@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/modules/workspace/archive.py

@@ -0,0 +1,109 @@
+"""Read archive metadata only; never extract members or follow their links."""
+import bz2
+import datetime
+import gzip
+import json
+import lzma
+import os
+import sys
+import tarfile
+import zipfile
+
+try:
+    import resource
+
+    resource.setrlimit(resource.RLIMIT_AS, (256 * 1024 * 1024,) * 2)
+except (ImportError, ValueError, OSError):  # Windows has no rlimit and macOS refuses RLIMIT_AS; MAX_BYTES and MAX_ENTRIES still bound the work.
+    pass
+MAX_ENTRIES = 5000
+MAX_BYTES = 256 * 1024 * 1024
+
+
+class LimitReached(Exception):
+    pass
+
+
+class BoundedReader:
+    def __init__(self, source):
+        self.source = source
+        self.remaining = MAX_BYTES
+
+    def read(self, size):
+        if self.remaining <= 0:
+            raise LimitReached()
+        data = self.source.read(min(size, self.remaining))
+        self.remaining -= len(data)
+        return data
+
+
+def timestamp(value):
+    try:
+        return datetime.datetime.fromtimestamp(value, datetime.timezone.utc).isoformat()
+    except (ValueError, OverflowError, OSError):
+        return None
+
+
+def inspect(path, name):
+    lower = name.lower()
+    result = {"format": "TAR", "size": os.stat(path).st_size, "entries": [], "truncated": False}
+    entries = result["entries"]
+    if lower.endswith(".zip"):
+        result["format"] = "ZIP"
+        with zipfile.ZipFile(path) as archive:
+            members = archive.infolist()
+            result["truncated"] = len(members) > MAX_ENTRIES
+            for item in members[:MAX_ENTRIES]:
+                mode = (item.external_attr >> 16) & 0o170000
+                kind = "directory" if item.is_dir() else "symlink" if mode == 0o120000 else "file"
+                entries.append({"path": item.filename, "type": kind, "size": item.file_size,
+                                "modified": datetime.datetime(*item.date_time).isoformat()})
+        return result
+    opener, compression = open, ""
+    if lower.endswith((".gz", ".gzip", ".tgz")):
+        opener, compression = gzip.open, "GZIP"
+    elif lower.endswith((".bz2", ".tbz", ".tbz2")):
+        opener, compression = bz2.open, "BZIP2"
+    elif lower.endswith((".xz", ".txz")):
+        opener, compression = lzma.open, "XZ"
+    result["format"] = "TAR" + (" + " + compression if compression else "")
+    try:
+        with opener(path, "rb") as source:
+            with tarfile.open(fileobj=BoundedReader(source), mode="r|") as archive:
+                for item in archive:
+                    if len(entries) == MAX_ENTRIES:
+                        result["truncated"] = True
+                        break
+                    kind = ("directory" if item.isdir() else "symlink" if item.issym() else
+                            "hardlink" if item.islnk() else "file" if item.isfile() else "other")
+                    entries.append({"path": item.name, "type": kind, "size": item.size,
+                                    "modified": timestamp(item.mtime), "link": item.linkname or None})
+        return result
+    except LimitReached:
+        result["truncated"] = True
+        return result
+    except tarfile.ReadError:
+        # A plain compressed stream is one file, not an archive of multiple members.
+        if not compression or lower.endswith((".tgz", ".tbz", ".tbz2", ".txz", ".tar.gz", ".tar.bz2", ".tar.xz")):
+            raise
+    result["format"] = compression
+    size = 0
+    with opener(path, "rb") as source:
+        while True:
+            data = source.read(min(65536, MAX_BYTES + 1 - size))
+            size += len(data)
+            if size > MAX_BYTES:
+                raise LimitReached()
+            if not data:
+                break
+    entries.append({"path": name.rsplit("/", 1)[-1].rsplit(".", 1)[0], "type": "file", "size": size})
+    return result
+
+
+try:
+    print(json.dumps(inspect(sys.argv[1], sys.argv[2]), ensure_ascii=True))
+except LimitReached:
+    print(json.dumps({"error": "Сжатый файл превышает лимит просмотра 256 МБ", "status": 413}))
+except (OSError, EOFError, ValueError, tarfile.TarError, zipfile.BadZipFile, lzma.LZMAError):
+    print(json.dumps({"error": "Архив повреждён или имеет неподдерживаемый формат", "status": 422}))
+except MemoryError:
+    print(json.dumps({"error": "Архив слишком большой для просмотра", "status": 413}))

package/packages/server/modules/workspace/external-files.js

@@ -0,0 +1,22 @@
+import { realpath } from "node:fs/promises";
+import { isAbsolute, dirname, basename } from "node:path";
+import { HttpError } from "../http/index.js";
+import { previewProjectFile, readProjectImage } from "./files.js";
+async function externalLocation(path) {
+    if (!isAbsolute(path) || path.includes("\0"))
+        throw new HttpError(400, "Укажите абсолютный путь к файлу");
+    const resolved = await realpath(path);
+    return { root: dirname(resolved), name: basename(resolved) };
+}
+export async function previewExternalFile(path, options = {}) {
+    const { root, name } = await externalLocation(path);
+    if (/\.(?:png|jpe?g|gif|webp|avif)$/i.test(name)) {
+        await readProjectImage(root, name);
+        return { path, content: "", image: true };
+    }
+    return { ...(await previewProjectFile(root, name, options)), path };
+}
+export async function readExternalImage(path) {
+    const { root, name } = await externalLocation(path);
+    return readProjectImage(root, name);
+}

package/packages/server/modules/workspace/files-exclude.js

@@ -0,0 +1,73 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { dataDir } from "../../../core/modules/app-paths/index.js";
+import { activeExcludePatterns, defaultFilesExclude, isExcludedPath, normalizeFilesExclude, } from "../../../core/modules/workspace/index.js";
+const settingsPath = () => join(dataDir(), "files-exclude.json");
+const override = new AsyncLocalStorage();
+let pending = Promise.resolve();
+let cache;
+/** Run workspace code against an in-memory exclude map (parallel-safe in tests). */
+export function withFilesExclude(exclude, run) {
+    return override.run(normalizeFilesExclude(exclude), () => Promise.resolve(run()));
+}
+export async function readFilesExclude() {
+    const local = override.getStore();
+    if (local)
+        return { ...local };
+    const path = settingsPath();
+    if (cache?.path === path)
+        return { ...cache.value };
+    try {
+        const data = JSON.parse(await readFile(path, "utf8"));
+        cache = { path, value: normalizeFilesExclude(data?.exclude ?? data) };
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        cache = { path, value: defaultFilesExclude() };
+    }
+    return { ...cache.value };
+}
+export async function writeFilesExclude(input) {
+    const exclude = normalizeFilesExclude(input);
+    const local = override.getStore();
+    if (local) {
+        Object.keys(local).forEach((key) => delete local[key]);
+        Object.assign(local, exclude);
+        return { ...local };
+    }
+    const task = pending.then(async () => {
+        await mkdir(dataDir(), { recursive: true });
+        const path = settingsPath();
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, JSON.stringify({ exclude }, null, 2) + "\n", { mode: 0o600 });
+            await rename(temporary, path);
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+        cache = { path, value: exclude };
+        return { ...exclude };
+    });
+    pending = task.catch(() => undefined);
+    return task;
+}
+export async function excludePatterns() {
+    const local = override.getStore();
+    if (local)
+        return activeExcludePatterns(local);
+    const path = settingsPath();
+    const value = await readFilesExclude();
+    if (cache?.path === path && cache.patterns)
+        return cache.patterns;
+    const patterns = activeExcludePatterns(value);
+    if (cache?.path === path)
+        cache.patterns = patterns;
+    return patterns;
+}
+export async function pathIsExcluded(path) {
+    return isExcludedPath(path, await excludePatterns());
+}

package/packages/server/modules/workspace/files.js

@@ -0,0 +1,332 @@
+import { os } from "../../../core/modules/os/index.js";
+import { lstat, open, readdir, realpath, rename, unlink, mkdir, cp, rm } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { HttpError } from "../http/index.js";
+import { LARGE_FILE_BYTES, MAX_TEXT_BYTES, moveDestination, treePageRange, } from "../../../core/modules/workspace/index.js";
+import { ignoredPaths } from "./ignored.js";
+import { MAX_BYTES, decode, excludePatterns, location, nameExcluded, pathExcluded, validatePath, } from "./paths.js";
+import { isExcludedPath } from "../../../core/modules/workspace/index.js";
+const archiveHelper = fileURLToPath(new URL("./archive.py", import.meta.url));
+const IMAGE_TYPES = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    svg: "image/svg+xml",
+};
+/** MIME of an image path; SVG is text and is edited as source, rasters are shown by URL. */
+export function imageType(path) {
+    return IMAGE_TYPES[path.split(".").at(-1)?.toLowerCase() ?? ""];
+}
+export const isRasterImage = (path) => /\.(?:png|jpe?g|gif|webp|avif)$/i.test(path);
+const tooLarge = () => new HttpError(413, `Файл больше ${MAX_TEXT_BYTES / 1024 / 1024} МБ: редактор не сможет его открыть`);
+export async function readProjectFile(root, path) {
+    const full = await location(root, path);
+    const file = await open(full, "r");
+    try {
+        const info = await file.stat();
+        if (!info.isFile())
+            throw new HttpError(400, "Выберите файл");
+        if (info.size > MAX_TEXT_BYTES)
+            throw tooLarge();
+        const buffer = await file.readFile();
+        if (buffer.length > MAX_TEXT_BYTES)
+            throw tooLarge();
+        return { path, content: decode(buffer) };
+    }
+    finally {
+        await file.close();
+    }
+}
+const pendingWrites = new Map();
+export async function saveProjectFile(root, path, content, original) {
+    validatePath(path);
+    if (path.includes("\\") || (await pathExcluded(path)))
+        throw new HttpError(403, "Выберите файл дерева проекта");
+    if (Buffer.byteLength(content) > MAX_TEXT_BYTES)
+        throw tooLarge();
+    if (content.includes("\0"))
+        throw new HttpError(415, "Бинарный файл недоступен для редактирования");
+    const base = await realpath(root);
+    const full = await location(base, path);
+    if (full !== resolve(base, path))
+        throw new HttpError(403, "Запись через символические ссылки недоступна");
+    const previous = pendingWrites.get(full);
+    const write = (async () => {
+        await previous?.catch(() => { });
+        if ((await readProjectFile(base, path)).content !== original)
+            throw new HttpError(409, "Файл изменён на диске. Откройте его заново после сохранения копии черновика.");
+        const info = await lstat(full);
+        if (!info.isFile() || info.nlink > 1)
+            throw new HttpError(403, "Запись связанного файла недоступна");
+        const temporary = resolve(dirname(full), `.projector-${randomUUID()}.tmp`);
+        try {
+            const file = await open(temporary, "wx", info.mode & 0o777);
+            try {
+                await file.writeFile(content, "utf8");
+                await file.chmod(info.mode & 0o777);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            if ((await location(base, path)) !== full ||
+                (await readProjectFile(base, path)).content !== original)
+                throw new HttpError(409, "Файл изменён на диске. Черновик не сохранён.");
+            await rename(temporary, full);
+            return { path, content };
+        }
+        finally {
+            await unlink(temporary).catch(() => { });
+        }
+    })();
+    pendingWrites.set(full, write);
+    try {
+        return await write;
+    }
+    finally {
+        if (pendingWrites.get(full) === write)
+            pendingWrites.delete(full);
+    }
+}
+/**
+ * What the file tab shows. With `ask`, a text file from `LARGE_FILE_BYTES` up is not read: the
+ * answer says how large it is (`large`), so the user can be asked before it is opened.
+ */
+export async function previewProjectFile(root, path, options = {}) {
+    if (/\.(?:png|jpe?g|gif|webp|avif)$/i.test(path)) {
+        await readProjectImage(root, path);
+        return { path, content: "", image: true };
+    }
+    if (!/\.(?:tar|tgz|gz|gzip|bz2|tbz2?|xz|txz|zip)$/i.test(path)) {
+        if (options.ask) {
+            const { size } = await lstat(await location(root, path));
+            if (size >= LARGE_FILE_BYTES)
+                return { path, content: "", large: size };
+        }
+        return readProjectFile(root, path);
+    }
+    const full = await location(root, path);
+    const info = await lstat(full);
+    if (!info.isFile())
+        throw new HttpError(400, "Выберите файл");
+    let stdout;
+    try {
+        ({ stdout } = await os.tools.runPython(archiveHelper, [full, path], {
+            timeout: 15000,
+            maxBuffer: 8 * MAX_BYTES,
+        }));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw new HttpError(503, "Для просмотра архивов нужен Python 3");
+        const failure = error;
+        if (failure.killed || failure.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
+            throw new HttpError(413, "Архив слишком большой или превышено время просмотра");
+        throw new HttpError(422, `Не удалось прочитать архив: ${(failure.stderr || failure.message).trim().split(/\r?\n/).at(-1)}`);
+    }
+    const data = JSON.parse(stdout);
+    if (data.error)
+        throw new HttpError(data.status ?? 422, data.error);
+    return { path, content: "", archive: data };
+}
+export async function readProjectImage(root, path) {
+    const type = imageType(path);
+    if (!type)
+        throw new HttpError(415, "Поддерживаются только изображения");
+    const file = await open(await location(root, path), "r");
+    try {
+        const info = await file.stat();
+        if (!info.isFile())
+            throw new HttpError(400, "Выберите файл");
+        const limit = 8 * MAX_BYTES;
+        if (info.size > limit)
+            throw new HttpError(413, "Изображение больше 8 МБ");
+        const buffer = Buffer.alloc(limit + 1);
+        const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+        if (bytesRead > limit)
+            throw new HttpError(413, "Изображение больше 8 МБ");
+        return { type, content: buffer.subarray(0, bytesRead) };
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function listProjectDirectory(root, path = "", params = {}) {
+    const full = await location(root, path);
+    const patterns = await excludePatterns();
+    const entries = (await readdir(full, { withFileTypes: true }))
+        .filter((entry) => {
+        if (!(entry.isDirectory() || entry.isFile()))
+            return false;
+        const relative = path ? `${path}/${entry.name}` : entry.name;
+        return !isExcludedPath(relative, patterns);
+    })
+        .sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
+    let page;
+    try {
+        page = treePageRange(entries, path, params);
+    }
+    catch (error) {
+        throw new HttpError(400, error instanceof Error ? error.message : "Неверная страница");
+    }
+    const visible = entries.slice(page.offset, page.end);
+    const ignored = await ignoredPaths(full, visible.map((entry) => entry.name));
+    return {
+        entries: await Promise.all(visible.map(async (entry) => ({
+            name: entry.name,
+            path: path ? `${path}/${entry.name}` : entry.name,
+            directory: entry.isDirectory(),
+            ...(ignored.has(entry.name) ? { ignored: true } : {}),
+            executable: entry.isFile() &&
+                (await lstat(resolve(full, entry.name)).then((info) => info.isFile() && os.tools.isExecutableFile(entry.name, info.mode), () => false)),
+        }))),
+        truncated: page.nextOffset !== null,
+        total: page.total,
+        nextOffset: page.nextOffset,
+    };
+}
+export async function moveProjectEntry(root, path, directory, name) {
+    // Mutations only accept canonical visible tree entries, never symlink aliases.
+    for (const value of [path, directory]) {
+        validatePath(value);
+        if (value && (await pathExcluded(value)))
+            throw new HttpError(403, "Перенос доступен только для файлов дерева проекта");
+        if (value.includes("\\"))
+            throw new HttpError(403, "Некорректный путь");
+    }
+    if (name !== undefined)
+        await validateEntryName(name);
+    const destination = name === undefined
+        ? moveDestination(path, directory)
+        : directory
+            ? `${directory}/${name}`
+            : name;
+    if (destination && (destination === path || destination.startsWith(path + "/")))
+        throw new HttpError(400, "Нельзя перенести в ту же папку или внутрь себя");
+    if (!destination)
+        throw new HttpError(400, "Нельзя перенести в ту же папку или внутрь себя");
+    const base = await realpath(root);
+    const source = await location(base, path);
+    const targetDirectory = await location(base, directory);
+    if (source !== resolve(base, path) || targetDirectory !== resolve(base, directory))
+        throw new HttpError(403, "Перенос через символические ссылки недоступен");
+    const info = await lstat(source);
+    if (!info.isFile() && !info.isDirectory())
+        throw new HttpError(400, "Выберите файл или папку");
+    if (!(await lstat(targetDirectory)).isDirectory())
+        throw new HttpError(400, "Выберите папку назначения");
+    const target = resolve(base, destination);
+    const exists = async () => lstat(target).then(() => true, (error) => {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    });
+    if (await exists())
+        throw new HttpError(409, "В папке назначения уже есть запись с таким именем");
+    try {
+        // GNU mv uses a no-replace rename, preventing overwrite even if a destination
+        // appears after the check. No copy fallback: a failed move leaves the source intact.
+        await os.tools.moveNoReplace(source, target);
+    }
+    catch (error) {
+        if (await exists())
+            throw new HttpError(409, "В папке назначения уже есть запись с таким именем");
+        throw error;
+    }
+    const remains = await lstat(source).then(() => true, (error) => {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    });
+    if (remains)
+        throw new HttpError(409, "Не удалось перенести: запись назначения уже существует");
+    return { source: path, destination };
+}
+export async function validateEntryName(name) {
+    if (!name.trim() ||
+        name === "." ||
+        name === ".." ||
+        /[/\\\0]/.test(name) ||
+        (await nameExcluded(name)))
+        throw new HttpError(400, "Укажите имя без разделителей пути");
+}
+export async function mutationLocation(root, path, allowRoot = false) {
+    validatePath(path);
+    if ((!path && !allowRoot) || path.includes("\\") || (path && (await pathExcluded(path))))
+        throw new HttpError(403, "Выберите запись дерева проекта");
+    const base = await realpath(root);
+    const full = await location(base, path);
+    if (full !== resolve(base, path))
+        throw new HttpError(403, "Операции через символические ссылки недоступны");
+    return full;
+}
+/** Keeps deleted entries on disk so accidental deletion is recoverable. */
+export async function trashProjectEntry(root, path) {
+    const source = await mutationLocation(root, path);
+    const base = await realpath(root);
+    const trash = resolve(base, ".projector-trash");
+    await mkdir(trash, { recursive: true, mode: 0o700 });
+    if ((await realpath(trash)) !== trash)
+        throw new HttpError(403, "Некорректная папка корзины");
+    await rename(source, resolve(trash, `${randomUUID()}-${path.split("/").at(-1)}`));
+}
+export async function mutateProjectEntry(root, action, path, directory = "", name = "") {
+    if (action === "rename") {
+        await validateEntryName(name);
+        await mutationLocation(root, path);
+        return moveProjectEntry(root, path, path.split("/").slice(0, -1).join("/"), name);
+    }
+    if (action === "delete") {
+        await trashProjectEntry(root, path);
+        return { source: path };
+    }
+    if (!["create-file", "create-directory", "copy"].includes(action))
+        throw new HttpError(400, "Неизвестное действие");
+    await validateEntryName(name);
+    const parent = await mutationLocation(root, directory, true);
+    if (!(await lstat(parent)).isDirectory())
+        throw new HttpError(400, "Выберите папку назначения");
+    const destination = directory ? `${directory}/${name}` : name;
+    const target = resolve(parent, name);
+    try {
+        if (action === "create-file") {
+            const file = await open(target, "wx");
+            await file.close();
+        }
+        else if (action === "create-directory")
+            await mkdir(target);
+        else {
+            const source = await mutationLocation(root, path);
+            if (destination === path || destination.startsWith(path + "/"))
+                throw new HttpError(400, "Нельзя копировать запись внутрь себя");
+            // Stage the complete copy before publishing; never overwrite a destination.
+            const temporary = resolve(parent, `.projector-${randomUUID()}.tmp`);
+            try {
+                await cp(source, temporary, {
+                    recursive: true,
+                    dereference: false,
+                    verbatimSymlinks: true,
+                    force: false,
+                    errorOnExist: true,
+                });
+                await os.tools.moveNoReplace(temporary, target);
+                if (await lstat(temporary).then(() => true, () => false))
+                    throw new HttpError(409, "Запись с таким именем уже существует");
+            }
+            finally {
+                await rm(temporary, { recursive: true, force: true });
+            }
+        }
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new HttpError(409, "Запись с таким именем уже существует");
+        throw error;
+    }
+    return { destination };
+}

package/packages/server/modules/workspace/find-paths.js

@@ -0,0 +1,92 @@
+import { realpath } from "node:fs/promises";
+import { os } from "../../../core/modules/os/index.js";
+import { HttpError } from "../http/index.js";
+import { MAX_BYTES, excludePatterns } from "./paths.js";
+const CACHE_MS = 5000;
+const MAX_PATHS = 50000;
+const cache = new Map();
+/** Every file of the project (what `rg --files` shows, honouring ignores) and its folders. */
+async function listPaths(root) {
+    const base = await realpath(root);
+    const cached = cache.get(base);
+    if (cached && Date.now() - cached.at < CACHE_MS)
+        return cached.paths;
+    const args = ["--files", "--hidden", "--no-require-git"];
+    for (const pattern of await excludePatterns()) {
+        args.push("--glob", `!${pattern}`);
+        if (!pattern.endsWith("/**"))
+            args.push("--glob", `!${pattern}/**`);
+    }
+    let output = "";
+    try {
+        output = (await os.tools.searchFiles(args, { cwd: base, maxBuffer: 16 * MAX_BYTES, timeout: 10000 })).stdout;
+    }
+    catch (error) {
+        const failure = error;
+        if (failure.code === "ENOENT")
+            throw new HttpError(503, "Для поиска нужен ripgrep (rg)");
+        // rg exits 1 for "nothing found" and 2 for partial errors; the partial list is still useful.
+        output = failure.stdout ?? "";
+    }
+    const files = output.split("\n").filter(Boolean).slice(0, MAX_PATHS);
+    const folders = new Set();
+    for (const file of files) {
+        const parts = file.split("/");
+        for (let end = 1; end < parts.length; end++)
+            folders.add(parts.slice(0, end).join("/"));
+    }
+    const paths = [
+        ...[...folders].map((path) => ({ path, directory: true })),
+        ...files.map((path) => ({ path, directory: false })),
+    ];
+    cache.set(base, { at: Date.now(), paths });
+    return paths;
+}
+/**
+ * Lower is better, `undefined` is no match: the query must appear in order (a subsequence), and
+ * a hit in the file name, or a tight one, beats a hit scattered over the folders.
+ */
+function score(path, query) {
+    const lower = path.toLowerCase();
+    const name = lower.slice(lower.lastIndexOf("/") + 1);
+    const exact = name.indexOf(query);
+    if (exact === 0)
+        return path.length * 0.01;
+    if (exact > 0)
+        return 1 + exact + path.length * 0.01;
+    const whole = lower.indexOf(query);
+    if (whole >= 0)
+        return 50 + whole + path.length * 0.01;
+    let at = -1;
+    let gaps = 0;
+    for (const letter of query) {
+        const next = lower.indexOf(letter, at + 1);
+        if (next < 0)
+            return undefined;
+        gaps += at < 0 ? 0 : next - at - 1;
+        at = next;
+    }
+    return 100 + gaps + path.length * 0.01;
+}
+/** Files and folders of a project whose path matches `query`, best first. */
+export async function findProjectPaths(root, query, limit = 30) {
+    const text = query.trim().toLowerCase();
+    if (text.length > 200)
+        throw new HttpError(400, "Запрос длиннее 200 символов");
+    const paths = await listPaths(root);
+    if (!text)
+        return paths
+            .filter((item) => !item.path.includes("/"))
+            .sort((a, b) => Number(b.directory) - Number(a.directory) || a.path.localeCompare(b.path))
+            .slice(0, limit);
+    const ranked = [];
+    for (const item of paths) {
+        const value = score(item.path, text);
+        if (value !== undefined)
+            ranked.push({ item, value });
+    }
+    return ranked
+        .sort((a, b) => a.value - b.value)
+        .slice(0, limit)
+        .map(({ item }) => item);
+}