qiksy 1.0.0

package/tools/work-finder/vendor/server.mjs

@@ -0,0 +1,1006 @@
+#!/usr/bin/env node
+/**
+ * Work Finder — job-search assistant driven by headless Claude Code agents.
+ *
+ *   npm start          → http://localhost:5544
+ *
+ * The server exposes a small JSON API + static UI. Long operations (search,
+ * cover letters, browser auto-apply, LinkedIn import) run as background jobs
+ * that spawn `claude -p …` (see lib/agent.mjs) and are polled by the UI.
+ */
+import { createServer } from 'node:http';
+import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, extname } from 'node:path';
+import { spawn } from 'node:child_process';
+
+import { load, save, uid, ROOT, DATA_DIR } from './lib/store.mjs';
+import { runClaude, extractJson } from './lib/agent.mjs';
+import { searchPrompt, coverLetterPrompt, autoApplyPrompt, importResumePrompt, leadsSearchPrompt, pitchPrompt, buildFromStoryPrompt } from './lib/prompts.mjs';
+import { createJob, jobLog, listJobs, getJob, cancelJob, cancelActiveByLabel, jobEvents } from './lib/jobs.mjs';
+import { ensureBrowser } from './scripts/launch-browser.mjs';
+import { PLANS, SELF_SETTABLE_PLANS } from './lib/plans.mjs';
+import { verifyLicense, licensePlanId, RECHECK_MS } from './lib/license.mjs';
+import { ROLE_CATALOG, SENIORITY, LOCATIONS, detectRoles } from './lib/catalog.mjs';
+import { checkMany, checkVacancyUrl } from './lib/linkcheck.mjs';
+import { probeEngine, startLogin, submitLoginCode } from './lib/engine.mjs';
+import { normalizeLinkedin } from './lib/linkedin.mjs';
+
+const PORT = Number(process.env.WF_PORT) || 5544;
+const PUBLIC_DIR = resolve(ROOT, 'public');
+const MIME = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css', '.png': 'image/png', '.svg': 'image/svg+xml' };
+
+let db = load();
+
+// ── тариф ──────────────────────────────────────────────────────────────────
+// Единственная ось — число кандидатов (maxProfiles). Кредитов НЕТ: юзер работает
+// на своём ключе Claude, частота запросов упирается в его тариф Claude.
+//
+// Эффективный тариф: `dev` (self-host) выставляется руками; платные start/pro
+// приходят ТОЛЬКО из валидной лицензии (db.settings.licenseInfo). Ручной выбор
+// плана в настройках ограничен free/dev — иначе на своей машине юзер выставил бы pro.
+// `dev` (unlimited — the self-host escape hatch) is the OWNER's path, not a
+// customer one: it unlocks ONLY when this backend is started with WF_DEV=1.
+// Without the flag the value is inert even if it lands in db.json (old migration,
+// a hand-edit), and the effective plan falls back to the license → free. This
+// closes the one-click "Dev — no limits" bypass in Settings while keeping the
+// owner's local unlimited a single env var away.
+const DEV_UNLOCKED = /^(1|true|yes|on)$/i.test(process.env.WF_DEV || '');
+
+function effectivePlanId() {
+  if (db.settings.plan === 'dev' && DEV_UNLOCKED) return 'dev';
+  return licensePlanId(db.settings.licenseInfo);
+}
+const plan = () => PLANS[effectivePlanId()] || PLANS.free;
+/** Effective candidate limit. A paid (Pro) license bought as Team carries `seats`,
+ *  which raises the limit above the plan's default of 1 — that's how "Team = Pro on N
+ *  seats" works without a separate plan. Individual Pro / no seats → the plan default. */
+function maxProfilesEff() {
+  const s = db.settings.licenseInfo?.seats;
+  if (effectivePlanId() === 'pro' && Number.isFinite(s) && s > 1) return s;
+  return plan().maxProfiles;
+}
+
+/** Проверить лицензию у воркера и закэшировать результат (best-effort). */
+async function refreshLicense() {
+  const info = await verifyLicense(db.settings.license || '');
+  if (info) { // null = офлайн → оставляем прошлый кэш
+    db.settings.licenseInfo = info;
+    save(db);
+  }
+  return db.settings.licenseInfo;
+}
+
+/** Информационный лог стоимости токенов юзера (его собственный ключ). Не гейт. */
+function logCost(label, costUsd) {
+  if (costUsd) db.usage.totalCostUsd = Math.round((db.usage.totalCostUsd + costUsd) * 1e4) / 1e4;
+  db.usage.log.push({ at: Date.now(), label, costUsd: costUsd ?? null });
+  if (db.usage.log.length > 200) db.usage.log.splice(0, db.usage.log.length - 200);
+  save(db);
+}
+
+function billingInfo() {
+  const p = plan();
+  const li = db.settings.licenseInfo;
+  return {
+    plan: effectivePlanId(),
+    planName: p.name,
+    manualPlan: db.settings.plan, // что выставлено руками (free/dev)
+    license: {
+      set: !!db.settings.license,
+      key: db.settings.license ? db.settings.license.slice(0, 6) + '…' : '',
+      plan: li && li.plan ? li.plan : 'free',
+      active: !!(li && li.active),
+      invalid: !!(li && li.invalid),
+      paidUntil: (li && li.paidUntil) || 0,
+      trial: !!(li && li.trial),
+      checkedAt: (li && li.checkedAt) || 0,
+    },
+    maxProfiles: isFinite(maxProfilesEff()) ? maxProfilesEff() : null,
+    maxRoles: isFinite(p.maxRoles) ? p.maxRoles : null,
+    seats: db.settings.licenseInfo?.seats || null, // Team seat count, if the license carries one
+    autoApply: p.autoApply,
+    leads: p.leads,
+    watch: p.watch, // scheduled monitoring (Pro) — the premium "find before the market" feature
+    watchCfg: { enabled: !!db.settings.watch?.enabled, everyHours: db.settings.watch?.everyHours || 6, lastRunAt: db.settings.watch?.lastRunAt || 0 },
+    devUnlocked: DEV_UNLOCKED, // owner's self-host escape hatch; hides the "Dev" plan option from customers
+
+    totalCostUsd: db.usage.totalCostUsd, // информативно: сколько потратил СВОЙ ключ
+  };
+}
+
+// ── job workers ────────────────────────────────────────────────────────────
+
+/** Запись в историю поисков (хлебные крошки в UI). */
+function createSearchRun(targets) {
+  const run = {
+    id: uid(),
+    at: Date.now(),
+    titles: targets.map(p => p.title),
+    profileIds: [...new Set(targets.map(p => p.profileId))],
+    vacancyIds: [],
+    added: 0,
+  };
+  db.searches.unshift(run);
+  if (db.searches.length > 50) db.searches.length = 50;
+  save(db);
+  return run;
+}
+
+// Юзер что-то СДЕЛАЛ с вакансией: сменил статус, написал письмо, отправил заявку,
+// закрепил. Такие при каскадном удалении роли/кандидата НЕ трогаем — это его труд
+// (та же логика, что в purgeHistory). Остальное — нетронутая находка, шум, уходит.
+const isTouched = (v) => v.status !== 'new' || !!v.coverLetter || !!v.applyResult || !!v.pinned;
+
+function startSearch(position, run = null) {
+  const profile = db.profiles.find(p => p.id === position.profileId) || db.profiles[0];
+  return createJob('search', `Поиск: ${position.title}`, async (job, signal) => {
+    const urlOf = it => it?.vacancy_url || it?.careers_url || null;
+    const keyOf = it => (it.company + '|' + it.vacancy_title).toLowerCase();
+    const seen = new Set(db.vacancies.map(v => keyOf(v)));
+    let added = 0;
+    let dead = 0;
+
+    // добавление одной вакансии (партиал во время поиска или из финального массива)
+    const push = it => {
+      const rawMatch = Number(it.match);
+      // `...it` is UNSANITIZED model output, so the server's identity/state fields go AFTER
+      // the spread — a hallucinated key (status/positionId/id/foundAt…) can never clobber
+      // them and mis-tag a vacancy under the wrong candidate or as already-sent. `match`
+      // is likewise clamped last (adversarial review 2026-07-25).
+      const vac = {
+        ...it,
+        id: uid(),
+        positionId: position.id,
+        status: 'new',
+        coverLetter: null,
+        applyResult: null,
+        foundAt: Date.now(),
+        match: Number.isFinite(rawMatch) ? Math.max(0, Math.min(100, Math.round(rawMatch))) : null,
+      };
+      db.vacancies.push(vac);
+      if (run) { run.vacancyIds.push(vac.id); run.added++; }
+      added++;
+      save(db);
+      // Push the full vacancy to the live stream so the theatre can flip in a real card
+      // the instant it's found — before the next /api/state poll reconciles it.
+      jobEvents.emit('event', { kind: 'vacancy', jobId: job.id, vacancy: vac, at: Date.now() });
+    };
+    const acceptable = it => it?.company && it?.vacancy_title && !seen.has(keyOf(it)) && (urlOf(it) || it.apply_email);
+
+    // партиалы: агент стримит `VACANCY: {...}` — проверяем ссылку и сразу кладём в базу
+    let chain = Promise.resolve();
+    const onPartial = it => {
+      chain = chain.then(async () => {
+        if (!acceptable(it)) return;
+        seen.add(keyOf(it));
+        const url = urlOf(it);
+        if (url) {
+          const chk = await checkVacancyUrl(url);
+          if (!chk.ok) { dead++; jobLog(job, `✂ ${it.company}: ${chk.reason}`); return; }
+        }
+        push(it);
+        jobLog(job, `＋ ${it.company} — ${it.vacancy_title}`);
+      }).catch(() => { /* партиал не критичен */ });
+    };
+
+    /* ONE SWEEP. The search does not stop at a number — it stops when a sweep finds
+       nothing new. "Find 8 and stop" was our own ceiling, not the market's: the
+       owner asked for React roles worldwide and got four, because the prompt told
+       the agent to quit at eight and the freshness window was three days. */
+    /* Safety rails, because "everything" runs on the user's own Claude quota:
+       stop after two barren sweeps in a row, and never exceed maxSweeps. */
+    const maxSweeps = Math.max(1, db.settings.maxSweeps ?? 6);
+
+    const sweep = async (wave) => {
+      const exclude = db.vacancies.filter(v => v.positionId === position.id).map(v => v.company);
+      const before = added;
+      const r = await runClaude({
+        prompt: searchPrompt(position, profile, exclude, db.settings, { wave, waves: maxSweeps, canNarrow: effectivePlanId() !== 'free' }),
+        allowedTools: ['WebSearch', 'WebFetch'],
+        withBrowser: !!db.settings.searchViaBrowser,
+        model: db.settings.model,
+        timeoutMs: (db.settings.searchViaBrowser ? 25 : 15) * 60_000,
+        signal,
+        onPartial,
+        onEvent: line => jobLog(job, line),
+      });
+      await chain.catch(() => {}); // партиалы этой волны
+      if (r.ok) {
+        const items = extractJson(r.result);
+        if (Array.isArray(items)) {
+          const rest = items.filter(acceptable);
+          if (rest.length) {
+            jobLog(job, `проверяю ссылки (${rest.length})…`);
+            const linkResults = await checkMany(rest.map(urlOf));
+            for (const it of rest) {
+              if (!acceptable(it)) continue;
+              seen.add(keyOf(it));
+              const url = urlOf(it);
+              const chk = url ? linkResults.get(url) : null;
+              if (url && chk && !chk.ok) { dead++; jobLog(job, `✂ ${it.company}: ${chk.reason}`); continue; }
+              push(it);
+            }
+          }
+        }
+      }
+      if (r.costUsd) logCost(`Поиск: ${position.title} (волна ${wave})`, r.costUsd);
+      return { ok: r.ok, error: r.error, costUsd: r.costUsd || 0, gained: added - before };
+    };
+
+    let cost = 0;
+    let barren = 0;
+    let lastErr = null;
+    let wave = 0;
+    while (wave < maxSweeps && !signal.aborted) {
+      wave++;
+      if (wave > 1) jobLog(job, `волна ${wave} из ${maxSweeps} — ищу то, чего ещё нет…`);
+      const r = await sweep(wave);
+      cost += r.costUsd;
+      if (!r.ok) { lastErr = r.error; break; }
+      jobLog(job, `волна ${wave}: +${r.gained} (всего ${added})`);
+      barren = r.gained ? 0 : barren + 1;
+      if (barren >= 2) { jobLog(job, 'две волны подряд без новых — рынок вычерпан'); break; }
+    }
+
+    const res = { ok: !lastErr, error: lastErr, costUsd: cost, result: '[]' };
+    if (!res.ok) {
+      // таймаут/обрыв, но партиалы уже в базе — это частичный успех, не ошибка
+      if (added > 0) {
+        jobLog(job, `⚠ ${res.error} — но ${added} вакансий уже добавлено по ходу поиска`);
+        return { found: added, added, dead, sweeps: wave, costUsd: cost, truncated: true };
+      }
+      throw new Error(res.error);
+    }
+    jobLog(job, `✓ добавлено: ${added}${dead ? `, отброшено битых ссылок: ${dead}` : ''} — волн: ${wave}`);
+    return { found: added, added, dead, sweeps: wave, costUsd: cost };
+  });
+}
+
+function startCoverLetter(vacancy) {
+  const position = db.positions.find(p => p.id === vacancy.positionId);
+  const profile = db.profiles.find(p => p.id === position?.profileId) || db.profiles[0];
+  return createJob('prepare', `Отклик: ${vacancy.company} — ${vacancy.vacancy_title}`, async (job, signal) => {
+    const res = await runClaude({
+      prompt: coverLetterPrompt(vacancy, profile),
+      allowedTools: ['WebFetch'],
+      model: db.settings.model,
+      signal,
+      onEvent: line => jobLog(job, line),
+    });
+    if (!res.ok) throw new Error(res.error);
+    vacancy.coverLetter = res.result.trim();
+    if (vacancy.status === 'new') vacancy.status = 'prepared';
+    save(db);
+    logCost(`Письмо: ${vacancy.company}`, res.costUsd); // в кошельке письма тоже по токенам
+    jobLog(job, '✓ сопроводительное письмо готово');
+    return { costUsd: res.costUsd };
+  });
+}
+
+function startAutoApply(vacancy) {
+  const position = db.positions.find(p => p.id === vacancy.positionId);
+  const profile = db.profiles.find(p => p.id === position?.profileId) || db.profiles[0];
+  return createJob('apply', `Автозаявка: ${vacancy.company} — ${vacancy.vacancy_title}`, async (job, signal) => {
+    jobLog(job, 'проверяю браузер (CDP :9222)…');
+    if (!(await ensureBrowser())) throw new Error('браузер не поднялся на :9222');
+    const res = await runClaude({
+      prompt: autoApplyPrompt(vacancy, profile, vacancy.coverLetter, db.settings.autoSubmit),
+      withBrowser: true,
+      allowedTools: ['WebFetch'],
+      model: db.settings.model,
+      timeoutMs: 15 * 60_000,
+      signal,
+      onEvent: line => jobLog(job, line),
+    });
+    if (!res.ok) throw new Error(res.error);
+    const outcome = extractJson(res.result) || { status: 'unknown', details: res.result.slice(0, 1000) };
+    vacancy.applyResult = { ...outcome, at: Date.now() };
+    if (outcome.status === 'submitted') vacancy.status = 'sent';
+    else if (outcome.status === 'ready_for_review') vacancy.status = 'ready';
+    save(db);
+    logCost(`Автозаявка: ${vacancy.company}`, res.costUsd);
+    jobLog(job, `✓ ${outcome.status}: ${String(outcome.details || '').slice(0, 200)}`);
+    return outcome;
+  });
+}
+
+function startLeadsSearch() {
+  const exclude = [...new Set([...db.leads.map(l => l.company), ...db.vacancies.map(v => v.company)])];
+  return createJob('leads', 'Поиск лидов: свежие инвестраунды', async (job, signal) => {
+    const res = await runClaude({
+      prompt: leadsSearchPrompt(db.profiles, exclude, db.settings),
+      allowedTools: ['WebSearch', 'WebFetch'],
+      model: db.settings.model,
+      timeoutMs: 15 * 60_000,
+      signal,
+      onEvent: line => jobLog(job, line),
+    });
+    if (!res.ok) throw new Error(res.error);
+    const items = extractJson(res.result);
+    if (!Array.isArray(items)) throw new Error('agent returned no JSON array: ' + res.result.slice(0, 300));
+    let added = 0;
+    for (const it of items) {
+      if (!it?.company) continue;
+      if (db.leads.some(l => l.company.toLowerCase() === it.company.toLowerCase())) continue;
+      const profile = db.profiles.find(p => p.name === it.fits_profile) || db.profiles[0];
+      db.leads.push({ id: uid(), status: 'new', pitch: null, foundAt: Date.now(), profileId: profile?.id, ...it });
+      added++;
+    }
+    save(db);
+    logCost('Поиск лидов', res.costUsd);
+    jobLog(job, `✓ найдено ${items.length}, добавлено новых: ${added}`);
+    return { found: items.length, added, costUsd: res.costUsd };
+  });
+}
+
+function startPitch(lead) {
+  const profile = db.profiles.find(p => p.id === lead.profileId) || db.profiles[0];
+  return createJob('pitch', `Питч: ${lead.company}`, async (job, signal) => {
+    const res = await runClaude({
+      prompt: pitchPrompt(lead, profile),
+      allowedTools: ['WebFetch'],
+      model: db.settings.model,
+      signal,
+      onEvent: line => jobLog(job, line),
+    });
+    if (!res.ok) throw new Error(res.error);
+    lead.pitch = res.result.trim();
+    if (lead.status === 'new') lead.status = 'ready';
+    save(db);
+    logCost(`Питч: ${lead.company}`, res.costUsd);
+    jobLog(job, '✓ питч готов');
+    return { costUsd: res.costUsd };
+  });
+}
+
+/**
+ * Онбординг одной кнопкой: импорт резюме (LinkedIn или текст) → позиции из
+ * каталога (выбранные или автоподбор по резюме) → автозапуск поиска на
+ * сколько хватит кредитов. Любая конфигурация приводит к работающему поиску.
+ */
+function startOnboard(profile, { linkedin, resumeText, roles = [], seniority = 'Senior', engagement = 'both' }) {
+  return createJob('import', `Новый кандидат: ${profile.name}`, async (job, signal) => {
+    // 1. резюме
+    let importCost = 0;
+    if (resumeText?.trim()) {
+      jobLog(job, 'структурирую вставленное резюме…');
+      const res = await runClaude({ prompt: importResumePrompt(resumeText), model: db.settings.model, signal, onEvent: l => jobLog(job, l) });
+      if (!res.ok) throw new Error(res.error);
+      profile.resume = res.result.trim();
+      importCost = res.costUsd || 0;
+    } else if (linkedin) {
+      jobLog(job, 'проверяю браузер (CDP :9222)…');
+      if (!(await ensureBrowser())) throw new Error('браузер не поднялся на :9222');
+      const rawPath = resolve(DATA_DIR, `linkedin-${profile.id}-raw.txt`);
+      jobLog(job, `читаю профиль ${linkedin}…`);
+      await new Promise((res2, rej) => {
+        const child = spawn(process.execPath, [resolve(ROOT, 'scripts/extract-linkedin.mjs'), linkedin, rawPath], { cwd: ROOT });
+        child.stderr.on('data', d => jobLog(job, String(d).trim()));
+        child.on('close', code => (code === 0 ? res2() : rej(new Error('extract-linkedin failed'))));
+      });
+      jobLog(job, 'структурирую резюме через Claude…');
+      const res = await runClaude({ prompt: importResumePrompt(readFileSync(rawPath, 'utf8')), model: db.settings.model, signal, onEvent: l => jobLog(job, l) });
+      if (!res.ok) throw new Error(res.error);
+      profile.resume = res.result.trim();
+      profile.linkedin = linkedin;
+      importCost = res.costUsd || 0;
+    }
+    save(db);
+    // онбординговое структурирование резюме — тоже токены (для кошелька)
+    if (importCost) logCost(`Онбординг: ${profile.name}`, importCost);
+
+    // 2. позиции из каталога (или автоподбор по резюме)
+    let roleIds = roles.filter(id => ROLE_CATALOG.some(r => r.id === id));
+    if (!roleIds.length) {
+      roleIds = detectRoles(profile.resume);
+      jobLog(job, roleIds.length ? `роли подобраны по резюме: ${roleIds.join(', ')}` : 'роли по резюме не распознаны');
+    }
+    if (!roleIds.length) roleIds = ['fullstack-js']; // запасной вариант: поиск должен работать всегда
+    const created = [];
+    const maxRoles = plan().maxRoles; // role cap applies to auto-onboarding too
+    for (const id of roleIds) {
+      if (isFinite(maxRoles) && db.positions.filter(p => p.profileId === profile.id).length >= maxRoles) break;
+      const role = ROLE_CATALOG.find(r => r.id === id);
+      const title = `${seniority} ${role.title}`.trim();
+      if (db.positions.some(p => p.profileId === profile.id && p.title === title)) continue;
+      const pos = { id: uid(), title, keywords: role.keywords, engagement, profileId: profile.id, selected: true };
+      db.positions.push(pos);
+      created.push(pos);
+    }
+    save(db);
+    jobLog(job, `создано позиций: ${created.length}`);
+
+    // 3. автопоиск по всем созданным позициям (кредитов нет — лимит только на профили)
+    const run = created.length ? createSearchRun(created) : null;
+    created.forEach(p => startSearch(p, run));
+    if (created.length) jobLog(job, `запущен поиск по ${created.length} позициям`);
+    return { resumeChars: profile.resume.length, positions: created.length, searches: created.length };
+  });
+}
+
+function startLinkedinImport(profile, url) {
+  return createJob('import', `Импорт LinkedIn: ${profile.name}`, async (job, signal) => {
+    jobLog(job, 'проверяю браузер (CDP :9222)…');
+    if (!(await ensureBrowser())) throw new Error('браузер не поднялся на :9222');
+    const rawPath = resolve(DATA_DIR, `linkedin-${profile.id}-raw.txt`);
+    jobLog(job, `читаю профиль ${url}…`);
+    await new Promise((res2, rej) => {
+      const child = spawn(process.execPath, [resolve(ROOT, 'scripts/extract-linkedin.mjs'), url, rawPath], { cwd: ROOT });
+      child.stderr.on('data', d => jobLog(job, String(d).trim()));
+      child.on('close', code => (code === 0 ? res2() : rej(new Error('extract-linkedin failed'))));
+    });
+    jobLog(job, 'структурирую резюме через Claude…');
+    const raw = readFileSync(rawPath, 'utf8');
+    const res = await runClaude({
+      prompt: importResumePrompt(raw),
+      model: db.settings.model,
+      signal,
+      onEvent: line => jobLog(job, line),
+    });
+    if (!res.ok) throw new Error(res.error);
+    profile.resume = res.result.trim();
+    profile.linkedin = url;
+    save(db);
+    logCost(`Импорт резюме: ${profile.name}`, res.costUsd);
+    jobLog(job, `✓ резюме импортировано (${profile.resume.length} символов)`);
+    return { chars: profile.resume.length };
+  });
+}
+
+// ── http plumbing ──────────────────────────────────────────────────────────
+
+const readBody = req => new Promise((res, rej) => {
+  let data = '';
+  req.on('data', c => { data += c; if (data.length > 2e6) req.destroy(); });
+  req.on('end', () => { try { res(data ? JSON.parse(data) : {}); } catch (e) { rej(e); } });
+  req.on('error', rej);
+});
+
+const json = (res, code, obj) => {
+  res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(obj));
+};
+
+/* Company-logo resolver for the card avatars. The DuckDuckGo favicon service
+   answers HTTP 404 for a domain it has no icon for — but with a generic grey
+   chevron PNG in the body, which a browser <img> would happily DECODE and show.
+   So we resolve it HERE, where the status code is visible: 404 upstream (or that
+   known placeholder body) → 404 to the client, whose <img> then errors out and
+   the Lucide role glyph shows instead. Real icons stream through, cached in
+   memory so a re-render (or the same company twice) costs nothing. */
+const LOGO_CACHE = new Map(); // domain → { type, buf } | null   (null = no logo)
+const LOGO_PLACEHOLDER_LEN = 1478; // DDG's "no favicon" chevron — a fixed asset
+const DOMAIN_RE = /^[a-z0-9.-]{1,253}$/;
+async function resolveLogo(domain) {
+  if (LOGO_CACHE.has(domain)) return LOGO_CACHE.get(domain);
+  let result = null;
+  try {
+    const r = await fetch(`https://icons.duckduckgo.com/ip3/${domain}.ico`, {
+      signal: AbortSignal.timeout(4000),
+    });
+    const type = r.headers.get('content-type') || '';
+    if (r.ok && type.startsWith('image/')) {
+      const buf = Buffer.from(await r.arrayBuffer());
+      // a live-but-iconless domain can still 200 with the placeholder body
+      if (buf.length && buf.length !== LOGO_PLACEHOLDER_LEN) result = { type, buf };
+    }
+  } catch { /* upstream down / timeout → treat as "no logo", fall back to glyph */ }
+  if (LOGO_CACHE.size > 2000) LOGO_CACHE.clear(); // cheap unbounded-growth guard
+  LOGO_CACHE.set(domain, result);
+  return result;
+}
+
+let browserAlive = false;
+async function probeBrowser() {
+  try {
+    const r = await fetch('http://localhost:9222/json/version', { signal: AbortSignal.timeout(1000) });
+    browserAlive = r.ok;
+  } catch { browserAlive = false; }
+}
+probeBrowser();
+setInterval(probeBrowser, 15_000).unref();
+
+// UI origins allowed to call this local backend cross-origin: the Nx dev
+// servers AND the deployed studio (its static build fetches http://localhost:5544
+// directly — browsers treat localhost as a secure origin, so an https page may).
+const UI_ORIGINS = new Set([
+  'https://studio.qiksy.app',
+  'https://qiksy.app',
+  ...Array.from({ length: 9 }, (_, i) => `http://localhost:${4300 + i}`),
+  'http://localhost:4200',
+  'http://127.0.0.1:4200',
+]);
+
+/* The request handler is EXPORTED so the unified qiksy-engine can mount Work Finder as a
+   module (it rewrites /api/wf/… → /api/… and delegates here). Run directly (dev/launchd),
+   the guard at the bottom still binds its own port, so the standalone backend is unchanged. */
+export const requestHandler = async (req, res) => {
+  const url = new URL(req.url, 'http://x');
+  const path = url.pathname;
+  const seg = path.split('/').filter(Boolean); // e.g. ['api','vacancies',':id','prepare']
+
+  // CORS for the allowed UI origins (echo the origin, not *, so it stays a list).
+  const origin = req.headers.origin;
+  if (origin && UI_ORIGINS.has(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Vary', 'Origin');
+    if (req.method === 'OPTIONS') {
+      // Chrome Private Network Access: public qiksy.app → localhost is blocked unless the
+      // preflight carries this header. See the note in client-finder-backend.
+      if (req.headers['access-control-request-private-network'] === 'true') {
+        res.setHeader('Access-Control-Allow-Private-Network', 'true');
+      }
+      res.writeHead(204, {
+        'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type',
+        'Access-Control-Max-Age': '86400',
+      });
+      res.end();
+      return;
+    }
+  }
+
+  try {
+    if (!path.startsWith('/api')) {
+      const file = path === '/' ? 'index.html' : path.slice(1);
+      const full = resolve(PUBLIC_DIR, file);
+      if (full.startsWith(PUBLIC_DIR) && existsSync(full)) {
+        res.writeHead(200, { 'Content-Type': MIME[extname(full)] || 'application/octet-stream' });
+        res.end(readFileSync(full));
+      } else {
+        res.writeHead(404); res.end('not found');
+      }
+      return;
+    }
+
+    // ── state ──
+    /* Start Anthropic's own sign-in on this machine and hand back ITS link, so the
+       panel can offer "open" and "copy" instead of firing a browser off-screen. We
+       never build a "connect with Claude" of our own — this launches theirs, and the
+       panel polls /api/engine until it turns green. */
+    if (req.method === 'POST' && path === '/api/engine/login') {
+      return json(res, 200, await startLogin());
+    }
+
+    /* The callback page shows a code instead of redirecting when it cannot reach the
+       CLI's loopback (another machine, or a browser that won't open localhost). This
+       is where that code goes. */
+    if (req.method === 'POST' && path === '/api/engine/login/code') {
+      const { code } = await readBody(req);
+      return json(res, 200, submitLoginCode(code));
+    }
+
+    /* Can this machine run the agent at all? The gate asks BEFORE demanding a key,
+       because the CLI may already be logged in with a Claude subscription — in which
+       case a key is not just optional, it is irrelevant. ?force=1 re-probes after the
+       user has gone and logged in. */
+    if (req.method === 'GET' && path === '/api/engine') {
+      const force = /[?&]force=1/.test(req.url || '');
+      return json(res, 200, await probeEngine({ force }));
+    }
+
+    /* Card avatar logo — proxies + filters the DDG favicon so logo-less companies
+       get a clean 404 (→ the UI shows a Lucide role glyph, not a grey placeholder). */
+    if (req.method === 'GET' && path === '/api/logo') {
+      const d = (url.searchParams.get('d') || '').toLowerCase();
+      if (!DOMAIN_RE.test(d) || !d.includes('.')) { res.writeHead(404); res.end(); return; }
+      const logo = await resolveLogo(d);
+      if (!logo) { res.writeHead(404); res.end(); return; }
+      res.writeHead(200, { 'Content-Type': logo.type, 'Cache-Control': 'public, max-age=604800' });
+      res.end(logo.buf);
+      return;
+    }
+
+    /* LIVE STREAM (SSE). Pushes every job log line, status change and vacancy found the
+       instant it happens — so the live-agent theatre shows the agent working without the
+       2.5 s poll lag or the last-12-log-line truncation. The /api/state poll stays the
+       source of truth; this is a live overlay. If the EventSource can't connect the
+       client just keeps polling, so nothing breaks. Never json()/end() here — the socket
+       stays open until the client disconnects. */
+    if (req.method === 'GET' && path === '/api/stream') {
+      res.writeHead(200, {
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        'Cache-Control': 'no-cache, no-transform',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no', // don't let a proxy buffer the stream
+      });
+      res.write('retry: 3000\n\n');
+      // Sync frame: any searches already running when a tab (re)connects mid-run.
+      const live = listJobs().filter(j => j.status === 'running' || j.status === 'queued')
+        .map(j => ({ id: j.id, type: j.type, label: j.label, status: j.status }));
+      res.write(`data: ${JSON.stringify({ kind: 'hello', jobs: live, at: Date.now() })}\n\n`);
+      const onEvent = ev => {
+        // A stalled-but-connected reader must not buffer unbounded: past ~1 MB queued,
+        // drop frames until it drains (the /api/state poll still reconciles the truth).
+        if (res.writableLength > 1_000_000) return;
+        try { res.write(`data: ${JSON.stringify(ev)}\n\n`); } catch { /* socket gone */ }
+      };
+      jobEvents.on('event', onEvent);
+      const ka = setInterval(() => { try { res.write(': ping\n\n'); } catch { /* gone */ } }, 25_000);
+      ka.unref?.();
+      const cleanup = () => { clearInterval(ka); jobEvents.off('event', onEvent); };
+      req.on('close', cleanup);
+      req.on('error', cleanup);
+      res.on('error', cleanup);
+      return;
+    }
+
+    if (req.method === 'GET' && path === '/api/state') {
+      return json(res, 200, {
+        ...db, browserAlive, jobs: listJobs(), billing: billingInfo(),
+        catalog: ROLE_CATALOG.map(({ id, group, title, keywords }) => ({ id, group, title, keywords })),
+        seniority: SENIORITY, locations: LOCATIONS,
+      });
+    }
+    /* SEARCH HISTORY — grouped by day, per candidate.
+       Grouping happens here, not in the browser, because the day boundary depends on
+       the machine's own clock and the UI should not have to agree with it separately.
+       Labels are NOT localised here: the API returns `daysAgo`, the interface says
+       "today" / "yesterday" in the user's language. */
+    if (req.method === 'GET' && path === '/api/history') {
+      const startOfDay = t => { const d = new Date(t); d.setHours(0, 0, 0, 0); return d.getTime(); };
+      const today = startOfDay(Date.now());
+      const nameOf = id => db.profiles.find(p => p.id === id)?.name || '';
+      const byDay = new Map();
+      for (const r of [...(db.searches || [])].sort((a, b) => b.at - a.at)) {
+        const day = startOfDay(r.at);
+        if (!byDay.has(day)) byDay.set(day, []);
+        // A run's findings are counted LIVE, not from the stored number: a vacancy
+        // deleted since (or purged) must not still be advertised as findable.
+        const alive = (r.vacancyIds || []).filter(id => db.vacancies.some(v => v.id === id));
+        byDay.get(day).push({
+          id: r.id,
+          at: r.at,
+          titles: r.titles || [],
+          profiles: (r.profileIds || []).map(id => ({ id, name: nameOf(id) })).filter(p => p.name),
+          found: alive.length,
+          vacancyIds: alive,
+        });
+      }
+      return json(res, 200, {
+        keptDays: db.settings.historyDays ?? 30,
+        days: [...byDay.entries()].map(([day, runs]) => ({
+          day,
+          daysAgo: Math.round((today - day) / 86_400_000),
+          runs,
+          found: runs.reduce((n, r) => n + r.found, 0),
+        })),
+      });
+    }
+
+    if (req.method === 'GET' && path === '/api/jobs') {
+      return json(res, 200, listJobs());
+    }
+    if (req.method === 'POST' && seg[1] === 'jobs' && seg[2] && seg[3] === 'cancel') {
+      return json(res, 200, { ok: cancelJob(seg[2]) });
+    }
+    if (req.method === 'GET' && seg[1] === 'jobs' && seg[2]) {
+      const j = getJob(seg[2]);
+      return j ? json(res, 200, j) : json(res, 404, { error: 'no such job' });
+    }
+
+    // ── settings ──
+    if (req.method === 'POST' && path === '/api/settings') {
+      const body = await readBody(req);
+      // Платные планы включаются лицензией, не руками. `dev` (безлимит) — тоже не
+      // руками: это лазейка владельца, и она открыта только при старте с WF_DEV=1.
+      // Без флага из настроек доступен один free — иначе покупатель в один клик
+      // выставил бы «Dev — без лимитов» и обошёл лимит кандидатов.
+      const selfSettable = DEV_UNLOCKED ? SELF_SETTABLE_PLANS : SELF_SETTABLE_PLANS.filter((p) => p !== 'dev');
+      if ('plan' in body && !selfSettable.includes(body.plan)) {
+        delete body.plan;
+      }
+      // license/licenseInfo меняются только через /api/license — не даём их перезаписать.
+      delete body.license;
+      delete body.licenseInfo;
+      Object.assign(db.settings, body);
+      save(db);
+      return json(res, 200, db.settings);
+    }
+
+    // ── watch / мониторинг (Pro): включить/выключить + частота ──
+    if (req.method === 'POST' && path === '/api/watch') {
+      if (!plan().watch) return json(res, 402, { error: 'Мониторинг доступен на Pro.', code: 'watch_pro' });
+      const b = await readBody(req);
+      const cur = db.settings.watch || { lastRunAt: 0 };
+      db.settings.watch = {
+        enabled: b.enabled !== undefined ? !!b.enabled : !!cur.enabled,
+        everyHours: b.everyHours !== undefined ? Math.max(1, Math.min(168, Number(b.everyHours) || 6)) : (cur.everyHours || 6),
+        lastRunAt: cur.lastRunAt || 0,
+      };
+      save(db);
+      return json(res, 200, db.settings.watch);
+    }
+
+    // ── license: ввести/сменить/убрать ключ и сразу проверить у воркера ──
+    if (req.method === 'POST' && path === '/api/license') {
+      const { key } = await readBody(req);
+      db.settings.license = typeof key === 'string' ? key.trim() : '';
+      db.settings.licenseInfo = null;
+      save(db);
+      await refreshLicense();
+      return json(res, 200, { billing: billingInfo() });
+    }
+
+    // ── profiles ──
+    if (req.method === 'POST' && path === '/api/profiles') {
+      const b = await readBody(req);
+      if (b.id) {
+        const p = db.profiles.find(x => x.id === b.id);
+        if (!p) return json(res, 404, { error: 'no such profile' });
+        Object.assign(p, { name: b.name ?? p.name, email: b.email ?? p.email, linkedin: b.linkedin ?? p.linkedin, resume: b.resume ?? p.resume, location: b.location ?? p.location ?? '' });
+        save(db);
+        return json(res, 200, p);
+      }
+      if (db.profiles.length >= maxProfilesEff()) {
+        return json(res, 402, { error: `Тариф «${plan().name}»: максимум ${maxProfilesEff()} кандидат(а). Больше кандидатов — план Team (места) в настройках.` });
+      }
+      const p = { id: uid(), name: b.name || 'Новый профиль', email: b.email || '', linkedin: b.linkedin || '', resume: b.resume || '', location: b.location || '' };
+      db.profiles.push(p);
+      save(db);
+      return json(res, 200, p);
+    }
+    if (req.method === 'DELETE' && seg[1] === 'profiles' && seg[2]) {
+      // Каскад: роли кандидата и их нетронутые находки уходят вместе с ним, иначе
+      // остаются сиротами в db.json навсегда и всплывают в списке. Найденное, над чем
+      // юзер работал, сохраняем.
+      const posIds = new Set(db.positions.filter(p => p.profileId === seg[2]).map(p => p.id));
+      db.positions.forEach(p => { if (posIds.has(p.id)) cancelActiveByLabel(`Поиск: ${p.title}`); });
+      db.vacancies = db.vacancies.filter(v => !posIds.has(v.positionId) || isTouched(v));
+      db.positions = db.positions.filter(p => p.profileId !== seg[2]);
+      db.profiles = db.profiles.filter(p => p.id !== seg[2]);
+      save(db);
+      return json(res, 200, { ok: true });
+    }
+    if (req.method === 'POST' && seg[1] === 'profiles' && seg[3] === 'import-linkedin') {
+      const p = db.profiles.find(x => x.id === seg[2]);
+      if (!p) return json(res, 404, { error: 'no such profile' });
+      const { url: liUrl } = await readBody(req);
+      const liCanon = normalizeLinkedin(liUrl);
+      if (!liCanon) return json(res, 400, { error: 'нужна ссылка на профиль вида linkedin.com/in/ваше-имя' });
+      return json(res, 200, { jobId: startLinkedinImport(p, liUrl).id });
+    }
+
+    // ── onboarding: кандидат одной кнопкой ──
+    if (req.method === 'POST' && path === '/api/onboard') {
+      const b = await readBody(req);
+      if (!b.name?.trim()) return json(res, 400, { error: 'нужно имя кандидата' });
+      if (!b.linkedin?.trim() && !b.resumeText?.trim()) return json(res, 400, { error: 'нужен LinkedIn URL или текст резюме' });
+      if (b.linkedin) {
+        const canon = normalizeLinkedin(b.linkedin);
+        if (!canon) return json(res, 400, { error: 'нужна ссылка на профиль вида linkedin.com/in/ваше-имя' });
+        b.linkedin = canon; // store one shape, whatever the user pasted
+      }
+      if (db.profiles.length >= maxProfilesEff()) {
+        return json(res, 402, { error: `Тариф «${plan().name}»: максимум ${maxProfilesEff()} кандидат(а). Больше кандидатов — план Team (места) в настройках.` });
+      }
+      const profile = { id: uid(), name: b.name.trim(), email: b.email || '', linkedin: b.linkedin?.trim() || '', location: b.location || 'Ukraine', resume: '' };
+      db.profiles.push(profile);
+      save(db);
+      return json(res, 200, { profileId: profile.id, jobId: startOnboard(profile, b).id });
+    }
+
+    // ── positions ──
+    if (req.method === 'POST' && path === '/api/positions') {
+      const b = await readBody(req);
+      if (!b.title) return json(res, 400, { error: 'title required' });
+      // by-role search carries NO candidate → keep profileId null (résumé-less); otherwise
+      // default to the sent profile or the first candidate.
+      const targetProfileId = b.byRole ? null : (b.profileId || db.profiles[0]?.id);
+      // ROLE CAP (owner 2026-07-25): roles are metered PER candidate (by-role null is its
+      // own bucket). Without this one padded candidate could hunt 30 roles = the work of
+      // ten candidates for free. Server-enforced — the client cap is bypassable.
+      const inBucket = db.positions.filter((p) => p.profileId === targetProfileId).length;
+      const maxRoles = plan().maxRoles;
+      if (isFinite(maxRoles) && inBucket >= maxRoles) {
+        return json(res, 402, { error: `Тариф «${plan().name}»: максимум ${maxRoles} ${maxRoles === 1 ? 'роль' : 'ролей'} на кандидата. Разные профессии — это разные кандидаты (Team).`, code: 'role_limit', maxRoles });
+      }
+      const pos = { id: uid(), title: b.title, keywords: b.keywords || '', engagement: b.engagement || 'both', profileId: targetProfileId, selected: true };
+      db.positions.push(pos);
+      save(db);
+      return json(res, 200, pos);
+    }
+    // roles come FROM the candidate's résumé — derive them (detectRoles) for a profile
+    // that has a résumé but no roles yet (owner model: a role is a property of the candidate)
+    if (req.method === 'POST' && seg[1] === 'profiles' && seg[2] && seg[3] === 'detect-roles') {
+      const profile = db.profiles.find(p => p.id === seg[2]);
+      if (!profile) return json(res, 404, { error: 'no such profile' });
+      if (!profile.resume?.trim()) return json(res, 400, { error: 'у кандидата нет резюме — сначала соберите профиль' });
+      let roleIds = detectRoles(profile.resume);
+      if (!roleIds.length) roleIds = ['fullstack-js'];
+      const created = [];
+      // Respect the role cap: a padded résumé must not slip past the per-candidate limit
+      // by having detectRoles mint the extra positions. Count what this candidate already
+      // has and stop at plan().maxRoles.
+      const maxRoles = plan().maxRoles;
+      for (const id of roleIds) {
+        const already = db.positions.filter(p => p.profileId === profile.id).length;
+        if (isFinite(maxRoles) && already >= maxRoles) break;
+        const role = ROLE_CATALOG.find(r => r.id === id);
+        if (!role) continue;
+        if (db.positions.some(p => p.profileId === profile.id && p.title === role.title)) continue;
+        const pos = { id: uid(), title: role.title, keywords: role.keywords, engagement: 'both', profileId: profile.id, selected: true };
+        db.positions.push(pos);
+        created.push(pos);
+      }
+      save(db);
+      return json(res, 200, { created: created.length, positions: created, maxRoles: isFinite(maxRoles) ? maxRoles : null });
+    }
+    // «Tell about yourself» (voice/text) → a structured professional profile + gaps.
+    // Runs on the machine's Claude sign-in (no key), hard-scoped to the profession.
+    if (req.method === 'POST' && path === '/api/builder/from-story') {
+      const b = await readBody(req);
+      const story = (b.story || '').trim();
+      if (story.length < 12) return json(res, 400, { error: 'расскажите чуть подробнее о себе' });
+      const r = await runClaude({ prompt: buildFromStoryPrompt(story, b.lang || 'en'), model: db.settings.model });
+      if (!r.ok) return json(res, 502, { error: r.error || 'claude failed' });
+      const parsed = extractJson(r.result);
+      if (!parsed) return json(res, 502, { error: 'не удалось разобрать ответ' });
+      logCost('Сбор профиля из рассказа', r.costUsd);
+      return json(res, 200, { profile: parsed, gaps: Array.isArray(parsed.gaps) ? parsed.gaps : [], costUsd: r.costUsd });
+    }
+    if (req.method === 'PATCH' && seg[1] === 'positions' && seg[2]) {
+      const p = db.positions.find(x => x.id === seg[2]);
+      if (!p) return json(res, 404, { error: 'no such position' });
+      const b = await readBody(req);
+      for (const k of ['title', 'keywords', 'engagement', 'profileId']) if (b[k] !== undefined) p[k] = b[k];
+      if (b.selected !== undefined) {
+        p.selected = !!b.selected;
+        // выключили лейбл — прерываем его текущий поиск
+        if (!p.selected) cancelActiveByLabel(`Поиск: ${p.title}`);
+      }
+      save(db);
+      return json(res, 200, p);
+    }
+    if (req.method === 'DELETE' && seg[1] === 'positions' && seg[2]) {
+      const pos = db.positions.find(p => p.id === seg[2]);
+      if (pos) cancelActiveByLabel(`Поиск: ${pos.title}`);
+      // Роль уходит вместе со своими нетронутыми находками (иначе сироты всплывают,
+      // когда не выбрана ни одна роль). То, над чем работали, остаётся.
+      db.vacancies = db.vacancies.filter(v => v.positionId !== seg[2] || isTouched(v));
+      db.positions = db.positions.filter(p => p.id !== seg[2]);
+      save(db);
+      return json(res, 200, { ok: true });
+    }
+
+    // ── ревизия ссылок по всей базе (без токенов) ──
+    if (req.method === 'POST' && path === '/api/validate-links') {
+      if (listJobs().some(j => j.type === 'validate' && (j.status === 'running' || j.status === 'queued'))) {
+        return json(res, 400, { error: 'проверка ссылок уже идёт' });
+      }
+      const job = createJob('validate', 'Проверка ссылок в базе', async j => {
+        const targets = db.vacancies.filter(v => ['new', 'prepared', 'ready'].includes(v.status) && (v.vacancy_url || v.careers_url));
+        jobLog(j, `проверяю ${targets.length} вакансий…`);
+        const results = await checkMany(targets.map(v => v.vacancy_url || v.careers_url));
+        let deadCount = 0;
+        for (const v of targets) {
+          const chk = results.get(v.vacancy_url || v.careers_url);
+          if (chk && !chk.ok) {
+            v.status = 'hidden';
+            v.dead_reason = chk.reason;
+            deadCount++;
+            jobLog(j, `✂ ${v.company} — ${v.vacancy_title}: ${chk.reason}`);
+          }
+        }
+        save(db);
+        jobLog(j, `✓ проверено ${targets.length}, скрыто мёртвых: ${deadCount}`);
+        return { checked: targets.length, dead: deadCount };
+      });
+      return json(res, 200, { jobId: job.id });
+    }
+
+    // ── search ──
+    if (req.method === 'POST' && path === '/api/search') {
+      const { positionId, positionIds } = await readBody(req);
+      let targets;
+      if (positionIds?.length) targets = db.positions.filter(p => positionIds.includes(p.id));
+      else if (positionId) targets = db.positions.filter(p => p.id === positionId);
+      else targets = db.positions.filter(p => p.selected); // multi-choice labels in the UI
+      if (!targets.length) return json(res, 400, { error: 'выберите хотя бы одну позицию (кликните по лейблу)' });
+      // guard: не ставить дубль, если по этой позиции уже идёт/стоит в очереди поиск
+      const activeLabels = new Set(listJobs()
+        .filter(j => j.type === 'search' && (j.status === 'running' || j.status === 'queued'))
+        .map(j => j.label));
+      const fresh = targets.filter(p => !activeLabels.has(`Поиск: ${p.title}`));
+      const run = fresh.length ? createSearchRun(fresh) : null;
+      return json(res, 200, { jobIds: fresh.map(p => startSearch(p, run).id), skipped: targets.length - fresh.length, runId: run?.id });
+    }
+
+    // ── leads ──
+    if (req.method === 'POST' && path === '/api/leads-search') {
+      if (!plan().leads) return json(res, 402, { error: `Поиск лидов доступен на тарифе Pro (сейчас «${plan().name}»).` });
+      const running = listJobs().some(j => j.type === 'leads' && (j.status === 'running' || j.status === 'queued'));
+      if (running) return json(res, 400, { error: 'поиск лидов уже идёт' });
+      return json(res, 200, { jobId: startLeadsSearch().id });
+    }
+    if (seg[1] === 'leads' && seg[2]) {
+      const l = db.leads.find(x => x.id === seg[2]);
+      if (!l) return json(res, 404, { error: 'no such lead' });
+      if (req.method === 'PATCH') {
+        const b = await readBody(req);
+        if (b.status) l.status = b.status;
+        if (b.pitch !== undefined) l.pitch = b.pitch;
+        save(db);
+        return json(res, 200, l);
+      }
+      if (req.method === 'DELETE') {
+        db.leads = db.leads.filter(x => x.id !== seg[2]);
+        save(db);
+        return json(res, 200, { ok: true });
+      }
+      if (req.method === 'POST' && seg[3] === 'pitch') return json(res, 200, { jobId: startPitch(l).id });
+    }
+
+    // ── vacancies ──
+    if (seg[1] === 'vacancies' && seg[2]) {
+      const v = db.vacancies.find(x => x.id === seg[2]);
+      if (!v) return json(res, 404, { error: 'no such vacancy' });
+      if (req.method === 'PATCH') {
+        const b = await readBody(req);
+        if (b.status) v.status = b.status;
+        if (b.coverLetter !== undefined) v.coverLetter = b.coverLetter;
+        if (b.userNote !== undefined) v.userNote = String(b.userNote); // юзерская заметка по вакансии
+        // Закреплённые — «вернуться к этой»: ортогонально статусу, поэтому
+        // отдельный флаг, а не ещё одно значение status.
+        if (b.pinned !== undefined) v.pinned = !!b.pinned;
+        save(db);
+        return json(res, 200, v);
+      }
+      if (req.method === 'DELETE') {
+        db.vacancies = db.vacancies.filter(x => x.id !== seg[2]);
+        save(db);
+        return json(res, 200, { ok: true });
+      }
+      if (req.method === 'POST' && seg[3] === 'prepare') return json(res, 200, { jobId: startCoverLetter(v).id });
+      if (req.method === 'POST' && seg[3] === 'autoapply') {
+        if (!plan().autoApply) return json(res, 402, { error: `Автозаявки доступны на тарифе Pro (сейчас «${plan().name}»). Письмо и прямая ссылка на форму доступны бесплатно.` });
+        if (!v.vacancy_url && !v.careers_url) return json(res, 400, { error: 'у вакансии нет URL' });
+        return json(res, 200, { jobId: startAutoApply(v).id });
+      }
+    }
+
+    json(res, 404, { error: 'unknown endpoint' });
+  } catch (err) {
+    json(res, 500, { error: String(err?.message || err) });
+  }
+};
+
+mkdirSync(DATA_DIR, { recursive: true });
+// Standalone (dev / launchd) binds its own port. The unified qiksy-engine sets QE_EMBEDDED
+// before importing this file, so an import yields requestHandler WITHOUT a second listener
+// on :5544. Env, not an argv-path check — launchd invokes the script by a path that doesn't
+// match import.meta.url, which left the backend running but never listening.
+if (!process.env.QE_EMBEDDED) {
+  createServer(requestHandler).listen(PORT, () => {
+    console.log(`Work Finder → http://localhost:${PORT}`);
+  });
+}
+
+// Проверяем лицензию на старте и раз в 6 часов (best-effort; офлайн не роняет кэш).
+if (db.settings.license) refreshLicense().catch(() => {});
+setInterval(() => { if (db.settings.license) refreshLicense().catch(() => {}); }, RECHECK_MS).unref();
+
+// ── WATCH / мониторинг (Pro) ─────────────────────────────────────────────────
+// Периодически сам перезапускает поиск по активным ролям, чтобы НОВОЕ всплывало без
+// ручного клика — это и есть «находим раньше рынка». Дедуп уже встроен (поиск исключает
+// уже найденные компании), так что watch-прогон просто досыпает свежие находки. Local-
+// first: крутится на Claude пользователя, нам это ничего не стоит. Гейт — только Pro.
+const WATCH_TICK_MS = 10 * 60_000; // проверяем «пора ли» каждые 10 минут
+function watchTick() {
+  try {
+    const w = db.settings.watch;
+    if (!w?.enabled || !plan().watch) return; // выключено или не Pro
+    const everyMs = Math.max(1, Number(w.everyHours) || 6) * 3600_000;
+    if (Date.now() - (w.lastRunAt || 0) < everyMs) return; // ещё рано
+    // не наслаивать: если поиск уже идёт — пропускаем этот тик
+    const busy = listJobs().some((j) => j.type === 'search' && (j.status === 'running' || j.status === 'queued'));
+    if (busy) return;
+    const targets = db.positions.filter((p) => p.selected !== false);
+    if (!targets.length) return;
+    w.lastRunAt = Date.now();
+    save(db);
+    const run = createSearchRun(targets);
+    targets.forEach((p) => startSearch(p, run));
+  } catch { /* watch — best-effort, никогда не роняем процесс */ }
+}
+setInterval(watchTick, WATCH_TICK_MS).unref();