@counterfact-labs/cli 0.1.3 → 0.2.4

package/dist/setup-pings/worker.js

@@ -0,0 +1,95 @@
+import { Buffer } from "node:buffer";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import process from "node:process";
+import { clearTimeout, setTimeout } from "node:timers";
+import { fileURLToPath, URL } from "node:url";
+import { SETUP_PING_STEPS } from "./contract.js";
+import { claimLink, claimStep } from "./state.js";
+import { DEFAULT_CONSOLE_URL } from "./client.js";
+function parseOperation(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const operation = raw;
+    if (typeof operation.homeDir !== "string" || typeof operation.origin !== "string")
+        return null;
+    if (operation.kind !== "ping" && operation.kind !== "link")
+        return null;
+    if (operation.kind === "ping" && !SETUP_PING_STEPS.includes(operation.step))
+        return null;
+    if (operation.kind === "link" && !operation.token)
+        return null;
+    if (operation.token !== undefined && (typeof operation.token !== "string" || !/^[\x21-\x7e]{1,4096}$/.test(operation.token)))
+        return null;
+    const base = new URL(operation.origin);
+    const production = base.origin === DEFAULT_CONSOLE_URL;
+    const loopback = operation.allowLoopback === true && base.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(base.hostname);
+    if ((!production && !loopback) || base.username || base.password || base.search || base.hash)
+        return null;
+    const url = new URL(`${base.href.replace(/\/+$/, "")}/api/funnel/step`);
+    return { operation, url };
+}
+export async function runWorker(raw, io = {}) {
+    let request;
+    let httpDeadline;
+    let stopped = false;
+    let finish;
+    const finished = new Promise(resolve => { finish = () => { stopped = true; resolve(); }; });
+    const deadline = setTimeout(finish, 750);
+    void (async () => {
+        try {
+            const parsed = parseOperation(raw);
+            if (!parsed)
+                return;
+            const { operation, url } = parsed;
+            const claim = operation.kind === "ping"
+                ? await (io.claimStep ?? claimStep)(operation.homeDir, operation.step).then(value => value && { ...value, step: operation.step })
+                : await (io.claimLink ?? claimLink)(operation.homeDir);
+            if (!claim || stopped)
+                return;
+            const body = JSON.stringify({ installId: claim.installId, step: claim.step });
+            const headers = { "content-type": "application/json", "content-length": Buffer.byteLength(body) };
+            if (operation.token)
+                headers.authorization = `Bearer ${operation.token}`;
+            const send = io.request ?? (url.protocol === "https:" ? httpsRequest : httpRequest);
+            request = send(url, { method: "POST", headers, agent: false }, response => {
+                // Status is final: no redirects, response body, retries or server text.
+                response.destroy();
+                finish();
+            });
+            request.on("error", finish);
+            // An absolute timer also covers DNS and TLS before a socket is ready.
+            httpDeadline = setTimeout(finish, 500);
+            request.end(body);
+            await finished;
+        }
+        catch { /* Disk and transport failures are deliberately silent. */ }
+        finally {
+            finish();
+        }
+    })();
+    await finished;
+    clearTimeout(deadline);
+    clearTimeout(httpDeadline);
+    request?.destroy();
+}
+async function main() {
+    // A hard process deadline also covers hung filesystem work and unread stdin.
+    const deadline = setTimeout(() => process.exit(0), 750);
+    try {
+        let input = "";
+        for await (const chunk of process.stdin) {
+            input += chunk;
+            if (Buffer.byteLength(input) > 16384)
+                return;
+        }
+        await runWorker(JSON.parse(input));
+    }
+    catch { /* No telemetry failure is printed. */ }
+    finally {
+        clearTimeout(deadline);
+        process.exit(0);
+    }
+}
+if (process.argv[1] === fileURLToPath(import.meta.url))
+    void main();

package/dist/transport/base64url.js

@@ -0,0 +1,9 @@
+/** Node's decoder ignores invalid characters and trailing bits; signed tokens require canonical bytes. */
+export function decodeBase64url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error();
+    const bytes = Buffer.from(value, "base64url");
+    if (bytes.toString("base64url") !== value)
+        throw new Error();
+    return bytes;
+}

package/dist/transport/http-response.js

@@ -0,0 +1,89 @@
+/** Owns response bounds and cleanup for direct HTTP clients; callers own destinations and payload formats. */
+export function requestBoundedResponse(start, limits) {
+    return new Promise((resolve, reject) => {
+        let req, response;
+        let done = false;
+        let timer;
+        const fail = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            req?.destroy();
+            response?.destroy();
+            reject(new Error("HTTP response failed"));
+        };
+        try {
+            for (const limit of [limits.maxBytes, limits.timeoutMs, limits.bodyTimeoutMs ?? limits.timeoutMs]) {
+                if (!Number.isSafeInteger(limit) || limit < 1)
+                    throw new Error();
+            }
+            // This starts before dialing and never resets on data, so trickled bytes cannot prolong it.
+            timer = setTimeout(fail, limits.timeoutMs);
+            req = start(incoming => {
+                incoming.on("error", fail);
+                incoming.on("aborted", fail);
+                if (done) {
+                    incoming.destroy();
+                    return;
+                }
+                if (response) {
+                    incoming.destroy();
+                    fail();
+                    return;
+                }
+                response = incoming;
+                try {
+                    if (limits.bodyTimeoutMs !== undefined) {
+                        clearTimeout(timer);
+                        timer = setTimeout(fail, limits.bodyTimeoutMs);
+                    }
+                    const length = incoming.headers["content-length"];
+                    const encoding = incoming.headers["content-encoding"];
+                    if (encoding !== undefined && encoding !== "identity" ||
+                        length !== undefined && (!/^\d+$/.test(length) || Number(length) > limits.maxBytes))
+                        throw new Error();
+                    limits.validate?.(incoming);
+                }
+                catch {
+                    fail();
+                    return;
+                }
+                const chunks = [];
+                let bytes = 0;
+                incoming.on("data", (chunk) => {
+                    if (done)
+                        return;
+                    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    bytes += buffer.length;
+                    if (bytes > limits.maxBytes) {
+                        fail();
+                        return;
+                    }
+                    chunks.push(buffer);
+                });
+                incoming.on("end", () => {
+                    if (done)
+                        return;
+                    if (!incoming.complete) {
+                        fail();
+                        return;
+                    }
+                    done = true;
+                    clearTimeout(timer);
+                    resolve({ response: incoming, body: Buffer.concat(chunks) });
+                });
+                incoming.on("close", () => { if (!incoming.complete)
+                    fail(); });
+            });
+            req.on("error", fail);
+            if (done)
+                req.destroy();
+            else
+                req.end(limits.requestBody);
+        }
+        catch {
+            fail();
+        }
+    });
+}

package/dist/transport/tls-exporter.js

@@ -0,0 +1,5 @@
+import { RELAY_TLS_EXPORTER_LABEL } from "../contract/messages.js";
+/** Each peer must derive these bytes independently from its actual socket. */
+export function relayExportedKeyMaterial(socket) {
+    return socket.exportKeyingMaterial(32, RELAY_TLS_EXPORTER_LABEL, Buffer.alloc(0));
+}

package/package.json

@@ -1,16 +1,62 @@
 {
   "name": "@counterfact-labs/cli",
-  "version": "0.1.3",
-  "license": "UNLICENSED",
-  "description": "Check an agent from your terminal or coding agent",
+  "version": "0.2.4",
   "type": "module",
-  "bin": { "counterfact-labs": "dist/main.js" },
-  "engines": { "node": ">=20" },
-  "files": ["dist", "!dist/**/*.test.js", "!dist/test-helpers.js"],
+  "files": [
+    "dist/**/*.js",
+    "dist/gatekeeper/trust/production.json",
+    "bundle/sealed.json",
+    "bundle/client-release.json"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
   "scripts": {
-    "prebuild": "node scripts/copy-api-types.mjs",
-    "build": "node scripts/build.mjs",
-    "test": "npm run build && node --test dist/*.test.js dist/commands/*.test.js",
-    "prepack": "npm run build"
-  }
+    "lint": "eslint .",
+    "bundle:seal": "tsx bundle/seal/cli.ts",
+    "bundle:check": "tsx bundle/seal/cli.ts check",
+    "bench:replay": "tsx bench/replay.ts",
+    "bench:importer": "tsx bench/importer-coverage.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test ${TEST_SHARD:+--test-shard=$TEST_SHARD} --test-concurrency=4 --test-timeout=600000 \"core/**/*.test.ts\" \"adapters/**/*.test.ts\" \"cli/**/*.test.ts\" \"bench/**/*.test.ts\" \"bundle/**/*.test.ts\" \"contract/**/*.test.ts\" \"gatekeeper/**/*.test.ts\" \"relay/**/*.test.ts\" \"transport/**/*.test.ts\" \"packages/core/src/**/*.test.ts\" \"packages/core/*.test.ts\" \"packages/setup-pings/src/**/*.test.ts\" \"scripts/**/*.test.ts\"",
+    "build:core": "npm run build --workspace @counterfact-labs/analysis-core",
+    "build:setup-pings": "npm run build --workspace @counterfact-labs/setup-pings",
+    "prepare": "npm run build:core && npm run build:setup-pings",
+    "pretest": "npm run build:core && npm run build:setup-pings",
+    "release:core": "tsx scripts/release-core.ts",
+    "build:cli": "npm run build:setup-pings && tsx scripts/build-cli.ts",
+    "prepack": "npm run build:core && npm run build:cli",
+    "pack:integration": "tsx scripts/integration/pack.ts",
+    "release:cli": "tsx scripts/release-cli.ts"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "0.128.0",
+    "zod": "4.6.5",
+    "asn1js": "3.0.6",
+    "pkijs": "3.2.5"
+  },
+  "devDependencies": {
+    "@eslint/js": "9.39.5",
+    "@types/node": "24.19.0",
+    "esbuild": "0.28.2",
+    "eslint": "9.39.5",
+    "js-yaml": "4.3.2",
+    "tsx": "4.23.15",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.64.0",
+    "@counterfact-labs/analysis-core": "0.8.0",
+    "@counterfact-labs/setup-pings": "0.1.0"
+  },
+  "workspaces": [
+    "packages/*"
+  ],
+  "bin": {
+    "counterfact-labs": "dist/cli/main.js"
+  },
+  "exports": {
+    ".": "./dist/cli/main.js",
+    "./gatekeeper": "./dist/gatekeeper/client.js"
+  },
+  "license": "UNLICENSED",
+  "description": "Analyze an agent from your terminal or coding agent"
 }

package/LICENSE

@@ -1 +0,0 @@
-Copyright (c) 2026 Counterfact Labs, Inc. All rights reserved. This software is provided to access the Counterfact service and may be used only for that purpose. No other rights are granted.

package/dist/api-types.js

@@ -1,2 +0,0 @@
-// This file is copied into the command-line package before its build. Keep it self-contained.
-export const CLI_BODY_LIMIT = 2 * 1024 * 1024;

package/dist/api.js

@@ -1,97 +0,0 @@
-import { CLI_BODY_LIMIT } from "./api-types.js";
-export const DEFAULT_URL = "https://app.counterfactlabs.com";
-export class ApiError extends Error {
-    status;
-    code;
-    retryAfterMs;
-    constructor(status, code, message, retryAfterMs = 0) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.retryAfterMs = retryAfterMs;
-    }
-}
-function retryAfterMs(value) {
-    if (!value)
-        return 0;
-    const seconds = Number(value);
-    if (Number.isFinite(seconds) && seconds >= 0)
-        return seconds * 1000;
-    const date = Date.parse(value);
-    return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
-}
-export class ApiClient {
-    token;
-    fetcher;
-    signal;
-    baseUrl;
-    constructor(baseUrl, token, fetcher = fetch, signal) {
-        this.token = token;
-        this.fetcher = fetcher;
-        this.signal = signal;
-        const url = new URL(baseUrl);
-        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
-            throw new Error("COUNTERFACT_URL must be an HTTP or HTTPS address without credentials or query fields.");
-        this.baseUrl = url.href.replace(/\/+$/, "");
-    }
-    async request(path, body, authenticated = true) {
-        this.signal?.throwIfAborted();
-        const headers = { accept: "application/json" };
-        if (authenticated) {
-            const token = await this.token();
-            if (!token)
-                throw new Error("Not signed in. Run counterfact-labs login.");
-            headers.authorization = `Bearer ${token}`;
-        }
-        if (body !== undefined)
-            headers["content-type"] = "application/json";
-        const serialized = body === undefined ? undefined : JSON.stringify(body);
-        if (serialized !== undefined && Buffer.byteLength(serialized, "utf8") > CLI_BODY_LIMIT) {
-            throw new ApiError(413, "body_too_large", "The upload is too large. Send at most 2 MB.");
-        }
-        const controller = new AbortController();
-        const cancel = () => controller.abort(this.signal?.reason);
-        const timeout = setTimeout(() => controller.abort(), 120_000);
-        timeout.unref();
-        this.signal?.addEventListener("abort", cancel, { once: true });
-        try {
-            this.signal?.throwIfAborted();
-            let response;
-            try {
-                response = await this.fetcher(`${this.baseUrl}/api/cli/${path}`, {
-                    method: body === undefined ? "GET" : "POST", headers,
-                    body: serialized,
-                    redirect: "error", signal: controller.signal,
-                });
-            }
-            catch {
-                this.signal?.throwIfAborted();
-                throw new ApiError(0, "unreachable", "Can't reach Counterfact. Try again shortly.");
-            }
-            let value;
-            try {
-                value = await response.json();
-            }
-            catch (error) {
-                this.signal?.throwIfAborted();
-                if (response.ok) {
-                    if (error instanceof SyntaxError)
-                        throw new Error("Counterfact returned an invalid response. Try again shortly.");
-                    throw new ApiError(0, "unreachable", "Can't reach Counterfact. Try again shortly.");
-                }
-            }
-            this.signal?.throwIfAborted();
-            if (!response.ok) {
-                const error = value;
-                throw new ApiError(response.status, error?.code ?? "request_failed", typeof error?.error === "string" ? error.error : "The request could not be completed. Try again shortly.", retryAfterMs(response.headers.get("retry-after")));
-            }
-            return value;
-        }
-        finally {
-            clearTimeout(timeout);
-            this.signal?.removeEventListener("abort", cancel);
-        }
-    }
-}
-export function errorCode(error) { return error instanceof ApiError && error.code === "low_balance" ? 2 : 1; }
-export function errorText(error) { return error instanceof Error ? error.message : "The request could not be completed. Try again shortly."; }

package/dist/commands/check.js

@@ -1,104 +0,0 @@
-import { resolve } from "node:path";
-import { realpath } from "node:fs/promises";
-import { listFiles, readUpload } from "../files.js";
-import { repositoryFacts } from "../git.js";
-import { fileText, quoteText, tasteText } from "../output.js";
-import { ApiError } from "../api.js";
-async function awaitQuote(response, ctx) {
-    let progressShown = false;
-    try {
-        while (response.status === "running") {
-            ctx.write(`\r\u001b[2K${response.progress}`);
-            progressShown = true;
-            await ctx.sleep(2000);
-            response = await ctx.api.request(`checks/${encodeURIComponent(response.id)}`);
-        }
-        if (response.status === "failed" || (response.status === "awaiting_confirm" && "error" in response))
-            throw new Error(response.error);
-        if (response.status !== "awaiting_confirm")
-            throw new Error("The check has already finished. Run the check again for a new quote.");
-        return response;
-    }
-    finally {
-        if (progressShown)
-            ctx.write("\r\u001b[2K");
-    }
-}
-export async function prepareCheck(path, ctx) {
-    const root = await realpath(resolve(path));
-    const { repoRoot, ...facts } = await repositoryFacts(root);
-    const files = await listFiles(root, repoRoot);
-    const plan = await ctx.api.request("checks/plan", { files });
-    const selected = new Set(plan.wanted);
-    const wanted = files.filter(file => selected.has(file.path));
-    if (!wanted.length)
-        throw new Error("No agent files were found in this folder.");
-    ctx.write(fileText(path, wanted));
-    const upload = await readUpload(root, files, plan.wanted);
-    const created = await ctx.api.request("checks", { ...facts, files: upload });
-    ctx.write(`Follow it in the app: ${created.url}\n`);
-    const response = await awaitQuote(created, ctx);
-    ctx.write(quoteText(response.quote));
-    return { root, response, files: upload, url: created.url };
-}
-/** A confirmed check can keep running and charge while the connection is down. */
-async function pollConfirmed(id, ctx) {
-    const started = ctx.now();
-    let waited = 0, backoff = 2000;
-    for (;;) {
-        try {
-            return await ctx.api.request(`checks/${id}`);
-        }
-        catch (error) {
-            if (!(error instanceof ApiError) || !(error.status === 0 || error.status === 429 || error.status >= 500 && error.status < 600))
-                throw error;
-            const wait = Math.max(backoff, error.retryAfterMs);
-            // Count both elapsed requests and scheduled waits, including injected clocks.
-            if (Math.max(ctx.now() - started, waited) + wait >= 300_000) {
-                throw new Error(`The check is still running. Its result will appear on the console's Checks page: ${ctx.api.baseUrl}/checks`);
-            }
-            await ctx.sleep(wait);
-            waited += wait;
-            backoff = Math.min(backoff * 2, 30_000);
-        }
-    }
-}
-export async function confirmPrepared(prepared, ctx) {
-    // A preview's price belongs to those uploaded files. Edits need a fresh preview and agreement.
-    const files = Object.entries(prepared.files).map(([path, text]) => ({ path, size: Buffer.byteLength(text, "utf8") }));
-    const current = await readUpload(prepared.root, files, files.map(file => file.path));
-    if (files.some(file => current[file.path] !== prepared.files[file.path]))
-        throw new Error("The agent files changed. Get a new preview and agree to its price before confirming.");
-    const id = encodeURIComponent(prepared.response.id);
-    await ctx.api.request(`checks/${id}/confirm`, { quoteId: prepared.response.quote.quoteId });
-    ctx.write("\r\u001b[2KChecking the agent…");
-    try {
-        for (;;) {
-            await ctx.sleep(2000);
-            const response = await pollConfirmed(id, ctx);
-            if (response.status === "done") {
-                ctx.write("\r\u001b[2K");
-                ctx.write(tasteText(response.taste, response.findingIds));
-                return response;
-            }
-            if (response.status === "failed" || (response.status === "awaiting_confirm" && "error" in response))
-                throw new Error(response.error);
-            if (response.status === "awaiting_confirm")
-                throw new Error("The check needs approval again. Run the check again to see its price.");
-            ctx.write(`\r\u001b[2K${response.progress}`);
-        }
-    }
-    catch (error) {
-        ctx.write("\r\u001b[2K");
-        throw error;
-    }
-}
-export async function check(path, options, ctx) {
-    const prepared = await prepareCheck(path, ctx);
-    if (options.dryRun)
-        return 0;
-    if (!options.yes && !await ctx.ask("Continue? [Y/n] "))
-        return 0;
-    await confirmPrepared(prepared, ctx);
-    return 0;
-}

package/dist/commands/login.js

@@ -1,9 +0,0 @@
-import { startSignIn } from "../sign-in.js";
-export async function login(ctx) {
-    const flow = await startSignIn(ctx);
-    ctx.write(`1. Open ${flow.verificationUri}. If asked, sign in with the code we email you.\n`
-        + `2. Then enter this code on that page: ${flow.userCode}\n`);
-    await flow.done;
-    ctx.write("Signed in.\n");
-    return 0;
-}

package/dist/files.js

@@ -1,99 +0,0 @@
-import { constants } from "node:fs";
-import { lstat, open, readdir, realpath } from "node:fs/promises";
-import { dirname, join, relative, resolve, sep } from "node:path";
-import { ignored, parseIgnore } from "./gitignore.js";
-import { isReadableRepoPath } from "./secret-files.js";
-const slash = (path) => path.split(sep).join("/");
-function safe(path) {
-    return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && isReadableRepoPath(path)
-        && path.split("/").every(part => !["", ".", "..", ".git", "node_modules"].includes(part));
-}
-async function ignoreFile(directory, base) {
-    try {
-        const file = await open(join(directory, ".gitignore"), constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            return parseIgnore(await file.readFile("utf8"), base);
-        }
-        finally {
-            await file.close();
-        }
-    }
-    catch (error) {
-        if (["ENOENT", "ELOOP"].includes(error.code ?? ""))
-            return [];
-        throw error;
-    }
-}
-export async function listFiles(root, repoRoot) {
-    root = await realpath(root);
-    const base = repoRoot ? await realpath(repoRoot) : root;
-    const prefix = slash(relative(base, root));
-    if (prefix.startsWith("../") || prefix === "..")
-        throw new Error("The agent folder must be inside its repository.");
-    let parentRules = [];
-    if (prefix) {
-        let directory = base;
-        parentRules = await ignoreFile(directory, "");
-        for (const part of prefix.split("/")) {
-            directory = join(directory, part);
-            if (ignored(slash(relative(base, directory)), true, parentRules))
-                return [];
-            if (directory !== root)
-                parentRules.push(...await ignoreFile(directory, slash(relative(base, directory))));
-        }
-    }
-    const files = [];
-    async function walk(directory, inherited) {
-        const scope = slash(relative(base, directory));
-        const rules = [...inherited, ...await ignoreFile(directory, scope)];
-        const entries = await readdir(directory, { withFileTypes: true });
-        for (const entry of entries) {
-            const absolute = join(directory, entry.name);
-            const path = slash(relative(root, absolute));
-            if (!safe(path) || entry.isSymbolicLink() || ignored(slash(relative(base, absolute)), entry.isDirectory(), rules))
-                continue;
-            if (entry.isDirectory())
-                await walk(absolute, rules);
-            else if (entry.isFile()) {
-                const stat = await lstat(absolute);
-                if (stat.isFile())
-                    files.push({ path, size: stat.size });
-            }
-        }
-    }
-    await walk(root, parentRules);
-    return files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-}
-export async function readUpload(root, files, wanted) {
-    root = await realpath(root);
-    const sizes = new Map(files.map(file => [file.path, file.size]));
-    const uploaded = Object.create(null);
-    for (const path of wanted) {
-        if (!safe(path) || !sizes.has(path))
-            throw new Error("Counterfact requested a file outside the local file list.");
-        const absolute = resolve(root, path);
-        // A directory replaced by a symlink after listing must not expose files outside the folder.
-        if (await realpath(dirname(absolute)) !== dirname(absolute))
-            throw new Error("A file changed since listing. Run the check again.");
-        const file = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            if (!(await file.stat()).isFile())
-                throw new Error("Only regular files can be uploaded.");
-            const bytes = await file.readFile();
-            let text;
-            try {
-                text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
-            }
-            catch {
-                throw new Error(`${path} is not UTF-8 text and cannot be uploaded.`);
-            }
-            if (Buffer.byteLength(text, "utf8") !== sizes.get(path))
-                throw new Error("A file changed since listing. Run the check again.");
-            uploaded[path] = text;
-        }
-        finally {
-            await file.close();
-        }
-    }
-    return { ...uploaded };
-}

package/dist/gitignore.js

@@ -1,70 +0,0 @@
-const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-function glob(pattern) {
-    let result = "";
-    for (let i = 0; i < pattern.length; i++) {
-        const ch = pattern[i];
-        if (ch === "\\" && i + 1 < pattern.length)
-            result += escape(pattern[++i]);
-        else if (ch === "*" && pattern[i + 1] === "*") {
-            i++;
-            if (pattern[i + 1] === "/") {
-                result += "(?:.*/)?";
-                i++;
-            }
-            else
-                result += ".*";
-        }
-        else if (ch === "*")
-            result += "[^/]*";
-        else if (ch === "?")
-            result += "[^/]";
-        else if (ch === "[") {
-            const end = pattern.indexOf("]", i + 1);
-            if (end < 0)
-                result += "\\[";
-            else {
-                const chars = pattern.slice(i + 1, end).replace(/^!/, "^");
-                result += `[${chars}]`;
-                i = end;
-            }
-        }
-        else
-            result += escape(ch);
-    }
-    return result;
-}
-export function parseIgnore(text, base) {
-    const rules = [];
-    for (let line of text.split(/\r?\n/)) {
-        line = line.replace(/(?<!\\) +$/, "");
-        if (!line || line.startsWith("#"))
-            continue;
-        const negate = line.startsWith("!");
-        if (negate)
-            line = line.slice(1);
-        const directory = line.endsWith("/");
-        if (directory)
-            line = line.slice(0, -1);
-        const anchored = line.startsWith("/") || line.includes("/");
-        if (line.startsWith("/"))
-            line = line.slice(1);
-        if (!line)
-            continue;
-        try {
-            rules.push({ base, directory, negate, regex: new RegExp(`${anchored ? "^" : "(?:^|/)"}${glob(line)}$`) });
-        }
-        catch {
-            throw new Error("A .gitignore pattern could not be read.");
-        }
-    }
-    return rules;
-}
-export function ignored(path, directory, rules) {
-    let excluded = false;
-    for (const rule of rules) {
-        const local = rule.base ? path.startsWith(`${rule.base}/`) ? path.slice(rule.base.length + 1) : null : path;
-        if (local !== null && (!rule.directory || directory) && rule.regex.test(local))
-            excluded = !rule.negate;
-    }
-    return excluded;
-}