server.mjs

import { createServer } from 'node:http';
import { createReadStream } from 'node:fs';
import { readFile, readdir, stat, realpath } from 'node:fs/promises';
import { createInterface } from 'node:readline';
import { join, resolve, relative, extname, basename, dirname } from 'node:path';
import { fileURLToPath } from 'node:url';
import { spawn } from 'node:child_process';
import { Readable } from 'node:stream';
import { isIP } from 'node:net';
import chokidar from 'chokidar';
import jschardet from 'jschardet';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const distDir = join(__dirname, 'dist');

// --- Friendly error reporting ---

const ERROR_HINTS = {
  EACCES: {
    title: 'アクセス権限エラー (EACCES)',
    meaning: 'ファイル・ディレクトリ、またはポートへのアクセスが許可されていません。',
    causes: [
      '1024 未満のポート (80, 443 など) を管理者権限なしで使おうとしている',
      '対象ディレクトリやファイルに読み取り権限がない',
    ],
    fixes: [
      '--port 4000 のように 1024 以上のポート番号を指定してください',
      'ls -la <ディレクトリ> で権限を確認してください (自分が読めるか)',
      '別のディレクトリに移動するか、権限を付与してから再実行してください',
    ],
  },
  EADDRINUSE: {
    title: 'ポートが既に使われています (EADDRINUSE)',
    meaning: '指定したポートは他のプロセスが使用中です。',
    causes: [
      '別の docview / 開発サーバが同じポートで起動している',
      '前回の起動プロセスが終了しきれていない',
    ],
    fixes: [
      'docview --port 4001 のように別のポートを指定してください',
      'lsof -i :<port> (macOS/Linux) で使用中のプロセスを特定できます',
      'Windows の場合: netstat -ano | findstr :<port>',
    ],
  },
  ENOENT: {
    title: 'ファイル・ディレクトリが見つかりません (ENOENT)',
    meaning: '指定したパスが存在しません。',
    causes: ['パス名の打ち間違い', 'ファイルが移動・削除された'],
    fixes: [
      'ls で対象のパスが存在するか確認してください',
      '相対パスは現在のディレクトリ (pwd) を基準にします',
      'スペースを含むパスは引用符で囲ってください: docview "My Docs"',
    ],
  },
  EADDRNOTAVAIL: {
    title: 'バインドできないアドレスです (EADDRNOTAVAIL)',
    meaning: '指定したネットワークアドレスがこのマシンで利用できません。',
    causes: ['ホスト名やIPが間違っている', 'ネットワーク設定の問題'],
    fixes: ['localhost または 127.0.0.1 を使用してください'],
  },
  EMFILE: {
    title: 'ファイルディスクリプタが不足しています (EMFILE)',
    meaning: 'OS が許可するオープン可能なファイル数の上限に達しました。',
    causes: ['非常に大量のファイルを監視しようとしている'],
    fixes: [
      'ulimit -n 10240 で上限を引き上げてください (macOS/Linux)',
      'docview <ディレクトリ> でファイル数の少ないディレクトリを指定してください',
    ],
  },
};

function searchUrl(query) {
  return `https://www.google.com/search?q=${encodeURIComponent(query)}`;
}

function formatFriendlyError(err) {
  const code = err && err.code;
  const hint = code && ERROR_HINTS[code];
  const lines = [];
  lines.push('');
  lines.push('  エラーが発生しました');
  lines.push('  ───────────────────────────────');
  if (hint) {
    lines.push(`  種類:  ${hint.title}`);
    lines.push(`  説明:  ${hint.meaning}`);
    lines.push('');
    lines.push('  考えられる原因:');
    hint.causes.forEach((c) => lines.push(`    - ${c}`));
    lines.push('');
    lines.push('  解決方法:');
    hint.fixes.forEach((f) => lines.push(`    - ${f}`));
  } else {
    lines.push(`  ${err && err.message ? err.message : String(err)}`);
    if (code) lines.push(`  コード: ${code}`);
    lines.push('');
    lines.push('  このエラーの意味が分からない場合は、下の検索リンクを開いてみてください。');
  }
  lines.push('');
  lines.push('  この問題の解決策を検索:');
  lines.push(`    ${searchUrl(`node.js ${code || (err && err.message) || 'error'}`)}`);
  if (err && err.message) {
    lines.push('');
    lines.push('  元のエラーメッセージ (そのまま検索にも使えます):');
    lines.push(`    ${err.message}`);
  }
  lines.push('  ───────────────────────────────');
  lines.push('');
  return lines.join('\n');
}

function reportAndExit(err, { exitCode = 1 } = {}) {
  try {
    process.stderr.write(formatFriendlyError(err));
  } catch {
    console.error(err);
  }
  process.exit(exitCode);
}

process.on('uncaughtException', (err) => reportAndExit(err));
process.on('unhandledRejection', (err) => reportAndExit(err instanceof Error ? err : new Error(String(err))));

// --- Encoding detection helpers ---

const ENCODING_MAP = {
  'utf-8': 'utf-8',
  'ascii': 'utf-8',
  'utf8': 'utf-8',
  'shift_jis': 'shift_jis',
  'shiftjis': 'shift_jis',
  'shift-jis': 'shift_jis',
  'windows-31j': 'shift_jis',
  'cp932': 'shift_jis',
  'euc-jp': 'euc-jp',
  'eucjp': 'euc-jp',
  'iso-2022-jp': 'iso-2022-jp',
  'euc-kr': 'euc-kr',
  'big5': 'big5',
  'gb2312': 'gbk',
  'gb18030': 'gb18030',
  'gbk': 'gbk',
  'windows-1252': 'windows-1252',
  'iso-8859-1': 'windows-1252',
  'iso-8859-2': 'iso-8859-2',
  'ibm866': 'ibm866',
  'koi8-r': 'koi8-r',
};

/**
 * Detect encoding from a buffer and return a TextDecoder-compatible label.
 */
function detectEncoding(buf) {
  // BOM detection
  if (buf[0] === 0xEF && buf[1] === 0xBB && buf[2] === 0xBF) return 'utf-8';
  if (buf[0] === 0xFF && buf[1] === 0xFE) return 'utf-16le';
  if (buf[0] === 0xFE && buf[1] === 0xFF) return 'utf-16be';

  const detected = jschardet.detect(buf);
  if (!detected || !detected.encoding) return 'utf-8';
  const key = detected.encoding.toLowerCase().replace(/[_\s]/g, match => match === '_' ? '_' : '-');
  return ENCODING_MAP[key] || 'utf-8';
}

/**
 * Read a file and decode to UTF-8 string, auto-detecting encoding.
 */
async function readFileText(filePath) {
  const buf = await readFile(filePath);
  const encoding = detectEncoding(buf);
  if (encoding === 'utf-8') return buf.toString('utf-8');
  const decoder = new TextDecoder(encoding);
  return decoder.decode(buf);
}

/**
 * Create a Readable stream of UTF-8 text from a file, auto-detecting encoding.
 * For UTF-8 files, uses createReadStream directly.
 * For non-UTF-8 files, reads the entire file, decodes, and wraps as a stream.
 */
async function createTextReadStream(filePath) {
  // Sample first 4KB to detect encoding
  const { open } = await import('node:fs/promises');
  const fh = await open(filePath, 'r');
  try {
    const sample = Buffer.alloc(4096);
    const { bytesRead } = await fh.read(sample, 0, 4096, 0);
    const encoding = detectEncoding(sample.subarray(0, bytesRead));
    if (encoding === 'utf-8') {
      return createReadStream(filePath, { encoding: 'utf-8' });
    }
    // Non-UTF-8: read full file, decode, return as stream
    const buf = await readFile(filePath);
    const text = new TextDecoder(encoding).decode(buf);
    return Readable.from([text]);
  } finally {
    await fh.close();
  }
}

// Parse CLI args
const args = process.argv.slice(2);
let targetDir = process.cwd();
let initialFile = null;
let port = 4000;
let remoteEnabled = true;
let allowPrivateRemote = false;
let remoteMaxSize = 5 * 1024 * 1024; // 5 MB default
// Default: relaxed TLS so self-signed / corporate-MITM CAs don't block fetches.
// Users who want strict verification can opt in with --remote-strict-tls.
let remoteInsecureTls = true;

for (let i = 0; i < args.length; i++) {
  if (args[i] === '--port' || args[i] === '-p') {
    const raw = args[++i];
    // Strict integer match: reject "4e3", "1.5", "80abc", empty, etc.
    if (typeof raw !== 'string' || !/^\d+$/.test(raw)) {
      reportAndExit(Object.assign(
        new Error(`ポート番号が不正です: "${raw}" (1〜65535 の整数を指定してください)`),
        { code: 'EINVALIDPORT' },
      ));
    }
    const parsed = Number(raw);
    if (parsed < 1 || parsed > 65535) {
      reportAndExit(Object.assign(
        new Error(`ポート番号が範囲外です: "${raw}" (1〜65535 の整数を指定してください)`),
        { code: 'EINVALIDPORT' },
      ));
    }
    port = parsed;
  } else if (args[i] === '--no-remote') {
    remoteEnabled = false;
  } else if (args[i] === '--allow-private-remote') {
    allowPrivateRemote = true;
  } else if (args[i] === '--remote-max-size') {
    const raw = args[++i];
    if (typeof raw !== 'string' || !/^\d+$/.test(raw)) {
      reportAndExit(Object.assign(
        new Error(`--remote-max-size の値が不正です: "${raw}" (バイト数を整数で指定してください)`),
        { code: 'EINVALIDREMOTESIZE' },
      ));
    }
    remoteMaxSize = Number(raw);
  } else if (args[i] === '--remote-strict-tls') {
    remoteInsecureTls = false;
  } else if (args[i] === '--remote-insecure-tls') {
    // No-op — insecure is already the default. Retained so old invocations
    // don't fail.
    remoteInsecureTls = true;
  } else if (!args[i].startsWith('-')) {
    const resolved = resolve(args[i]);
    try {
      const s = await stat(resolved);
      if (s.isFile()) {
        targetDir = dirname(resolved);
        initialFile = basename(resolved);
      } else {
        targetDir = resolved;
      }
    } catch {
      // Path doesn't exist yet — treat as directory
      targetDir = resolved;
    }
  }
}

const SUPPORTED_EXTENSIONS = new Set([
  // Markdown
  '.md', '.markdown', '.mdx', '.txt',
  // Data
  '.json', '.jsonl', '.ndjson', '.yaml', '.yml', '.csv', '.tsv',
  // Config
  '.toml', '.ini', '.conf', '.env', '.cfg', '.properties',
  // Logs
  '.log',
  // Images
  '.png', '.jpg', '.jpeg', '.gif', '.svg', '.webp', '.bmp', '.ico',
  // Videos (Phase 1 — see docs/design/video-support.md)
  '.mp4', '.m4v', '.webm', '.ogv', '.mov',
]);

const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.svg', '.webp', '.bmp', '.ico']);
const VIDEO_EXTENSIONS = new Set(['.mp4', '.m4v', '.webm', '.ogv', '.mov']);
const SEARCH_CONTEXT_LINES = 20;

// --- Remote URL fetching (Phase 3) ---
// Primary gate: URL path extension must be in SUPPORTED_EXTENSIONS.
// Secondary gate: Content-Type must be in REMOTE_MIME_ALLOW (used when URL has no / unsupported ext).
// Hard deny: Content-Type in REMOTE_MIME_DENY is rejected even if the extension is allowed.
const REMOTE_MIME_ALLOW = new Set([
  'text/markdown', 'text/x-markdown', 'text/plain',
  'application/json', 'application/yaml', 'application/x-yaml',
  'text/yaml', 'text/x-yaml',
  'text/csv', 'text/tab-separated-values',
  'application/x-ndjson', 'application/jsonl',
  'application/toml', 'text/x-toml', 'text/x-ini', 'text/x-properties',
  'image/png', 'image/jpeg', 'image/gif', 'image/svg+xml',
  'image/webp', 'image/bmp', 'image/x-icon', 'image/vnd.microsoft.icon',
]);
const REMOTE_MIME_DENY = new Set([
  'text/html', 'application/xhtml+xml',
  'text/javascript', 'application/javascript', 'application/x-javascript',
]);

function isPrivateIPv4(ip) {
  const parts = ip.split('.').map(Number);
  if (parts.length !== 4 || parts.some((p) => !Number.isFinite(p) || p < 0 || p > 255)) return true;
  const [a, b] = parts;
  if (a === 0) return true;             // "this network"
  if (a === 10) return true;            // RFC1918
  if (a === 127) return true;           // loopback
  if (a === 169 && b === 254) return true;  // link-local (AWS metadata etc.)
  if (a === 172 && b >= 16 && b <= 31) return true;  // RFC1918
  if (a === 192 && b === 168) return true;           // RFC1918
  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT RFC6598
  if (a >= 224) return true;            // multicast / reserved
  return false;
}

function isPrivateIPv6(ip) {
  const lower = ip.toLowerCase();
  // Normalize IPv6 like ::ffff:127.0.0.1 to IPv4 form
  const v4Mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
  if (v4Mapped) return isPrivateIPv4(v4Mapped[1]);
  if (lower === '::1' || lower === '::') return true;
  if (lower.startsWith('fe80:') || lower.startsWith('fe80')) return true; // link-local
  if (lower.startsWith('fc') || lower.startsWith('fd')) return true;      // ULA
  if (lower.startsWith('ff')) return true;                                 // multicast
  return false;
}

function isPrivateAddress(ip, family) {
  if (family === 6) return isPrivateIPv6(ip);
  return isPrivateIPv4(ip);
}

function normalizeContentType(ct) {
  return (ct || '').split(';')[0].trim().toLowerCase();
}

/**
 * Fetch a remote URL with SSRF and content-type guards.
 * Re-resolves DNS on every hop (original + redirects) to prevent rebinding.
 *
 * Returns one of:
 *   { status: 200, body: Buffer, contentType, sourceUrl, lastModified }
 *   { status, error }   // any error condition
 */
async function fetchRemoteUrl(rawUrl, config, hopsLeft = 3) {
  const { maxSize, allowPrivate, insecureTls = false, timeoutMs = 5000 } = config;

  let urlObj;
  try { urlObj = new URL(rawUrl); } catch {
    return { status: 400, error: 'Invalid URL' };
  }
  if (urlObj.protocol !== 'http:' && urlObj.protocol !== 'https:') {
    return { status: 400, error: `Unsupported protocol: ${urlObj.protocol}` };
  }

  const ext = extname(urlObj.pathname).toLowerCase();
  const extAllowed = ext.length > 0 && SUPPORTED_EXTENSIONS.has(ext);
  const hasExt = ext.length > 0;
  if (hasExt && !extAllowed) {
    return { status: 415, error: `Unsupported file extension: ${ext}` };
  }

  if (!urlObj.hostname) {
    return { status: 400, error: 'URL has no hostname' };
  }

  // DNS lookup (re-done for every hop — guards against rebinding)
  let address, family;
  try {
    const { lookup } = await import('node:dns/promises');
    const result = await lookup(urlObj.hostname, { verbatim: true });
    address = result?.address;
    family = result?.family;
  } catch (err) {
    return { status: 502, error: `DNS lookup failed for ${urlObj.hostname}: ${err.message}` };
  }
  if (typeof address !== 'string' || !address) {
    return { status: 502, error: `DNS lookup returned no address for ${urlObj.hostname}` };
  }
  const ipVersion = isIP(address);
  if (ipVersion === 0) {
    return { status: 502, error: `DNS lookup returned invalid IP for ${urlObj.hostname}: ${address}` };
  }
  // Trust isIP over the DNS-reported family — Node has surfaced family
  // values outside {4, 6} in rare environments, which breaks net.connect.
  const numericFamily = ipVersion === 6 ? 6 : 4;

  if (!allowPrivate && isPrivateAddress(address, numericFamily)) {
    return { status: 403, error: `Refusing to fetch private/loopback address (${address})` };
  }

  const lib = urlObj.protocol === 'https:' ? await import('node:https') : await import('node:http');
  // Connect directly to the resolved IP so Node skips its own DNS lookup —
  // this closes the rebinding window between our check and the connect call
  // without needing a custom `lookup` hook (which has been unreliable across
  // Node versions). The Host header keeps the origin server's virtual host
  // routing intact, and servername drives TLS SNI.
  const port = urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80);
  const hostHeader = urlObj.port ? `${urlObj.hostname}:${urlObj.port}` : urlObj.hostname;
  const connectHost = numericFamily === 6 ? `[${address}]` : address;

  return new Promise((resolve) => {
    const reqOptions = {
      method: 'GET',
      host: connectHost,
      path: urlObj.pathname + urlObj.search,
      port,
      headers: {
        // Fresh request — no cookies / auth leakage
        'Host': hostHeader,
        'User-Agent': 'DocView-Remote/1.0',
        'Accept': '*/*',
        'Accept-Encoding': 'identity',
      },
      timeout: timeoutMs,
      servername: urlObj.hostname, // TLS SNI
    };
    if (urlObj.protocol === 'https:' && insecureTls) {
      // User opted into skipping cert verification — common when operating
      // behind a corporate TLS-inspecting proxy. Scope is per-request only.
      reqOptions.rejectUnauthorized = false;
    }

    const req = lib.request(reqOptions, (remoteRes) => {
      const status = remoteRes.statusCode ?? 502;

      // Manual redirect handling — re-validate at every hop
      if (status >= 300 && status < 400 && remoteRes.headers.location) {
        remoteRes.resume();
        if (hopsLeft <= 0) {
          resolve({ status: 502, error: 'Too many redirects' });
          return;
        }
        let nextUrl;
        try { nextUrl = new URL(remoteRes.headers.location, rawUrl).href; }
        catch { resolve({ status: 502, error: 'Invalid redirect target' }); return; }
        resolve(fetchRemoteUrl(nextUrl, config, hopsLeft - 1));
        return;
      }

      if (status < 200 || status >= 300) {
        remoteRes.resume();
        resolve({ status: 502, error: `Remote returned ${status}` });
        return;
      }

      const ct = normalizeContentType(remoteRes.headers['content-type']);
      if (ct && REMOTE_MIME_DENY.has(ct)) {
        remoteRes.resume();
        resolve({ status: 415, error: `Content-Type ${ct} is not allowed` });
        return;
      }
      // If no extension signal, require MIME allow-list match
      if (!extAllowed) {
        if (!ct || !REMOTE_MIME_ALLOW.has(ct)) {
          remoteRes.resume();
          resolve({ status: 415, error: ct ? `Content-Type ${ct} is not in the allow list` : 'Missing Content-Type' });
          return;
        }
      }

      const lengthHeader = remoteRes.headers['content-length'];
      if (lengthHeader && Number(lengthHeader) > maxSize) {
        remoteRes.resume();
        resolve({ status: 413, error: `Remote content exceeds ${maxSize} bytes` });
        return;
      }

      const chunks = [];
      let total = 0;
      remoteRes.on('data', (chunk) => {
        total += chunk.length;
        if (total > maxSize) {
          remoteRes.destroy();
          resolve({ status: 413, error: `Remote content exceeds ${maxSize} bytes` });
          return;
        }
        chunks.push(chunk);
      });
      remoteRes.on('end', () => {
        resolve({
          status: 200,
          body: Buffer.concat(chunks),
          contentType: remoteRes.headers['content-type'] || 'application/octet-stream',
          sourceUrl: urlObj.href,
          lastModified: remoteRes.headers['last-modified'] || null,
        });
      });
      remoteRes.on('error', (err) => resolve({ status: 502, error: `Stream error: ${err.message}` }));
    });

    req.on('timeout', () => { req.destroy(); resolve({ status: 504, error: 'Remote request timed out' }); });
    req.on('error', (err) => resolve({ status: 502, error: `Request error: ${err.message}` }));
    req.end();
  });
}

const IMAGE_MIME = {
  '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
  '.gif': 'image/gif', '.svg': 'image/svg+xml', '.webp': 'image/webp',
  '.bmp': 'image/bmp', '.ico': 'image/x-icon',
};

const VIDEO_MIME = {
  '.mp4': 'video/mp4',
  '.m4v': 'video/mp4',
  '.webm': 'video/webm',
  '.ogv': 'video/ogg',
  '.mov': 'video/quicktime',
};

/**
 * Parse an HTTP Range header against a known total size.
 *
 * Supports:
 *   - bytes=START-END   inclusive byte range
 *   - bytes=START-      from START to end of file
 *   - bytes=-SUFFIX     last SUFFIX bytes of file
 *
 * Returns { start, end } (both inclusive) or null when the range is malformed
 * or unsatisfiable. Caller is responsible for emitting 416 vs 200 vs 206.
 */
function parseRange(header, total) {
  const m = /^bytes=(\d*)-(\d*)$/.exec(header || '');
  if (!m) return null;
  const startStr = m[1];
  const endStr = m[2];
  let start = startStr === '' ? null : parseInt(startStr, 10);
  let end = endStr === '' ? null : parseInt(endStr, 10);
  if (start === null && end === null) return null;
  if (start === null) {
    // Suffix length form: bytes=-SUFFIX
    if (end === 0) return null; // ambiguous — treat as unsatisfiable
    start = Math.max(0, total - end);
    end = total - 1;
  }
  if (end === null || end >= total) end = total - 1;
  if (!Number.isFinite(start) || !Number.isFinite(end)) return null;
  if (start < 0 || start > end || start >= total) return null;
  return { start, end };
}

// --- Minimal ZIP writer (STORE method, no external deps) ---
// Produces a standards-compliant .zip archive in memory from a list of
// { name: string, data: Buffer } entries. Uses method=0 (stored) so there
// is no deflate cost; image files are already compressed.

const CRC32_TABLE = (() => {
  const t = new Uint32Array(256);
  for (let i = 0; i < 256; i++) {
    let c = i;
    for (let k = 0; k < 8; k++) c = (c & 1) ? (0xEDB88320 ^ (c >>> 1)) : (c >>> 1);
    t[i] = c >>> 0;
  }
  return t;
})();

function crc32(buf) {
  let c = 0xFFFFFFFF;
  for (let i = 0; i < buf.length; i++) {
    c = (c >>> 8) ^ CRC32_TABLE[(c ^ buf[i]) & 0xFF];
  }
  return (c ^ 0xFFFFFFFF) >>> 0;
}

function buildZip(entries) {
  const locals = [];
  const centrals = [];
  let offset = 0;

  for (const entry of entries) {
    const nameBuf = Buffer.from(entry.name, 'utf8');
    const data = entry.data;
    const crc = crc32(data);
    const size = data.length;

    const lfh = Buffer.alloc(30);
    lfh.writeUInt32LE(0x04034b50, 0);      // local file header signature
    lfh.writeUInt16LE(20, 4);              // version needed
    lfh.writeUInt16LE(0x0800, 6);          // general purpose flag (UTF-8 name)
    lfh.writeUInt16LE(0, 8);               // method = store
    lfh.writeUInt16LE(0, 10);              // mod time
    lfh.writeUInt16LE(0x21, 12);           // mod date (1980-01-01)
    lfh.writeUInt32LE(crc, 14);
    lfh.writeUInt32LE(size, 18);           // compressed size
    lfh.writeUInt32LE(size, 22);           // uncompressed size
    lfh.writeUInt16LE(nameBuf.length, 26);
    lfh.writeUInt16LE(0, 28);              // extra field length
    locals.push(lfh, nameBuf, data);

    const cdh = Buffer.alloc(46);
    cdh.writeUInt32LE(0x02014b50, 0);      // central dir header signature
    cdh.writeUInt16LE(0x031E, 4);          // version made by (UNIX + 3.0)
    cdh.writeUInt16LE(20, 6);              // version needed
    cdh.writeUInt16LE(0x0800, 8);          // general purpose flag
    cdh.writeUInt16LE(0, 10);              // method
    cdh.writeUInt16LE(0, 12);              // mod time
    cdh.writeUInt16LE(0x21, 14);           // mod date
    cdh.writeUInt32LE(crc, 16);
    cdh.writeUInt32LE(size, 20);
    cdh.writeUInt32LE(size, 24);
    cdh.writeUInt16LE(nameBuf.length, 28);
    cdh.writeUInt16LE(0, 30);              // extra length
    cdh.writeUInt16LE(0, 32);              // comment length
    cdh.writeUInt16LE(0, 34);              // disk number start
    cdh.writeUInt16LE(0, 36);              // internal attrs
    cdh.writeUInt32LE(0, 38);              // external attrs
    cdh.writeUInt32LE(offset, 42);         // LFH offset
    centrals.push(cdh, nameBuf);

    offset += lfh.length + nameBuf.length + data.length;
  }

  const centralSize = centrals.reduce((s, b) => s + b.length, 0);
  const eocd = Buffer.alloc(22);
  eocd.writeUInt32LE(0x06054b50, 0);       // end of central dir signature
  eocd.writeUInt16LE(0, 4);                // disk number
  eocd.writeUInt16LE(0, 6);                // disk with central dir
  eocd.writeUInt16LE(entries.length, 8);   // entries on this disk
  eocd.writeUInt16LE(entries.length, 10);  // total entries
  eocd.writeUInt32LE(centralSize, 12);     // central dir size
  eocd.writeUInt32LE(offset, 16);          // central dir offset
  eocd.writeUInt16LE(0, 20);               // comment length

  return Buffer.concat([...locals, ...centrals, eocd]);
}

// SSE clients
const sseClients = new Set();

// File tree builder
async function buildTree(dir, base = dir) {
  const entries = await readdir(dir, { withFileTypes: true });
  const items = [];

  for (const entry of entries) {
    if (entry.name === 'node_modules' || entry.name === '.git') continue;
    // Skip hidden dirs but allow hidden files with supported extensions (e.g. .env)
    if (entry.isDirectory() && entry.name.startsWith('.')) continue;

    const fullPath = join(dir, entry.name);
    const relPath = relative(base, fullPath);

    if (entry.isDirectory()) {
      const children = await buildTree(fullPath, base);
      if (children.length > 0) {
        items.push({ name: entry.name, path: relPath, type: 'dir', children });
      }
    } else if (SUPPORTED_EXTENSIONS.has(extname(entry.name).toLowerCase())) {
      items.push({ name: entry.name, path: relPath, type: 'file' });
    }
  }

  // Sort: dirs first, then files, alphabetically
  items.sort((a, b) => {
    if (a.type !== b.type) return a.type === 'dir' ? -1 : 1;
    return a.name.localeCompare(b.name);
  });

  return items;
}

// Safe path resolution (prevent traversal + symlink bypass)
async function safePath(reqPath) {
  const resolved = resolve(targetDir, reqPath);
  // Check string prefix with trailing separator to prevent /docs-secret bypass
  const safePrefix = targetDir.endsWith('/') ? targetDir : targetDir + '/';
  if (resolved !== targetDir && !resolved.startsWith(safePrefix)) return null;
  try {
    // Resolve symlinks to real path and re-check
    const real = await realpath(resolved);
    const realBase = await realpath(targetDir);
    const realPrefix = realBase.endsWith('/') ? realBase : realBase + '/';
    if (real !== realBase && !real.startsWith(realPrefix)) return null;
    return real;
  } catch {
    return null;
  }
}

// MIME types for static files
const MIME = {
  '.html': 'text/html; charset=utf-8',
  '.js': 'application/javascript; charset=utf-8',
  '.css': 'text/css; charset=utf-8',
  '.svg': 'image/svg+xml',
  '.json': 'application/json; charset=utf-8',
  '.png': 'image/png',
  '.ico': 'image/x-icon',
};

// Serve static file from dist
async function serveStatic(res, urlPath) {
  let filePath = join(distDir, urlPath === '/' ? 'index.html' : urlPath);

  try {
    const s = await stat(filePath);
    if (s.isDirectory()) filePath = join(filePath, 'index.html');
  } catch {
    // SPA fallback
    filePath = join(distDir, 'index.html');
  }

  try {
    const content = await readFile(filePath);
    const ext = extname(filePath);
    res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
    res.end(content);
  } catch {
    res.writeHead(404, { 'Content-Type': 'text/plain' });
    res.end('Not found');
  }
}

// --- Line-range reading helpers ---

/**
 * Read a range of lines from a file using streams (never loads full file).
 * Returns the requested lines and the total line count.
 */
async function readLineRange(filePath, offset, limit) {
  const inputStream = await createTextReadStream(filePath);
  return new Promise((resolve, reject) => {
    const lines = [];
    let lineNum = 0;
    const rl = createInterface({
      input: inputStream,
      crlfDelay: Infinity,
    });
    rl.on('line', (line) => {
      if (lineNum >= offset && lines.length < limit) {
        lines.push(line);
      }
      lineNum++;
      // Optimisation: once we have our lines, we still need total count,
      // so we keep counting but skip storing.
    });
    rl.on('close', () => resolve({ lines, totalLines: lineNum }));
    rl.on('error', reject);
  });
}

/**
 * Estimate total line count. For small files (< 1 MB) count exactly.
 * For larger files, sample the first 8 KB and extrapolate.
 */
async function estimateLineCount(filePath, fileSize) {
  const EXACT_THRESHOLD = 1024 * 1024; // 1 MB
  if (fileSize <= EXACT_THRESHOLD) {
    const inputStream = await createTextReadStream(filePath);
    return new Promise((resolve, reject) => {
      let count = 0;
      const rl = createInterface({
        input: inputStream,
        crlfDelay: Infinity,
      });
      rl.on('line', () => count++);
      rl.on('close', () => resolve(count));
      rl.on('error', reject);
    });
  }
  // Sample first 8 KB
  const SAMPLE = 8192;
  const buf = Buffer.alloc(SAMPLE);
  const { open } = await import('node:fs/promises');
  const fh = await open(filePath, 'r');
  try {
    const { bytesRead } = await fh.read(buf, 0, SAMPLE, 0);
    const encoding = detectEncoding(buf.subarray(0, bytesRead));
    const sample = encoding === 'utf-8'
      ? buf.toString('utf-8', 0, bytesRead)
      : new TextDecoder(encoding).decode(buf.subarray(0, bytesRead));
    const newlines = (sample.match(/\n/g) || []).length;
    if (newlines === 0) return 1;
    const avgLineBytes = bytesRead / newlines;
    return Math.round(fileSize / avgLineBytes);
  } finally {
    await fh.close();
  }
}

/**
 * Search lines in a file matching a query string (case-insensitive).
 * Streams through the file and collects matching lines with pagination.
 * For CSV, always includes the header (line 0) in the response metadata.
 */
async function searchFileLines(filePath, query, offset, limit) {
  const lowerQuery = query.toLowerCase();
  const inputStream = await createTextReadStream(filePath);
  return new Promise((resolve, reject) => {
    const matches = [];
    let lineNum = 0;
    let totalMatches = 0;
    let headerLine = null;

    const rl = createInterface({
      input: inputStream,
      crlfDelay: Infinity,
    });

    rl.on('line', (line) => {
      // Capture header (line 0) for CSV
      if (lineNum === 0) {
        headerLine = line;
      }

      if (line.toLowerCase().includes(lowerQuery)) {
        if (totalMatches >= offset && matches.length < limit) {
          matches.push({ lineNum, text: line });
        }
        totalMatches++;
      }
      lineNum++;
    });

    rl.on('close', () => resolve({ matches, totalMatches, totalLines: lineNum, headerLine }));
    rl.on('error', reject);
  });
}

// HTTP server
const server = createServer(async (req, res) => {
  const url = new URL(req.url, `http://localhost:${port}`);

  // Security headers
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'");
  // CORS restricted to same origin (no external access)
  const origin = req.headers.origin;
  if (origin && (origin === `http://localhost:${port}` || origin === `http://127.0.0.1:${port}`)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
  }

  if (req.method === 'OPTIONS') {
    res.writeHead(204);
    res.end();
    return;
  }

  // API routes
  if (url.pathname === '/api/tree') {
    try {
      const tree = await buildTree(targetDir);
      const rootName = basename(targetDir);
      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
      res.end(JSON.stringify({ root: rootName, tree }));
    } catch (err) {
      res.writeHead(500, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Internal server error' }));
    }
    return;
  }

  // File metadata (size, line count) — lightweight, no full read
  if (url.pathname === '/api/file/meta') {
    const filePath = url.searchParams.get('path');
    if (!filePath) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing path parameter' }));
      return;
    }
    const resolved = await safePath(filePath);
    if (!resolved) {
      res.writeHead(403, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Access denied' }));
      return;
    }
    try {
      const fileStat = await stat(resolved);
      const ext = extname(resolved).toLowerCase();
      const meta = {
        size: fileStat.size,
        mtime: fileStat.mtime.toISOString(),
        ext,
      };
      // For text files > 0 bytes, estimate line count from a sample
      if (!IMAGE_EXTENSIONS.has(ext) && fileStat.size > 0) {
        meta.lines = await estimateLineCount(resolved, fileStat.size);
      }
      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
      res.end(JSON.stringify(meta));
    } catch {
      res.writeHead(404, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'File not found' }));
    }
    return;
  }

  if (url.pathname === '/api/file') {
    const filePath = url.searchParams.get('path');
    if (!filePath) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing path parameter' }));
      return;
    }

    const resolved = await safePath(filePath);
    if (!resolved) {
      res.writeHead(403, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Access denied' }));
      return;
    }

    // Line-range parameters (optional — omit for full file)
    const offsetParam = url.searchParams.get('offset');
    const limitParam = url.searchParams.get('limit');
    const hasRange = offsetParam !== null || limitParam !== null;

    try {
      const fileStat = await stat(resolved);
      const mtime = fileStat.mtime.toISOString();
      const ext = extname(resolved).toLowerCase();

      if (IMAGE_EXTENSIONS.has(ext)) {
        const content = await readFile(resolved);
        const mime = IMAGE_MIME[ext] || 'application/octet-stream';
        res.writeHead(200, { 'Content-Type': mime, 'Cache-Control': 'max-age=5', 'X-File-Mtime': mtime });
        res.end(content);
      } else if (VIDEO_EXTENSIONS.has(ext)) {
        // Stream videos with HTTP Range support (206 Partial Content).
        // <video> elements depend on this for seeking — without it, seek bars
        // are non-functional and large files lock up the browser.
        const total = fileStat.size;
        const mime = VIDEO_MIME[ext] || 'application/octet-stream';
        const rangeHeader = req.headers['range'];
        const baseHeaders = {
          'Content-Type': mime,
          'Accept-Ranges': 'bytes',
          'Cache-Control': 'no-store',
          'X-File-Mtime': mtime,
        };

        if (rangeHeader) {
          const range = parseRange(rangeHeader, total);
          if (!range) {
            res.writeHead(416, {
              ...baseHeaders,
              'Content-Range': `bytes */${total}`,
              'Content-Length': '0',
            });
            res.end();
            return;
          }
          const { start, end } = range;
          const chunkLen = end - start + 1;
          res.writeHead(206, {
            ...baseHeaders,
            'Content-Range': `bytes ${start}-${end}/${total}`,
            'Content-Length': String(chunkLen),
          });
          if (req.method === 'HEAD') {
            res.end();
            return;
          }
          const stream = createReadStream(resolved, { start, end });
          stream.on('error', () => { try { res.destroy(); } catch { /* ignore */ } });
          res.on('close', () => stream.destroy());
          stream.pipe(res);
        } else {
          res.writeHead(200, {
            ...baseHeaders,
            'Content-Length': String(total),
          });
          if (req.method === 'HEAD') {
            res.end();
            return;
          }
          const stream = createReadStream(resolved);
          stream.on('error', () => { try { res.destroy(); } catch { /* ignore */ } });
          res.on('close', () => stream.destroy());
          stream.pipe(res);
        }
      } else if (hasRange) {
        // Streaming line-range read — never loads the full file into memory
        const offset = Math.max(0, parseInt(offsetParam || '0', 10) || 0);
        const limit = Math.max(1, parseInt(limitParam || '1000', 10) || 1000);
        const { lines, totalLines } = await readLineRange(resolved, offset, limit);

        const headers = {
          'Content-Type': 'text/plain; charset=utf-8',
          'X-File-Mtime': mtime,
          'X-Total-Lines': String(totalLines),
          'X-Chunk-Offset': String(offset),
          'X-Chunk-Limit': String(limit),
          'X-Has-More': String(offset + lines.length < totalLines),
          'Access-Control-Expose-Headers': 'X-File-Mtime, X-Total-Lines, X-Chunk-Offset, X-Chunk-Limit, X-Has-More',
        };
        res.writeHead(200, headers);
        res.end(lines.join('\n'));
      } else {
        const content = await readFileText(resolved);
        res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8', 'X-File-Mtime': mtime });
        res.end(content);
      }
    } catch {
      res.writeHead(404, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'File not found' }));
    }
    return;
  }

  // In-file search — stream grep with pagination (for chunked mode)
  if (url.pathname === '/api/file/search') {
    const filePath = url.searchParams.get('path');
    const query = url.searchParams.get('q');
    if (!filePath || !query) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing path or q parameter' }));
      return;
    }
    const resolved = await safePath(filePath);
    if (!resolved) {
      res.writeHead(403, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Access denied' }));
      return;
    }
    try {
      const offset = Math.max(0, parseInt(url.searchParams.get('offset') || '0', 10) || 0);
      const limit = Math.max(1, parseInt(url.searchParams.get('limit') || '1000', 10) || 1000);
      const { matches, totalMatches, totalLines, headerLine } = await searchFileLines(resolved, query, offset, limit);

      const body = JSON.stringify({ matches, totalMatches, totalLines, headerLine });
      res.writeHead(200, {
        'Content-Type': 'application/json; charset=utf-8',
        'X-Total-Matches': String(totalMatches),
        'X-Total-Lines': String(totalLines),
      });
      res.end(body);
    } catch {
      res.writeHead(500, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Search failed' }));
    }
    return;
  }

  if (url.pathname === '/api/watch') {
    res.writeHead(200, {
      'Content-Type': 'text/event-stream',
      'Cache-Control': 'no-cache',
      'Connection': 'keep-alive',
    });
    res.write('data: connected\n\n');

    sseClients.add(res);
    req.on('close', () => sseClients.delete(res));
    return;
  }

  if (url.pathname === '/api/info') {
    res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
    res.end(JSON.stringify({
      root: basename(targetDir),
      initialFile,
      remote: {
        enabled: remoteEnabled,
        allowPrivate: allowPrivateRemote,
        maxSizeBytes: remoteMaxSize,
        insecureTls: remoteInsecureTls,
      },
    }));
    return;
  }

  if (url.pathname === '/api/remote') {
    if (!remoteEnabled) {
      res.writeHead(403, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Remote URLs are disabled on this server (--no-remote)' }));
      return;
    }
    const rawUrl = url.searchParams.get('url');
    if (!rawUrl) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing url parameter' }));
      return;
    }

    const result = await fetchRemoteUrl(rawUrl, {
      maxSize: remoteMaxSize,
      allowPrivate: allowPrivateRemote,
      insecureTls: remoteInsecureTls,
    });

    if (result.status !== 200) {
      res.writeHead(result.status, { 'Content-Type': 'application/json; charset=utf-8' });
      res.end(JSON.stringify({ error: result.error }));
      return;
    }

    const headers = {
      'Content-Type': result.contentType,
      'X-Source-Url': result.sourceUrl,
      'Access-Control-Expose-Headers': 'X-Source-Url, X-File-Mtime',
    };
    if (result.lastModified) headers['X-File-Mtime'] = result.lastModified;
    res.writeHead(200, headers);
    res.end(result.body);
    return;
  }

  if (url.pathname === '/api/search') {
    const query = url.searchParams.get('q');
    if (!query) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing q parameter' }));
      return;
    }

    const results = [];
    const useRegex = url.searchParams.get('regex') === '1';
    const contextParam = Number.parseInt(url.searchParams.get('context') || '', 10);
    const contextLines = Number.isFinite(contextParam)
      ? Math.max(0, Math.min(contextParam, 50))
      : SEARCH_CONTEXT_LINES;
    let matcher;
    if (useRegex) {
      // Reject patterns likely to cause catastrophic backtracking (ReDoS)
      if (query.length > 200 || /(\.\*){3,}|(\([^)]*\+\)[^)]*\+)/.test(query)) {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Regex pattern too complex' }));
        return;
      }
      try {
        matcher = new RegExp(query, 'i');
      } catch {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Invalid regex pattern' }));
        return;
      }
    } else {
      const lowerQuery = query.toLowerCase();
      matcher = { test: (s) => s.toLowerCase().includes(lowerQuery) };
    }

    async function searchDir(dir) {
      if (results.length >= 100) return;
      const entries = await readdir(dir, { withFileTypes: true });
      for (const entry of entries) {
        if (results.length >= 100) return;
        if (entry.name === 'node_modules' || entry.name === '.git') continue;
        if (entry.isDirectory() && entry.name.startsWith('.')) continue;

        const fullPath = join(dir, entry.name);
        if (entry.isDirectory()) {
          await searchDir(fullPath);
        } else {
          const ext = extname(entry.name).toLowerCase();
          if (SUPPORTED_EXTENSIONS.has(ext) && !IMAGE_EXTENSIONS.has(ext)) {
            try {
              const content = await readFileText(fullPath);
              const lines = content.split('\n');
              for (let i = 0; i < lines.length && results.length < 100; i++) {
                if (matcher.test(lines[i])) {
                  const start = Math.max(0, i - contextLines);
                  const end = Math.min(lines.length, i + contextLines + 1);
                  results.push({
                    path: relative(targetDir, fullPath),
                    line: i + 1,
                    text: lines[i],
                    contextStartLine: start + 1,
                    contextLines: lines.slice(start, end),
                  });
                }
              }
            } catch {
              // Skip unreadable files
            }
          }
        }
      }
    }

    try {
      await searchDir(targetDir);
      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
      res.end(JSON.stringify(results));
    } catch (err) {
      res.writeHead(500, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Internal server error' }));
    }
    return;
  }

  if (url.pathname === '/api/album' || url.pathname === '/api/gallery') {
    const dirParam = url.searchParams.get('path');
    if (!dirParam) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing path parameter' }));
      return;
    }
    const recursive = url.searchParams.get('recursive') === '1';
    const limitParam = url.searchParams.get('limit');
    const limitNum = limitParam ? Math.min(Math.max(1, parseInt(limitParam, 10) || 2000), 10000) : 2000;

    // /api/album is the legacy image-only endpoint. /api/gallery accepts
    // ?kind=image|video|all (default: all). The two endpoints share a single
    // collector but differ in response shape so existing /api/album clients
    // do not see a `kind` field appear unexpectedly.
    const isGallery = url.pathname === '/api/gallery';
    const kindParam = (url.searchParams.get('kind') || 'all').toLowerCase();
    let wantImage = true;
    let wantVideo = true;
    if (isGallery) {
      if (kindParam === 'image') { wantVideo = false; }
      else if (kindParam === 'video') { wantImage = false; }
      else if (kindParam !== 'all') {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: `Invalid kind: ${kindParam} (expected image|video|all)` }));
        return;
      }
    } else {
      // /api/album always returns images only (legacy contract).
      wantVideo = false;
    }

    const resolved = await safePath(dirParam);
    if (!resolved) {
      res.writeHead(403, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Access denied' }));
      return;
    }

    try {
      const dirStat = await stat(resolved);
      if (!dirStat.isDirectory()) {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Path is not a directory' }));
        return;
      }
    } catch {
      res.writeHead(404, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Directory not found' }));
      return;
    }

    const EXCLUDED_DIRS = new Set(['.git', 'node_modules', '.docview-cache']);

    /** Collect media files (image and/or video) recursively or non-recursively. Returns true if the limit was hit. */
    async function collectMedia(dir, items) {
      if (items.length >= limitNum) return true;
      let entries;
      try { entries = await readdir(dir, { withFileTypes: true }); }
      catch { return false; }

      for (const entry of entries) {
        if (items.length >= limitNum) return true;
        if (entry.name.startsWith('.')) continue;
        if (EXCLUDED_DIRS.has(entry.name)) continue;

        const fullPath = join(dir, entry.name);
        if (entry.isDirectory()) {
          if (recursive) {
            const truncated = await collectMedia(fullPath, items);
            if (truncated) return true;
          }
        } else {
          const ext = extname(entry.name).toLowerCase();
          const isImage = IMAGE_EXTENSIONS.has(ext);
          const isVideo = VIDEO_EXTENSIONS.has(ext);
          if ((wantImage && isImage) || (wantVideo && isVideo)) {
            const relPath = relative(targetDir, fullPath);
            try {
              const s = await stat(fullPath);
              items.push({
                path: relPath,
                name: entry.name,
                size: s.size,
                mtime: s.mtime.toISOString(),
                ext,
                kind: isImage ? 'image' : 'video',
              });
            } catch { /* skip inaccessible */ }
          }
        }
      }
      return false;
    }

    try {
      const items = [];
      const truncated = await collectMedia(resolved, items);
      const relDir = relative(targetDir, resolved) || '.';
      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
      if (isGallery) {
        res.end(JSON.stringify({ root: relDir, dir: relDir, total: items.length, truncated, items }));
      } else {
        // Legacy /api/album shape — strip `kind` from each entry so existing
        // clients see the exact same payload they did before video support.
        const images = items.map(({ kind: _kind, ...rest }) => rest);
        res.end(JSON.stringify({ dir: relDir, total: images.length, truncated, images }));
      }
    } catch {
      res.writeHead(500, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Internal server error' }));
    }
    return;
  }

  if (url.pathname === '/api/shutdown') {
    res.writeHead(200, { 'Content-Type': 'text/plain' });
    res.end('ok');
    watcher.close();
    server.close(() => process.exit(0));
    return;
  }

  if (url.pathname === '/api/custom-css') {
    const cssPath = join(targetDir, '.docview.css');
    try {
      const content = await readFile(cssPath, 'utf-8');
      res.writeHead(200, { 'Content-Type': 'text/css; charset=utf-8' });
      res.end(content);
    } catch {
      res.writeHead(404, { 'Content-Type': 'text/plain' });
      res.end('Not found');
    }
    return;
  }

  if (url.pathname === '/api/backlinks') {
    const targetPath = url.searchParams.get('path');
    if (!targetPath) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing path parameter' }));
      return;
    }

    const MARKDOWN_LIKE = new Set(['.md', '.markdown', '.mdx', '.txt']);
    const targetName = basename(targetPath).replace(/\.[^.]+$/, '');
    const backlinks = [];

    function isLinkToTarget(link, sourcePath) {
      if (!link) return false;
      const linkPath = link.split('#')[0].replace(/^\.\//, '');
      if (!linkPath) return false;
      if (linkPath === targetPath) return true;
      const sourceDir = dirname(sourcePath);
      const resolved = join(sourceDir, linkPath).replace(/\\/g, '/');
      if (resolved === targetPath) return true;
      const linkName = basename(linkPath).replace(/\.[^.]+$/, '');
      if (linkName === targetName && !linkPath.includes('/')) return true;
      return false;
    }

    async function scanBacklinks(dir) {
      if (backlinks.length >= 50) return;
      const entries = await readdir(dir, { withFileTypes: true });
      for (const entry of entries) {
        if (backlinks.length >= 50) return;
        if (entry.name === 'node_modules' || entry.name === '.git') continue;
        if (entry.isDirectory() && entry.name.startsWith('.')) continue;
        const fullPath = join(dir, entry.name);
        if (entry.isDirectory()) {
          await scanBacklinks(fullPath);
        } else {
          const ext = extname(entry.name).toLowerCase();
          if (!MARKDOWN_LIKE.has(ext)) continue;
          const relPath = relative(targetDir, fullPath);
          if (relPath === targetPath) continue;
          try {
            const content = await readFileText(fullPath);
            const linkRegex = /\[(?:[^\]]*)\]\(([^)]+)\)|\[\[([^\]|]+)(?:\|[^\]]*?)?\]\]/g;
            let match;
            while ((match = linkRegex.exec(content)) !== null) {
              const linkTarget = match[1] || match[2];
              if (isLinkToTarget(linkTarget, relPath)) {
                const line = content.substring(0, match.index).split('\n').length;
                backlinks.push({ path: relPath, line });
                break;
              }
            }
          } catch { /* skip */ }
        }
      }
    }

    try {
      await scanBacklinks(targetDir);
      res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
      res.end(JSON.stringify(backlinks));
    } catch {
      res.writeHead(500, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Internal server error' }));
    }
    return;
  }

  if (req.method === 'POST' && url.pathname === '/api/download-zip') {
    const MAX_BODY = 256 * 1024;        // request body (JSON of paths)
    const MAX_FILES = 500;
    const MAX_TOTAL_BYTES = 500 * 1024 * 1024;

    let body = '';
    for await (const chunk of req) {
      body += chunk;
      if (body.length > MAX_BODY) {
        res.writeHead(413, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Request body too large' }));
        return;
      }
    }

    let data;
    try { data = JSON.parse(body); } catch {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Invalid JSON' }));
      return;
    }

    const paths = Array.isArray(data?.paths) ? data.paths : null;
    if (!paths || paths.length === 0) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing paths' }));
      return;
    }
    if (paths.length > MAX_FILES) {
      res.writeHead(413, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: `Too many files (max ${MAX_FILES})` }));
      return;
    }

    const entries = [];
    const usedNames = new Map();
    let totalBytes = 0;

    for (const reqPath of paths) {
      if (typeof reqPath !== 'string' || !reqPath) continue;
      const resolved = await safePath(reqPath);
      if (!resolved) {
        res.writeHead(403, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: `Access denied: ${reqPath}` }));
        return;
      }
      const ext = extname(resolved).toLowerCase();
      if (!IMAGE_EXTENSIONS.has(ext) && !VIDEO_EXTENSIONS.has(ext)) {
        res.writeHead(400, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: `Unsupported file type: ${reqPath}` }));
        return;
      }
      try {
        const s = await stat(resolved);
        if (!s.isFile()) {
          res.writeHead(400, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ error: `Not a file: ${reqPath}` }));
          return;
        }
        totalBytes += s.size;
        if (totalBytes > MAX_TOTAL_BYTES) {
          res.writeHead(413, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ error: `Total size exceeds ${MAX_TOTAL_BYTES} bytes` }));
          return;
        }
        const content = await readFile(resolved);

        let name = basename(resolved);
        if (usedNames.has(name)) {
          const n = usedNames.get(name) + 1;
          usedNames.set(name, n);
          const dot = name.lastIndexOf('.');
          name = dot > 0
            ? `${name.slice(0, dot)} (${n})${name.slice(dot)}`
            : `${name} (${n})`;
        } else {
          usedNames.set(name, 0);
        }
        entries.push({ name, data: content });
      } catch {
        res.writeHead(404, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: `File not found: ${reqPath}` }));
        return;
      }
    }

    if (entries.length === 0) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'No valid files to archive' }));
      return;
    }

    const zip = buildZip(entries);
    const ts = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
    const filename = `docview-${ts}.zip`;
    res.writeHead(200, {
      'Content-Type': 'application/zip',
      'Content-Length': String(zip.length),
      'Content-Disposition': `attachment; filename="${filename}"`,
      'Cache-Control': 'no-store',
    });
    res.end(zip);
    return;
  }

  if (req.method === 'POST' && url.pathname === '/api/diagram') {
    // Body size limit (1 MB) to prevent memory exhaustion
    const MAX_BODY = 1024 * 1024;
    let body = '';
    for await (const chunk of req) {
      body += chunk;
      if (body.length > MAX_BODY) {
        res.writeHead(413, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Request body too large' }));
        return;
      }
    }

    let data;
    try { data = JSON.parse(body); } catch {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Invalid JSON' }));
      return;
    }

    const { type, source } = data;
    if (!type || !source) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Missing type or source' }));
      return;
    }

    // Whitelist diagram types to prevent SSRF via URL path injection
    const ALLOWED_DIAGRAM_TYPES = new Set(['d2', 'plantuml', 'ditaa']);
    if (!ALLOWED_DIAGRAM_TYPES.has(type)) {
      res.writeHead(400, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: `Unsupported diagram type: ${type}` }));
      return;
    }

    // Try local CLI first
    const localSvg = await tryLocalDiagramCLI(type, source);
    if (localSvg) {
      res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
      res.end(localSvg);
      return;
    }

    // Fallback to Kroki
    const krokiUrl = process.env.KROKI_URL || 'https://kroki.io';
    try {
      const krokiRes = await fetch(`${krokiUrl}/${type}/svg`, {
        method: 'POST',
        headers: { 'Content-Type': 'text/plain' },
        body: source,
        signal: AbortSignal.timeout(15000),
      });
      if (krokiRes.ok) {
        const svg = await krokiRes.text();
        res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
        res.end(svg);
      } else {
        res.writeHead(502, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ error: 'Diagram rendering failed' }));
      }
    } catch {
      res.writeHead(503, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ error: 'Diagram service unavailable' }));
    }
    return;
  }

  // Static files
  await serveStatic(res, url.pathname);
});

// Diagram CLI helper
function tryLocalDiagramCLI(type, source) {
  const commands = {
    d2: ['d2', ['-', '-']],
    plantuml: ['plantuml', ['-tsvg', '-pipe']],
  };
  const cmd = commands[type];
  if (!cmd) return Promise.resolve(null);
  return new Promise((resolve) => {
    try {
      const proc = spawn(cmd[0], cmd[1], { timeout: 15000 });
      let out = '';
      proc.stdout.on('data', (d) => { out += d; });
      proc.on('close', (code) => { resolve(code === 0 && out ? out : null); });
      proc.on('error', () => resolve(null));
      proc.stdin.write(source);
      proc.stdin.end();
    } catch { resolve(null); }
  });
}

// File watcher
const mdGlobs = [...SUPPORTED_EXTENSIONS].map((ext) => `**/*${ext}`);
const watcher = chokidar.watch(mdGlobs, {
  cwd: targetDir,
  ignoreInitial: true,
  ignored: ['**/node_modules/**', '**/.*'],
});

function broadcast(event, filePath) {
  const data = JSON.stringify({ event, path: filePath });
  for (const client of sseClients) {
    client.write(`data: ${data}\n\n`);
  }
}

watcher.on('change', (path) => broadcast('change', path));
watcher.on('add', (path) => broadcast('add', path));
watcher.on('unlink', (path) => broadcast('unlink', path));
watcher.on('error', (err) => {
  // Non-fatal: continue running but inform the user
  process.stderr.write(formatFriendlyError(err));
});

async function killExistingDocview(p) {
  try {
    const res = await fetch(`http://localhost:${p}/api/tree`);
    if (res.ok) {
      console.log(`  Stopping existing DocView on port ${p}...`);
      await fetch(`http://localhost:${p}/api/shutdown`).catch(() => {});
      await new Promise((r) => setTimeout(r, 500));
    }
  } catch {
    // No server running — good
  }
}

await killExistingDocview(port);

server.on('error', (err) => reportAndExit(err));

const BANNER = [
  '       _                     _',
  '    __| |  ___    ___ __   _(_)  ___ __      __',
  '   / _` | / _ \\  / __|\\ \\ / / | / _ \\\\ \\ /\\ / /',
  '  | (_| || (_) || (__  \\ V /| ||  __/ \\ V  V /',
  '   \\__,_| \\___/  \\___|  \\_/ |_| \\___|  \\_/\\_/',
].join('\n');

const TIPS = [
  'Press "?" in the browser to see all keyboard shortcuts.',
  'Cmd+P opens the file search — type to fuzzy-match any file.',
  'Cmd+Shift+F runs full-text search across every served file.',
  'Cmd+E shows recent files — jump back without re-navigating.',
  'Cmd+B toggles the sidebar. Cmd+\\ opens a split view.',
  '"/" inside a document starts vim-style find (n / N to navigate).',
  'Cmd+Shift+S turns Markdown "---" sections into a slide deck.',
  'Cmd+Shift+E exports the current view to a standalone HTML file.',
  'Share a specific line: append "&line=N" (or "&line=10-20") to the URL hash.',
  'Click any line number in code / log views to copy a link to that exact line.',
  'Drop a ".docview.css" in the served directory to inject custom styles.',
  'Large CSV / JSONL / log files stream in chunks — search still hits every row.',
  'Mermaid, KaTeX math, footnotes, and GitHub Alerts all render inline in Markdown.',
  'JSON / YAML files show as an interactive tree — toggle Source to see the raw text.',
  'Alt+Z toggles word wrap in code views. Cmd+= / Cmd+- zooms text.',
];

function pickTip() {
  return TIPS[Math.floor(Math.random() * TIPS.length)];
}

server.listen(port, () => {
  console.log('');
  console.log(BANNER);
  console.log(`  ─────────────────────────────────────────────`);
  console.log(`  Watching:  ${targetDir}`);
  if (initialFile) console.log(`  File:      ${initialFile}`);
  console.log(`  Server:    http://localhost:${port}/`);
  if (remoteEnabled) {
    const priv = allowPrivateRemote ? ' (incl. private IPs)' : '';
    const tls = remoteInsecureTls ? ' · TLS verify off' : ' · TLS strict';
    console.log(`  Remote:    on${priv} · max ${(remoteMaxSize / 1024 / 1024).toFixed(1)} MB${tls}`);
  } else {
    console.log(`  Remote:    off (--no-remote)`);
  }
  console.log(`  ─────────────────────────────────────────────`);
  console.log(`  Tip:       ${pickTip()}`);
  console.log('');
  if (process.send) process.send({ type: 'listening', port });
});