@youtyan/code-viewer 0.1.25 → 0.1.27

package/dist/code-viewer.js

@@ -6,16 +6,36 @@ import {
   constants,
   existsSync as existsSync3,
   lstatSync as lstatSync3,
+  mkdirSync,
   openSync,
   readFileSync as readFileSync2,
   realpathSync,
+  renameSync,
   statSync,
   unlinkSync,
   watch,
   writeFileSync
 } from "node:fs";
+import { homedir } from "node:os";
 import { basename as basename2, dirname as dirname2, extname, join as join4, relative } from "node:path";
 
+// web-src/directory-name.ts
+function normalizeNewDirectoryName(name) {
+  if (typeof name !== "string")
+    return null;
+  const trimmed = name.trim();
+  if (!trimmed || trimmed.length > 180)
+    return null;
+  if (trimmed.includes("/") || trimmed.includes("\\") || trimmed.includes("\x00") || Array.from(trimmed).some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 32 || code === 127;
+  }))
+    return null;
+  if (trimmed === "." || trimmed === ".." || trimmed.toLowerCase() === ".git")
+    return null;
+  return trimmed;
+}
+
 // web-src/routes.ts
 var SPA_PATHS = ["/todif", "/todiff", "/file", "/help"];
 var APP_ENTRY_PATHS = ["/", "/index.html"];
@@ -568,7 +588,13 @@ function omittedWorktreeDirectoryReason(name, omitDirNames) {
     return "internal";
   return omitDirNames.has(name) ? "heavy" : undefined;
 }
-function worktreeEntryFromDirent(base, dir, name, isDirectory, omitDirNames) {
+function worktreeEntryFromDirent(base, dir, name, isDirectory, omitDirNames, excludeNames) {
+  if (excludeNames.has(name.toLowerCase()))
+    return {
+      name,
+      path: "",
+      type: isDirectory ? "tree" : "blob"
+    };
   const entryPath = base ? `${base}/${name}` : name;
   const type = isDirectory ? hasDotGitEntry(join2(dir, name)) ? "commit" : "tree" : "blob";
   const omittedReason = type === "tree" ? omittedWorktreeDirectoryReason(name, omitDirNames) : undefined;
@@ -580,14 +606,15 @@ function worktreeEntryFromDirent(base, dir, name, isDirectory, omitDirNames) {
     children_omitted_reason: omittedReason
   } : { name, path: entryPath, type };
 }
-function worktreeFilesystemEntries(cwd, path, recursive, omitDirNames = DEFAULT_WORKTREE_OMIT_DIR_NAMES) {
+function worktreeFilesystemEntries(cwd, path, recursive, omitDirNames = DEFAULT_WORKTREE_OMIT_DIR_NAMES, excludeNames = []) {
   const base = normalizeTreePath(path);
   const root = join2(cwd, base);
   const omitDirNameSet = new Set(omitDirNames);
+  const excludeNameSet = new Set(excludeNames.map((name) => name.toLowerCase()));
   let directEntries;
   try {
     const dirents = readdirSync(root, { withFileTypes: true });
-    directEntries = sortTreeEntries(dirents.map((entry) => worktreeEntryFromDirent(base, root, entry.name, entry.isDirectory(), omitDirNameSet)));
+    directEntries = sortTreeEntries(dirents.map((entry) => worktreeEntryFromDirent(base, root, entry.name, entry.isDirectory(), omitDirNameSet, excludeNameSet)).filter((entry) => entry.path));
   } catch {
     return [];
   }
@@ -624,6 +651,8 @@ function worktreeFilesystemEntries(cwd, path, recursive, omitDirNames = DEFAULT_
       return;
     }
     for (const entry of entries) {
+      if (excludeNameSet.has(entry.name.toLowerCase()))
+        continue;
       const entryPath = prefix ? `${prefix}/${entry.name}` : entry.name;
       const full = join2(dir, entry.name);
       if (entry.isDirectory()) {
@@ -699,15 +728,12 @@ function combineDirectAndRecursiveFiles(directEntries, fileEntries) {
     ...fileEntries.filter((entry) => !seen.has(entry.path))
   ];
 }
-function worktreeFiles(cwd) {
-  return listTree("worktree", "", cwd, { recursive: true }).entries;
-}
 function listTree(ref, path, cwd, options = {}) {
   const base = normalizeTreePath(path);
   if (ref === "worktree") {
     return {
       code: 0,
-      entries: worktreeFilesystemEntries(cwd, base, !!options.recursive, options.omitDirNames),
+      entries: worktreeFilesystemEntries(cwd, base, !!options.recursive, options.omitDirNames, options.excludeNames),
       stderr: ""
     };
   }
@@ -1099,17 +1125,19 @@ var GREP_DEFAULT_MAX = 200;
 var GREP_ABSOLUTE_MAX = 500;
 var GREP_MAX_FILE_BYTES = 2 * 1024 * 1024;
 var FILE_SEARCH_ABSOLUTE_MAX = 50000;
+var DEFAULT_EXCLUDE_NAMES = [".DS_Store"];
 function normalizeGrepMax(value) {
   const parsed = Number(value || "");
   if (!Number.isInteger(parsed) || parsed <= 0)
     return GREP_DEFAULT_MAX;
   return Math.min(parsed, GREP_ABSOLUTE_MAX);
 }
-function isSkippableSearchPath(path, omitDirNames = []) {
+function isSkippableSearchPath(path, omitDirNames = [], excludeNames = []) {
   const omitDirs = new Set(omitDirNames.map((name) => name.toLowerCase()));
+  const excluded = new Set(excludeNames.map((name) => name.toLowerCase()));
   return path.split(/[\\/]+/).some((part) => {
     const lower = part.toLowerCase();
-    return lower === ".git" || omitDirs.has(lower);
+    return lower === ".git" || omitDirs.has(lower) || excluded.has(lower);
   });
 }
 function fixedStringLineMatches(path, text, query, max) {
@@ -1142,7 +1170,7 @@ function buildFileSearchList(ref, generation, entries) {
     truncated: entries.length > FILE_SEARCH_ABSOLUTE_MAX
   };
 }
-function buildRgArgs(query, max, paths, regex = false, omitDirNames = []) {
+function buildRgArgs(query, max, paths, regex = false, omitDirNames = [], excludeNames = []) {
   const safePaths = paths.length ? paths : ["."];
   const omitGlobs = omitDirNames.flatMap((name) => [
     "--glob",
@@ -1150,6 +1178,12 @@ function buildRgArgs(query, max, paths, regex = false, omitDirNames = []) {
     "--glob",
     `!**/${name}/**`
   ]);
+  const excludeGlobs = excludeNames.flatMap((name) => [
+    "--glob",
+    `!${name}`,
+    "--glob",
+    `!**/${name}`
+  ]);
   const args = [
     "rg",
     "--no-config",
@@ -1164,6 +1198,7 @@ function buildRgArgs(query, max, paths, regex = false, omitDirNames = []) {
     "--max-filesize",
     "2M",
     ...omitGlobs,
+    ...excludeGlobs,
     "-e",
     query,
     "--",
@@ -1173,7 +1208,7 @@ function buildRgArgs(query, max, paths, regex = false, omitDirNames = []) {
     args.splice(8, 0, "--fixed-strings");
   return args;
 }
-function parseRgOutput(stdout, max, omitDirNames = []) {
+function parseRgOutput(stdout, max, omitDirNames = [], excludeNames = []) {
   const matches = [];
   for (const line of stdout.split(`
 `)) {
@@ -1186,7 +1221,7 @@ function parseRgOutput(stdout, max, omitDirNames = []) {
     const lineNo = Number(parsed[2]);
     const column = Number(parsed[3]);
     const preview = parsed[4];
-    if (!path || !lineNo || !column || isSkippableSearchPath(path, omitDirNames))
+    if (!path || !lineNo || !column || isSkippableSearchPath(path, omitDirNames, excludeNames))
       continue;
     matches.push({
       path,
@@ -1197,12 +1232,12 @@ function parseRgOutput(stdout, max, omitDirNames = []) {
   }
   return matches;
 }
-function parseGitGrepOutput(stdout, ref, max, omitDirNames = []) {
+function parseGitGrepOutput(stdout, ref, max, omitDirNames = [], excludeNames = []) {
   const prefix = `${ref}:`;
   const normalized = stdout.split(`
 `).map((line) => line.startsWith(prefix) ? line.slice(prefix.length) : line).join(`
 `);
-  return parseRgOutput(normalized, max, omitDirNames);
+  return parseRgOutput(normalized, max, omitDirNames, excludeNames);
 }
 
 // web-src/server/preview.ts
@@ -1218,8 +1253,8 @@ var SIZE_LARGE = 20000;
 var LINE_INDEX_MIN_START = 1e4;
 var LINE_INDEX_MAX_FILE_BYTES = 256 * 1024 * 1024;
 var BLOB_LINE_CACHE_MAX_BYTES = 128 * 1024 * 1024;
-var MAX_UPLOAD_FILE_BYTES = 10 * 1024 * 1024;
-var MAX_UPLOAD_TOTAL_BYTES = 50 * 1024 * 1024;
+var MAX_UPLOAD_FILE_BYTES = 512 * 1024 * 1024;
+var MAX_UPLOAD_TOTAL_BYTES = 1024 * 1024 * 1024;
 var MAX_UPLOAD_BODY_BYTES = MAX_UPLOAD_TOTAL_BYTES + 1024 * 1024;
 var MAX_UPLOAD_FILES = 50;
 var SAFE_UPLOAD_EXTENSIONS = new Set([
@@ -1237,7 +1272,19 @@ var SAFE_UPLOAD_EXTENSIONS = new Set([
   ".jpeg",
   ".gif",
   ".webp",
+  ".svg",
   ".pdf",
+  ".mp4",
+  ".mov",
+  ".m4v",
+  ".webm",
+  ".mp3",
+  ".wav",
+  ".m4a",
+  ".aac",
+  ".flac",
+  ".ogg",
+  ".zip",
   ".ts",
   ".tsx",
   ".js",
@@ -1250,11 +1297,11 @@ var generation = 1;
 var cwd = repoRoot(process.cwd()) || process.cwd();
 var cliArgs = DEFAULT_ARGS;
 var listenPort = 0;
-var allowUpload = false;
-var uploadAllowedByCli = false;
 var openAfterStart = false;
 var scopeOmitDirNames = DEFAULT_WORKTREE_OMIT_DIR_NAMES;
 var scopeOmitDirCliOverride = null;
+var scopeExcludeNames = DEFAULT_EXCLUDE_NAMES;
+var uploadDisabledByConfig = false;
 var rgAvailableCache = null;
 var enc = new TextEncoder;
 var sseClients = new Set;
@@ -1307,10 +1354,7 @@ Examples:
       listenPort = parsed;
     } else if (arg === "--open") {
       openAfterStart = true;
-    } else if (arg === "--allow-upload") {
-      allowUpload = true;
-      uploadAllowedByCli = true;
-    } else if (arg === "--scope-omit-dir") {
+    } else if (arg === "--allow-upload") {} else if (arg === "--scope-omit-dir") {
       const next = process.argv[++i];
       if (!next) {
         console.error("--scope-omit-dir requires a directory name");
@@ -1326,14 +1370,16 @@ Examples:
   }
   if (rest.length)
     cliArgs = rest;
-  if (!uploadAllowedByCli)
-    allowUpload = loadProjectConfigUploadEnabled();
   const configScopeOmitDirs = loadProjectConfigScopeOmitDirs();
+  const configScopeExcludeNames = loadProjectConfigScopeExcludeNames();
+  uploadDisabledByConfig = loadProjectConfigUploadDisabled();
   if (scopeOmitDirCliOverride) {
     scopeOmitDirNames = scopeOmitDirCliOverride;
   } else if (configScopeOmitDirs) {
     scopeOmitDirNames = configScopeOmitDirs;
   }
+  if (configScopeExcludeNames)
+    scopeExcludeNames = configScopeExcludeNames;
 }
 function json(data, init = {}) {
   return new Response(JSON.stringify(data), {
@@ -1606,6 +1652,13 @@ function normalizeScopeOmitDirNames(names) {
     ...new Set(names.filter((name) => typeof name === "string").map((name) => name.trim()).filter((name) => name && name.length <= 64 && !name.includes("/") && !name.includes("\\") && !name.includes("\x00") && name !== "." && name !== ".." && name !== ".git"))
   ].sort((a, b) => a.localeCompare(b));
 }
+function normalizeScopeExcludeNames(names) {
+  if (!Array.isArray(names))
+    return [];
+  return [
+    ...new Set(names.filter((name) => typeof name === "string").map((name) => name.trim()).filter((name) => name && name.length <= 128 && !name.includes("/") && !name.includes("\\") && !name.includes("\x00") && name !== "." && name !== ".." && name !== ".git"))
+  ].sort((a, b) => a.localeCompare(b));
+}
 function parseScopeOmitDirNamesQuery(value) {
   const names = value ? value.split(",") : [];
   if (names.length > 100)
@@ -1617,6 +1670,17 @@ function parseScopeOmitDirNamesQuery(value) {
   }
   return normalizeScopeOmitDirNames(names);
 }
+function parseScopeExcludeNamesQuery(value) {
+  const names = value ? value.split(",") : [];
+  if (names.length > 200)
+    return null;
+  for (const raw of names) {
+    const name = raw.trim();
+    if (!name || name.length > 128 || name.includes("/") || name.includes("\\") || name.includes("\x00") || name === "." || name === ".." || name === ".git")
+      return null;
+  }
+  return normalizeScopeExcludeNames(names);
+}
 function loadProjectConfig() {
   const full = join4(cwd, ".code-viewer.json");
   if (!existsSync3(full))
@@ -1640,9 +1704,9 @@ function loadProjectConfig() {
     return null;
   }
 }
-function loadProjectConfigUploadEnabled() {
+function loadProjectConfigUploadDisabled() {
   const config = loadProjectConfig();
-  return config?.upload?.enabled === true;
+  return config?.upload?.enabled === false;
 }
 function loadProjectConfigScopeOmitDirs() {
   const config = loadProjectConfig();
@@ -1650,14 +1714,31 @@ function loadProjectConfigScopeOmitDirs() {
     return null;
   return normalizeScopeOmitDirNames(config.scope.omitDirs);
 }
+function loadProjectConfigScopeExcludeNames() {
+  const config = loadProjectConfig();
+  if (!config?.scope || !Array.isArray(config.scope.excludeNames))
+    return null;
+  return normalizeScopeExcludeNames(config.scope.excludeNames);
+}
 function scopeOmitDirNamesFromQuery(url) {
   if (!url.searchParams.has("omit_dirs"))
     return scopeOmitDirNames;
   return parseScopeOmitDirNamesQuery(url.searchParams.get("omit_dirs") || "") || scopeOmitDirNames;
 }
+function scopeExcludeNamesFromQuery(url) {
+  if (!url.searchParams.has("exclude_names"))
+    return scopeExcludeNames;
+  return parseScopeExcludeNamesQuery(url.searchParams.get("exclude_names") || "") || scopeExcludeNames;
+}
 function invalidScopeOmitDirNamesQuery(url) {
   return url.searchParams.has("omit_dirs") && !parseScopeOmitDirNamesQuery(url.searchParams.get("omit_dirs") || "");
 }
+function invalidScopeExcludeNamesQuery(url) {
+  return url.searchParams.has("exclude_names") && !parseScopeExcludeNamesQuery(url.searchParams.get("exclude_names") || "");
+}
+function isExcludedScopePath(path, excludeNames) {
+  return path.split(/[\\/]+/).some((part) => excludeNames.some((name) => part.toLowerCase() === name.toLowerCase()));
+}
 function isGitInternalPath(path) {
   return path.split(/[\\/]+/).some((part) => part.toLowerCase() === ".git");
 }
@@ -1684,6 +1765,9 @@ function safeWorktreePath(path) {
     return null;
   return realFull;
 }
+function worktreePath(path) {
+  return join4(cwd, path);
+}
 function safeOpenWorktreePath(path) {
   if (path === "") {
     try {
@@ -1798,10 +1882,14 @@ function handleTree(url) {
   const recursive = url.searchParams.get("recursive") === "1";
   if (invalidScopeOmitDirNamesQuery(url))
     return text("invalid omit dirs", 400);
+  if (invalidScopeExcludeNamesQuery(url))
+    return text("invalid exclude names", 400);
+  const excludeNames = scopeExcludeNamesFromQuery(url);
   const entries = listTree(target, path, cwd, {
     recursive,
-    omitDirNames: scopeOmitDirNamesFromQuery(url)
-  }).entries;
+    omitDirNames: scopeOmitDirNamesFromQuery(url),
+    excludeNames
+  }).entries.filter((entry) => !isExcludedScopePath(entry.path, excludeNames));
   return json({
     ref: target,
     path,
@@ -1809,7 +1897,7 @@ function handleTree(url) {
     branch: currentBranch(cwd) || undefined,
     entries: recursive ? entries : entries.map((entry) => attachTreeEntryMetadata(target, entry)),
     readme: readReadme(target, path),
-    upload_enabled: allowUpload && (target === "worktree" || target === "")
+    upload_enabled: !uploadDisabledByConfig && (target === "worktree" || target === "")
   });
 }
 function handleSettings() {
@@ -1818,6 +1906,8 @@ function handleSettings() {
     scope: {
       omit_dirs_effective: scopeOmitDirNames,
       omit_dirs_built_in: DEFAULT_WORKTREE_OMIT_DIR_NAMES,
+      exclude_names_effective: scopeExcludeNames,
+      exclude_names_built_in: DEFAULT_EXCLUDE_NAMES,
       max_entries: WORKTREE_RECURSIVE_ENTRY_LIMIT
     }
   });
@@ -1828,22 +1918,26 @@ function handleFiles(url) {
     return text("invalid target", 400);
   if (invalidScopeOmitDirNamesQuery(url))
     return text("invalid omit dirs", 400);
+  if (invalidScopeExcludeNamesQuery(url))
+    return text("invalid exclude names", 400);
   const omitDirNames = scopeOmitDirNamesFromQuery(url);
-  const key = `${target || "worktree"}\x00${omitDirNames.join("\x00")}`;
+  const excludeNames = scopeExcludeNamesFromQuery(url);
+  const key = `${target || "worktree"}\x00${omitDirNames.join("\x00")}\x00${excludeNames.join("\x00")}`;
   const cached = fileListCache.get(key);
   if (cached && cached.generation === generation)
     return json(cached.body);
   const ref = target || "worktree";
   const entries = listTree(ref, "", cwd, {
     recursive: true,
-    omitDirNames
-  }).entries;
+    omitDirNames,
+    excludeNames
+  }).entries.filter((entry) => !isExcludedScopePath(entry.path, excludeNames));
   const body = buildFileSearchList(ref, generation, entries);
   fileListCache.set(key, { generation, body });
   return json(body);
 }
-function parseGrepPaths(url, omitDirNames) {
-  return url.searchParams.getAll("path").filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames));
+function parseGrepPaths(url, omitDirNames, excludeNames) {
+  return url.searchParams.getAll("path").filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames, excludeNames));
 }
 function rgAvailable() {
   if (rgAvailableCache !== null)
@@ -1852,13 +1946,17 @@ function rgAvailable() {
   rgAvailableCache = proc.code === 0;
   return rgAvailableCache;
 }
-function grepWorktreeFallback(query, max, paths, omitDirNames) {
-  const candidates = paths.length ? paths : worktreeFiles(cwd).map((entry) => entry.path);
+function grepWorktreeFallback(query, max, paths, omitDirNames, excludeNames) {
+  const candidates = paths.length ? paths : listTree("worktree", "", cwd, {
+    recursive: true,
+    omitDirNames,
+    excludeNames
+  }).entries.map((entry) => entry.path);
   const matches = [];
   for (const path of candidates) {
     if (matches.length >= max)
       break;
-    if (!safePath(path) || isGitInternalPath(path) || isSkippableSearchPath(path, omitDirNames))
+    if (!safePath(path) || isGitInternalPath(path) || isSkippableSearchPath(path, omitDirNames, excludeNames))
       continue;
     const full = safeWorktreePath(path);
     if (!full)
@@ -1883,13 +1981,13 @@ function grepWorktreeFallback(query, max, paths, omitDirNames) {
   }
   return matches;
 }
-function grepWorktree(query, max, paths, regex, omitDirNames) {
+function grepWorktree(query, max, paths, regex, omitDirNames, excludeNames) {
   if (rgAvailable()) {
-    const safePaths = paths.filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames) && safeWorktreePath(path));
-    const args = buildRgArgs(query, max, safePaths, regex, omitDirNames);
+    const safePaths = paths.filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames, excludeNames) && safeWorktreePath(path));
+    const args = buildRgArgs(query, max, safePaths, regex, omitDirNames, excludeNames);
     const proc = runSync(args, cwd, { timeout: 5000 });
     const stdout = proc.stdout;
-    const matches2 = parseRgOutput(stdout, max, omitDirNames).filter((match) => safePath(match.path) && !isGitInternalPath(match.path) && !isSkippableSearchPath(match.path, omitDirNames) && !!safeWorktreePath(match.path));
+    const matches2 = parseRgOutput(stdout, max, omitDirNames, excludeNames).filter((match) => safePath(match.path) && !isGitInternalPath(match.path) && !isSkippableSearchPath(match.path, omitDirNames, excludeNames) && !!safeWorktreePath(match.path));
     return {
       ref: "worktree",
       engine: "rg",
@@ -1904,7 +2002,7 @@ function grepWorktree(query, max, paths, regex, omitDirNames) {
       truncated: false,
       matches: []
     };
-  const matches = grepWorktreeFallback(query, max, paths, omitDirNames);
+  const matches = grepWorktreeFallback(query, max, paths, omitDirNames, excludeNames);
   return {
     ref: "worktree",
     engine: "fallback",
@@ -1912,8 +2010,8 @@ function grepWorktree(query, max, paths, regex, omitDirNames) {
     matches
   };
 }
-function grepTreeRef(ref, query, max, paths, regex, omitDirNames) {
-  const safePaths = paths.filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames));
+function grepTreeRef(ref, query, max, paths, regex, omitDirNames, excludeNames) {
+  const safePaths = paths.filter((path) => safePath(path) && !isGitInternalPath(path) && !isSkippableSearchPath(path, omitDirNames, excludeNames));
   const args = [
     "git",
     "-c",
@@ -1932,7 +2030,7 @@ function grepTreeRef(ref, query, max, paths, regex, omitDirNames) {
   ];
   const proc = runSync(args, cwd, { timeout: 5000 });
   const stdout = proc.stdout;
-  const matches = parseGitGrepOutput(stdout, ref, max, omitDirNames).slice(0, max);
+  const matches = parseGitGrepOutput(stdout, ref, max, omitDirNames, excludeNames).slice(0, max);
   return { ref, engine: "git", truncated: matches.length >= max, matches };
 }
 function handleGrep(url) {
@@ -1941,8 +2039,11 @@ function handleGrep(url) {
   const max = normalizeGrepMax(url.searchParams.get("max"));
   if (invalidScopeOmitDirNamesQuery(url))
     return text("invalid omit dirs", 400);
+  if (invalidScopeExcludeNamesQuery(url))
+    return text("invalid exclude names", 400);
   const omitDirNames = scopeOmitDirNamesFromQuery(url);
-  const paths = parseGrepPaths(url, omitDirNames);
+  const excludeNames = scopeExcludeNamesFromQuery(url);
+  const paths = parseGrepPaths(url, omitDirNames, excludeNames);
   const regex = url.searchParams.get("regex") === "1";
   if (!query.trim())
     return json({
@@ -1952,10 +2053,10 @@ function handleGrep(url) {
       matches: []
     });
   if (ref === "worktree" || ref === "")
-    return json(grepWorktree(query, max, paths, regex, omitDirNames));
+    return json(grepWorktree(query, max, paths, regex, omitDirNames, excludeNames));
   if (!verifyTreeRef(ref, cwd))
     return text("invalid target", 400);
-  return json(grepTreeRef(ref, query, max, paths, regex, omitDirNames));
+  return json(grepTreeRef(ref, query, max, paths, regex, omitDirNames, excludeNames));
 }
 function handleRefCommits(url) {
   const query = url.searchParams.get("q") || "";
@@ -2353,24 +2454,26 @@ function isForbiddenUploadName(name) {
   return lower.startsWith(".") || lower === "package.json" || lower === "package-lock.json" || lower === "bun.lock" || lower === "bun.lockb" || lower === "yarn.lock" || lower === "pnpm-lock.yaml" || lower === "makefile" || lower === "dockerfile" || lower.endsWith(".dockerfile") || /^(tsconfig|jsconfig|bunfig|vercel|netlify|wrangler|next|vite|webpack|rollup|esbuild|astro|svelte|tailwind|postcss|babel|prettier|eslint)\./.test(lower) || lower.endsWith(".config.js") || lower.endsWith(".config.jsx") || lower.endsWith(".config.ts") || lower.endsWith(".config.tsx") || lower.endsWith(".config.mjs") || lower.endsWith(".config.cjs") || lower.includes("credential") || lower.includes("secret") || lower.endsWith(".exe") || lower.endsWith(".dll") || lower.endsWith(".dylib") || lower.endsWith(".so") || lower.endsWith(".sh") || lower.endsWith(".bash") || lower.endsWith(".zsh") || lower.endsWith(".fish") || lower.endsWith(".ps1") || lower.endsWith(".bat") || lower.endsWith(".cmd");
 }
 function safeUploadFileName(name) {
-  if (!name || name.includes("\x00") || name.includes("/") || name.includes("\\"))
-    return null;
-  if (name === "." || name === "..")
+  const trimmed = name.trim();
+  if (!trimmed || trimmed.length > 180 || trimmed.includes("\x00") || trimmed.includes("/") || trimmed.includes("\\") || Array.from(trimmed).some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 32 || code === 127;
+  }))
     return null;
-  if (!/^[A-Za-z0-9][A-Za-z0-9._ -]{0,180}$/.test(name))
+  if (trimmed === "." || trimmed === "..")
     return null;
-  if (isGitInternalPath(name) || isForbiddenUploadName(name))
+  if (isGitInternalPath(trimmed) || isForbiddenUploadName(trimmed))
     return null;
-  if (!SAFE_UPLOAD_EXTENSIONS.has(extname(name).toLowerCase()))
+  if (!SAFE_UPLOAD_EXTENSIONS.has(extname(trimmed).toLowerCase()))
     return null;
-  return name;
+  return trimmed;
 }
 function uploadOpenFlags() {
   return constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0);
 }
 async function handleUploadFiles(req) {
-  if (!allowUpload)
-    return text("upload disabled", 403);
+  if (uploadDisabledByConfig)
+    return text("upload disabled by project config", 403);
   if (req.method !== "POST")
     return text("method not allowed", 405);
   if (!sideEffectRequestAllowed(req))
@@ -2468,6 +2571,152 @@ function openOsPath(path) {
   const cmd = process.platform === "darwin" ? ["open", "--", path] : process.platform === "win32" ? ["explorer.exe", path] : ["xdg-open", path];
   spawnDetached(cmd);
 }
+function windowsTrashScript(path) {
+  const quotedPath = path.replace(/'/g, "''");
+  return [
+    "$ErrorActionPreference = 'Stop';",
+    `$path = '${quotedPath}';`,
+    "Add-Type -TypeDefinition @'",
+    "using System;",
+    "using System.Runtime.InteropServices;",
+    "public static class CodeViewerRecycleBin {",
+    "  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]",
+    "  public struct SHFILEOPSTRUCT {",
+    "    public IntPtr hwnd;",
+    "    public uint wFunc;",
+    "    public string pFrom;",
+    "    public string pTo;",
+    "    public ushort fFlags;",
+    "    [MarshalAs(UnmanagedType.Bool)] public bool fAnyOperationsAborted;",
+    "    public IntPtr hNameMappings;",
+    "    public string lpszProgressTitle;",
+    "  }",
+    '  [DllImport("shell32.dll", CharSet = CharSet.Unicode)]',
+    "  private static extern int SHFileOperationW(ref SHFILEOPSTRUCT lpFileOp);",
+    "  public static void MoveToRecycleBin(string path) {",
+    "    const uint FO_DELETE = 0x0003;",
+    "    const ushort FOF_SILENT = 0x0004;",
+    "    const ushort FOF_NOCONFIRMATION = 0x0010;",
+    "    const ushort FOF_ALLOWUNDO = 0x0040;",
+    "    const ushort FOF_NOERRORUI = 0x0400;",
+    "    var op = new SHFILEOPSTRUCT {",
+    "      hwnd = IntPtr.Zero,",
+    "      wFunc = FO_DELETE,",
+    '      pFrom = path + "\\0\\0",',
+    "      pTo = null,",
+    "      fFlags = (ushort)(FOF_ALLOWUNDO | FOF_NOCONFIRMATION | FOF_NOERRORUI | FOF_SILENT),",
+    "      fAnyOperationsAborted = false,",
+    "      hNameMappings = IntPtr.Zero,",
+    "      lpszProgressTitle = null",
+    "    };",
+    "    int result = SHFileOperationW(ref op);",
+    '    if (result != 0) throw new InvalidOperationException("SHFileOperationW failed: " + result);',
+    '    if (op.fAnyOperationsAborted) throw new OperationCanceledException("SHFileOperationW aborted");',
+    "  }",
+    "}",
+    "'@;",
+    "[CodeViewerRecycleBin]::MoveToRecycleBin($path);"
+  ].join(" ");
+}
+function windowsRestoreTrashScript(originalPath) {
+  const quotedPath = originalPath.replace(/'/g, "''");
+  return [
+    "$ErrorActionPreference = 'Stop';",
+    `$original = '${quotedPath}';`,
+    "$parent = [System.IO.Path]::GetDirectoryName($original);",
+    "$name = [System.IO.Path]::GetFileName($original);",
+    "$shell = New-Object -ComObject Shell.Application;",
+    "$bin = $shell.Namespace(10);",
+    "$restored = $false;",
+    "foreach ($item in $bin.Items()) {",
+    "  $deletedFrom = $item.ExtendedProperty('System.Recycle.DeletedFrom');",
+    "  if ($item.Name -eq $name -and $deletedFrom -eq $parent) {",
+    "    $item.InvokeVerb('ESTORE');",
+    "    $restored = $true;",
+    "    break;",
+    "  }",
+    "}",
+    "if (-not $restored) { throw 'recycle bin item not found'; }"
+  ].join(" ");
+}
+function makeUndoId() {
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function clearMutableCaches() {
+  fileCache.clear();
+  metaCache.clear();
+  fileListCache.clear();
+}
+function moveMacPathIntoTrash(path) {
+  const trashDir = join4(homedir(), ".Trash");
+  const base = basename2(path) || "code-viewer-trash-item";
+  const target = join4(trashDir, `${base}-${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2, 8)}`);
+  try {
+    mkdirSync(trashDir, { recursive: true });
+    renameSync(path, target);
+    return { ok: true, trashPath: target };
+  } catch (error) {
+    return { ok: false, error: String(error) };
+  }
+}
+function movePathToTrash(path) {
+  lstatSync3(path);
+  if (process.platform === "darwin") {
+    return moveMacPathIntoTrash(path);
+  }
+  if (process.platform === "win32") {
+    const res = runSync([
+      "powershell.exe",
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      windowsTrashScript(path)
+    ], cwd, { timeout: 60000 });
+    return res.code === 0 ? { ok: true } : { ok: false, error: res.stderr || res.stdout };
+  }
+  return { ok: false, error: "trash unsupported" };
+}
+function restoreTrashPath(originalPath, trashPath) {
+  const parent = parentRepoPath(originalPath);
+  const parentFullPath = safeOpenWorktreePath(parent);
+  if (!parentFullPath)
+    return { ok: false, error: "invalid restore target" };
+  const original = worktreePath(originalPath);
+  if (existsSync3(original))
+    return { ok: false, error: "restore target exists" };
+  if (trashPath) {
+    if (process.platform !== "darwin")
+      return { ok: false, error: "invalid trash handle" };
+    if (!existsSync3(trashPath))
+      return { ok: false, error: "trash item not found" };
+    try {
+      const trashRoot = join4(homedir(), ".Trash");
+      const trashRelative = relative(trashRoot, trashPath);
+      if (trashRelative === "" || trashRelative.startsWith("..") || trashRelative.startsWith("/") || trashRelative.startsWith("\\"))
+        return { ok: false, error: "invalid trash handle" };
+      mkdirSync(dirname2(original), { recursive: true });
+      renameSync(trashPath, original);
+      return { ok: true };
+    } catch (error) {
+      return { ok: false, error: String(error) };
+    }
+  }
+  if (process.platform === "win32") {
+    const res = runSync([
+      "powershell.exe",
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      windowsRestoreTrashScript(original)
+    ], cwd, { timeout: 60000 });
+    return res.code === 0 ? { ok: true } : { ok: false, error: res.stderr || res.stdout };
+  }
+  return { ok: false, error: "undo unavailable for this trash operation" };
+}
 async function handleOpenPath(req) {
   if (req.method !== "POST")
     return text("method not allowed", 405);
@@ -2508,6 +2757,142 @@ async function handleOpenPath(req) {
   openOsPath(target);
   return json({ ok: true });
 }
+async function handleTrashPath(req) {
+  if (req.method !== "POST")
+    return text("method not allowed", 405);
+  if (!sideEffectRequestAllowed(req))
+    return text("forbidden", 403);
+  const contentType = req.headers.get("content-type") || "";
+  if (!/^application\/json(?:;|$)/i.test(contentType))
+    return text("unsupported media type", 415);
+  const length = Number(req.headers.get("content-length") || "0");
+  if (length > 1024)
+    return text("payload too large", 413);
+  let body = {};
+  try {
+    const raw = await req.text();
+    if (raw.length > 1024)
+      return text("payload too large", 413);
+    body = JSON.parse(raw);
+  } catch {
+    return text("invalid json", 400);
+  }
+  const path = typeof body.path === "string" ? body.path.replace(/^\/+|\/+$/g, "") : "";
+  if (!path)
+    return text("invalid path", 400);
+  if (!safeRepoPath(path))
+    return text("invalid path", 400);
+  if (isGitInternalPath(path))
+    return text("forbidden", 403);
+  const originalFullPath = safeWorktreePath(path);
+  if (!originalFullPath)
+    return text("not found", 404);
+  const moved = movePathToTrash(worktreePath(path));
+  if (!moved.ok)
+    return text(moved.error || "trash failed", 500);
+  const undo = {
+    id: makeUndoId(),
+    type: "trash",
+    label: `Restore ${path}`,
+    payload: {
+      original_path: path,
+      trashPath: moved.trashPath
+    }
+  };
+  generation++;
+  clearMutableCaches();
+  sendSse("update");
+  return json({ ok: true, generation, undo });
+}
+async function handleCreateDirectory(req) {
+  if (req.method !== "POST")
+    return text("method not allowed", 405);
+  if (!sideEffectRequestAllowed(req))
+    return text("forbidden", 403);
+  const contentType = req.headers.get("content-type") || "";
+  if (!/^application\/json(?:;|$)/i.test(contentType))
+    return text("unsupported media type", 415);
+  const lengthHeader = req.headers.get("content-length");
+  const length = Number(lengthHeader || "0");
+  if (lengthHeader && (!Number.isFinite(length) || length < 0))
+    return text("invalid content length", 400);
+  if (length > 2048)
+    return text("payload too large", 413);
+  let body = {};
+  try {
+    const raw = await req.text();
+    if (raw.length > 2048)
+      return text("payload too large", 413);
+    body = JSON.parse(raw);
+  } catch {
+    return text("invalid json", 400);
+  }
+  const dir = typeof body.dir === "string" ? body.dir.trim().replace(/^\/+|\/+$/g, "") : "";
+  const name = normalizeNewDirectoryName(body.name);
+  if (!safeRepoPath(dir))
+    return text("invalid dir", 400);
+  if (dir && isGitInternalPath(dir))
+    return text("forbidden", 403);
+  if (!name)
+    return text("invalid name", 400);
+  const parent = safeOpenWorktreePath(dir);
+  if (!parent)
+    return text("not found", 404);
+  const stats = statSync(parent);
+  if (!stats.isDirectory())
+    return text("not a directory", 400);
+  const targetPath = dir ? `${dir}/${name}` : name;
+  if (!safeRepoPath(targetPath) || isGitInternalPath(targetPath))
+    return text("invalid target", 400);
+  const target = join4(parent, name);
+  if (existsSync3(target))
+    return text("already exists", 409);
+  try {
+    mkdirSync(target, { recursive: false });
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return text("already exists", 409);
+    return text("create failed", 500);
+  }
+  generation++;
+  clearMutableCaches();
+  sendSse("update");
+  return json({ ok: true, path: targetPath, generation });
+}
+async function handleRestoreTrash(req) {
+  if (req.method !== "POST")
+    return text("method not allowed", 405);
+  if (!sideEffectRequestAllowed(req))
+    return text("forbidden", 403);
+  const contentType = req.headers.get("content-type") || "";
+  if (!/^application\/json(?:;|$)/i.test(contentType))
+    return text("unsupported media type", 415);
+  const length = Number(req.headers.get("content-length") || "0");
+  if (length > 1024)
+    return text("payload too large", 413);
+  let body = {};
+  try {
+    const raw = await req.text();
+    if (raw.length > 1024)
+      return text("payload too large", 413);
+    body = JSON.parse(raw);
+  } catch {
+    return text("invalid json", 400);
+  }
+  const originalPath = typeof body.original_path === "string" ? body.original_path.replace(/^\/+|\/+$/g, "") : "";
+  const trashPath = typeof body.trashPath === "string" ? body.trashPath : "";
+  if (!originalPath || !safeRepoPath(originalPath))
+    return text("invalid restore target", 400);
+  if (isGitInternalPath(originalPath))
+    return text("forbidden", 403);
+  const restored = restoreTrashPath(originalPath, trashPath || undefined);
+  if (!restored.ok)
+    return text(restored.error || "undo failed", 409);
+  generation++;
+  clearMutableCaches();
+  sendSse("update");
+  return json({ ok: true, generation });
+}
 function sendSse(event, data = "tick") {
   const payload = enc.encode(`event: ${event}
 data: ${data}
@@ -2556,6 +2941,12 @@ var server = await startServer({
       return handleRawFile(req, url);
     if (url.pathname === "/_open_path")
       return handleOpenPath(req);
+    if (url.pathname === "/_trash_path")
+      return handleTrashPath(req);
+    if (url.pathname === "/_restore_trash")
+      return handleRestoreTrash(req);
+    if (url.pathname === "/_create_directory")
+      return handleCreateDirectory(req);
     if (url.pathname === "/_upload_files")
       return handleUploadFiles(req);
     if (url.pathname === "/_refs")
@@ -2564,9 +2955,7 @@ var server = await startServer({
       if (!sideEffectRequestAllowed(req))
         return text("forbidden", 403);
       generation++;
-      fileCache.clear();
-      metaCache.clear();
-      fileListCache.clear();
+      clearMutableCaches();
       sendSse("update");
       return json({ ok: true, generation });
     }