@timo9378/flow2code 0.1.4 → 0.1.6

package/dist/compiler.cjs

@@ -1831,21 +1831,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1862,8 +1863,8 @@ function compile(ir, options) {
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
     pluginRegistry
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1873,7 +1874,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1888,8 +1889,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -2093,7 +2094,7 @@ function generateNodeChainDAG(writer, triggerId, context) {
       generateNodeBody(writer, node, context);
     });
     writer.writeLine(`)();`);
-    writer.writeLine(`${promiseVar}.catch(() => {});`);
+    writer.writeLine(`${promiseVar}.catch((err) => { console.error("[Flow2Code DAG Error]", err); });`);
     writer.blankLine();
   }
   if (dagNodeIds.length > 0) {
@@ -2143,11 +2144,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2166,7 +2164,18 @@ function generateNodeBody(writer, node, context) {
   const plugin = context.pluginRegistry.get(node.nodeType);
   if (plugin) {
     const pluginCtx = createPluginContext(context);
-    plugin.generate(node, writer, pluginCtx);
+    try {
+      plugin.generate(node, writer, pluginCtx);
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      const stack = err instanceof Error ? err.stack : void 0;
+      throw new Error(
+        `[flow2code] Plugin "${node.nodeType}" threw an error while generating node "${node.label}" (${node.id}):
+  ${errMsg}` + (stack ? `
+  Stack: ${stack}` : ""),
+        { cause: err }
+      );
+    }
   } else {
     throw new Error(
       `[flow2code] Unsupported node type: "${node.nodeType}". Register a plugin via pluginRegistry.register() or use a built-in node type.`
@@ -2174,6 +2183,13 @@ function generateNodeBody(writer, node, context) {
   }
 }
 function createPluginContext(context) {
+  const pendingChildBlockIds = [];
+  const applyChildBlockRegistration = (nodeId) => {
+    pendingChildBlockIds.push(nodeId);
+    context.childBlockNodeIds.add(nodeId);
+    context.symbolTableExclusions.add(nodeId);
+    context.generatedBlockNodeIds.add(nodeId);
+  };
   return {
     ir: context.ir,
     nodeMap: context.nodeMap,
@@ -2199,9 +2215,7 @@ function createPluginContext(context) {
       return resolveEnvVars(url, context);
     },
     generateChildNode(writer, node) {
-      context.childBlockNodeIds.add(node.id);
-      context.symbolTableExclusions.add(node.id);
-      context.generatedBlockNodeIds.add(node.id);
+      applyChildBlockRegistration(node.id);
       writer.writeLine(`// --- ${node.label} (${node.nodeType}) [${node.id}] ---`);
       generateNodeBody(writer, node, context);
       generateBlockContinuation(writer, node.id, context);
@@ -2245,27 +2259,27 @@ function collectRequiredPackages(ir, context) {
 function buildSourceMap(code, ir, filePath) {
   const lines = code.split("\n");
   const mappings = {};
-  const nodeMarkerRegex = /^[\s]*\/\/ --- .+? \(.+?\) \[(.+?)\] ---$/;
+  const validNodeIds = new Set(ir.nodes.map((n) => n.id));
   let currentNodeId = null;
   let currentStartLine = 0;
   for (let i = 0; i < lines.length; i++) {
     const lineNum = i + 1;
-    const match = lines[i].match(nodeMarkerRegex);
-    if (match) {
-      if (currentNodeId) {
-        mappings[currentNodeId] = {
-          startLine: currentStartLine,
-          endLine: lineNum - 1
-        };
-      }
-      const [, nodeId] = match;
-      if (ir.nodes.some((n) => n.id === nodeId)) {
-        currentNodeId = nodeId;
-        currentStartLine = lineNum;
-      } else {
-        currentNodeId = null;
-      }
+    const line = lines[i];
+    const bracketOpen = line.indexOf("[");
+    const bracketClose = line.indexOf("] ---", bracketOpen);
+    if (bracketOpen === -1 || bracketClose === -1) continue;
+    const trimmed = line.trimStart();
+    if (!trimmed.startsWith("//")) continue;
+    const candidateId = line.slice(bracketOpen + 1, bracketClose);
+    if (!validNodeIds.has(candidateId)) continue;
+    if (currentNodeId) {
+      mappings[currentNodeId] = {
+        startLine: currentStartLine,
+        endLine: lineNum - 1
+      };
     }
+    currentNodeId = candidateId;
+    currentStartLine = lineNum;
   }
   if (currentNodeId) {
     mappings[currentNodeId] = {

package/dist/compiler.js

@@ -1764,21 +1764,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1795,8 +1796,8 @@ function compile(ir, options) {
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
     pluginRegistry
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1806,7 +1807,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1821,8 +1822,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -2026,7 +2027,7 @@ function generateNodeChainDAG(writer, triggerId, context) {
       generateNodeBody(writer, node, context);
     });
     writer.writeLine(`)();`);
-    writer.writeLine(`${promiseVar}.catch(() => {});`);
+    writer.writeLine(`${promiseVar}.catch((err) => { console.error("[Flow2Code DAG Error]", err); });`);
     writer.blankLine();
   }
   if (dagNodeIds.length > 0) {
@@ -2076,11 +2077,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2099,7 +2097,18 @@ function generateNodeBody(writer, node, context) {
   const plugin = context.pluginRegistry.get(node.nodeType);
   if (plugin) {
     const pluginCtx = createPluginContext(context);
-    plugin.generate(node, writer, pluginCtx);
+    try {
+      plugin.generate(node, writer, pluginCtx);
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      const stack = err instanceof Error ? err.stack : void 0;
+      throw new Error(
+        `[flow2code] Plugin "${node.nodeType}" threw an error while generating node "${node.label}" (${node.id}):
+  ${errMsg}` + (stack ? `
+  Stack: ${stack}` : ""),
+        { cause: err }
+      );
+    }
   } else {
     throw new Error(
       `[flow2code] Unsupported node type: "${node.nodeType}". Register a plugin via pluginRegistry.register() or use a built-in node type.`
@@ -2107,6 +2116,13 @@ function generateNodeBody(writer, node, context) {
   }
 }
 function createPluginContext(context) {
+  const pendingChildBlockIds = [];
+  const applyChildBlockRegistration = (nodeId) => {
+    pendingChildBlockIds.push(nodeId);
+    context.childBlockNodeIds.add(nodeId);
+    context.symbolTableExclusions.add(nodeId);
+    context.generatedBlockNodeIds.add(nodeId);
+  };
   return {
     ir: context.ir,
     nodeMap: context.nodeMap,
@@ -2132,9 +2148,7 @@ function createPluginContext(context) {
       return resolveEnvVars(url, context);
     },
     generateChildNode(writer, node) {
-      context.childBlockNodeIds.add(node.id);
-      context.symbolTableExclusions.add(node.id);
-      context.generatedBlockNodeIds.add(node.id);
+      applyChildBlockRegistration(node.id);
       writer.writeLine(`// --- ${node.label} (${node.nodeType}) [${node.id}] ---`);
       generateNodeBody(writer, node, context);
       generateBlockContinuation(writer, node.id, context);
@@ -2178,27 +2192,27 @@ function collectRequiredPackages(ir, context) {
 function buildSourceMap(code, ir, filePath) {
   const lines = code.split("\n");
   const mappings = {};
-  const nodeMarkerRegex = /^[\s]*\/\/ --- .+? \(.+?\) \[(.+?)\] ---$/;
+  const validNodeIds = new Set(ir.nodes.map((n) => n.id));
   let currentNodeId = null;
   let currentStartLine = 0;
   for (let i = 0; i < lines.length; i++) {
     const lineNum = i + 1;
-    const match = lines[i].match(nodeMarkerRegex);
-    if (match) {
-      if (currentNodeId) {
-        mappings[currentNodeId] = {
-          startLine: currentStartLine,
-          endLine: lineNum - 1
-        };
-      }
-      const [, nodeId] = match;
-      if (ir.nodes.some((n) => n.id === nodeId)) {
-        currentNodeId = nodeId;
-        currentStartLine = lineNum;
-      } else {
-        currentNodeId = null;
-      }
+    const line = lines[i];
+    const bracketOpen = line.indexOf("[");
+    const bracketClose = line.indexOf("] ---", bracketOpen);
+    if (bracketOpen === -1 || bracketClose === -1) continue;
+    const trimmed = line.trimStart();
+    if (!trimmed.startsWith("//")) continue;
+    const candidateId = line.slice(bracketOpen + 1, bracketClose);
+    if (!validNodeIds.has(candidateId)) continue;
+    if (currentNodeId) {
+      mappings[currentNodeId] = {
+        startLine: currentStartLine,
+        endLine: lineNum - 1
+      };
     }
+    currentNodeId = candidateId;
+    currentStartLine = lineNum;
   }
   if (currentNodeId) {
     mappings[currentNodeId] = {

package/dist/server.js

@@ -3,7 +3,7 @@
 // src/server/index.ts
 import { createServer } from "http";
 import { readFile, stat } from "fs/promises";
-import { join as join2, extname, dirname as dirname2 } from "path";
+import { join as join2, extname, dirname as dirname2, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync2 } from "fs";
 
@@ -1717,21 +1717,22 @@ function compile(ir, options) {
       errors: validation.errors.map((e) => `[${e.code}] ${e.message}`)
     };
   }
+  const workingIR = validation.migrated && validation.migratedIR ? validation.migratedIR : ir;
   let plan;
   try {
-    plan = topologicalSort(ir);
+    plan = topologicalSort(workingIR);
   } catch (err) {
     return {
       success: false,
       errors: [err instanceof Error ? err.message : String(err)]
     };
   }
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+  const nodeMap = new Map(workingIR.nodes.map((n) => [n.id, n]));
   const platformName = options?.platform ?? "nextjs";
   const platform = getPlatform(platformName);
-  const symbolTable = buildSymbolTable(ir);
+  const symbolTable = buildSymbolTable(workingIR);
   const context = {
-    ir,
+    ir: workingIR,
     plan,
     nodeMap,
     envVars: /* @__PURE__ */ new Set(),
@@ -1748,8 +1749,8 @@ function compile(ir, options) {
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
     pluginRegistry
   };
-  const trigger = ir.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(ir, trigger.id);
+  const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1759,7 +1760,7 @@ function compile(ir, options) {
   );
   if (hasConcurrency) {
     context.dagMode = true;
-    for (const node of ir.nodes) {
+    for (const node of workingIR.nodes) {
       if (node.category !== "trigger" /* TRIGGER */) {
         context.symbolTableExclusions.add(node.id);
       }
@@ -1774,8 +1775,8 @@ function compile(ir, options) {
   });
   const code = sourceFile.getFullText();
   const filePath = platform.getOutputFilePath(trigger);
-  collectRequiredPackages(ir, context);
-  const sourceMap = buildSourceMap(code, ir, filePath);
+  collectRequiredPackages(workingIR, context);
+  const sourceMap = buildSourceMap(code, workingIR, filePath);
   const dependencies = {
     all: [...context.requiredPackages].sort(),
     missing: [...context.requiredPackages].sort(),
@@ -1979,7 +1980,7 @@ function generateNodeChainDAG(writer, triggerId, context) {
       generateNodeBody(writer, node, context);
     });
     writer.writeLine(`)();`);
-    writer.writeLine(`${promiseVar}.catch(() => {});`);
+    writer.writeLine(`${promiseVar}.catch((err) => { console.error("[Flow2Code DAG Error]", err); });`);
     writer.blankLine();
   }
   if (dagNodeIds.length > 0) {
@@ -2029,11 +2030,8 @@ function generateConcurrentNodes(writer, nodeIds, context) {
     writer.writeLine(";");
   }
   writer.writeLine(
-    `const [${taskNames.map((_, i) => `r${i}`).join(", ")}] = await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
+    `await Promise.all([${taskNames.map((t) => `${t}()`).join(", ")}]);`
   );
-  activeNodeIds.forEach((nodeId, i) => {
-    writer.writeLine(`flowState['${nodeId}'] = r${i};`);
-  });
   activeNodeIds.forEach((nodeId) => {
     const varName = context.symbolTable.getVarName(nodeId);
     writer.writeLine(`const ${varName} = flowState['${nodeId}'];`);
@@ -2052,7 +2050,18 @@ function generateNodeBody(writer, node, context) {
   const plugin = context.pluginRegistry.get(node.nodeType);
   if (plugin) {
     const pluginCtx = createPluginContext(context);
-    plugin.generate(node, writer, pluginCtx);
+    try {
+      plugin.generate(node, writer, pluginCtx);
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      const stack = err instanceof Error ? err.stack : void 0;
+      throw new Error(
+        `[flow2code] Plugin "${node.nodeType}" threw an error while generating node "${node.label}" (${node.id}):
+  ${errMsg}` + (stack ? `
+  Stack: ${stack}` : ""),
+        { cause: err }
+      );
+    }
   } else {
     throw new Error(
       `[flow2code] Unsupported node type: "${node.nodeType}". Register a plugin via pluginRegistry.register() or use a built-in node type.`
@@ -2060,6 +2069,13 @@ function generateNodeBody(writer, node, context) {
   }
 }
 function createPluginContext(context) {
+  const pendingChildBlockIds = [];
+  const applyChildBlockRegistration = (nodeId) => {
+    pendingChildBlockIds.push(nodeId);
+    context.childBlockNodeIds.add(nodeId);
+    context.symbolTableExclusions.add(nodeId);
+    context.generatedBlockNodeIds.add(nodeId);
+  };
   return {
     ir: context.ir,
     nodeMap: context.nodeMap,
@@ -2085,9 +2101,7 @@ function createPluginContext(context) {
       return resolveEnvVars(url, context);
     },
     generateChildNode(writer, node) {
-      context.childBlockNodeIds.add(node.id);
-      context.symbolTableExclusions.add(node.id);
-      context.generatedBlockNodeIds.add(node.id);
+      applyChildBlockRegistration(node.id);
       writer.writeLine(`// --- ${node.label} (${node.nodeType}) [${node.id}] ---`);
       generateNodeBody(writer, node, context);
       generateBlockContinuation(writer, node.id, context);
@@ -2131,27 +2145,27 @@ function collectRequiredPackages(ir, context) {
 function buildSourceMap(code, ir, filePath) {
   const lines = code.split("\n");
   const mappings = {};
-  const nodeMarkerRegex = /^[\s]*\/\/ --- .+? \(.+?\) \[(.+?)\] ---$/;
+  const validNodeIds = new Set(ir.nodes.map((n) => n.id));
   let currentNodeId = null;
   let currentStartLine = 0;
   for (let i = 0; i < lines.length; i++) {
     const lineNum = i + 1;
-    const match = lines[i].match(nodeMarkerRegex);
-    if (match) {
-      if (currentNodeId) {
-        mappings[currentNodeId] = {
-          startLine: currentStartLine,
-          endLine: lineNum - 1
-        };
-      }
-      const [, nodeId] = match;
-      if (ir.nodes.some((n) => n.id === nodeId)) {
-        currentNodeId = nodeId;
-        currentStartLine = lineNum;
-      } else {
-        currentNodeId = null;
-      }
+    const line = lines[i];
+    const bracketOpen = line.indexOf("[");
+    const bracketClose = line.indexOf("] ---", bracketOpen);
+    if (bracketOpen === -1 || bracketClose === -1) continue;
+    const trimmed = line.trimStart();
+    if (!trimmed.startsWith("//")) continue;
+    const candidateId = line.slice(bracketOpen + 1, bracketClose);
+    if (!validNodeIds.has(candidateId)) continue;
+    if (currentNodeId) {
+      mappings[currentNodeId] = {
+        startLine: currentStartLine,
+        endLine: lineNum - 1
+      };
     }
+    currentNodeId = candidateId;
+    currentStartLine = lineNum;
   }
   if (currentNodeId) {
     mappings[currentNodeId] = {
@@ -3469,7 +3483,9 @@ function handleCompile(body, projectRoot) {
     let writtenPath = null;
     if (shouldWrite && result.filePath && result.code) {
       const fullPath = resolve(join(projectRoot, result.filePath));
-      if (!fullPath.startsWith(resolve(projectRoot))) {
+      const resolvedRoot = resolve(projectRoot);
+      const sep = resolvedRoot.endsWith("/") || resolvedRoot.endsWith("\\") ? "" : process.platform === "win32" ? "\\" : "/";
+      if (!fullPath.startsWith(resolvedRoot + sep)) {
         return {
           status: 400,
           body: { success: false, error: "Output path escapes project root" }
@@ -3687,6 +3703,66 @@ function handleDecompile(body) {
   }
 }
 
+// src/lib/logger.ts
+import pc from "picocolors";
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+  silent: 4
+};
+var Logger = class {
+  /** Minimum log level (default: "info"). Set to "silent" to suppress all output. */
+  level = "info";
+  /** Prefix for all log lines (default: "[flow2code]") */
+  prefix = "[flow2code]";
+  shouldLog(level) {
+    return LEVEL_ORDER[level] >= LEVEL_ORDER[this.level];
+  }
+  debug(...args) {
+    if (!this.shouldLog("debug")) return;
+    console.log(pc.gray(`${this.prefix} ${pc.dim("DEBUG")}`), ...args);
+  }
+  info(...args) {
+    if (!this.shouldLog("info")) return;
+    console.log(pc.blue(`${this.prefix}`), ...args);
+  }
+  success(...args) {
+    if (!this.shouldLog("info")) return;
+    console.log(pc.green(`${this.prefix} \u2705`), ...args);
+  }
+  warn(...args) {
+    if (!this.shouldLog("warn")) return;
+    console.warn(pc.yellow(`${this.prefix} \u26A0\uFE0F`), ...args);
+  }
+  error(...args) {
+    if (!this.shouldLog("error")) return;
+    console.error(pc.red(`${this.prefix} \u274C`), ...args);
+  }
+  /** Print a blank line (respects silent mode) */
+  blank() {
+    if (!this.shouldLog("info")) return;
+    console.log();
+  }
+  /** Print raw text without prefix (respects silent mode) */
+  raw(...args) {
+    if (!this.shouldLog("info")) return;
+    console.log(...args);
+  }
+  /** Formatted key-value line for startup banners */
+  kv(key, value) {
+    if (!this.shouldLog("info")) return;
+    console.log(`  ${pc.dim("\u251C\u2500")} ${pc.bold(key)}  ${value}`);
+  }
+  /** Last key-value line (uses └─) */
+  kvLast(key, value) {
+    if (!this.shouldLog("info")) return;
+    console.log(`  ${pc.dim("\u2514\u2500")} ${pc.bold(key)}  ${value}`);
+  }
+};
+var logger = new Logger();
+
 // src/server/index.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname2(__filename);
@@ -3768,7 +3844,7 @@ function sendJson(res, status, body) {
 }
 var MAX_BODY_SIZE = 2 * 1024 * 1024;
 async function readBody(req) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     let totalSize = 0;
     req.on("data", (chunk) => {
@@ -3780,7 +3856,7 @@ async function readBody(req) {
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf-8")));
+    req.on("end", () => resolve3(Buffer.concat(chunks).toString("utf-8")));
     req.on("error", reject);
   });
 }
@@ -3789,7 +3865,13 @@ async function parseJsonBody(req) {
   return JSON.parse(raw);
 }
 async function serveStatic(staticDir, pathname, res) {
-  let filePath = join2(staticDir, pathname === "/" ? "index.html" : pathname);
+  const decodedPath = decodeURIComponent(pathname);
+  let filePath = join2(staticDir, decodedPath === "/" ? "index.html" : decodedPath);
+  const resolvedPath = resolve2(filePath);
+  const resolvedStaticDir = resolve2(staticDir);
+  if (!resolvedPath.startsWith(resolvedStaticDir + (resolvedStaticDir.endsWith("/") || resolvedStaticDir.endsWith("\\") ? "" : process.platform === "win32" ? "\\" : "/"))) {
+    return false;
+  }
   if (!extname(filePath)) {
     filePath += ".html";
   }
@@ -3877,7 +3959,7 @@ function startServer(options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
   const server = createServer((req, res) => {
     handleRequest(req, res, staticDir, projectRoot).catch((err) => {
-      console.error("[flow2code] Internal error:", err);
+      logger.error("Internal error:", err);
       res.writeHead(500, { "Content-Type": "text/plain" });
       res.end("Internal Server Error");
     });
@@ -3888,20 +3970,20 @@ function startServer(options = {}) {
     if (options.onReady) {
       options.onReady(url);
     } else {
-      console.log(`
-  \u{1F680} Flow2Code Dev Server`);
-      console.log(`  \u251C\u2500 Local:   ${url}`);
-      console.log(`  \u251C\u2500 API:     ${url}/api/compile`);
-      console.log(`  \u251C\u2500 Static:  ${staticDir}`);
-      console.log(`  \u2514\u2500 Project: ${projectRoot}`);
+      logger.blank();
+      logger.info("Flow2Code Dev Server");
+      logger.kv("Local:", url);
+      logger.kv("API:", `${url}/api/compile`);
+      logger.kv("Static:", staticDir);
+      logger.kvLast("Project:", projectRoot);
       if (!hasUI) {
-        console.log();
-        console.log(`  \u26A0\uFE0F  UI files not found (out/index.html missing).`);
-        console.log(`     The API endpoints still work, but the visual editor won't load.`);
-        console.log(`     To fix: run "pnpm build:ui" in the flow2code source directory,`);
-        console.log(`     or reinstall from npm: npm i @timo9378/flow2code@latest`);
+        logger.blank();
+        logger.warn("UI files not found (out/index.html missing).");
+        logger.raw("     The API endpoints still work, but the visual editor won't load.");
+        logger.raw('     To fix: run "pnpm build:ui" in the flow2code source directory,');
+        logger.raw("     or reinstall from npm: npm i @timo9378/flow2code@latest");
       }
-      console.log();
+      logger.blank();
     }
   });
   return server;