tina4-nodejs 3.13.133 → 3.13.134

package/packages/core/src/middleware.ts

@@ -865,7 +865,7 @@ export class RequestLogger {
  * Usage:
  *   Router.use(SecurityHeadersMiddleware);
  */
-export class SecurityHeadersMiddleware {
+export class SecurityHeadersMiddleware {
   static beforeSecurity(req: Tina4Request, res: Tina4Response): [Tina4Request, Tina4Response] {
     res.header(
       "X-Frame-Options",
@@ -962,10 +962,45 @@ export class SecurityHeadersMiddleware {
     if (firstHop) return firstHop === "https";
     return Boolean((req.socket as { encrypted?: boolean } | undefined)?.encrypted);
   }
-}
-
-/**
- * Class-based CSRF middleware using the before/after convention.
+}
+
+function csrfMethodIsSafe(method: string | undefined): boolean {
+  const normalized = (method ?? "GET").toUpperCase();
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
+}
+
+function csrfRouteSkips(req: Tina4Request): boolean {
+  const route = (req as any)._route ?? (req as any).route;
+  return Boolean(route?.noAuth);
+}
+
+function csrfBearerIsValid(req: Tina4Request, secret: string): boolean {
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return false;
+  const bearerToken = authHeader.slice(7).trim();
+  return Boolean(bearerToken && validToken(bearerToken, secret));
+}
+
+function csrfRequestToken(req: Tina4Request): { token: string; fromQuery: boolean } {
+  const query = (req as any).query ?? {};
+  if (query.formToken) return { token: "", fromQuery: true };
+  const body = (req as any).body;
+  if (body && typeof body === "object" && body.formToken) return { token: String(body.formToken), fromQuery: false };
+  return { token: String(req.headers["x-form-token"] ?? ""), fromQuery: false };
+}
+
+function csrfSessionMatches(req: Tina4Request, payload: Record<string, unknown>): boolean {
+  const tokenSessionId = payload.session_id as string | undefined;
+  if (!tokenSessionId) return true;
+  const session = (req as any).session;
+  if (!session) return true;
+  let currentSessionId = session.session_id ?? session.sessionId ?? session.id;
+  if (typeof currentSessionId === "function") currentSessionId = undefined;
+  return !currentSessionId || tokenSessionId === currentSessionId;
+}
+
+/**
+ * Class-based CSRF middleware using the before/after convention.
  * Validates form tokens on state-changing requests (POST, PUT, PATCH, DELETE).
  *
  * OFF by default — a default app has NO CSRF gate because the middleware is
@@ -1012,17 +1047,7 @@ export class CsrfMiddleware {
       return [req, res];
     }
 
-    // Skip safe HTTP methods
-    const method = (req.method ?? "GET").toUpperCase();
-    if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
-      return [req, res];
-    }
-
-    // Skip routes marked noAuth
-    const route = (req as any)._route ?? (req as any).route;
-    if (route?.noAuth) {
-      return [req, res];
-    }
+    if (csrfMethodIsSafe(req.method) || csrfRouteSkips(req)) return [req, res];
 
     // Resolve the signing secret ONCE, fail-closed — IDENTICAL to the validator
     // (auth.ts validToken: `secret ?? process.env.TINA4_SECRET ?? ""`). Blank
@@ -1039,35 +1064,20 @@ export class CsrfMiddleware {
 
     // Skip requests with a valid Bearer token (API clients). Pass the resolved
     // secret so the Bearer check uses the SAME key as the form-token check.
-    const authHeader = req.headers.authorization ?? "";
-    if (authHeader.startsWith("Bearer ")) {
-      const bearerToken = authHeader.slice(7).trim();
-      if (bearerToken && validToken(bearerToken, secret)) {
-        return [req, res];
-      }
-    }
-
-    // Reject if token is in query string (security risk — a URL leaks through
-    // logs, referers and history).
-    const query = (req as any).query ?? {};
-    if (query.formToken) {
-      console.warn("[Tina4 CSRF] Token found in query string — rejected for security");
-      return reject("Form token must not be sent in the URL query string");
-    }
-
-    // Extract token: body first, then header
-    let token: string | undefined;
-    const body = (req as any).body;
-    if (body && typeof body === "object" && body.formToken) {
-      token = String(body.formToken);
-    }
-
-    if (!token) {
-      token = (req.headers["x-form-token"] as string) ?? "";
-    }
-
-    if (!token) {
-      return reject("Invalid or missing form token");
+    if (csrfBearerIsValid(req, secret)) return [req, res];
+
+    // Reject if token is in query string (security risk — a URL leaks through
+    // logs, referers and history).
+    const requestToken = csrfRequestToken(req);
+    if (requestToken.fromQuery) {
+      console.warn("[Tina4 CSRF] Token found in query string — rejected for security");
+      return reject("Form token must not be sent in the URL query string");
+    }
+
+    // Extract token: body first, then header
+    const token = requestToken.token;
+    if (!token) {
+      return reject("Invalid or missing form token");
     }
 
     // Validate the token signature / expiry against the resolved secret.
@@ -1086,21 +1096,7 @@ export class CsrfMiddleware {
 
     // Session binding — if token has session_id, verify it matches the request
     // session. A token minted for one session cannot be replayed against another.
-    const tokenSessionId = payload.session_id as string | undefined;
-    if (tokenSessionId) {
-      const session = (req as any).session;
-      let currentSessionId: string | undefined;
-      if (session) {
-        currentSessionId = session.session_id ?? session.sessionId ?? session.id;
-        if (typeof currentSessionId === "function") {
-          currentSessionId = undefined;
-        }
-      }
-
-      if (currentSessionId && tokenSessionId !== currentSessionId) {
-        return reject("Invalid or missing form token");
-      }
-    }
+    if (!csrfSessionMatches(req, payload)) return reject("Invalid or missing form token");
 
     return [req, res];
   }

package/packages/core/src/plan.ts

@@ -158,6 +158,78 @@ function loadParsed(name: string): { path: string; plan: ParsedPlan } {
   return { path: p, plan: parse(fs.readFileSync(p, "utf-8")) };
 }
 
+function fleshPrompt(title: string, goal: string, existing: string[], prompt: string): { system: string; user: string } {
+  const system =
+    "You are Tina4, a coding planner embedded in the Tina4 dev " +
+    "admin. Return ONLY a JSON array of short imperative step " +
+    "strings (no prose, no code-fences, no numbering). 3-8 steps, " +
+    "each referencing concrete files/routes/migrations. Example: " +
+    '["Create src/orm/Duck.ts with id/name/sighted_at", ' +
+    '"Add migration 001_create_ducks.sql", ' +
+    '"Add GET/POST/PUT/DELETE /api/ducks routes in ' +
+    'src/routes/ducks.ts"]';
+  const parts: string[] = [`Plan title: ${title}`];
+  if (goal) parts.push(`Goal: ${goal}`);
+  if (existing.length) parts.push("Existing steps (don't repeat):\n- " + existing.join("\n- "));
+  if (prompt) parts.push(`Extra context from caller: ${prompt}`);
+  parts.push("Reply with ONLY the JSON array — no explanation, no markdown fences.");
+  return { system, user: parts.join("\n\n") };
+}
+
+async function fetchFleshReply(aiUrl: string, aiModel: string, prompts: { system: string; user: string }): Promise<{ reply: string } | { error: string }> {
+  try {
+    const response = await fetch(aiUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ model: aiModel, stream: false, messages: [
+        { role: "system", content: prompts.system },
+        { role: "user", content: prompts.user },
+      ] }),
+      signal: AbortSignal.timeout(120_000),
+    });
+    const result = await response.json() as Record<string, unknown>;
+    const message = (result.message as Record<string, unknown> | undefined) || {};
+    return { reply: ((message.content as string) || (result.response as string) || "") };
+  } catch (error) {
+    return { error: `AI backend unreachable: ${(error as Error).message}` };
+  }
+}
+
+function parseFleshReply(reply: string): string[] {
+  let body = reply.trim();
+  if (body.startsWith("```")) {
+    body = body.replace(/^`+/, "").replace(/`+$/, "");
+    if (body.toLowerCase().startsWith("json")) body = body.slice(4).trim();
+    body = body.trim();
+  }
+  try {
+    const parsed = JSON.parse(body);
+    if (Array.isArray(parsed)) return parsed.map((step) => String(step).trim()).filter(Boolean);
+  } catch {
+    // Fall back to markdown-style lists below.
+  }
+  const proposed: string[] = [];
+  for (const line of reply.split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:[-*]|\d+[.)])\s+(.+?)\s*$/);
+    if (match) proposed.push(match[1].trim());
+  }
+  return proposed;
+}
+
+function addFleshSteps(target: string, existing: string[], proposed: string[]): string[] {
+  const existingLc = new Set(existing.map((step) => step.toLowerCase()));
+  const added: string[] = [];
+  for (const step of proposed) {
+    if (existingLc.has(step.toLowerCase())) continue;
+    const result = Plan.addStep(step, target);
+    if (result.ok) {
+      added.push(step);
+      existingLc.add(step.toLowerCase());
+    }
+  }
+  return added;
+}
+
 // ── Plan namespace ────────────────────────────────────────────
 
 export const Plan = {
@@ -453,81 +525,17 @@ export const Plan = {
     const title = currentPlan.title || target;
     const goal = currentPlan.goal || "";
 
-    const systemPrompt =
-      "You are Tina4, a coding planner embedded in the Tina4 dev " +
-      "admin. Return ONLY a JSON array of short imperative step " +
-      "strings (no prose, no code-fences, no numbering). 3-8 steps, " +
-      "each referencing concrete files/routes/migrations. Example: " +
-      '["Create src/orm/Duck.ts with id/name/sighted_at", ' +
-      '"Add migration 001_create_ducks.sql", ' +
-      '"Add GET/POST/PUT/DELETE /api/ducks routes in ' +
-      'src/routes/ducks.ts"]';
-
-    const userParts: string[] = [`Plan title: ${title}`];
-    if (goal) userParts.push(`Goal: ${goal}`);
-    if (existing.length) userParts.push("Existing steps (don't repeat):\n- " + existing.join("\n- "));
-    if (prompt) userParts.push(`Extra context from caller: ${prompt}`);
-    userParts.push("Reply with ONLY the JSON array — no explanation, no markdown fences.");
-
     const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11437/api/chat";
     const aiModel = process.env.TINA4_AI_MODEL || "qwen2.5-coder:14b";
-
-    let result: Record<string, unknown>;
-    try {
-      const resp = await fetch(aiUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          model: aiModel,
-          stream: false,
-          messages: [
-            { role: "system", content: systemPrompt },
-            { role: "user", content: userParts.join("\n\n") },
-          ],
-        }),
-        signal: AbortSignal.timeout(120_000),
-      });
-      result = (await resp.json()) as Record<string, unknown>;
-    } catch (e) {
-      return { ok: false, error: `AI backend unreachable: ${(e as Error).message}` };
-    }
-
-    const msg = (result.message as Record<string, unknown> | undefined) || {};
-    const reply = (msg.content as string) || (result.response as string) || "";
-    let body = reply.trim();
-    if (body.startsWith("```")) {
-      body = body.replace(/^`+/, "").replace(/`+$/, "");
-      if (body.toLowerCase().startsWith("json")) body = body.slice(4).trim();
-      body = body.trim();
-    }
-
-    let proposed: string[] = [];
-    try {
-      const parsed = JSON.parse(body);
-      if (Array.isArray(parsed)) {
-        proposed = parsed.map((x) => String(x).trim()).filter(Boolean);
-      }
-    } catch {
-      for (const line of reply.split(/\r?\n/)) {
-        const m = line.match(/^\s*(?:[-*]|\d+[.)])\s+(.+?)\s*$/);
-        if (m) proposed.push(m[1].trim());
-      }
-    }
+    const prompts = fleshPrompt(title, goal, existing, prompt);
+    const fetched = await fetchFleshReply(aiUrl, aiModel, prompts);
+    if ("error" in fetched) return { ok: false, error: fetched.error };
+    const proposed = parseFleshReply(fetched.reply);
 
     if (proposed.length === 0) {
-      return { ok: false, error: "AI returned no usable steps", raw_reply: reply.slice(0, 400) };
-    }
-
-    const existingLc = new Set(existing.map((s) => s.toLowerCase()));
-    const added: string[] = [];
-    for (const step of proposed) {
-      if (existingLc.has(step.toLowerCase())) continue;
-      const res = Plan.addStep(step, target);
-      if (res.ok) {
-        added.push(step);
-        existingLc.add(step.toLowerCase());
-      }
+      return { ok: false, error: "AI returned no usable steps", raw_reply: fetched.reply.slice(0, 400) };
     }
+    const added = addFleshSteps(target, existing, proposed);
 
     return {
       ok: true,

package/packages/core/src/projectIndex.ts

@@ -9,25 +9,10 @@
  * Python) using regex. No LLM involvement — pure static analysis.
  */
 
-import * as fs from "node:fs";
 import * as path from "node:path";
-import * as crypto from "node:crypto";
-
-const INDEX_DIRNAME = ".tina4";
-const INDEX_FILENAME = "project_index.json";
-
-const SKIP_DIRS = new Set([
-  ".git", ".hg", ".svn", "node_modules", "__pycache__", ".venv", "venv",
-  ".mypy_cache", ".ruff_cache", ".pytest_cache", "dist", "build",
-  ".tina4", "logs", ".idea", ".vscode",
-]);
-
-const INDEX_EXT = new Set([
-  ".py", ".twig", ".html", ".sql", ".scss", ".css", ".js", ".ts",
-  ".mjs", ".md", ".json", ".yml", ".yaml", ".toml", ".env",
-]);
-
-const MAX_FILE_BYTES = 256 * 1024;
+import * as fs from "node:fs";
+import { extract, indexPath, loadRaw, projectRoot, saveRaw, walk } from "./projectIndexStorage.js";
+import type { IndexData } from "./projectIndexStorage.js";
 
 export interface FileRoute {
   method: string;
@@ -60,266 +45,20 @@ export interface FileEntry {
   error?: string;
 }
 
-interface IndexData {
-  version: number;
-  files: Record<string, FileEntry>;
-  generated_at: number;
-}
-
-function projectRoot(): string {
-  return path.resolve(process.cwd());
-}
-
-function indexPath(): string {
-  const d = path.join(projectRoot(), INDEX_DIRNAME);
-  if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });
-  return path.join(d, INDEX_FILENAME);
-}
-
-// ── Per-language extractors ──────────────────────────────────
-
-const ROUTE_METHODS = new Set(["get", "post", "put", "patch", "delete", "any_method", "any"]);
-
-// TypeScript/JavaScript: grab exports and imports + route decorator calls
-const JS_EXPORT_RE = /^\s*export\s+(?:default\s+)?(?:async\s+)?(?:function|class|const|let|var|interface|type|enum)\s+([A-Za-z_$][\w$]*)/gm;
-const JS_IMPORT_RE = /^\s*import\s+[^'"]+?['"]([^'"]+)['"]/gm;
-// Calls like: get("/api/foo", ...) or router.post("/api/foo", ...)
-const JS_ROUTE_RE = /(?:^|\W)(?:(?:[A-Za-z_$][\w$]*)\.)?(get|post|put|patch|delete|any)\s*\(\s*['"]([^'"]+)['"]/g;
-
-function extractJsTs(text: string): FileEntry {
-  const exports: string[] = [];
-  const imports: string[] = [];
-  const routes: FileRoute[] = [];
-  let m: RegExpExecArray | null;
-
-  JS_EXPORT_RE.lastIndex = 0;
-  while ((m = JS_EXPORT_RE.exec(text)) !== null) {
-    if (!exports.includes(m[1])) exports.push(m[1]);
-  }
-  JS_IMPORT_RE.lastIndex = 0;
-  while ((m = JS_IMPORT_RE.exec(text)) !== null) {
-    if (!imports.includes(m[1])) imports.push(m[1]);
+function scoreSearchEntry(query: string, rel: string, entry: FileEntry): number {
+  let score = rel.toLowerCase().includes(query) ? 10 : 0;
+  for (const symbol of entry.symbols || []) {
+    if (query === symbol.toLowerCase()) score += 8;
+    else if (symbol.toLowerCase().includes(query)) score += 4;
   }
-  JS_ROUTE_RE.lastIndex = 0;
-  while ((m = JS_ROUTE_RE.exec(text)) !== null) {
-    const method = m[1].toUpperCase();
-    const routePath = m[2];
-    if (ROUTE_METHODS.has(m[1].toLowerCase()) && !routes.some((r) => r.method === method && r.path === routePath)) {
-      routes.push({ method, path: routePath, handler: "" });
-    }
+  for (const route of entry.routes || []) {
+    if (`${route.path || ""} ${route.handler || ""}`.toLowerCase().includes(query)) score += 5;
   }
-
-  exports.sort();
-  imports.sort();
-  return { exports, imports, routes };
-}
-
-const TWIG_EXTENDS_RE = /\{%\s*extends\s+['"]([^'"]+)['"]\s*%\}/g;
-const TWIG_BLOCK_RE = /\{%\s*block\s+([A-Za-z_][\w-]*)/g;
-const TWIG_INCLUDE_RE = /\{%\s*include\s+['"]([^'"]+)['"]/g;
-
-function extractTwig(text: string): FileEntry {
-  const extendsList: string[] = [];
-  const blocks = new Set<string>();
-  const includes = new Set<string>();
-  let m: RegExpExecArray | null;
-
-  TWIG_EXTENDS_RE.lastIndex = 0;
-  while ((m = TWIG_EXTENDS_RE.exec(text)) !== null) extendsList.push(m[1]);
-  TWIG_BLOCK_RE.lastIndex = 0;
-  while ((m = TWIG_BLOCK_RE.exec(text)) !== null) blocks.add(m[1]);
-  TWIG_INCLUDE_RE.lastIndex = 0;
-  while ((m = TWIG_INCLUDE_RE.exec(text)) !== null) includes.add(m[1]);
-
-  return {
-    extends: extendsList,
-    blocks: Array.from(blocks).sort(),
-    includes: Array.from(includes).sort(),
-  };
-}
-
-const SQL_CREATE_RE = /create\s+(?:unique\s+)?(table|index|view|trigger|sequence|procedure|function)\s+(?:if\s+not\s+exists\s+)?([A-Za-z_][\w.]*)/gi;
-const SQL_ALTER_RE = /alter\s+(table|index|view)\s+([A-Za-z_][\w.]*)/gi;
-
-function extractSql(text: string): FileEntry {
-  const creates: string[] = [];
-  const alters: string[] = [];
-  let m: RegExpExecArray | null;
-  SQL_CREATE_RE.lastIndex = 0;
-  while ((m = SQL_CREATE_RE.exec(text)) !== null) creates.push(`${m[1].toUpperCase()} ${m[2]}`);
-  SQL_ALTER_RE.lastIndex = 0;
-  while ((m = SQL_ALTER_RE.exec(text)) !== null) alters.push(`${m[1].toUpperCase()} ${m[2]}`);
-  return { creates, alters };
-}
-
-const MD_H1_RE = /^#\s+(.+)$/m;
-const MD_H2_RE = /^##\s+(.+)$/gm;
-
-function extractMd(text: string): FileEntry {
-  const h1 = MD_H1_RE.exec(text);
-  const sections: string[] = [];
-  let m: RegExpExecArray | null;
-  MD_H2_RE.lastIndex = 0;
-  while ((m = MD_H2_RE.exec(text)) !== null && sections.length < 30) {
-    sections.push(m[1]);
-  }
-  return { title: (h1 ? h1[1] : "").trim(), sections };
-}
-
-// Python: cheap regex — no AST in Node.js. Good enough for search.
-const PY_CLASS_RE = /^class\s+([A-Za-z_][\w]*)/gm;
-const PY_FUNC_RE = /^(?:async\s+)?def\s+([A-Za-z_][\w]*)/gm;
-const PY_IMPORT_RE = /^(?:from\s+([A-Za-z_][\w.]*)\s+import|import\s+([A-Za-z_][\w.]*))/gm;
-const PY_DECOR_RE = /^@(?:[A-Za-z_][\w]*\.)?(get|post|put|patch|delete|any_method)\s*\(\s*['"]([^'"]+)['"]/gm;
-
-function extractPython(text: string): FileEntry {
-  const symbols: string[] = [];
-  const imports: string[] = [];
-  const routes: FileRoute[] = [];
-  let m: RegExpExecArray | null;
-  PY_CLASS_RE.lastIndex = 0;
-  while ((m = PY_CLASS_RE.exec(text)) !== null) symbols.push(m[1]);
-  PY_FUNC_RE.lastIndex = 0;
-  while ((m = PY_FUNC_RE.exec(text)) !== null) symbols.push(m[1]);
-  PY_IMPORT_RE.lastIndex = 0;
-  while ((m = PY_IMPORT_RE.exec(text)) !== null) imports.push(m[1] || m[2]);
-  PY_DECOR_RE.lastIndex = 0;
-  while ((m = PY_DECOR_RE.exec(text)) !== null) {
-    routes.push({ method: m[1].toUpperCase(), path: m[2], handler: "" });
+  if ((entry.summary || "").toLowerCase().includes(query)) score += 3;
+  for (const imported of entry.imports || []) {
+    if (imported.toLowerCase().includes(query)) score += 1;
   }
-  // Best-effort docstring
-  const doc = text.match(/^\s*"""\s*([^\n]+)/);
-  return {
-    symbols,
-    imports,
-    routes,
-    docstring: doc ? doc[1].trim().slice(0, 200) : "",
-  };
-}
-
-function extractGeneric(text: string): FileEntry {
-  for (const line of text.split(/\r?\n/)) {
-    const s = line.trim();
-    if (!s || s.startsWith("<!--")) continue;
-    return { first_line: s.slice(0, 200) };
-  }
-  return {};
-}
-
-const EXTRACTORS: Record<string, (t: string) => FileEntry> = {
-  ".ts": extractJsTs,
-  ".js": extractJsTs,
-  ".mjs": extractJsTs,
-  ".twig": extractTwig,
-  ".html": extractTwig,
-  ".sql": extractSql,
-  ".md": extractMd,
-  ".py": extractPython,
-};
-
-function languageFor(p: string): string {
-  const ext = path.extname(p);
-  const map: Record<string, string> = {
-    ".py": "python", ".twig": "twig", ".html": "html", ".sql": "sql",
-    ".scss": "scss", ".css": "css", ".js": "javascript", ".mjs": "javascript",
-    ".ts": "typescript", ".md": "markdown", ".json": "json", ".yml": "yaml",
-    ".yaml": "yaml", ".toml": "toml", ".env": "env",
-  };
-  return map[ext] || "text";
-}
-
-function summarise(entry: FileEntry): string {
-  if (entry.skipped) return entry.skipped;
-  if (entry.docstring) return entry.docstring;
-  if (entry.title) return entry.title;
-  if (entry.routes && entry.routes.length) {
-    const r = entry.routes[0];
-    const extra = entry.routes.length > 1 ? ` (+${entry.routes.length - 1} more)` : "";
-    return `${r.method} ${r.path}${extra}`;
-  }
-  if (entry.symbols && entry.symbols.length) {
-    return "defines " + entry.symbols.slice(0, 4).join(", ");
-  }
-  if (entry.exports && entry.exports.length) {
-    return "exports " + entry.exports.slice(0, 4).join(", ");
-  }
-  if (entry.creates && entry.creates.length) {
-    return "schema: " + entry.creates.slice(0, 3).join(", ");
-  }
-  if (entry.extends && entry.extends.length) {
-    return `template, extends ${entry.extends[0]}`;
-  }
-  if (entry.first_line) return entry.first_line;
-  return "";
-}
-
-function extract(fullPath: string): FileEntry {
-  let st: fs.Stats;
-  try {
-    st = fs.statSync(fullPath);
-  } catch {
-    return {};
-  }
-  const entry: FileEntry = {
-    path: path.relative(projectRoot(), fullPath),
-    size: st.size,
-    mtime: Math.floor(st.mtimeMs / 1000),
-    language: languageFor(fullPath),
-  };
-  if (st.size > MAX_FILE_BYTES) {
-    entry.skipped = `too large (${st.size} bytes)`;
-    return entry;
-  }
-  let text: string;
-  try {
-    text = fs.readFileSync(fullPath, "utf-8");
-  } catch {
-    return entry;
-  }
-  entry.sha256 = crypto.createHash("sha256").update(text, "utf-8").digest("hex").slice(0, 16);
-  const extractor = EXTRACTORS[path.extname(fullPath)] || extractGeneric;
-  try {
-    Object.assign(entry, extractor(text));
-  } catch (e) {
-    entry.extraction_error = (e as Error).message.slice(0, 200);
-  }
-  entry.summary = summarise(entry);
-  return entry;
-}
-
-function walk(dir: string, out: string[]): void {
-  let entries: fs.Dirent[];
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const e of entries) {
-    if (e.isDirectory()) {
-      if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
-      walk(path.join(dir, e.name), out);
-    } else if (e.isFile()) {
-      if (e.name.startsWith(".") && e.name !== ".env") continue;
-      const ext = path.extname(e.name);
-      if (!INDEX_EXT.has(ext) && e.name !== ".env") continue;
-      out.push(path.join(dir, e.name));
-    }
-  }
-}
-
-function loadRaw(): IndexData {
-  const p = indexPath();
-  if (!fs.existsSync(p)) return { version: 1, files: {}, generated_at: 0 };
-  try {
-    return JSON.parse(fs.readFileSync(p, "utf-8")) as IndexData;
-  } catch {
-    return { version: 1, files: {}, generated_at: 0 };
-  }
-}
-
-function saveRaw(data: IndexData): void {
-  data.generated_at = Math.floor(Date.now() / 1000);
-  fs.writeFileSync(indexPath(), JSON.stringify(data, null, 2), "utf-8");
+  return score;
 }
 
 export const ProjectIndex = {
@@ -370,19 +109,7 @@ export const ProjectIndex = {
     if (!q) return [];
     const hits: Array<[number, { path: string; summary: string; score: number; language: string }]> = [];
     for (const [rel, entry] of Object.entries(data.files)) {
-      let score = 0;
-      if (rel.toLowerCase().includes(q)) score += 10;
-      for (const s of entry.symbols || []) {
-        if (q === s.toLowerCase()) score += 8;
-        else if (s.toLowerCase().includes(q)) score += 4;
-      }
-      for (const r of entry.routes || []) {
-        if (`${r.path || ""} ${r.handler || ""}`.toLowerCase().includes(q)) score += 5;
-      }
-      if ((entry.summary || "").toLowerCase().includes(q)) score += 3;
-      for (const imp of entry.imports || []) {
-        if (imp.toLowerCase().includes(q)) score += 1;
-      }
+      const score = scoreSearchEntry(q, rel, entry);
       if (score > 0) {
         hits.push([
           score,