@mastra/code-sdk 1.15.0-alpha.1 → 1.15.0-alpha.11

package/dist/agents/sandbox-filesystem.d.ts

@@ -116,19 +116,20 @@ export declare class SandboxFilesystem implements WorkspaceFilesystem {
      */
     walk(path: string, options?: WalkOptions): Promise<WalkEntry[]>;
     /**
-     * Content search executed inside the sandbox in one command. Prefers
-     * ripgrep (`rg --json`) when installed; otherwise falls back to
-     * `grep -rnE`. Patterns the ERE fallback can't express (PCRE-style classes,
-     * word boundaries, lookarounds, non-greedy quantifiers) throw
-     * {@link UnsupportedGrepPatternError} so callers use their host-side walk.
+     * Content search executed inside the sandbox in one command, using the best
+     * engine the sandbox has: ripgrep, then GNU grep (with git choosing files
+     * inside repositories), then POSIX `grep -rnE`. Patterns the grep engines
+     * can't express (PCRE-style classes, word boundaries, lookarounds,
+     * non-greedy quantifiers) throw {@link UnsupportedGrepPatternError} so
+     * callers use their host-side walk.
      *
-     * Callers are expected to apply their own gitignore/hidden/glob filtering
-     * to the returned paths; both engines run with ignore rules disabled so
-     * results are a superset of what any host-side filter would keep.
+     * ripgrep and GNU grep apply every `.gitignore` in the tree, relative to the
+     * directory that holds it, and skip `node_modules` unless the search path
+     * is inside one. Callers still apply their own hidden/glob filtering.
      */
     grep(options: FilesystemGrepOptions): Promise<FilesystemGrepResult[]>;
-    private rgCheck;
-    private hasRipgrep;
+    private toolsCheck;
+    private searchTools;
     private grepWithRipgrep;
     private parseRipgrepJson;
     /**
@@ -138,6 +139,27 @@ export declare class SandboxFilesystem implements WorkspaceFilesystem {
      * POSIX bracket classes, GNU word anchors) must fall back to the host walk.
      */
     private static readonly ERE_UNSUPPORTED;
+    /**
+     * Escapes that `grep -P` (PCRE) and JS RegExp (without the `u` flag) both
+     * accept but read differently, e.g. `\A` is "start of subject" in PCRE and
+     * a literal `A` in JS, plus POSIX bracket classes. PCRE-only syntax that JS
+     * rejects (inline flags, possessive quantifiers, atomic groups) already
+     * fails the JS compile below.
+     */
+    private static readonly PCRE_UNSUPPORTED;
+    /** Reject patterns grep can't run with the same meaning as JS; return the JS regex used for columns. */
+    private static grepRegex;
+    /**
+     * GNU grep without ripgrep. Inside a git checkout, `git grep` picks the
+     * files (tracked plus untracked, every `.gitignore` applied) and GNU grep
+     * prints them with context. Outside a checkout (e.g. a multi-repo root),
+     * each child repository is searched the same way and plain grep covers the
+     * remaining files, skipping `node_modules`. `--null` ends each file name
+     * with NUL, so match (`N:`) and context (`N-`) lines parse unambiguously.
+     * When grep and git support it, patterns run as PCRE (`-P`), so `\d`,
+     * `\w`, `\s`, `\b`, and lookarounds don't need the host walk.
+     */
+    private grepWithGnuGrep;
     private grepWithPosixGrep;
     private applyTotalCap;
     exists(path: string): Promise<boolean>;

package/dist/agents/sandbox-filesystem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-filesystem.d.ts","sourceRoot":"","sources":["../../src/agents/sandbox-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,QAAQ,EAER,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,YAAY,EACb,MAAM,wBAAwB,CAAC;AAmBhC,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EAAE,EACf,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;IACnD,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAmBD,qBAAa,iBAAkB,YAAW,mBAAmB;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,aAAa;IAC9B,MAAM,EAAE,cAAc,CAAW;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAkB;gBAE5B,OAAO,EAAE,wBAAwB;IAc7C,8EAA8E;IAC9E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,6EAA6E;YAC/D,IAAI;IAkBlB;;;;OAIG;YACW,YAAY;IAI1B;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAkBtB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;YAS5C,IAAI;IASlB;;;;;;;;;OASG;YACW,uBAAuB;IA0BrC;;;;;;OAMG;YACW,mBAAmB;YAWnB,MAAM;IAUd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAoBvE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCzE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAuBxE,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,gBAAgB;IAQxB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAqDrE;;;;;;;;;;OAUG;IACG,IAAI,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAS3E,OAAO,CAAC,OAAO,CAA+B;IAE9C,OAAO,CAAC,UAAU;YAQJ,eAAe;IA4B7B,OAAO,CAAC,gBAAgB;IA2DxB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA+C;YAExE,iBAAiB;IAsD/B,OAAO,CAAC,aAAa;IAgBf,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+BrC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAKjC,OAAO,IAAI,cAAc;IAUzB,eAAe,IAAI,MAAM;CAG1B"}
+{"version":3,"file":"sandbox-filesystem.d.ts","sourceRoot":"","sources":["../../src/agents/sandbox-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,QAAQ,EAER,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,YAAY,EACb,MAAM,wBAAwB,CAAC;AAmBhC,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,EAAE,EACf,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;IACnD,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAkGD,qBAAa,iBAAkB,YAAW,mBAAmB;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,aAAa;IAC9B,MAAM,EAAE,cAAc,CAAW;IAEjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAkB;gBAE5B,OAAO,EAAE,wBAAwB;IAc7C,8EAA8E;IAC9E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,6EAA6E;YAC/D,IAAI;IAkBlB;;;;OAIG;YACW,YAAY;IAI1B;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAkBtB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;YAS5C,IAAI;IASlB;;;;;;;;;OASG;YACW,uBAAuB;IA0BrC;;;;;;OAMG;YACW,mBAAmB;YAWnB,MAAM;IAUd,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAoBvE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpF,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBhE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCzE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAuBxE,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,gBAAgB;IAQxB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IA6DrE;;;;;;;;;;;OAWG;IACG,IAAI,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAS3E,OAAO,CAAC,UAAU,CAAmC;IAErD,OAAO,CAAC,WAAW;YAoBL,eAAe;IAgC7B,OAAO,CAAC,gBAAgB;IA4BxB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA+C;IAEtF;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAyC;IAEjF,wGAAwG;IACxG,OAAO,CAAC,MAAM,CAAC,SAAS;IAkBxB;;;;;;;;;OASG;YACW,eAAe;YAqFf,iBAAiB;IAoD/B,OAAO,CAAC,aAAa;IAgBf,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+BrC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAKjC,OAAO,IAAI,cAAc;IAUzB,eAAe,IAAI,MAAM;CAG1B"}

package/dist/agents/sandbox-filesystem.js

@@ -25,10 +25,69 @@ const EXIT_EXISTS = 22;
 const EXIT_NOT_DIRECTORY = 23;
 /** Default per-command deadline so a hung sandbox can't block file tools forever. */
 const COMMAND_TIMEOUT_MS = 3e4;
+/**
+* Explain why a native grep command failed so callers can tell a timeout or
+* broken toolchain apart from a pattern the engine cannot express.
+*/
+function describeGrepFailure(result) {
+	if (result.exitCode === 124) return `timed out after ${COMMAND_TIMEOUT_MS / 1e3}s`;
+	const stderrLine = result.stderr.split("\n").map((line) => line.trim()).find(Boolean);
+	const detail = stderrLine ? `: ${stderrLine.length > 200 ? `${stderrLine.slice(0, 200)}…` : stderrLine}` : "";
+	return `exit code ${result.exitCode}${detail}`;
+}
 /** Single-quote a string for safe POSIX shell interpolation. */
 function shellQuote(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+/** One command that reports which search tools the sandbox has, one name per line. */
+const SEARCH_TOOLS_PROBE = "command -v rg >/dev/null 2>&1 && echo rg; grep --version 2>/dev/null | head -n 1 | grep -q 'GNU grep' && echo gnu-grep; printf 'a1\\n' | grep -qP '\\d(?=)' 2>/dev/null && echo grep-pcre; if command -v git >/dev/null 2>&1; then echo git; d=$(mktemp -d 2>/dev/null) && { (cd \"$d\" && git init -q && printf 'a1\\n' >f && git grep -q --untracked -P -e '\\d(?=)') >/dev/null 2>&1 && echo git-pcre; rm -rf \"$d\"; }; fi; true";
+function isInsideNodeModules(path) {
+	return path.split("/").includes("node_modules");
+}
+function fileLines(files, filePath) {
+	let state = files.get(filePath);
+	if (!state) {
+		state = {
+			matches: [],
+			linesByNumber: /* @__PURE__ */ new Map()
+		};
+		files.set(filePath, state);
+	}
+	return state;
+}
+/** Turn per-file lines into results relative to `abs`, attaching before/after context. */
+function toGrepResults(files, abs, contextLines) {
+	const results = [];
+	for (const [filePath, state] of files) {
+		if (state.matches.length === 0) continue;
+		const rel = posix.relative(abs, filePath) || posix.basename(filePath);
+		const matches = state.matches.map((match) => {
+			if (contextLines <= 0) return match;
+			const before = [];
+			for (let n = match.line - 1; n >= Math.max(1, match.line - contextLines); n--) {
+				const text = state.linesByNumber.get(n);
+				if (text === void 0) break;
+				before.unshift(text);
+			}
+			const after = [];
+			for (let n = match.line + 1; n <= match.line + contextLines; n++) {
+				const text = state.linesByNumber.get(n);
+				if (text === void 0) break;
+				after.push(text);
+			}
+			return {
+				...match,
+				before,
+				after
+			};
+		});
+		results.push({
+			path: rel,
+			matches
+		});
+	}
+	return results;
+}
 function isFileContentString(content) {
 	return typeof content === "string";
 }
@@ -319,8 +378,11 @@ var SandboxFilesystem = class SandboxFilesystem {
 		const abs = await this.resolveAsync(path);
 		await this.assertContainedRealpath(abs, path);
 		const maxDepth = options?.maxDepth !== void 0 && Number.isFinite(options.maxDepth) ? `-maxdepth ${Math.max(0, Math.floor(options.maxDepth))} ` : "";
-		const hiddenPrune = options?.includeHidden ? "" : `-name '.*' -prune -o `;
-		const script = `root=${shellQuote(abs)}\n[ -e "$root" ] || [ -L "$root" ] || exit ${EXIT_NOT_FOUND}\n[ -d "$root" ] || exit ${EXIT_NOT_DIRECTORY}\nfind "$root" -mindepth 1 ${maxDepth}${hiddenPrune}-print 2>/dev/null | while IFS= read -r f; do if [ -L "$f" ]; then if [ -d "$f" ]; then t=D; else t=F; fi; printf '%s\\t%s\\t%s\\n' "$t" "$f" "$(readlink "$f")"; elif [ -d "$f" ]; then printf 'd\\t%s\\n' "$f"; else printf 'f\\t%s\\n' "$f"; fi; done`;
+		const keepGitignore = options?.includeGitignoreFiles ? `! \\( -type f -name .gitignore \\) ` : "";
+		const hiddenPrune = options?.includeHidden ? "" : `\\( -name '.*' ${keepGitignore}\\) -prune -o `;
+		const skipNames = options?.skipDirectoryNames?.filter(Boolean) ?? [];
+		const skipPrune = skipNames.length ? `\\( -type d \\( ${skipNames.map((name) => `-name ${shellQuote(name)}`).join(" -o ")} \\) \\) -prune -o ` : "";
+		const script = `root=${shellQuote(abs)}\n[ -e "$root" ] || [ -L "$root" ] || exit ${EXIT_NOT_FOUND}\n[ -d "$root" ] || exit ${EXIT_NOT_DIRECTORY}\nfind "$root" -mindepth 1 ${maxDepth}${hiddenPrune}${skipPrune}-print 2>/dev/null | while IFS= read -r f; do if [ -L "$f" ]; then if [ -d "$f" ]; then t=D; else t=F; fi; printf '%s\\t%s\\t%s\\n' "$t" "$f" "$(readlink "$f")"; elif [ -d "$f" ]; then printf 'd\\t%s\\n' "$f"; else printf 'f\\t%s\\n' "$f"; fi; done`;
 		const result = await this.exec(script);
 		if (result.exitCode === EXIT_NOT_FOUND) throw new DirectoryNotFoundError(path);
 		if (result.exitCode === EXIT_NOT_DIRECTORY) throw new NotDirectoryError(path);
@@ -356,31 +418,53 @@ var SandboxFilesystem = class SandboxFilesystem {
 		return entries;
 	}
 	/**
-	* Content search executed inside the sandbox in one command. Prefers
-	* ripgrep (`rg --json`) when installed; otherwise falls back to
-	* `grep -rnE`. Patterns the ERE fallback can't express (PCRE-style classes,
-	* word boundaries, lookarounds, non-greedy quantifiers) throw
-	* {@link UnsupportedGrepPatternError} so callers use their host-side walk.
+	* Content search executed inside the sandbox in one command, using the best
+	* engine the sandbox has: ripgrep, then GNU grep (with git choosing files
+	* inside repositories), then POSIX `grep -rnE`. Patterns the grep engines
+	* can't express (PCRE-style classes, word boundaries, lookarounds,
+	* non-greedy quantifiers) throw {@link UnsupportedGrepPatternError} so
+	* callers use their host-side walk.
 	*
-	* Callers are expected to apply their own gitignore/hidden/glob filtering
-	* to the returned paths; both engines run with ignore rules disabled so
-	* results are a superset of what any host-side filter would keep.
+	* ripgrep and GNU grep apply every `.gitignore` in the tree, relative to the
+	* directory that holds it, and skip `node_modules` unless the search path
+	* is inside one. Callers still apply their own hidden/glob filtering.
 	*/
 	async grep(options) {
 		const abs = await this.resolveAsync(options.path);
 		await this.assertContainedRealpath(abs, options.path);
-		if (await this.hasRipgrep()) return this.grepWithRipgrep(abs, options);
+		const tools = await this.searchTools();
+		if (tools.rg) return this.grepWithRipgrep(abs, options);
+		if (tools.gnuGrep) return this.grepWithGnuGrep(abs, options, tools);
 		return this.grepWithPosixGrep(abs, options);
 	}
-	rgCheck;
-	hasRipgrep() {
-		this.rgCheck ??= this.exec("command -v rg >/dev/null 2>&1").then((r) => r.exitCode === 0, () => false);
-		return this.rgCheck;
+	toolsCheck;
+	searchTools() {
+		const check = this.toolsCheck ??= this.exec(SEARCH_TOOLS_PROBE).then((result) => {
+			if (result.exitCode !== 0) throw new Error(`search tool probe exited with ${result.exitCode}`);
+			const found = new Set(result.stdout.split("\n").map((line) => line.trim()));
+			const git = found.has("git");
+			return {
+				rg: found.has("rg"),
+				gnuGrep: found.has("gnu-grep"),
+				git,
+				pcre: found.has("grep-pcre") && (!git || found.has("git-pcre"))
+			};
+		});
+		return check.catch(() => {
+			if (this.toolsCheck === check) this.toolsCheck = void 0;
+			return {
+				rg: false,
+				gnuGrep: false,
+				git: false,
+				pcre: false
+			};
+		});
 	}
 	async grepWithRipgrep(abs, options) {
 		const args = [
-			"rg --json --no-ignore --hidden",
+			"rg --json --hidden --no-require-git",
 			`-g ${shellQuote("!.git/**")}`,
+			isInsideNodeModules(abs) ? "" : `-g ${shellQuote("!**/node_modules/**")}`,
 			options.caseSensitive ? "" : "-i",
 			options.maxCountPerFile !== void 0 ? `-m ${Math.max(1, Math.floor(options.maxCountPerFile))}` : "",
 			options.contextLines ? `-C ${Math.max(0, Math.floor(options.contextLines))}` : "",
@@ -390,7 +474,7 @@ var SandboxFilesystem = class SandboxFilesystem {
 		const result = await this.exec(args);
 		if (result.exitCode === 1) return [];
 		const results = this.parseRipgrepJson(result.stdout, abs, options);
-		if (result.exitCode !== 0 && results.length === 0) throw new UnsupportedGrepPatternError(options.pattern);
+		if (result.exitCode !== 0 && results.length === 0) throw new UnsupportedGrepPatternError(options.pattern, describeGrepFailure(result));
 		return results;
 	}
 	parseRipgrepJson(stdout, abs, options) {
@@ -407,14 +491,7 @@ var SandboxFilesystem = class SandboxFilesystem {
 			const filePath = event.data?.path?.text;
 			const lineNumber = event.data?.line_number;
 			if (!filePath || !lineNumber) continue;
-			let state = files.get(filePath);
-			if (!state) {
-				state = {
-					matches: [],
-					linesByNumber: /* @__PURE__ */ new Map()
-				};
-				files.set(filePath, state);
-			}
+			const state = fileLines(files, filePath);
 			const text = (event.data?.lines?.text ?? "").replace(/\r?\n$/, "");
 			state.linesByNumber.set(lineNumber, text);
 			if (event.type === "match") {
@@ -423,42 +500,11 @@ var SandboxFilesystem = class SandboxFilesystem {
 				state.matches.push({
 					line: lineNumber,
 					column,
-					text,
-					lineNumber
+					text
 				});
 			}
 		}
-		const contextLines = options.contextLines ?? 0;
-		const results = [];
-		for (const [filePath, state] of files) {
-			if (state.matches.length === 0) continue;
-			const rel = posix.relative(abs, filePath) || posix.basename(filePath);
-			const matches = state.matches.map(({ lineNumber, ...match }) => {
-				if (contextLines <= 0) return match;
-				const before = [];
-				for (let n = lineNumber - 1; n >= Math.max(1, lineNumber - contextLines); n--) {
-					const t = state.linesByNumber.get(n);
-					if (t === void 0) break;
-					before.unshift(t);
-				}
-				const after = [];
-				for (let n = lineNumber + 1; n <= lineNumber + contextLines; n++) {
-					const t = state.linesByNumber.get(n);
-					if (t === void 0) break;
-					after.push(t);
-				}
-				return {
-					...match,
-					before,
-					after
-				};
-			});
-			results.push({
-				path: rel,
-				matches
-			});
-		}
-		return this.applyTotalCap(results, options.maxTotalMatches);
+		return this.applyTotalCap(toGrepResults(files, abs, options.contextLines ?? 0), options.maxTotalMatches);
 	}
 	/**
 	* Patterns whose meaning differs between POSIX ERE and JS RegExp. The grep
@@ -467,17 +513,113 @@ var SandboxFilesystem = class SandboxFilesystem {
 	* POSIX bracket classes, GNU word anchors) must fall back to the host walk.
 	*/
 	static ERE_UNSUPPORTED = /\\[dDwWsSbB<>]|\(\?|[*+?}]\?|\[:[a-z]+:\]/;
-	async grepWithPosixGrep(abs, options) {
-		if (SandboxFilesystem.ERE_UNSUPPORTED.test(options.pattern)) throw new UnsupportedGrepPatternError(options.pattern);
-		let jsRegex;
+	/**
+	* Escapes that `grep -P` (PCRE) and JS RegExp (without the `u` flag) both
+	* accept but read differently, e.g. `\A` is "start of subject" in PCRE and
+	* a literal `A` in JS, plus POSIX bracket classes. PCRE-only syntax that JS
+	* rejects (inline flags, possessive quantifiers, atomic groups) already
+	* fails the JS compile below.
+	*/
+	static PCRE_UNSUPPORTED = /\\[AzZGKQEhHvVRXNCpPe]|\[:[a-z]+:\]/;
+	/** Reject patterns grep can't run with the same meaning as JS; return the JS regex used for columns. */
+	static grepRegex(options, pcre = false) {
+		if (pcre ? SandboxFilesystem.PCRE_UNSUPPORTED.test(options.pattern) : SandboxFilesystem.ERE_UNSUPPORTED.test(options.pattern)) throw new UnsupportedGrepPatternError(options.pattern, pcre ? "grep -P reads this syntax differently from JavaScript" : "POSIX ERE cannot express this syntax");
 		try {
-			jsRegex = new RegExp(options.pattern, options.caseSensitive ? "" : "i");
+			return new RegExp(options.pattern, options.caseSensitive ? "" : "i");
 		} catch {
-			throw new UnsupportedGrepPatternError(options.pattern);
+			throw new UnsupportedGrepPatternError(options.pattern, "invalid regular expression");
+		}
+	}
+	/**
+	* GNU grep without ripgrep. Inside a git checkout, `git grep` picks the
+	* files (tracked plus untracked, every `.gitignore` applied) and GNU grep
+	* prints them with context. Outside a checkout (e.g. a multi-repo root),
+	* each child repository is searched the same way and plain grep covers the
+	* remaining files, skipping `node_modules`. `--null` ends each file name
+	* with NUL, so match (`N:`) and context (`N-`) lines parse unambiguously.
+	* When grep and git support it, patterns run as PCRE (`-P`), so `\d`,
+	* `\w`, `\s`, `\b`, and lookarounds don't need the host walk.
+	*/
+	async grepWithGnuGrep(abs, options, tools) {
+		const hasGit = tools.git;
+		const mode = tools.pcre ? "-P" : "-E";
+		const jsRegex = SandboxFilesystem.grepRegex(options, tools.pcre);
+		const contextLines = Math.max(0, Math.floor(options.contextLines ?? 0));
+		const grepFlags = [
+			`-HnI${mode.slice(1)} --null`,
+			options.caseSensitive ? "" : "-i",
+			options.maxCountPerFile !== void 0 ? `-m ${Math.max(1, Math.floor(options.maxCountPerFile))}` : "",
+			contextLines > 0 ? `-C ${contextLines}` : ""
+		].filter(Boolean).join(" ");
+		const skipNodeModules = !isInsideNodeModules(abs);
+		const nodeModulesPathspec = skipNodeModules ? ` ${shellQuote(":(exclude,glob)**/node_modules/**")}` : "";
+		const pruneNames = skipNodeModules ? "-name .git -o -name node_modules" : "-name .git";
+		const script = [
+			`pat=${shellQuote(options.pattern)}`,
+			`root=${shellQuote(abs)}`,
+			`grep ${mode} -e "$pat" </dev/null >/dev/null 2>&1`,
+			"if [ $? -eq 2 ]; then echo \"grep: invalid regular expression\" >&2; exit 2; fi",
+			"tmp=$(mktemp -d) || exit 1",
+			`trap 'rm -rf "$tmp"' EXIT`,
+			`search_files() { xargs -0 -r grep ${grepFlags} -e "$pat" -- 2>/dev/null; }`,
+			"search_repo() {",
+			`  git -C "$1" grep -l -z -I --untracked ${options.caseSensitive ? "" : "-i "}${mode} -e "$pat" -- .${nodeModulesPathspec} >"$tmp/files" 2>/dev/null`,
+			"  [ $? -gt 1 ] && return 1",
+			`  printf '\\0%s\\n' "$1"`,
+			"  (cd \"$1\" && search_files) <\"$tmp/files\"",
+			"}",
+			...hasGit ? [
+				"if git -C \"$root\" rev-parse --is-inside-work-tree >/dev/null 2>&1 && ! git -C \"$root\" check-ignore -q . 2>/dev/null; then",
+				"  search_repo \"$root\" && exit 0",
+				"fi",
+				`find "$root" -mindepth 1 -maxdepth 3 \\( ${skipNodeModules ? "-name node_modules -prune" : "-false"} \\) -o \\( -name .git -prune -print \\) >"$tmp/repos" 2>/dev/null`,
+				": >\"$tmp/done\"",
+				"while IFS= read -r g; do",
+				"  d=${g%/.git}",
+				"  search_repo \"$d\" && printf '%s\\n' \"$d\" >>\"$tmp/done\"",
+				"done <\"$tmp/repos\"",
+				"set --",
+				"while IFS= read -r d; do set -- \"$@\" -o -path \"$d\"; done <\"$tmp/done\""
+			] : ["set --"],
+			`printf '\\0%s\\n' "$root"`,
+			`find "$root" -mindepth 1 \\( ${pruneNames} "$@" \\) -prune -o -type f -print0 2>/dev/null | search_files`,
+			"exit 0"
+		].join("\n");
+		const result = await this.exec(script);
+		if (result.exitCode !== 0) throw new UnsupportedGrepPatternError(options.pattern, describeGrepFailure(result));
+		const files = /* @__PURE__ */ new Map();
+		let base = abs;
+		for (const line of result.stdout.split("\n")) {
+			if (!line || line === "--") continue;
+			if (line.startsWith("\0")) {
+				base = line.slice(1);
+				continue;
+			}
+			const nul = line.indexOf("\0");
+			if (nul <= 0) continue;
+			const parsed = /^(\d+)([:-])(.*)$/s.exec(line.slice(nul + 1));
+			if (!parsed) continue;
+			const lineNumber = Number(parsed[1]);
+			const text = parsed[3];
+			const state = fileLines(files, posix.resolve(base, line.slice(0, nul)));
+			state.linesByNumber.set(lineNumber, text);
+			if (parsed[2] !== ":") continue;
+			const column = jsRegex.exec(text)?.index;
+			if (column === void 0) throw new UnsupportedGrepPatternError(options.pattern, "POSIX ERE and JS RegExp disagree on this pattern");
+			state.matches.push({
+				line: lineNumber,
+				column,
+				text
+			});
 		}
-		if (options.contextLines) throw new UnsupportedGrepPatternError(options.pattern);
+		return this.applyTotalCap(toGrepResults(files, abs, contextLines), options.maxTotalMatches);
+	}
+	async grepWithPosixGrep(abs, options) {
+		const jsRegex = SandboxFilesystem.grepRegex(options);
+		if (options.contextLines) throw new UnsupportedGrepPatternError(options.pattern, "context lines are not supported by POSIX grep");
 		const args = [
 			"grep -rnIE",
+			"--exclude-dir=.git",
 			options.caseSensitive ? "" : "-i",
 			options.maxCountPerFile !== void 0 ? `-m ${Math.max(1, Math.floor(options.maxCountPerFile))}` : "",
 			"--",
@@ -486,7 +628,7 @@ var SandboxFilesystem = class SandboxFilesystem {
 		].filter(Boolean).join(" ");
 		const result = await this.exec(args);
 		if (result.exitCode === 1) return [];
-		if (result.exitCode !== 0) throw new UnsupportedGrepPatternError(options.pattern);
+		if (result.exitCode !== 0 && !(result.exitCode === 2 && result.stdout.trim())) throw new UnsupportedGrepPatternError(options.pattern, describeGrepFailure(result));
 		const byFile = /* @__PURE__ */ new Map();
 		for (const line of result.stdout.split("\n")) {
 			if (!line) continue;
@@ -495,7 +637,7 @@ var SandboxFilesystem = class SandboxFilesystem {
 			const rel = posix.relative(abs, parsed[1]) || posix.basename(parsed[1]);
 			const text = parsed[3];
 			const column = jsRegex.exec(text)?.index;
-			if (column === void 0) throw new UnsupportedGrepPatternError(options.pattern);
+			if (column === void 0) throw new UnsupportedGrepPatternError(options.pattern, "POSIX ERE and JS RegExp disagree on this pattern");
 			let matches = byFile.get(rel);
 			if (!matches) {
 				matches = [];