@botconnector/bccli 0.4.0-beta.27 → 0.4.0-beta.29

package/dist/{chunk-CJEIJ5VW.js → chunk-DJR4EAVL.js}

@@ -35,7 +35,7 @@ function readSecret(prompt) {
   });
 }
 async function runLogin(providerId, cwd) {
-  const { runProviderCommand } = await import("./providerCli-G5OGC2UN.js");
+  const { runProviderCommand } = await import("./providerCli-II7TQDYQ.js");
   const { parseCliArgs } = await import("./args-XQYEBOKB.js");
   return runProviderCommand(parseCliArgs(["provider", "add", providerId]), {
     env: process.env,

package/dist/{chunk-IXAVAK7R.js → chunk-WWQVALA5.js}

@@ -285,6 +285,7 @@ function lunaToolPlan(tools, enableProgrammaticToolCalling = false, programmatic
     name: tool.function.name,
     description: tool.function.description,
     parameters: tool.function.parameters,
+    ...tool.function.output_schema ? { output_schema: tool.function.output_schema } : {},
     strict: false
   }));
   const mcpIndexes = native.map((tool, index) => String(tool.name).startsWith("mcp__") ? index : -1).filter((index) => index >= 0);

package/dist/{chunk-HP3J6JEY.js → chunk-YPD4D6E3.js}

@@ -247,10 +247,37 @@ function ignorePatterns(root) {
   return patterns;
 }
 
+// src/tools/globSafety.ts
+var MAX_GLOB_LENGTH = 4096;
+var MAX_BRACE_DEPTH = 16;
+function validateGlobPattern(pattern) {
+  if (pattern.length > MAX_GLOB_LENGTH) return `Glob pattern is too long (max ${MAX_GLOB_LENGTH} characters).`;
+  let depth = 0;
+  let escaped = false;
+  for (const char of pattern) {
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === "{") {
+      depth++;
+      if (depth > MAX_BRACE_DEPTH) return `Glob brace nesting is too deep (max ${MAX_BRACE_DEPTH}).`;
+    } else if (char === "}" && depth > 0) {
+      depth--;
+    }
+  }
+  return void 0;
+}
+
 export {
   toolLabel,
   runPrint,
   ignorePatterns,
+  validateGlobPattern,
   BUILTIN_AGENTS,
   instructionPaths,
   buildSystemPrompt,

package/dist/cli.js

@@ -7,8 +7,9 @@ import {
   loadCommands,
   loadSkills,
   parseFrontmatter,
-  runPrint
-} from "./chunk-HP3J6JEY.js";
+  runPrint,
+  validateGlobPattern
+} from "./chunk-YPD4D6E3.js";
 import {
   helpText,
   parseCliArgs
@@ -22,7 +23,7 @@ import {
   createProvider,
   hasPendingProgrammaticReplay,
   listAllModels
-} from "./chunk-IXAVAK7R.js";
+} from "./chunk-WWQVALA5.js";
 import {
   providerName,
   readGlobalConfigFile
@@ -30,7 +31,7 @@ import {
 import "./chunk-SN3ODJZN.js";
 import {
   runLogin
-} from "./chunk-CJEIJ5VW.js";
+} from "./chunk-DJR4EAVL.js";
 import {
   Session,
   pruneSessions
@@ -570,7 +571,7 @@ async function loadPage(inputUrl, signal) {
 var fetchTool = createFetchTool();
 
 // src/tools/glob.ts
-import fg from "fast-glob";
+import { glob as nativeGlob } from "fs/promises";
 import { z as z4 } from "zod";
 var MAX_OUTPUT_CHARS = 24e3;
 var globTool = defineTool({
@@ -583,8 +584,14 @@ var globTool = defineTool({
   kind: "read",
   target: (input) => input.pattern,
   async run(input, ctx) {
+    const invalid = validateGlobPattern(input.pattern);
+    if (invalid) return { output: invalid, isError: true };
     const root = resolvePath(ctx.cwd, input.path ?? ".");
-    const files = (await fg(input.pattern, { cwd: root, ignore: ignorePatterns(root), onlyFiles: true, dot: true })).sort();
+    const files = [];
+    for await (const file of nativeGlob(input.pattern, { cwd: root, exclude: ignorePatterns(root) })) {
+      files.push(file);
+    }
+    files.sort();
     if (!files.length) return { output: "No matching files." };
     const first = files.slice(0, 500);
     const shown = [];
@@ -606,13 +613,16 @@ var globTool = defineTool({
 // src/tools/grep.ts
 import { execFile } from "child_process";
 import { readFile as readFile2 } from "fs/promises";
-import fg2 from "fast-glob";
+import { glob as nativeGlob2 } from "fs/promises";
 import { z as z5 } from "zod";
 var MAX_MATCHES = 200;
 var MAX_OUTPUT_CHARS2 = 24e3;
 async function grepJs(pattern, opts) {
   const regex = new RegExp(pattern, opts.ignoreCase ? "i" : "");
-  const files = await fg2(opts.glob ?? "**/*", { cwd: opts.root, ignore: ignorePatterns(opts.root), onlyFiles: true, dot: true });
+  const files = [];
+  for await (const file of nativeGlob2(opts.glob ?? "**/*", { cwd: opts.root, exclude: ignorePatterns(opts.root) })) {
+    files.push(file);
+  }
   const out = [];
   for (const file of files.sort()) {
     let text;
@@ -657,6 +667,10 @@ var grepTool = defineTool({
   kind: "read",
   target: (input) => input.pattern,
   async run(input, ctx) {
+    if (input.glob) {
+      const invalid = validateGlobPattern(input.glob);
+      if (invalid) return { output: invalid, isError: true };
+    }
     const opts = { root: resolvePath(ctx.cwd, input.path ?? "."), glob: input.glob, ignoreCase: input.ignore_case };
     try {
       new RegExp(input.pattern);
@@ -783,7 +797,7 @@ var ALL_TOOLS = [readTool, writeTool, editTool, bashTool, grepTool, globTool, fe
 function toolDefinitions(tools) {
   return tools.map((tool) => {
     const { $schema: _ignored, ...parameters } = tool.jsonSchema ?? z8.toJSONSchema(tool.schema);
-    return { type: "function", function: { name: tool.name, description: tool.description, parameters } };
+    return { type: "function", function: { name: tool.name, description: tool.description, parameters, ...tool.outputJsonSchema ? { output_schema: tool.outputJsonSchema } : {} } };
   });
 }
 
@@ -1247,6 +1261,7 @@ var McpManager = class {
       description: `[MCP ${server}] ${tool.description ?? tool.name}`.slice(0, 1024),
       schema: z9.record(z9.string(), z9.unknown()),
       jsonSchema: tool.inputSchema,
+      ...tool.outputSchema ? { outputJsonSchema: tool.outputSchema } : {},
       kind: "mcp",
       programmaticSafe: tool.annotations?.readOnlyHint === true,
       target: (input) => {
@@ -1661,7 +1676,7 @@ function createRuntime(opts) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.4.0-beta.27" : "0.0.0-dev";
+var VERSION = true ? "0.4.0-beta.29" : "0.0.0-dev";
 
 // src/cli.ts
 function chooseLanguage(argv) {
@@ -1687,12 +1702,12 @@ async function main() {
   if (args.command === "login") return runLogin(args.loginProvider ?? "bc-cloud", cwd);
   if (args.command === "mcp") {
     const { runMcpCommand } = await import("./mcpCli-J43FHF2H.js");
-    const { readSecret } = await import("./login-MOXJVDKB.js");
+    const { readSecret } = await import("./login-HUPT4247.js");
     return runMcpCommand(args, { env: process.env, cwd, out: (s) => console.log(s), err: (s) => console.error(s), readSecret });
   }
   if (args.command === "provider") {
-    const { runProviderCommand } = await import("./providerCli-G5OGC2UN.js");
-    const { readSecret } = await import("./login-MOXJVDKB.js");
+    const { runProviderCommand } = await import("./providerCli-II7TQDYQ.js");
+    const { readSecret } = await import("./login-HUPT4247.js");
     return runProviderCommand(args, { env: process.env, cwd, out: (s) => console.log(s), err: (s) => console.error(s), readSecret });
   }
   if (args.command === "connect" || args.command === "disconnect" || args.command === "integrations") {
@@ -1732,7 +1747,7 @@ async function main() {
     }
   }
   if (!process.stdin.isTTY) throw new ConfigError(t('Interactive mode needs a terminal. For scripts/CI use: bccli -p "task"'));
-  const { startInteractive } = await import("./ui-SRXPL7KU.js");
+  const { startInteractive } = await import("./ui-H3IDVNE7.js");
   return startInteractive(rt, { initialPrompt: args.prompt, resume: args.resume, version: VERSION });
 }
 main().then(

package/dist/{login-MOXJVDKB.js → login-HUPT4247.js}

@@ -2,7 +2,7 @@
 import {
   readSecret,
   runLogin
-} from "./chunk-CJEIJ5VW.js";
+} from "./chunk-DJR4EAVL.js";
 export {
   readSecret,
   runLogin

package/dist/{providerCli-G5OGC2UN.js → providerCli-II7TQDYQ.js}

@@ -2,7 +2,7 @@
 import {
   addProviderKey,
   runProviderCommand
-} from "./chunk-IXAVAK7R.js";
+} from "./chunk-WWQVALA5.js";
 import "./chunk-K5JNR3HL.js";
 import "./chunk-SN3ODJZN.js";
 import "./chunk-EO7IVVX4.js";

package/dist/{ui-SRXPL7KU.js → ui-H3IDVNE7.js}

@@ -4,8 +4,9 @@ import {
   ignorePatterns,
   instructionPaths,
   parseFrontmatter,
-  toolLabel
-} from "./chunk-HP3J6JEY.js";
+  toolLabel,
+  validateGlobPattern
+} from "./chunk-YPD4D6E3.js";
 import {
   nextMode
 } from "./chunk-ELML4KVQ.js";
@@ -50,7 +51,7 @@ import { render } from "ink";
 import { execFile as execFile2 } from "child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir } from "os";
-import { dirname, join, relative, resolve } from "path";
+import { dirname, join as join2, relative, resolve } from "path";
 import { Box as Box13, Static, Text as Text15, useApp, useInput as useInput9 } from "ink";
 import { useCallback, useEffect as useEffect2, useRef, useState as useState8 } from "react";
 
@@ -801,13 +802,23 @@ import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
 import { useState as useState5 } from "react";
 
 // src/ui/complete.ts
-import fg from "fast-glob";
+import { globSync } from "fs";
+import { statSync } from "fs";
+import { join } from "path";
 function completeFile(value, cwd) {
   const match = /(^|\s)@([^\s]*)$/.exec(value);
   if (!match) return value;
   const prefix = match[2];
   const escaped = prefix.replace(/([*?[\]{}()!])/g, "\\$1");
-  const found = fg.sync(`${escaped}*`, { cwd, ignore: ignorePatterns(cwd), onlyFiles: false, markDirectories: true, dot: false }).sort();
+  const pattern = `${escaped}*`;
+  if (validateGlobPattern(pattern)) return value;
+  const found = globSync(pattern, { cwd, exclude: ignorePatterns(cwd) }).map((entry2) => {
+    try {
+      return statSync(join(cwd, entry2)).isDirectory() ? `${entry2}/` : entry2;
+    } catch {
+      return entry2;
+    }
+  }).sort();
   if (!found.length) return value;
   const pick = found[0];
   return `${value.slice(0, value.length - prefix.length)}${pick}${pick.endsWith("/") ? "" : " "}`;
@@ -1403,7 +1414,7 @@ function App({ runtime, initialPrompt, version }) {
             notice(t("Write the text: /memory global <text>."), "warn");
             return;
           }
-          const file = global ? join(runtime.home, "BCCLI.md") : join(runtime.cwd, "AGENTS.md");
+          const file = global ? join2(runtime.home, "BCCLI.md") : join2(runtime.cwd, "AGENTS.md");
           try {
             mkdirSync(dirname(file), { recursive: true });
             appendMemory(file, text);
@@ -1509,7 +1520,7 @@ function App({ runtime, initialPrompt, version }) {
             return;
           }
           process.stdout.write(osc52(last.content, !!process.env.TMUX));
-          const file = join(runtime.home, "last-answer.md");
+          const file = join2(runtime.home, "last-answer.md");
           mkdirSync(runtime.home, { recursive: true });
           writeFileSync(file, last.content);
           notice(t("Copied to the clipboard (if the terminal supports OSC 52) and saved to {file}.", { file }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botconnector/bccli",
-  "version": "0.4.0-beta.27",
+  "version": "0.4.0-beta.29",
   "description": "BCCLI — BotConnector AI coding agent for the terminal",
   "type": "module",
   "bin": {
@@ -26,7 +26,6 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
     "diff": "^9.0.0",
-    "fast-glob": "^3.3.3",
     "ink": "^7.1.1",
     "openai": "^7.27.0",
     "react": "^19.3.0",
@@ -43,5 +42,8 @@
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
     "vitest": "^5.0.2"
+  },
+  "overrides": {
+    "esbuild": "0.28.2"
   }
 }