@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/modules/workspace/git-sync.js

@@ -0,0 +1,245 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { os } from "../../../core/modules/os/index.js";
+import { environmentForPath, runEnvironmentCommand } from "../environments/index.js";
+import { integrationConfig } from "../integration-store/index.js";
+import { gitlabAccessToken, gitlabBaseUrl } from "../gitlab/index.js";
+import { HttpError } from "../http/index.js";
+import { git, serializeGitWrite } from "./git.js";
+import { projectBranches } from "./git-branches.js";
+/** Network operations wait for the remote, not just for the local command. */
+const TIMEOUT = 120_000;
+function httpsHost(remote) {
+    try {
+        const url = new URL(remote);
+        return url.protocol === "https:" ? url.hostname.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Credentials of a matching integration; a self-hosted GitLab token never follows a gitlab.com link. */
+async function credentialsFor(root, remote, push) {
+    const url = (await git(root, ["remote", "get-url", ...(push ? ["--push"] : []), remote]).catch(() => "")).trim();
+    const host = httpsHost(url);
+    if (!host)
+        return undefined;
+    if (host === "github.com") {
+        const config = await integrationConfig("github");
+        const token = config.enabled ? config.credentials.token || "" : "";
+        return token
+            ? { username: "x-access-token", tokenEnv: "PROJECTOR_GITHUB_TOKEN", token }
+            : undefined;
+    }
+    const config = await integrationConfig("gitlab");
+    if (!config.enabled || !config.credentials.token)
+        return undefined;
+    let base;
+    let configured;
+    try {
+        base = gitlabBaseUrl(config.settings.url);
+        configured = new URL(base).hostname.toLowerCase();
+    }
+    catch {
+        base = "https://gitlab.com";
+        configured = "gitlab.com";
+    }
+    if (host !== configured)
+        return undefined;
+    // A gitlab.com alias must not receive a token meant for a private instance.
+    if (host === "gitlab.com" && configured !== "gitlab.com")
+        return undefined;
+    const token = await gitlabAccessToken(base, config.credentials).catch(() => config.credentials.token || "");
+    return token ? { username: "oauth2", tokenEnv: "PROJECTOR_GITLAB_TOKEN", token } : undefined;
+}
+function assertToken(token) {
+    if (token.includes("\n") || token.includes("\r"))
+        throw new HttpError(409, "Некорректный токен интеграции");
+}
+function quote(shellWord) {
+    return `'${shellWord.replaceAll("'", "'\\''")}'`;
+}
+const containerScript = (auth) => String.raw `cat > /tmp/projector-askpass <<'PROJECTOR_ASKPASS'
+#!/bin/sh
+case "$1" in
+  *Username*) printf "%s\n" ${quote(auth.username)} ;;
+  *) printf "%s\n" "$${auth.tokenEnv}" ;;
+esac
+PROJECTOR_ASKPASS
+chmod 700 /tmp/projector-askpass
+export GIT_ASKPASS=/tmp/projector-askpass GIT_TERMINAL_PROMPT=0
+exec /usr/bin/git --literal-pathspecs -c credential.helper= -c http.followRedirects=false -C /workspace "$@"`;
+async function runInEnvironment(environment, args, auth) {
+    const helper = await mkdtemp(join(tmpdir(), "projector-git-"));
+    const credentials = auth ? join(helper, "credentials") : undefined;
+    try {
+        if (auth && credentials) {
+            assertToken(auth.token);
+            await writeFile(credentials, `${auth.tokenEnv}=${auth.token}\n`, { mode: 0o600 });
+            await os.tools.restrictToOwner(credentials);
+        }
+        const command = auth
+            ? [
+                "/bin/bash",
+                "--noprofile",
+                "--norc",
+                "-c",
+                containerScript(auth),
+                "projector-git",
+                ...args,
+            ]
+            : ["/usr/bin/git", "--literal-pathspecs", "-C", "/workspace", ...args];
+        return (await runEnvironmentCommand(environment, command, TIMEOUT, undefined, credentials))
+            .stdout;
+    }
+    finally {
+        await rm(helper, { recursive: true, force: true });
+    }
+}
+/** Runs a network command with the matching integration token; the token stays out of argv and errors. */
+async function runRemote(root, args, remote, push = false) {
+    const auth = await credentialsFor(root, remote, push);
+    const environment = await environmentForPath(root);
+    if (environment)
+        return runInEnvironment(environment, args, auth);
+    if (!auth)
+        return git(root, args, { timeout: TIMEOUT, env: { GIT_TERMINAL_PROMPT: "0" } });
+    assertToken(auth.token);
+    const helper = await mkdtemp(join(tmpdir(), "projector-git-"));
+    try {
+        const script = os.tools.gitAskpass(auth);
+        const askpass = join(helper, script.filename);
+        await writeFile(askpass, script.contents, { mode: 0o700 });
+        return await git(root, ["-c", "credential.helper=", "-c", "http.followRedirects=false", ...args], {
+            timeout: TIMEOUT,
+            env: {
+                GIT_ASKPASS: askpass,
+                GIT_TERMINAL_PROMPT: "0",
+                [auth.tokenEnv]: auth.token,
+            },
+        });
+    }
+    finally {
+        await rm(helper, { recursive: true, force: true });
+    }
+}
+function redact(text) {
+    return text
+        .replace(/(https?:\/\/)[^\s/@]+@/gi, "$1***@")
+        .replace(/([?&](?:token|access_token|private_token)=)[^\s&]+/gi, "$1***");
+}
+async function run(root, args, remote, push = false) {
+    try {
+        return await runRemote(root, args, remote, push);
+    }
+    catch (error) {
+        const raw = String(error?.stderr ?? (error instanceof Error ? error.message : error));
+        const lines = redact(raw)
+            .split("\n")
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .slice(0, 6)
+            .join("\n");
+        throw new HttpError(409, lines || "Операция Git не выполнена");
+    }
+}
+async function currentBranch(root) {
+    const branches = await projectBranches(root);
+    if (!branches.available)
+        throw new HttpError(404, "Здесь нет Git-репозитория");
+    const current = branches.branches.find((branch) => branch.current);
+    if (!current || branches.detached)
+        throw new HttpError(409, "Сначала переключитесь на ветку, а не на отдельный коммит");
+    return { branches, current };
+}
+/** The configured remote of a branch; push may use a separate pushRemote or remote.pushDefault. */
+async function remoteOf(root, branches, branch, action) {
+    const config = (key) => git(root, ["config", "--get", key])
+        .then((value) => value.trim())
+        .catch(() => "");
+    const fallback = branches.remotes.includes("origin") ? "origin" : branches.remotes[0];
+    const remote = action === "push"
+        ? (await config(`branch.${branch.name}.pushRemote`)) ||
+            (await config("remote.pushDefault")) ||
+            (await config(`branch.${branch.name}.remote`)) ||
+            fallback
+        : (await config(`branch.${branch.name}.remote`)) || fallback;
+    if (!remote || !branches.remotes.includes(remote))
+        throw new HttpError(409, "У репозитория нет удалённого репозитория для этой ветки");
+    return remote;
+}
+// One network operation per repository; the index queue stays separate for quick local work.
+const pendingNetwork = new Map();
+async function serializeNetwork(root, operation) {
+    const key = (await git(root, ["rev-parse", "--absolute-git-dir"]).catch(() => root)).trim();
+    const previous = pendingNetwork.get(key);
+    const current = (async () => {
+        await previous?.catch(() => { });
+        return operation();
+    })();
+    pendingNetwork.set(key, current);
+    try {
+        return await current;
+    }
+    finally {
+        if (pendingNetwork.get(key) === current)
+            pendingNetwork.delete(key);
+    }
+}
+export async function mutateProjectSync(root, action) {
+    if (!["fetch", "pull", "push"].includes(action))
+        throw new HttpError(400, "Неизвестное действие синхронизации");
+    const operation = action;
+    const { branches, current } = await currentBranch(root);
+    const remote = await remoteOf(root, branches, current, operation);
+    if (operation === "pull") {
+        if (!current.upstream || current.gone)
+            throw new HttpError(409, "У ветки нет upstream. Отправьте ветку, чтобы создать его");
+        return serializeNetwork(root, () => serializeGitWrite(root, async () => {
+            const output = await run(root, ["pull", "--ff-only"], remote);
+            const fresh = await projectBranches(root);
+            const upToDate = /already up[ -]to[ -]date|уже актуально/i.test(output);
+            return {
+                action: operation,
+                branches: fresh,
+                message: upToDate ? "Уже актуально" : "Изменения получены",
+            };
+        }));
+    }
+    if (operation === "fetch") {
+        return serializeNetwork(root, async () => {
+            await run(root, ["fetch", "--prune", remote], remote);
+            return {
+                action: operation,
+                branches: await projectBranches(root),
+                message: "Удалённые ветки обновлены",
+            };
+        });
+    }
+    return serializeNetwork(root, async () => {
+        // A missing or deleted upstream is published again, like «Publish branch» in an editor.
+        const publish = !current.upstream || current.gone;
+        const ahead = current.ahead;
+        const merge = publish
+            ? ""
+            : (await git(root, ["config", "--get", `branch.${current.name}.merge`]).catch(() => "")).trim();
+        const target = merge.startsWith("refs/heads/")
+            ? merge.slice("refs/heads/".length)
+            : current.name;
+        const args = publish
+            ? ["push", "--set-upstream", remote, current.name]
+            : ["push", remote, `${current.name}:${target}`];
+        await run(root, args, remote, true);
+        const fresh = await projectBranches(root);
+        return {
+            action: operation,
+            branches: fresh,
+            message: publish
+                ? `Ветка ${current.name} опубликована`
+                : ahead > 0
+                    ? `Отправлено коммитов: ${ahead}`
+                    : "Нечего отправлять",
+        };
+    });
+}

package/packages/server/modules/workspace/git-tree.js

@@ -0,0 +1,126 @@
+import { HttpError } from "../http/index.js";
+import { LARGE_FILE_BYTES, MAX_TEXT_BYTES, isExcludedPath, treePageRange, } from "../../../core/modules/workspace/index.js";
+import { git, gitBytes, gitText } from "./git.js";
+import { excludePatterns } from "./files-exclude.js";
+import { imageType, isRasterImage } from "./files.js";
+import { MAX_BYTES, validatePath } from "./paths.js";
+const COMMIT = /^[0-9a-f]{7,40}$/i;
+export async function resolveRevision(root, rev) {
+    if (!COMMIT.test(rev))
+        throw new HttpError(400, "Некорректный хеш коммита");
+    const full = (await git(root, ["rev-parse", "--verify", "--quiet", `${rev}^{commit}`]).catch(() => "")).trim();
+    if (!full)
+        throw new HttpError(404, "Коммит не найден");
+    return full;
+}
+export function validateRelativePath(path) {
+    validatePath(path);
+    if (path.includes("\\"))
+        throw new HttpError(403, "Некорректный путь");
+}
+/**
+ * Directory of a committed tree. Git names entries relative to the project folder, so the same
+ * paging and exclusion contract as the working tree applies; only the source of the listing differs.
+ */
+export async function listProjectGitTree(root, rev, path = "", params = {}) {
+    const commit = await resolveRevision(root, rev);
+    validateRelativePath(path);
+    const args = ["ls-tree", "-z", commit];
+    // A trailing slash asks git for the contents of the directory, not the directory entry itself.
+    if (path)
+        args.push("--", `${path}/`);
+    const raw = await git(root, args);
+    const patterns = await excludePatterns();
+    const entries = [];
+    for (const row of raw.split("\0")) {
+        if (!row)
+            continue;
+        const tab = row.indexOf("\t");
+        if (tab < 0)
+            continue;
+        const [mode = "", type = ""] = row.slice(0, tab).split(" ");
+        const entryPath = row.slice(tab + 1);
+        if (!entryPath || isExcludedPath(entryPath, patterns))
+            continue;
+        const name = entryPath.split("/").at(-1);
+        if (!name)
+            continue;
+        entries.push({
+            name,
+            path: entryPath,
+            directory: type === "tree",
+            ...(mode === "100755" ? { executable: true } : {}),
+            ...(type === "commit" ? { disabled: true } : {}),
+        });
+    }
+    entries.sort((a, b) => Number(b.directory) - Number(a.directory) || a.name.localeCompare(b.name));
+    let page;
+    try {
+        page = treePageRange(entries, path, params);
+    }
+    catch (error) {
+        throw new HttpError(400, error instanceof Error ? error.message : "Неверная страница");
+    }
+    return {
+        entries: entries.slice(page.offset, page.end),
+        truncated: page.nextOffset !== null,
+        total: page.total,
+        nextOffset: page.nextOffset,
+    };
+}
+/** Text of a committed file; the answer is always read-only. */
+/** Raw image bytes of a committed file; raster images are shown by URL, SVG is read as text. */
+export async function readProjectGitImage(root, rev, path) {
+    validateRelativePath(path);
+    const type = imageType(path);
+    if (!type)
+        throw new HttpError(415, "Поддерживаются только изображения");
+    const commit = await resolveRevision(root, rev);
+    const prefix = (await git(root, ["rev-parse", "--show-prefix"])).trim();
+    const spec = `${commit}:${prefix}${path}`;
+    const kind = (await git(root, ["cat-file", "-t", spec]).catch(() => "")).trim();
+    if (kind !== "blob")
+        throw new HttpError(404, "Изображение не найдено в этом коммите");
+    const size = Number((await git(root, ["cat-file", "-s", spec])).trim());
+    const limit = 8 * MAX_BYTES;
+    if (!Number.isSafeInteger(size) || size < 0)
+        throw new HttpError(404, "Изображение не найдено в этом коммите");
+    if (size > limit)
+        throw new HttpError(413, "Изображение больше 8 МБ");
+    return { type, content: await gitBytes(root, ["show", spec], limit + 1) };
+}
+export async function readProjectGitFile(root, rev, path, options = {}) {
+    const commit = await resolveRevision(root, rev);
+    validateRelativePath(path);
+    if (!path)
+        throw new HttpError(400, "Выберите файл");
+    const prefix = (await git(root, ["rev-parse", "--show-prefix"])).trim();
+    const spec = `${commit}:${prefix}${path}`;
+    const type = (await git(root, ["cat-file", "-t", spec]).catch(() => "")).trim();
+    if (!type)
+        throw new HttpError(404, "Файл не найден в этом коммите");
+    if (type !== "blob")
+        throw new HttpError(400, "Выберите файл");
+    const size = Number((await git(root, ["cat-file", "-s", spec])).trim());
+    if (!Number.isSafeInteger(size) || size < 0)
+        throw new HttpError(404, "Файл не найден в этом коммите");
+    if (isRasterImage(path)) {
+        if (size > 8 * MAX_BYTES)
+            throw new HttpError(413, "Изображение больше 8 МБ");
+        return { path, content: "", image: true, readonly: true, size };
+    }
+    if (size > MAX_TEXT_BYTES)
+        throw new HttpError(413, `Файл больше ${MAX_TEXT_BYTES / 1024 / 1024} МБ: редактор не сможет его открыть`);
+    if (options.ask && size >= LARGE_FILE_BYTES)
+        return { path, content: "", large: size, readonly: true };
+    try {
+        return { path, content: await gitText(root, commit, path), readonly: true, size };
+    }
+    catch (error) {
+        if (error instanceof HttpError && error.status === 415)
+            return { path, content: "", binary: true, size, readonly: true };
+        if (error instanceof HttpError)
+            throw error;
+        throw new HttpError(404, "Файл не найден в этом коммите");
+    }
+}

package/packages/server/modules/workspace/git.js

@@ -0,0 +1,276 @@
+import { os } from "../../../core/modules/os/index.js";
+import { environmentForPath, runEnvironmentCommand } from "../environments/index.js";
+import { lstat, realpath } from "node:fs/promises";
+import { HttpError } from "../http/index.js";
+import { githubRepositoryFromRemote } from "../../../core/modules/github/index.js";
+import { GITLAB_DEFAULT_INSTANCE, gitlabRepositoryFromRemote, normalizeGitlabInstance, normalizeGitlabProjectPath, } from "../../../core/modules/gitlab/index.js";
+import { integrationConfig } from "../integration-store/index.js";
+import { gitlabBaseUrl } from "../gitlab/index.js";
+import { MAX_BYTES, decode, exec, location, pathExcluded, validatePath } from "./paths.js";
+import { isExcludedPath } from "../../../core/modules/workspace/index.js";
+import { excludePatterns } from "./files-exclude.js";
+import { mutateProjectEntry, mutationLocation, readProjectFile } from "./files.js";
+import { MAX_TEXT_BYTES } from "../../../core/modules/workspace/index.js";
+export async function git(root, args, options = {}) {
+    const settings = typeof options === "number" ? { maxBuffer: options } : options;
+    const maxBuffer = settings.maxBuffer ?? 4 * MAX_BYTES;
+    const timeout = settings.timeout ?? 10_000;
+    const project = await environmentForPath(root);
+    if (project)
+        return (await runEnvironmentCommand(project, [
+            "/usr/bin/git",
+            "--literal-pathspecs",
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-C",
+            "/workspace",
+            ...args,
+        ], timeout)).stdout;
+    return (await exec("git", ["--literal-pathspecs", "-C", root, ...args], {
+        windowsHide: true,
+        maxBuffer,
+        timeout,
+        env: {
+            ...process.env,
+            GIT_OPTIONAL_LOCKS: "0",
+            GIT_TERMINAL_PROMPT: "0",
+            ...settings.env,
+        },
+    })).stdout;
+}
+/** Binary output of a read-only Git command; text commands still use `git`. */
+export async function gitBytes(root, args, maxBuffer = 8 * MAX_BYTES) {
+    const project = await environmentForPath(root);
+    if (project)
+        throw new HttpError(501, "Изображения из контейнера пока недоступны");
+    return (await exec("git", ["--literal-pathspecs", "-C", root, ...args], {
+        windowsHide: true,
+        maxBuffer,
+        timeout: 10000,
+        encoding: "buffer",
+        env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+    })).stdout;
+}
+/** `owner/repository` when the project's `origin` points at GitHub, otherwise null. */
+export async function projectGithubRepository(root) {
+    const remote = await git(root, ["remote", "get-url", "origin"]).catch(() => "");
+    return githubRepositoryFromRemote(remote);
+}
+/**
+ * GitLab instance and project path when the project's `origin` points at GitLab, otherwise null.
+ * A self-hosted remote is accepted only for the configured instance; the install prefix of that
+ * instance is removed from the path, and credentials of the remote never leave this function.
+ */
+export async function projectGitlabRepository(root) {
+    const remote = await git(root, ["remote", "get-url", "origin"]).catch(() => "");
+    const repository = gitlabRepositoryFromRemote(remote);
+    if (!repository)
+        return null;
+    let configured = GITLAB_DEFAULT_INSTANCE;
+    let configuredHost = GITLAB_DEFAULT_INSTANCE;
+    let prefix = "";
+    try {
+        const base = new URL(gitlabBaseUrl((await integrationConfig("gitlab")).settings.url));
+        configured = normalizeGitlabInstance(base.origin);
+        // SSH and scp remotes carry no web port, so the host alone identifies the same instance.
+        configuredHost = normalizeGitlabInstance(base.hostname);
+        prefix = base.pathname.replace(/^\/+|\/+$/g, "");
+    }
+    catch {
+        // An unusable setting must not break local projects: only gitlab.com stays reachable.
+    }
+    if (repository.instance !== configured &&
+        repository.instance !== configuredHost &&
+        repository.instance !== GITLAB_DEFAULT_INSTANCE)
+        return null;
+    // SSH remotes name the host without the web port; canonical links use the configured instance.
+    const instance = repository.instance === configuredHost ? configured : repository.instance;
+    let path = repository.path;
+    if (prefix &&
+        (repository.instance === configured || repository.instance === configuredHost) &&
+        path.startsWith(`${prefix}/`))
+        path = path.slice(prefix.length + 1);
+    try {
+        return { instance, path: normalizeGitlabProjectPath(path) };
+    }
+    catch {
+        return null;
+    }
+}
+export async function projectGit(root) {
+    try {
+        await git(root, ["rev-parse", "--show-toplevel"]);
+    }
+    catch {
+        return { available: false, branch: "", changes: [] };
+    }
+    const prefix = (await git(root, ["rev-parse", "--show-prefix"])).trim();
+    const branch = (await git(root, ["symbolic-ref", "--short", "HEAD"]).catch(() => git(root, ["rev-parse", "--short", "HEAD"]))).trim();
+    const rows = (await git(root, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", "."])).split("\0");
+    const changes = [];
+    for (let i = 0; i < rows.length; i++) {
+        const row = rows[i];
+        if (!row)
+            continue;
+        const path = row.slice(3);
+        const rename = /[RC]/.test(row.slice(0, 2));
+        const original = rename ? rows[++i] : undefined;
+        if (!path.startsWith(prefix))
+            continue;
+        if (path.slice(prefix.length).split("/").includes(".projector-trash"))
+            continue;
+        changes.push({
+            path: path.slice(prefix.length),
+            originalPath: original?.startsWith(prefix) ? original.slice(prefix.length) : undefined,
+            index: row[0],
+            worktree: row[1],
+        });
+    }
+    await Promise.all(changes.map(async (change) => {
+        change.executable = await location(root, change.path)
+            .then((full) => lstat(full).then((info) => info.isFile() && os.tools.isExecutableFile(change.path, info.mode)))
+            .catch(() => false);
+    }));
+    return { available: true, branch, changes };
+}
+// Serialize index writes even when multiple SDK clients act at once.
+const pendingGitWrites = new Map();
+/** Runs a write after the pending ones of the same repository finished. */
+export async function serializeGitWrite(root, write) {
+    const repository = (await git(root, ["rev-parse", "--absolute-git-dir"])).trim();
+    const previous = pendingGitWrites.get(repository);
+    const operation = (async () => {
+        await previous?.catch(() => { });
+        return write();
+    })();
+    pendingGitWrites.set(repository, operation);
+    try {
+        return await operation;
+    }
+    finally {
+        if (pendingGitWrites.get(repository) === operation)
+            pendingGitWrites.delete(repository);
+    }
+}
+export async function mutateProjectGit(root, action, selection) {
+    if (!["stage", "unstage", "discard"].includes(action))
+        throw new HttpError(400, "Неизвестное действие Git");
+    const paths = [...new Set(Array.isArray(selection) ? selection : [selection])];
+    if (!paths.length || paths.length > 10000)
+        throw new HttpError(400, "Укажите файлы Git");
+    for (const path of paths) {
+        validatePath(path);
+        if (!path || path.includes("\\") || (await pathExcluded(path)))
+            throw new HttpError(403, "Выберите файл проекта");
+    }
+    const base = await realpath(root);
+    return serializeGitWrite(base, async () => {
+        const overview = await projectGit(base);
+        const selected = paths.map((path) => {
+            const change = overview.changes.find((entry) => entry.path === path);
+            if (!change)
+                throw new HttpError(404, "Изменение больше не найдено. Обновите Git.");
+            return change;
+        });
+        const indexPaths = new Set(paths);
+        const patterns = await excludePatterns();
+        // Validate the entire selection before changing the shared index.
+        for (const change of selected) {
+            let ancestor = change.path;
+            while (ancestor) {
+                try {
+                    await mutationLocation(base, ancestor);
+                    break;
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                    ancestor = ancestor.split("/").slice(0, -1).join("/");
+                }
+            }
+            const conflict = change.index === "U" ||
+                change.worktree === "U" ||
+                ["AA", "DD"].includes(change.index + change.worktree);
+            if (action !== "stage" && conflict)
+                throw new HttpError(409, "Сначала разрешите конфликт слияния");
+            if (action === "unstage") {
+                if ([" ", "?"].includes(change.index))
+                    throw new HttpError(409, "Нет изменений Staged");
+                if (change.index === "R") {
+                    if (!change.originalPath)
+                        throw new HttpError(409, "Переименование пересекает границу проекта. Откройте корень репозитория.");
+                    validatePath(change.originalPath);
+                    if (isExcludedPath(change.originalPath, patterns))
+                        throw new HttpError(403, "Недоступный путь Git");
+                    indexPaths.add(change.originalPath);
+                }
+            }
+            else if (change.worktree === " ")
+                throw new HttpError(409, "Нет рабочих изменений");
+        }
+        if (action === "stage")
+            await git(base, ["add", "--", ...paths]);
+        else if (action === "unstage") {
+            const hasHead = await git(base, ["rev-parse", "--verify", "HEAD"]).then(() => true, () => false);
+            await git(base, hasHead
+                ? ["restore", "--staged", "--", ...indexPaths]
+                : ["rm", "--cached", "-f", "--", ...indexPaths]);
+        }
+        else {
+            const tracked = selected
+                .filter((change) => change.index !== "?")
+                .map((change) => change.path);
+            if (tracked.length)
+                await git(base, ["restore", "--worktree", "--", ...tracked]);
+            for (const change of selected)
+                if (change.index === "?")
+                    await mutateProjectEntry(base, "delete", change.path);
+        }
+        return projectGit(base);
+    });
+}
+export async function gitText(root, ref, path) {
+    validatePath(path);
+    const prefix = (await git(root, ["rev-parse", "--show-prefix"])).trim();
+    const value = await git(root, ["show", `${ref}:${prefix}${path}`], MAX_TEXT_BYTES);
+    return decode(Buffer.from(value));
+}
+export async function projectComparison(root, path, staged) {
+    validatePath(path);
+    const overview = await projectGit(root);
+    const change = overview.changes.find((item) => item.path === path);
+    if (!change)
+        throw new HttpError(404, "Изменение больше не найдено. Обновите Git.");
+    if (change.index === "U" ||
+        change.worktree === "U" ||
+        ["AA", "DD"].includes(change.index + change.worktree))
+        throw new HttpError(409, "Конфликт слияния. Откройте файл в дереве, чтобы просмотреть маркеры конфликта.");
+    const status = staged ? change.index : change.worktree;
+    if (status === " ")
+        throw new HttpError(404, "Изменение больше не найдено");
+    const untracked = change.index === "?";
+    const originalPath = staged ? (change.originalPath ?? path) : path;
+    const original = untracked || status === "A" ? "" : await gitText(root, staged ? "HEAD" : "", originalPath);
+    const modified = status === "D"
+        ? ""
+        : staged
+            ? await gitText(root, "", path)
+            : (await readProjectFile(root, path)).content;
+    return { path, original, modified, staged };
+}
+/**
+ * Index version of a tracked file for editor gutter decorations. Like VS Code,
+ * staged changes are not marked and untracked files have no gutter.
+ */
+export async function projectGutter(root, path) {
+    validatePath(path);
+    const unavailable = { available: false, original: "" };
+    try {
+        await git(root, ["rev-parse", "--show-toplevel"]);
+        await git(root, ["ls-files", "--error-unmatch", "--", path]);
+        return { available: true, original: await git(root, ["show", `:./${path}`]) };
+    }
+    catch {
+        return unavailable;
+    }
+}

package/packages/server/modules/workspace/ignored.js

@@ -0,0 +1,23 @@
+import { spawn } from "node:child_process";
+// Paths (relative to `dir`) that git ignores; empty when git or the repository is missing.
+export function ignoredPaths(dir, names) {
+    if (!names.length)
+        return Promise.resolve(new Set());
+    return new Promise((done) => {
+        const child = spawn("git", ["-C", dir, "check-ignore", "-z", "--stdin"], {
+            windowsHide: true,
+            stdio: ["pipe", "pipe", "ignore"],
+            env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+        });
+        let out = "";
+        const timer = setTimeout(() => child.kill(), 5000);
+        child.stdout.on("data", (chunk) => (out += chunk));
+        child.on("error", () => done(new Set()));
+        child.on("close", () => {
+            clearTimeout(timer);
+            done(new Set(out.split("\0").filter(Boolean)));
+        });
+        child.stdin.on("error", () => { });
+        child.stdin.end(names.join("\0") + "\0");
+    });
+}