@jsenv/core 41.2.7 → 41.2.9

package/dist/build/build.js

@@ -6411,7 +6411,30 @@ const jsenvPluginDirectoryListing = ({
       const { request, requestedUrl, mainFilePath, rootDirectoryUrl } =
         reference.ownerUrlInfo.context;
       if (!fsStat) {
-        if (!request || request.headers["sec-fetch-dest"] !== "document") {
+        if (!request) {
+          // no request we should not serve directoy listing
+          return null;
+        }
+        const secFetchDest = request.headers["sec-fetch-dest"];
+        if (secFetchDest && secFetchDest !== "document") {
+          // we have sec fetch dest and it's not document so it's not a navigation request, we should not serve directory listing
+          return null;
+        }
+        if (!secFetchDest) {
+          // beware we might end up here when nav context is not trusted (http, ip url etc)
+          // in that case we fallback to detecting if the request explicitly accepts html.
+          // browsers navigating to a page send "text/html,..." explicitly; programmatic
+          // fetch clients like Node.js send "*/*" which should NOT trigger directory listing.
+          // We must NOT use pickContentType here because it matches "text/html" via the
+          // "*/*" wildcard, causing programmatic fetches to receive the directory listing
+          // HTML page (status 200) instead of a 404.
+          const acceptHeader = request.headers.accept || "";
+          if (!acceptHeader.includes("text/html")) {
+            return null;
+          }
+        }
+        // requestedUrl must be a proper file:// URL (no encoded slashes)
+        if (requestedUrl.includes("%2F") || requestedUrl.includes("%2f")) {
           return null;
         }
         if (url !== requestedUrl) {

package/dist/build/jsenv_core_packages.js

@@ -871,44 +871,53 @@ const TIME_DICTIONARY_EN = {
   second: { long: "second", plural: "seconds", short: "s" },
   joinDuration: (primary, remaining) => `${primary} and ${remaining}`,
 };
-const TIME_DICTIONARY_FR = {
-  year: { long: "an", plural: "ans", short: "a" },
-  month: { long: "mois", plural: "mois", short: "m" },
-  week: { long: "semaine", plural: "semaines", short: "s" },
-  day: { long: "jour", plural: "jours", short: "j" },
-  hour: { long: "heure", plural: "heures", short: "h" },
-  minute: { long: "minute", plural: "minutes", short: "m" },
-  second: { long: "seconde", plural: "secondes", short: "s" },
-  joinDuration: (primary, remaining) => `${primary} et ${remaining}`,
-};
 
+/**
+ * Converts a duration in milliseconds into a human-readable string intended for display in
+ * CLI output — where readability matters more than precision.
+ *
+ * - Values below 1ms are displayed as "0 second". Sub-millisecond durations are not
+ *   meaningful at human scale, and showing "0.0001 second" (or switching to a "millisecond"
+ *   unit) would hurt readability. The chosen trade-off is to always use "second" as the
+ *   smallest unit and accept the loss of precision for very small values.
+ * - Values below 1s are displayed in fractional seconds (e.g. "0.05 second").
+ * - Values are expressed using the two most significant units (e.g. "1 hour and 23 minutes").
+ * - Rounding never causes a value to display as the next unit boundary
+ *   (e.g. 59_999ms → "59.9 seconds", never "60 seconds").
+ *
+ * @param {number} ms - Duration in milliseconds.
+ * @param {object} [options]
+ * @param {boolean} [options.short=false] - Use compact unit symbols (e.g. "1h and 23m").
+ * @param {boolean} [options.rounded=true] - Round the last displayed digit. When false, truncates instead.
+ * @param {number} [options.decimals] - Override the number of decimal places shown.
+ * @returns {string}
+ */
 const humanizeDuration = (
   ms,
   {
     short,
     rounded = true,
     decimals,
-    lang = "en",
-    timeDictionnary = lang === "fr" ? TIME_DICTIONARY_FR : TIME_DICTIONARY_EN,
+    timeDictionnary = TIME_DICTIONARY_EN,
   } = {},
 ) => {
-  // ignore ms below meaningfulMs so that:
-  // humanizeDuration(0.5) -> "0 second"
-  // humanizeDuration(1.1) -> "0.001 second" (and not "0.0011 second")
-  // This tool is meant to be read by humans and it would be barely readable to see
-  // "0.0001 second" (stands for 0.1 millisecond)
-  // yes we could return "0.1 millisecond" but we choosed consistency over precision
-  // so that the prefered unit is "second" (and does not become millisecond when ms is super small)
   if (ms < 1) {
-    return short
-      ? `0${timeDictionnary.second.short}`
-      : `0 ${timeDictionnary.second.long}`;
+    if (short) {
+      return `0${timeDictionnary.second.short}`;
+    }
+    return `0 ${timeDictionnary.second.long}`;
   }
   const { primary, remaining } = parseMs(ms);
   if (!remaining) {
+    const primaryUnitIndex = UNIT_KEYS.indexOf(primary.name);
+    const nextUnitName = UNIT_KEYS[primaryUnitIndex - 1];
+    const maxCount = nextUnitName
+      ? UNIT_MS[nextUnitName] / UNIT_MS[primary.name]
+      : null;
     return humanizeDurationUnit(primary, {
       decimals:
         decimals === undefined ? (primary.name === "second" ? 1 : 0) : decimals,
+      maxCount,
       short,
       rounded,
       timeDictionnary,
@@ -926,15 +935,23 @@ const humanizeDuration = (
     rounded,
     timeDictionnary,
   });
+  if (short) {
+    return `${primaryText}${remainingText}`;
+  }
   return timeDictionnary.joinDuration(primaryText, remainingText);
 };
 const humanizeDurationUnit = (
   unit,
-  { decimals, short, rounded, timeDictionnary },
+  { decimals, maxCount, short, rounded, timeDictionnary },
 ) => {
-  const count = rounded
+  let count = rounded
     ? setRoundedPrecision(unit.count, { decimals })
     : setPrecision(unit.count, { decimals });
+  if (maxCount !== null && maxCount !== undefined && count >= maxCount) {
+    // Prevent rounding up to the next unit boundary (e.g. 59.999s → 60s → cap to 59.9s)
+    const factor = Math.pow(10, decimals ?? 0);
+    count = Math.floor(unit.count * factor) / factor;
+  }
   const name = unit.name;
   if (short) {
     const unitText = timeDictionnary[name].short;
@@ -987,6 +1004,17 @@ const parseMs = (ms) => {
       },
     };
   }
+  // When remaining rounds up to a full next-unit (e.g. 59.999s rounds to 60s = 1min),
+  // drop the remaining to avoid displaying "59 minutes and 60 seconds".
+  const remainingUnitMs = UNIT_MS[remainingUnitName];
+  const nextUnitMs = UNIT_MS[firstUnitName];
+  const maxRemainingCount = nextUnitMs / remainingUnitMs; // e.g. 60 for seconds-in-a-minute
+  // Cap remaining so it never rounds up to the next unit boundary
+  // (e.g. 59.5s stays as 59s instead of rounding to 60s = 1min)
+  const cappedRemainingCount =
+    remainingUnitCount >= maxRemainingCount - 1
+      ? maxRemainingCount - 1
+      : remainingUnitCount;
   // - 1 year and 1 month is great
   return {
     primary: {
@@ -995,7 +1023,7 @@ const parseMs = (ms) => {
     },
     remaining: {
       name: remainingUnitName,
-      count: remainingUnitCount,
+      count: cappedRemainingCount,
     },
   };
 };
@@ -5742,13 +5770,11 @@ const applyPackageResolve = (packageSpecifier, resolutionContext) => {
   if (packageSpecifier === "") {
     throw new Error("invalid module specifier");
   }
-  if (
-    conditions.includes("node") &&
-    isSpecifierForNodeBuiltin(packageSpecifier)
-  ) {
+  // "node:" prefixed specifiers always resolve to node builtins
+  if (packageSpecifier.startsWith("node:")) {
     return createResolutionResult({
       type: "node_builtin_specifier",
-      url: `node:${packageSpecifier}`,
+      url: packageSpecifier,
     });
   }
   let { packageName, packageSubpath } = parsePackageSpecifier(packageSpecifier);
@@ -5808,6 +5834,17 @@ const applyPackageResolve = (packageSpecifier, resolutionContext) => {
       packageJson,
     });
   }
+  // Bare builtin names (without "node:" prefix) are valid only if no local package found
+  // Local packages always take priority over builtins with the same name
+  if (
+    conditions.includes("node") &&
+    isSpecifierForNodeBuiltin(packageSpecifier)
+  ) {
+    return createResolutionResult({
+      type: "node_builtin_specifier",
+      url: `node:${packageSpecifier}`,
+    });
+  }
   throw createModuleNotFoundError(packageName, resolutionContext);
 };
 

package/dist/client/directory_listing/directory_listing.html

@@ -5,6 +5,7 @@
     <meta charset="utf-8">
     <link rel="icon" href="data:,">
     <link rel="stylesheet" href="./css/directory_listing.css">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
   </head>
 
   <body data-theme="dark">

package/dist/start_build_server/jsenv_core_packages.js

@@ -780,44 +780,53 @@ const TIME_DICTIONARY_EN = {
   second: { long: "second", plural: "seconds", short: "s" },
   joinDuration: (primary, remaining) => `${primary} and ${remaining}`,
 };
-const TIME_DICTIONARY_FR = {
-  year: { long: "an", plural: "ans", short: "a" },
-  month: { long: "mois", plural: "mois", short: "m" },
-  week: { long: "semaine", plural: "semaines", short: "s" },
-  day: { long: "jour", plural: "jours", short: "j" },
-  hour: { long: "heure", plural: "heures", short: "h" },
-  minute: { long: "minute", plural: "minutes", short: "m" },
-  second: { long: "seconde", plural: "secondes", short: "s" },
-  joinDuration: (primary, remaining) => `${primary} et ${remaining}`,
-};
 
+/**
+ * Converts a duration in milliseconds into a human-readable string intended for display in
+ * CLI output — where readability matters more than precision.
+ *
+ * - Values below 1ms are displayed as "0 second". Sub-millisecond durations are not
+ *   meaningful at human scale, and showing "0.0001 second" (or switching to a "millisecond"
+ *   unit) would hurt readability. The chosen trade-off is to always use "second" as the
+ *   smallest unit and accept the loss of precision for very small values.
+ * - Values below 1s are displayed in fractional seconds (e.g. "0.05 second").
+ * - Values are expressed using the two most significant units (e.g. "1 hour and 23 minutes").
+ * - Rounding never causes a value to display as the next unit boundary
+ *   (e.g. 59_999ms → "59.9 seconds", never "60 seconds").
+ *
+ * @param {number} ms - Duration in milliseconds.
+ * @param {object} [options]
+ * @param {boolean} [options.short=false] - Use compact unit symbols (e.g. "1h and 23m").
+ * @param {boolean} [options.rounded=true] - Round the last displayed digit. When false, truncates instead.
+ * @param {number} [options.decimals] - Override the number of decimal places shown.
+ * @returns {string}
+ */
 const humanizeDuration = (
   ms,
   {
     short,
     rounded = true,
     decimals,
-    lang = "en",
-    timeDictionnary = lang === "fr" ? TIME_DICTIONARY_FR : TIME_DICTIONARY_EN,
+    timeDictionnary = TIME_DICTIONARY_EN,
   } = {},
 ) => {
-  // ignore ms below meaningfulMs so that:
-  // humanizeDuration(0.5) -> "0 second"
-  // humanizeDuration(1.1) -> "0.001 second" (and not "0.0011 second")
-  // This tool is meant to be read by humans and it would be barely readable to see
-  // "0.0001 second" (stands for 0.1 millisecond)
-  // yes we could return "0.1 millisecond" but we choosed consistency over precision
-  // so that the prefered unit is "second" (and does not become millisecond when ms is super small)
   if (ms < 1) {
-    return short
-      ? `0${timeDictionnary.second.short}`
-      : `0 ${timeDictionnary.second.long}`;
+    if (short) {
+      return `0${timeDictionnary.second.short}`;
+    }
+    return `0 ${timeDictionnary.second.long}`;
   }
   const { primary, remaining } = parseMs(ms);
   if (!remaining) {
+    const primaryUnitIndex = UNIT_KEYS.indexOf(primary.name);
+    const nextUnitName = UNIT_KEYS[primaryUnitIndex - 1];
+    const maxCount = nextUnitName
+      ? UNIT_MS[nextUnitName] / UNIT_MS[primary.name]
+      : null;
     return humanizeDurationUnit(primary, {
       decimals:
         decimals === undefined ? (primary.name === "second" ? 1 : 0) : decimals,
+      maxCount,
       short,
       rounded,
       timeDictionnary,
@@ -835,15 +844,23 @@ const humanizeDuration = (
     rounded,
     timeDictionnary,
   });
+  if (short) {
+    return `${primaryText}${remainingText}`;
+  }
   return timeDictionnary.joinDuration(primaryText, remainingText);
 };
 const humanizeDurationUnit = (
   unit,
-  { decimals, short, rounded, timeDictionnary },
+  { decimals, maxCount, short, rounded, timeDictionnary },
 ) => {
-  const count = rounded
+  let count = rounded
     ? setRoundedPrecision(unit.count, { decimals })
     : setPrecision(unit.count, { decimals });
+  if (maxCount !== null && maxCount !== undefined && count >= maxCount) {
+    // Prevent rounding up to the next unit boundary (e.g. 59.999s → 60s → cap to 59.9s)
+    const factor = Math.pow(10, decimals ?? 0);
+    count = Math.floor(unit.count * factor) / factor;
+  }
   const name = unit.name;
   if (short) {
     const unitText = timeDictionnary[name].short;
@@ -896,6 +913,17 @@ const parseMs = (ms) => {
       },
     };
   }
+  // When remaining rounds up to a full next-unit (e.g. 59.999s rounds to 60s = 1min),
+  // drop the remaining to avoid displaying "59 minutes and 60 seconds".
+  const remainingUnitMs = UNIT_MS[remainingUnitName];
+  const nextUnitMs = UNIT_MS[firstUnitName];
+  const maxRemainingCount = nextUnitMs / remainingUnitMs; // e.g. 60 for seconds-in-a-minute
+  // Cap remaining so it never rounds up to the next unit boundary
+  // (e.g. 59.5s stays as 59s instead of rounding to 60s = 1min)
+  const cappedRemainingCount =
+    remainingUnitCount >= maxRemainingCount - 1
+      ? maxRemainingCount - 1
+      : remainingUnitCount;
   // - 1 year and 1 month is great
   return {
     primary: {
@@ -904,7 +932,7 @@ const parseMs = (ms) => {
     },
     remaining: {
       name: remainingUnitName,
-      count: remainingUnitCount,
+      count: cappedRemainingCount,
     },
   };
 };

package/dist/start_dev_server/jsenv_core_packages.js

@@ -379,44 +379,53 @@ const TIME_DICTIONARY_EN = {
   second: { long: "second", plural: "seconds", short: "s" },
   joinDuration: (primary, remaining) => `${primary} and ${remaining}`,
 };
-const TIME_DICTIONARY_FR = {
-  year: { long: "an", plural: "ans", short: "a" },
-  month: { long: "mois", plural: "mois", short: "m" },
-  week: { long: "semaine", plural: "semaines", short: "s" },
-  day: { long: "jour", plural: "jours", short: "j" },
-  hour: { long: "heure", plural: "heures", short: "h" },
-  minute: { long: "minute", plural: "minutes", short: "m" },
-  second: { long: "seconde", plural: "secondes", short: "s" },
-  joinDuration: (primary, remaining) => `${primary} et ${remaining}`,
-};
 
+/**
+ * Converts a duration in milliseconds into a human-readable string intended for display in
+ * CLI output — where readability matters more than precision.
+ *
+ * - Values below 1ms are displayed as "0 second". Sub-millisecond durations are not
+ *   meaningful at human scale, and showing "0.0001 second" (or switching to a "millisecond"
+ *   unit) would hurt readability. The chosen trade-off is to always use "second" as the
+ *   smallest unit and accept the loss of precision for very small values.
+ * - Values below 1s are displayed in fractional seconds (e.g. "0.05 second").
+ * - Values are expressed using the two most significant units (e.g. "1 hour and 23 minutes").
+ * - Rounding never causes a value to display as the next unit boundary
+ *   (e.g. 59_999ms → "59.9 seconds", never "60 seconds").
+ *
+ * @param {number} ms - Duration in milliseconds.
+ * @param {object} [options]
+ * @param {boolean} [options.short=false] - Use compact unit symbols (e.g. "1h and 23m").
+ * @param {boolean} [options.rounded=true] - Round the last displayed digit. When false, truncates instead.
+ * @param {number} [options.decimals] - Override the number of decimal places shown.
+ * @returns {string}
+ */
 const humanizeDuration = (
   ms,
   {
     short,
     rounded = true,
     decimals,
-    lang = "en",
-    timeDictionnary = lang === "fr" ? TIME_DICTIONARY_FR : TIME_DICTIONARY_EN,
+    timeDictionnary = TIME_DICTIONARY_EN,
   } = {},
 ) => {
-  // ignore ms below meaningfulMs so that:
-  // humanizeDuration(0.5) -> "0 second"
-  // humanizeDuration(1.1) -> "0.001 second" (and not "0.0011 second")
-  // This tool is meant to be read by humans and it would be barely readable to see
-  // "0.0001 second" (stands for 0.1 millisecond)
-  // yes we could return "0.1 millisecond" but we choosed consistency over precision
-  // so that the prefered unit is "second" (and does not become millisecond when ms is super small)
   if (ms < 1) {
-    return short
-      ? `0${timeDictionnary.second.short}`
-      : `0 ${timeDictionnary.second.long}`;
+    if (short) {
+      return `0${timeDictionnary.second.short}`;
+    }
+    return `0 ${timeDictionnary.second.long}`;
   }
   const { primary, remaining } = parseMs(ms);
   if (!remaining) {
+    const primaryUnitIndex = UNIT_KEYS.indexOf(primary.name);
+    const nextUnitName = UNIT_KEYS[primaryUnitIndex - 1];
+    const maxCount = nextUnitName
+      ? UNIT_MS[nextUnitName] / UNIT_MS[primary.name]
+      : null;
     return humanizeDurationUnit(primary, {
       decimals:
         decimals === undefined ? (primary.name === "second" ? 1 : 0) : decimals,
+      maxCount,
       short,
       rounded,
       timeDictionnary,
@@ -434,15 +443,23 @@ const humanizeDuration = (
     rounded,
     timeDictionnary,
   });
+  if (short) {
+    return `${primaryText}${remainingText}`;
+  }
   return timeDictionnary.joinDuration(primaryText, remainingText);
 };
 const humanizeDurationUnit = (
   unit,
-  { decimals, short, rounded, timeDictionnary },
+  { decimals, maxCount, short, rounded, timeDictionnary },
 ) => {
-  const count = rounded
+  let count = rounded
     ? setRoundedPrecision(unit.count, { decimals })
     : setPrecision(unit.count, { decimals });
+  if (maxCount !== null && maxCount !== undefined && count >= maxCount) {
+    // Prevent rounding up to the next unit boundary (e.g. 59.999s → 60s → cap to 59.9s)
+    const factor = Math.pow(10, decimals ?? 0);
+    count = Math.floor(unit.count * factor) / factor;
+  }
   const name = unit.name;
   if (short) {
     const unitText = timeDictionnary[name].short;
@@ -495,6 +512,17 @@ const parseMs = (ms) => {
       },
     };
   }
+  // When remaining rounds up to a full next-unit (e.g. 59.999s rounds to 60s = 1min),
+  // drop the remaining to avoid displaying "59 minutes and 60 seconds".
+  const remainingUnitMs = UNIT_MS[remainingUnitName];
+  const nextUnitMs = UNIT_MS[firstUnitName];
+  const maxRemainingCount = nextUnitMs / remainingUnitMs; // e.g. 60 for seconds-in-a-minute
+  // Cap remaining so it never rounds up to the next unit boundary
+  // (e.g. 59.5s stays as 59s instead of rounding to 60s = 1min)
+  const cappedRemainingCount =
+    remainingUnitCount >= maxRemainingCount - 1
+      ? maxRemainingCount - 1
+      : remainingUnitCount;
   // - 1 year and 1 month is great
   return {
     primary: {
@@ -503,7 +531,7 @@ const parseMs = (ms) => {
     },
     remaining: {
       name: remainingUnitName,
-      count: remainingUnitCount,
+      count: cappedRemainingCount,
     },
   };
 };
@@ -5208,13 +5236,11 @@ const applyPackageResolve = (packageSpecifier, resolutionContext) => {
   if (packageSpecifier === "") {
     throw new Error("invalid module specifier");
   }
-  if (
-    conditions.includes("node") &&
-    isSpecifierForNodeBuiltin(packageSpecifier)
-  ) {
+  // "node:" prefixed specifiers always resolve to node builtins
+  if (packageSpecifier.startsWith("node:")) {
     return createResolutionResult({
       type: "node_builtin_specifier",
-      url: `node:${packageSpecifier}`,
+      url: packageSpecifier,
     });
   }
   let { packageName, packageSubpath } = parsePackageSpecifier(packageSpecifier);
@@ -5274,6 +5300,17 @@ const applyPackageResolve = (packageSpecifier, resolutionContext) => {
       packageJson,
     });
   }
+  // Bare builtin names (without "node:" prefix) are valid only if no local package found
+  // Local packages always take priority over builtins with the same name
+  if (
+    conditions.includes("node") &&
+    isSpecifierForNodeBuiltin(packageSpecifier)
+  ) {
+    return createResolutionResult({
+      type: "node_builtin_specifier",
+      url: `node:${packageSpecifier}`,
+    });
+  }
   throw createModuleNotFoundError(packageName, resolutionContext);
 };
 

package/dist/start_dev_server/start_dev_server.js

@@ -2471,7 +2471,30 @@ const jsenvPluginDirectoryListing = ({
       const { request, requestedUrl, mainFilePath, rootDirectoryUrl } =
         reference.ownerUrlInfo.context;
       if (!fsStat) {
-        if (!request || request.headers["sec-fetch-dest"] !== "document") {
+        if (!request) {
+          // no request we should not serve directoy listing
+          return null;
+        }
+        const secFetchDest = request.headers["sec-fetch-dest"];
+        if (secFetchDest && secFetchDest !== "document") {
+          // we have sec fetch dest and it's not document so it's not a navigation request, we should not serve directory listing
+          return null;
+        }
+        if (!secFetchDest) {
+          // beware we might end up here when nav context is not trusted (http, ip url etc)
+          // in that case we fallback to detecting if the request explicitly accepts html.
+          // browsers navigating to a page send "text/html,..." explicitly; programmatic
+          // fetch clients like Node.js send "*/*" which should NOT trigger directory listing.
+          // We must NOT use pickContentType here because it matches "text/html" via the
+          // "*/*" wildcard, causing programmatic fetches to receive the directory listing
+          // HTML page (status 200) instead of a 404.
+          const acceptHeader = request.headers.accept || "";
+          if (!acceptHeader.includes("text/html")) {
+            return null;
+          }
+        }
+        // requestedUrl must be a proper file:// URL (no encoded slashes)
+        if (requestedUrl.includes("%2F") || requestedUrl.includes("%2f")) {
           return null;
         }
         if (url !== requestedUrl) {
@@ -10148,7 +10171,7 @@ const startDevServer = async ({
   ignore,
   port = 3456,
   hostname,
-  acceptAnyIp,
+  acceptAnyIp = true,
   https,
   // it's better to use http1 by default because it allows to get statusText in devtools
   // which gives valuable information when there is errors

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/core",
-  "version": "41.2.7",
+  "version": "41.2.9",
   "type": "module",
   "description": "Tool to develop, test and build js projects",
   "repository": {
@@ -72,14 +72,14 @@
     "test:snapshot_clear": "npx @jsenv/filesystem clear **/tests/**/side_effects/"
   },
   "dependencies": {
-    "@jsenv/ast": "6.8.1",
-    "@jsenv/js-module-fallback": "1.4.31",
-    "@jsenv/plugin-bundling": "2.10.11",
+    "@jsenv/ast": "6.8.3",
+    "@jsenv/js-module-fallback": "1.4.33",
+    "@jsenv/plugin-bundling": "2.10.13",
     "@jsenv/plugin-minification": "1.7.3",
-    "@jsenv/plugin-supervisor": "1.8.2",
-    "@jsenv/plugin-transpilation": "1.5.73",
+    "@jsenv/plugin-supervisor": "1.8.4",
+    "@jsenv/plugin-transpilation": "1.5.75",
     "@jsenv/server": "17.3.0",
-    "@jsenv/sourcemap": "1.3.17",
+    "@jsenv/sourcemap": "1.3.19",
     "react-table": "7.8.0"
   },
   "devDependencies": {

package/src/dev/start_dev_server.js

@@ -53,7 +53,7 @@ export const startDevServer = async ({
   ignore,
   port = 3456,
   hostname,
-  acceptAnyIp,
+  acceptAnyIp = true,
   https,
   // it's better to use http1 by default because it allows to get statusText in devtools
   // which gives valuable information when there is errors

package/src/plugins/protocol_file/client/directory_listing.html

@@ -5,6 +5,7 @@
     <meta charset="utf-8" />
     <link rel="icon" href="data:," />
     <link rel="stylesheet" href="./directory_listing.css" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
   </head>
 
   <body data-theme="dark">

package/src/plugins/protocol_file/jsenv_plugin_directory_listing.js

@@ -71,7 +71,30 @@ export const jsenvPluginDirectoryListing = ({
       const { request, requestedUrl, mainFilePath, rootDirectoryUrl } =
         reference.ownerUrlInfo.context;
       if (!fsStat) {
-        if (!request || request.headers["sec-fetch-dest"] !== "document") {
+        if (!request) {
+          // no request we should not serve directoy listing
+          return null;
+        }
+        const secFetchDest = request.headers["sec-fetch-dest"];
+        if (secFetchDest && secFetchDest !== "document") {
+          // we have sec fetch dest and it's not document so it's not a navigation request, we should not serve directory listing
+          return null;
+        }
+        if (!secFetchDest) {
+          // beware we might end up here when nav context is not trusted (http, ip url etc)
+          // in that case we fallback to detecting if the request explicitly accepts html.
+          // browsers navigating to a page send "text/html,..." explicitly; programmatic
+          // fetch clients like Node.js send "*/*" which should NOT trigger directory listing.
+          // We must NOT use pickContentType here because it matches "text/html" via the
+          // "*/*" wildcard, causing programmatic fetches to receive the directory listing
+          // HTML page (status 200) instead of a 404.
+          const acceptHeader = request.headers.accept || "";
+          if (!acceptHeader.includes("text/html")) {
+            return null;
+          }
+        }
+        // requestedUrl must be a proper file:// URL (no encoded slashes)
+        if (requestedUrl.includes("%2F") || requestedUrl.includes("%2f")) {
           return null;
         }
         if (url !== requestedUrl) {