@akasecurity/cli 0.9.5 → 0.9.6

package/dist/cli.js

@@ -854,7 +854,7 @@ var updateCodexPlugin = manager2.update;
 
 // ../packages/local-ops/src/egress-record.ts
 import { statSync as statSync7 } from "fs";
-import { dirname as dirname5, relative as relative2, resolve } from "path";
+import { dirname as dirname5, relative, resolve } from "path";
 
 // ../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -2263,6 +2263,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -2273,10 +2307,17 @@ var KeywordMatcher = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -2292,7 +2333,10 @@ var RegexMatcher = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -2400,11 +2444,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -30956,7 +31004,7 @@ function resolveNonGitProject(startDir, recognizeMarker) {
 // ../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
-import { basename as basename5, join as join13, relative, sep as sep4 } from "path";
+import { basename as basename5, join as join13 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -30974,23 +31022,28 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".cache"
 ]);
 var MAX_FILES = 2e4;
-function readIgnoreLayer(dir) {
+function readIgnoreLayer(dir, anchorLen) {
   try {
     const content = readFileSync9(join13(dir, ".gitignore"), "utf8");
-    return { base: dir, matcher: (0, import_ignore.default)().add(content) };
+    return { matcher: (0, import_ignore.default)().add(content), anchorLen };
   } catch {
     return void 0;
   }
 }
-function isIgnored(layers, absPath, isDir) {
-  let ignored = false;
-  for (const layer of layers) {
-    const rel = relative(layer.base, absPath).split(sep4).join("/") + (isDir ? "/" : "");
-    const verdict = layer.matcher.test(rel);
-    if (verdict.ignored) ignored = true;
-    else if (verdict.unignored) ignored = false;
+function relToAnchor(dirRel, anchorLen, name) {
+  if (anchorLen === dirRel.length) return name;
+  return `${dirRel.slice(anchorLen === 0 ? 0 : anchorLen + 1)}/${name}`;
+}
+function isIgnored(layers, dirRel, name, isDir) {
+  const suffix = isDir ? "/" : "";
+  for (let i = layers.length - 1; i >= 0; i--) {
+    const layer = layers[i];
+    if (layer === void 0) continue;
+    const verdict = layer.matcher.test(relToAnchor(dirRel, layer.anchorLen, name) + suffix);
+    if (verdict.ignored) return true;
+    if (verdict.unignored) return false;
   }
-  return ignored;
+  return false;
 }
 var GENERATED_FILES = /* @__PURE__ */ new Set([
   "pnpm-lock.yaml",
@@ -31043,7 +31096,7 @@ function classifyOrigin(relPath, name) {
 }
 function resolveProjectFiles(cwd) {
   try {
-    let visit3 = function(dir, layers) {
+    let visit3 = function(dir, dirRel, layers) {
       let dirents;
       try {
         dirents = readdirSync5(dir, { withFileTypes: true, encoding: "utf8" });
@@ -31051,21 +31104,22 @@ function resolveProjectFiles(cwd) {
         walk.lostSubtree = true;
         return false;
       }
-      const layer = readIgnoreLayer(dir);
+      const layer = readIgnoreLayer(dir, dirRel.length);
       const dirLayers = layer ? [...layers, layer] : layers;
       for (const entry of dirents) {
-        const fullPath = join13(dir, entry.name);
         if (entry.isDirectory()) {
-          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
+          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
+          const fullPath = join13(dir, entry.name);
           if (existsSync9(join13(fullPath, ".git"))) continue;
-          if (visit3(fullPath, dirLayers)) return true;
+          const childRel = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
+          if (visit3(fullPath, childRel, dirLayers)) return true;
           continue;
         }
         if (!entry.isFile()) continue;
         if (entry.name === ".git") continue;
-        if (isIgnored(dirLayers, fullPath, false)) continue;
+        if (isIgnored(dirLayers, dirRel, entry.name, false)) continue;
         if (files.length >= MAX_FILES) return true;
-        const relPath = relative(root, fullPath).split(sep4).join("/");
+        const relPath = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
         files.push({
           path: relPath,
           name: basename5(entry.name),
@@ -31082,7 +31136,7 @@ function resolveProjectFiles(cwd) {
     const isLinkedCheckout = resolveHeadRoot(cwd) !== worktree;
     const files = [];
     const walk = { lostSubtree: false };
-    const truncated = visit3(root, []) || walk.lostSubtree || isLinkedCheckout;
+    const truncated = visit3(root, "", []) || walk.lostSubtree || isLinkedCheckout;
     if (files.length === 0) return void 0;
     files.sort((a, b) => a.path.localeCompare(b.path));
     return { files, truncated, scannedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -31154,7 +31208,7 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
     }
     const files = [];
     for (const hit of egress.files) {
-      const file2 = toPosix(relative2(root, hit.file));
+      const file2 = toPosix(relative(root, hit.file));
       if (file2 === "" || file2.startsWith("../")) continue;
       if (file2.startsWith(".") || file2.includes("/.")) continue;
       files.push({ ...hit, file: file2, vendored: isVendoredPath(file2) });
@@ -31163,7 +31217,7 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
       projectKey,
       project,
       projectId,
-      reconcile: { mode: "walk", walkedPrefix: toPosix(relative2(root, abs)) },
+      reconcile: { mode: "walk", walkedPrefix: toPosix(relative(root, abs)) },
       hits: resolveEgress(files)
     });
     return { ...summary, project };
@@ -31175,7 +31229,7 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
 // ../packages/local-ops/src/fs-scan.ts
 import { createHash as createHash5, randomUUID as randomUUID15 } from "crypto";
 import { readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync8 } from "fs";
-import { basename as basename6, extname, join as join15, relative as relative3, resolve as resolve2 } from "path";
+import { basename as basename6, extname, join as join15, relative as relative2, resolve as resolve2 } from "path";
 var import_ignore2 = __toESM(require_ignore(), 1);
 var AKAIGNORE_FILENAME = ".akaignore";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
@@ -31200,7 +31254,7 @@ function readIgnoreLayer2(dir, filename) {
 function evaluate(layers, absPath, isDir) {
   let state = "unmatched";
   for (const layer of layers) {
-    const rel = toPosix(relative3(layer.base, absPath)) + (isDir ? "/" : "");
+    const rel = toPosix(relative2(layer.base, absPath)) + (isDir ? "/" : "");
     const verdict = layer.matcher.test(rel);
     if (verdict.ignored) state = "ignored";
     else if (verdict.unignored) state = "unignored";
@@ -31777,12 +31831,19 @@ import { parseArgs as parseArgs2 } from "util";
 
 // src/lib/open-url.ts
 import { spawn as spawn2 } from "child_process";
-function openUrl(url2) {
-  const platform2 = process.platform;
-  const command = platform2 === "darwin" ? "open" : platform2 === "win32" ? "cmd" : "xdg-open";
-  const args = platform2 === "win32" ? ["/c", "start", "", url2] : [url2];
+function openUrlCommand(platform2, url2) {
+  if (platform2 === "darwin") return { command: "open", args: [url2] };
+  if (platform2 === "win32") return { command: "cmd", args: ["/c", "start", "", url2] };
+  return { command: "xdg-open", args: [url2] };
+}
+var DETACHED = Object.freeze({ stdio: "ignore", detached: true });
+function openUrl(url2, deps = {}) {
+  const { command, args } = openUrlCommand(deps.platform ?? process.platform, url2);
   try {
-    spawn2(command, args, { stdio: "ignore", detached: true }).unref();
+    const child = (deps.spawn ?? spawn2)(command, [...args], DETACHED);
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }
@@ -32126,18 +32187,36 @@ function processHiddenChar(state, ch) {
   return { ...state, value: state.value + ch };
 }
 var CLEANUP_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
-function terminalPrompter() {
+function processIo() {
+  return {
+    input: process.stdin,
+    output: process.stdout,
+    errorOutput: process.stderr,
+    signals: {
+      once: (signal, handler) => {
+        process.once(signal, handler);
+      },
+      off: (signal, handler) => {
+        process.removeListener(signal, handler);
+      },
+      raise: (signal) => {
+        process.kill(process.pid, signal);
+      }
+    }
+  };
+}
+function terminalPrompter(io = processIo()) {
   return {
     out: (text) => {
-      process.stdout.write(text);
+      io.output.write(text);
     },
     err: (text) => {
-      process.stderr.write(text);
+      io.errorOutput.write(text);
     },
-    isInteractive: process.stdin.isTTY && process.stdout.isTTY,
+    isInteractive: io.input.isTTY && io.output.isTTY,
     ask(question) {
       return new Promise((resolve6) => {
-        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        const rl = createInterface({ input: io.input, output: io.output });
         rl.question(question, (answer) => {
           rl.close();
           resolve6(answer);
@@ -32152,8 +32231,8 @@ function terminalPrompter() {
     // invoked from.
     askHidden(question) {
       return new Promise((resolve6, reject) => {
-        const stdin = process.stdin;
-        process.stdout.write(question);
+        const stdin = io.input;
+        io.output.write(question);
         stdin.setRawMode(true);
         stdin.resume();
         let state = { value: "", esc: "none" };
@@ -32163,7 +32242,7 @@ function terminalPrompter() {
           restored = true;
           stdin.removeListener("data", onData);
           stdin.removeListener("error", onError);
-          for (const sig of CLEANUP_SIGNALS) process.removeListener(sig, onSignal);
+          for (const sig of CLEANUP_SIGNALS) io.signals.off(sig, onSignal);
           try {
             stdin.setRawMode(false);
           } catch {
@@ -32172,7 +32251,7 @@ function terminalPrompter() {
         };
         const finish = (err) => {
           restore();
-          process.stdout.write("\n");
+          io.output.write("\n");
           if (err) reject(err);
           else resolve6(state.value);
         };
@@ -32181,7 +32260,7 @@ function terminalPrompter() {
         };
         const onSignal = (sig) => {
           restore();
-          process.kill(process.pid, sig);
+          io.signals.raise(sig);
         };
         const onData = (chunk) => {
           try {
@@ -32202,12 +32281,12 @@ function terminalPrompter() {
         };
         stdin.on("data", onData);
         stdin.once("error", onError);
-        for (const sig of CLEANUP_SIGNALS) process.once(sig, onSignal);
+        for (const sig of CLEANUP_SIGNALS) io.signals.once(sig, onSignal);
       });
     },
     async readAllStdin() {
       const chunks = [];
-      for await (const chunk of process.stdin) {
+      for await (const chunk of io.input) {
         chunks.push(chunk);
       }
       return Buffer.concat(chunks).toString("utf8");

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "AI Traffic Control",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Local secret detection and redaction for ChatGPT and Claude.ai web chat.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqnwx5Snbi3oZ7mDBC78NaTHO6dTKYRtCqr29YnOImR47UM21tP1us3KF6FjQMtR6tAsffflRok1PThQpjBNwYdRM+stvPIUr5GqBRQL1Ge///kZaVz7eCptCjKg00ygk2HwelaCNt6nWy6czIcM3/HssrNflw42IKsBORW7qQ+KhhKqlABjkRUDvBcuhwOU34HHMJxeP2XdyI5T5msqVJN1nVA+X9T/18dP7cCSzkp9RwLN1hvQMS6n3A1R0HUCmfra1lb1KqQhy3EBdm2VwxTDGVPfGYbTdNSyRT70wzcZy1IdQkfT6YOy1M//+yT7Vu9p/aajs+dNNn/zUn0qJyQIDAQAB",
   "icons": {

package/native-host/host.js

@@ -26197,6 +26197,40 @@ function escapeRegExp2(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../../packages/detections/src/regex-cache.ts
+var singles = /* @__PURE__ */ new WeakMap();
+var keywordLists = /* @__PURE__ */ new WeakMap();
+var labelLists = /* @__PURE__ */ new WeakMap();
+function listCache(kind) {
+  return kind === "keyword" ? keywordLists : labelLists;
+}
+function memoizedRegExp(owner, build) {
+  const cached2 = singles.get(owner);
+  if (cached2 !== void 0) {
+    cached2.lastIndex = 0;
+    return cached2;
+  }
+  const compiled = build();
+  singles.set(owner, compiled);
+  return compiled;
+}
+function memoizedRegExpList(kind, owner, build) {
+  const cache = listCache(kind);
+  const cached2 = cache.get(owner);
+  if (cached2 !== void 0) {
+    if (cached2.stateful) {
+      for (const re of cached2.entries) if (re !== void 0) re.lastIndex = 0;
+    }
+    return cached2.entries;
+  }
+  const entries = build();
+  cache.set(owner, {
+    entries,
+    stateful: entries.some((re) => re !== void 0 && (re.global || re.sticky))
+  });
+  return entries;
+}
+
 // ../../packages/detections/src/matchers/limits.ts
 var MAX_MATCHES_PER_RULE = 1e4;
 var MAX_REGEX_INPUT_LENGTH = 2e5;
@@ -26207,10 +26241,17 @@ var KeywordMatcher2 = class {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
     const spans = [];
-    for (const kw of keywords) {
-      if (kw.length === 0) continue;
+    const compiled = memoizedRegExpList(
+      "keyword",
+      rule.matcher,
+      () => keywords.map((kw) => {
+        if (kw.length === 0) return void 0;
+        return new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
+      })
+    );
+    for (const re of compiled) {
+      if (re === void 0) continue;
       if (spans.length >= MAX_MATCHES_PER_RULE) break;
-      const re = new RegExp(escapeRegExp2(kw), caseSensitive ? "gu" : "giu");
       let m;
       while ((m = re.exec(text)) !== null) {
         spans.push({ start: m.index, end: m.index + m[0].length });
@@ -26226,7 +26267,10 @@ var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
     const { pattern, flags, captureGroup } = rule.matcher;
-    const re = new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`);
+    const re = memoizedRegExp(
+      rule.matcher,
+      () => new RegExp(pattern, flags.includes("d") ? flags : `${flags}d`)
+    );
     const scanText2 = text.length > MAX_REGEX_INPUT_LENGTH ? text.slice(0, MAX_REGEX_INPUT_LENGTH) : text;
     const spans = [];
     let m;
@@ -26334,11 +26378,15 @@ function isCorroborated(candidate, candidates, text) {
   const labels = req.labels;
   if (labels && labels.length > 0) {
     const haystack = text.slice(Math.max(0, winStart), winEnd);
-    for (const label of labels) {
-      const trimmed = label.trim();
-      if (trimmed.length === 0) continue;
-      const re = new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
-      if (re.test(haystack)) return true;
+    for (const re of memoizedRegExpList(
+      "label",
+      req,
+      () => labels.map((label) => {
+        const trimmed = label.trim();
+        return trimmed.length === 0 ? void 0 : new RegExp(`(?<![A-Za-z0-9])${escapeRegExp2(trimmed)}(?![A-Za-z0-9])`, "i");
+      })
+    )) {
+      if (re?.test(haystack)) return true;
     }
   }
   return false;
@@ -26688,13 +26736,14 @@ function probesFor(rule) {
   const derived = rule.matcher.type === "regex" ? derivedProbes(rule.matcher.pattern) : [];
   return [...derived, ...EXPONENTIAL_PROBES, ...POLYNOMIAL_PROBES];
 }
-function worstProbeMs(rule) {
+var wallClock = () => performance.now();
+function worstProbeMs(rule, now = wallClock) {
   let ms = 0;
   let probe = "";
   for (const text of probesFor(rule)) {
-    const start = performance.now();
+    const start = now();
     scan(text, [rule]);
-    const elapsed = performance.now() - start;
+    const elapsed = now() - start;
     if (elapsed > ms) {
       ms = elapsed;
       probe = text;
@@ -29252,10 +29301,10 @@ function parseFrontmatter(raw) {
   if (lines[0]?.trim() !== "---") return out;
   for (const line of lines.slice(1)) {
     if (line.trim() === "---") break;
-    const sep5 = line.indexOf(":");
-    if (sep5 === -1) continue;
-    const key = line.slice(0, sep5).trim();
-    const value = line.slice(sep5 + 1).trim().replace(/^['"]|['"]$/g, "");
+    const sep4 = line.indexOf(":");
+    if (sep4 === -1) continue;
+    const key = line.slice(0, sep4).trim();
+    const value = line.slice(sep4 + 1).trim().replace(/^['"]|['"]$/g, "");
     if (value === "") continue;
     if (key === "name") out.name = value;
     else if (key === "description") out.description = value;
@@ -29941,7 +29990,7 @@ import { basename as basename5, dirname as dirname3, sep as sep3 } from "path";
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename6, join as join12, relative, sep as sep4 } from "path";
+import { basename as basename6, join as join12 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -29959,23 +30008,28 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".cache"
 ]);
 var MAX_FILES = 2e4;
-function readIgnoreLayer(dir) {
+function readIgnoreLayer(dir, anchorLen) {
   try {
     const content = readFileSync8(join12(dir, ".gitignore"), "utf8");
-    return { base: dir, matcher: (0, import_ignore.default)().add(content) };
+    return { matcher: (0, import_ignore.default)().add(content), anchorLen };
   } catch {
     return void 0;
   }
 }
-function isIgnored(layers, absPath, isDir) {
-  let ignored = false;
-  for (const layer of layers) {
-    const rel = relative(layer.base, absPath).split(sep4).join("/") + (isDir ? "/" : "");
-    const verdict = layer.matcher.test(rel);
-    if (verdict.ignored) ignored = true;
-    else if (verdict.unignored) ignored = false;
+function relToAnchor(dirRel, anchorLen, name) {
+  if (anchorLen === dirRel.length) return name;
+  return `${dirRel.slice(anchorLen === 0 ? 0 : anchorLen + 1)}/${name}`;
+}
+function isIgnored(layers, dirRel, name, isDir) {
+  const suffix = isDir ? "/" : "";
+  for (let i = layers.length - 1; i >= 0; i--) {
+    const layer = layers[i];
+    if (layer === void 0) continue;
+    const verdict = layer.matcher.test(relToAnchor(dirRel, layer.anchorLen, name) + suffix);
+    if (verdict.ignored) return true;
+    if (verdict.unignored) return false;
   }
-  return ignored;
+  return false;
 }
 var GENERATED_FILES = /* @__PURE__ */ new Set([
   "pnpm-lock.yaml",
@@ -30028,7 +30082,7 @@ function classifyOrigin(relPath, name) {
 }
 function resolveProjectFiles(cwd) {
   try {
-    let visit2 = function(dir, layers) {
+    let visit2 = function(dir, dirRel, layers) {
       let dirents;
       try {
         dirents = readdirSync4(dir, { withFileTypes: true, encoding: "utf8" });
@@ -30036,21 +30090,22 @@ function resolveProjectFiles(cwd) {
         walk.lostSubtree = true;
         return false;
       }
-      const layer = readIgnoreLayer(dir);
+      const layer = readIgnoreLayer(dir, dirRel.length);
       const dirLayers = layer ? [...layers, layer] : layers;
       for (const entry of dirents) {
-        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
-          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
+          if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, dirRel, entry.name, true)) continue;
+          const fullPath = join12(dir, entry.name);
           if (existsSync8(join12(fullPath, ".git"))) continue;
-          if (visit2(fullPath, dirLayers)) return true;
+          const childRel = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
+          if (visit2(fullPath, childRel, dirLayers)) return true;
           continue;
         }
         if (!entry.isFile()) continue;
         if (entry.name === ".git") continue;
-        if (isIgnored(dirLayers, fullPath, false)) continue;
+        if (isIgnored(dirLayers, dirRel, entry.name, false)) continue;
         if (files.length >= MAX_FILES) return true;
-        const relPath = relative(root, fullPath).split(sep4).join("/");
+        const relPath = dirRel === "" ? entry.name : `${dirRel}/${entry.name}`;
         files.push({
           path: relPath,
           name: basename6(entry.name),
@@ -30067,7 +30122,7 @@ function resolveProjectFiles(cwd) {
     const isLinkedCheckout = resolveHeadRoot(cwd) !== worktree;
     const files = [];
     const walk = { lostSubtree: false };
-    const truncated = visit2(root, []) || walk.lostSubtree || isLinkedCheckout;
+    const truncated = visit2(root, "", []) || walk.lostSubtree || isLinkedCheckout;
     if (files.length === 0) return void 0;
     files.sort((a, b) => a.path.localeCompare(b.path));
     return { files, truncated, scannedAt: (/* @__PURE__ */ new Date()).toISOString() };