@akasecurity/ai-tc-claude-code 0.9.5 → 0.9.6

package/scripts/reconcile.js

@@ -26963,6 +26963,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26973,10 +27007,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26992,7 +27033,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -27100,11 +27144,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -29547,7 +29595,7 @@ import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+import { basename as basename5, join as join12 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -30202,7 +30250,7 @@ var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/remediation/redact.ts
 import { readFileSync as readFileSync10, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve } from "path";
+import { isAbsolute as isAbsolute2, relative, resolve } from "path";
 
 // src/history/transcripts.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
@@ -30426,7 +30474,7 @@ function realPathOrNull(path) {
 function isWithinRoot(realTarget, root) {
   const realRoot = realPathOrNull(root);
   if (realRoot === null) return false;
-  const rel = relative2(realRoot, realTarget);
+  const rel = relative(realRoot, realTarget);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function resolveRedactableArtifact(filePath, scope) {

package/scripts/remediate.js

@@ -26961,6 +26961,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26971,10 +27005,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26990,7 +27031,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -27098,11 +27142,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -27370,13 +27418,14 @@ function probesFor(rule) {
   const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
   return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
 }
-function worstProbeMs(rule) {
+var wallClock = () => performance.now();
+function worstProbeMs(rule, now = wallClock) {
   let ms = 0;
   let probe = "";
   for (const text of probesFor(rule)) {
-    const start = performance.now();
+    const start = now();
     scan(text, [rule]);
-    const elapsed = performance.now() - start;
+    const elapsed = now() - start;
     if (elapsed > ms) {
       ms = elapsed;
       probe = text;
@@ -30011,7 +30060,7 @@ function applyCategoryPosture(posture, repo, mode = "fill-gaps") {
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+import { basename as basename5, join as join12 } from "path";
 
 // ../../packages/plugin-sdk/src/provider-env-antigravity.ts
 var optionalBaseUrl2 = external_exports.preprocess((v) => {
@@ -31084,8 +31133,8 @@ function table(headers, rows, opts = {}) {
   const widths = headers.map(
     (h, i) => Math.max(visibleLength(h), ...rows.map((r) => visibleLength(r[i] ?? "")))
   );
-  const sep5 = " ".repeat(gap);
-  const fmt = (cells) => cells.map((cell, i) => padEnd(cell, widths[i] ?? 0)).join(sep5);
+  const sep4 = " ".repeat(gap);
+  const fmt = (cells) => cells.map((cell, i) => padEnd(cell, widths[i] ?? 0)).join(sep4);
   const headerLine = fmt(headers.map((h) => h.toUpperCase()));
   if (opts.rowSep === true) {
     const fullWidth = widths.reduce((n, w) => n + w, 0) + gap * Math.max(0, widths.length - 1);
@@ -31097,7 +31146,7 @@ function table(headers, rows, opts = {}) {
     });
     return [headerLine, rule, ...body].join("\n");
   }
-  const ruleLine = widths.map((w) => "\u2500".repeat(w)).join(sep5);
+  const ruleLine = widths.map((w) => "\u2500".repeat(w)).join(sep4);
   return [headerLine, ruleLine, ...rows.map(fmt)].join("\n");
 }
 function fenced(body) {
@@ -31472,7 +31521,7 @@ var DAY_MS5 = 24 * 60 * 60 * 1e3;
 
 // src/remediation/redact.ts
 import { readFileSync as readFileSync11, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve } from "path";
+import { isAbsolute as isAbsolute2, relative, resolve } from "path";
 var REDACTED_PLACEHOLDER = "[REDACTED:SECRET]";
 var REPLACE_PATTERN_SEQUENCE = /\$[$&`'<0-9]/;
 function replacementFor(rawValue, replacements) {
@@ -31495,7 +31544,7 @@ function realPathOrNull(path) {
 function isWithinRoot(realTarget, root) {
   const realRoot = realPathOrNull(root);
   if (realRoot === null) return false;
-  const rel = relative2(realRoot, realTarget);
+  const rel = relative(realRoot, realTarget);
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function resolveRedactableArtifact(filePath, scope) {

package/scripts/scan-worker.js

@@ -579,6 +579,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -589,10 +623,17 @@ var KeywordMatcher = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -608,7 +649,10 @@ var RegexMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -713,11 +757,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -17951,13 +17999,14 @@ function probesFor(rule) {
   const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
   return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
 }
-function worstProbeMs(rule) {
+var wallClock = () => performance.now();
+function worstProbeMs(rule, now = wallClock) {
   let ms = 0;
   let probe = "";
   for (const text of probesFor(rule)) {
-    const start = performance.now();
+    const start = now();
     scan(text, [rule]);
-    const elapsed = performance.now() - start;
+    const elapsed = now() - start;
     if (elapsed > ms) {
       ms = elapsed;
       probe = text;

package/scripts/session-start.js

@@ -26053,6 +26053,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26063,10 +26097,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26082,7 +26123,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -26190,11 +26234,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -29027,10 +29075,10 @@ function parseFrontmatter(raw) {
   if (lines[0]?.trim() !== "---") return out;
   for (const line of lines.slice(1)) {
     if (line.trim() === "---") break;
-    const sep5 = line.indexOf(":");
-    if (sep5 === -1) continue;
-    const key = line.slice(0, sep5).trim();
-    const value = line.slice(sep5 + 1).trim().replace(/^['"]|['"]$/g, "");
+    const sep4 = line.indexOf(":");
+    if (sep4 === -1) continue;
+    const key = line.slice(0, sep4).trim();
+    const value = line.slice(sep4 + 1).trim().replace(/^['"]|['"]$/g, "");
     if (value === "") continue;
     if (key === "name") out.name = value;
     else if (key === "description") out.description = value;
@@ -29249,7 +29297,7 @@ import { basename as basename5, dirname as dirname3, sep as sep3 } from "path";
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename6, join as join12, relative, sep as sep4 } from "path";
+import { basename as basename6, join as join12 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -29267,23 +29315,28 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".cache"
 ]);
 var MAX_FILES = 2e4;
-function readIgnoreLayer(dir) {
+function readIgnoreLayer(dir, anchorLen) {
   try {
     const content = readFileSync8(join12(dir, ".gitignore"), "utf8");
-    return { base: dir, matcher: (0, import_ignore.default)().add(content) };
+    return { matcher: (0, import_ignore.default)().add(content), anchorLen };
   } catch {
     return void 0;
   }
 }
-function isIgnored(layers, absPath, isDir) {
-  let ignored = false;
-  for (const layer of layers) {
-    const rel = relative(layer.base, absPath).split(sep4).join("/") + (isDir ? "/" : "");
-    const verdict = layer.matcher.test(rel);
-    if (verdict.ignored) ignored = true;
-    else if (verdict.unignored) ignored = false;
+function relToAnchor(dirRel, anchorLen, name) {
+  if (anchorLen === dirRel.length) return name;
+  return `${dirRel.slice(anchorLen === 0 ? 0 : anchorLen + 1)}/${name}`;
+}
+function isIgnored(layers, dirRel, name, isDir) {
+  const suffix = isDir ? "/" : "";
+  for (let i = layers.length - 1; i >= 0; i--) {
+    const layer = layers[i];
+    if (layer === void 0) continue;
+    const verdict = layer.matcher.test(relToAnchor(dirRel, layer.anchorLen, name) + suffix);
+    if (verdict.ignored) return true;
+    if (verdict.unignored) return false;
   }
-  return ignored;
+  return false;
 }
 var GENERATED_FILES = /* @__PURE__ */ new Set([
   "pnpm-lock.yaml",
@@ -29336,7 +29389,7 @@ function classifyOrigin(relPath, name) {
 }
 function resolveProjectFiles(cwd) {
   try {
-    let visit2 = function(dir, layers) {
+    let visit2 = function(dir, dirRel, layers) {
       let dirents;
       try {
         dirents = readdirSync4(dir, { withFileTypes: true, encoding: "utf8" });
@@ -29344,21 +29397,22 @@ function resolveProjectFiles(cwd) {
         walk.lostSubtree = true;
         return false;
       }
-      const layer = readIgnoreLayer(dir);
+      const layer = readIgnoreLayer(dir, dirRel.length);
       const dirLayers = layer ? [...layers, layer] : layers;
       for (const entry of dirents) {
-        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
-          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
+          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
+          const fullPath = join12(dir, entry.name);
           if (existsSync8(join12(fullPath, ".git"))) continue;
-          if (visit2(fullPath, dirLayers)) return true;
+          const childRel = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
+          if (visit2(fullPath, childRel, dirLayers)) return true;
           continue;
         }
         if (!entry.isFile()) continue;
         if (entry.name === ".git") continue;
-        if (isIgnored(dirLayers, fullPath, false)) continue;
+        if (isIgnored(dirLayers, dirRel, entry.name, false)) continue;
         if (files.length >= MAX_FILES) return true;
-        const relPath = relative(root, fullPath).split(sep4).join("/");
+        const relPath = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
         files.push({
           path: relPath,
           name: basename6(entry.name),
@@ -29375,7 +29429,7 @@ function resolveProjectFiles(cwd) {
     const isLinkedCheckout = resolveHeadRoot(cwd) !== worktree;
     const files = [];
     const walk = { lostSubtree: false };
-    const truncated = visit2(root, []) || walk.lostSubtree || isLinkedCheckout;
+    const truncated = visit2(root, "", []) || walk.lostSubtree || isLinkedCheckout;
     if (files.length === 0) return void 0;
     files.sort((a, b) => a.path.localeCompare(b.path));
     return { files, truncated, scannedAt: (/* @__PURE__ */ new Date()).toISOString() };