wiki-viewer 2.9.1 → 2.9.3

package/.next/standalone/server.js

@@ -15,7 +15,7 @@ const currentPort = parseInt(process.env.PORT, 10) || 3000
 const hostname = process.env.HOSTNAME || '0.0.0.0'
 
 let keepAliveTimeout = parseInt(process.env.KEEP_ALIVE_TIMEOUT, 10)
-const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"2.9.0"},"webpack":null,"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/sil/wiki-viewer","allowedDevOrigins":["devvm"],"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","turbopack":{"root":"/home/sil/wiki-viewer"},"distDirRoot":".next"}
+const nextConfig = {"env":{"NEXT_PUBLIC_APP_VERSION":"2.9.3"},"webpack":null,"typescript":{"ignoreBuildErrors":false},"typedRoutes":false,"distDir":"./.next","cleanDistDir":true,"assetPrefix":"","cacheMaxMemorySize":52428800,"configOrigin":"next.config.ts","useFileSystemPublicRoutes":true,"generateEtags":true,"pageExtensions":["tsx","ts","jsx","js"],"poweredByHeader":true,"compress":true,"images":{"deviceSizes":[640,750,828,1080,1200,1920,2048,3840],"imageSizes":[32,48,64,96,128,256,384],"path":"/_next/image","loader":"default","loaderFile":"","domains":[],"disableStaticImages":false,"minimumCacheTTL":14400,"formats":["image/webp"],"maximumRedirects":3,"maximumResponseBody":50000000,"dangerouslyAllowLocalIP":false,"dangerouslyAllowSVG":false,"contentSecurityPolicy":"script-src 'none'; frame-src 'none'; sandbox;","contentDispositionType":"attachment","localPatterns":[{"pathname":"**","search":""}],"remotePatterns":[],"qualities":[75],"unoptimized":true,"customCacheHandler":false},"devIndicators":{"position":"bottom-left"},"onDemandEntries":{"maxInactiveAge":60000,"pagesBufferLength":5},"basePath":"","sassOptions":{},"trailingSlash":false,"i18n":null,"productionBrowserSourceMaps":false,"excludeDefaultMomentLocales":true,"reactProductionProfiling":false,"reactStrictMode":null,"reactMaxHeadersLength":6000,"httpAgentOptions":{"keepAlive":true},"logging":{"serverFunctions":true,"browserToTerminal":"warn"},"compiler":{},"expireTime":31536000,"staticPageGenerationTimeout":60,"output":"standalone","modularizeImports":{"@mui/icons-material":{"transform":"@mui/icons-material/{{member}}"},"lodash":{"transform":"lodash/{{member}}"}},"outputFileTracingRoot":"/home/runner/work/wiki-viewer/wiki-viewer","allowedDevOrigins":["devvm"],"cacheComponents":false,"cacheLife":{"default":{"stale":300,"revalidate":900,"expire":4294967294},"seconds":{"stale":30,"revalidate":1,"expire":60},"minutes":{"stale":300,"revalidate":60,"expire":3600},"hours":{"stale":300,"revalidate":3600,"expire":86400},"days":{"stale":300,"revalidate":86400,"expire":604800},"weeks":{"stale":300,"revalidate":604800,"expire":2592000},"max":{"stale":300,"revalidate":2592000,"expire":31536000}},"cacheHandlers":{},"experimental":{"appNewScrollHandler":false,"useSkewCookie":false,"cssChunking":true,"multiZoneDraftMode":false,"appNavFailHandling":false,"prerenderEarlyExit":true,"serverMinification":true,"linkNoTouchStart":false,"caseSensitiveRoutes":false,"cachedNavigations":false,"partialFallbacks":false,"dynamicOnHover":false,"varyParams":false,"prefetchInlining":false,"preloadEntriesOnStart":true,"clientRouterFilter":true,"clientRouterFilterRedirects":false,"fetchCacheKeyPrefix":"","proxyPrefetch":"flexible","optimisticClientCache":true,"manualClientBasePath":false,"cpus":3,"memoryBasedWorkersCount":false,"imgOptConcurrency":null,"imgOptTimeoutInSeconds":7,"imgOptMaxInputPixels":268402689,"imgOptSequentialRead":null,"imgOptSkipMetadata":null,"isrFlushToDisk":true,"workerThreads":false,"optimizeCss":false,"nextScriptWorkers":false,"scrollRestoration":false,"externalDir":false,"disableOptimizedLoading":false,"gzipSize":true,"craCompat":false,"esmExternals":true,"fullySpecified":false,"swcTraceProfiling":false,"forceSwcTransforms":false,"largePageDataBytes":128000,"typedEnv":false,"parallelServerCompiles":false,"parallelServerBuildTraces":false,"ppr":false,"authInterrupts":false,"webpackMemoryOptimizations":false,"optimizeServerReact":true,"strictRouteTypes":false,"viewTransition":false,"removeUncaughtErrorAndRejectionListeners":false,"validateRSCRequestHeaders":false,"staleTimes":{"dynamic":0,"static":300},"reactDebugChannel":true,"serverComponentsHmrCache":true,"staticGenerationMaxConcurrency":8,"staticGenerationMinPagesPerWorker":25,"transitionIndicator":false,"gestureTransition":false,"inlineCss":false,"useCache":false,"globalNotFound":false,"browserDebugInfoInTerminal":"warn","lockDistDir":true,"proxyClientMaxBodySize":10485760,"hideLogsAfterAbort":false,"mcpServer":true,"turbopackFileSystemCacheForDev":true,"turbopackFileSystemCacheForBuild":false,"turbopackInferModuleSideEffects":true,"turbopackPluginRuntimeStrategy":"childProcesses","optimizePackageImports":["lucide-react","date-fns","lodash-es","ramda","antd","react-bootstrap","ahooks","@ant-design/icons","@headlessui/react","@headlessui-float/react","@heroicons/react/20/solid","@heroicons/react/24/solid","@heroicons/react/24/outline","@visx/visx","@tremor/react","rxjs","@mui/material","@mui/icons-material","recharts","react-use","effect","@effect/schema","@effect/platform","@effect/platform-node","@effect/platform-browser","@effect/platform-bun","@effect/sql","@effect/sql-mssql","@effect/sql-mysql2","@effect/sql-pg","@effect/sql-sqlite-node","@effect/sql-sqlite-bun","@effect/sql-sqlite-wasm","@effect/sql-sqlite-react-native","@effect/rpc","@effect/rpc-http","@effect/typeclass","@effect/experimental","@effect/opentelemetry","@material-ui/core","@material-ui/icons","@tabler/icons-react","mui-core","react-icons/ai","react-icons/bi","react-icons/bs","react-icons/cg","react-icons/ci","react-icons/di","react-icons/fa","react-icons/fa6","react-icons/fc","react-icons/fi","react-icons/gi","react-icons/go","react-icons/gr","react-icons/hi","react-icons/hi2","react-icons/im","react-icons/io","react-icons/io5","react-icons/lia","react-icons/lib","react-icons/lu","react-icons/md","react-icons/pi","react-icons/ri","react-icons/rx","react-icons/si","react-icons/sl","react-icons/tb","react-icons/tfi","react-icons/ti","react-icons/vsc","react-icons/wi"],"trustHostHeader":false,"isExperimentalCompile":false},"htmlLimitedBots":"[\\w-]+-Google|Google-[\\w-]+|Chrome-Lighthouse|Slurp|DuckDuckBot|baiduspider|yandex|sogou|bitlybot|tumblr|vkShare|quora link preview|redditbot|ia_archiver|Bingbot|BingPreview|applebot|facebookexternalhit|facebookcatalog|Twitterbot|LinkedInBot|Slackbot|Discordbot|WhatsApp|SkypeUriPreview|Yeti|googleweblight","bundlePagesRouterDependencies":false,"configFileName":"next.config.ts","turbopack":{"root":"/home/runner/work/wiki-viewer/wiki-viewer"},"distDirRoot":".next"}
 
 process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(nextConfig)
 

package/README.md

@@ -8,7 +8,7 @@
 
   <p>
     <a href="https://www.npmjs.com/package/wiki-viewer"><img src="https://img.shields.io/npm/v/wiki-viewer" alt="npm version" /></a>
-    <img src="https://img.shields.io/badge/node-%3E%3D18-brightgreen" alt="Node.js ≥18" />
+    <img src="https://img.shields.io/badge/node-%3E%3D20.9.0-brightgreen" alt="Node.js ≥20.9.0" />
     <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license" />
   </p>
 </div>
@@ -364,7 +364,9 @@ read it.
 - Open a file and use **Share** to mint a link. It serves a rendered, read-only
   view at `/share/<token>`.
 - **Password (optional).** Protect a link with a password; only the hash is
-  stored. Visitors unlock before reading.
+  stored. Visitors unlock before reading. A successful password POST sets a
+  short-lived, scoped, `HttpOnly` cookie derived from the stored hash; the
+  password is never accepted in the URL, query string, or logs.
 - **Expiry (optional).** Set a number of days; the link returns `410` once
   expired.
 - **View counts.** Each open increments a counter visible in the share dialog.
@@ -390,6 +392,10 @@ the file browser it shows a **Launch** button.
 
 > Launching runs arbitrary project code on the host. Only launch apps you
 > trust. Git-backed (read-only) workspaces still run apps but reject writes.
+>
+> In authenticated multi-user mode, starting or stopping an app requires admin
+> privilege. Set `WIKI_ALLOW_APP_RUNNER=1` to explicitly allow non-admins to
+> launch apps in their workspaces.
 
 ## Auth and multi-user mode
 
@@ -705,7 +711,7 @@ Note: `AGENT_BEARER_TOKEN` (legacy single-secret mode) does nothing now. The ser
 
 ### Prerequisites
 
-- **Node.js** ≥ 18
+- **Node.js** ≥ 20.9.0
 - **pnpm** — `npm install -g pnpm`
 
 ### Run from source
@@ -728,7 +734,7 @@ The dev server supports hot reload.
 | `pnpm build`     | Production build                       |
 | `pnpm start`     | Production server (after `build`)      |
 | `pnpm wiki`      | CLI entry point (after `build`)        |
-| `pnpm test`      | Run the proof + auth test suite (180+) |
+| `pnpm test`      | Run the proof + auth test suite (636 tests, floor 624) |
 
 ### All environment variables
 
@@ -746,6 +752,7 @@ The dev server supports hot reload.
 | `WIKI_OWNER_HOSTS`     | csv: extra hostnames trusted for CSRF Origin check                                | `localhost,127.0.0.1` |
 | `WIKI_ALLOW_INSECURE`  | Set to `1` to bypass the prod-https guard (dev / CI only)                         | unset                 |
 | `WIKI_ADMIN_EMAILS`    | csv: emails treated as admins (seed/override; otherwise first signup is admin)    | unset                 |
+| `WIKI_ALLOW_APP_RUNNER`| Set to `1` to let non-admins launch node apps (host code execution; multi-user risk) | unset              |
 | `AGENT_RATE_LIMIT`     | Max mutation ops per minute per agent identity                                    | `60`                  |
 | `WIKI_SSH_PASSWORD`    | Password for a `--ssh-password` CLI mount (avoids the interactive prompt)         | unset                 |
 
@@ -878,7 +885,7 @@ wiki-viewer/
 │   │   ├── app-runner.ts         Launches and supervises node-app child processes
 │   │   └── proof/                Agent protocol core (ops-applier, registry, file-lock)
 │   ├── stores/                   Zustand state
-│   ├── tests/proof/              Node test runner suite (180+ tests)
+│   ├── tests/proof/              Node test runner suite (636 tests, floor 624)
 │   └── middleware.ts             Cookie-presence gate for UI routes
 ├── public/
 ├── next.config.ts

package/bin/cli/config.js

@@ -0,0 +1,105 @@
+import path from "node:path";
+import os from "node:os";
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+
+export const configDir = path.join(os.homedir(), ".wiki-viewer");
+export const configPath = path.join(configDir, "config.json");
+export const logDir = path.join(configDir, "logs");
+
+export function loadConfig() {
+	if (!existsSync(configPath)) return {};
+	try {
+		return JSON.parse(readFileSync(configPath, "utf8"));
+	} catch {
+		console.error(`Warning: could not parse ${configPath}, ignoring it`);
+		return {};
+	}
+}
+
+export function saveConfig(cfg) {
+	mkdirSync(configDir, { recursive: true });
+	writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n");
+}
+
+// Pull repeatable `--env KEY=VALUE` (or `-e KEY=VALUE`) pairs out of an argv
+// list. Returns the collected map; the caller has already parsed the rest.
+export function parseEnvFlags(args) {
+	const env = {};
+	for (let i = 0; i < args.length; i++) {
+		if (args[i] === "--env" || args[i] === "-e") {
+			const pair = args[++i];
+			if (!pair || !pair.includes("=")) {
+				console.error(`Error: --env expects KEY=VALUE (got: ${pair ?? "(nothing)"})`);
+				process.exit(1);
+			}
+			const idx = pair.indexOf("=");
+			env[pair.slice(0, idx)] = pair.slice(idx + 1);
+		}
+	}
+	return env;
+}
+
+export function configCommand(args) {
+	const cfg = loadConfig();
+
+	if (args.length === 0 || args[0] === "show" || args[0] === "list") {
+		if (!existsSync(configPath)) {
+			console.log(`No config yet at ${configPath}`);
+			console.log(`Create one with: wiki-viewer service install [dir] [options] [--env KEY=VALUE]`);
+			return;
+		}
+		console.log(configPath);
+		console.log(JSON.stringify(cfg, null, 2));
+		return;
+	}
+
+	if (args[0] === "set") {
+		const pairs = args.slice(1);
+		if (pairs.length === 0) {
+			console.error("Usage: wiki-viewer config set KEY=VALUE [KEY=VALUE ...]");
+			process.exit(1);
+		}
+		cfg.env = cfg.env ?? {};
+		for (const pair of pairs) {
+			const idx = pair.indexOf("=");
+			if (idx < 0) { console.error(`Error: expected KEY=VALUE (got: ${pair})`); process.exit(1); }
+			cfg.env[pair.slice(0, idx)] = pair.slice(idx + 1);
+		}
+		saveConfig(cfg);
+		console.log(`Updated env in ${configPath}: ${pairs.map((p) => p.split("=")[0]).join(", ")}`);
+		if (serviceIsInstalled()) console.log("Run `wiki-viewer service restart` to apply.");
+		return;
+	}
+
+	if (args[0] === "unset") {
+		const keys = args.slice(1);
+		if (keys.length === 0) { console.error("Usage: wiki-viewer config unset KEY [KEY ...]"); process.exit(1); }
+		cfg.env = cfg.env ?? {};
+		for (const k of keys) delete cfg.env[k];
+		saveConfig(cfg);
+		console.log(`Removed from env: ${keys.join(", ")}`);
+		if (serviceIsInstalled()) console.log("Run `wiki-viewer service restart` to apply.");
+		return;
+	}
+
+	if (args[0] === "path") { console.log(configPath); return; }
+
+	console.error(`Unknown config command: ${args[0]}`);
+	console.error("Try: show | set KEY=VALUE | unset KEY | path");
+	process.exit(1);
+}
+
+// configCommand needs to know whether a service is installed to prompt the user
+// to restart it after an env change. Importing the full service module from
+// config.js would create a circular dependency, so we keep a tiny local check.
+function serviceIsInstalled() {
+	const SERVICE_NAME = "wiki-viewer";
+	const LAUNCHD_LABEL = "com.wiki-viewer";
+	if (process.platform === "linux") {
+		return existsSync(path.join(os.homedir(), ".config", "systemd", "user", `${SERVICE_NAME}.service`));
+	}
+	if (process.platform === "darwin") {
+		return existsSync(path.join(os.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`));
+	}
+	return false;
+}

package/bin/cli/prompt.js

@@ -0,0 +1,36 @@
+import { createInterface } from "node:readline";
+import { stdin, stdout } from "node:process";
+
+// A prompt helper that survives piped (non-TTY) stdin. node:readline/promises
+// closes the stream between awaited questions when input is piped, so we buffer
+// every line via the 'line' event and hand them out one at a time instead.
+export function makePrompter() {
+	const rl = createInterface({ input: stdin, output: stdout });
+	const queue = [];
+	const waiters = [];
+	let closed = false;
+
+	rl.on("line", (line) => {
+		if (waiters.length) waiters.shift()(line);
+		else queue.push(line);
+	});
+	rl.on("close", () => {
+		closed = true;
+		while (waiters.length) waiters.shift()(null);
+	});
+
+	const nextLine = () =>
+		new Promise((resolve) => {
+			if (queue.length) resolve(queue.shift());
+			else if (closed) resolve(null);
+			else waiters.push(resolve);
+		});
+
+	const prompt = async (text) => {
+		stdout.write(text);
+		const line = await nextLine();
+		return line == null ? "" : line;
+	};
+
+	return { prompt, close: () => rl.close() };
+}

package/bin/cli/serve.js

@@ -0,0 +1,413 @@
+import { spawn, execFileSync, execSync } from "node:child_process";
+import { createServer as createHttpsServer } from "node:https";
+import { request as httpRequest } from "node:http";
+import { createServer as createNetServer } from "node:net";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import { makePrompter } from "./prompt.js";
+import { configDir, loadConfig, parseEnvFlags } from "./config.js";
+import {
+	looksLikeSshTarget,
+	parseSshTarget,
+	buildSshfsArgs,
+} from "../shared/ssh-target.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export const appRoot = path.resolve(__dirname, "..", "..");
+export const serverJs = path.join(appRoot, ".next", "standalone", "server.js");
+
+// Env vars the app reads that the bin can derive or manage on the user's behalf.
+// Everything else in config.env is passed through verbatim.
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", ""]);
+
+const mountsDir = path.join(configDir, "mounts");
+let activeMount = null;
+
+export function parseServeArgs(args) {
+	let port = process.env.PORT;
+	let host = process.env.HOSTNAME;
+	let useHttps;
+	let userSpecifiedPort = false;
+	let userSpecifiedHost = false;
+	let rootDir;
+	let noAuth;
+	let sshKey;
+	let sshPort;
+	let sshPassword;
+	let sshReadOnly;
+
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === "-p" || a === "--port") { port = args[++i] ?? port; userSpecifiedPort = true; }
+		else if (a === "-H" || a === "--host") { host = args[++i] ?? host; userSpecifiedHost = true; }
+		else if (a === "-e" || a === "--env") { i++; } // consumed by parseEnvFlags
+		else if (a === "--https") useHttps = true;
+		else if (a === "--no-auth") noAuth = true;
+		else if (a === "--ssh-key") sshKey = args[++i];
+		else if (a === "--ssh-port") sshPort = args[++i];
+		else if (a === "--ssh-password") sshPassword = true;
+		else if (a === "--ssh-readonly") sshReadOnly = true;
+		else if (!a.startsWith("-") && rootDir === undefined) rootDir = a;
+	}
+
+	return { rootDir, port, host, useHttps, userSpecifiedPort, userSpecifiedHost, noAuth, sshKey, sshPort, sshPassword: Boolean(sshPassword), sshReadOnly: Boolean(sshReadOnly) };
+}
+
+// ── ssh (sshfs) targets ──────────────────────────────────────────────────────
+// Symmetry with the local-directory arg: `wiki-viewer user@host:/path` mounts a
+// remote directory over sshfs and serves it as ROOT_DIR — no local clone. The
+// mount is ephemeral (under ~/.wiki-viewer/mounts) and unmounted on exit. Auth:
+// ssh-agent/host keys by default, --ssh-key <path>, or --ssh-password.
+
+function isMountedSync(mp) {
+	try {
+		if (process.platform === "linux") {
+			const m = readFileSync("/proc/mounts", "utf8");
+			return m.split("\n").some((l) => { const p = l.split(" "); return p[1] === mp && /fuse/.test(p[2] || ""); });
+		}
+		const out = execFileSync("mount", [], { encoding: "utf8" });
+		return out.split("\n").some((l) => l.includes(` on ${mp} `));
+	} catch { return false; }
+}
+
+function unmountSync(mp) {
+	const tries = process.platform === "linux"
+		? [["fusermount", ["-u", "-z", mp]], ["umount", [mp]]]
+		: [["umount", [mp]], ["diskutil", ["unmount", "force", mp]]];
+	for (const [bin, a] of tries) { try { execFileSync(bin, a, { stdio: "ignore" }); break; } catch { /* try next */ } }
+	try { rmSync(mp, { recursive: false, force: true }); } catch { /* best-effort */ }
+}
+
+function registerMountCleanup() {
+	const cleanup = () => { if (activeMount) { const mp = activeMount; activeMount = null; unmountSync(mp); } };
+	process.on("exit", cleanup);
+	for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+		process.on(sig, () => { cleanup(); process.exit(0); });
+	}
+}
+
+async function mountSshTarget({ targetStr, port, keyPath, password, readOnly }) {
+	const target = parseSshTarget(targetStr);
+	if (!target) {
+		console.error(`Error: invalid SSH target '${targetStr}'. Use the form user@host:/abs/path.`);
+		process.exit(1);
+	}
+	try { execFileSync("sshfs", ["--version"], { stdio: "ignore" }); }
+	catch {
+		console.error("Error: sshfs not found. Install sshfs + FUSE (e.g. `apt install sshfs`, `brew install macfuse sshfs`).");
+		process.exit(1);
+	}
+
+	mkdirSync(mountsDir, { recursive: true });
+	const mp = path.join(mountsDir, `cli-${process.pid}`);
+	if (isMountedSync(mp)) unmountSync(mp);
+	mkdirSync(mp, { recursive: true });
+
+	const args = buildSshfsArgs({ target, mountpoint: mp, port, keyPath, password, readOnly });
+	registerMountCleanup();
+	await new Promise((resolve, reject) => {
+		const child = spawn("sshfs", args, { stdio: ["pipe", "ignore", "pipe"] });
+		let err = "";
+		const t = setTimeout(() => { child.kill("SIGKILL"); reject(new Error("sshfs mount timed out after 25s")); }, 25_000);
+		child.stderr.on("data", (d) => { err += d.toString(); });
+		child.on("error", (e) => { clearTimeout(t); reject(e); });
+		child.on("close", (code) => { clearTimeout(t); code === 0 ? resolve() : reject(new Error(err.trim() || `sshfs exited ${code}`)); });
+		if (password != null) child.stdin.write(password + "\n");
+		child.stdin.end();
+	}).catch((e) => {
+		console.error(`Error: sshfs mount failed: ${e.message}`);
+		try { unmountSync(mp); } catch { /* ignore */ }
+		process.exit(1);
+	});
+
+	if (!isMountedSync(mp)) {
+		console.error("Error: sshfs reported success but the mount is not live.");
+		unmountSync(mp);
+		process.exit(1);
+	}
+	activeMount = mp;
+	return mp;
+}
+
+async function promptLine(text) {
+	const io = makePrompter();
+	const ans = await io.prompt(text);
+	io.close();
+	return ans;
+}
+
+// ── config file ────────────────────────────────────────────────────────────
+
+// Ad-hoc serve: CLI flags + built-in defaults. The run *shape* (dir/host/port)
+// does NOT read the config file, so an installed service never silently alters
+// a one-off invocation. App-level env (config.env) is still read, because those
+// are settings about the app itself (allowlists, OAuth) rather than the bind.
+export function resolveServeOptions(args) {
+	const cli = parseServeArgs(args);
+	const cfg = loadConfig();
+	const isSsh = cli.rootDir != null && looksLikeSshTarget(cli.rootDir);
+	return {
+		rootDir: cli.rootDir && !isSsh ? path.resolve(cli.rootDir) : null,
+		sshTarget: isSsh ? cli.rootDir : null,
+		sshKey: cli.sshKey, sshPort: cli.sshPort, sshPassword: cli.sshPassword, sshReadOnly: cli.sshReadOnly,
+		port: String(cli.port ?? "3000"),
+		host: cli.host ?? "localhost",
+		useHttps: Boolean(cli.useHttps),
+		userSpecifiedPort: cli.userSpecifiedPort,
+		configEnv: { ...(cfg.env ?? {}), ...(cli.noAuth ? { WIKI_NO_AUTH: "1" } : {}), ...parseEnvFlags(args) },
+	};
+}
+
+// Service run: config file is the source of truth. CLI flags (if any) still win
+// so the unit/plist could pass overrides, but normally there are none.
+// Precedence: explicit CLI flags > config file > built-in defaults.
+export function resolveRunOptions(args) {
+	const cli = parseServeArgs(args);
+	const cfg = loadConfig();
+
+	const rootDir = cli.rootDir ?? cfg.rootDir ?? null;
+	const port = cli.port ?? cfg.port ?? "3000";
+	const host = cli.host ?? cfg.host ?? "localhost";
+	const useHttps = cli.useHttps ?? cfg.https ?? false;
+	const userSpecifiedPort = cli.userSpecifiedPort || cfg.port != null;
+
+	const isSsh = rootDir != null && looksLikeSshTarget(rootDir);
+	return {
+		rootDir: rootDir && !isSsh ? path.resolve(rootDir) : null,
+		sshTarget: isSsh ? rootDir : null,
+		sshKey: cli.sshKey ?? cfg.ssh?.key,
+		sshPort: cli.sshPort ?? cfg.ssh?.port,
+		sshPassword: cli.sshPassword,
+		sshReadOnly: cli.sshReadOnly || Boolean(cfg.ssh?.readOnly),
+		port: String(port),
+		host,
+		useHttps: Boolean(useHttps),
+		userSpecifiedPort,
+		configEnv: { ...(cfg.env ?? {}), ...(cli.noAuth ? { WIKI_NO_AUTH: "1" } : {}), ...parseEnvFlags(args) },
+	};
+}
+
+// ── environment resolution ───────────────────────────────────────────────────
+
+export function isLocalHost(h) {
+	return LOCAL_HOSTS.has(h);
+}
+
+// Build the env for the spawned server.
+// Precedence (highest first):
+//   1. the shell environment the user launched us with (explicit override)
+//   2. config.env from ~/.wiki-viewer/config.json
+//   3. values derived by the bin from the run options (e.g. BETTER_AUTH_URL)
+export function computeServerEnv({ host, port, useHttps, configEnv }) {
+	const warnings = [];
+	const derived = {};
+
+	const scheme = useHttps ? "https" : "http";
+	const urlHost = isLocalHost(host) || host === "0.0.0.0" ? "localhost" : host;
+	const isSecureContext = useHttps || isLocalHost(host);
+
+	derived.BETTER_AUTH_URL = `${scheme}://${urlHost}:${port}`;
+
+	if (!isSecureContext) {
+		derived.WIKI_ALLOW_INSECURE = "1";
+		warnings.push(
+			`Serving plain HTTP on a non-local host (${host}). Browsers treat this as\n` +
+			`   an insecure context: login cookies, service workers and PDF.js will not\n` +
+			`   work reliably, and OAuth callbacks will fail.\n` +
+			`   Fix: re-run with --https, or put a TLS-terminating proxy in front and set\n` +
+			`   BETTER_AUTH_URL to its public https:// URL (see "env" in ${path.join(configDir, "config.json")}).`,
+		);
+	} else if (isLocalHost(host) && !useHttps) {
+		derived.WIKI_ALLOW_INSECURE = "1";
+	}
+
+	const env = { ...derived, ...configEnv };
+
+	// Note when the shell overrode a derived/config value so the user isn't
+	// surprised that --host/--port didn't change the auth URL.
+	if (process.env.BETTER_AUTH_URL && process.env.BETTER_AUTH_URL !== env.BETTER_AUTH_URL) {
+		warnings.push(
+			`BETTER_AUTH_URL is set in your shell (${process.env.BETTER_AUTH_URL}) and\n` +
+			`   overrides the derived/config value.`,
+		);
+	}
+
+	return { env, warnings };
+}
+
+// ── HTTPS cert generation ──────────────────────────────────────────────────
+
+export function ensureCerts(host) {
+	const dir = path.join(configDir, "certs");
+	mkdirSync(dir, { recursive: true });
+	const keyPath = path.join(dir, "key.pem");
+	const certPath = path.join(dir, "cert.pem");
+	if (existsSync(keyPath) && existsSync(certPath)) {
+		return { key: readFileSync(keyPath), cert: readFileSync(certPath) };
+	}
+	try {
+		execSync("mkcert -version", { stdio: "ignore" });
+		execSync(`mkcert -install 2>/dev/null; mkcert -key-file "${keyPath}" -cert-file "${certPath}" localhost 127.0.0.1 "${host}"`, { stdio: "pipe" });
+		console.log("🔒  Trusted cert via mkcert");
+	} catch {
+		try {
+			execSync(
+				`openssl req -x509 -newkey rsa:2048 -keyout "${keyPath}" -out "${certPath}" -days 825 -nodes -subj "/CN=localhost"`,
+				{ stdio: "ignore" },
+			);
+			console.log("🔒  Self-signed cert (browser will warn once — click through)");
+		} catch {
+			console.error("Error: --https requires mkcert or openssl");
+			process.exit(1);
+		}
+	}
+	return { key: readFileSync(keyPath), cert: readFileSync(certPath) };
+}
+
+// ── port availability helpers ──────────────────────────────────────────────
+
+export function isPortAvailable(p, h) {
+	return new Promise((resolve) => {
+		const s = createNetServer();
+		s.once("error", () => resolve(false));
+		s.once("listening", () => s.close(() => resolve(true)));
+		s.listen(Number(p), h);
+	});
+}
+
+export async function findNextAvailablePort(startPort, h) {
+	let p = Number(startPort);
+	while (!(await isPortAvailable(p, h))) p++;
+	return String(p);
+}
+
+export function freePort() {
+	return new Promise((resolve) => {
+		const s = createNetServer();
+		s.listen(0, "127.0.0.1", () => {
+			const { port: p } = s.address();
+			s.close(() => resolve(p));
+		});
+	});
+}
+
+export function getNetworkAddress() {
+	for (const ifaces of Object.values(os.networkInterfaces())) {
+		for (const iface of ifaces ?? []) {
+			if (iface.family === "IPv4" && !iface.internal) return iface.address;
+		}
+	}
+	return null;
+}
+
+// ── start ──────────────────────────────────────────────────────────────────
+
+export async function start(opts) {
+	const { useHttps, configEnv = {} } = opts;
+	let resolvedRoot = opts.rootDir;
+	let { port, host, userSpecifiedPort } = opts;
+
+	if (!existsSync(serverJs)) {
+		console.error("Error: pre-built server not found at", serverJs);
+		console.error("This is a bug – please report it at https://github.com/anh-chu/wiki-viewer/issues");
+		process.exit(1);
+	}
+
+	// SSH target: mount it over sshfs and serve the mount point as ROOT_DIR.
+	if (opts.sshTarget) {
+		let password = null;
+		if (opts.sshPassword) {
+			password = process.env.WIKI_SSH_PASSWORD
+				?? await promptLine(`SSH password for ${opts.sshTarget}: `);
+		}
+		console.log(`🔗  Mounting ${opts.sshTarget} over SSH…`);
+		resolvedRoot = await mountSshTarget({
+			targetStr: opts.sshTarget,
+			port: opts.sshPort,
+			keyPath: opts.sshKey,
+			password,
+			readOnly: opts.sshReadOnly,
+		});
+		console.log(`   mounted at ${resolvedRoot}${opts.sshReadOnly ? " (read-only)" : ""}`);
+	}
+
+	if (resolvedRoot) {
+		console.log(`📂  ${resolvedRoot}`);
+	} else {
+		console.log("📂  No directory specified — open the browser to choose one");
+	}
+
+	// Auto-select next free port when user didn't specify one
+	if (!userSpecifiedPort) {
+		const available = await isPortAvailable(Number(port), host);
+		if (!available) {
+			const original = port;
+			port = await findNextAvailablePort(Number(port) + 1, host);
+			console.log(`⚠️   Port ${original} in use → using ${port} (pass -p <port> to override)`);
+		}
+	}
+
+	const internalPort = useHttps ? String(await freePort()) : port;
+	const internalHost = useHttps ? "127.0.0.1" : host;
+
+	const { env: appEnv, warnings } = computeServerEnv({ host, port, useHttps, configEnv });
+	for (const w of warnings) console.log(`\n⚠️   ${w}`);
+
+	const child = spawn(process.execPath, [serverJs], {
+		cwd: path.join(appRoot, ".next", "standalone"),
+		stdio: "inherit",
+		env: {
+			...appEnv,
+			...process.env,
+			...(resolvedRoot ? { ROOT_DIR: resolvedRoot } : {}),
+			PORT: internalPort,
+			HOSTNAME: internalHost,
+		},
+	});
+
+	child.on("exit", (code) => process.exit(code ?? 0));
+
+	if (useHttps) {
+		const { key, cert } = ensureCerts(host);
+
+		const proxy = createHttpsServer({ key, cert }, (req, res) => {
+			const options = {
+				hostname: internalHost,
+				port: Number(internalPort),
+				path: req.url,
+				method: req.method,
+				headers: req.headers,
+			};
+			const upstream = httpRequest(options, (upRes) => {
+				res.writeHead(upRes.statusCode, upRes.headers);
+				upRes.pipe(res);
+			});
+			upstream.on("error", () => res.destroy());
+			req.pipe(upstream);
+		});
+
+		setTimeout(() => {
+			proxy.listen(Number(port), host, () => {
+				const scheme = "https";
+				const displayHost = host === "0.0.0.0" ? "localhost" : host;
+				console.log(`\n  ➜  Local:   ${scheme}://${displayHost}:${port}`);
+				const netAddr = getNetworkAddress();
+				if (netAddr && host !== "localhost" && host !== "127.0.0.1") {
+					console.log(`  ➜  Network: ${scheme}://${netAddr}:${port}`);
+				}
+				console.log(`\n  Listening on ${host}:${port}  (--host / -H, --port / -p to rebind)\n`);
+			});
+		}, 1_000);
+	} else {
+		const scheme = "http";
+		const displayHost = host === "0.0.0.0" ? "localhost" : host;
+		console.log(`\n  ➜  Local:   ${scheme}://${displayHost}:${port}`);
+		const netAddr = getNetworkAddress();
+		if (netAddr && host !== "localhost" && host !== "127.0.0.1") {
+			console.log(`  ➜  Network: ${scheme}://${netAddr}:${port}`);
+		}
+		console.log(`\n  Listening on ${host}:${port}  (--host / -H, --port / -p to rebind)\n`);
+	}
+}