@botconnector/bccli 0.4.0-beta.28 → 0.4.0-beta.29

package/dist/{chunk-HP3J6JEY.js → chunk-YPD4D6E3.js}

@@ -247,10 +247,37 @@ function ignorePatterns(root) {
   return patterns;
 }
 
+// src/tools/globSafety.ts
+var MAX_GLOB_LENGTH = 4096;
+var MAX_BRACE_DEPTH = 16;
+function validateGlobPattern(pattern) {
+  if (pattern.length > MAX_GLOB_LENGTH) return `Glob pattern is too long (max ${MAX_GLOB_LENGTH} characters).`;
+  let depth = 0;
+  let escaped = false;
+  for (const char of pattern) {
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === "{") {
+      depth++;
+      if (depth > MAX_BRACE_DEPTH) return `Glob brace nesting is too deep (max ${MAX_BRACE_DEPTH}).`;
+    } else if (char === "}" && depth > 0) {
+      depth--;
+    }
+  }
+  return void 0;
+}
+
 export {
   toolLabel,
   runPrint,
   ignorePatterns,
+  validateGlobPattern,
   BUILTIN_AGENTS,
   instructionPaths,
   buildSystemPrompt,

package/dist/cli.js

@@ -7,8 +7,9 @@ import {
   loadCommands,
   loadSkills,
   parseFrontmatter,
-  runPrint
-} from "./chunk-HP3J6JEY.js";
+  runPrint,
+  validateGlobPattern
+} from "./chunk-YPD4D6E3.js";
 import {
   helpText,
   parseCliArgs
@@ -570,7 +571,7 @@ async function loadPage(inputUrl, signal) {
 var fetchTool = createFetchTool();
 
 // src/tools/glob.ts
-import fg from "fast-glob";
+import { glob as nativeGlob } from "fs/promises";
 import { z as z4 } from "zod";
 var MAX_OUTPUT_CHARS = 24e3;
 var globTool = defineTool({
@@ -583,8 +584,14 @@ var globTool = defineTool({
   kind: "read",
   target: (input) => input.pattern,
   async run(input, ctx) {
+    const invalid = validateGlobPattern(input.pattern);
+    if (invalid) return { output: invalid, isError: true };
     const root = resolvePath(ctx.cwd, input.path ?? ".");
-    const files = (await fg(input.pattern, { cwd: root, ignore: ignorePatterns(root), onlyFiles: true, dot: true })).sort();
+    const files = [];
+    for await (const file of nativeGlob(input.pattern, { cwd: root, exclude: ignorePatterns(root) })) {
+      files.push(file);
+    }
+    files.sort();
     if (!files.length) return { output: "No matching files." };
     const first = files.slice(0, 500);
     const shown = [];
@@ -606,13 +613,16 @@ var globTool = defineTool({
 // src/tools/grep.ts
 import { execFile } from "child_process";
 import { readFile as readFile2 } from "fs/promises";
-import fg2 from "fast-glob";
+import { glob as nativeGlob2 } from "fs/promises";
 import { z as z5 } from "zod";
 var MAX_MATCHES = 200;
 var MAX_OUTPUT_CHARS2 = 24e3;
 async function grepJs(pattern, opts) {
   const regex = new RegExp(pattern, opts.ignoreCase ? "i" : "");
-  const files = await fg2(opts.glob ?? "**/*", { cwd: opts.root, ignore: ignorePatterns(opts.root), onlyFiles: true, dot: true });
+  const files = [];
+  for await (const file of nativeGlob2(opts.glob ?? "**/*", { cwd: opts.root, exclude: ignorePatterns(opts.root) })) {
+    files.push(file);
+  }
   const out = [];
   for (const file of files.sort()) {
     let text;
@@ -657,6 +667,10 @@ var grepTool = defineTool({
   kind: "read",
   target: (input) => input.pattern,
   async run(input, ctx) {
+    if (input.glob) {
+      const invalid = validateGlobPattern(input.glob);
+      if (invalid) return { output: invalid, isError: true };
+    }
     const opts = { root: resolvePath(ctx.cwd, input.path ?? "."), glob: input.glob, ignoreCase: input.ignore_case };
     try {
       new RegExp(input.pattern);
@@ -1662,7 +1676,7 @@ function createRuntime(opts) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.4.0-beta.28" : "0.0.0-dev";
+var VERSION = true ? "0.4.0-beta.29" : "0.0.0-dev";
 
 // src/cli.ts
 function chooseLanguage(argv) {
@@ -1733,7 +1747,7 @@ async function main() {
     }
   }
   if (!process.stdin.isTTY) throw new ConfigError(t('Interactive mode needs a terminal. For scripts/CI use: bccli -p "task"'));
-  const { startInteractive } = await import("./ui-SRXPL7KU.js");
+  const { startInteractive } = await import("./ui-H3IDVNE7.js");
   return startInteractive(rt, { initialPrompt: args.prompt, resume: args.resume, version: VERSION });
 }
 main().then(

package/dist/{ui-SRXPL7KU.js → ui-H3IDVNE7.js}

@@ -4,8 +4,9 @@ import {
   ignorePatterns,
   instructionPaths,
   parseFrontmatter,
-  toolLabel
-} from "./chunk-HP3J6JEY.js";
+  toolLabel,
+  validateGlobPattern
+} from "./chunk-YPD4D6E3.js";
 import {
   nextMode
 } from "./chunk-ELML4KVQ.js";
@@ -50,7 +51,7 @@ import { render } from "ink";
 import { execFile as execFile2 } from "child_process";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir } from "os";
-import { dirname, join, relative, resolve } from "path";
+import { dirname, join as join2, relative, resolve } from "path";
 import { Box as Box13, Static, Text as Text15, useApp, useInput as useInput9 } from "ink";
 import { useCallback, useEffect as useEffect2, useRef, useState as useState8 } from "react";
 
@@ -801,13 +802,23 @@ import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
 import { useState as useState5 } from "react";
 
 // src/ui/complete.ts
-import fg from "fast-glob";
+import { globSync } from "fs";
+import { statSync } from "fs";
+import { join } from "path";
 function completeFile(value, cwd) {
   const match = /(^|\s)@([^\s]*)$/.exec(value);
   if (!match) return value;
   const prefix = match[2];
   const escaped = prefix.replace(/([*?[\]{}()!])/g, "\\$1");
-  const found = fg.sync(`${escaped}*`, { cwd, ignore: ignorePatterns(cwd), onlyFiles: false, markDirectories: true, dot: false }).sort();
+  const pattern = `${escaped}*`;
+  if (validateGlobPattern(pattern)) return value;
+  const found = globSync(pattern, { cwd, exclude: ignorePatterns(cwd) }).map((entry2) => {
+    try {
+      return statSync(join(cwd, entry2)).isDirectory() ? `${entry2}/` : entry2;
+    } catch {
+      return entry2;
+    }
+  }).sort();
   if (!found.length) return value;
   const pick = found[0];
   return `${value.slice(0, value.length - prefix.length)}${pick}${pick.endsWith("/") ? "" : " "}`;
@@ -1403,7 +1414,7 @@ function App({ runtime, initialPrompt, version }) {
             notice(t("Write the text: /memory global <text>."), "warn");
             return;
           }
-          const file = global ? join(runtime.home, "BCCLI.md") : join(runtime.cwd, "AGENTS.md");
+          const file = global ? join2(runtime.home, "BCCLI.md") : join2(runtime.cwd, "AGENTS.md");
           try {
             mkdirSync(dirname(file), { recursive: true });
             appendMemory(file, text);
@@ -1509,7 +1520,7 @@ function App({ runtime, initialPrompt, version }) {
             return;
           }
           process.stdout.write(osc52(last.content, !!process.env.TMUX));
-          const file = join(runtime.home, "last-answer.md");
+          const file = join2(runtime.home, "last-answer.md");
           mkdirSync(runtime.home, { recursive: true });
           writeFileSync(file, last.content);
           notice(t("Copied to the clipboard (if the terminal supports OSC 52) and saved to {file}.", { file }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botconnector/bccli",
-  "version": "0.4.0-beta.28",
+  "version": "0.4.0-beta.29",
   "description": "BCCLI — BotConnector AI coding agent for the terminal",
   "type": "module",
   "bin": {
@@ -26,7 +26,6 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
     "diff": "^9.0.0",
-    "fast-glob": "^3.3.3",
     "ink": "^7.1.1",
     "openai": "^7.27.0",
     "react": "^19.3.0",
@@ -43,5 +42,8 @@
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
     "vitest": "^5.0.2"
+  },
+  "overrides": {
+    "esbuild": "0.28.2"
   }
 }