@nexrall/code-core 1.4.63 → 1.4.65

package/dist/tools/executor.js

@@ -33,6 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.capExternalOutput = capExternalOutput;
+exports.runCapture = runCapture;
+exports.globToRegex = globToRegex;
 exports.executeTool = executeTool;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -64,7 +67,15 @@ const peerTransport_1 = require("../agent/peerTransport");
 const DEFAULT_TIMEOUT_MS = 60000;
 const MAX_FETCH_BYTES = 200 * 1024; // 200 KB
 const MAX_READ_BYTES = 500 * 1024; // 500 KB — still used by notebook_read (JSON.parse needs it whole)
-const MAX_OUTPUT_CHARS = 100000; // bash / grep output cap (~100 KB)
+// bash / grep / list output cap. 30K chars matches Claude Code's Bash default; it was 100K,
+// i.e. ~28K tokens re-sent on every later request for one noisy command. Full bash output
+// still spills to a temp file (see GAP B below), so nothing is lost — only inlined less.
+const MAX_OUTPUT_CHARS = 30000;
+// fetch_url: text handed to the model AFTER html stripping. The download cap above stays
+// larger because raw HTML is mostly markup that stripHtml discards.
+const MAX_FETCH_OUTPUT_CHARS = 40000;
+// glob / search_files(files) list cap, most-recent first — same as Claude Code's Glob.
+const MAX_GLOB_RESULTS = 100;
 // read_file has NO byte-size gate (unlike the old 500KB cutoff) — like Claude
 // Code, a file of any size can be read; it's always streamed line-by-line so
 // memory is bounded regardless of file size. Instead there are two independent
@@ -81,6 +92,10 @@ const MAX_READ_LINES = 2000;
 const MAX_READ_TOKENS = 25000;
 const READ_CHARS_PER_TOKEN = 4; // rough, conservative — consistent with loop.ts's resume estimator
 const MAX_READ_CHARS = MAX_READ_TOKENS * READ_CHARS_PER_TOKEN; // 100,000 chars
+// Per-line cap (Claude Code: 2000). Without it a line longer than the whole token budget
+// (minified bundle, one-line JSON) could never be kept: the read returned "lines 1-0 (more
+// lines follow — pass offset:0 to continue)" forever and the model fell back to `cat`.
+const MAX_READ_LINE_CHARS = 2000;
 // GAP B — output spillover. The inline bash result keeps only HEAD+TAIL (~100 KB),
 // which loses the MIDDLE of a large log — often exactly where a stack trace's root
 // cause or a failing assertion lives. To make the full log recoverable WITHOUT
@@ -270,12 +285,16 @@ async function readFileWindowed(resolved, offset, requestedLimit) {
         let keptChars = 0;
         let lineNo = 0; // 0-based index of the NEXT line to be completed
         let carry = ''; // partial line spanning chunk boundaries
+        let carryOverflow = false; // carry already holds MAX_READ_LINE_CHARS+ of a longer line
         let stopped = false;
         let hitTokenCap = false;
         let sawEof = false;
         const stream = fs.createReadStream(resolved, { encoding: 'utf-8', highWaterMark: 256 * 1024 });
         // Returns false if adding this line would exceed the token budget (line NOT kept).
-        const tryPushLine = (line) => {
+        const tryPushLine = (raw) => {
+            const line = raw.length > MAX_READ_LINE_CHARS
+                ? `${raw.slice(0, MAX_READ_LINE_CHARS)}… [line truncated at ${MAX_READ_LINE_CHARS} chars]`
+                : raw;
             const formatted = formatNumberedLine(offset, kept.length, line);
             const added = formatted.length + 1; // +1 for the join newline
             if (keptChars + added > MAX_READ_CHARS) {
@@ -308,9 +327,23 @@ async function readFileWindowed(resolved, offset, requestedLimit) {
             resolve({ output: `[File: ${resolved} — lines ${first}-${last}${totalNote}${note}]\n${numbered}` });
         };
         stream.on('data', (chunk) => {
-            const text = carry + (typeof chunk === 'string' ? chunk : chunk.toString('utf-8'));
+            let str = typeof chunk === 'string' ? chunk : chunk.toString('utf-8');
+            if (carryOverflow) {
+                // Still inside an over-long line whose kept prefix is already in `carry`:
+                // discard until its newline so memory stays bounded for one-line files.
+                const nl = str.indexOf('\n');
+                if (nl < 0)
+                    return;
+                str = str.slice(nl);
+                carryOverflow = false;
+            }
+            const text = carry + str;
             const lines = text.split('\n');
             carry = lines.pop() ?? ''; // last element is an incomplete line (or '')
+            if (carry.length > MAX_READ_LINE_CHARS) {
+                carry = carry.slice(0, MAX_READ_LINE_CHARS + 1); // +1 so tryPushLine still marks it truncated
+                carryOverflow = true;
+            }
             for (const line of lines) {
                 if (lineNo >= offset) {
                     if (lineNo >= hardEndLine) {
@@ -434,7 +467,7 @@ async function writeFile(input, workDir) {
             // A brand-new file has no "removed" side — every line is an addition.
             return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)${sec}`, linesAdded: lines, linesRemoved: 0 };
         }
-        const xfile = crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
+        const xfile = await crossFileBreakageWarning(resolved, normalizeLF(priorContent), normalizeLF(content), workDir ?? process.cwd());
         // Reward-hacking guard: a write_file that OVERWRITES an existing test file can
         // silently drop assertions / test cases. The loop layer can't see the prior
         // content — but we can (we just read it). Run the full old→new analysis and
@@ -1111,22 +1144,116 @@ async function bash(input, abortSignal, sandbox, workDir, onStream) {
         child.on('close', () => clearInterval(pollAbort));
     });
 }
+/**
+ * Cap output from a tool we do not control (MCP servers). Built-in tools all cap their
+ * own output, but an MCP result went into the conversation verbatim: one call to a
+ * DB/browser/log server could inline megabytes, which is then re-sent (and re-billed as
+ * cache writes) on every later round until compaction. Keep HEAD+TAIL inline and spill
+ * the full text to a temp file the model can read_file with offset/limit — the same
+ * contract as bash's GAP B spill.
+ */
+function capExternalOutput(output, label, maxChars = MAX_OUTPUT_CHARS) {
+    if (output.length <= maxChars)
+        return output;
+    let spillNote = '';
+    try {
+        fs.mkdirSync(SPILL_DIR, { recursive: true });
+        const safe = label.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 60);
+        const spillPath = path.join(SPILL_DIR, `${safe}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.log`);
+        fs.writeFileSync(spillPath, (0, safeSlice_1.sliceSafeEnd)(output, MAX_SPILL_BYTES));
+        spillNote = ` Full output (${output.length} chars) saved to ${spillPath} — use read_file with offset/limit to inspect any section.`;
+    }
+    catch { /* spill is best-effort */ }
+    const headLen = Math.floor(maxChars * 0.7);
+    const tailLen = maxChars - headLen;
+    const omitted = output.length - headLen - tailLen;
+    return `${(0, safeSlice_1.sliceSafeEnd)(output, headLen)}\n\n[… ${omitted} chars omitted.${spillNote}]\n\n${(0, safeSlice_1.sliceSafeStart)(output, output.length - tailLen)}`;
+}
+function runCapture(cmd, args, opts) {
+    return new Promise((resolve) => {
+        let stdout = '';
+        let stderr = '';
+        let bytes = 0;
+        let error;
+        let settled = false;
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(cmd, args, { cwd: opts.cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+        }
+        catch (e) {
+            resolve({ stdout: '', stderr: '', status: null, signal: null, error: e });
+            return;
+        }
+        const finish = (status, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve({ stdout, stderr, status, signal, ...(error ? { error } : {}) });
+        };
+        const kill = (code) => {
+            if (!error)
+                error = Object.assign(new Error(`${cmd} ${code}`), { code });
+            try {
+                child.kill('SIGTERM');
+            }
+            catch { /* already gone */ }
+        };
+        const timer = setTimeout(() => kill('ETIMEDOUT'), opts.timeout);
+        child.stdout.setEncoding('utf-8');
+        child.stderr.setEncoding('utf-8');
+        child.stdout.on('data', (chunk) => {
+            if (error)
+                return;
+            bytes += Buffer.byteLength(chunk);
+            if (bytes > opts.maxBuffer) {
+                // Keep what fits, like spawnSync's truncated stdout on ENOBUFS.
+                stdout += chunk.slice(0, Math.max(0, chunk.length - (bytes - opts.maxBuffer)));
+                kill('ENOBUFS');
+                return;
+            }
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => { if (stderr.length < 64 * 1024)
+            stderr += chunk; });
+        child.on('error', (e) => { if (!error)
+            error = e; finish(null, null); });
+        child.on('close', (code, signal) => finish(code, signal));
+    });
+}
 // Detect ripgrep once per process — preferred over grep (faster, respects .gitignore).
+//
+// Binary resolution: NEXRALL_RG_PATH first (the VS Code extension points it at the rg
+// that ships inside every VS Code / Cursor install, so users without a system rg still
+// get the fast, .gitignore-aware path), then `rg` on PATH. Before this, a machine with
+// no rg installed silently fell back to grep and a full, ignore-unaware directory walk.
 let _rgChecked = false;
 let _rgAvailable = false;
+let _rgBin = 'rg';
 function ripgrepAvailable() {
     if (!_rgChecked) {
-        const probe = (0, child_process_1.spawnSync)('rg', ['--version'], { encoding: 'utf-8', timeout: 3000 });
-        _rgAvailable = probe.status === 0;
         _rgChecked = true;
+        const candidates = [process.env.NEXRALL_RG_PATH, 'rg'].filter((c) => !!c);
+        for (const bin of candidates) {
+            const probe = (0, child_process_1.spawnSync)(bin, ['--version'], { encoding: 'utf-8', timeout: 3000 });
+            if (probe.status === 0) {
+                _rgBin = bin;
+                _rgAvailable = true;
+                break;
+            }
+        }
     }
     return _rgAvailable;
 }
+/** The ripgrep binary to spawn. Only meaningful after ripgrepAvailable() returned true. */
+function rgBin() {
+    return _rgBin;
+}
 // ── Cross-file breakage warning ──────────────────────────────────────────────
 // After an edit removes/renames an exported symbol, scan the rest of the repo for
 // surviving references. Returns a short warning string (or '' when clean). Best-
 // effort, time-boxed, and never throws — a scan failure must not fail the edit.
-function crossFileBreakageWarning(editedAbsPath, oldContent, newContent, workDir) {
+async function crossFileBreakageWarning(editedAbsPath, oldContent, newContent, workDir) {
     if (process.env.NEXRALL_CROSSFILE_CHECK === '0')
         return '';
     let removed;
@@ -1147,8 +1274,9 @@ function crossFileBreakageWarning(editedAbsPath, oldContent, newContent, workDir
     } })();
     const hits = [];
     const MAX_SYMBOLS = 8;
-    for (const sym of removed.slice(0, MAX_SYMBOLS)) {
-        const refs = scanReferences(sym.name, workDir, editedReal);
+    // Scans run concurrently (they used to be up to 8 sequential blocking rg calls).
+    const scanned = await Promise.all(removed.slice(0, MAX_SYMBOLS).map(async (sym) => ({ sym, refs: await scanReferences(sym.name, workDir, editedReal) })));
+    for (const { sym, refs } of scanned) {
         if (refs.length) {
             const shown = refs.slice(0, 3).map((r) => `      ${r}`).join('\n');
             const more = refs.length > 3 ? `\n      … and ${refs.length - 3} more` : '';
@@ -1163,31 +1291,20 @@ function crossFileBreakageWarning(editedAbsPath, oldContent, newContent, workDir
 }
 // Find files (other than the edited one) that reference `name` as a whole word.
 // Uses ripgrep when available (fast, .gitignore-aware), else a bounded grep -r.
-function scanReferences(name, workDir, excludeRealPath) {
+async function scanReferences(name, workDir, excludeRealPath) {
     const pattern = `\\b${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`;
     const files = new Set();
     try {
-        if (ripgrepAvailable()) {
-            const r = (0, child_process_1.spawnSync)('rg', ['-l', '--no-messages', '-e', pattern, '.'], {
-                cwd: workDir, encoding: 'utf-8', timeout: 8000, maxBuffer: 8 * 1024 * 1024,
-            });
-            if (r.stdout)
-                for (const line of r.stdout.split('\n')) {
-                    if (line.trim())
-                        files.add(line.trim());
-                }
-        }
-        else {
-            const r = (0, child_process_1.spawnSync)('grep', ['-rlI', '--exclude-dir=node_modules', '--exclude-dir=.git',
-                '--exclude-dir=dist', '--exclude-dir=.next', '-E', pattern, '.'], {
-                cwd: workDir, encoding: 'utf-8', timeout: 8000, maxBuffer: 8 * 1024 * 1024,
-            });
-            if (r.stdout)
-                for (const line of r.stdout.split('\n')) {
-                    if (line.trim())
-                        files.add(line.trim());
-                }
-        }
+        const opts = { cwd: workDir, timeout: 8000, maxBuffer: 8 * 1024 * 1024 };
+        const r = ripgrepAvailable()
+            ? await runCapture(rgBin(), ['-l', '--no-messages', '-e', pattern, '.'], opts)
+            : await runCapture('grep', ['-rlI', '--exclude-dir=node_modules', '--exclude-dir=.git',
+                '--exclude-dir=dist', '--exclude-dir=.next', '-E', pattern, '.'], opts);
+        if (r.stdout)
+            for (const line of r.stdout.split('\n')) {
+                if (line.trim())
+                    files.add(line.trim());
+            }
     }
     catch {
         return [];
@@ -1209,9 +1326,13 @@ function scanReferences(name, workDir, excludeRealPath) {
 async function searchFiles(input, workDir) {
     const pattern = typeof input.pattern === 'string' ? input.pattern : '';
     const searchPath = typeof input.path === 'string' ? input.path : '.';
-    const searchType = typeof input.type === 'string' ? input.type : 'content';
     const ignoreCase = input.case_insensitive === true;
     const contextLines = typeof input.context_lines === 'number' ? Math.min(10, Math.max(0, input.context_lines)) : 0;
+    // Default is "files" (paths of matching files only), like Claude Code's Grep
+    // files_with_matches: a content dump of a common pattern was ~50× larger. Asking for
+    // context_lines implies the caller wants content.
+    const searchType = typeof input.type === 'string' ? input.type : (contextLines > 0 ? 'content' : 'files');
+    const filesOnly = searchType === 'files' || searchType === 'files_with_matches';
     const include = typeof input.include === 'string' ? input.include : ''; // e.g. "*.ts"
     if (!pattern)
         return { error: 'Missing required parameter: pattern' };
@@ -1220,7 +1341,8 @@ async function searchFiles(input, workDir) {
         if (searchType === 'filename') {
             const matches = [];
             const patternLower = pattern.toLowerCase();
-            walkDir(resolved, (filePath) => {
+            const listing = await listFiles(resolved);
+            listing.files.forEach((filePath) => {
                 const name = path.basename(filePath);
                 const nameLower = name.toLowerCase();
                 // Also match against the path relative to the search root — a pattern
@@ -1238,9 +1360,15 @@ async function searchFiles(input, workDir) {
             });
             if (matches.length === 0)
                 return { output: 'No matching files found.' };
-            let out = matches.join('\n');
+            const relBase = workDir ? path.resolve(workDir) : process.cwd();
+            let out = matches.map((f) => {
+                const r = path.relative(relBase, f);
+                return r.startsWith('..') || path.isAbsolute(r) ? f : r.replace(/\\/g, '/');
+            }).join('\n');
             if (out.length > MAX_OUTPUT_CHARS)
                 out = (0, safeSlice_1.sliceSafeEnd)(out, MAX_OUTPUT_CHARS) + '\n[Truncated]';
+            if (listing.truncated)
+                out += `\n[Scan stopped after ${WALK_MAX_FILES.toLocaleString('en-US')} files — narrow the path for complete results.]`;
             return { output: out };
         }
         else {
@@ -1250,20 +1378,31 @@ async function searchFiles(input, workDir) {
             // pattern can emit tens of MB and the default silently truncates + sets
             // status:null (ENOBUFS), which used to surface as an empty "search failed".
             const SEARCH_MAX_BUFFER = 64 * 1024 * 1024; // 64 MB
-            const spawnOpts = { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS, maxBuffer: SEARCH_MAX_BUFFER };
+            // Run from workDir with a RELATIVE target so every output line is workDir-relative
+            // (what read_file resolves against). Absolute prefixes were ~25% of the tokens.
+            // A target outside workDir keeps absolute paths.
+            const base = workDir ? path.resolve(workDir) : process.cwd();
+            const relTarget = path.relative(base, resolved);
+            const inside = !relTarget.startsWith('..') && !path.isAbsolute(relTarget);
+            const target = inside ? (relTarget || '.') : resolved;
+            const spawnOpts = { timeout: DEFAULT_TIMEOUT_MS, maxBuffer: SEARCH_MAX_BUFFER, cwd: base };
             let result;
             if (ripgrepAvailable()) {
-                const args = ['--line-number', '--no-heading', '--color=never', '--hidden', '--glob', '!.git'];
+                const args = filesOnly
+                    ? ['--files-with-matches', '--color=never', '--hidden', '--glob', '!.git']
+                    : ['--line-number', '--no-heading', '--color=never', '--hidden', '--glob', '!.git',
+                        // One minified-bundle hit could otherwise fill the whole output cap.
+                        '--max-columns', '500', '--max-columns-preview'];
                 if (ignoreCase)
                     args.push('-i');
-                if (contextLines > 0)
+                if (contextLines > 0 && !filesOnly)
                     args.push(`-C${contextLines}`);
                 if (include)
                     args.push('--glob', include);
                 // -m is PER-FILE in rg/grep; the real global cap is applied on the
                 // output below. Keep a generous per-file cap so no single file floods.
-                args.push('-m', '200', '--regexp', pattern, resolved);
-                result = (0, child_process_1.spawnSync)('rg', args, spawnOpts);
+                args.push('-m', '200', '--regexp', pattern, target);
+                result = await runCapture(rgBin(), args, spawnOpts);
             }
             else {
                 // -E (ERE) matters: without it, grep defaults to BRE, where a bare
@@ -1276,23 +1415,26 @@ async function searchFiles(input, workDir) {
                 // fallback path whenever ripgrep isn't installed on the host. ERE
                 // matches rg's semantics (bare parens group, \( \) literal) so the
                 // SAME pattern behaves identically whether or not rg is present.
-                const args = ['-rnE', '--binary-files=without-match', '--color=never'];
+                const args = [filesOnly ? '-rlE' : '-rnE', '--binary-files=without-match', '--color=never'];
                 if (ignoreCase)
                     args.push('-i');
-                if (contextLines > 0)
+                if (contextLines > 0 && !filesOnly)
                     args.push(`-C${contextLines}`);
                 if (include)
                     args.push(`--include=${include}`);
-                args.push('--exclude-dir=.git', '--exclude-dir=node_modules', '--exclude-dir=dist', '--exclude-dir=.next', '--exclude-dir=__pycache__', '--exclude-dir=.turbo', '--exclude-dir=coverage', '--exclude-dir=.cache', '-m', '200', pattern, resolved);
-                result = (0, child_process_1.spawnSync)('grep', args, spawnOpts);
+                args.push('--exclude-dir=.git', '--exclude-dir=node_modules', '--exclude-dir=dist', '--exclude-dir=.next', '--exclude-dir=__pycache__', '--exclude-dir=.turbo', '--exclude-dir=coverage', '--exclude-dir=.cache', '--exclude-dir=.venv', '--exclude-dir=venv', '-m', '200', pattern, target);
+                result = await runCapture('grep', args, spawnOpts);
             }
-            let output = result.stdout ?? '';
+            // rg/grep print "./x" when the target is "." — drop the noise prefix.
+            let output = (result.stdout ?? '').replace(/^\.\//gm, '');
             const stderr = result.stderr ?? '';
-            // Distinguish real failure modes. spawnSync sets `.error` (not `.status`)
-            // for timeout (ETIMEDOUT), buffer overflow (ENOBUFS) and spawn failures.
+            // Distinguish real failure modes. runCapture (like spawnSync) sets `.error`
+            // (not `.status`) for timeout (ETIMEDOUT), buffer overflow (ENOBUFS) and spawn failures.
             const spawnErr = result.error;
             if (spawnErr) {
-                if (spawnErr.code === 'ETIMEDOUT' || result.signal === 'SIGTERM') {
+                // ENOBUFS first: the child is SIGTERM'd on overflow too, so testing the signal
+                // first misreported a too-large result as a timeout.
+                if (spawnErr.code === 'ETIMEDOUT' || (result.signal === 'SIGTERM' && spawnErr.code !== 'ENOBUFS')) {
                     const partial = output ? `\n\nPartial results before timeout:\n${globalCapMatches(output)}` : '';
                     return { error: `Search timed out after ${Math.round(DEFAULT_TIMEOUT_MS / 1000)}s — narrow the path or pattern (or add an "include" filter).${partial}` };
                 }
@@ -1312,11 +1454,23 @@ async function searchFiles(input, workDir) {
                 // otherwise surfaces as raw, cryptic engine stderr (e.g. "parentheses
                 // not balanced", "Unmatched ( or \("). Give an actionable hint instead
                 // of just relaying the tool's internal error message verbatim.
-                const hint = /parenthes|bracket|brace|Unmatched|repetition-operator|invalid regex/i.test(stderr)
+                const hint = /parenthes|bracket|brace|Unmatched|unclosed|repetition-operator|invalid regex/i.test(stderr)
                     ? ' — the pattern has invalid/unbalanced regex syntax. If you meant to match literal parentheses/brackets, escape them (e.g. "\\(", "\\)"), or simplify the pattern.'
                     : '';
                 return { error: (stderr || 'search failed').trim() + hint };
             }
+            if (filesOnly) {
+                const files = output.split('\n').filter(Boolean);
+                if (!files.length)
+                    return { output: 'No matches found.' };
+                const shown = files.slice(0, MAX_GLOB_RESULTS);
+                const more = files.length > shown.length
+                    ? `\n[${files.length - shown.length} more files not shown — narrow the pattern/path]` : '';
+                return {
+                    output: `${files.length} file(s) contain matches (type="content" for the matching lines):\n` +
+                        shown.join('\n') + more,
+                };
+            }
             output = globalCapMatches(output);
             return { output: output || 'No matches found.' };
         }
@@ -1344,7 +1498,7 @@ function globalCapMatches(output) {
     }
     if (capped.length > MAX_OUTPUT_CHARS) {
         capped = (0, safeSlice_1.sliceSafeEnd)(capped, MAX_OUTPUT_CHARS);
-        note = `\n[Output truncated at ${MAX_OUTPUT_CHARS / 1024}KB.]`;
+        note = `\n[Output truncated at ${MAX_OUTPUT_CHARS.toLocaleString('en-US')} chars.]`;
     }
     return capped + note;
 }
@@ -1371,13 +1525,68 @@ function matchesPattern(name, pattern) {
         return false;
     }
 }
+// Noise directories never worth walking. .venv/venv matter most: a single Python virtualenv
+// is hundreds of MB of third-party files that drowned glob / filename-search results.
+const WALK_SKIP_DIRS = new Set([
+    '.git', 'node_modules', 'dist', '.next', '__pycache__', '.turbo', 'coverage',
+    '.venv', 'venv', '.tox', '.mypy_cache', '.pytest_cache', '.ruff_cache', '.gradle',
+    '.cache', '.parcel-cache', '.svelte-kit', '.nuxt', 'target', '.idea', '.DS_Store',
+]);
+/** Hard ceiling on files visited by the fallback directory walk (no ripgrep). */
+const WALK_MAX_FILES = 50000;
+/**
+ * List candidate files under `root` for glob / filename search.
+ *
+ * With ripgrep: `rg --files`, which honours .gitignore / .ignore (and git's global
+ * excludes) — so build output, vendored deps and generated files that the project
+ * itself ignores no longer drown results. Measured on this repo: the old walk visited
+ * 2,972 files vs 948 tracked. `--hidden` keeps dotfiles like .github/ (still minus
+ * anything ignored), and the WALK_SKIP_DIRS noise list is applied on top so a repo
+ * with no .gitignore still skips node_modules etc.
+ *
+ * Without ripgrep: the old walk, but capped at WALK_MAX_FILES so a 100k-file monorepo
+ * cannot stall the process; `truncated` tells the caller to say so.
+ */
+async function listFiles(root) {
+    if (ripgrepAvailable()) {
+        // --follow: the walkDir this replaced followed symlinks (pnpm / linked monorepo
+        // packages); without it rg silently drops every symlinked dir AND file. rg detects
+        // symlink loops itself.
+        const args = ['--files', '--hidden', '--follow', '--no-messages', '--color=never'];
+        for (const d of WALK_SKIP_DIRS)
+            args.push('--glob', `!**/${d}/**`);
+        args.push('.');
+        const r = await runCapture(rgBin(), args, { cwd: root, timeout: DEFAULT_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024 });
+        // rg exits 1 when it finds no files at all — a real (empty) answer, not a failure.
+        // Exit 2 = "some path errored" (a symlink loop, an unreadable dir) — the list of
+        // everything else is still complete, so keep it rather than re-walking the tree.
+        if (!r.error && (r.status === 0 || r.status === 1 || (r.status === 2 && r.stdout))) {
+            const files = r.stdout.split('\n').filter(Boolean).map((f) => path.join(root, f.replace(/^\.\//, '')));
+            return { files, truncated: false };
+        }
+        // Anything else (timeout, overflow, spawn failure): fall through to the walk.
+    }
+    const files = [];
+    let truncated = false;
+    walkDir(root, (f) => {
+        if (files.length >= WALK_MAX_FILES) {
+            truncated = true;
+            return false;
+        }
+        files.push(f);
+        return true;
+    });
+    return { files, truncated };
+}
+// callback returning `false` STOPS the walk (a cap that only stopped collecting would
+// still traverse the whole tree, so it would not bound the time at all).
 function walkDir(dirPath, callback, _visited = new Set()) {
     try {
         // Resolve symlinks to detect cycles — a symlink pointing to a parent dir
         // would cause infinite recursion without this guard.
         const real = fs.realpathSync(dirPath);
         if (_visited.has(real))
-            return;
+            return true;
         _visited.add(real);
         const entries = fs.readdirSync(dirPath, { withFileTypes: true });
         for (const entry of entries) {
@@ -1394,18 +1603,20 @@ function walkDir(dirPath, callback, _visited = new Set()) {
             })());
             if (isDir) {
                 // Skip common noise directories
-                if (['.git', 'node_modules', 'dist', '.next', '__pycache__', '.turbo', 'coverage'].includes(entry.name))
+                if (WALK_SKIP_DIRS.has(entry.name))
                     continue;
-                walkDir(fullPath, callback, _visited);
+                if (walkDir(fullPath, callback, _visited) === false)
+                    return false;
             }
-            else {
-                callback(fullPath);
+            else if (callback(fullPath) === false) {
+                return false;
             }
         }
     }
     catch {
         // Skip unreadable directories
     }
+    return true;
 }
 async function createDirectory(input, workDir) {
     const dirPath = typeof input.path === 'string' ? input.path : '';
@@ -1637,7 +1848,7 @@ async function editFile(input, workDir) {
         const diff = buildDiff(filePath, oldNorm, newNorm, origNorm);
         const linesBefore = origNorm.split('\n').length;
         const linesAfter = updated.split('\n').length;
-        const xfile = crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
+        const xfile = await crossFileBreakageWarning(resolved, origNorm, normalizeLF(updated), workDir ?? process.cwd());
         // Security-lint only the NEWLY INSERTED text, not the whole file. Scanning the
         // full file would re-report pre-existing findings on every unrelated edit —
         // noise that has nothing to do with the change being made, and the fastest way
@@ -1845,7 +2056,49 @@ function fetchBlocklistCheck(parsedUrl) {
     }
     return null;
 }
-async function fetchUrl(input, _workDir, _redirectCount = 0, abortSignal) {
+/**
+ * fetch_url as the model sees it. With `prompt`, the page (fetched HERE, so localhost
+ * and intranet docs work and the server is never an open proxy) is answered by a cheap
+ * model server-side (/api/code/tools/web_fetch_extract — DeepSeek Flash by default) and
+ * only that answer is returned: Claude Code's WebFetch. Any failure of the extraction
+ * step falls back to the ordinary capped page text, so the call never gets worse.
+ */
+async function fetchUrlTool(input, workDir, abortSignal) {
+    const prompt = typeof input.prompt === 'string' ? input.prompt.trim() : '';
+    if (!prompt)
+        return fetchUrl(input, workDir, 0, abortSignal);
+    const capture = {};
+    const raw = await fetchUrl(input, workDir, 0, abortSignal, capture);
+    if (raw.error !== undefined || !capture.text?.trim())
+        return raw;
+    const token = (0, auth_1.getToken)();
+    if (!token)
+        return raw;
+    try {
+        const r = await _httpsPost(`${client_2.API_BASE}/api/code/tools/web_fetch_extract`, JSON.stringify({ url: capture.url ?? input.url, content: capture.text, prompt, ...(0, client_1.billingOverrideFields)() }), { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` }, 90000, abortSignal);
+        let json = {};
+        try {
+            json = JSON.parse(r.body);
+        }
+        catch { /* fall through */ }
+        if (r.status !== 200 || !json.text) {
+            return { ...raw, output: `${raw.output ?? ''}\n\n[prompt extraction unavailable (${json.error ?? `HTTP ${r.status}`}) — raw page text shown instead]` };
+        }
+        return {
+            output: `[Answer extracted from ${capture.url ?? input.url} by ${json.model ?? 'a low-cost model'} for: "${prompt.slice(0, 200)}"]\n\n` +
+                `<untrusted_web_content url="${capture.url ?? input.url}">\n${json.text}\n</untrusted_web_content>`,
+        };
+    }
+    catch (err) {
+        if (err.name === 'AbortError')
+            return { error: 'fetch_url stopped by user', interrupted: true };
+        return { ...raw, output: `${raw.output ?? ''}\n\n[prompt extraction failed (${err.message}) — raw page text shown instead]` };
+    }
+}
+async function fetchUrl(input, _workDir, _redirectCount = 0, abortSignal, 
+// Receives the FULL stripped page text (before the 40K model-facing cap), for the
+// prompt-extraction path in fetchUrlTool. Threaded through redirects.
+capture) {
     const url = typeof input.url === 'string' ? input.url : '';
     if (!url)
         return { error: 'Missing required parameter: url' };
@@ -1947,7 +2200,7 @@ async function fetchUrl(input, _workDir, _redirectCount = 0, abortSignal) {
                     finish({ error: `Invalid redirect location: ${res.headers.location}` });
                     return;
                 }
-                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1, abortSignal).then(finish);
+                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1, abortSignal, capture).then(finish);
                 return;
             }
             const contentType = res.headers['content-type'] ?? '';
@@ -1961,7 +2214,15 @@ async function fetchUrl(input, _workDir, _redirectCount = 0, abortSignal) {
                 let body = Buffer.concat(chunks).toString('utf-8');
                 if (isHtml)
                     body = stripHtml(body);
-                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
+                if (capture) {
+                    capture.text = body;
+                    capture.url = url;
+                }
+                let truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
+                if (body.length > MAX_FETCH_OUTPUT_CHARS) {
+                    body = (0, safeSlice_1.sliceSafeEnd)(body, MAX_FETCH_OUTPUT_CHARS);
+                    truncNote = `\n\n[Truncated at ${MAX_FETCH_OUTPUT_CHARS.toLocaleString('en-US')} chars of page text]`;
+                }
                 // Prompt-injection mitigation: fetched web content is fully attacker-controlled
                 // (anyone can put "ignore previous instructions..." on a page). Wrap it in an
                 // explicit untrusted-data delimiter so the model treats it as DATA to read, not
@@ -2083,7 +2344,7 @@ async function multiEdit(input, workDir) {
         // preserving the original mode bits (+x on scripts etc.).
         const finalContent = wasCRLF ? content.replace(/\n/g, '\r\n') : content;
         atomicWritePreservingMode(resolved, finalContent, pre.mode);
-        const xfile = crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
+        const xfile = await crossFileBreakageWarning(resolved, originalNorm, content, workDir ?? process.cwd());
         // Lint only the newly inserted text (see the same reasoning in editFile).
         const sec = (0, securityLint_1.securityNoteText)((0, securityLint_1.checkSecurity)(insertedText.join('\n')));
         return {
@@ -2106,38 +2367,97 @@ async function glob(input, workDir) {
     try {
         const resolved = resolvePath(searchDir, workDir);
         const matches = [];
-        // Convert glob pattern to regex
-        const toRegex = (p) => {
-            const escaped = p.replace(/[.+^${}()|[\]\\]/g, '\\$&');
-            const re = escaped
-                .replace(/\*\*\//g, '(?:[^/]+/)*') // **/ = zero or more segments (fixes root-level: index.ts matches **/*.ts)
-                .replace(/\*\*/g, '.*') // ** matches anything
-                .replace(/\*/g, '[^/]*') // * matches within one segment
-                .replace(/\?/g, '[^/]'); // ? matches single non-slash char
-            return new RegExp(`^${re}$`);
-        };
-        const regex = toRegex(pattern);
-        walkDir(resolved, (filePath) => {
+        const regex = globToRegex(pattern);
+        // Only fall back to basename test for patterns without a path separator
+        // (i.e. single-segment patterns like "*.ts"). Patterns with "/" (e.g.
+        // "src/*.ts") must match the full relative path to avoid false positives.
+        const useBasename = !pattern.includes('/') && !pattern.includes('**');
+        const listing = await listFiles(resolved);
+        for (const filePath of listing.files) {
             const rel = path.relative(resolved, filePath).replace(/\\/g, '/');
-            // Only fall back to basename test for patterns without a path separator
-            // (i.e. single-segment patterns like "*.ts"). Patterns with "/" (e.g.
-            // "src/*.ts") must match the full relative path to avoid false positives.
-            const useBasename = !pattern.includes('/') && !pattern.includes('**');
             if (regex.test(rel) || (useBasename && regex.test(path.basename(filePath)))) {
                 matches.push(filePath);
             }
-        });
+        }
+        const scanNote = listing.truncated
+            ? `\n[Scan stopped after ${WALK_MAX_FILES.toLocaleString('en-US')} files — narrow the path for complete results.]`
+            : '';
         if (!matches.length)
-            return { output: `No files matched pattern: ${pattern}` };
-        let out = matches.join('\n');
-        if (out.length > MAX_OUTPUT_CHARS)
-            out = (0, safeSlice_1.sliceSafeEnd)(out, MAX_OUTPUT_CHARS) + '\n[Truncated]';
-        return { output: `${matches.length} file(s) matched "${pattern}":\n${out}` };
+            return { output: `No files matched pattern: ${pattern}${scanNote}` };
+        // Most recently modified first, capped — same shape as Claude Code's Glob. Paths are
+        // relative to the search dir: absolute prefixes were ~25% of the output's tokens.
+        const mtime = (f) => { try {
+            return fs.statSync(f).mtimeMs;
+        }
+        catch {
+            return 0;
+        } };
+        const sorted = matches.map((f) => ({ f, t: mtime(f) })).sort((a, b) => b.t - a.t).map((x) => x.f);
+        const shown = sorted.slice(0, MAX_GLOB_RESULTS).map((f) => path.relative(resolved, f).replace(/\\/g, '/'));
+        const more = sorted.length > shown.length
+            ? `\n[${sorted.length - shown.length} more not shown — narrow the pattern or path]`
+            : '';
+        return { output: `${matches.length} file(s) matched "${pattern}" under ${resolved}:\n${shown.join('\n')}${more}${scanNote}` };
     }
     catch (err) {
         return { error: err.message };
     }
 }
+/**
+ * Glob → anchored RegExp. Scans the pattern once, so the `*` / `?` rules can never
+ * rewrite the regex emitted for `**` (the old chained .replace() calls turned
+ * `**\/` into `([^/]:[^/]+/)` — every `**` pattern silently matched nothing).
+ * Supports `**`, `*`, `?`, `{a,b}` and `[...]` classes.
+ */
+function globToRegex(pattern) {
+    let re = '';
+    let inBrace = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === '*') {
+            if (pattern[i + 1] === '*') {
+                const slash = pattern[i + 2] === '/';
+                re += slash ? '(?:[^/]*/)*' : '.*';
+                i += slash ? 2 : 1;
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if (c === '{') {
+            inBrace++;
+            re += '(?:';
+        }
+        else if (c === '}' && inBrace > 0) {
+            inBrace--;
+            re += ')';
+        }
+        else if (c === ',' && inBrace > 0) {
+            re += '|';
+        }
+        else if (c === '[') {
+            const end = pattern.indexOf(']', i + 1);
+            if (end > i) {
+                let cls = pattern.slice(i + 1, end).replace(/\\/g, '\\\\');
+                if (cls.startsWith('!'))
+                    cls = '^' + cls.slice(1);
+                re += `[${cls}]`;
+                i = end;
+            }
+            else {
+                re += '\\[';
+            }
+        }
+        else {
+            re += c.replace(/[.+^$()|[\]\\{}]/g, '\\$&');
+        }
+    }
+    re += ')'.repeat(inBrace); // an unclosed `{` must not throw "Invalid regular expression"
+    return new RegExp(`^${re}$`);
+}
 const _todoScopes = new Map();
 function todoScope(key) {
     const k = key || 'default';
@@ -2396,7 +2716,7 @@ async function notebookRead(input, workDir) {
         });
         let output = lines.join('\n');
         if (output.length > MAX_OUTPUT_CHARS) {
-            output = (0, safeSlice_1.sliceSafeEnd)(output, MAX_OUTPUT_CHARS) + '\n\n[Notebook output truncated at 100KB]';
+            output = (0, safeSlice_1.sliceSafeEnd)(output, MAX_OUTPUT_CHARS) + `\n\n[Notebook output truncated at ${MAX_OUTPUT_CHARS.toLocaleString('en-US')} chars]`;
         }
         return { output };
     }
@@ -2493,7 +2813,10 @@ function _httpsPost(url, body, headers, timeoutMs = 30000, abortSignal) {
         const done = (fn) => { if (settled)
             return; settled = true; if (abortPoll)
             clearInterval(abortPoll); fn(); };
-        const req = https.request({ hostname: u.hostname, path: u.pathname + u.search, method: 'POST', headers: { ...headers, 'Content-Length': Buffer.byteLength(body) }, timeout: timeoutMs }, (res) => {
+        // http for an http:// API base (local dev / tests) — https.request would reject it —
+        // and the explicit port, which was silently dropped (so :3000 went to :443).
+        const mod = u.protocol === 'http:' ? http : https;
+        const req = mod.request({ hostname: u.hostname, ...(u.port ? { port: Number(u.port) } : {}), path: u.pathname + u.search, method: 'POST', headers: { ...headers, 'Content-Length': Buffer.byteLength(body) }, timeout: timeoutMs }, (res) => {
             res.on('data', (c) => chunks.push(c));
             res.on('end', () => done(() => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf-8') })));
         });
@@ -2839,7 +3162,7 @@ const TOOL_MAP = {
     copy_file: copyFile,
     move_file: moveFile,
     delete_file: deleteFile,
-    fetch_url: fetchUrl,
+    fetch_url: (input) => fetchUrlTool(input),
     web_search: webSearch,
     generate_image: generateImage,
     stock_photo: stockPhoto,
@@ -2921,7 +3244,7 @@ selfPeer) {
         // silently making the user wait out their own timeout (up to 170s for
         // generate_image) instead of returning control immediately.
         if (name === 'fetch_url')
-            return await fetchUrl(input, workDir, 0, abortSignal);
+            return await fetchUrlTool(input, workDir, abortSignal);
         if (name === 'web_search')
             return await webSearch(input, workDir, abortSignal);
         if (name === 'generate_image')