server.js

const http = require('http');
const fs = require('fs');
const path = require('path');
const url = require('url');

const { PORT, DB_PATH, STATS_CACHE_FILE, MULTI_USER, BASE_URL, SHARE_ADMIN_KEY } = require('./lib/config');
const { parseAll, backfillRateLimitEvents } = require('./lib/parser');
const Aggregator = require('./lib/aggregator');
const { AggregatorCache } = require('./lib/aggregator');
const { calculateCost, getPricingMeta } = require('./lib/pricing');
const pricingFetcher = require('./lib/pricing-fetcher');
const {
  initDB, insertMessages, streamAllMessages, getParseState, setParseState, closeDB,
  insertMessagesForUser, streamMessagesForUser,
  regenerateApiKey, cleanExpiredSessions, findUserByApiKey,
  getUnlockedAchievements, unlockAchievementsBatch, unlockAchievementsBatchAt, clearAchievementsForUser, replaceAchievementsForUser,
  getMetadata, setMetadata,
  insertRateLimitEvents, insertRateLimitEventsForUser,
  getAllRateLimitEvents, getRateLimitEventsForUser,
  createDevice, getDevicesForUser, getDeviceById, findDeviceByApiKey, findUserById,
  renameDevice, deleteDevice, regenerateDeviceKey, updateDeviceLastSync,
  getProjectShare, listProjectShares, createProjectShare, deleteProjectShare,
  createProjectAlias, deleteProjectAlias, getProjectAliasRows,
  getProjectAliasMap
} = require('./lib/db');
const achievements = require('./lib/achievements');
const { generateExportHTML } = require('./lib/export-html');
const { generateProjectReport } = require('./lib/report-project');
const Watcher = require('./lib/watcher');
const { authenticateRequest, authenticateApiKey, handleAuthRoute } = require('./lib/auth');
const github = require('./lib/github');
const anthropicApi = require('./lib/anthropic-api');
const planUsage = require('./lib/plan-usage');

const PUBLIC_DIR = path.join(__dirname, 'public');

// Read sync-agent files for install script generation
const SYNC_AGENT_INDEX = fs.readFileSync(path.join(__dirname, 'sync-agent', 'index.js'), 'utf-8');
const SYNC_AGENT_PKG = fs.readFileSync(path.join(__dirname, 'sync-agent', 'package.json'), 'utf-8');

// MIME types
const MIME = {
  '.html': 'text/html',
  '.css': 'text/css',
  '.js': 'application/javascript',
  '.json': 'application/json',
  '.png': 'image/png',
  '.jpg': 'image/jpeg',
  '.jpeg': 'image/jpeg',
  '.svg': 'image/svg+xml'
};

// --- Read Claude's own stats-cache.json ---
function readStatsCache() {
  try {
    return JSON.parse(fs.readFileSync(STATS_CACHE_FILE, 'utf-8'));
  } catch {
    return null;
  }
}

// --- Init ---
console.log('Starting Claude Token Tracker...');
if (MULTI_USER) console.log('Multi-user mode enabled');

// 1. Initialize DB
initDB();

// 1b. Initialize GitHub module with DB reference
github.initGithub(require('./lib/db'));

// 1c. Initialize Anthropic API module with DB reference
anthropicApi.initAnthropicApi(require('./lib/db'));

// 1d. Initialize Plan Usage module with DB reference
planUsage.initPlanUsage(require('./lib/db'));

// 1e. Initialize Pricing module — loads cached overrides synchronously, then
// fetches fresh prices from LiteLLM in the background and schedules a 24h refresh.
pricingFetcher.initPricing(require('./lib/db'));

// 2. Load existing messages and parse JSONL (single-user only; multi-user uses per-user cache)
const aggregator = new Aggregator();
let parseState = {};
if (!MULTI_USER) {
  // Load the project merge map before any messages so aliases fold during build.
  aggregator.setProjectAliases(getProjectAliasMap(0));
  // Stream messages straight into the aggregator instead of materializing the
  // full array — the old peak (two ~150k-object arrays alive at once) grew the
  // V8 heap by hundreds of MB that were never returned to the OS.
  aggregator.addMessages(streamAllMessages());
  if (aggregator.messageCount > 0) {
    console.log(`Loaded ${aggregator.messageCount} messages from database`);
  }

  const existingRateLimitEvents = getAllRateLimitEvents();
  if (existingRateLimitEvents.length > 0) {
    aggregator.addRateLimitEvents(existingRateLimitEvents);
    console.log(`Loaded ${existingRateLimitEvents.length} rate-limit events from database`);
  }

  // Parse new JSONL data incrementally
  const t0 = Date.now();
  const savedParseState = getParseState();
  const { messages: newMessages, rateLimitEvents: newRateLimitEvents, parseState: newParseState } = parseAll(savedParseState);
  parseState = newParseState;

  if (newMessages.length > 0) {
    // The aggregator already contains every DB message at this point, so its
    // ID map doubles as the dedup set (no extra 150k-entry Set needed).
    const trulyNew = newMessages.filter(m => !aggregator.hasMessage(m.id));
    if (trulyNew.length > 0) {
      insertMessages(trulyNew, calculateCost);
      aggregator.addMessages(trulyNew);
      console.log(`Parsed ${trulyNew.length} new messages in ${Date.now() - t0}ms`);
    }
  }

  if (newRateLimitEvents.length > 0) {
    insertRateLimitEvents(newRateLimitEvents);
    aggregator.addRateLimitEvents(newRateLimitEvents);
    console.log(`Parsed ${newRateLimitEvents.length} new rate-limit events`);
  }

  // Backfill rate-limit events if needed
  if (existingRateLimitEvents.length === 0 && newRateLimitEvents.length === 0) {
    const backfilled = backfillRateLimitEvents();
    if (backfilled.length > 0) {
      insertRateLimitEvents(backfilled);
      aggregator.addRateLimitEvents(backfilled);
      console.log(`Backfilled ${backfilled.length} rate-limit events from existing JSONL files`);
    }
  }

  setParseState(parseState);
} else {
  console.log('Multi-user mode: skipping global aggregator (per-user cache used instead)');
}

// DB helper for achievements module
const achievementsDb = { getUnlockedAchievements, unlockAchievementsBatch, unlockAchievementsBatchAt, clearAchievementsForUser, replaceAchievementsForUser };
// Metadata-flag prefix for the one-time historical achievements backfill (per
// user). v2: ratio/average achievements gated on tier-scaled minimum active
// days. v3 (2026-08-30): 500 new definitions plus corrected thresholds on
// eight previously unreachable ones — bumping the version re-migrates existing
// data once so unlock dates land on the day each condition was really met.
const ACH_BACKFILL_FLAG = 'ach_backfill_v3_';

// 5. Check achievements on startup (single-user). A FRESH install with an
// existing Claude history would bulk-unlock hundreds of achievements stamped
// "now" — replay the history instead so unlock dates land on the day each
// condition was actually first met (no distorted timeline).
if (!MULTI_USER) {
  try {
    const needsBackfill = aggregator.messageCount > 0 &&
      (getUnlockedAchievements(0).length === 0 || !getMetadata(ACH_BACKFILL_FLAG + 0));
    if (needsBackfill) {
      const res = achievements.backfillAchievements(aggregator, 0, achievementsDb);
      setMetadata(ACH_BACKFILL_FLAG + 0, new Date().toISOString());
      console.log(`Backfilled ${res.unlocked} achievements with historical dates across ${res.days} days (${res.from} – ${res.to})`);
    } else {
      const newAch = achievements.checkAchievements(aggregator, 0, achievementsDb);
      if (newAch.length > 0) console.log(`Unlocked ${newAch.length} new achievements`);
    }
  } catch (e) { console.error('Achievement check failed on startup:', e.message); }
}

// Start file watcher (single-user only)
const watcher = new Watcher(aggregator, parseState, (newMsgs, rleEvents) => {
  if (newMsgs.length > 0) insertMessages(newMsgs, calculateCost);
  if (rleEvents && rleEvents.length > 0) insertRateLimitEvents(rleEvents);
  setParseState(parseState);
  try {
    const newAch = achievements.checkAchievements(aggregator, 0, achievementsDb);
    if (newAch.length > 0) {
      watcher.broadcast({ type: 'achievement-unlocked', achievements: achievements.getAchievementsByKeys(newAch) });
    }
  } catch (e) { console.error('Achievement check failed:', e.message); }
});
if (!MULTI_USER) {
  watcher.start();
}

// Multi-user aggregator cache
// Streaming loader keeps the per-user cache build from materializing the full
// message array (same RSS-peak reasoning as the single-user bootstrap).
const aggregatorCache = MULTI_USER ? new AggregatorCache(streamMessagesForUser, getRateLimitEventsForUser, getProjectAliasMap) : null;

// Re-apply the project merge map after a merge/un-merge and refresh caches so
// the change is visible immediately across dashboard + public shares.
function applyProjectMergeChange(userId) {
  global._shareAggCache = null; // force the global (admin) share aggregator to rebuild
  if (MULTI_USER) {
    if (aggregatorCache) aggregatorCache.invalidateUser(userId);
  } else {
    aggregator.setProjectAliases(getProjectAliasMap(0));
    aggregator.reset();
    aggregator.addMessages(streamAllMessages());
    aggregator.addRateLimitEvents(getAllRateLimitEvents());
  }
}

// Clean expired sessions periodically (multi-user)
let sessionCleanupTimer = null;
if (MULTI_USER) {
  sessionCleanupTimer = setInterval(() => cleanExpiredSessions(), 60 * 60 * 1000);
}

// --- Backup system ---
let backup = null;
try {
  backup = require('./lib/backup');
  backup.startAutoBackup();
} catch {
  // backup module not yet available during Phase 2
}

// --- HTTP Server ---
// NO blanket `Access-Control-Allow-Origin: *` here. It made every API response
// readable by any website the user's browser visited (single-user mode has no
// auth at all), and — because writeHead's header object overrides setHeader —
// it also overwrote the deliberate origin allowlist on the public share
// endpoint, silently turning that allowlist into a wildcard. Endpoints that
// genuinely need CORS set the header themselves (see /api/public/share/:token).
function sendJSON(res, data, status = 200) {
  const body = JSON.stringify(data);
  const headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-cache' };
  const cors = res.getHeader('Access-Control-Allow-Origin');
  if (cors) headers['Access-Control-Allow-Origin'] = cors;
  res.writeHead(status, headers);
  res.end(body);
}

function serveStatic(res, filePath, req) {
  const ext = path.extname(filePath);
  const mime = MIME[ext] || 'application/octet-stream';

  fs.stat(filePath, (statErr, stat) => {
    if (statErr || !stat.isFile()) {
      res.writeHead(404);
      res.end('Not found');
      return;
    }
    // Cheap ETag from mtime + size; browsers revalidate (must-revalidate) and
    // get a 304 instead of re-downloading ~640KB of JS/CSS on every reload.
    const etag = `"${stat.mtimeMs.toString(36)}-${stat.size.toString(36)}"`;
    const cacheHeaders = {
      'ETag': etag,
      'Cache-Control': 'public, max-age=0, must-revalidate'
    };
    if (req && req.headers['if-none-match'] === etag) {
      res.writeHead(304, cacheHeaders);
      res.end();
      return;
    }
    fs.readFile(filePath, (err, data) => {
      if (err) {
        res.writeHead(404);
        res.end('Not found');
        return;
      }
      res.writeHead(200, { 'Content-Type': mime, 'Content-Length': data.length, ...cacheHeaders });
      res.end(data);
    });
  });
}

/**
 * Read request body as JSON
 */
function readBody(req, maxBytes = 10 * 1024 * 1024) {
  return new Promise((resolve, reject) => {
    let data = '';
    let bytes = 0;
    req.on('data', chunk => {
      bytes += chunk.length;
      if (bytes > maxBytes) { req.destroy(); return reject(new Error('Body too large')); }
      data += chunk;
    });
    req.on('end', () => {
      try { resolve(JSON.parse(data)); }
      catch (e) { reject(e); }
    });
    req.on('error', reject);
  });
}

/**
 * Get the aggregator for the current request.
 * In single-user mode: returns the global aggregator.
 * In multi-user mode: returns a per-user aggregator from the cache.
 * If deviceId is provided, returns a device-filtered aggregator.
 */
function getAggregator(user, deviceId) {
  if (!MULTI_USER) return aggregator;
  return aggregatorCache.get(user.id, deviceId || null);
}

/**
 * Generate a self-contained install script for the sync agent
 */
function generateInstallScript(serverUrl, apiKey) {
  return `#!/bin/bash
set -e

GREEN='\\033[0;32m'
YELLOW='\\033[1;33m'
RED='\\033[0;31m'
BLUE='\\033[0;34m'
BOLD='\\033[1m'
NC='\\033[0m'

info() { echo -e "\$BLUE▸\$NC \$1"; }
ok()   { echo -e "\$GREEN✓\$NC \$1"; }
warn() { echo -e "\$YELLOW⚠\$NC \$1"; }
err()  { echo -e "\$RED✗\$NC \$1"; }

INSTALL_DIR="\$HOME/claude-sync-agent"

echo -e "\$BOLD""Claude Sync Agent Installer""\$NC"
echo ""

# --- 1. Prerequisites ---
if ! command -v node &> /dev/null; then
  err "Node.js is not installed. Install Node.js 18+ first."
  exit 1
fi
NODE_VERSION=\$(node -v | sed 's/v//' | cut -d. -f1)
if [ "\$NODE_VERSION" -lt 18 ]; then
  err "Node.js 18+ required (found \$(node -v))"
  exit 1
fi
ok "Node.js \$(node -v)"

if ! command -v npm &> /dev/null; then
  err "npm is not installed."
  exit 1
fi

# --- 2. Handle existing installation ---
if [ -d "\$INSTALL_DIR" ]; then
  info "Updating existing installation at \$INSTALL_DIR ..."
  # Stop existing service before overwriting
  OS_PRE=\$(uname -s)
  if [ "\$OS_PRE" = "Darwin" ]; then
    PLIST_PRE="\$HOME/Library/LaunchAgents/io.celox.claude-sync-agent.plist"
    [ -f "\$PLIST_PRE" ] && launchctl unload "\$PLIST_PRE" 2>/dev/null || true
  elif [ "\$OS_PRE" = "Linux" ]; then
    systemctl --user stop claude-sync-agent 2>/dev/null || true
  fi
fi

# --- 3. Install files ---
info "Installing to \$INSTALL_DIR ..."
mkdir -p "\$INSTALL_DIR"

cat > "\$INSTALL_DIR/index.js" << 'SYNCAGENTEOF'
${SYNC_AGENT_INDEX}
SYNCAGENTEOF

cat > "\$INSTALL_DIR/package.json" << 'SYNCAGENTEOF'
${SYNC_AGENT_PKG}
SYNCAGENTEOF

cat > "\$INSTALL_DIR/config.json" << SYNCAGENTEOF
{
  "serverUrl": "${serverUrl}",
  "apiKey": "${apiKey}"
}
SYNCAGENTEOF

ok "Files written"

# --- 4. Install dependencies ---
info "Installing dependencies..."
cd "\$INSTALL_DIR"
npm install --production --silent 2>&1 | tail -1
ok "Dependencies installed"

# --- 5. Verify server connection ---
info "Verifying server connection..."
HTTP_STATUS=\$(curl -s -o /dev/null -w "%{http_code}" \\
  -X POST \\
  -H "Authorization: Bearer ${apiKey}" \\
  -H "Content-Type: application/json" \\
  -d '{"messages":[]}' \\
  "${serverUrl}/api/sync" 2>/dev/null || echo "000")

if [ "\$HTTP_STATUS" = "400" ]; then
  ok "Server connection verified"
elif [ "\$HTTP_STATUS" = "401" ]; then
  warn "API key rejected — regenerate it on the website"
elif [ "\$HTTP_STATUS" = "000" ]; then
  warn "Could not reach server at ${serverUrl}"
else
  warn "Unexpected response (HTTP \$HTTP_STATUS)"
fi

# --- 6. Autostart ---
NODE_PATH=\$(which node)
OS=\$(uname -s)

setup_launchd() {
  local PLIST_DIR="\$HOME/Library/LaunchAgents"
  local PLIST="\$PLIST_DIR/io.celox.claude-sync-agent.plist"
  mkdir -p "\$PLIST_DIR"

  [ -f "\$PLIST" ] && launchctl unload "\$PLIST" 2>/dev/null || true

  cat > "\$PLIST" << PLISTEOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>io.celox.claude-sync-agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>\$NODE_PATH</string>
        <string>\$INSTALL_DIR/index.js</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
    <key>StandardOutPath</key>
    <string>\$INSTALL_DIR/stdout.log</string>
    <key>StandardErrorPath</key>
    <string>\$INSTALL_DIR/stderr.log</string>
    <key>WorkingDirectory</key>
    <string>\$INSTALL_DIR</string>
</dict>
</plist>
PLISTEOF

  launchctl load "\$PLIST" 2>/dev/null
  ok "Autostart configured (launchd)"
  ok "Agent is running — survives reboots"
  echo ""
  info "Logs:    tail -f \$INSTALL_DIR/stdout.log"
  info "Stop:    launchctl unload \$PLIST"
  info "Restart: launchctl unload \$PLIST && launchctl load \$PLIST"
  info "Remove:  launchctl unload \$PLIST && rm \$PLIST"
}

setup_systemd() {
  local SERVICE_DIR="\$HOME/.config/systemd/user"
  local SERVICE="\$SERVICE_DIR/claude-sync-agent.service"
  mkdir -p "\$SERVICE_DIR"

  cat > "\$SERVICE" << SERVICEEOF
[Unit]
Description=Claude Sync Agent
After=network.target

[Service]
ExecStart=\$NODE_PATH \$INSTALL_DIR/index.js
WorkingDirectory=\$INSTALL_DIR
Restart=on-failure
RestartSec=10
Environment=NODE_ENV=production

[Install]
WantedBy=default.target
SERVICEEOF

  systemctl --user daemon-reload
  systemctl --user enable claude-sync-agent 2>/dev/null
  systemctl --user restart claude-sync-agent
  ok "Autostart configured (systemd)"
  ok "Agent is running — survives reboots"
  echo ""
  info "Logs:    journalctl --user -u claude-sync-agent -f"
  info "Stop:    systemctl --user stop claude-sync-agent"
  info "Restart: systemctl --user restart claude-sync-agent"
  info "Remove:  systemctl --user disable --now claude-sync-agent"
}

echo ""
if [ "\$OS" = "Darwin" ] || [ "\$OS" = "Linux" ]; then
  read -p "\$(echo -e "\$BLUE▸\$NC") Set up autostart? [Y/n] " -n 1 -r
  echo
  if [[ ! \$REPLY =~ ^[Nn]\$ ]]; then
    if [ "\$OS" = "Darwin" ]; then
      setup_launchd
    else
      if command -v systemctl &> /dev/null; then
        setup_systemd
      else
        warn "systemd not available"
        info "Use PM2 instead:"
        info "  pm2 start \$INSTALL_DIR/index.js --name claude-sync"
        info "  pm2 save"
      fi
    fi
  else
    info "Start manually: node \$INSTALL_DIR/index.js"
    info "Or with PM2:    pm2 start \$INSTALL_DIR/index.js --name claude-sync && pm2 save"
  fi
else
  warn "Unknown OS — skipping autostart"
  info "Start manually: node \$INSTALL_DIR/index.js"
fi

echo ""
echo -e "\$GREEN\$BOLD=== Installation complete ===\$NC"
echo "  Directory: \$INSTALL_DIR"
echo "  Server:    ${serverUrl}"
echo ""
`;
}

/**
 * Generate a self-contained PowerShell install script for the sync agent (Windows)
 */
function generateWindowsInstallScript(serverUrl, apiKey) {
  // Use single-quoted heredocs (@'...'@) for index.js and package.json (no interpolation)
  // Use double-quoted heredoc (@"..."@) for config.json (needs variable interpolation)
  return `#Requires -Version 5.0
$ErrorActionPreference = "Stop"

function Write-Info($msg)  { Write-Host "  $msg" -ForegroundColor Cyan }
function Write-Ok($msg)    { Write-Host "  $msg" -ForegroundColor Green }
function Write-Warn($msg)  { Write-Host "  $msg" -ForegroundColor Yellow }
function Write-Err($msg)   { Write-Host "  $msg" -ForegroundColor Red }

$InstallDir = Join-Path $env:USERPROFILE "claude-sync-agent"

Write-Host ""
Write-Host "  Claude Sync Agent Installer" -ForegroundColor White
Write-Host ""

# --- 1. Prerequisites ---
$nodeCmd = Get-Command node -ErrorAction SilentlyContinue
if (-not $nodeCmd) {
    Write-Err "Node.js is not installed. Install Node.js 18+ first."
    exit 1
}
$nodeVersion = (node -v) -replace '^v', ''
$nodeMajor = [int]($nodeVersion.Split('.')[0])
if ($nodeMajor -lt 18) {
    Write-Err "Node.js 18+ required (found v$nodeVersion)"
    exit 1
}
Write-Ok "Node.js v$nodeVersion"

# --- 2. Handle existing installation ---
if (Test-Path $InstallDir) {
    Write-Info "Updating existing installation at $InstallDir ..."
    $task = Get-ScheduledTask -TaskName "ClaudeSyncAgent" -ErrorAction SilentlyContinue
    if ($task) {
        Stop-ScheduledTask -TaskName "ClaudeSyncAgent" -ErrorAction SilentlyContinue
    }
}

# --- 3. Install files ---
Write-Info "Installing to $InstallDir ..."
New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null

$indexJs = @'
${SYNC_AGENT_INDEX}
'@
Set-Content -Path (Join-Path $InstallDir "index.js") -Value $indexJs -Encoding UTF8

$packageJson = @'
${SYNC_AGENT_PKG}
'@
Set-Content -Path (Join-Path $InstallDir "package.json") -Value $packageJson -Encoding UTF8

$configJson = @"
{
  "serverUrl": "${serverUrl}",
  "apiKey": "${apiKey}"
}
"@
Set-Content -Path (Join-Path $InstallDir "config.json") -Value $configJson -Encoding UTF8

Write-Ok "Files written"

# --- 4. Install dependencies ---
Write-Info "Installing dependencies..."
Push-Location $InstallDir
& npm.cmd install --production --silent 2>&1 | Out-Null
Pop-Location
Write-Ok "Dependencies installed"

# --- 5. Verify server connection ---
Write-Info "Verifying server connection..."
try {
    $response = Invoke-WebRequest -Uri "${serverUrl}/api/sync" -Method POST \`
        -Headers @{ "Authorization" = "Bearer ${apiKey}"; "Content-Type" = "application/json" } \`
        -Body '{"messages":[]}' -UseBasicParsing -ErrorAction Stop
    Write-Ok "Server connection verified"
} catch {
    $status = 0
    if ($_.Exception.Response) {
        $status = [int]$_.Exception.Response.StatusCode
    }
    if ($status -eq 400) {
        Write-Ok "Server connection verified"
    } elseif ($status -eq 401) {
        Write-Warn "API key rejected - regenerate it on the website"
    } else {
        Write-Warn "Could not reach server at ${serverUrl}"
    }
}

# --- 6. Autostart (Task Scheduler) ---
Write-Info "Setting up autostart (Task Scheduler)..."
$nodePath = (Get-Command node).Source
$action = New-ScheduledTaskAction -Execute $nodePath -Argument (Join-Path $InstallDir "index.js") -WorkingDirectory $InstallDir
$trigger = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit (New-TimeSpan -Hours 0)
Register-ScheduledTask -TaskName "ClaudeSyncAgent" -Action $action -Trigger $trigger -Settings $settings -Force | Out-Null
Start-ScheduledTask -TaskName "ClaudeSyncAgent" -ErrorAction SilentlyContinue
Write-Ok "Autostart configured (Task Scheduler)"
Write-Ok "Agent is running — survives reboots"

Write-Host ""
Write-Host "  === Installation complete ===" -ForegroundColor Green
Write-Host "  Directory: $InstallDir"
Write-Host "  Server:    ${serverUrl}"
Write-Host ""
Write-Info "Stop:    Stop-ScheduledTask -TaskName ClaudeSyncAgent"
Write-Info "Restart: Start-ScheduledTask -TaskName ClaudeSyncAgent"
Write-Info "Remove:  Unregister-ScheduledTask -TaskName ClaudeSyncAgent -Confirm:\`$false"
Write-Host ""
`;
}

const server = http.createServer((req, res) => {
  const parsed = url.parse(req.url, true);
  const pathname = parsed.pathname;
  const query = parsed.query;

  // Auth routes (always accessible)
  if (pathname.startsWith('/auth/')) {
    if (handleAuthRoute(req, res, pathname, sendJSON)) return;
  }

  // Config endpoint (tells frontend about mode)
  if (pathname === '/api/config') {
    return sendJSON(res, { multiUser: MULTI_USER, hasGithubToken: !!process.env.GITHUB_TOKEN });
  }

  // Sync endpoint — API key auth, separate from session auth
  if (pathname === '/api/sync' && req.method === 'POST') {
    const auth = authenticateApiKey(req);
    if (!auth) return sendJSON(res, { error: 'Unauthorized' }, 401);
    const syncUser = auth.user;
    const syncDevice = auth.device;
    const deviceId = syncDevice ? syncDevice.id : null;

    readBody(req).then(body => {
      const messages = body.messages;
      const rateLimitEvents = body.rateLimitEvents;
      const hasMessages = Array.isArray(messages) && messages.length > 0;
      const hasRateLimitEvents = Array.isArray(rateLimitEvents) && rateLimitEvents.length > 0;

      const hasPlanUsage = !!body.planUsage;
      if (!hasMessages && !hasRateLimitEvents && !hasPlanUsage) {
        return sendJSON(res, { error: 'No data provided' }, 400);
      }

      if (hasMessages) {
        insertMessagesForUser(messages, calculateCost, syncUser.id, deviceId);
      }

      if (hasRateLimitEvents) {
        insertRateLimitEventsForUser(rateLimitEvents, syncUser.id, deviceId);
      }

      // Store plan usage data if provided (backwards-compatible)
      if (body.planUsage) {
        planUsage.storeSyncedPlanUsage(syncUser.id, body.planUsage);
      }

      // Update device last sync time
      if (deviceId) updateDeviceLastSync(deviceId);

      // Incrementally update cached aggregators (avoids full rebuild from 67k+ messages)
      if (aggregatorCache && (hasMessages || hasRateLimitEvents)) {
        const aggMessages = hasMessages ? messages.map(m => ({
          id: m.id, timestamp: m.timestamp, model: m.model, sessionId: m.sessionId,
          project: m.project, inputTokens: m.inputTokens || 0, outputTokens: m.outputTokens || 0,
          cacheReadTokens: m.cacheReadTokens || 0, cacheCreateTokens: m.cacheCreateTokens || 0,
          cacheCreate5m: m.cacheCreate5m || 0, cacheCreate1h: m.cacheCreate1h || 0,
          stopReason: m.stopReason, tools: m.tools || [], toolCounts: m.toolCounts || {},
          isSubagent: !!(m.isSubagent), linesAdded: m.linesAdded || 0,
          linesRemoved: m.linesRemoved || 0, linesWritten: m.linesWritten || 0
        })) : null;
        aggregatorCache.addToUser(syncUser.id, aggMessages, hasRateLimitEvents ? rateLimitEvents : null);
      }

      // Check achievements for this user (always use all-devices aggregator)
      try {
        const userAgg = aggregatorCache.get(syncUser.id);
        const newAch = achievements.checkAchievements(userAgg, syncUser.id, achievementsDb);
        if (newAch.length > 0) {
          watcher.broadcast({ type: 'achievement-unlocked', achievements: achievements.getAchievementsByKeys(newAch), userId: syncUser.id });
        }
      } catch (e) { console.error('Achievement check failed for user', syncUser.id, ':', e.message); }

      // Broadcast SSE update to this user's clients
      watcher.broadcast({ type: 'update', count: hasMessages ? messages.length : 0, userId: syncUser.id });

      return sendJSON(res, { inserted: hasMessages ? messages.length : 0, rateLimitEvents: hasRateLimitEvents ? rateLimitEvents.length : 0 });
    }).catch(err => {
      return sendJSON(res, { error: 'Invalid JSON: ' + err.message }, 400);
    });
    return;
  }

  // Sync agent install script download — uses device-specific API key
  if (pathname === '/api/sync-agent/install.sh' && req.method === 'GET') {
    if (!MULTI_USER) return sendJSON(res, { error: 'Not available in single-user mode' }, 404);

    let scriptUser = authenticateRequest(req);
    if (!scriptUser && query.key) {
      scriptUser = findUserByApiKey(query.key);
      if (!scriptUser) {
        const dev = findDeviceByApiKey(query.key);
        if (dev) scriptUser = findUserById(dev.user_id);
      }
    }
    if (!scriptUser) return sendJSON(res, { error: 'Unauthorized' }, 401);

    // Resolve device API key
    let apiKey;
    if (query.device) {
      const device = getDeviceById(parseInt(query.device));
      if (!device || device.user_id !== scriptUser.id) return sendJSON(res, { error: 'Device not found' }, 404);
      apiKey = device.api_key;
    } else {
      const devices = getDevicesForUser(scriptUser.id);
      apiKey = devices.length > 0 ? devices[0].api_key : scriptUser.api_key;
    }

    const script = generateInstallScript(BASE_URL, apiKey);
    res.writeHead(200, {
      'Content-Type': 'text/plain; charset=utf-8',
      'Content-Disposition': 'attachment; filename="install-sync-agent.sh"',
      'Cache-Control': 'no-cache'
    });
    return res.end(script);
  }

  // Sync agent PowerShell install script download (Windows)
  if (pathname === '/api/sync-agent/install.ps1' && req.method === 'GET') {
    if (!MULTI_USER) return sendJSON(res, { error: 'Not available in single-user mode' }, 404);

    let scriptUser = authenticateRequest(req);
    if (!scriptUser && query.key) {
      scriptUser = findUserByApiKey(query.key);
      if (!scriptUser) {
        const dev = findDeviceByApiKey(query.key);
        if (dev) scriptUser = findUserById(dev.user_id);
      }
    }
    if (!scriptUser) return sendJSON(res, { error: 'Unauthorized' }, 401);

    let apiKey;
    if (query.device) {
      const device = getDeviceById(parseInt(query.device));
      if (!device || device.user_id !== scriptUser.id) return sendJSON(res, { error: 'Device not found' }, 404);
      apiKey = device.api_key;
    } else {
      const devices = getDevicesForUser(scriptUser.id);
      apiKey = devices.length > 0 ? devices[0].api_key : scriptUser.api_key;
    }

    const script = generateWindowsInstallScript(BASE_URL, apiKey);
    res.writeHead(200, {
      'Content-Type': 'text/plain; charset=utf-8',
      'Content-Disposition': 'attachment; filename="install-sync-agent.ps1"',
      'Cache-Control': 'no-cache'
    });
    return res.end(script);
  }

  // Static files — always accessible (login page needs them)
  if (!pathname.startsWith('/api/')) {
    let filePath = pathname === '/' ? '/index.html' : pathname;
    filePath = path.join(PUBLIC_DIR, filePath);

    // Prevent path traversal
    if (!filePath.startsWith(PUBLIC_DIR)) {
      res.writeHead(403);
      return res.end('Forbidden');
    }

    return serveStatic(res, filePath, req);
  }

  // --- Public share endpoint (no auth required) ---
  // Rate limiting for share endpoint: max 30 requests per minute per IP
  if (!global._shareRateLimit) global._shareRateLimit = new Map();
  if (pathname.startsWith('/api/public/share/') && req.method === 'GET') {
    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || req.socket.remoteAddress;
    const now = Date.now();
    const windowMs = 60000;
    const maxRequests = 30;
    const ipHits = global._shareRateLimit.get(clientIp) || [];
    const recentHits = ipHits.filter(t => t > now - windowMs);
    if (recentHits.length >= maxRequests) {
      res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '60' });
      return res.end(JSON.stringify({ error: 'Too many requests' }));
    }
    recentHits.push(now);
    global._shareRateLimit.set(clientIp, recentHits);
    // Cleanup old entries every 100 requests
    if (global._shareRateLimit.size > 1000) {
      for (const [ip, hits] of global._shareRateLimit) {
        if (hits.every(t => t < now - windowMs)) global._shareRateLimit.delete(ip);
      }
    }

    const shareToken = pathname.split('/api/public/share/')[1];
    if (!shareToken || shareToken.length !== 48 || !/^[a-f0-9]+$/.test(shareToken)) {
      return sendJSON(res, { error: 'Invalid token format' }, 400);
    }

    const share = getProjectShare(shareToken);
    if (!share) return sendJSON(res, { error: 'Not found' }, 404);

    // In multi-user mode, use cached global aggregator
    const shareAgg = MULTI_USER ? (() => {
      const now = Date.now();
      if (!global._shareAggCache || now - global._shareAggCacheTime > 300000) {
        const { streamAllMessages } = require('./lib/db');
        const a = new Aggregator();
        // SECURITY: do NOT apply a cross-user alias union here. This aggregator
        // spans every user's messages and backs the global/admin shares; folding
        // it with another user's merge map would let any user rewrite project-name
        // resolution for everyone's shares (cross-tenant poisoning). Shares resolve
        // to the literal project name in multi-user mode. Per-user merges only
        // affect each user's own (scoped) dashboard aggregator.
        a.addMessages(streamAllMessages());
        global._shareAggCache = a;
        global._shareAggCacheTime = now;
      }
      return global._shareAggCache;
    })() : aggregator;
    const projectData = shareAgg.getProjectDetail(share.project, query.from, query.to);
    if (!projectData) return sendJSON(res, { error: 'Not found' }, 404);

    // Return full project data for customer transparency
    const sessionList = Array.isArray(projectData.sessionList) ? projectData.sessionList : [];
    const response = {
      label: share.label || 'Projekt',
      period: { from: query.from || null, to: query.to || null },
      summary: {
        total_input_tokens: projectData.inputTokens || 0,
        total_output_tokens: projectData.outputTokens || 0,
        total_cache_read_tokens: projectData.cacheReadTokens || 0,
        total_cache_create_tokens: projectData.cacheCreateTokens || 0,
        total_messages: projectData.messages || 0,
        total_sessions: projectData.sessions || 0,
        total_cost: projectData.cost || 0,
        lines_added: projectData.linesAdded || 0,
        lines_removed: projectData.linesRemoved || 0,
        lines_written: projectData.linesWritten || 0,
        // total_duration_min used to be the sum of session spans, which counted
        // idle time and overlapping sessions and could exceed the wall clock.
        // It is now an alias of the active time so existing consumers stop
        // receiving an impossible number; span_min carries the elapsed range.
        total_duration_min: projectData.totalActiveMin || 0,
        total_active_min: projectData.totalActiveMin || 0,
        span_min: projectData.spanMin || 0,
        first_activity: projectData.firstTs || null,
        last_activity: projectData.lastTs || null,
        models_used: (projectData.models || []).map(m => ({
          name: m.name,
          messages: m.messages,
          cost: m.cost || 0,
        })),
        tools: (projectData.tools || []).slice(0, 15).map(t => ({
          name: t.name,
          calls: t.calls || t.count || 0,
        })),
      },
      daily: (projectData.daily || []).map(d => ({
        date: d.date,
        input_tokens: d.inputTokens || 0,
        output_tokens: d.outputTokens || 0,
        cache_read_tokens: d.cacheReadTokens || 0,
        messages: d.messages || 0,
        cost: d.cost || 0,
        lines_added: d.linesAdded || 0,
        lines_removed: d.linesRemoved || 0,
        lines_written: d.linesWritten || 0,
      })),
      sessions: sessionList.map(s => ({
        start: s.firstMessage,
        end: s.lastMessage,
        messages: s.messages || 0,
        input_tokens: s.inputTokens || 0,
        output_tokens: s.outputTokens || 0,
        cost: s.cost || 0,
        duration_min: s.durationMin || 0,
        active_min: s.activeMin || 0,
        model: s.model,
        lines_added: s.linesAdded || 0,
        lines_removed: s.linesRemoved || 0,
        lines_written: s.linesWritten || 0,
      })),
    };

    // Restrict CORS to known origins
    const origin = req.headers.origin || '';
    const allowedOrigins = ['https://ops.celox.io', 'https://tracker.celox.io', 'http://localhost:5173', 'http://localhost:8090'];
    if (allowedOrigins.includes(origin)) {
      res.setHeader('Access-Control-Allow-Origin', origin);
    }
    return sendJSON(res, response);
  }

  // CORS preflight for share endpoint
  if (pathname.startsWith('/api/public/share/') && req.method === 'OPTIONS') {
    const origin = req.headers.origin || '';
    const allowedOrigins = ['https://ops.celox.io', 'https://tracker.celox.io', 'http://localhost:5173', 'http://localhost:8090'];
    if (allowedOrigins.includes(origin)) {
      res.writeHead(204, {
        'Access-Control-Allow-Origin': origin,
        'Access-Control-Allow-Methods': 'GET, OPTIONS',
        'Access-Control-Allow-Headers': 'Content-Type',
        'Access-Control-Max-Age': '86400',
      });
    } else {
      res.writeHead(204);
    }
    return res.end();
  }

  // --- Share admin key management (session auth only, for settings UI) ---
  if (pathname === '/api/share-admin-key' && req.method === 'GET') {
    const sessionUser = authenticateRequest(req);
    if (MULTI_USER && !sessionUser) return sendJSON(res, { error: 'Unauthorized' }, 401);
    return sendJSON(res, {
      key: SHARE_ADMIN_KEY || null,
      base_url: BASE_URL || `http://localhost:${PORT}`,
    });
  }

  if (pathname === '/api/share-admin-key' && req.method === 'POST') {
    const sessionUser = authenticateRequest(req);
    if (MULTI_USER && !sessionUser) return sendJSON(res, { error: 'Unauthorized' }, 401);
    const crypto = require('crypto');
    const newKey = crypto.randomBytes(32).toString('hex');
    // Write to .env file
    const envPath = path.join(__dirname, '.env');
    try {
      let envContent = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf-8') : '';
      if (envContent.includes('SHARE_ADMIN_KEY=')) {
        envContent = envContent.replace(/SHARE_ADMIN_KEY=.*/g, `SHARE_ADMIN_KEY=${newKey}`);
      } else {
        envContent += `\nSHARE_ADMIN_KEY=${newKey}`;
      }
      fs.writeFileSync(envPath, envContent);
      // Update in-memory (requires restart for full effect, but update the module cache)
      require('./lib/config').SHARE_ADMIN_KEY = newKey;
      return sendJSON(res, { key: newKey, note: 'Key aktualisiert. Server-Neustart empfohlen.' });
    } catch (err) {
      return sendJSON(res, { error: err.message }, 500);
    }
  }

  // --- Share admin API (admin key auth, before multi-user check) ---
  if (pathname.startsWith('/api/shares')) {
    const authHeader = req.headers.authorization || '';
    const currentShareKey = require('./lib/config').SHARE_ADMIN_KEY;
    const isAdmin = currentShareKey && authHeader === `Bearer ${currentShareKey}`;
    const sessionUser = authenticateRequest(req);
    if (!isAdmin && !(MULTI_USER ? sessionUser : true)) {
      return sendJSON(res, { error: 'Unauthorized' }, 401);
    }

    // In multi-user mode, use a cached global aggregator (rebuilt every 5 min)
    const shareAgg = MULTI_USER ? (() => {
      const now = Date.now();
      if (!global._shareAggCache || now - global._shareAggCacheTime > 300000) {
        const { streamAllMessages } = require('./lib/db');
        const a = new Aggregator();
        // SECURITY: do NOT apply a cross-user alias union here. This aggregator
        // spans every user's messages and backs the global/admin shares; folding
        // it with another user's merge map would let any user rewrite project-name
        // resolution for everyone's shares (cross-tenant poisoning). Shares resolve
        // to the literal project name in multi-user mode. Per-user merges only
        // affect each user's own (scoped) dashboard aggregator.
        a.addMessages(streamAllMessages());
        global._shareAggCache = a;
        global._shareAggCacheTime = now;
      }
      return global._shareAggCache;
    })() : aggregator;

    if (pathname === '/api/shares/projects' && req.method === 'GET') {
      const projects = shareAgg.getProjects();
      return sendJSON(res, (projects || []).map(p => ({
        name: p.name,
        messages: p.messages,
        sessions: p.sessions,
        last_activity: p.lastTs,
      })));
    }

    if (pathname === '/api/shares' && req.method === 'GET') {
      return sendJSON(res, listProjectShares());
    }

    if (pathname === '/api/shares' && req.method === 'POST') {
      let body = '';
      req.on('data', chunk => body += chunk);
      req.on('end', () => {
        try {
          const { project, label, expires_in_days } = JSON.parse(body);
          if (!project) return sendJSON(res, { error: 'project is required' }, 400);
          const share = createProjectShare(project, label, expires_in_days);
          return sendJSON(res, share, 201);
        } catch (err) {
          return sendJSON(res, { error: err.message }, 400);
        }
      });
      return;
    }

    if (pathname.startsWith('/api/shares/') && req.method === 'DELETE') {
      const shareId = pathname.split('/api/shares/')[1];
      if (!shareId || shareId === 'projects') return sendJSON(res, { error: 'Invalid' }, 400);
      deleteProjectShare(shareId);
      res.writeHead(204);
      return res.end();
    }
  }

  // Public pricing meta — informational, no user data exposed.
  // Refresh stays behind the auth gate further down.
  if (pathname === '/api/pricing' && req.method === 'GET') {
    const meta = getPricingMeta();
    const lastError = pricingFetcher.getLastError();
    return sendJSON(res, { ...meta, lastError });
  }

  // --- All /api/* routes below require authentication in multi-user mode ---
  const user = authenticateRequest(req);
  if (MULTI_USER && !user) {
    return sendJSON(res, { error: 'Unauthorized' }, 401);
  }

  const deviceFilter = query.device ? parseInt(query.device) : null;
  const agg = getAggregator(user, deviceFilter);

  // API routes
  if (pathname === '/api/active-sessions') {
    const minutes = parseInt(query.minutes) || 10;
    return sendJSON(res, agg.getActiveSessions(minutes));
  }

  if (pathname === '/api/overview') {
    return sendJSON(res, agg.getOverview(query.from, query.to));
  }

  if (pathname === '/api/rate-limits') {
    return sendJSON(res, agg.getRateLimits(query.from, query.to));
  }

  if (pathname === '/api/daily') {
    return sendJSON(res, agg.getDaily(query.from, query.to));
  }

  if (pathname === '/api/daily-by-model') {
    return sendJSON(res, agg.getDailyByModel(query.from, query.to));
  }

  if (pathname === '/api/sessions') {
    return sendJSON(res, agg.getSessions(query.project, query.model, query.from, query.to));
  }

  if (pathname.startsWith('/api/session/')) {
    const id = pathname.split('/api/session/')[1];
    const session = agg.getSession(id);
    if (!session) return sendJSON(res, { error: 'Not found' }, 404);
    return sendJSON(res, session);
  }

  if (pathname === '/api/project-detail') {
    if (!query.name) return sendJSON(res, { error: 'name parameter required' }, 400);
    return sendJSON(res, agg.getProjectDetail(query.name, query.from, query.to));
  }

  // Standalone per-project report. `download=1` saves it as a file,
  // `print=1` opens the browser print dialog (that is the PDF path — there is
  // no server-side PDF engine, see lib/report-project.js).
  if (pathname === '/api/project-report') {
    if (!query.name) return sendJSON(res, { error: 'name parameter required' }, 400);
    const detail = agg.getProjectDetail(query.name, query.from, query.to);
    if (!detail || !detail.messages) {
      return sendJSON(res, { error: 'no data for project' }, 404);
    }
    const periodLabel = query.from && query.to
      ? `${query.from} – ${query.to}`
      : query.from ? `ab ${query.from}` : 'Gesamter Zeitraum';
    const html = generateProjectReport(detail, {
      periodLabel,
      print: query.print === '1'
    });
    const headers = {
      'Content-Type': 'text/html; charset=utf-8',
      'Cache-Control': 'no-store'
    };
    if (query.download === '1') {
      // Project names contain slashes and dots — flatten to a safe filename.
      const safe = String(detail.name).replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'projekt';
      const stamp = new Date().toISOString().slice(0, 10);
      headers['Content-Disposition'] = `attachment; filename="token-report-${safe}-${stamp}.html"`;
    }
    res.writeHead(200, headers);
    return res.end(html);
  }

  if (pathname === '/api/projects') {
    return sendJSON(res, agg.getProjects(query.from, query.to));
  }

  if (pathname === '/api/models') {
    return sendJSON(res, agg.getModels(query.from, query.to));
  }

  if (pathname === '/api/tools') {
    return sendJSON(res, agg.getTools(query.from, query.to));
  }

  if (pathname === '/api/tool-stats') {
    return sendJSON(res, agg.getToolStats(query.from, query.to));
  }

  if (pathname === '/api/mcp-servers') {
    return sendJSON(res, agg.getMcpServers(query.from, query.to));
  }

  if (pathname === '/api/subagent-stats') {
    return sendJSON(res, agg.getSubagentStats(query.from, query.to));
  }

  if (pathname === '/api/tool-cost-daily') {
    return sendJSON(res, agg.getToolCostDaily(query.from, query.to));
  }

  if (pathname === '/api/hourly') {
    return sendJSON(res, agg.getHourly(query.from, query.to));
  }

  if (pathname === '/api/hourly-by-model') {
    return sendJSON(res, agg.getHourlyByModel(query.from, query.to));
  }

  if (pathname === '/api/hourly-weekday') {
    return sendJSON(res, agg.getHourlyWeekday(query.from, query.to));
  }

  // Usage-trend comparisons (today/week/month/rolling-7d vs previous period).
  // Anchored at "now" — deliberately independent of the period filter.
  if (pathname === '/api/trends') {
    return sendJSON(res, agg.getTrends());
  }

  // Insights API endpoints
  if (pathname === '/api/stop-reasons') {
    return sendJSON(res, agg.getStopReasons(query.from, query.to));
  }

  if (pathname === '/api/day-of-week') {
    return sendJSON(res, agg.getDayOfWeek(query.from, query.to));
  }

  if (pathname === '/api/cache-efficiency') {
    return sendJSON(res, agg.getCacheEfficiency(query.from, query.to));
  }

  if (pathname === '/api/cumulative-cost') {
    return sendJSON(res, agg.getCumulativeCost(query.from, query.to));
  }

  if (pathname === '/api/daily-cost-breakdown') {
    return sendJSON(res, agg.getDailyCostBreakdown(query.from, query.to));
  }

  if (pathname === '/api/session-efficiency') {
    return sendJSON(res, agg.getSessionEfficiency(query.from, query.to));
  }

  if (pathname === '/api/productivity') {
    return sendJSON(res, agg.getProductivity(query.from, query.to));
  }
  if (pathname === '/api/efficiency-trend') {
    return sendJSON(res, agg.getEfficiencyTrend(query.from, query.to));
  }
  if (pathname === '/api/model-efficiency') {
    return sendJSON(res, agg.getModelEfficiency(query.from, query.to));
  }
  if (pathname === '/api/session-depth') {
    return sendJSON(res, agg.getSessionDepthAnalysis(query.from, query.to));
  }

  // Claude's own stats-cache with cost calculation (single-user only)
  if (pathname === '/api/stats-cache') {
    if (MULTI_USER) {
      return sendJSON(res, { error: 'Not available in multi-user mode' }, 404);
    }
    const sc = readStatsCache();
    if (!sc) return sendJSON(res, { error: 'stats-cache.json not found' }, 404);
    const modelsWithCost = {};
    let totalCost = 0;
    for (const [model, usage] of Object.entries(sc.modelUsage || {})) {
      const cost = calculateCost(model, {
        inputTokens: usage.inputTokens,
        outputTokens: usage.outputTokens,
        cacheReadTokens: usage.cacheReadInputTokens,
        cacheCreateTokens: usage.cacheCreationInputTokens
      });
      totalCost += cost;
      modelsWithCost[model] = { ...usage, estimatedCost: Math.round(cost * 100) / 100 };
    }
    return sendJSON(res, {
      ...sc,
      modelUsage: modelsWithCost,
      totalEstimatedCost: Math.round(totalCost * 100) / 100
    });
  }

  if (pathname === '/api/live') {
    res.writeHead(200, {
      'Content-Type': 'text/event-stream',
      'Cache-Control': 'no-cache',
      'Connection': 'keep-alive'
      // same-origin only — the dashboard is served from this server
    });
    res.write('data: {"type":"connected"}\n\n');
    // Tag SSE client with userId for multi-user filtering
    if (MULTI_USER && user) {
      res._userId = user.id;
    }
    watcher.addSSEClient(res);
    return;
  }

  if (pathname === '/api/export-html' && req.method === 'GET') {
    const overview = agg.getOverview(query.from, query.to);
    const daily = agg.getDaily(query.from, query.to);
    const sessions = agg.getSessions(null, null, query.from, query.to);
    const projects = agg.getProjects(query.from, query.to);
    const models = agg.getModels(query.from, query.to);
    const tools = agg.getTools(query.from, query.to);
    const toolStats = agg.getToolStats(query.from, query.to);
    const hourly = agg.getHourly(query.from, query.to);
    const productivity = agg.getProductivity(query.from, query.to);
    const stopReasons = agg.getStopReasons(query.from, query.to);
    const weekday = agg.getDayOfWeek(query.from, query.to);
    const rateLimits = agg.getRateLimits(query.from, query.to);
    const exportUserId = MULTI_USER ? user.id : 0;
    const achData = achievements.getAchievementsResponse(exportUserId, achievementsDb);
    const periodLabel = query.from && query.to
      ? `${query.from} — ${query.to}`
      : query.from ? `From ${query.from}` : 'All Time';

    // Fetch GitHub and Anthropic data (best-effort, no secrets exported)
    const githubToken = github.getToken(user);
    const anthropicToken = anthropicApi.getAdminToken(user);
    const promises = [];
    promises.push(githubToken
      ? Promise.all([
        github.getBillingInfo(githubToken, user.id).catch(() => null),
        github.getContributionsAndRepos(githubToken, user.id).catch(() => null),
        github.getActionsUsageByRepo(githubToken, user.id).catch(() => null),
        github.getCodeStats(githubToken, user.id).catch(() => null)
      ])
      : Promise.resolve([null, null, null, null]));
    promises.push(anthropicToken
      ? anthropicApi.getDashboardData(anthropicToken, user.id).catch(() => null)
      : Promise.resolve(null));

    Promise.all(promises).then(([ghResults, anthropicData]) => {
      const [ghBilling, ghStats, ghActions, ghCodeStats] = ghResults;
      const githubData = (ghBilling || ghStats || ghActions || ghCodeStats)
        ? { billing: ghBilling, stats: ghStats, actions: ghActions, codeStats: ghCodeStats }
        : null;
      const html = generateExportHTML({ overview, daily, sessions, projects, models, tools, toolStats, hourly, productivity, stopReasons, weekday, achievements: achData, rateLimits, periodLabel, githubData, anthropicData });
      res.writeHead(200, {
        'Content-Type': 'text/html; charset=utf-8',
        'Content-Disposition': `attachment; filename="claude-tracker-${new Date().toISOString().slice(0, 10)}.html"`,
        'Cache-Control': 'no-cache'
      });
      res.end(html);
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  // Recompute all achievements with historical unlock dates (replays the
  // message history day by day; rewrites the user's achievements table).
  // Manual re-run of the historical backfill. No longer wired to a button: the
  // backfill runs automatically on a fresh install and once per user whenever
  // ACH_BACKFILL_FLAG is bumped, which covers every case that actually changes
  // unlock dates. Kept as the maintainer's recovery path (curl -XPOST) for the
  // ones that don't — e.g. after a project merge shifts per-project counts.
  if (pathname === '/api/achievements/recompute' && req.method === 'POST') {
    const achUserId = MULTI_USER ? user.id : 0;
    // Always replay the FULL (all-device) history — a device-filtered replay
    // would produce different unlock dates per device view.
    const fullAgg = MULTI_USER ? aggregatorCache.get(user.id, null) : aggregator;
    try {
      const result = achievements.backfillAchievements(fullAgg, achUserId, achievementsDb);
      setMetadata(ACH_BACKFILL_FLAG + achUserId, new Date().toISOString());
      return sendJSON(res, { recomputed: true, ...result });
    } catch (e) {
      return sendJSON(res, { error: e.message }, 500);
    }
  }

  if (pathname === '/api/rebuild' && req.method === 'POST') {
    if (MULTI_USER) {
      // In multi-user mode, just invalidate the user's cache
      if (aggregatorCache) aggregatorCache.invalidateUser(user.id);
      return sendJSON(res, { rebuilt: true, messages: 0, timeMs: 0 });
    }
    aggregator.reset();
    const _t0 = Date.now();
    // Reload the DB-persisted history FIRST. Claude Code prunes old JSONL
    // session files (on this machine ~2,300 of ~4,000 are already gone), so a
    // rebuild that only re-parses JSONL silently dropped everything older than
    // the retention window from the live aggregator until the next restart.
    // The DB is the long-term store; JSONL re-parse then updates/dedups by id.
    aggregator.addMessages(streamAllMessages());
    aggregator.addRateLimitEvents(getAllRateLimitEvents());
    const { messages, parseState: newState } = parseAll({});
    Object.assign(parseState, newState);
    aggregator.addMessages(messages);
    insertMessages(messages, calculateCost);
    setParseState(parseState);
    try { achievements.checkAchievements(aggregator, 0, achievementsDb); } catch (e) { console.error('Achievement check failed on rebuild:', e.message); }
    return sendJSON(res, { rebuilt: true, messages: messages.length, timeMs: Date.now() - _t0 });
  }

  // --- Project merge (aliases) ---------------------------------------------
  // List active merges for the current user.
  if (pathname === '/api/project-aliases' && req.method === 'GET') {
    const aliasUserId = MULTI_USER ? user.id : 0;
    return sendJSON(res, { aliases: getProjectAliasRows(aliasUserId) });
  }

  // Merge one or more source projects into a target (canonical) project.
  // Body: { sources: string[]|string, target: string }
  if (pathname === '/api/project-merge' && req.method === 'POST') {
    readBody(req).then(body => {
      const aliasUserId = MULTI_USER ? user.id : 0;
      const target = (body.target || '').trim();
      let sources = body.sources ?? body.source;
      if (typeof sources === 'string') sources = [sources];
      if (!Array.isArray(sources)) sources = [];
      sources = [...new Set(sources.map(s => (s || '').trim()).filter(Boolean))];

      if (!target) return sendJSON(res, { error: 'target is required' }, 400);
      if (sources.length === 0) return sendJSON(res, { error: 'at least one source project is required' }, 400);

      // Resolve the target through existing merges so we never point at an alias
      // (keeps the map flat: source -> terminal canonical).
      const existing = getProjectAliasMap(aliasUserId);
      const canonical = existing[target] || target;

      // SECURITY: only allow merging projects the requesting user actually owns.
      // Validate against the user's own (scoped) aggregator so one user can never
      // create an alias that references another user's project name.
      const ownAgg = MULTI_USER ? aggregatorCache.get(user.id) : aggregator;
      const owned = new Set((ownAgg.getProjects() || []).map(p => p.name));
      // Names already folded away by a previous merge no longer appear in
      // getProjects(), but the user did own them — keep them mergeable (e.g. to
      // redirect an existing alias to a different canonical).
      for (const r of getProjectAliasRows(aliasUserId)) owned.add(r.alias);
      const unknown = [...new Set([...sources, canonical])].filter(n => !owned.has(n));
      if (unknown.length > 0) {
        return sendJSON(res, { error: 'unknown project(s): ' + unknown.join(', ') }, 400);
      }

      const merged = [];
      for (const src of sources) {
        if (src === canonical) continue;       // can't merge a project into itself
        createProjectAlias(aliasUserId, src, canonical);
        merged.push(src);
      }
      if (merged.length === 0) return sendJSON(res, { error: 'nothing to merge' }, 400);

      applyProjectMergeChange(aliasUserId);
      return sendJSON(res, { merged, target: canonical, count: merged.length });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  // Un-merge: remove a single alias, restoring the original split (non-destructive).
  // Body: { alias: string }
  if (pathname === '/api/project-aliases' && req.method === 'DELETE') {
    readBody(req).then(body => {
      const aliasUserId = MULTI_USER ? user.id : 0;
      const alias = (body.alias || '').trim();
      if (!alias) return sendJSON(res, { error: 'alias is required' }, 400);
      deleteProjectAlias(aliasUserId, alias);
      applyProjectMergeChange(aliasUserId);
      return sendJSON(res, { unmerged: alias });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  // Sync key management
  if (pathname === '/api/sync-key' && req.method === 'GET') {
    if (!MULTI_USER) return sendJSON(res, { error: 'Not available in single-user mode' }, 404);
    return sendJSON(res, { apiKey: user.api_key });
  }

  if (pathname === '/api/sync-key' && req.method === 'POST') {
    if (!MULTI_USER) return sendJSON(res, { error: 'Not available in single-user mode' }, 404);
    const newKey = regenerateApiKey(user.id);
    return sendJSON(res, { apiKey: newKey });
  }

  // Device management endpoints
  if (pathname === '/api/devices' && req.method === 'GET') {
    const userId = MULTI_USER ? user.id : 0;
    const devices = getDevicesForUser(userId);
    return sendJSON(res, devices.map(d => ({
      id: d.id,
      name: d.name,
      apiKeyLast8: d.api_key.slice(-8),
      createdAt: d.created_at,
      lastSyncAt: d.last_sync_at
    })));
  }

  if (pathname === '/api/devices' && req.method === 'POST') {
    readBody(req).then(body => {
      const name = (body.name || '').trim();
      if (!name) return sendJSON(res, { error: 'Device name required' }, 400);
      if (name.length > 50) return sendJSON(res, { error: 'Name too long (max 50)' }, 400);
      const userId = MULTI_USER ? user.id : 0;
      const device = createDevice(userId, name);
      return sendJSON(res, { id: device.id, name: device.name, apiKey: device.api_key, createdAt: device.created_at });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  if (pathname.match(/^\/api\/devices\/\d+$/) && req.method === 'PUT') {
    const deviceId = parseInt(pathname.split('/').pop());
    const device = getDeviceById(deviceId);
    const userId = MULTI_USER ? user.id : 0;
    if (!device || device.user_id !== userId) return sendJSON(res, { error: 'Not found' }, 404);
    readBody(req).then(body => {
      const name = (body.name || '').trim();
      if (!name) return sendJSON(res, { error: 'Device name required' }, 400);
      renameDevice(deviceId, name);
      return sendJSON(res, { renamed: true });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  if (pathname.match(/^\/api\/devices\/\d+$/) && req.method === 'DELETE') {
    const deviceId = parseInt(pathname.split('/').pop());
    const device = getDeviceById(deviceId);
    const userId = MULTI_USER ? user.id : 0;
    if (!device || device.user_id !== userId) return sendJSON(res, { error: 'Not found' }, 404);
    const devices = getDevicesForUser(userId);
    if (devices.length <= 1) return sendJSON(res, { error: 'Cannot delete last device' }, 400);
    deleteDevice(deviceId);
    return sendJSON(res, { deleted: true });
  }

  if (pathname.match(/^\/api\/devices\/\d+\/regenerate-key$/) && req.method === 'POST') {
    const deviceId = parseInt(pathname.split('/')[3]);
    const device = getDeviceById(deviceId);
    const userId = MULTI_USER ? user.id : 0;
    if (!device || device.user_id !== userId) return sendJSON(res, { error: 'Not found' }, 404);
    const newKey = regenerateDeviceKey(deviceId);
    return sendJSON(res, { apiKey: newKey });
  }

  // Global comparison endpoint (multi-user only)
  if (pathname === '/api/global-averages') {
    if (!MULTI_USER) return sendJSON(res, { error: 'Not available in single-user mode' }, 404);
    const { getGlobalUserStats } = require('./lib/db');
    return sendJSON(res, getGlobalUserStats(query.from, query.to, user.id));
  }

  // GitHub stats endpoints
  if (pathname === '/api/github/billing' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    github.getBillingInfo(token, user.id).then(data => {
      const age = github.getCacheAge(user.id, 'billing');
      sendJSON(res, { ...data, _cached: age !== null, _age: age || 0 });
    }).catch(err => {
      console.error('[billing] error:', err.message);
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/stats' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    github.getContributionsAndRepos(token, user.id).then(data => {
      const age = github.getCacheAge(user.id, 'contributions');
      sendJSON(res, { ...data, _cached: age !== null, _age: age || 0 });
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/code-frequency' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    const owner = query.owner;
    const repo = query.repo;
    if (!owner || !repo) return sendJSON(res, { error: 'Missing owner or repo' }, 400);
    github.getCodeFrequency(token, user.id, owner, repo).then(data => {
      sendJSON(res, data);
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/languages' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    const owner = query.owner;
    const repo = query.repo;
    if (!owner || !repo) return sendJSON(res, { error: 'Missing owner or repo' }, 400);
    github.getRepoLanguages(token, user.id, owner, repo).then(data => {
      sendJSON(res, data);
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/actions-usage' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    github.getActionsUsageByRepo(token, user.id).then(data => {
      const age = github.getCacheAge(user.id, 'actions-usage');
      sendJSON(res, { ...data, _cached: age !== null, _age: age || 0 });
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/code-stats' && req.method === 'GET') {
    const token = github.getToken(user);
    if (!token) return sendJSON(res, { error: 'No GitHub token configured' }, 400);
    github.getCodeStats(token, user.id).then(data => {
      const age = github.getCacheAge(user.id, 'code-stats');
      sendJSON(res, { ...data, _cached: age !== null, _age: age || 0 });
    }).catch(err => {
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/github/refresh' && req.method === 'POST') {
    github.clearCache(user.id);
    return sendJSON(res, { cleared: true });
  }

  // Per-user Anthropic key management
  if (pathname === '/api/user/anthropic-key' && req.method === 'GET') {
    return sendJSON(res, { hasKey: anthropicApi.hasAdminKey(user) });
  }

  if (pathname === '/api/user/anthropic-key' && req.method === 'POST') {
    readBody(req).then(body => {
      const key = (body.key || '').trim();
      if (!key.startsWith('sk-ant-admin')) {
        return sendJSON(res, { error: 'Invalid key format — must start with sk-ant-admin' }, 400);
      }
      anthropicApi.saveAdminKey(user.id, key);
      return sendJSON(res, { saved: true });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  if (pathname === '/api/user/anthropic-key' && req.method === 'DELETE') {
    anthropicApi.deleteAdminKey(user.id);
    anthropicApi.clearCache(user.id);
    return sendJSON(res, { deleted: true });
  }

  // Anthropic API endpoints
  if (pathname === '/api/anthropic/dashboard' && req.method === 'GET') {
    const token = anthropicApi.getAdminToken(user);
    if (!token) return sendJSON(res, { error: 'No Anthropic admin key configured' }, 400);
    anthropicApi.getDashboardData(token, user.id).then(data => {
      const age = anthropicApi.getCacheAge(user.id, 'anthropic-dashboard');
      sendJSON(res, { ...data, _cached: age !== null, _age: age || 0 });
    }).catch(err => {
      console.error('[anthropic] dashboard error:', err.message);
      sendJSON(res, { error: err.message }, 500);
    });
    return;
  }

  if (pathname === '/api/anthropic/refresh' && req.method === 'POST') {
    anthropicApi.clearCache(user.id);
    return sendJSON(res, { cleared: true });
  }

  if (pathname === '/api/pricing/refresh' && req.method === 'POST') {
    pricingFetcher.refreshPricing()
      .then(result => sendJSON(res, { ok: true, ...result }))
      .catch(err => sendJSON(res, { ok: false, error: err.message }, 502));
    return;
  }

  if (pathname === '/api/anthropic/budget' && req.method === 'GET') {
    const uid = MULTI_USER ? user.id : 0;
    const budget = getMetadata(`anthropic_budget_${uid}`);
    return sendJSON(res, { budget: budget ? parseFloat(budget) : null });
  }

  if (pathname === '/api/anthropic/budget' && req.method === 'POST') {
    readBody(req).then(body => {
      const uid = MULTI_USER ? user.id : 0;
      if (body.budget === null || body.budget === undefined) {
        setMetadata(`anthropic_budget_${uid}`, '');
        return sendJSON(res, { budget: null });
      }
      const val = parseFloat(body.budget);
      if (isNaN(val) || val < 0) return sendJSON(res, { error: 'Invalid budget' }, 400);
      setMetadata(`anthropic_budget_${uid}`, String(val));
      return sendJSON(res, { budget: val });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  // Plan Usage endpoints
  if (pathname === '/api/plan-usage' && req.method === 'GET') {
    planUsage.getPlanUsage(user).then(data => {
      sendJSON(res, { planUsage: data, hasToken: planUsage.hasOAuthToken(user) });
    }).catch(err => {
      const isExpired = err.message === 'TOKEN_EXPIRED';
      sendJSON(res, {
        planUsage: null,
        hasToken: planUsage.hasOAuthToken(user),
        error: isExpired ? 'TOKEN_EXPIRED' : err.message
      }, isExpired ? 200 : 200);
    });
    return;
  }

  if (pathname === '/api/plan-usage/token' && req.method === 'POST') {
    readBody(req).then(body => {
      const token = (body.token || '').trim();
      if (!token.startsWith('sk-ant-oat01-')) {
        return sendJSON(res, { error: 'Invalid token format — must start with sk-ant-oat01-' }, 400);
      }
      const uid = MULTI_USER ? user.id : 0;
      planUsage.saveOAuthToken(uid, token);
      planUsage.clearCache(uid);
      return sendJSON(res, { saved: true });
    }).catch(err => sendJSON(res, { error: err.message }, 400));
    return;
  }

  if (pathname === '/api/plan-usage/token' && req.method === 'DELETE') {
    const uid = MULTI_USER ? user.id : 0;
    planUsage.deleteOAuthToken(uid);
    planUsage.clearCache(uid);
    return sendJSON(res, { deleted: true });
  }

  if (pathname === '/api/plan-usage/refresh' && req.method === 'POST') {
    const uid = MULTI_USER ? user.id : 0;
    planUsage.clearCache(uid);
    planUsage.getPlanUsage(user).then(data => {
      sendJSON(res, { planUsage: data });
    }).catch(err => {
      sendJSON(res, { planUsage: null, error: err.message });
    });
    return;
  }

  // Achievements endpoint
  if (pathname === '/api/achievements') {
    const userId = MULTI_USER ? user.id : 0;
    // One-time migration: users whose unlocks predate the historical backfill
    // carry hundreds of achievements stamped on their first init/sync day.
    // Recompute once from history, then never again (metadata flag).
    if (!getMetadata(ACH_BACKFILL_FLAG + userId)) {
      try {
        const fullAgg = MULTI_USER ? aggregatorCache.get(user.id, null) : aggregator;
        if (fullAgg.messageCount > 0) {
          const res2 = achievements.backfillAchievements(fullAgg, userId, achievementsDb);
          setMetadata(ACH_BACKFILL_FLAG + userId, new Date().toISOString());
          console.log(`Achievements backfill migration (user ${userId}): ${res2.unlocked} unlocks re-dated across ${res2.days} days`);
        }
      } catch (e) { console.error('Achievements backfill migration failed:', e.message); }
    }
    return sendJSON(res, achievements.getAchievementsResponse(userId, achievementsDb));
  }

  // Database download
  if (pathname === '/api/download-db' && req.method === 'GET') {
    try {
      const stat = fs.statSync(DB_PATH);
      const dateStr = new Date().toISOString().slice(0, 10);
      res.writeHead(200, {
        'Content-Type': 'application/x-sqlite3',
        'Content-Disposition': `attachment; filename="tracker-${dateStr}.db"`,
        'Content-Length': stat.size
      });
      const stream = fs.createReadStream(DB_PATH);
      stream.pipe(res);
      return;
    } catch (err) {
      return sendJSON(res, { error: err.message }, 500);
    }
  }

  // Backup endpoints
  if (pathname === '/api/backup' && req.method === 'POST') {
    if (!backup) return sendJSON(res, { error: 'Backup module not available' }, 500);
    try {
      const result = backup.backupNow();
      return sendJSON(res, result);
    } catch (err) {
      return sendJSON(res, { error: err.message }, 500);
    }
  }

  if (pathname === '/api/export' && req.method === 'GET') {
    if (!backup) return sendJSON(res, { error: 'Backup module not available' }, 500);
    try {
      const data = backup.exportJSON();
      res.writeHead(200, {
        'Content-Type': 'application/json',
        'Content-Disposition': `attachment; filename="claude-tracker-export-${new Date().toISOString().slice(0, 10)}.json"`
        // no CORS: this is a full data export, downloaded same-origin
      });
      return res.end(JSON.stringify(data, null, 2));
    } catch (err) {
      return sendJSON(res, { error: err.message }, 500);
    }
  }

  // 404
  sendJSON(res, { error: 'Not found' }, 404);
});

// Export for testing
function startServer(port) {
  const p = port || PORT;
  return new Promise((resolve) => {
    server.listen(p, () => {
      console.log(`Dashboard: http://localhost:${p}`);
      console.log(`API: http://localhost:${p}/api/overview`);
      // One-shot full GC shortly after bootstrap: the startup load/parse churns
      // through hundreds of MB of short-lived objects and V8 only returns those
      // pages to the OS after a memory-reducing major GC — which may otherwise
      // not run for a long time on an idle server. Compacting once here drops
      // the resident set to roughly the live-data size. No-op if it fails.
      setTimeout(() => {
        try {
          const v8 = require('v8');
          v8.setFlagsFromString('--expose-gc');
          const gc = require('vm').runInNewContext('gc');
          gc();
          v8.setFlagsFromString('--no-expose-gc');
        } catch { /* best effort */ }
      }, 10_000).unref();
      resolve(server);
    });
  });
}

if (require.main === module) {
  startServer();
}

// Graceful shutdown
process.on('SIGINT', () => {
  console.log('\nShutting down...');
  watcher.stop();
  setParseState(parseState);
  if (backup) backup.stopAutoBackup();
  if (aggregatorCache) aggregatorCache.stop();
  if (sessionCleanupTimer) clearInterval(sessionCleanupTimer);
  closeDB();
  process.exit(0);
});

module.exports = { server, startServer, aggregator };