@basein/runner 0.3.1 → 0.3.3

package/dist/replay/builtins.js

@@ -0,0 +1,674 @@
+/**
+ * builtins — running a scenario's built-in steps (`Read`, `Glob`, `Grep`,
+ * `Edit`, `Write`, `Bash`) on the runner itself (docs/calculatedReplay.md §5).
+ *
+ * A built-in lives inside the host session, not behind any MCP server, so there
+ * is no proxy to relay it to: historically every built-in step threw `not_run`
+ * and the plan handed the task back to the model. This module is the other
+ * option: execute the step here, against the *session's own project directory*,
+ * so a chain that starts with a `Read` no longer costs a hand-over.
+ *
+ * THE RULES, because this bypasses the host's permission prompts entirely:
+ *
+ *   - **Default deny beyond read-only.** Which built-ins may run at all is
+ *     `BIR_BUILTIN_TOOLS` ({@link parseBuiltinTools}), and its default is the
+ *     read-only set (`Read,Glob,Grep`). `Edit`, `Write` and `Bash` are an
+ *     explicit, per-environment opt-in — a recorded `rm` must never run
+ *     because a prompt looked similar.
+ *   - **Path jail.** Every path is resolved against, and confined to, the
+ *     session's project directory ({@link jailed}), symlinks included. The
+ *     daemon's own cwd is never used: it is `~/.baseinstrunner`, not the
+ *     project (§5.1 of the change plan).
+ *   - **Bash runs nothing unless `BIR_BASH_ALLOW` says so.** A command must
+ *     match one of its prefixes ({@link bashAllowed}); unset means `Bash`
+ *     never executes here, even when allow-listed.
+ *   - **Same failure contract as an MCP step.** A step that *cannot* run here
+ *     throws {@link BuiltinNotRunnable} (→ `not_run`: the session can still do
+ *     it, or a recorded output may stand in under
+ *     `BIR_REPLAY_RECORDED_OUTPUTS=1`). One that ran out of time throws
+ *     {@link BuiltinTimeout} (→ `uncertain`). Any other throw is a step that
+ *     ran and failed (→ `failed`), never silently threaded as a success.
+ *
+ * Outputs mimic the **hook view** of each tool — Claude Code's `tool_response`
+ * as `PostToolUse` reports it — because that is exactly what the recorder
+ * stored for built-in steps (control/server.ts, `onToolPost`) and therefore
+ * what each step's `toolOutputLogic` was authored against. The shapes are a
+ * best effort and may drift from a future host's, the same caveat the
+ * hook-view threading fallback already carries ("shapes may differ").
+ */
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+// ── configuration ────────────────────────────────────────────────────────────
+/**
+ * The built-ins bir may stand in for or execute when `BIR_BUILTIN_TOOLS` is
+ * unset: the read-only set. Reading a file the session itself would read
+ * without a prompt is the risk floor; anything that writes or runs is not.
+ */
+export const DEFAULT_BUILTIN_TOOLS = ["Read", "Glob", "Grep"];
+/** The built-ins {@link runBuiltin} actually implements. */
+export const EXECUTABLE_BUILTINS = new Set([
+    "Read",
+    "Glob",
+    "Grep",
+    "Edit",
+    "Write",
+    "Bash",
+]);
+/** `read` → `Read`: the vocabulary is small enough to forgive casing. */
+const CANONICAL_BUILTIN = new Map([...EXECUTABLE_BUILTINS].map((name) => [name.toLowerCase(), name]));
+/**
+ * Parse `BIR_BUILTIN_TOOLS`. Unset means {@link DEFAULT_BUILTIN_TOOLS}; set,
+ * it is the whole list — `none` (or an empty value) turns built-ins off
+ * entirely. Unlike `BIR_REPLAY_ALLOW_SERVERS`, an explicit empty list is
+ * honoured: there is a non-empty default to fall back from, so emptiness here
+ * is a choice, not an accident.
+ */
+export function parseBuiltinTools(value) {
+    if (value === undefined)
+        return new Set(DEFAULT_BUILTIN_TOOLS);
+    const names = value
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0 && !["none", "off", "0"].includes(s.toLowerCase()))
+        .map((s) => CANONICAL_BUILTIN.get(s.toLowerCase()) ?? s);
+    return new Set(names);
+}
+/**
+ * Parse `BIR_BASH_ALLOW`: comma-separated command prefixes, `*` for
+ * everything. Undefined (unset or blank) means `Bash` never executes on the
+ * runner — the flag is the opt-in, exactly like the tool list itself.
+ */
+export function parseBashAllow(value) {
+    const prefixes = (value ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return prefixes.length > 0 ? prefixes : undefined;
+}
+/**
+ * Whether `command` matches the `BIR_BASH_ALLOW` prefixes. A prefix that ends
+ * mid-word must end the command's word too: `git` allows `git status` and
+ * `git`, never `gitk` — an operator who wrote `git` meant git, and the
+ * trimming in {@link parseBashAllow} must not widen that.
+ */
+export function bashAllowed(command, allow) {
+    if (!allow)
+        return false;
+    const trimmed = command.trimStart();
+    const word = /[A-Za-z0-9_-]/;
+    return allow.some((prefix) => {
+        if (prefix === "*")
+            return true;
+        if (!trimmed.startsWith(prefix))
+            return false;
+        const next = trimmed.charAt(prefix.length);
+        return next === "" || !word.test(next) || !word.test(prefix.charAt(prefix.length - 1));
+    });
+}
+// ── the failure contract ─────────────────────────────────────────────────────
+/**
+ * The step cannot run here — policy, not breakage: the tool is not
+ * implemented, its path leaves the project, `Bash` is not allowed, or the
+ * input is not even the right shape. Maps to `not_run`: nothing happened, the
+ * session may still do it, a recorded output may stand in.
+ */
+export class BuiltinNotRunnable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BuiltinNotRunnable";
+    }
+}
+/**
+ * The step started and was cut off by its clock. For `Bash` the command may
+ * have done part of its work; for a walk there is simply no result. Either
+ * way nothing may be asserted, which is `uncertain` — the same word an MCP
+ * step's timeout gets.
+ */
+export class BuiltinTimeout extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BuiltinTimeout";
+    }
+}
+// ── size caps ────────────────────────────────────────────────────────────────
+// The results flow through the same `serializeCapped(redact(...))` as every
+// recorded payload, so these caps are about the daemon's memory and time, not
+// about what reaches the service.
+/** The most of one file a `Read`/`Edit` loads. */
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+/** `Read` line clamp, matching the host's own rendering limit. */
+const MAX_LINE_CHARS = 2_000;
+/** `Read` default line count, matching the host's. */
+const DEFAULT_READ_LINES = 2_000;
+/** Bash stdout/stderr cap. */
+const MAX_BASH_BUFFER = 8 * 1024 * 1024;
+/** The most files a Glob answers, oldest dropped first (mtime order). */
+const MAX_GLOB_RESULTS = 100;
+/** The most directory entries a walk visits before it reports `truncated`. */
+const MAX_WALK_ENTRIES = 50_000;
+/** The most files a Grep opens, and the most of each it reads. */
+const MAX_GREP_FILES = 5_000;
+const MAX_GREP_FILE_BYTES = 4 * 1024 * 1024;
+/** The most matching lines a Grep's `content` mode returns. */
+const DEFAULT_GREP_HEAD = 250;
+// ── the executor ─────────────────────────────────────────────────────────────
+/**
+ * Execute one built-in step and return its hook-shaped result (an object; the
+ * caller serializes). Throws per the failure contract above.
+ */
+export async function runBuiltin(toolName, input, ctx) {
+    const deadline = ctx.timeoutMs !== undefined ? Date.now() + ctx.timeoutMs : undefined;
+    switch (toolName) {
+        case "Read":
+            return runRead(input, ctx);
+        case "Glob":
+            return runGlob(input, ctx, deadline);
+        case "Grep":
+            return runGrep(input, ctx, deadline);
+        case "Edit":
+            return runEdit(input, ctx);
+        case "Write":
+            return runWrite(input, ctx);
+        case "Bash":
+            return runBash(input, ctx);
+        default:
+            // Allow-listed but not implemented (`TodoWrite`, a tool this version
+            // does not know): the session runs it, or its recording stands in.
+            throw new BuiltinNotRunnable(`no runner-side implementation for ${toolName}`);
+    }
+}
+// ── the path jail ────────────────────────────────────────────────────────────
+/** Case-blind on Windows, where `C:\Repo` and `c:\repo` are one directory. */
+function samePath(a, b) {
+    return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function underRoot(root, abs) {
+    const prefix = root.endsWith(sep) ? root : root + sep;
+    return (samePath(abs, root) ||
+        (process.platform === "win32"
+            ? abs.toLowerCase().startsWith(prefix.toLowerCase())
+            : abs.startsWith(prefix)));
+}
+/**
+ * Resolve `p` against the session root and refuse anything outside it — first
+ * textually, then through `realpath` so a symlink inside the project cannot
+ * point the step at a file beyond it. The nearest existing ancestor is what
+ * gets resolved, so a `Write` to a new file is judged by its real directory.
+ */
+async function jailed(root, p, what = "file_path") {
+    if (typeof p !== "string" || p.trim() === "") {
+        throw new BuiltinNotRunnable(`${what} is required`);
+    }
+    const r = resolve(root);
+    const abs = resolve(r, p);
+    const outside = () => {
+        throw new BuiltinNotRunnable(`${p} is outside the session's project directory, so bir does not touch it unattended`);
+    };
+    if (!underRoot(r, abs))
+        outside();
+    // The textual check passed; now the physical one. Walk up to what exists,
+    // realpath it, and require *that* to sit under the root's own realpath.
+    let probe = abs;
+    let real;
+    for (;;) {
+        try {
+            real = await realpath(probe);
+            break;
+        }
+        catch {
+            const parent = dirname(probe);
+            if (samePath(parent, probe))
+                break; // hit the filesystem root: nothing exists
+            probe = parent;
+        }
+    }
+    if (real !== undefined) {
+        let realRoot;
+        try {
+            realRoot = await realpath(r);
+        }
+        catch {
+            throw new BuiltinNotRunnable(`the session's project directory does not exist: ${root}`);
+        }
+        if (!underRoot(realRoot, real))
+            outside();
+    }
+    return abs;
+}
+// ── Read ─────────────────────────────────────────────────────────────────────
+async function runRead(input, ctx) {
+    const filePath = await jailed(ctx.cwd, input.file_path);
+    const size = (await stat(filePath)).size;
+    if (size > MAX_FILE_BYTES) {
+        throw new Error(`file is ${size} bytes, more than the ${MAX_FILE_BYTES} this runner reads`);
+    }
+    const text = await readFile(filePath, "utf8");
+    const all = text.split(/\r?\n/);
+    // `offset` is 1-based, as the host's Read documents it; 0 reads as 1.
+    const offset = Math.max(1, numberOr(input.offset, 1));
+    const limit = Math.max(1, numberOr(input.limit, DEFAULT_READ_LINES));
+    const lines = all
+        .slice(offset - 1, offset - 1 + limit)
+        .map((l) => (l.length > MAX_LINE_CHARS ? l.slice(0, MAX_LINE_CHARS) : l));
+    return {
+        type: "text",
+        file: {
+            filePath,
+            content: lines.join("\n"),
+            numLines: lines.length,
+            startLine: offset,
+            totalLines: all.length,
+        },
+    };
+}
+// ── Glob ─────────────────────────────────────────────────────────────────────
+async function runGlob(input, ctx, deadline) {
+    const pattern = input.pattern;
+    if (typeof pattern !== "string" || pattern.trim() === "") {
+        throw new BuiltinNotRunnable("pattern is required");
+    }
+    const root = await jailed(ctx.cwd, typeof input.path === "string" ? input.path : ".", "path");
+    const startedAt = Date.now();
+    const re = globToRegExp(pattern);
+    const found = [];
+    const truncated = await walk(root, deadline, (rel, abs, mtime) => {
+        if (re.test(rel))
+            found.push({ path: abs, mtime });
+        return true;
+    });
+    found.sort((a, b) => b.mtime - a.mtime);
+    const filenames = found.slice(0, MAX_GLOB_RESULTS).map((f) => f.path);
+    return {
+        filenames,
+        durationMs: Date.now() - startedAt,
+        numFiles: filenames.length,
+        truncated: truncated || found.length > MAX_GLOB_RESULTS,
+    };
+}
+// ── Grep ─────────────────────────────────────────────────────────────────────
+/** Grep inputs this executor honours; anything else is the session's job. */
+const GREP_KNOWN_KEYS = new Set([
+    "pattern",
+    "path",
+    "glob",
+    "output_mode",
+    "-i",
+    "-n",
+    "head_limit",
+]);
+async function runGrep(input, ctx, deadline) {
+    const pattern = input.pattern;
+    if (typeof pattern !== "string" || pattern === "") {
+        throw new BuiltinNotRunnable("pattern is required");
+    }
+    // Context lines, multiline mode, type filters, offsets: a stand-in that
+    // silently ignored them would thread the *wrong* output. Decline instead —
+    // the step still runs in the session, or its recording stands in.
+    const exotic = Object.keys(input).filter((k) => !GREP_KNOWN_KEYS.has(k) && input[k] !== undefined && input[k] !== null);
+    if (exotic.length > 0) {
+        throw new BuiltinNotRunnable(`this runner does not support Grep's ${exotic.join(", ")}`);
+    }
+    let re;
+    try {
+        re = new RegExp(pattern, input["-i"] === true ? "i" : "");
+    }
+    catch (err) {
+        throw new BuiltinNotRunnable(`the pattern is not a regular expression this runner can run: ${err.message}`);
+    }
+    const target = await jailed(ctx.cwd, typeof input.path === "string" ? input.path : ".", "path");
+    // ripgrep's `-g '*.ts'` matches the basename at any depth; only a pattern
+    // with a `/` in it speaks about the path.
+    const globRe = typeof input.glob === "string" && input.glob
+        ? globToRegExp(input.glob.includes("/") ? input.glob : `**/${input.glob}`)
+        : undefined;
+    const mode = typeof input.output_mode === "string" ? input.output_mode : "files_with_matches";
+    const headLimit = Math.max(1, numberOr(input.head_limit, DEFAULT_GREP_HEAD));
+    // One file, or a walk — the host's Grep takes both.
+    const files = [];
+    const st = await stat(target).catch(() => undefined);
+    let truncated = false;
+    if (st?.isFile()) {
+        files.push({ path: target, mtime: st.mtimeMs });
+    }
+    else {
+        truncated = await walk(target, deadline, (rel, abs, mtime) => {
+            if (!globRe || globRe.test(rel))
+                files.push({ path: abs, mtime });
+            return files.length < MAX_GREP_FILES;
+        });
+    }
+    const mtimes = new Map(files.map((f) => [f.path, f.mtime]));
+    const matches = [];
+    for (const f of files) {
+        if (deadline !== undefined && Date.now() > deadline) {
+            throw new BuiltinTimeout(`Grep ran out of time after ${files.length} candidate files`);
+        }
+        const lines = await matchFile(f.path, re, mode === "files_with_matches");
+        if (lines)
+            matches.push({ path: f.path, lines });
+    }
+    matches.sort((a, b) => (mtimes.get(b.path) ?? 0) - (mtimes.get(a.path) ?? 0));
+    if (mode === "count") {
+        const shown = matches.slice(0, headLimit);
+        return {
+            mode: "count",
+            content: shown.map((m) => `${m.path}:${m.lines.length}`).join("\n"),
+            numFiles: matches.length,
+            numMatches: matches.reduce((n, m) => n + m.lines.length, 0),
+            truncated: truncated || matches.length > shown.length,
+        };
+    }
+    if (mode === "content") {
+        const numbered = input["-n"] !== false;
+        const out = [];
+        for (const m of matches) {
+            for (const line of m.lines) {
+                out.push(numbered ? `${m.path}:${line.n}:${line.text}` : `${m.path}:${line.text}`);
+                if (out.length >= headLimit)
+                    break;
+            }
+            if (out.length >= headLimit)
+                break;
+        }
+        return { mode: "content", content: out.join("\n"), numLines: out.length, truncated };
+    }
+    const filenames = matches.slice(0, headLimit).map((m) => m.path);
+    return {
+        mode: "files_with_matches",
+        filenames,
+        numFiles: filenames.length,
+        truncated: truncated || matches.length > filenames.length,
+    };
+}
+/** The matching lines of one file, or undefined when none (or not text). */
+async function matchFile(path, re, firstOnly) {
+    let buf;
+    try {
+        const st = await stat(path);
+        if (!st.isFile() || st.size > MAX_GREP_FILE_BYTES)
+            return undefined;
+        buf = await readFile(path);
+    }
+    catch {
+        return undefined; // unreadable is not a match
+    }
+    // A NUL near the start is the classic binary sniff, same as grep's own.
+    if (buf.subarray(0, 4096).includes(0))
+        return undefined;
+    const lines = buf.toString("utf8").split(/\r?\n/);
+    const out = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        if (re.test(lines[i])) {
+            out.push({ n: i + 1, text: lines[i].slice(0, MAX_LINE_CHARS) });
+            if (firstOnly)
+                return out;
+        }
+    }
+    return out.length > 0 ? out : undefined;
+}
+// ── Edit / Write ─────────────────────────────────────────────────────────────
+async function runEdit(input, ctx) {
+    const filePath = await jailed(ctx.cwd, input.file_path);
+    const oldString = input.old_string;
+    const newString = input.new_string;
+    if (typeof oldString !== "string" || oldString === "") {
+        throw new BuiltinNotRunnable("old_string is required");
+    }
+    if (typeof newString !== "string")
+        throw new BuiltinNotRunnable("new_string is required");
+    const replaceAll = input.replace_all === true;
+    const size = (await stat(filePath)).size;
+    if (size > MAX_FILE_BYTES) {
+        throw new Error(`file is ${size} bytes, more than the ${MAX_FILE_BYTES} this runner edits`);
+    }
+    const current = await readFile(filePath, "utf8");
+    const occurrences = current.split(oldString).length - 1;
+    if (occurrences === 0)
+        throw new Error(`old_string was not found in ${filePath}`);
+    if (!replaceAll && occurrences > 1) {
+        throw new Error(`old_string appears ${occurrences} times in ${filePath}; it must be unique`);
+    }
+    const next = replaceAll
+        ? current.split(oldString).join(newString)
+        : current.replace(oldString, newString);
+    await writeFile(filePath, next, "utf8");
+    return {
+        filePath,
+        oldString,
+        newString,
+        originalFile: current,
+        structuredPatch: [],
+        userModified: false,
+        replaceAll,
+    };
+}
+async function runWrite(input, ctx) {
+    const filePath = await jailed(ctx.cwd, input.file_path);
+    const content = input.content;
+    if (typeof content !== "string")
+        throw new BuiltinNotRunnable("content is required");
+    const existed = await stat(filePath).then((s) => s.isFile(), () => false);
+    // No mkdir: the host's Write does not invent directories, so neither does
+    // the stand-in — a missing parent is a divergence, not a wish.
+    await writeFile(filePath, content, "utf8");
+    return {
+        type: existed ? "update" : "create",
+        filePath,
+        content,
+        structuredPatch: [],
+    };
+}
+// ── Bash ─────────────────────────────────────────────────────────────────────
+/**
+ * Which `bash` a runner-side step uses. On Windows the host's own Bash tool
+ * is Git Bash, which is rarely on the daemon's PATH — so the standard
+ * Git-for-Windows locations are preferred over PATH, where `bash.exe` may
+ * even be the WSL stub (a different filesystem view entirely). Resolved once.
+ */
+export function bashExecutable() {
+    if (process.platform !== "win32")
+        return "bash";
+    for (const candidate of [
+        join(process.env.ProgramFiles ?? "C:\\Program Files", "Git", "bin", "bash.exe"),
+        join(process.env["ProgramFiles(x86)"] ?? "C:\\Program Files (x86)", "Git", "bin", "bash.exe"),
+    ]) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return "bash.exe";
+}
+async function runBash(input, ctx) {
+    const command = input.command;
+    if (typeof command !== "string" || command.trim() === "") {
+        throw new BuiltinNotRunnable("command is required");
+    }
+    if (!ctx.bashAllow) {
+        throw new BuiltinNotRunnable("BIR_BASH_ALLOW is not set, so bir runs no Bash command unattended");
+    }
+    if (!bashAllowed(command, ctx.bashAllow)) {
+        throw new BuiltinNotRunnable("the command does not match BIR_BASH_ALLOW, so bir does not run it unattended");
+    }
+    const timeoutMs = ctx.timeoutMs ?? 120_000;
+    // The host's Bash semantics, which the recorded chain was written against:
+    // the working directory carries over from the plan's previous Bash step,
+    // variables and functions do not (a fresh `-l` shell each call).
+    const startIn = ctx.bashCwd && existsSync(ctx.bashCwd) ? ctx.bashCwd : resolve(ctx.cwd);
+    // Where the shell *ends up* is asked of the shell itself, behind a marker
+    // no real output contains (random per call), printed to stderr and
+    // stripped before the output is threaded — the recording never carried it.
+    // `pwd -W` is Git Bash's Windows-path form; elsewhere it fails quietly and
+    // plain `pwd` answers. An explicit `exit` skips the marker, and the
+    // previous directory simply stands.
+    const mark = `__BIR_PWD_${randomBytes(8).toString("hex")}__`;
+    const script = `${command}\n__bir_rc=$?\nprintf '\\n%s%s%s' '${mark}' "$(pwd -W 2>/dev/null || pwd)" '${mark}' 1>&2\nexit "$__bir_rc"`;
+    return new Promise((resolvePromise, rejectPromise) => {
+        execFile(bashExecutable(), ["-lc", script], {
+            cwd: startIn,
+            timeout: timeoutMs,
+            maxBuffer: MAX_BASH_BUFFER,
+            windowsHide: true,
+        }, (err, stdout, stderr) => {
+            const cleaned = takePwdMarker(String(stderr ?? ""), mark);
+            if (cleaned.pwd)
+                ctx.onBashCwd?.(cleaned.pwd);
+            if (err) {
+                const e = err;
+                if (e.code === "ENOENT") {
+                    // No bash on this machine (a Windows runner without Git Bash):
+                    // the step is the session's, exactly as before.
+                    rejectPromise(new BuiltinNotRunnable("no `bash` on the runner's PATH"));
+                    return;
+                }
+                if (e.killed || e.signal === "SIGTERM") {
+                    rejectPromise(new BuiltinTimeout(`the command was stopped after ${timeoutMs}ms and may have done part of its work`));
+                    return;
+                }
+                const code = typeof e.code === "number" ? e.code : 1;
+                const detail = String(cleaned.text || stdout || "").trim().slice(0, 500);
+                rejectPromise(new Error(`the command exited with code ${code}${detail ? `: ${detail}` : ""}`));
+                return;
+            }
+            resolvePromise({
+                stdout: String(stdout ?? ""),
+                stderr: cleaned.text,
+                interrupted: false,
+                isImage: false,
+            });
+        });
+    });
+}
+/**
+ * Split the shell's final `$PWD` out of stderr again: the marked chunk (and
+ * the newline the wrapper added before it) is removed, whatever else the
+ * command wrote stays byte-for-byte.
+ */
+function takePwdMarker(stderr, mark) {
+    const i = stderr.indexOf(mark);
+    if (i < 0)
+        return { text: stderr };
+    const j = stderr.indexOf(mark, i + mark.length);
+    if (j < 0)
+        return { text: stderr };
+    const pwd = stderr.slice(i + mark.length, j).trim();
+    const before = stderr.slice(0, i).replace(/\n$/, "");
+    const after = stderr.slice(j + mark.length);
+    return { text: before + after, pwd: pwd || undefined };
+}
+// ── shared walking and matching ─────────────────────────────────────────────
+/** Directories no scenario's step means to scan. */
+const SKIP_DIRS = new Set([".git", "node_modules", ".hg", ".svn"]);
+/**
+ * Walk `root`, calling `visit(relativePath, absolutePath, mtimeMs)` for every
+ * regular file. Never follows directory symlinks — the jail was checked at
+ * the root, and a link out of it must not re-open the door. Returns whether
+ * the walk was cut short (entry cap, deadline, or `visit` saying stop).
+ */
+async function walk(root, deadline, visit) {
+    let seen = 0;
+    const queue = [root];
+    while (queue.length > 0) {
+        if (deadline !== undefined && Date.now() > deadline) {
+            throw new BuiltinTimeout(`the walk ran out of time after ${seen} entries`);
+        }
+        const dir = queue.shift();
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // unreadable directory: skip, as the host's own tools do
+        }
+        for (const entry of entries) {
+            seen += 1;
+            if (seen > MAX_WALK_ENTRIES)
+                return true;
+            const abs = resolve(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name))
+                    queue.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // symlinks and specials stay unfollowed
+            let mtime = 0;
+            try {
+                mtime = (await stat(abs)).mtimeMs;
+            }
+            catch {
+                continue;
+            }
+            const rel = abs.slice(resolve(root).length + 1).split(sep).join("/");
+            if (!visit(rel, abs, mtime))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * A glob pattern as a RegExp over `/`-separated relative paths: `**` crosses
+ * directories, `*` and `?` stay inside one, `{a,b}` alternates, `[…]` passes
+ * through as a character class. Matched against the whole relative path, as
+ * the host's Glob does — a bare `*.ts` is the top level only (Grep's filter
+ * widens a bare pattern itself, ripgrep-style). Enough for the patterns
+ * Claude Code writes; a pattern beyond it simply matches nothing it should
+ * not.
+ */
+export function globToRegExp(pattern) {
+    let p = pattern.replace(/\\/g, "/");
+    if (p.startsWith("./"))
+        p = p.slice(2);
+    let out = "";
+    for (let i = 0; i < p.length; i += 1) {
+        const c = p[i];
+        if (c === "*") {
+            if (p[i + 1] === "*") {
+                // `**/` may match nothing at all; a trailing `**` matches the rest.
+                out += p[i + 2] === "/" ? "(?:[^/]+/)*" : ".*";
+                i += p[i + 2] === "/" ? 2 : 1;
+            }
+            else {
+                out += "[^/]*";
+            }
+        }
+        else if (c === "?") {
+            out += "[^/]";
+        }
+        else if (c === "{") {
+            const end = p.indexOf("}", i);
+            if (end === -1) {
+                out += "\\{";
+            }
+            else {
+                out += `(?:${p
+                    .slice(i + 1, end)
+                    .split(",")
+                    .map((s) => s.replace(/[.+^$()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]"))
+                    .join("|")})`;
+                i = end;
+            }
+        }
+        else if (c === "[") {
+            const end = p.indexOf("]", i + (p[i + 1] === "!" || p[i + 1] === "^" ? 2 : 1) + 1);
+            if (end === -1) {
+                out += "\\[";
+            }
+            else {
+                const body = p.slice(i + 1, end).replace(/^!/, "^");
+                out += `[${body}]`;
+                i = end;
+            }
+        }
+        else {
+            out += /[.+^$()|\\]/.test(c) ? `\\${c}` : c;
+        }
+    }
+    return new RegExp(`^${out}$`);
+}
+function numberOr(value, fallback) {
+    const n = typeof value === "string" ? Number(value) : value;
+    return typeof n === "number" && Number.isFinite(n) ? Math.floor(n) : fallback;
+}
+//# sourceMappingURL=builtins.js.map