texlite 0.6.0 → 0.6.5

package/dist/server/compileArtifacts.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { publishedCompileArtifacts } from "./compiler.js";
-import { outputRoot, resolveSourcePath, safeRelativePath, sourceRoot } from "./files.js";
+import { outputRoot, resolveSourcePath, safeRelativePath, sourceRoot, texFileStem } from "./files.js";
 import { hasDocumentClass } from "./zip.js";
 export function availablePdf(config, projectId, mainFile, defaultMainFile) {
     const isDefault = mainFile === defaultMainFile;
@@ -11,20 +11,20 @@ export function availablePdf(config, projectId, mainFile, defaultMainFile) {
     if (!isDefault)
         return null;
     const retained = retainedPdfPath(config, projectId);
-    if (fs.existsSync(retained))
-        return { path: retained, version: String(fs.statSync(retained).mtimeMs) };
-    const legacy = path.join(outputRoot(config, projectId), `${path.basename(mainFile, ".tex")}.pdf`);
-    return fs.existsSync(legacy) ? { path: legacy, version: String(fs.statSync(legacy).mtimeMs) } : null;
+    const retainedStat = regularFileStat(retained);
+    if (retainedStat)
+        return { path: retained, version: String(retainedStat.mtimeMs) };
+    const legacy = path.join(outputRoot(config, projectId), `${texFileStem(mainFile)}.pdf`);
+    const legacyStat = regularFileStat(legacy);
+    return legacyStat ? { path: legacy, version: String(legacyStat.mtimeMs) } : null;
 }
 /** Resolve the PDF bytes belonging to one successful compile run. */
 export function compileRunPdf(config, projectId, mainFile, runId) {
     if (!/^[a-f0-9-]{36}$/i.test(runId))
         return null;
     const output = path.join(outputRoot(config, projectId), ".texlite", "runs", runId, "output");
-    const pdf = path.join(output, `${path.basename(mainFile, ".tex")}.pdf`);
-    if (!fs.existsSync(pdf) || !fs.statSync(pdf).isFile())
-        return null;
-    return { path: pdf, version: runId };
+    const pdf = path.join(output, `${texFileStem(mainFile)}.pdf`);
+    return regularFileStat(pdf) ? { path: pdf, version: runId } : null;
 }
 export function syncArtifacts(config, projectId, mainFile, defaultMainFile) {
     const isDefault = mainFile === defaultMainFile;
@@ -40,7 +40,7 @@ export function syncArtifacts(config, projectId, mainFile, defaultMainFile) {
     };
     if (fs.existsSync(retained.pdf) && fs.existsSync(retained.synctex))
         return retained;
-    const basename = path.basename(mainFile, ".tex");
+    const basename = texFileStem(mainFile);
     const legacy = {
         source: sourceRoot(config, projectId),
         pdf: path.join(outputRoot(config, projectId), `${basename}.pdf`),
@@ -59,10 +59,19 @@ export function compileMainFile(config, projectId, defaultMainFile, value) {
     if (!mainFile.toLocaleLowerCase().endsWith(".tex"))
         return null;
     const absolute = resolveSourcePath(config, projectId, mainFile);
-    if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile())
-        return null;
-    if (mainFile !== defaultMainFile && !hasDocumentClass(fs.readFileSync(absolute, "utf8")))
+    try {
+        if (!fs.statSync(absolute).isFile())
+            return null;
+        // A project may intentionally contain only one fragmentary .tex file; the
+        // upload flow keeps it as the configured root and latexmk reports the
+        // resulting compile error. Session-selected alternate roots are stricter:
+        // they must identify an actual document rather than an included fragment.
+        if (mainFile !== defaultMainFile && !hasDocumentClass(fs.readFileSync(absolute, "utf8")))
+            return null;
+    }
+    catch {
         return null;
+    }
     return mainFile;
 }
 export function compilePdfUrl(projectId, mainFile, version) {
@@ -94,3 +103,12 @@ function retainedPdfPath(config, projectId) {
 function retainedSynctexPath(config, projectId) {
     return path.join(outputRoot(config, projectId), ".texlite", "latest.synctex.gz");
 }
+function regularFileStat(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        return stat.isFile() ? stat : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/server/compiler.js

@@ -6,8 +6,9 @@ import { performance } from "node:perf_hooks";
 import { pipeline } from "node:stream/promises";
 import { Transform } from "node:stream";
 import { gunzipSync, gzipSync } from "node:zlib";
-import { listProjectFilesAsync, outputRoot, safeRelativePath, sourceRoot } from "./files.js";
+import { listProjectFilesAsync, outputRoot, resolveSourcePath, safeRelativePath, texFileStem } from "./files.js";
 import { parseCompileDiagnostics } from "./compileDiagnostics.js";
+import { detachedProcessGroup, killProcessGroup } from "./processTree.js";
 export class CompileQueue {
     concurrency;
     running = 0;
@@ -44,7 +45,12 @@ export class CompileQueue {
         }
     }
 }
-/** Serializes each project while still respecting the server-wide LaTeX process limit. */
+/**
+ * Coalesces and serializes each project/main-document target while still
+ * respecting the server-wide LaTeX process limit. Different root documents
+ * may compile concurrently because their caches and published bundles are
+ * isolated by target.
+ */
 export class ProjectCompileCoordinator {
     queue;
     targets = new Map();
@@ -55,19 +61,23 @@ export class ProjectCompileCoordinator {
         const targetKey = `${input.projectId}\0${input.target ?? ""}`;
         const state = this.targets.get(targetKey) ?? { active: null, pending: null };
         this.targets.set(targetKey, state);
-        if (state.active?.input.revision === input.revision) {
-            if (state.pending) {
-                this.redirect(state.pending, state.active);
-                state.pending.input.onDiscarded("superseded");
+        const generation = input.generation ?? input.revision;
+        const active = state.active;
+        if (active && (active.input.generation ?? active.input.revision) === generation) {
+            const pending = state.pending;
+            if (pending) {
+                this.redirect(pending, active);
+                pending.input.onDiscarded("superseded");
                 state.pending = null;
             }
             input.onDiscarded("duplicate");
-            state.active.input.onSelected();
-            return state.active.promise;
+            active.input.onSelected();
+            return active.promise;
         }
-        if (state.pending?.input.revision === input.revision) {
+        const pending = state.pending;
+        if (pending && (pending.input.generation ?? pending.input.revision) === generation) {
             input.onDiscarded("duplicate");
-            return state.pending.promise;
+            return pending.promise;
         }
         const managed = deferredJob(input);
         if (state.active) {
@@ -123,7 +133,11 @@ export async function captureCompileSnapshot(config, projectId, runId, settings)
     const hash = createHash("sha256");
     const files = [];
     const directories = [];
-    hash.update(JSON.stringify(settings));
+    // The content revision remains independent from the cheap generation. A
+    // metadata-only project update should still be able to reuse an identical
+    // source snapshot after the generation check misses.
+    const { generation, ...contentSettings } = settings;
+    hash.update(JSON.stringify(contentSettings));
     try {
         const entries = (await listProjectFilesAsync(config, projectId)).sort((left, right) => left.path.localeCompare(right.path));
         const fileEntries = entries.filter((entry) => entry.type === "file");
@@ -141,8 +155,10 @@ export async function captureCompileSnapshot(config, projectId, runId, settings)
             const batch = fileEntries.slice(offset, offset + 4);
             const settled = await Promise.allSettled(batch.map(async (entry) => {
                 const destination = path.join(snapshotSource, entry.path);
-                const liveFile = path.join(sourceRoot(config, projectId), entry.path);
-                const stat = await fs.promises.stat(liveFile);
+                const liveFile = resolveSourcePath(config, projectId, entry.path);
+                const stat = await fs.promises.lstat(liveFile);
+                if (stat.isSymbolicLink() || !stat.isFile())
+                    throw new Error(`Compile source path is not a regular file: ${entry.path}`);
                 await fs.promises.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
                 const digest = await copyAndDigest(liveFile, destination);
                 await fs.promises.utimes(destination, stat.atime, stat.mtime);
@@ -156,7 +172,7 @@ export async function captureCompileSnapshot(config, projectId, runId, settings)
         for (const file of files)
             hash.update(file.digest);
         return {
-            projectId, runId, mainFile: safeRelativePath(settings.mainFile), revision: hash.digest("hex"), root,
+            projectId, runId, mainFile: safeRelativePath(settings.mainFile), revision: hash.digest("hex"), generation, root,
             sourceDir: snapshotSource, outputDir: snapshotOutput, files, directories
         };
     }
@@ -218,8 +234,8 @@ export function cleanCompileArtifacts(config, projectId, mainFile, defaultMainFi
             path.join(output, ".texlite", "latest.json"),
             path.join(output, ".texlite", "latest.pdf"),
             path.join(output, ".texlite", "latest.synctex.gz"),
-            path.join(output, `${path.basename(mainFile, ".tex")}.pdf`),
-            path.join(output, `${path.basename(mainFile, ".tex")}.synctex.gz`)
+            path.join(output, `${texFileStem(mainFile)}.pdf`),
+            path.join(output, `${texFileStem(mainFile)}.synctex.gz`)
         ])
             fs.rmSync(generated, { force: true });
     }
@@ -234,6 +250,7 @@ export function publishCompileArtifacts(config, projectId, snapshot, result) {
         mainFile: snapshot.mainFile,
         runId: snapshot.runId,
         revision: snapshot.revision,
+        generation: snapshot.generation ?? null,
         pdf: path.basename(result.pdfPath),
         synctex: result.synctexPath ? path.basename(result.synctexPath) : null
     };
@@ -283,6 +300,34 @@ export function listPublishedCompileArtifacts(config, projectId) {
         result.push(legacy);
     return result;
 }
+/**
+ * Recover database run state after a crash between publishing an immutable
+ * bundle and updating compile_runs. A valid published manifest is evidence
+ * that latexmk produced a usable PDF, so the corresponding run must be
+ * visible to latest/PDF endpoints after restart.
+ */
+export function reconcilePublishedCompileRuns(config, db, projectId) {
+    const recover = db.prepare(`UPDATE compile_runs
+    SET status = 'succeeded', log = CASE WHEN log = '' THEN ? ELSE log END, finished_at = ?
+    WHERE id = ? AND project_id = ?`);
+    const insert = db.prepare(`INSERT OR IGNORE INTO compile_runs
+    (id, project_id, requested_by, main_file, status, log, created_at, finished_at)
+    VALUES (?, ?, NULL, ?, 'succeeded', ?, ?, ?)`);
+    for (const artifact of listPublishedCompileArtifacts(config, projectId)) {
+        let finishedAt = new Date().toISOString();
+        try {
+            finishedAt = fs.statSync(artifact.pdf).mtime.toISOString();
+        }
+        catch { /* manifest validation already checked the file */ }
+        const message = "Recovered a published PDF after a server restart.";
+        const existing = db.prepare("SELECT status FROM compile_runs WHERE id = ? AND project_id = ?")
+            .get(artifact.runId, projectId);
+        if (!existing)
+            insert.run(artifact.runId, projectId, artifact.mainFile, message, finishedAt, finishedAt);
+        else if (existing.status !== "succeeded")
+            recover.run(message, finishedAt, artifact.runId, projectId);
+    }
+}
 function readPublishedManifest(config, projectId, manifestPath, expectedMainFile, legacy = false) {
     if (!fs.existsSync(manifestPath))
         return null;
@@ -291,9 +336,12 @@ function readPublishedManifest(config, projectId, manifestPath, expectedMainFile
         const mainFile = manifest.version === 2 && typeof manifest.mainFile === "string"
             ? safeRelativePath(manifest.mainFile)
             : legacy && manifest.version === 1 ? expectedMainFile ?? "" : null;
+        const generation = manifest.generation === undefined || manifest.generation === null
+            ? null : typeof manifest.generation === "string" ? manifest.generation : null;
         if (mainFile === null || (expectedMainFile !== undefined && mainFile !== expectedMainFile)
             || typeof manifest.runId !== "string" || !/^[a-f0-9-]{36}$/i.test(manifest.runId)
             || typeof manifest.revision !== "string" || typeof manifest.pdf !== "string"
+            || (manifest.generation !== undefined && manifest.generation !== null && generation === null)
             || path.basename(manifest.pdf) !== manifest.pdf
             || (manifest.synctex !== null && (typeof manifest.synctex !== "string" || path.basename(manifest.synctex) !== manifest.synctex))) {
             return null;
@@ -305,7 +353,7 @@ function readPublishedManifest(config, projectId, manifestPath, expectedMainFile
         const synctex = manifest.synctex ? path.join(output, manifest.synctex) : null;
         if (!fs.existsSync(source) || !fs.existsSync(output) || !fs.existsSync(pdf) || (synctex && !fs.existsSync(synctex)))
             return null;
-        return { mainFile, runId: manifest.runId, revision: manifest.revision, source, output, pdf, synctex };
+        return { mainFile, runId: manifest.runId, revision: manifest.revision, generation, source, output, pdf, synctex };
     }
     catch {
         return null;
@@ -486,7 +534,7 @@ function rewriteSynctexSource(synctexPath, cacheSource, snapshotSource) {
 }
 export async function compileProject(config, snapshot, mainFileInput, engine, latexmkrcInput) {
     const mainFile = safeRelativePath(mainFileInput);
-    if (!mainFile.endsWith(".tex"))
+    if (!/\.tex$/i.test(mainFile))
         throw new Error("主文件必须是 .tex 文件");
     const startedAt = performance.now();
     let latexmkrc = null;
@@ -520,6 +568,7 @@ export async function compileProject(config, snapshot, mainFileInput, engine, la
         const child = spawn(config.latexmk, args, {
             cwd,
             shell: false,
+            detached: detachedProcessGroup(),
             env: { ...process.env, max_print_line: "1000" },
             stdio: ["ignore", "pipe", "pipe"]
         });
@@ -534,7 +583,7 @@ export async function compileProject(config, snapshot, mainFileInput, engine, la
         child.on("error", reject);
         const timeout = setTimeout(() => {
             log += `\n编译超过 ${config.compileTimeoutMs / 1000} 秒，已终止。\n`;
-            child.kill("SIGKILL");
+            killProcessGroup(child);
         }, config.compileTimeoutMs);
         child.on("close", (code) => {
             clearTimeout(timeout);
@@ -542,7 +591,7 @@ export async function compileProject(config, snapshot, mainFileInput, engine, la
         });
     });
     const latexmkMs = performance.now() - latexmkStartedAt;
-    const basename = path.basename(mainFile, ".tex");
+    const basename = texFileStem(mainFile);
     const cachedPdf = path.join(outDir, `${basename}.pdf`);
     const ok = processResult.code === 0 && fs.existsSync(cachedPdf);
     const diagnostics = parseCompileDiagnostics(processResult.log, ok ? "succeeded" : "failed");

package/dist/server/db.js

@@ -29,6 +29,7 @@ function migrate(db) {
       created_at TEXT NOT NULL
     );
     CREATE INDEX IF NOT EXISTS sessions_user_id ON sessions(user_id);
+    CREATE INDEX IF NOT EXISTS sessions_expires_at ON sessions(expires_at);
 
     CREATE TABLE IF NOT EXISTS projects (
       id TEXT PRIMARY KEY,
@@ -125,6 +126,7 @@ function migrate(db) {
       edited_at TEXT
     );
     CREATE INDEX IF NOT EXISTS comments_project_file ON comments(project_id, file_path);
+    CREATE INDEX IF NOT EXISTS comments_project_resolved ON comments(project_id, resolved);
 
     CREATE TABLE IF NOT EXISTS comment_replies (
       id TEXT PRIMARY KEY,
@@ -274,6 +276,10 @@ function migrate(db) {
     FROM project_tag_links link JOIN user_tags user_tag ON user_tag.id = link.tag_id;
   `);
 }
+/** Remove sessions that can no longer authenticate any request. */
+export function pruneExpiredSessions(db, asOf = new Date().toISOString()) {
+    return db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(asOf).changes;
+}
 export function activeAdminCount(db) {
     const row = db.prepare("SELECT COUNT(*) AS count FROM users WHERE role = 'admin' AND disabled = 0").get();
     return Number(row.count);

package/dist/server/environment.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { detachedProcessGroup, killProcessGroup } from "./processTree.js";
 export async function assertEnvironment(config) {
     const commands = [
         { name: "latexmk", command: config.latexmk },
@@ -33,7 +34,8 @@ export async function assertGitAvailable(config) {
 function commandVersion(command, timeoutMs) {
     return new Promise((resolve) => {
         const child = spawn(command, ["--version"], {
-            env: { ...process.env, LC_ALL: "C" }, shell: false, stdio: ["ignore", "pipe", "pipe"]
+            env: { ...process.env, LC_ALL: "C" }, shell: false, detached: detachedProcessGroup(),
+            stdio: ["ignore", "pipe", "pipe"]
         });
         const stdout = [];
         const stderr = [];
@@ -46,7 +48,7 @@ function commandVersion(command, timeoutMs) {
             clearTimeout(timer);
             resolve({ ...result, stdout: Buffer.concat(stdout).toString("utf8"), stderr: Buffer.concat(stderr).toString("utf8") });
         };
-        const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); }, timeoutMs);
+        const timer = setTimeout(() => { timedOut = true; killProcessGroup(child); }, timeoutMs);
         child.stdout.on("data", (chunk) => { if (Buffer.concat(stdout).length < 64 * 1024)
             stdout.push(chunk); });
         child.stderr.on("data", (chunk) => { if (Buffer.concat(stderr).length < 64 * 1024)

package/dist/server/files.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { randomUUID } from "node:crypto";
 export function projectRoot(config, projectId) {
     return path.join(config.projectsDir, projectId);
 }
@@ -27,79 +28,203 @@ Start writing here.
 \\end{document}
 `, { encoding: "utf8", mode: 0o600 });
 }
-export function duplicateProjectFiles(config, sourceProjectId, targetProjectId) {
+export async function duplicateProjectFiles(config, sourceProjectId, targetProjectId) {
     const source = sourceRoot(config, sourceProjectId);
     const target = sourceRoot(config, targetProjectId);
-    fs.mkdirSync(target, { recursive: true, mode: 0o700 });
+    assertNoSourceSymlinks(config, sourceProjectId);
+    await fs.promises.mkdir(target, { recursive: true, mode: 0o700 });
     if (fs.existsSync(source)) {
-        for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+        const entries = await fs.promises.readdir(source, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isSymbolicLink())
+                throw symbolicLinkError(entry.name);
             if (entry.name === ".git")
                 continue;
-            fs.cpSync(path.join(source, entry.name), path.join(target, entry.name), {
-                recursive: true, errorOnExist: true, force: false, verbatimSymlinks: true
+            await fs.promises.cp(path.join(source, entry.name), path.join(target, entry.name), {
+                recursive: true, errorOnExist: true, force: false, verbatimSymlinks: false
             });
         }
     }
-    fs.mkdirSync(outputRoot(config, targetProjectId), { recursive: true, mode: 0o700 });
+    await fs.promises.mkdir(outputRoot(config, targetProjectId), { recursive: true, mode: 0o700 });
 }
 export function safeRelativePath(input) {
     if (!input || input.includes("\0") || path.isAbsolute(input)) {
-        throw Object.assign(new Error("无效的文件路径"), { code: "INVALID_PATH" });
+        throw Object.assign(new Error("无效的文件路径"), { statusCode: 400, code: "INVALID_PATH" });
     }
     const normalized = path.posix.normalize(input.replaceAll("\\", "/"));
     if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
-        throw Object.assign(new Error("无效的文件路径"), { code: "INVALID_PATH" });
+        throw Object.assign(new Error("无效的文件路径"), { statusCode: 400, code: "INVALID_PATH" });
     }
     if (normalized.split("/").some((segment) => segment.toLocaleLowerCase() === ".git")) {
-        throw Object.assign(new Error(".git 是系统保留目录"), { code: "RESERVED_PATH" });
+        throw Object.assign(new Error(".git 是系统保留目录"), { statusCode: 400, code: "RESERVED_PATH" });
     }
     return normalized;
 }
-export function resolveSourcePath(config, projectId, input) {
-    return path.join(sourceRoot(config, projectId), safeRelativePath(input));
+export function symbolicLinkError(relativePath) {
+    return Object.assign(new Error(`项目源文件包含不受支持的符号链接，已拒绝访问：${relativePath || "source"}`), { statusCode: 409, code: "SYMLINK_FORBIDDEN" });
+}
+/**
+ * Check every existing component below the project directory without
+ * resolving it.  `stat()` and most file APIs follow links, so a lexical
+ * `safeRelativePath()` check alone is not sufficient after a Git checkout.
+ */
+function assertSourcePathComponents(config, projectId, relativePath, allowFinalSymlink = false) {
+    let current = projectRoot(config, projectId);
+    const segments = ["source", ...relativePath.split("/").filter(Boolean)];
+    const projectStat = lstatIfPresent(current);
+    if (projectStat?.isSymbolicLink())
+        throw symbolicLinkError("source");
+    for (let index = 0; index < segments.length; index += 1) {
+        current = path.join(current, segments[index]);
+        const stat = lstatIfPresent(current);
+        if (!stat)
+            return;
+        const isFinal = index === segments.length - 1;
+        if (stat.isSymbolicLink() && !(allowFinalSymlink && isFinal && relativePath.length > 0)) {
+            const displayed = relativePath || segments.slice(0, index + 1).join("/");
+            throw symbolicLinkError(displayed);
+        }
+    }
+}
+function lstatIfPresent(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Reject every link below an existing directory without following it. */
+export function assertNoSymbolicLinks(root, ignoreGitDirectory = false) {
+    const rootStat = lstatIfPresent(root);
+    if (!rootStat)
+        return;
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
+        throw symbolicLinkError("source");
+    const visit = (directory, prefix) => {
+        const directoryStat = lstatIfPresent(directory);
+        if (!directoryStat || directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
+            throw symbolicLinkError(prefix || "source");
+        }
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isSymbolicLink())
+                throw symbolicLinkError(relative);
+            if (ignoreGitDirectory && entry.name === ".git")
+                continue;
+            if (entry.isDirectory())
+                visit(path.join(directory, entry.name), relative);
+        }
+    };
+    visit(root, "");
+}
+/** Reject every link in a checked-out project source tree. */
+export function assertNoSourceSymlinks(config, projectId) {
+    assertSourcePathComponents(config, projectId, "");
+    assertNoSymbolicLinks(sourceRoot(config, projectId), true);
+}
+/** Return the output stem for a TeX file, regardless of extension casing. */
+export function texFileStem(input) {
+    return path.basename(input).replace(/\.tex$/i, "");
+}
+export function resolveSourcePath(config, projectId, input, options = {}) {
+    const relativePath = safeRelativePath(input);
+    assertSourcePathComponents(config, projectId, relativePath, options.allowFinalSymlink === true);
+    return path.join(sourceRoot(config, projectId), relativePath);
 }
 export function listProjectFiles(config, projectId) {
     const root = sourceRoot(config, projectId);
     const result = [];
     const visit = (directory, prefix) => {
+        const directoryStat = fs.lstatSync(directory);
+        if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())
+            throw symbolicLinkError(prefix || "source");
         for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-            if (entry.name === ".git")
-                continue;
             const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
             const absolute = path.join(directory, entry.name);
+            if (entry.isSymbolicLink())
+                throw symbolicLinkError(relative);
+            if (entry.name === ".git")
+                continue;
             if (entry.isDirectory()) {
                 result.push({ path: relative, type: "directory" });
                 visit(absolute, relative);
             }
             else if (entry.isFile()) {
-                result.push({ path: relative, type: "file", size: fs.statSync(absolute).size });
+                const stat = fs.lstatSync(absolute);
+                if (stat.isSymbolicLink())
+                    throw symbolicLinkError(relative);
+                if (stat.isFile())
+                    result.push({ path: relative, type: "file", size: stat.size });
             }
         }
     };
-    if (fs.existsSync(root))
+    assertSourcePathComponents(config, projectId, "");
+    if (lstatIfPresent(root))
         visit(root, "");
     return result;
 }
 export async function listProjectFilesAsync(config, projectId) {
     const root = sourceRoot(config, projectId);
     const result = [];
+    let activeIo = 0;
+    const waiters = [];
+    const limited = async (operation) => {
+        if (activeIo >= 4)
+            await new Promise((resolve) => waiters.push(resolve));
+        activeIo += 1;
+        try {
+            return await operation();
+        }
+        finally {
+            activeIo -= 1;
+            waiters.shift()?.();
+        }
+    };
     const visit = async (directory, prefix) => {
-        const entries = await fs.promises.readdir(directory, { withFileTypes: true });
+        let entries;
+        try {
+            const directoryStat = await limited(() => fs.promises.lstat(directory));
+            if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())
+                throw symbolicLinkError(prefix || "source");
+            entries = await limited(() => fs.promises.readdir(directory, { withFileTypes: true }));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        const children = [];
         for (const entry of entries) {
-            if (entry.name === ".git")
-                continue;
             const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
             const absolute = path.join(directory, entry.name);
+            if (entry.isSymbolicLink())
+                throw symbolicLinkError(relative);
+            if (entry.name === ".git")
+                continue;
             if (entry.isDirectory()) {
                 result.push({ path: relative, type: "directory" });
-                await visit(absolute, relative);
+                children.push(visit(absolute, relative));
             }
             else if (entry.isFile()) {
-                const stat = await fs.promises.stat(absolute);
-                result.push({ path: relative, type: "file", size: stat.size, mtimeMs: stat.mtimeMs });
+                try {
+                    const stat = await limited(() => fs.promises.lstat(absolute));
+                    if (stat.isSymbolicLink())
+                        throw symbolicLinkError(relative);
+                    if (stat.isFile())
+                        result.push({ path: relative, type: "file", size: stat.size, mtimeMs: stat.mtimeMs });
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
             }
         }
+        await Promise.all(children);
     };
+    assertSourcePathComponents(config, projectId, "");
     try {
         await visit(root, "");
     }
@@ -107,7 +232,7 @@ export async function listProjectFilesAsync(config, projectId) {
         if (error.code !== "ENOENT")
             throw error;
     }
-    return result;
+    return result.sort((left, right) => left.path.localeCompare(right.path));
 }
 export function removeProjectDirectory(config, projectId) {
     const root = projectRoot(config, projectId);
@@ -115,7 +240,29 @@ export function removeProjectDirectory(config, projectId) {
         return;
     const trash = path.join(config.dataDir, "trash");
     fs.mkdirSync(trash, { recursive: true, mode: 0o700 });
-    const target = path.join(trash, `${projectId}-${Date.now()}`);
-    fs.renameSync(root, target);
-    fs.rmSync(target, { recursive: true, force: true });
+    const target = path.join(trash, `${projectId}-${Date.now()}-${randomUUID()}`);
+    try {
+        fs.renameSync(root, target);
+        void fs.promises.rm(target, { recursive: true, force: true }).catch(() => undefined);
+    }
+    catch {
+        fs.rmSync(root, { recursive: true, force: true });
+        if (fs.existsSync(root)) {
+            throw new Error(`无法清理项目目录: ${root}`);
+        }
+    }
+}
+export async function pruneTrashDirectory(config) {
+    for (const folder of ["trash", "tmp"]) {
+        const dir = path.join(config.dataDir, folder);
+        try {
+            if (!fs.existsSync(dir))
+                continue;
+            const entries = await fs.promises.readdir(dir);
+            await Promise.allSettled(entries.map((entry) => fs.promises.rm(path.join(dir, entry), { recursive: true, force: true })));
+        }
+        catch {
+            // Ignore error
+        }
+    }
 }