server.js

#!/usr/bin/env node

/**
 * Job Wizard — Local Dashboard Server
 *
 * A tiny zero-dependency HTTP server that lets you view and triage jobs from
 * your Notion pipeline in the browser, WITHOUT exposing your Notion token to
 * the page (the token stays here, server-side).
 *
 * Endpoints:
 *   GET  /                → serves dashboard.html
 *   GET  /api/jobs        → reads jobs from the Notion database (Pipeline2)
 *   POST /api/status      → { pageId, status } updates a job's Status
 *   POST /api/apply       → { pageId } sets status "Applying", exports a job
 *                           package, and attempts the Phase 2 writer (graceful)
 *
 * Usage: npm run dashboard   (then open http://localhost:4321)
 */

const http = require('http');
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execFile } = require('child_process');
const { generateApplication } = require('./lib/generate-application');
const { Notion, P } = require('./lib/notion');
const store = require('./lib/store');
const score = require('./lib/score');
const gmail = require('./lib/gmail');
const jsearch = require('./lib/sources/jsearch');
const { detect } = require('./lib/detect-ats');
const { fetchJD } = require('./lib/jd-fetch');
const { CAREER_SYSTEMS } = require('./lib/sources');
const { regionOf, countryOf, canonicalCity, plain, INDIA_REGIONS } = require('./lib/job');

const PAUSE_FLAG = path.join(__dirname, 'logs', 'schedule.paused');
const LAST_RUN = path.join(__dirname, 'logs', 'last-run.json');
const LAUNCH_AGENTS = path.join(os.homedir(), 'Library', 'LaunchAgents');
// Any installed search schedule (e.g. com.<you>.jobwizard.search.plist) — no name hardcoded.
function findPlist() {
  try { const f = fs.readdirSync(LAUNCH_AGENTS).find(n => /jobwizard\.search\.plist$/.test(n)); return f ? path.join(LAUNCH_AGENTS, f) : null; }
  catch { return null; }
}

const ROOT = __dirname;
const PORT = process.env.PORT || 4321;
const NOTION_VERSION = '2022-06-28';

function loadConfig() {
  const p = path.join(ROOT, 'config.json');
  if (!fs.existsSync(p)) {
    console.error('❌ config.json not found.');
    process.exit(1);
  }
  return JSON.parse(fs.readFileSync(p, 'utf8'));
}

const config = loadConfig();
const NOTION_TOKEN = config.notion.api_token;
const DB_ID = config.notion.database_id;
const notion = new Notion(NOTION_TOKEN);
const companiesDb = () => config.notion.companies_database_id;

const notionHeaders = {
  Authorization: `Bearer ${NOTION_TOKEN}`,
  'Content-Type': 'application/json',
  'Notion-Version': NOTION_VERSION,
};

// ---------------------------------------------------------------------------
// Notion helpers
// ---------------------------------------------------------------------------

function txt(prop) {
  if (!prop) return '';
  if (prop.type === 'title') return (prop.title || []).map(t => t.plain_text).join('');
  if (prop.type === 'rich_text') return (prop.rich_text || []).map(t => t.plain_text).join('');
  if (prop.type === 'select') return prop.select ? prop.select.name : '';
  if (prop.type === 'number') return prop.number;
  if (prop.type === 'url') return prop.url || '';
  if (prop.type === 'date') return prop.date ? prop.date.start : '';
  return '';
}

async function loadCompanies() {
  return store.loadCompanies(notion, companiesDb());
}

async function fetchJobs() {
  const companies = await loadCompanies();
  const rows = await store.loadJobs(notion, DB_ID, companies, config);
  return rows.map(r => ({
    id: r.id,
    role: r.title || '(untitled)',
    company: r.company,
    companyName: r.companyName,
    city: r.city,
    region: r.region,
    country: countryOf(r.city, r.region),
    cities: [...new Set(String(r.city || '').split('|').map(canonicalCity))],   // India tab Location filter
    status: r.status,
    // Legacy rows have only the old single "Source" text; new rows have the Sources list.
    sources: r.sources.length ? r.sources : [r.legacySource === 'User Applied' ? 'User Applied' : 'JSearch'],
    source: r.sources.length ? r.sources.join(', ') : r.legacySource,
    url: r.url,
    links: r.links,
    posted: r.posted,
    firstSeen: r.firstSeen,
    originalPosted: r.originalPosted,   // set when an archived job came back as a repost
    fitScore: r.fitScore || 0,
    tier: r.tier,
    skills: r.skills, experience: r.experience, domain: r.domain,
    fitEstimated: r.fitEstimated,
    isDirect: r.isDirect,
    strengths: r.strengths,
    gaps: r.gaps,
    jobDescription: r.jobDescription,
    dedupKey: r.dedupKey,
    jdState: r.jdState,
    // External ("User Applied") rows often share a blank/generic company+role, which
    // would collide into one folder. folderFor() gives them a unique per-page suffix so
    // each external job gets its own folder, details drawer, and generated files.
    folder: folderFor(r.legacySource, r.company, r.title, r.id),
  })).map(j => {
    // "Docs ready" badge: résumé + cover both written by /job-wizard.
    const docs = listDocs(j.folder);
    j.docsReady = docs.some(f => /_resume\.tex$/i.test(f)) && docs.some(f => /_cover\.tex$/i.test(f));
    j.verdict = j.docsReady ? ((readReview(j.folder) || {}).verdict || null) : null;
    return j;
  });
}

async function updateStatus(pageId, status, retry = true) {
  const res = await fetch(`https://api.notion.com/v1/pages/${pageId}`, {
    method: 'PATCH', headers: notionHeaders,
    body: JSON.stringify({ properties: { Status: { select: { name: status } } } }),
  });
  // 409 = another write to the same page (e.g. a JD save) landed at the same moment — retry once.
  if (res.status === 409 && retry) { await new Promise(r => setTimeout(r, 1000)); return updateStatus(pageId, status, false); }
  if (!res.ok) throw new Error(`Notion update ${res.status}: ${(await res.text()).slice(0, 200)}`);
  return res.json();
}

async function fetchOneJob(pageId) {
  const res = await fetch(`https://api.notion.com/v1/pages/${pageId}`, { headers: notionHeaders });
  if (!res.ok) throw new Error(`Notion page ${res.status}`);
  const page = await res.json();
  const p = page.properties || {};
  const titleProp = Object.values(p).find(v => v.type === 'title');
  return {
    id: page.id,
    role: titleProp ? txt(titleProp) : '(untitled)',
    company: txt(p['Company']),
    city: txt(p['City']),
    url: txt(p['URL']),
    jobDescription: txt(p['Job Description']),
    source: txt(p['Source']),
  };
}

// Folder for a job's application files. External ("User Applied") jobs get a unique
// suffix from the page-id tail so they never collide — MUST match fetchJobs().
function folderFor(source, company, role, pageId) {
  const base = `${slug(company)}-${slug(role)}`;
  return source === 'User Applied' ? `${base}-${String(pageId).replace(/-/g, '').slice(-12)}` : base;
}

// ---------------------------------------------------------------------------
// Apply trigger (Phase 2) — graceful
// ---------------------------------------------------------------------------

function slug(s) {
  return (s || 'unknown').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 40);
}

async function triggerApply(pageId) {
  // 1) Mark as Applying (this always works)
  await updateStatus(pageId, 'Applying');

  // 2) Export a job package to applications/<company>-<role>/job.json
  const job = await fetchOneJob(pageId);
  const folderName = folderFor(job.source, job.company, job.role, pageId);
  const dir = path.join(ROOT, 'applications', folderName);
  fs.mkdirSync(dir, { recursive: true });
  fs.writeFileSync(path.join(dir, 'job.json'), JSON.stringify(job, null, 2));

  const hasJD = (job.jobDescription || '').trim().length > 50;

  // 3) Auto-generate the tailored résumé, cover letter, and 3-lens review —
  //    headless, no manual trigger. Runs in a background worker (below).
  if (autoGenEnabled() && hasJD) {
    enqueueGeneration(folderName, job);
    return {
      status: 'Applying', package: folderName, jdPresent: true, auto: true,
      message: 'Marked Applying. Auto-generating the tailored résumé, cover letter, and 3-lens review now — ' +
        "they'll appear in this job's details in a minute or two (the view refreshes on its own).",
    };
  }

  if (autoGenEnabled() && !hasJD) {
    writeReview(folderName, {
      status: 'error',
      message: 'Job description missing or too short — paste the full JD into the Notion row, then click Retry.',
      updatedAt: new Date().toISOString(),
    });
  }

  return {
    status: 'Applying', package: folderName, jdPresent: hasJD, auto: false,
    message: 'Marked Applying.' +
      (!hasJD ? ' Heads up: the stored JD looks short — use "Paste JD" in Details for the best result.' : '') +
      ' When you\'ve finished shortlisting, run /job-wizard in your Claude session to generate résumés, cover letters, and reviews for all Applying jobs.',
  };
}

// ---------------------------------------------------------------------------
// Headless auto-generation: sequential background worker + daily cap
// ---------------------------------------------------------------------------

function autoGenEnabled() {
  return !!(config.auto_generate && config.auto_generate.enabled);
}
function dailyCap() {
  return (config.auto_generate && config.auto_generate.max_per_day) || 20;
}

const genQueue = [];
let genBusy = false;
let genDay = new Date().toDateString();
let genCount = 0;

function stubReview(folder, status, message) {
  writeReview(folder, { status, message, updatedAt: new Date().toISOString() });
}

function enqueueGeneration(folder, job) {
  genQueue.push({ folder, job });
  stubReview(folder, 'generating', 'Queued for auto-generation…');
  processQueue();
}

async function processQueue() {
  if (genBusy) return;
  const item = genQueue.shift();
  if (!item) return;
  genBusy = true;
  const { folder, job } = item;
  try {
    const today = new Date().toDateString();
    if (today !== genDay) { genDay = today; genCount = 0; }

    if (genCount >= dailyCap()) {
      stubReview(folder, 'error',
        `Daily auto-generation cap (${dailyCap()}) reached. Click Retry tomorrow, or raise config.auto_generate.max_per_day.`);
    } else {
      stubReview(folder, 'generating', 'Generating résumé, cover letter, and 3-lens review…');
      await generateApplication({
        job, folder, config, root: ROOT,
        onProgress: (m) => stubReview(folder, 'generating', m),
      });
      genCount++;
      console.log(`[gen] completed: ${folder}`);
    }
  } catch (e) {
    stubReview(folder, 'error', e.message || String(e));
    console.error('[gen] failed for', folder, '—', e.message);
  } finally {
    genBusy = false;
    if (genQueue.length) processQueue();
  }
}

// ---------------------------------------------------------------------------
// Run search on demand (spawns the search agent)
// ---------------------------------------------------------------------------

function runSearch() {
  return new Promise(resolve => {
    execFile('node', ['agents/job-search-agent.js'], { cwd: ROOT, timeout: 15 * 60000 }, (err, stdout, stderr) => {
      const out = (stdout || '') + (stderr || '');
      const idx = out.indexOf('📊 Search Summary');
      const summary = idx >= 0 ? out.slice(idx) : out.split('\n').slice(-15).join('\n');
      let lastRun = null;
      try { lastRun = JSON.parse(fs.readFileSync(LAST_RUN, 'utf8')); } catch { /* none */ }
      resolve({ ok: !err, summary: summary.trim() || (err ? err.message : 'Done.'), lastRun });
    });
  });
}

// ---------------------------------------------------------------------------
// Schedule status (Option A: pause via flag file, no launchd catch-up)
// ---------------------------------------------------------------------------

function scheduleState() {
  const installed = !!findPlist();
  const paused = fs.existsSync(PAUSE_FLAG);
  let lastRun = null;
  try { lastRun = JSON.parse(fs.readFileSync(LAST_RUN, 'utf8')); } catch { /* none yet */ }
  return { installed, paused, active: installed && !paused, lastRun };
}

function setPaused(paused) {
  try {
    fs.mkdirSync(path.dirname(PAUSE_FLAG), { recursive: true });
    if (paused) fs.writeFileSync(PAUSE_FLAG, new Date().toISOString());
    else if (fs.existsSync(PAUSE_FLAG)) fs.unlinkSync(PAUSE_FLAG);
  } catch (e) {
    const st = scheduleState();
    st.error = e.message;
    return st;
  }
  return scheduleState();
}

// ---------------------------------------------------------------------------
// Application details: file-based review.json + generated docs
// ---------------------------------------------------------------------------

const SAFE = /^[A-Za-z0-9._-]+$/;

// A single path segment is safe only if it matches SAFE AND is not a traversal
// token. SAFE alone permits ".." (both chars are allowed), which combined with
// path.join would let a request escape applications/ and read arbitrary files.
function safeSeg(s) {
  return typeof s === 'string' && s.length > 0 && SAFE.test(s) && !s.includes('..');
}

function appFolder(company, role) {
  return `${slug(company)}-${slug(role)}`;
}
function reviewPath(folder) {
  return path.join(ROOT, 'applications', folder, 'review.json');
}
function readReview(folder) {
  try { return JSON.parse(fs.readFileSync(reviewPath(folder), 'utf8')); } catch { return null; }
}
function writeReview(folder, data) {
  const dir = path.join(ROOT, 'applications', folder);
  fs.mkdirSync(dir, { recursive: true });
  fs.writeFileSync(reviewPath(folder), JSON.stringify(data, null, 2));
  return data;
}
function listDocs(folder) {
  try {
    return fs.readdirSync(path.join(ROOT, 'applications', folder)).filter(f => /\.(tex|docx|pdf)$/i.test(f));
  } catch { return []; }
}

// ---------------------------------------------------------------------------
// Learning feedback log: every status change is a labelled example.
// ---------------------------------------------------------------------------

const FEATURES_LOG = path.join(ROOT, 'data', 'features.jsonl');
const FEEDBACK_LOG = path.join(ROOT, 'data', 'feedback.jsonl');

function lookupFeatures(dedupKey) {
  if (!dedupKey) return null;
  try {
    const lines = fs.readFileSync(FEATURES_LOG, 'utf8').trim().split('\n');
    for (let i = lines.length - 1; i >= 0; i--) {   // most recent scoring wins
      try { const r = JSON.parse(lines[i]); if (r.dedupKey === dedupKey) return r; } catch {}
    }
  } catch {}
  return null;
}

function appendFeedback(rec) {
  try {
    fs.mkdirSync(path.join(ROOT, 'data'), { recursive: true });
    fs.appendFileSync(FEEDBACK_LOG, JSON.stringify(rec) + '\n');
  } catch {}
}

// ---------------------------------------------------------------------------
// External ("User Applied") jobs + JD editing — Notion is the single record.
// ---------------------------------------------------------------------------

let _schemaCache = null;
async function notionSchema() {
  if (_schemaCache) return _schemaCache;
  const res = await fetch(`https://api.notion.com/v1/databases/${DB_ID}`, { headers: notionHeaders });
  if (!res.ok) throw new Error(`Notion schema ${res.status}: ${(await res.text()).slice(0, 160)}`);
  const db = await res.json();
  const props = db.properties || {};
  let titleName = 'Name';
  for (const [n, d] of Object.entries(props)) if (d.type === 'title') { titleName = n; break; }
  _schemaCache = { props, titleName };
  return _schemaCache;
}

// Rich-text that preserves long text by splitting across multiple objects
// (Notion caps a single rich_text object at 2000 chars).
function rt(s) {
  const str = (s || '').toString();
  const chunks = [];
  for (let i = 0; i < str.length && i < 100000; i += 1900) chunks.push({ text: { content: str.slice(i, i + 1900) } });
  return { rich_text: chunks.length ? chunks : [{ text: { content: '' } }] };
}

// Create a grid row for a job the user pasted a link to.
async function createExternalJob({ url, company, role, city }) {
  const { props, titleName } = await notionSchema();
  const today = new Date().toISOString().split('T')[0];
  const P = {};
  const set = (n, v) => { if (props[n]) P[n] = v; };
  P[titleName] = { title: [{ text: { content: (role || 'External Job').slice(0, 1900) } }] };
  set('Company', rt(company || ''));
  set('City', rt(city || ''));
  set('Source', rt('User Applied'));
  if (props['Sources']) P['Sources'] = { multi_select: [{ name: 'User Applied' }] };
  if (props['Is Direct']) P['Is Direct'] = { checkbox: true };
  if (props['Status']) P['Status'] = { select: { name: 'Applying' } };
  if (props['JD State']) P['JD State'] = { select: { name: 'Pending' } };
  if (props['URL']) P['URL'] = { url: /^https?:\/\/\S+$/i.test(url || '') ? url : null };
  if (props['First Seen']) P['First Seen'] = { date: { start: today } };
  set('Dedup Key', rt(`userapplied::${slug(role || 'external')}::${slug(company || '')}::${Date.now()}`));

  const res = await fetch('https://api.notion.com/v1/pages', {
    method: 'POST', headers: notionHeaders,
    body: JSON.stringify({ parent: { database_id: DB_ID }, properties: P }),
  });
  if (!res.ok) throw new Error(`Notion create ${res.status}: ${(await res.text()).slice(0, 200)}`);
  return res.json();
}

// Best-effort: only lands if 'Dismiss Reason' (select) / 'Dismiss Note' (text) exist in the DB.
async function setDismissReason(pageId, reason, note) {
  const properties = { 'Dismiss Reason': { select: { name: reason } } };
  if (note) properties['Dismiss Note'] = { rich_text: [{ text: { content: String(note).slice(0, 2000) } }] };
  try {
    const res = await fetch(`https://api.notion.com/v1/pages/${pageId}`, {
      method: 'PATCH', headers: notionHeaders,
      body: JSON.stringify({ properties }),
    });
    return res.ok;
  } catch { return false; }
}

// ---------------------------------------------------------------------------
// Job sources: companies, settings, Gmail, JD lookup
// ---------------------------------------------------------------------------

const CONFIG_PATH = path.join(ROOT, 'config.json');
const TIER_NAMES = ['Top', 'Middle', 'Bottom'];
const TYPES = ['Employer', 'Recruiter', 'IT services'];

/** Write config.json safely: re-read, merge only the given keys, atomic rename. */
function saveConfig(patch) {
  const current = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
  Object.assign(current, patch);
  const tmp = CONFIG_PATH + '.tmp';
  fs.writeFileSync(tmp, JSON.stringify(current, null, 2) + '\n');
  fs.renameSync(tmp, CONFIG_PATH);
  Object.assign(config, patch);
}

function settingsView() {
  const s = score.settings(config);
  const js = config.jsearch || {};
  return {
    scoring: { fit_weights: s.fit_weights, priority_weights: s.priority_weights, location_values: s.location_values,
      tier_values: s.tier_values, freshness_days: s.freshness_days, penalty: s.penalty, skills_full: s.skills_full },
    tiers: s.tiers,
    target_cities: config.target_cities || [],
    exclude_titles: config.exclude_titles || [],
    exclude_companies_pharma: config.exclude_companies_pharma || [],
    connections: {
      notion: true,
      companies: !!companiesDb(),
      gmail: gmail.status(),
      jsearch: !!(js.api_key && !String(js.api_key).includes('YOUR_')),
      anthropic: false,
    },
    budget: { ...jsearch.readBudget(), limits: jsearch.limits(config), usage: jsearch.usage().slice(0, 30) },
    schedule: scheduleState(),
  };
}

const num = (v, lo = 0, hi = 100) => { const n = Number(v); if (!Number.isFinite(n) || n < lo || n > hi) throw new Error(`invalid number: ${v}`); return Math.round(n); };
const numMap = (obj, keys, hi = 100) => Object.fromEntries(keys.map(k => [k, num(obj[k], 0, hi)]));

function saveSettings(b) {
  const d = score.DEFAULTS;
  const scoring = {
    fit_weights: numMap(b.scoring.fit_weights, Object.keys(d.fit_weights)),
    priority_weights: numMap(b.scoring.priority_weights, Object.keys(d.priority_weights)),
    location_values: numMap(b.scoring.location_values, Object.keys(d.location_values)),
    tier_values: numMap(b.scoring.tier_values, Object.keys(d.tier_values)),
    freshness_days: num(b.scoring.freshness_days, 1, 90),
    penalty: num(b.scoring.penalty, 0, 100),
    skills_full: num(b.scoring.skills_full ?? d.skills_full, 1, 30),
  };
  const tiers = numMap(b.tiers, ['high', 'medium', 'stretch']);
  const cities = (b.target_cities || []).map(c => String(c).trim()).filter(Boolean).slice(0, 20);
  if (!cities.length) throw new Error('at least one target city is required');
  const patch = { scoring, tiers, target_cities: cities };
  // JSearch monthly cap, editable in Settings; never above the hard maximum.
  if (b.jsearch_monthly_limit !== undefined) {
    patch.jsearch = { ...(config.jsearch || {}), monthly_limit: num(b.jsearch_monthly_limit, 1, jsearch.HARD_MAX) };
  }
  saveConfig(patch);
  return settingsView();
}

function cleanCompany(b) {
  const c = {};
  if (b.name !== undefined) { c.name = String(b.name).trim(); if (!c.name) throw new Error('company name required'); }
  if (b.tier !== undefined) { if (!TIER_NAMES.includes(b.tier)) throw new Error('tier must be Top, Middle or Bottom'); c.tier = b.tier; }
  if (b.type !== undefined) { if (!TYPES.includes(b.type)) throw new Error('bad type'); c.type = b.type; }
  if (b.aliases !== undefined) c.aliases = String(b.aliases);
  if (b.system !== undefined) { if (b.system && !CAREER_SYSTEMS[b.system]) throw new Error('unsupported job system'); c.system = b.system || null; }
  if (b.board !== undefined) c.board = String(b.board);
  if (b.sampleLink !== undefined) c.sampleLink = String(b.sampleLink);
  if (b.verified !== undefined) c.verified = !!b.verified;
  if (b.status !== undefined) { if (!['Active', 'Archived'].includes(b.status)) throw new Error('bad status'); c.status = b.status; }
  if (b.notes !== undefined) c.notes = String(b.notes);
  return c;
}

/** Pasted job link → job system + 3 current jobs from that board, for the user to confirm. */
async function detectCompany(link, name) {
  const found = await detect(link);
  if (!found) return { system: null };
  const jobs = await CAREER_SYSTEMS[found.system].list({ name: name || 'Company', board: found.board });
  const product = jobs.filter(j => /product/i.test(j.title));
  const samples = (product.length >= 3 ? product : jobs).slice(0, 3)
    .map(j => ({ title: j.title, location: j.location, postedAt: j.postedAt }));
  return { ...found, samples, total: jobs.length };
}

/** Save a JD on a row and recompute its Fit (removes the "~"). */
async function saveJDAndRescore(pageId, jd, state) {
  jd = plain(jd);
  const [page, companies] = await Promise.all([notion.getPage(pageId), loadCompanies()]);
  const row = store.jobFromPage(page, companies, config);
  const rec = { title: row.title, company: row.company, description: jd, region: row.region,
    postedAt: row.posted, isDirect: row.isDirect };
  const props = store.scoreProps(rec, store.scoreRecord(rec, row.companyTier, config));
  props['Job Description'] = P.text(jd);
  props['JD State'] = P.select(state);
  await notion.update(pageId, props);
  return { fit: props['Fit Score'].number, tier: props.Tier.select.name };
}

/**
 * Edit a job from the dashboard. Role/company/city/link only for jobs the user added
 * (User Applied) — searched jobs keep the source's details so dedup keeps matching them.
 * The JD can be edited on any job; any change re-scores.
 */
async function editJob({ pageId, role, company, city, url, jd }) {
  const [page, companies] = await Promise.all([notion.getPage(pageId), loadCompanies()]);
  const row = store.jobFromPage(page, companies, config);
  const external = row.legacySource === 'User Applied';
  if (external) {
    const next = { title: plain(role) || plain(row.title), company: plain(company), city: plain(city) };
    const props = {
      Role: P.title(next.title), Company: P.text(next.company), City: P.text(next.city),
      Region: P.select(regionOf(next.city, { targetCities: config.target_cities || [] })),
    };
    if (url !== undefined) {
      if (url && !/^https?:\/\/\S+$/i.test(url)) throw Object.assign(new Error('the job link must be an http(s) URL'), { code: 400 });
      props.URL = P.url(url || null);
    }
    await notion.update(pageId, props);
    // Keep generated files attached: the folder name follows company + role.
    const from = path.join(ROOT, 'applications', folderFor('User Applied', row.company, row.title, pageId));
    const to = path.join(ROOT, 'applications', folderFor('User Applied', next.company, next.title, pageId));
    if (from !== to && fs.existsSync(from) && !fs.existsSync(to)) fs.renameSync(from, to);
  }
  const text = (jd ?? row.jobDescription ?? '').trim();
  if (text) return saveJDAndRescore(pageId, text, text === row.jobDescription.trim() ? (row.jdState || 'Provided') : 'Provided');
  return {};
}

async function findJD(pageId) {
  const [page, companies] = await Promise.all([notion.getPage(pageId), loadCompanies()]);
  const row = store.jobFromPage(page, companies, config);
  // Free first: the posting's own page (never LinkedIn); JSearch only if that finds nothing.
  let jd = null;
  for (const link of [row.url, ...row.links]) { if ((jd = await fetchJD(link))) break; }
  if (!jd) jd = await jsearch.lookup(config, { title: row.title, company: row.company }, row.region);
  if (!jd) return { found: false };
  return { found: true, ...(await saveJDAndRescore(pageId, jd, 'Fetched')) };
}

const oauthStates = new Set();
const redirectUri = () => `http://localhost:${PORT}/oauth/gmail/callback`;

// ---------------------------------------------------------------------------
// HTTP server
// ---------------------------------------------------------------------------

function send(res, code, data, type = 'application/json') {
  res.writeHead(code, { 'Content-Type': type });
  res.end(type === 'application/json' ? JSON.stringify(data) : data);
}

function readBody(req) {
  return new Promise(resolve => {
    let b = '';
    req.on('data', c => (b += c));
    req.on('end', () => { try { resolve(JSON.parse(b || '{}')); } catch { resolve({}); } });
  });
}

// Never let a stray error take the whole server down (keeps it alive overnight).
process.on('uncaughtException', (err) => console.error('[server] uncaughtException (kept alive):', err && err.message));
process.on('unhandledRejection', (err) => console.error('[server] unhandledRejection (kept alive):', err && (err.message || err)));

const server = http.createServer(async (req, res) => {
  try {
    // State-changing calls must be JSON: browsers can't send that cross-site without a CORS
    // preflight (which we never grant), so other web pages can't drive this local server.
    if (req.method === 'POST' && !String(req.headers['content-type'] || '').includes('application/json')) {
      return send(res, 415, { error: 'Content-Type must be application/json' });
    }

    if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html' || req.url.startsWith('/?'))) {
      const html = fs.readFileSync(path.join(ROOT, 'dashboard.html'), 'utf8');
      return send(res, 200, html, 'text/html');
    }

    if (req.method === 'GET' && req.url === '/api/jobs') {
      const jobs = await fetchJobs();
      return send(res, 200, { jobs });
    }

    if (req.method === 'POST' && req.url === '/api/status') {
      const { pageId, status, reason, note, job } = await readBody(req);
      if (!pageId || !status) return send(res, 400, { error: 'pageId and status required' });
      await updateStatus(pageId, status);
      if (reason && status === 'Not Relevant') await setDismissReason(pageId, reason, note);

      // Log this labelled example for later search/scoring refinement.
      const feats = lookupFeatures(job && job.dedupKey);
      appendFeedback({
        at: new Date().toISOString(),
        pageId,
        label: status,
        reason: reason || null,
        note: note || null,
        dedupKey: (job && job.dedupKey) || (feats && feats.dedupKey) || null,
        role: (job && job.role) || (feats && feats.role) || null,
        company: (job && job.company) || (feats && feats.company) || null,
        city: (job && job.city) || (feats && feats.city) || null,
        source: (job && job.source) || (feats && feats.source) || null,
        fitScore: (job && job.fitScore) ?? (feats && feats.fitScore) ?? null,
        skillsMatch: feats ? feats.skillsMatch : null,
        domainMatch: feats ? feats.domainMatch : null,
        experienceMatch: feats ? feats.experienceMatch : null,
        locationMatch: feats ? feats.locationMatch : null,
        roleSearched: feats ? feats.roleSearched : null,
        jdSnippet: feats ? feats.jdSnippet : null,
      });

      return send(res, 200, { ok: true, status });
    }

    if (req.method === 'GET' && req.url.startsWith('/api/details')) {
      const folder = new URL(req.url, 'http://x').searchParams.get('job') || '';
      if (!safeSeg(folder)) return send(res, 400, { error: 'bad job id' });
      return send(res, 200, { review: readReview(folder), files: listDocs(folder) });
    }

    if (req.method === 'POST' && req.url === '/api/decision') {
      const { job, decision } = await readBody(req);
      if (!safeSeg(job || '') || !['revise', 'accept'].includes(decision)) {
        return send(res, 400, { error: 'job + decision (revise|accept) required' });
      }
      const rv = readReview(job) || { round: 1, maxRounds: 3, verdict: 'Needs Work', objections: [], lenses: {} };
      if (decision === 'accept') {
        rv.decision = 'accepted';
        rv.verdict = 'Accepted';
      } else {
        rv.decision = 'revise';
        rv.round = Math.min((rv.round || 1) + 1, rv.maxRounds || 3);
      }
      rv.updatedAt = new Date().toISOString();
      writeReview(job, rv);
      return send(res, 200, rv);
    }

    if (req.method === 'GET' && req.url.startsWith('/api/file')) {
      const q = new URL(req.url, 'http://x').searchParams;
      const folder = q.get('job') || '';
      const name = q.get('name') || '';
      if (!safeSeg(folder) || !safeSeg(name)) return send(res, 400, { error: 'bad path' });
      const fp = path.join(ROOT, 'applications', folder, name);
      if (!fs.existsSync(fp)) return send(res, 404, { error: 'not found' });
      const type = name.toLowerCase().endsWith('.pdf')
        ? 'application/pdf'
        : name.toLowerCase().endsWith('.tex')
          ? 'text/plain; charset=utf-8'
        : name.toLowerCase().endsWith('.docx')
          ? 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
          : 'application/octet-stream';
      res.writeHead(200, { 'Content-Type': type, 'Content-Disposition': `attachment; filename="${name}"` });
      return res.end(fs.readFileSync(fp));
    }

    if (req.method === 'GET' && req.url === '/api/schedule') {
      return send(res, 200, scheduleState());
    }

    if (req.method === 'POST' && req.url === '/api/schedule') {
      const { action } = await readBody(req);
      if (action !== 'pause' && action !== 'resume') return send(res, 400, { error: 'action must be pause|resume' });
      return send(res, 200, setPaused(action === 'pause'));
    }

    if (req.method === 'POST' && req.url === '/api/search') {
      const result = await runSearch();
      return send(res, 200, { ok: true, ...result });
    }

    if (req.method === 'POST' && req.url === '/api/apply') {
      const { pageId } = await readBody(req);
      if (!pageId) return send(res, 400, { error: 'pageId required' });
      const result = await triggerApply(pageId);
      return send(res, 200, { ok: true, ...result });
    }

    if (req.method === 'POST' && req.url === '/api/external') {
      const b = await readBody(req);
      const [company, role, city] = [b.company, b.role, b.city].map(plain);   // 𝐃𝐮𝐛𝐚𝐢 → Dubai
      const { url, jd } = b;
      // The link is optional — referrals and direct postings often have none.
      if (url && !/^https?:\/\/\S+$/i.test(url)) return send(res, 400, { error: 'the job link must be an http(s) URL' });
      if (!role && !company) return send(res, 400, { error: 'enter at least a role or a company' });
      const page = await createExternalJob({ url, company, role, city });
      const region = regionOf(city, { targetCities: config.target_cities || [] });
      const where = `${INDIA_REGIONS.has(region) ? 'India Jobs' : 'Outside India Jobs'} tab${city ? '' : ' (no city given)'}`;
      if ((jd || '').trim()) {
        const r = await saveJDAndRescore(page.id, jd.trim(), 'Provided');
        return send(res, 200, { ok: true, id: page.id, message: `Added to the ${where} with its JD — Fit ${r.fit} (${r.tier}). Run /job-wizard to generate.` });
      }
      return send(res, 200, { ok: true, id: page.id, message: `Added to the ${where} (JD pending). Use ✏️ Edit to add the JD any time.` });
    }

    if (req.method === 'POST' && req.url === '/api/editjob') {
      const b = await readBody(req);
      if (!b.pageId) return send(res, 400, { error: 'pageId required' });
      try {
        const r = await editJob(b);
        return send(res, 200, { ok: true, ...r, message: r.fit != null ? `Saved — Fit is now ${r.fit} (${r.tier}).` : 'Saved.' });
      } catch (e) { if (e.code === 400) return send(res, 400, { error: e.message }); throw e; }
    }

    if (req.method === 'POST' && req.url === '/api/setjd') {
      const { pageId, jd } = await readBody(req);
      if (!pageId || !(jd || '').trim()) return send(res, 400, { error: 'pageId and jd text required' });
      const r = await saveJDAndRescore(pageId, jd.trim(), 'Provided');
      return send(res, 200, { ok: true, ...r, message: `JD saved — Fit is now ${r.fit} (${r.tier}).` });
    }

    if (req.method === 'POST' && req.url === '/api/regenerate') {
      const { job: folder } = await readBody(req);
      if (!safeSeg(folder || '')) return send(res, 400, { error: 'bad job id' });
      if (!autoGenEnabled()) return send(res, 400, { error: 'auto-generation is disabled in config.json' });
      let job;
      try { job = JSON.parse(fs.readFileSync(path.join(ROOT, 'applications', folder, 'job.json'), 'utf8')); }
      catch { return send(res, 400, { error: 'job.json not found — re-flip this job to Applying first.' }); }
      enqueueGeneration(folder, job);
      return send(res, 200, { ok: true, message: 'Re-generating résumé, cover letter, and review…' });
    }

    if (req.method === 'GET' && req.url === '/lib/score.js') {
      return send(res, 200, fs.readFileSync(path.join(ROOT, 'lib', 'score.js'), 'utf8'), 'application/javascript');
    }

    if (req.method === 'GET' && req.url === '/api/companies') {
      return send(res, 200, { companies: await loadCompanies(), configured: !!companiesDb() });
    }

    if (req.method === 'POST' && req.url === '/api/companies/detect') {
      const { link, name } = await readBody(req);
      if (!/^https?:\/\/\S+$/i.test(link || '')) return send(res, 400, { error: 'paste a full job link (https://…)' });
      return send(res, 200, await detectCompany(link, name));
    }

    if (req.method === 'POST' && req.url === '/api/companies/create') {
      if (!companiesDb()) return send(res, 400, { error: 'Companies database not set up — run npm run init-notion' });
      const c = cleanCompany({ status: 'Active', verified: false, ...(await readBody(req)) });
      if (!c.name || !c.tier) return send(res, 400, { error: 'name and tier required' });
      const page = await notion.create(companiesDb(), store.companyProps(c));
      return send(res, 200, { ok: true, company: store.companyFromPage(page) });
    }

    if (req.method === 'POST' && req.url === '/api/companies/update') {
      const { id, ...fields } = await readBody(req);
      if (!id) return send(res, 400, { error: 'id required' });
      const page = await notion.update(id, store.companyProps(cleanCompany(fields)));
      return send(res, 200, { ok: true, company: store.companyFromPage(page) });
    }

    if (req.method === 'GET' && req.url === '/api/settings') {
      return send(res, 200, settingsView());
    }

    if (req.method === 'POST' && req.url === '/api/settings') {
      try { return send(res, 200, saveSettings(await readBody(req))); }
      catch (e) { return send(res, 400, { error: e.message }); }
    }

    if (req.method === 'POST' && req.url === '/api/findjd') {
      const { pageId } = await readBody(req);
      if (!pageId) return send(res, 400, { error: 'pageId required' });
      try {
        const r = await findJD(pageId);
        return send(res, 200, r.found
          ? { ok: true, ...r, message: `Found the JD — Fit is now ${r.fit} (${r.tier}).` }
          : { ok: false, message: 'No description found on the posting page or in JSearch. Paste the JD from the posting instead.' });
      } catch (e) { return send(res, 200, { ok: false, message: e.message }); }
    }

    if (req.method === 'POST' && req.url === '/api/gmail/client') {
      const { clientId, clientSecret } = await readBody(req);
      if (!/\.apps\.googleusercontent\.com$/.test(String(clientId || '').trim()) || !String(clientSecret || '').trim()) {
        return send(res, 400, { error: 'Paste the Client ID (…apps.googleusercontent.com) and Client secret from Google Cloud.' });
      }
      gmail.saveClient(clientId, clientSecret);
      return send(res, 200, { ok: true, gmail: gmail.status() });
    }

    if (req.method === 'GET' && req.url === '/api/gmail/connect') {
      const state = require('crypto').randomBytes(16).toString('hex');
      oauthStates.add(state);
      res.writeHead(302, { Location: gmail.authUrl(redirectUri(), state) });
      return res.end();
    }

    if (req.method === 'GET' && req.url.startsWith('/oauth/gmail/callback')) {
      const q = new URL(req.url, 'http://x').searchParams;
      if (!oauthStates.delete(q.get('state') || '')) return send(res, 400, 'Invalid or expired sign-in attempt. Go back to Settings and click Connect Gmail again.', 'text/plain');
      if (q.get('error')) return send(res, 400, `Google sign-in cancelled: ${q.get('error')}`, 'text/plain');
      await gmail.exchangeCode(q.get('code'), redirectUri());
      res.writeHead(302, { Location: '/#settings' });
      return res.end();
    }

    if (req.method === 'POST' && req.url === '/api/gmail/disconnect') {
      const { email } = await readBody(req);          // one inbox; omitted = the pre-multi-account one
      await gmail.disconnect(email);
      return send(res, 200, { ok: true, gmail: gmail.status() });
    }

    send(res, 404, { error: 'not found' });
  } catch (err) {
    console.error(new Date().toISOString(), req.method, req.url, err.message);
    send(res, 500, { error: err.message });
  }
});

server.listen(PORT, '127.0.0.1', () => {
  console.log(`\n📋 Job Wizard dashboard running:  http://localhost:${PORT}`);
  console.log(`   Reading Notion database: ${DB_ID}`);
  console.log(`   Press Ctrl+C to stop.\n`);
});