID(str(server_row['server'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        server_name = safe_tree_name(server_row.get('name'),
+                                                                     safe_tree_name(server_row.get('host_name'),
+                                                                                    'Unnamed server'))
+                                        try:
+                                            records = await getattr(client, method_name)(
+                                                UUID(cluster), UUID(server_id))
+                                            for row in records:
+                                                if not isinstance(row, dict):
+                                                    continue
+                                                if kind == 'transfer-directories':
+                                                    selector = row.get('service-name')
+                                                    if (not isinstance(selector, str) or not selector.strip()
+                                                            or not _search_text(selector)):
+                                                        continue
+                                                    name = selector
+                                                else:
+                                                    try:
+                                                        selector = str(UUID(str(row[selector_key])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    name = safe_tree_name(row.get(label_key),
+                                                                          'Assignment rule' if kind == 'rules'
+                                                                          else 'Service setting')
+                                                found.append((index, host, port, protocol, cluster,
+                                                              cluster_name, server_id, server_name,
+                                                              selector, name))
+                                        except Exception:
+                                            continue
+                    except Exception:
+                        pass  # Preserve completed server reads, not private errors.
+                    return found
+
+                batches = await asyncio.gather(*(list_one(index, *endpoint)
+                                                 for index, endpoint in tuple(servers.items())))
+                return [row for batch in batches for row in batch]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{html.escape(selector, quote=True)}">'
+                f'<td>{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/servers/{server_id}">'
+                f'{html.escape(server_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/servers/{server_id}/{kind}'
+                f'{"?" + urlencode({"service_name": selector}, quote_via=quote) if kind == "transfer-directories" else "/" + selector}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name,
+                    server_id, server_name, selector, name in rows)
+            title = kind.replace('-', ' ').title()
+            body = (f'<section><h1>{title} across RAS</h1><p><a href="/ras">All RAS servers</a>'
+                    '</p>' + inventory_filter(title) +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    f'<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Working server</th><th>{title}</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/administrators':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            kind = parse_qs(environ.get('QUERY_STRING', '')).get('kind', [''])[0]
+            if kind not in ('agent-admins', 'cluster-admins'):
+                return page(environ, start_response, '<p>Invalid inventory kind</p>', '400 Bad Request')
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                if kind == 'agent-admins':
+                                    for row in await client.list_agent_admins():
+                                        if not isinstance(row, dict):
+                                            continue
+                                        name = row.get('name')
+                                        if (isinstance(name, str) and name.strip()
+                                                and _search_text(name)):
+                                            found.append((index, host, port, protocol, '', '', name))
+                                else:
+                                    for record in await client.list_clusters():
+                                        if not isinstance(record, dict):
+                                            continue
+                                        try:
+                                            cluster = str(UUID(str(record['cluster'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        cluster_name = safe_tree_name(record.get('name'),
+                                                                      safe_tree_name(record.get('host'),
+                                                                                     'Unnamed cluster'))
+                                        try:
+                                            for row in await client.list_cluster_admins(UUID(cluster)):
+                                                if not isinstance(row, dict):
+                                                    continue
+                                                name = row.get('name')
+                                                if (isinstance(name, str) and name.strip()
+                                                        and _search_text(name)):
+                                                    found.append((index, host, port, protocol,
+                                                                  cluster, cluster_name, name))
+                                        except Exception:
+                                            continue
+                    except Exception:
+                        pass  # Keep completed clusters, never expose private exception text.
+                    return found
+
+                batches = await asyncio.gather(*(list_one(index, *endpoint)
+                                                 for index, endpoint in tuple(servers.items())))
+                return [row for batch in batches for row in batch]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{html.escape(name, quote=True)}">'
+                f'<td>{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                + (f'<td><a href="/ras/{index}/clusters/{cluster}">'
+                   f'{html.escape(cluster_name)}</a></td>' if cluster else '<td>—</td>')
+                + (f'<td><a href="/ras/{index}/clusters/{cluster}/admins">' if cluster else
+                   f'<td><a href="/ras/{index}/agent/admins">')
+                + html.escape(name) + '</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, name in rows)
+            title = 'Agent administrators' if kind == 'agent-admins' else 'Cluster administrators'
+            body = (f'<section><h1>{title} across RAS</h1><p><a href="/ras">All RAS servers</a>'
+                    '</p>' + inventory_filter(title) +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Administrator</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/cluster-inventory':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            kind = parse_qs(environ.get('QUERY_STRING', '')).get('kind', [''])[0]
+            if kind not in ('managers', 'counters', 'limits'):
+                return page(environ, start_response, '<p>Invalid inventory kind</p>', '400 Bad Request')
+            selector_key, is_uuid = SEARCH_CLUSTER_GROUPS[kind]
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name = safe_tree_name(record.get('name'),
+                                                                  safe_tree_name(record.get('host'),
+                                                                                 'Unnamed cluster'))
+                                    try:
+                                        for row in await getattr(client, 'list_' + kind)(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                selector = (str(UUID(str(row[selector_key]))) if is_uuid
+                                                            else row[selector_key])
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            if not is_uuid and (not isinstance(selector, str)
+                                                                or not selector.strip() or not _search_text(selector)):
+                                                continue
+                                            name = (safe_tree_name(row.get('host'), 'Cluster manager')
+                                                    if is_uuid else selector)
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, selector, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Retain completed clusters, not private exception text.
+                    return found
+
+                batches = await asyncio.gather(*(list_one(index, *endpoint)
+                                                 for index, endpoint in tuple(servers.items())))
+                return [row for batch in batches for row in batch]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{html.escape(selector, quote=True)}">'
+                f'<td>{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/{kind}/{quote(selector, safe="")}">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, selector, name in rows)
+            title = kind.title()
+            body = (f'<section><h1>{title} across RAS</h1><p><a href="/ras">All RAS servers</a>'
+                    '</p>' + inventory_filter(title) +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    f'<th>RAS</th><th>Protocol</th><th>Cluster</th><th>{title}</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/profiles':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name, cluster_host = record.get('name'), record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_profiles(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            name = row.get('name')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                continue
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Preserve completed clusters without exposing server errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row><td>{html.escape(f"{host}:{port}")}</td>'
+                f'<td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/profiles/overview?'
+                f'{urlencode({"name": name}, quote_via=quote)}">{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, name in rows)
+            body = ('<section><h1>Security profiles across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Security profiles') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Profile</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/infobases':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def list_one(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline), semaphore:
+                            async with RacClient(host, port, protocol) as client:
+                                for record in await client.list_clusters():
+                                    if not isinstance(record, dict):
+                                        continue
+                                    try:
+                                        cluster = str(UUID(str(record['cluster'])))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    cluster_name = record.get('name')
+                                    cluster_host = record.get('host')
+                                    if (not isinstance(cluster_name, str) or not cluster_name.strip()
+                                            or not _search_text(cluster_name)):
+                                        cluster_name = (cluster_host if isinstance(cluster_host, str)
+                                                        and cluster_host.strip() and _search_text(cluster_host)
+                                                        else 'Unnamed cluster')
+                                    try:
+                                        for row in await client.list_infobases(UUID(cluster)):
+                                            if not isinstance(row, dict):
+                                                continue
+                                            try:
+                                                infobase = str(UUID(str(row['infobase'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            name = row.get('name')
+                                            if (not isinstance(name, str) or not name.strip()
+                                                    or not _search_text(name)):
+                                                name = 'Unnamed infobase'
+                                            found.append((index, host, port, protocol, cluster,
+                                                          cluster_name, infobase, name))
+                                    except Exception:
+                                        continue
+                    except Exception:
+                        pass  # Keep completed clusters, never expose RAS errors.
+                    return found
+
+                groups = await asyncio.gather(*(list_one(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory())
+            items = ''.join(
+                f'<tr data-searchable-row data-search-key="{base}"><td>'
+                f'{html.escape(f"{host}:{port}")}</td><td>{html.escape(protocol)}</td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}">{html.escape(cluster_name)}</a></td>'
+                f'<td><a href="/ras/{index}/clusters/{cluster}/infobases/{base}/summary">'
+                f'{html.escape(name)}</a></td></tr>'
+                for index, host, port, protocol, cluster, cluster_name, base, name in rows)
+            body = ('<section><h1>Infobases across RAS</h1><p>'
+                    '<a href="/ras">All RAS servers</a></p>' + inventory_filter('Infobases') +
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>RAS</th><th>Protocol</th><th>Cluster</th><th>Infobase</th>'
+                    '</tr></thead><tbody>' + items + '</tbody></table></div></section>')
+            return page(environ, start_response, body)
+        if path == '/ras/search':
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            query = environ.get('QUERY_STRING', '')
+            if len(query) > 512:
+                return page(environ, start_response, '<p>Invalid search</p>', '400 Bad Request')
+            try:
+                if re.search(r'%(?![0-9A-Fa-f]{2})', query):
+                    raise ValueError('escape')
+                unquote_to_bytes(query).decode('utf-8')
+                fields = parse_qs(query, strict_parsing=bool(query))
+                if set(fields) - {'q', 'scope'} or any(len(values) != 1 for values in fields.values()):
+                    raise ValueError('query')
+                scope = fields.get('scope', ['inventory'])[0]
+                if scope not in ('inventory', 'clusters', 'infobases', 'agent-admins', 'cluster-admins',
+                                  'services', 'locks', 'transfer-directories',
+                                  'servers', 'processes', 'sessions', 'profiles', *SEARCH_PROFILE_ACL,
+                                  *SEARCH_CLUSTER_GROUPS, *SEARCH_SERVER_GROUPS):
+                    raise ValueError('scope')
+                term = fields.get('q', [''])[0].strip()
+                if len(term) > 100 or '\x00' in term:
+                    raise ValueError('query')
+            except (ValueError, UnicodeError):
+                return page(environ, start_response, '<p>Invalid search</p>', '400 Bad Request')
+
+            async def inventory():
+                semaphore = asyncio.Semaphore(4)
+                deadline = asyncio.get_running_loop().time() + SEARCH_ENDPOINT_TIMEOUT
+
+                async def query_server(index, host, port, protocol):
+                    found = []
+                    try:
+                        async with asyncio.timeout_at(deadline):
+                            async with semaphore:
+                                async with RacClient(host, port, protocol) as client:
+                                    if scope == 'agent-admins':
+                                        for admin in await client.list_agent_admins():
+                                            if not isinstance(admin, dict):
+                                                continue
+                                            name = admin.get('name')
+                                            os_user = admin.get('os-user', '')
+                                            if (not isinstance(name, str) or not name or not _search_text(name)):
+                                                continue
+                                            if term.casefold() in name.casefold() or (
+                                                    isinstance(os_user, str) and _search_text(os_user)
+                                                    and term.casefold() in os_user.casefold()):
+                                                found.append((index, host, port, protocol, scope, '', '', name))
+                                        return found
+                                    clusters = await client.list_clusters()
+                                    for cluster in clusters:
+                                        try:
+                                            ident = str(UUID(str(cluster['cluster'])))
+                                        except (KeyError, TypeError, ValueError):
+                                            continue
+                                        cluster_name = cluster.get('name', '')
+                                        valid_name = _search_text(cluster_name) and bool(cluster_name.strip())
+                                        cluster_host = cluster.get('host', '')
+                                        valid_host = _search_text(cluster_host) and bool(cluster_host.strip())
+                                        if scope in ('inventory', 'clusters') and (
+                                                term.casefold() in ident.casefold()
+                                                or valid_name and term.casefold() in cluster_name.casefold()
+                                                or valid_host and term.casefold() in cluster_host.casefold()):
+                                            found.append((index, host, port, protocol, 'cluster', ident,
+                                                          '', cluster_name if valid_name else
+                                                          cluster_host if valid_host and cluster_host else 'Unnamed cluster'))
+                                        try:
+                                            if scope == 'cluster-admins':
+                                                for admin in await client.list_cluster_admins(UUID(ident)):
+                                                    if not isinstance(admin, dict):
+                                                        continue
+                                                    name = admin.get('name')
+                                                    os_user = admin.get('os-user', '')
+                                                    if (not isinstance(name, str) or not name or not _search_text(name)):
+                                                        continue
+                                                    if term.casefold() in name.casefold() or (
+                                                            isinstance(os_user, str) and _search_text(os_user)
+                                                            and term.casefold() in os_user.casefold()):
+                                                        found.append((index, host, port, protocol, scope,
+                                                                      ident, '', name))
+                                            elif scope in (*SEARCH_SERVER_GROUPS, 'transfer-directories'):
+                                                for server in await client.list_servers(UUID(ident)):
+                                                    try:
+                                                        server_id = str(UUID(str(server['server'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    try:
+                                                        if scope == 'transfer-directories':
+                                                            records = await client.list_service_data_dirs_for_transfer(
+                                                                UUID(ident), UUID(server_id))
+                                                            for record in records:
+                                                                if not isinstance(record, dict):
+                                                                    continue
+                                                                name = record.get('service-name')
+                                                                infobase = record.get('infobase-name', '')
+                                                                if (not isinstance(name, str) or not name
+                                                                        or not _search_text(name)):
+                                                                    continue
+                                                                valid_infobase = (isinstance(infobase, str)
+                                                                                  and _search_text(infobase))
+                                                                if (term.casefold() in name.casefold()
+                                                                        or isinstance(infobase, str)
+                                                                        and valid_infobase
+                                                                        and term.casefold() in infobase.casefold()):
+                                                                    found.append((index, host, port, protocol, scope,
+                                                                                  ident, server_id, name))
+                                                        else:
+                                                            method, key, label_key = SEARCH_SERVER_GROUPS[scope]
+                                                            for record in await getattr(client, method)(UUID(ident), UUID(server_id)):
+                                                                try:
+                                                                    record_id = str(UUID(str(record[key])))
+                                                                except (KeyError, TypeError, ValueError):
+                                                                    continue
+                                                                name = record.get(label_key, '')
+                                                                valid_name = _search_text(name) and isinstance(name, str) and bool(name.strip())
+                                                                if scope == 'rules':
+                                                                    secondary = (record.get('infobase-name', ''),
+                                                                                 record.get('application-ext', ''))
+                                                                else:
+                                                                    secondary = (record.get('infobase-name', ''),)
+                                                                fields = (name, *secondary, record_id)
+                                                                if any(isinstance(field, str) and _search_text(field)
+                                                                       and term.casefold() in field.casefold()
+                                                                       for field in fields):
+                                                                    label = (' · '.join(field for field in fields[:-1]
+                                                                                       if isinstance(field, str) and field.strip()
+                                                                                       and _search_text(field))
+                                                                             if scope == 'rules' else
+                                                                             name if valid_name else '')
+                                                                    found.append((index, host, port, protocol, scope,
+                                                                                  ident, f'{server_id}/{record_id}',
+                                                                                  label or ('Assignment rule' if scope == 'rules'
+                                                                                            else 'Service setting')))
+                                                    except Exception:
+                                                        found.append((index, host, port, protocol, 'error', '', '', 'Unavailable'))
+                                            elif scope == 'services':
+                                                for record in await client.list_services(UUID(ident)):
+                                                    if not isinstance(record, dict):
+                                                        continue
+                                                    name = record.get('name')
+                                                    description = record.get('descr', '')
+                                                    if not isinstance(name, str) or not name or not _search_text(name):
+                                                        continue
+                                                    manager = record.get('manager')
+                                                    if (term.casefold() in name.casefold()
+                                                            or _search_text(description)
+                                                            and term.casefold() in description.casefold()
+                                                            or isinstance(manager, str) and _search_text(manager)
+                                                            and term.casefold() in manager.casefold()):
+                                                        found.append((index, host, port, protocol, scope,
+                                                                      ident, '', name))
+                                            elif scope == 'locks':
+                                                for record in await client.list_locks(UUID(ident)):
+                                                    if not isinstance(record, dict):
+                                                        continue
+                                                    try:
+                                                        connection_id = str(UUID(str(record['connection'])))
+                                                        object_id = str(UUID(str(record['object'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    description = record.get('lock-descr', '')
+                                                    valid_description = _search_text(description)
+                                                    if (term.casefold() in object_id.casefold()
+                                                            or term.casefold() in connection_id.casefold()
+                                                            or valid_description and term.casefold() in description.casefold()):
+                                                        label = description if valid_description and description.strip() else 'Lock'
+                                                        found.append((index, host, port, protocol, scope,
+                                                                      ident, connection_id,
+                                                                      label))
+                                            elif scope == 'servers':
+                                                for server in await client.list_servers(UUID(ident)):
+                                                    try:
+                                                        server_id = str(UUID(str(server['server'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    server_name = server.get('name', '')
+                                                    valid_name = _search_text(server_name) and bool(server_name.strip())
+                                                    server_host = server.get('host_name', '')
+                                                    valid_host = _search_text(server_host) and bool(server_host.strip())
+                                                    if (term.casefold() in server_id.casefold()
+                                                            or valid_name and term.casefold() in server_name.casefold()
+                                                            or valid_host and term.casefold() in server_host.casefold()):
+                                                        found.append((index, host, port, protocol, 'server', ident,
+                                                                      server_id, server_name if valid_name else
+                                                                      server_host if valid_host and server_host else 'Unnamed server'))
+                                            elif scope == 'processes':
+                                                for process in await client.list_processes(UUID(ident)):
+                                                    try:
+                                                        process_id = str(UUID(str(process['process'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    pid = process.get('pid')
+                                                    valid_pid = (type(pid) is str and pid.isascii()
+                                                                 and pid.isdecimal() and len(pid) <= 20)
+                                                    process_host = process.get('host', '')
+                                                    if (isinstance(pid, str) and valid_pid
+                                                            and term.casefold() in pid.casefold()
+                                                            or term.casefold() in process_id.casefold()
+                                                            or _search_text(process_host)
+                                                            and term.casefold() in process_host.casefold()):
+                                                        label = f'PID {pid}' if valid_pid else 'Working process'
+                                                        found.append((index, host, port, protocol, 'process', ident,
+                                                                      process_id, label))
+                                            elif scope == 'sessions':
+                                                for session in await client.list_sessions(UUID(ident)):
+                                                    try:
+                                                        session_id = str(UUID(str(session['session_id'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    user = session.get('user_name', '')
+                                                    valid_user = _search_text(user) and bool(user.strip())
+                                                    number = session.get('id')
+                                                    number_matches = (type(number) is int and number >= 0
+                                                                      and term == str(number))
+                                                    if (number_matches or any(isinstance(field, str)
+                                                            and _search_text(field)
+                                                            and term.casefold() in field.casefold()
+                                                            for field in (user, session.get('host'),
+                                                                          session.get('app_id'), session_id))):
+                                                        display = (user if valid_user else
+                                                                   f'Session {number}' if type(number) is int and number >= 0
+                                                                   else 'Session')
+                                                        found.append((index, host, port, protocol, 'session', ident,
+                                                                      session_id, display))
+                                            elif scope == 'profiles':
+                                                for profile in await client.list_profiles(UUID(ident)):
+                                                    if not isinstance(profile, dict):
+                                                        continue
+                                                    name = profile.get('name')
+                                                    if (not isinstance(name, str) or not name or not _search_text(name)):
+                                                        continue
+                                                    if term.casefold() in name.casefold():
+                                                        found.append((index, host, port, protocol, 'profile', ident,
+                                                                      '', name))
+                                            elif scope in SEARCH_PROFILE_ACL:
+                                                acl_type, field = SEARCH_PROFILE_ACL[scope]
+                                                for profile in await client.list_profiles(UUID(ident)):
+                                                    if not isinstance(profile, dict):
+                                                        continue
+                                                    name = profile.get('name')
+                                                    if (not isinstance(name, str) or not name.strip() or not _search_text(name)):
+                                                        continue
+                                                    try:
+                                                        records = await getattr(client, PROFILE_ACL_LISTS[acl_type])(
+                                                            UUID(ident), name)
+                                                        for record in records:
+                                                            if not isinstance(record, dict):
+                                                                continue
+                                                            alias = record.get(field)
+                                                            if (isinstance(alias, str) and alias and _search_text(alias)
+                                                                    and term.casefold() in alias.casefold()):
+                                                                found.append((index, host, port, protocol, scope,
+                                                                              ident, name, alias))
+                                                    except Exception:
+                                                        found.append((index, host, port, protocol, 'error', '', '',
+                                                                      'Unavailable'))
+                                            elif scope in SEARCH_CLUSTER_GROUPS:
+                                                field, is_uuid = SEARCH_CLUSTER_GROUPS[scope]
+                                                for record in await getattr(client, 'list_' + scope)(UUID(ident)):
+                                                    try:
+                                                        value = record[field]
+                                                        if is_uuid:
+                                                            value = str(UUID(str(value)))
+                                                        elif (not isinstance(value, str) or not value or
+                                                              '\x00' in value or len(value.encode('utf-8')) > 1024):
+                                                            continue
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    if scope == 'managers':
+                                                        manager_host = record.get('host', '')
+                                                        valid_host = _search_text(manager_host) and bool(manager_host.strip())
+                                                        fields = (value, manager_host, record.get('descr', ''),
+                                                                  record.get('pid', ''))
+                                                        label = manager_host if valid_host and manager_host else 'Cluster manager'
+                                                    elif scope == 'connections':
+                                                        connection_host = record.get('host', '')
+                                                        valid_host = _search_text(connection_host) and bool(connection_host.strip())
+                                                        fields = (value, connection_host, record.get('application'))
+                                                        number = record.get('conn-id')
+                                                        if type(number) is int and number >= 0 and term == str(number):
+                                                            fields += (str(number),)
+                                                        label = (connection_host if valid_host and connection_host else
+                                                                 f'Connection {number}' if type(number) is int and number >= 0
+                                                                 else 'Connection')
+                                                    else:
+                                                        fields = (value, record.get('descr'))
+                                                        label = value
+                                                    if any(isinstance(field, str) and _search_text(field)
+                                                           and term.casefold() in field.casefold()
+                                                           for field in fields):
+                                                        found.append((index, host, port, protocol, scope, ident,
+                                                                      value, label or value))
+                                            elif scope in ('inventory', 'infobases'):
+                                                for base in await client.list_infobases(UUID(ident)):
+                                                    try:
+                                                        base_id = str(UUID(str(base['infobase'])))
+                                                    except (KeyError, TypeError, ValueError):
+                                                        continue
+                                                    base_name = base.get('name', '')
+                                                    valid_name = _search_text(base_name) and bool(base_name.strip())
+                                                    if (term.casefold() in base_id.casefold()
+                                                            or valid_name and term.casefold() in base_name.casefold()):
+                                                        found.append((index, host, port, protocol, 'infobase', ident,
+                                                                      base_id, base_name if valid_name else 'Unnamed infobase'))
+                                        except Exception:
+                                            found.append((index, host, port, protocol, 'error', '', '', 'Unavailable'))
+                    except Exception:
+                        # No server exception text in HTML (may contain private connection data).
+                        found.append((index, host, port, protocol, 'error', '', '', 'Unavailable'))
+                    return found
+
+                groups = await asyncio.gather(*(query_server(index, *endpoint)
+                                                for index, endpoint in tuple(servers.items())))
+                return [row for group in groups for row in group]
+
+            rows = asyncio.run(inventory()) if term else []
+            items = []
+            for index, host, port, protocol, kind, cluster, base, name in rows:
+                address = html.escape(f'{host}:{port}')
+                label = html.escape(name)
+                if kind == 'error':
+                    items.append(f'<tr><td>{address}</td><td>{html.escape(protocol)}</td>'
+                                 '<td>Unavailable</td><td>—</td></tr>')
+                    continue
+                target = f'/ras/{index}/clusters/{cluster}'
+                if kind == 'agent-admins':
+                    target = f'/ras/{index}/agent/admins'
+                elif kind == 'cluster-admins':
+                    target += '/admins'
+                elif kind == 'services':
+                    target += '/services'
+                elif kind == 'locks':
+                    target += f'/connections/{base}/locks'
+                elif kind == 'infobase':
+                    target += f'/infobases/{base}/summary'
+                elif kind == 'server':
+                    target += f'/servers/{base}'
+                elif kind == 'process':
+                    target += f'/processes/{base}'
+                elif kind == 'session':
+                    target += f'/sessions/{base}'
+                elif kind == 'profile':
+                    target += '/profiles/overview?' + urlencode({'name': name})
+                elif kind in SEARCH_PROFILE_ACL:
+                    target += (f'/profiles/{quote(base, safe="")}/acl/{SEARCH_PROFILE_ACL[kind][0]}'
+                               '?' + urlencode({'name': name}))
+                elif kind in SEARCH_CLUSTER_GROUPS:
+                    target += f'/{kind}/{quote(base, safe="")}'
+                elif kind == 'transfer-directories':
+                    target += f'/servers/{base}/transfer-directories?' + urlencode({'service_name': name})
+                elif kind in SEARCH_SERVER_GROUPS:
+                    server_id, record_id = base.split('/')
+                    target += f'/servers/{server_id}/{kind}/{record_id}'
+                attributes = {'ras': f'{host}:{port}', 'protocol': protocol, 'type': kind,
+                              'object': name, 'cluster': cluster or '—'}
+                inspection = ''.join(f' data-inspect-{key}="{html.escape(value, quote=True)}"'
+                                     for key, value in attributes.items())
+                items.append(f'<tr class="selectable-row" tabindex="0" aria-selected="false"{inspection}>'
+                             f'<td>{address}</td><td>{html.escape(protocol)}</td>'
+                             f'<td>{html.escape(SEARCH_KIND_NAMES.get(kind, SECTION_NAMES.get(kind, kind)))}</td><td><a href="{html.escape(target, quote=True)}">'
+                             f'{label}</a></td></tr>')
+            body = ('<section><h1>Поиск по серверам RAS</h1><p><a href="/ras">Серверы RAS</a></p>'
+                    '<form method="get" action="/ras/search"><label>Имя, пользователь, PID или UUID '
+                    f'<input name="q" value="{html.escape(term, quote=True)}" maxlength="100"></label>'
+                    '<label>Область поиска <select name="scope"><option value="inventory"' +
+                    (' selected' if scope == 'inventory' else '') + '>Кластеры и базы</option>'
+                    '<option value="clusters"' + (' selected' if scope == 'clusters' else '') +
+                    '>Только кластеры</option>'
+                    '<option value="infobases"' + (' selected' if scope == 'infobases' else '') +
+                    '>Только базы</option>'
+                    '<option value="agent-admins"' + (' selected' if scope == 'agent-admins' else '') +
+                    '>Администраторы агента</option>'
+                    '<option value="cluster-admins"' + (' selected' if scope == 'cluster-admins' else '') +
+                    '>Администраторы кластера</option>'
+                    '<option value="services"' + (' selected' if scope == 'services' else '') +
+                    '>Сервисы кластера</option>'
+                    '<option value="locks"' + (' selected' if scope == 'locks' else '') +
+                    '>Блокировки кластера</option>'
+                    '<option value="servers"' + (' selected' if scope == 'servers' else '') +
+                    '>Кластеры и рабочие серверы</option>'
+                    '<option value="processes"' + (' selected' if scope == 'processes' else '') +
+                    '>Кластеры и процессы</option>'
+                    '<option value="sessions"' + (' selected' if scope == 'sessions' else '') +
+                    '>Кластеры и сеансы</option>'
+                    '<option value="profiles"' + (' selected' if scope == 'profiles' else '') +
+                    '>Кластеры и профили безопасности</option>' +
+                    ''.join(f'<option value="{kind}"' + (' selected' if scope == kind else '') +
+                            f'>{SEARCH_KIND_NAMES.get(kind, SECTION_NAMES.get(kind, kind))}</option>'
+                            for kind in SEARCH_PROFILE_ACL) +
+                    ''.join(f'<option value="{kind}"' + (' selected' if scope == kind else '') +
+                            f'>Кластеры и {SECTION_NAMES.get(kind, kind)}</option>' for kind in SEARCH_CLUSTER_GROUPS) +
+                    ''.join(f'<option value="{kind}"' + (' selected' if scope == kind else '') +
+                            f'>Серверы и {SECTION_NAMES.get(kind, kind)}</option>' for kind in SEARCH_SERVER_GROUPS) +
+                    '<option value="transfer-directories"' +
+                    (' selected' if scope == 'transfer-directories' else '') +
+                    '>Серверы и каталоги переноса</option>' +
+                    '</select></label>'
+                    '<button>Найти</button></form><div class="table-scroll">'
+                    '<table class="inventory-grid"><thead><tr><th scope="col">RAS</th>'
+                    '<th scope="col">Протокол</th><th scope="col">Тип</th>'
+                    '<th scope="col">Объект</th></tr></thead><tbody>' + ''.join(items) + '</tbody></table></div>'
+                    f'<p>Найдено объектов: {len(items)}</p></section>')
+            detail = ('<h2>Выбор</h2><p>Выберите объект в таблице для просмотра подробностей.</p>'
+                      '<h2>Область поиска</h2><p>' +
+                      html.escape(SEARCH_KIND_NAMES.get(scope, SECTION_NAMES.get(scope, scope))) + '</p>')
+            return page(environ, start_response, body, inspector=detail)
+        if path in ('/ras', '/ras/'):
+            if method == 'POST':
+                host_header = environ.get('HTTP_HOST', '')
+                origin = urlsplit(environ.get('HTTP_ORIGIN', ''))
+                if (environ.get('REMOTE_ADDR') not in ('127.0.0.1', '::1') or
+                        not _LOOPBACK.fullmatch(host_header) or origin.scheme != 'http' or
+                        origin.netloc != host_header or origin.path or origin.query or origin.fragment or
+                        environ.get('CONTENT_TYPE', '').split(';', 1)[0] != 'application/x-www-form-urlencoded'):
+                    return page(environ, start_response, '<p>Invalid origin</p>', '403 Forbidden')
+                try:
+                    length = int(environ.get('CONTENT_LENGTH', '-1'))
+                    if not 0 <= length <= 2048:
+                        raise ValueError('length')
+                    raw = environ['wsgi.input'].read(length)
+                    if len(raw) != length:
+                        raise ValueError('truncated')
+                    fields = parse_qs(raw.decode('utf-8'), strict_parsing=True)
+                    if set(fields) != {'csrf_token', 'host', 'port', 'protocol'} or any(
+                            len(values) != 1 for values in fields.values()):
+                        raise ValueError('fields')
+                    if not hmac.compare_digest(fields['csrf_token'][0], csrf_token):
+                        raise ValueError('token')
+                    host, port, protocol = (fields[name][0] for name in ('host', 'port', 'protocol'))
+                    if (not _HOST.fullmatch(host) or not port.isascii() or not port.isdecimal() or
+                            not 1 <= int(port) <= 65535 or protocol not in ('16.0', '10.0', 'auto') or
+                            len(servers) >= 64):
+                        raise ValueError('endpoint')
+                    endpoint = (host, int(port), protocol)
+                    if endpoint not in servers.values():
+                        servers[next_index] = endpoint
+                        next_index += 1
+                except (ValueError, UnicodeError, KeyError):
+                    return page(environ, start_response, '<p>Invalid RAS endpoint</p>', '403 Forbidden')
+            elif method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET, POST')])
+                return [b'']
+            cards = ''.join(f'<tr><td><a href="/ras/{index}/clusters">{html.escape(host)}:{port}'
+                            f'</a></td><td>{html.escape(protocol)}</td><td>Локальное подключение</td><td>'
+                            '<form method="post" action="/ras/remove">'
+                            f'<input type="hidden" name="csrf_token" value="{html.escape(csrf_token, quote=True)}">'
+                            f'<input type="hidden" name="index" value="{index}">'
+                            f'<input type="hidden" name="confirm" value="{html.escape(f"{host}:{port}/{protocol}", quote=True)}">'
+                            '<button type="submit" class="danger-button">Удалить</button></form></td></tr>'
+                            for index, (host, port, protocol) in servers.items())
+            body = ('<section><h1>Серверы RAS</h1><p>Выберите подключение для просмотра кластеров и баз. '
+                    '<a href="/ras/search">Поиск по серверам</a> · '
+                    '<a href="/ras/clusters">Все кластеры</a> · '
+                    '<a href="/ras/infobases">Все базы</a> · '
+                    '<a href="/ras/servers">Рабочие серверы</a> · '
+                    '<a href="/ras/processes">Рабочие процессы</a> · '
+                    '<a href="/ras/sessions">Сеансы</a> · '
+                    '<a href="/ras/connections">Соединения</a> · '
+                    '<a href="/ras/locks">Блокировки</a> · '
+                    '<a href="/ras/services">Сервисы</a> · '
+                    '<a href="/ras/profiles">Профили безопасности</a> · '
+                    '<a href="/ras/administrators?kind=agent-admins">Администраторы агента</a> · '
+                    '<a href="/ras/administrators?kind=cluster-admins">Администраторы кластера</a> · '
+                    '<a href="/ras/cluster-inventory?kind=managers">Менеджеры</a> · '
+                    '<a href="/ras/cluster-inventory?kind=counters">Счётчики</a> · '
+                    '<a href="/ras/cluster-inventory?kind=limits">Ограничения</a> · '
+                    '<a href="/ras/server-inventory?kind=rules">Правила</a> · '
+                    '<a href="/ras/server-inventory?kind=service-settings">Настройки сервисов</a> · '
+                    '<a href="/ras/server-inventory?kind=transfer-directories">Каталоги переноса</a></p>'
+                    '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                    '<th>Сервер RAS</th><th>Протокол</th><th>Режим</th><th>Действия</th>'
+                    '</tr></thead><tbody>' + cards + '</tbody></table></div><form method="post" action="/ras">'
+                    '<h2><span class="ui-icon" aria-hidden="true">＋</span> Добавить сервер RAS</h2><input type="hidden" name="csrf_token" value="' +
+                    html.escape(csrf_token, quote=True) + '"><label>Адрес <input name="host" required></label>'
+                    '<label>Порт <input name="port" type="number" min="1" max="65535" value="1545" required></label>'
+                    '<label>Протокол <select name="protocol"><option>16.0</option><option>10.0</option><option>auto</option>'
+                    '</select></label><button>Добавить сервер</button></form></section>')
+            return page(environ, start_response, body,
+                        inspector='<h2>Рабочая область</h2><dl><dt>Режим</dt><dd>Только чтение</dd>'
+                        f'<dt>Серверов</dt><dd>{len(servers)}</dd></dl>'
+                        '<p>Подключения хранятся только в памяти. Учётные данные не сохраняются.</p>')
+        match = _ENDPOINT.fullmatch(path)
+        if match:
+            if method != 'GET':
+                start_response('405 Method Not Allowed', [('Allow', 'GET')])
+                return [b'']
+            if len(match.group(1)) > 16:
+                start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                return [b'Unknown RAS server']
+            index = int(match.group(1))
+            if index not in servers:
+                start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                return [b'Unknown RAS server']
+            host, port, protocol = servers[index]
+            server_tree = re.fullmatch(
+                r'clusters/([0-9a-fA-F-]{36})/servers/tree', match.group(2))
+            profile_tree = re.fullmatch(
+                r'clusters/([0-9a-fA-F-]{36})/profiles/tree', match.group(2))
+            process_tree = re.fullmatch(
+                r'clusters/([0-9a-fA-F-]{36})/servers/([0-9a-fA-F-]{36})/processes/tree',
+                match.group(2))
+            connection_tree = re.fullmatch(
+                r'clusters/([0-9a-fA-F-]{36})/servers/([0-9a-fA-F-]{36})/processes/'
+                r'([0-9a-fA-F-]{36})/connections/tree', match.group(2))
+            if match.group(2) == 'tree' or server_tree or profile_tree or process_tree or connection_tree:
+                def has_uuid(rows, field, selected):
+                    for row in rows:
+                        try:
+                            if str(UUID(str(row[field]))) == selected:
+                                return True
+                        except (KeyError, TypeError, ValueError):
+                            continue
+                    return False
+
+                selected_cluster = None
+                selected_server = None
+                selected_process = None
+                tree_match = server_tree or profile_tree or process_tree or connection_tree
+                if tree_match is not None:
+                    try:
+                        selected_cluster = str(UUID(tree_match.group(1)))
+                        if process_tree or connection_tree:
+                            selected_server = str(UUID(tree_match.group(2)))
+                        if connection_tree:
+                            selected_process = str(UUID(connection_tree.group(3)))
+                    except ValueError:
+                        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                        return [b'Unknown cluster']
+                async def load_tree():
+                    result = []
+                    async with asyncio.timeout(SEARCH_ENDPOINT_TIMEOUT):
+                        async with RacClient(host, port, protocol) as client:
+                            for cluster in await client.list_clusters():
+                                try:
+                                    cluster_id = str(UUID(str(cluster['cluster'])))
+                                except (ValueError, KeyError, TypeError):
+                                    continue
+                                bases = []
+                                if selected_cluster is None:
+                                    try:
+                                        for base in await client.list_infobases(UUID(cluster_id)):
+                                            try:
+                                                base_id = str(UUID(str(base['infobase'])))
+                                            except (KeyError, TypeError, ValueError):
+                                                continue
+                                            base_name = safe_tree_name(base.get('name'), 'Unnamed infobase')
+                                            bases.append((base_id, base_name))
+                                    except Exception:
+                                        bases.append((None, 'Unavailable'))
+                                cluster_name = safe_tree_name(cluster.get('name'), 'Unnamed cluster')
+                                result.append((cluster_id, cluster_name, bases))
+                            working_servers = []
+                            profiles = []
+                            profile_error = False
+                            if profile_tree and selected_cluster is not None and any(
+                                    row[0] == selected_cluster for row in result):
+                                try:
+                                    for profile in await client.list_profiles(UUID(selected_cluster)):
+                                        if not isinstance(profile, dict):
+                                            continue
+                                        name = profile.get('name')
+                                        if (isinstance(name, str) and name.strip() and '\x00' not in name
+                                                and safe_tree_name(name, '') == name):
+                                            profiles.append(name)
+                                except Exception:
+                                    profiles = []
+                                    profile_error = True
+                            if selected_cluster is not None and not profile_tree and any(
+                                    row[0] == selected_cluster for row in result):
+                                working_servers = await client.list_servers(UUID(selected_cluster))
+                            processes = []
+                            if selected_server is not None and has_uuid(working_servers, 'server', selected_server):
+                                for process in await client.list_processes(
+                                        UUID(selected_cluster), UUID(selected_server)):
+                                    if not isinstance(process, dict):
+                                        continue
+                                    try:
+                                        UUID(str(process['process']))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    pid = process.get('pid')
+                                    if (type(pid) is not str or not pid.isascii() or not pid.isdecimal()
+                                            or len(pid) > 20):
+                                        process = dict(process, pid='Working process')
+                                    processes.append(process)
+                            connections = []
+                            if selected_process is not None and has_uuid(processes, 'process', selected_process):
+                                for connection in await client.list_connections(
+                                        UUID(selected_cluster), process_id=UUID(selected_process)):
+                                    if not isinstance(connection, dict):
+                                        continue
+                                    try:
+                                        UUID(str(connection['connection']))
+                                    except (KeyError, TypeError, ValueError):
+                                        continue
+                                    connection_host = safe_tree_name(connection.get('host'), 'Connection')
+                                    connections.append(dict(connection, host=connection_host))
+                    return result, working_servers, processes, connections, profiles, profile_error
+
+                try:
+                    clusters, working_servers, processes, connections, profiles, profile_error = asyncio.run(load_tree())
+                except Exception:
+                    clusters = ()
+                    working_servers = ()
+                    processes = ()
+                    connections = ()
+                    profiles = ()
+                    profile_error = False
+                    status = 'Unavailable'
+                else:
+                    status = f'{len(clusters)} clusters'
+                if selected_cluster is not None:
+                    if status == 'Unavailable':
+                        return page(environ, start_response, '<p>RAS unavailable</p>',
+                                    '503 Service Unavailable')
+                    if not any(row[0] == selected_cluster for row in clusters):
+                        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                        return [b'Unknown cluster']
+                    if selected_server is not None and not has_uuid(working_servers, 'server', selected_server):
+                        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                        return [b'Unknown server']
+                    if selected_process is not None and not has_uuid(processes, 'process', selected_process):
+                        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+                        return [b'Unknown process']
+                    from ..read_service import SERVER_LISTS
+                    rows = []
+                    server_nodes = []
+                    for server in working_servers:
+                        try:
+                            server_id = str(UUID(str(server['server'])))
+                        except (KeyError, ValueError, TypeError):
+                            continue
+                        base = f'/ras/{index}/clusters/{selected_cluster}/servers/{server_id}'
+                        server_name = (safe_tree_name(server.get('name'), '') or
+                                       safe_tree_name(server.get('host_name'), '') or 'Unnamed server')
+                        server_nodes.append((server_id, server_name))
+                        label = html.escape(server_name)
+                        links = (f'<a href="{base}">info</a> ' + ' '.join(
+                            f'<a href="{base}/{kind}">{html.escape(kind.replace("-", " "))}</a>'
+                            for kind in ('processes', *SERVER_LISTS)))
+                        attributes = (f'data-inspect-ras="{html.escape(f"{host}:{port}", quote=True)}" '
+                                      f'data-inspect-protocol="{html.escape(protocol, quote=True)}" '
+                                      f'data-inspect-cluster="{selected_cluster}" '
+                                      'data-inspect-type="server" '
+                                      f'data-inspect-object="{html.escape(server_name, quote=True)}"')
+                        rows.append(f'<tr data-searchable-row data-search-key="{server_id}" class="selectable-row" tabindex="0" aria-selected="false" '
+                                    f'{attributes}><td>{label}</td>'
+                                    f'<td>{links}</td></tr>')
+                    body = ('<section><h1>Working servers</h1><p>Cluster ' +
+                            html.escape(next((name for ident, name, _ in clusters if ident == selected_cluster),
+                                             'Unnamed cluster')) + '</p>' + inventory_filter('Working servers') +
+                            '<div class="table-scroll">'
+                            '<table class="inventory-grid"><thead><tr><th>Name</th>'
+                            '<th>Sections</th></tr></thead><tbody>' +
+                            ''.join(rows) + '</tbody></table></div></section>')
+                    if profile_tree:
+                        profile_rows = []
+                        for name in profiles:
+                            profile_url = (f'/ras/{index}/clusters/{selected_cluster}/profiles/'
+                                           f'{quote(name, safe="")}')
+                            overview = (f'/ras/{index}/clusters/{selected_cluster}/profiles/overview?'
+                                        + urlencode({'name': name}))
+                            links = ' '.join(f'<a href="{profile_url}/acl/{kind}">'
+                                             f'{html.escape(kind.title())}</a>' for kind in PROFILE_ACL_LISTS)
+                            attributes = (f'data-inspect-ras="{html.escape(f"{host}:{port}", quote=True)}" '
+                                          f'data-inspect-protocol="{html.escape(protocol, quote=True)}" '
+                                          f'data-inspect-cluster="{selected_cluster}" '
+                                          'data-inspect-type="profile" '
+                                          f'data-inspect-object="{html.escape(name, quote=True)}"')
+                            profile_rows.append(
+                                '<tr data-searchable-row class="selectable-row" tabindex="0" '
+                                f'aria-selected="false" {attributes}><td><a href="{overview}">'
+                                f'{html.escape(name)}</a></td><td>{links}</td></tr>')
+                        body = ('<section><h1>Security profiles</h1><p>Cluster ' +
+                                html.escape(next((name for ident, name, _ in clusters if ident == selected_cluster),
+                                                 'Unnamed cluster')) + '</p>' + inventory_filter('Security profiles') +
+                                '<div class="table-scroll"><table class="inventory-grid">'
+                                '<thead><tr><th>Name</th><th>ACL sections</th></tr></thead><tbody>' +
+                                (('<tr><td>Unavailable</td><td>—</td></tr>') if profile_error else
+                                 ''.join(profile_rows)) + '</tbody></table></div></section>')
+                    process_nodes = []
+                    connection_nodes = []
+                    if selected_server is not None:
+                        process_rows = []
+                        for process in processes:
+                            try:
+                                process_id = str(UUID(str(process['process'])))
+                            except (KeyError, ValueError, TypeError):
+                                continue
+                            pid = str(process.get('pid', ''))
+                            process_nodes.append((process_id, pid))
+                            url = f'/ras/{index}/clusters/{selected_cluster}/processes/{process_id}'
+                            attributes = (f'data-inspect-ras="{html.escape(f"{host}:{port}", quote=True)}" '
+                                          f'data-inspect-protocol="{html.escape(protocol, quote=True)}" '
+                                          f'data-inspect-cluster="{selected_cluster}" '
+                                          'data-inspect-type="process" '
+                                          f'data-inspect-object="{html.escape(pid, quote=True)}"')
+                            process_rows.append(
+                                f'<tr data-searchable-row data-search-key="{process_id}" class="selectable-row" tabindex="0" aria-selected="false" '
+                                f'{attributes}><td><a href="{url}">{html.escape(pid)}</a></td>'
+                                f'<td><a href="{url}/connections">'
+                                'connections</a></td></tr>')
+                        body += ('<section><h2>Processes</h2>' + inventory_filter('Processes') +
+                                 '<div class="table-scroll">'
+                                 '<table class="inventory-grid"><thead><tr><th>PID</th>'
+                                 '<th>Sections</th></tr></thead><tbody>' + ''.join(process_rows) +
+                                 '</tbody></table></div></section>')
+                    if selected_process is not None:
+                        connection_rows = []
+                        for connection in connections:
+                            try:
+                                connection_id = str(UUID(str(connection['connection'])))
+                            except (KeyError, ValueError, TypeError):
+                                continue
+                            connection_host = str(connection.get('host', ''))
+                            connection_nodes.append((connection_id, connection_host))
+                            url = f'/ras/{index}/clusters/{selected_cluster}/connections/{connection_id}'
+                            attributes = (f'data-inspect-ras="{html.escape(f"{host}:{port}", quote=True)}" '
+                                          f'data-inspect-protocol="{html.escape(protocol, quote=True)}" '
+                                          f'data-inspect-cluster="{selected_cluster}" '
+                                          'data-inspect-type="connection" '
+                                          f'data-inspect-object="{html.escape(connection_host, quote=True)}"')
+                            connection_rows.append(
+                                f'<tr data-searchable-row data-search-key="{connection_id}" class="selectable-row" tabindex="0" '
+                                f'aria-selected="false" {attributes}><td><a href="{url}">'
+                                f'{html.escape(connection_host)}</a></td>'
+                                f'<td><a href="{url}/locks">locks</a></td></tr>')
+                        body += ('<section><h2>Connections</h2>' + inventory_filter('Connections') +
+                                 '<div class="table-scroll"><table class="inventory-grid">'
+                                 '<thead><tr><th>Host</th><th>Sections</th></tr></thead>'
+                                 '<tbody>' + ''.join(connection_rows) + '</tbody></table></div></section>')
+                    return page(environ, start_response, body,
+                                expanded_index=index, clusters=clusters,
+                                expanded_cluster=selected_cluster, servers_for_cluster=server_nodes,
+                                expanded_server=selected_server, processes_for_server=process_nodes,
+                                expanded_process=selected_process, connections_for_process=connection_nodes,
+                                profiles_for_cluster=profiles)
+                rows = []
+                for cluster_id, name, bases in clusters:
+                    cluster_url = f'/ras/{index}/clusters/{cluster_id}'
+                    cluster_label = html.escape(name)
+                    attributes = (f'data-inspect-ras="{html.escape(f"{host}:{port}", quote=True)}" '
+                                  f'data-inspect-protocol="{html.escape(protocol, quote=True)}" '
+                                  f'data-inspect-cluster="{cluster_id}"')
+                    rows.append(f'<tr data-searchable-row data-search-key="{cluster_id}" class="selectable-row" tabindex="0" aria-selected="false" '
+                                f'{attributes} data-inspect-type="cluster" '
+                                f'data-inspect-object="{html.escape(name, quote=True)}">'
+                                f'<td><a href="{cluster_url}">{cluster_label}</a></td>'
+                                '<td>Cluster</td></tr>')
+                    for base_id, base_name in bases:
+                        if base_id is None:
+                            rows.append('<tr><td>Unavailable</td><td>Infobases</td></tr>')
+                            continue
+                        base_url = f'{cluster_url}/infobases/{base_id}/summary'
+                        rows.append(f'<tr data-searchable-row data-search-key="{base_id}" class="selectable-row" tabindex="0" aria-selected="false" '
+                                    f'{attributes} data-inspect-type="infobase" '
+                                    f'data-inspect-object="{html.escape(base_name, quote=True)}">'
+                                    f'<td>↳ <a href="{base_url}">{html.escape(base_name)}</a></td>'
+                                    '<td>Infobase</td></tr>')
+                body = ('<section><h1>RAS navigation</h1><p>' + html.escape(f'{host}:{port}') +
+                        ' · ' + html.escape(protocol) + '</p><p>' + status +
+                        '</p><p>Select a cluster or infobase in the tree, or '
+                        f'<a href="/ras/{index}/clusters">open the cluster table</a>.</p>' +
+                        inventory_filter('Clusters and infobases') +
+                        '<div class="table-scroll"><table class="inventory-grid"><thead><tr>'
+                        '<th>Name</th><th>Type</th></tr></thead><tbody>' +
+                        ''.join(rows) + '</tbody></table></div></section>')
+                return page(environ, start_response, body, expanded_index=index, clusters=clusters,
+                            inspector='<h2>Selected RAS</h2><dl><dt>Endpoint</dt><dd>' +
+                            html.escape(f'{host}:{port}') + '</dd><dt>Protocol</dt><dd>' +
+                            html.escape(protocol) + '</dd></dl>')
+            prefix = f'/ras/{index}'
+            scoped = dict(environ, PATH_INFO='/' + match.group(2))
+            # Prefix only local absolute links/forms. External links are never rewritten.
+            def respond(status, headers, exc_info=None):
+                scoped['_response_status'] = status
+                scoped['_response_headers'] = headers
+                return start_response(status, headers, exc_info)
+            chunks = create_app(lambda: RacClient(host, port, protocol),
+                                read_timeout=SEARCH_ENDPOINT_TIMEOUT)(scoped, respond)
+            content_type = next((value for name, value in scoped.get('_response_headers', [])
+                                 if name.lower() == 'content-type'), '')
+            if 'text/html' not in content_type:
+                return chunks
+            scoped_html = b''.join(re.sub(
+                rb'\b(href|action)="/(?!ras(?:/|"))',
+                lambda hit: hit.group(1) + b'="' + prefix.encode() + b'/', chunk)
+                for chunk in chunks)
+            if scoped.get('_response_status') != '200 OK':
+                return [scoped_html]
+            # The read-only dashboard returns a complete document. Reuse only its
+            # generated main content, not its standalone navigation or scripts.
+            _head, marker, rest = scoped_html.partition(b'<main>')
+            content, end, after = rest.rpartition(b'</main>')
+            if not marker or not end or b'</body>' not in after:
+                return [scoped_html]
+            return [render_document('RAS workspace', content.decode('utf-8'),
+                                    workspace_tree=navigation(),
+                                    inspector='<h2>Selected RAS</h2><dl><dt>Endpoint</dt><dd>' +
+                                    html.escape(f'{host}:{port}') + '</dd><dt>Protocol</dt><dd>' +
+                                    html.escape(protocol) + '</dd></dl>').encode('utf-8')]
+        if path in ('/', '/clusters'):
+            return page(environ, start_response,
+                        '<section><h1>RAS workspace</h1><p><a href="/ras">Open servers →</a></p></section>')
+        start_response('404 Not Found', [('Content-Type', 'text/plain')])
+        return [b'Not found']
+
+    return workspace