@pellux/goodvibes-sdk 0.30.3 → 0.33.0

package/dist/platform/tools/fetch/extract.js

@@ -1,3 +1,8 @@
+const HTML_SELECTOR_TAG_RE = /^[a-z][a-z0-9-]*$/i;
+const HTML_SELECTOR_ATTRIBUTE_RE = /^[a-z0-9_-]+$/i;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 function stripHtml(html) {
     return html
         .replace(/<script[\s\S]*?<\/script>/gi, '')
@@ -101,17 +106,23 @@ function extractStructured(html, selectors) {
         else if (trimmed.includes('.')) {
             const [tag, cls] = trimmed.split('.');
             tagPattern = tag || '[a-z][a-z0-9]*';
-            classFilter = cls;
+            classFilter = cls ?? null;
         }
         else {
             tagPattern = trimmed || '[a-z][a-z0-9]*';
         }
+        if (tagPattern !== '[a-z][a-z0-9]*' && !HTML_SELECTOR_TAG_RE.test(tagPattern))
+            continue;
+        if (idFilter !== null && !HTML_SELECTOR_ATTRIBUTE_RE.test(idFilter))
+            continue;
+        if (classFilter !== null && !HTML_SELECTOR_ATTRIBUTE_RE.test(classFilter))
+            continue;
         let attrClause = '';
         if (idFilter) {
-            attrClause = `(?=[^>]*\\bid=["']${idFilter}["'])`;
+            attrClause = `(?=[^>]*\\bid=["']${escapeRegExp(idFilter)}["'])`;
         }
         else if (classFilter) {
-            attrClause = `(?=[^>]*\\bclass=["'][^"']*\\b${classFilter}\\b[^"']*["'])`;
+            attrClause = `(?=[^>]*\\bclass=["'][^"']*\\b${escapeRegExp(classFilter)}\\b[^"']*["'])`;
         }
         const re = new RegExp(`<(${tagPattern})${attrClause}[^>]*>([\\s\\S]*?)<\\/\\1>`, 'gi');
         let m;

package/dist/platform/tools/fetch/runtime.d.ts

@@ -4,8 +4,8 @@ import type { FetchOutput, FetchUrlResult } from './types.js';
 import type { ServiceRegistry } from '../../config/service-registry.js';
 import type { FeatureFlagManager } from '../../runtime/feature-flags/index.js';
 export interface FetchRuntimeDeps {
-    readonly serviceRegistry?: Pick<ServiceRegistry, 'resolveAuth'> | null;
-    readonly featureFlags?: Pick<FeatureFlagManager, 'isEnabled'> | null;
+    readonly serviceRegistry?: Pick<ServiceRegistry, 'resolveAuth'> | null | undefined;
+    readonly featureFlags?: Pick<FeatureFlagManager, 'isEnabled'> | null | undefined;
 }
 interface CacheEntry {
     data: FetchUrlResult;

package/dist/platform/tools/fetch/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAsF,MAAM,aAAa,CAAC;AAClI,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAUxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;CACtE;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AASD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,eAAe,CAAK;IAE5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOtE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAiBxC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;CAkFpF;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;AAgfD,wBAAgB,eAAe,CAC7B,IAAI,GAAE,gBAAqB,EAC3B,OAAO,sBAA4B,GAClC,IAAI,CAiCN"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAsF,MAAM,aAAa,CAAC;AAClI,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAUxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;CAClF;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AASD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,eAAe,CAAK;IAE5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOtE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAiBxC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;CAkFpF;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;AAgfD,wBAAgB,eAAe,CAC7B,IAAI,GAAE,gBAAqB,EAC3B,OAAO,sBAA4B,GAClC,IAAI,CAiCN"}

package/dist/platform/tools/fetch/runtime.js

@@ -187,8 +187,8 @@ async function fetchOneRaw(urlInput, headers, method, body, effectiveUrl, trustT
             })
             : await instrumentedFetch(effectiveUrl, {
                 method,
-                headers: Object.keys(headers).length > 0 ? headers : undefined,
-                body,
+                ...(Object.keys(headers).length > 0 ? { headers: headers } : {}),
+                ...(body !== undefined ? { body } : {}),
                 signal: controller.signal,
             });
         clearTimeout(timer);
@@ -207,8 +207,8 @@ async function fetchWithValidatedRedirects(input) {
     for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
         const response = await instrumentedFetch(currentUrl, {
             method: currentMethod,
-            headers: Object.keys(currentHeaders).length > 0 ? currentHeaders : undefined,
-            body: currentBody,
+            ...(Object.keys(currentHeaders).length > 0 ? { headers: currentHeaders } : {}),
+            ...(currentBody !== undefined ? { body: currentBody } : {}),
             signal: input.signal,
             redirect: 'manual',
         });
@@ -443,7 +443,7 @@ async function fetchOne(urlInput, opts, runtime) {
             : err instanceof Error
                 ? err.message
                 : summarizeError(err);
-        logger.debug('fetch tool: request failed', { url: urlInput.url, error: message });
+        logger.warn('fetch tool: request failed', { url: urlInput.url, error: message });
         return { url: urlInput.url, error: message, duration_ms: durationMs };
     }
 }

package/dist/platform/tools/fetch/schema.d.ts

@@ -183,71 +183,70 @@ export type FetchVerbosity = 'count_only' | 'minimal' | 'standard' | 'verbose';
 export interface FetchAuthInput {
     type: 'bearer' | 'basic' | 'api-key';
     /** Bearer token (used with type 'bearer'). */
-    token?: string;
+    token?: string | undefined;
     /** Username for basic auth (used with type 'basic'). */
-    username?: string;
+    username?: string | undefined;
     /** Password for basic auth (used with type 'basic'). */
-    password?: string;
+    password?: string | undefined;
     /** Header name for API key auth (used with type 'api-key'). Defaults to X-API-Key. */
-    header?: string;
+    header?: string | undefined;
     /** API key value (used with type 'api-key'). */
-    key?: string;
+    key?: string | undefined;
 }
 /** Input shape for a single URL entry. */
 export interface FetchUrlInput {
     url: string;
-    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS' | undefined;
     /** Query parameters appended as a query string to the URL. */
-    params?: Record<string, string>;
-    headers?: Record<string, string>;
-    body?: string;
+    params?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+    body?: string | undefined;
     /** Base64-encoded request body. Decoded before sending. Takes precedence over body. */
-    body_base64?: string;
-    body_type?: 'json' | 'form' | 'raw' | 'multipart';
+    body_base64?: string | undefined;
+    body_type?: 'json' | 'form' | 'raw' | 'multipart' | undefined;
     /** Key-value pairs used when body_type is 'form' or 'multipart'. */
-    body_data?: Record<string, string>;
-    extract?: FetchExtractMode;
+    body_data?: Record<string, string> | undefined;
+    extract?: FetchExtractMode | undefined;
     /** CSS selectors for structured extraction mode. */
-    selectors?: string[];
-    timeout_ms?: number;
+    selectors?: string[] | undefined;
+    timeout_ms?: number | undefined;
     /** Maximum response body size in bytes. Overrides global max_content_length. */
-    max_content_length?: number;
+    max_content_length?: number | undefined;
     /** When a service is specified and a 401 is returned, refresh auth and retry once. */
-    retry_on_auth?: boolean;
+    retry_on_auth?: boolean | undefined;
     /** Named service for automatic credential lookup from the service registry. */
-    service?: string;
+    service?: string | undefined;
     /** Inline auth configuration. Applied directly without registry lookup. */
-    auth?: FetchAuthInput;
+    auth?: FetchAuthInput | undefined;
 }
 /**
  * Sanitization mode for response content.
  *
- * Re-exported from sanitizer.ts to avoid duplication. `FetchSanitizeMode`
- * is an alias for `SanitizeMode`.
+ * Re-exported from sanitizer.ts to avoid duplication.
  */
 import type { SanitizeMode } from './sanitizer.js';
-/** Sanitization mode alias — re-exported from sanitizer.ts to avoid duplication. */
+/** Sanitization mode re-exported from sanitizer.ts. */
 export type FetchSanitizeMode = SanitizeMode;
 /** Full input shape for the fetch tool. */
 export interface FetchInput {
     urls: FetchUrlInput[];
-    extract?: FetchExtractMode;
-    parallel?: boolean;
-    verbosity?: FetchVerbosity;
+    extract?: FetchExtractMode | undefined;
+    parallel?: boolean | undefined;
+    verbosity?: FetchVerbosity | undefined;
     /** Cache GET responses by URL+params for this many seconds. 0 = disabled (default). */
-    cache_ttl_seconds?: number;
+    cache_ttl_seconds?: number | undefined;
     /** Minimum delay in ms between sequential requests. 0 = disabled (default). */
-    rate_limit_ms?: number;
+    rate_limit_ms?: number | undefined;
     /** Global maximum response body size in bytes. */
-    max_content_length?: number;
+    max_content_length?: number | undefined;
     /**
      * Response sanitization mode applied to all URL responses.
      * Defaults to `'safe-text'` when omitted (rollback-safe default for fetch sanitization).
      */
-    sanitize_mode?: FetchSanitizeMode;
+    sanitize_mode?: FetchSanitizeMode | undefined;
     /** Hostnames or glob patterns explicitly trusted. Trusted hosts may use sanitize_mode: none. */
-    trusted_hosts?: string[];
+    trusted_hosts?: string[] | undefined;
     /** Hostnames or glob patterns explicitly blocked. Denied pre-request regardless of other config. */
-    blocked_hosts?: string[];
+    blocked_hosts?: string[] | undefined;
 }
 //# sourceMappingURL=schema.d.ts.map

package/dist/platform/tools/fetch/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsKpB,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,OAAO,GACP,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,KAAK,GACL,SAAS,CAAC;AAEd,+BAA+B;AAC/B,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/E,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1E,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IAClD,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsKpB,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,OAAO,GACP,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,KAAK,GACL,SAAS,CAAC;AAEd,+BAA+B;AAC/B,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/E,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IACtF,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9D,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC/C,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,sFAAsF;IACtF,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,2EAA2E;IAC3E,IAAI,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACnC;AAED;;;;GAIG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,uDAAuD;AACvD,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,SAAS,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC;;;OAGG;IACH,aAAa,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC9C,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACtC"}

package/dist/platform/tools/fetch/trust-tiers.d.ts

@@ -24,7 +24,7 @@
  *
  * - `trusted`  — Explicitly allowlisted; sanitization may be relaxed.
  * - `unknown`  — Not in any list; standard `safe-text` sanitization applied.
- * - `blocked`  — Internal/sensitive host; request denied pre-request.
+ * - `blocked`  — Sensitive host; request denied pre-request.
  */
 export type HostTrustTier = 'trusted' | 'unknown' | 'blocked';
 /**
@@ -47,12 +47,12 @@ export interface TrustTierConfig {
      * Trusted hosts may opt out of sanitization via fetch config.
      * Example: `['api.anthropic.com', '*.internal.example.com']`
      */
-    trustedHosts?: string[];
+    trustedHosts?: string[] | undefined;
     /**
      * Hostnames or glob patterns that are explicitly blocked.
      * Blocked hosts are denied pre-request regardless of other config.
      */
-    blockedHosts?: string[];
+    blockedHosts?: string[] | undefined;
 }
 /**
  * Telemetry event names emitted by the trust tier classifier.

package/dist/platform/tools/fetch/trust-tiers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-tiers.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/trust-tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAsID;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC5B,sEAAsE;;IAEtE,8DAA8D;;CAEtD,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAAoB,GAC3B,eAAe,CA8EjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,GACtB,IAAI,CAUN;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D"}
+{"version":3,"file":"trust-tiers.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/trust-tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CACrC;AAsID;;;GAGG;AACH,eAAO,MAAM,iBAAiB;IAC5B,sEAAsE;;IAEtE,8DAA8D;;CAEtD,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAAoB,GAC3B,eAAe,CA8EjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,GACtB,IAAI,CAUN;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO1D"}

package/dist/platform/tools/fetch/trust-tiers.js

@@ -82,8 +82,8 @@ const ENCODED_IP_HEX_OCTAL_PATTERNS = [
  * Returns true if the host is a decimal integer representation of a
  * private/loopback IPv4 address (e.g. 2130706433 = 127.0.0.1).
  *
- * The old pattern `/^\d{8,10}$/` was too broad — it blocked all 8-10 digit
- * numbers regardless of whether they decoded to a private address.
+ * Only block decimal integers that decode to private addresses; ordinary
+ * numeric hostnames remain subject to the rest of the trust-tier checks.
  */
 function isPrivateDecimalIp(host) {
     if (!/^\d{1,10}$/.test(host))

package/dist/platform/tools/fetch/types.d.ts

@@ -1,20 +1,20 @@
 import type { FetchSanitizeMode } from './schema.js';
 export interface FetchUrlResult {
     url: string;
-    status?: number;
-    statusText?: string;
-    contentType?: string;
-    byteSize?: number;
-    content?: string;
-    error?: string;
-    truncated?: boolean;
-    from_cache?: boolean;
-    redirected?: boolean;
-    final_url?: string;
-    duration_ms?: number;
-    tokens_used?: number;
-    sanitization_tier?: FetchSanitizeMode | 'skipped';
-    host_trust_tier?: string;
+    status?: number | undefined;
+    statusText?: string | undefined;
+    contentType?: string | undefined;
+    byteSize?: number | undefined;
+    content?: string | undefined;
+    error?: string | undefined;
+    truncated?: boolean | undefined;
+    from_cache?: boolean | undefined;
+    redirected?: boolean | undefined;
+    final_url?: string | undefined;
+    duration_ms?: number | undefined;
+    tokens_used?: number | undefined;
+    sanitization_tier?: FetchSanitizeMode | 'skipped' | undefined;
+    host_trust_tier?: string | undefined;
     metadata?: {
         headers: Record<string, string>;
         redirected: boolean;
@@ -23,13 +23,13 @@ export interface FetchUrlResult {
 }
 export interface FetchOutput {
     success: boolean;
-    error?: string;
-    results?: FetchUrlResult[];
+    error?: string | undefined;
+    results?: FetchUrlResult[] | undefined;
     summary: {
         total: number;
         succeeded: number;
         failed: number;
-        total_ms?: number;
+        total_ms?: number | undefined;
     };
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/platform/tools/fetch/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,EAAE,OAAO,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/fetch/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9D,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,EAAE,OAAO,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,CAAC;CACH"}

package/dist/platform/tools/find/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/content.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAE7E,OAAO,EAOL,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AASrB,iBAAe,mBAAmB,CAChC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,kBAAkB,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0PlC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/content.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAG7E,OAAO,EASL,kBAAkB,EAGnB,MAAM,aAAa,CAAC;AASrB,iBAAe,mBAAmB,CAChC,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,kBAAkB,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA+PlC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/platform/tools/find/content.js

@@ -1,6 +1,7 @@
 import { stat as statAsync } from 'node:fs/promises';
 import { summarizeError } from '../../utils/error-display.js';
-import { collectFilesForSearch, isBinary, makeCountResult, makeFilesResult, makeLocationsResult, readTextFile, FindRuntimeService, validateSearchPath, } from './shared.js';
+import { compileSafeRegExp, safeRegExpTest } from '../../utils/safe-regex.js';
+import { collectFilesForSearch, createFindDiagnostics, addFindWarning, isBinary, makeCountResult, makeFilesResult, makeLocationsResult, readTextFile, FindRuntimeService, validateSearchPath, withFindWarnings, } from './shared.js';
 async function executeContentQuery(query, output, runtime, projectRoot) {
     const validatedPath = validateSearchPath(query.path, projectRoot);
     if (typeof validatedPath === 'object')
@@ -11,6 +12,7 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
     const maxTotal = output.max_total_matches ?? output.max_results ?? 100;
     const ctxBefore = output.context_before ?? 0;
     const ctxAfter = output.context_after ?? 0;
+    const diagnostics = createFindDiagnostics();
     if (format === 'signatures' || format === 'full') {
         return { error: `Output format '${format}' is only valid for symbols mode` };
     }
@@ -34,28 +36,29 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
     ].join('');
     let regex;
     try {
-        regex = new RegExp(rawPattern, flags);
+        regex = compileSafeRegExp(rawPattern, flags, { operation: 'find content' });
     }
     catch (e) {
         return { error: `Invalid regex: ${summarizeError(e)}` };
     }
-    const files = await collectFilesForSearch(basePath, query.glob);
+    const files = await collectFilesForSearch(basePath, query.glob, diagnostics);
     if (query.negate) {
         const nonMatchingFiles = [];
         for (const file of files) {
-            const content = await readTextFile(file);
+            const content = await readTextFile(file, diagnostics);
             if (content === null)
                 continue;
-            regex.lastIndex = 0;
-            if (!regex.test(content)) {
+            if (content.length > 500_000)
+                continue;
+            if (!safeRegExpTest(regex, content, { operation: 'find content negate', maxInputChars: 500_000 })) {
                 nonMatchingFiles.push(file);
                 if (nonMatchingFiles.length >= maxTotal)
                     break;
             }
         }
         if (format === 'count_only')
-            return makeCountResult(nonMatchingFiles.length);
-        return makeFilesResult(nonMatchingFiles, nonMatchingFiles.length);
+            return withFindWarnings(makeCountResult(nonMatchingFiles.length), diagnostics.warnings);
+        return withFindWarnings(makeFilesResult(nonMatchingFiles, nonMatchingFiles.length), diagnostics.warnings);
     }
     const cacheKey = { pattern: rawPattern, glob: query.glob ?? '', path: basePath, flags };
     const cachedEntry = runtime.searchCacheGet(cacheKey);
@@ -72,10 +75,10 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
         outer: for (const file of files) {
             if (totalMatches >= maxTotal)
                 break;
-            const content = await readTextFile(file);
+            const content = await readTextFile(file, diagnostics);
             if (content === null)
                 continue;
-            if (await isBinary(file))
+            if (await isBinary(file, diagnostics))
                 continue;
             const lines = content.split('\n');
             const fileMatches = [];
@@ -84,8 +87,9 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                     break;
                 if (totalMatches >= maxTotal)
                     break outer;
-                regex.lastIndex = 0;
-                if (regex.test(lines[i])) {
+                if ((lines[i]?.length ?? 0) > 50_000)
+                    continue;
+                if (safeRegExpTest(regex, lines[i], { operation: 'find content line' })) {
                     const match = { file, line: i + 1, text: lines[i] };
                     if (format === 'context') {
                         match.context_before = lines.slice(Math.max(0, i - ctxBefore), i);
@@ -125,7 +129,8 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                 const s = await statAsync(f);
                 fileMtimes.set(f, s.mtimeMs);
             }
-            catch {
+            catch (err) {
+                addFindWarning(diagnostics, `Could not stat '${f}' for ranked search; ranking may be incomplete: ${summarizeError(err)}`);
                 fileMtimes.set(f, 0);
             }
         }));
@@ -166,17 +171,17 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                         m.endLine = scope.endLine;
                     }
                 }
-                catch {
-                    // ignore
+                catch (err) {
+                    addFindWarning(diagnostics, `Could not expand match scope in '${file}' at line ${m.line}: ${summarizeError(err)}`);
                 }
             }
         }
     }
     if (format === 'count_only') {
-        return makeCountResult(totalMatches, undefined, matchedFiles.size);
+        return withFindWarnings(makeCountResult(totalMatches, undefined, matchedFiles.size), diagnostics.warnings);
     }
     if (format === 'files_only') {
-        return makeFilesResult(Array.from(matchedFiles.keys()), matchedFiles.size);
+        return withFindWarnings(makeFilesResult(Array.from(matchedFiles.keys()), matchedFiles.size), diagnostics.warnings);
     }
     if (format === 'locations') {
         const locations = [];
@@ -185,7 +190,7 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                 locations.push({ file, line: m.line });
             }
         }
-        return makeLocationsResult(locations, totalMatches);
+        return withFindWarnings(makeLocationsResult(locations, totalMatches), diagnostics.warnings);
     }
     if (format === 'matches' || format === 'context') {
         const results = [];
@@ -195,7 +200,7 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                 let replacedText;
                 if (query.preview_replace !== undefined) {
                     try {
-                        const replaceRegex = new RegExp(rawPattern, flags);
+                        const replaceRegex = compileSafeRegExp(rawPattern, flags, { operation: 'find content preview_replace' });
                         replacedText = m.text.replace(replaceRegex, query.preview_replace);
                     }
                     catch {
@@ -231,10 +236,10 @@ async function executeContentQuery(query, output, runtime, projectRoot) {
                     importedBy: importGraph.findDependents(file),
                 };
             }
-            return { matches: results, count: totalMatches, relationships: relMap };
+            return withFindWarnings({ matches: results, count: totalMatches, relationships: relMap }, [...diagnostics.warnings, ...(importGraph.getWarnings?.() ?? [])]);
         }
-        return { matches: results, count: totalMatches };
+        return withFindWarnings({ matches: results, count: totalMatches }, diagnostics.warnings);
     }
-    return makeCountResult(totalMatches);
+    return withFindWarnings(makeCountResult(totalMatches), diagnostics.warnings);
 }
 export { executeContentQuery };

package/dist/platform/tools/find/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/files.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI7D,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8IlC"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/files.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgB7D,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmKlC"}

package/dist/platform/tools/find/files.js

@@ -1,7 +1,8 @@
 import { join, relative } from 'node:path';
 import { statSync, lstatSync } from 'node:fs';
-import { buildGitignoreMatcher, collectGlobFiles, makeCountResult, makeFilesResult, matchesGlob, validateSearchPath } from './shared.js';
+import { addFindWarning, buildGitignoreMatcher, collectGlobFiles, createFindDiagnostics, findNestedGitignoreFiles, makeCountResult, makeFilesResult, matchesGlob, validateSearchPath, withFindWarnings, } from './shared.js';
 import { summarizeError } from '../../utils/error-display.js';
+import { compileSafeRegExp, safeRegExpTest } from '../../utils/safe-regex.js';
 export async function executeFilesQuery(query, output, projectRoot) {
     const validatedPath = validateSearchPath(query.path, projectRoot);
     if (typeof validatedPath === 'object')
@@ -9,11 +10,20 @@ export async function executeFilesQuery(query, output, projectRoot) {
     const basePath = validatedPath;
     const patterns = query.patterns ?? ['**/*'];
     const excludePatterns = query.exclude ?? [];
-    const compiledExcludes = excludePatterns.map((p) => new Bun.Glob(p));
     const maxResults = output.max_results ?? 100;
     const includeHidden = query.include_hidden ?? false;
     const followSymlinks = query.follow_symlinks ?? false;
     const respectGitignore = query.respect_gitignore !== false;
+    const diagnostics = createFindDiagnostics();
+    const compiledExcludes = [];
+    for (const pattern of excludePatterns) {
+        try {
+            compiledExcludes.push(new Bun.Glob(pattern));
+        }
+        catch (err) {
+            addFindWarning(diagnostics, `Skipped invalid exclude glob '${pattern}': ${summarizeError(err)}`);
+        }
+    }
     const modifiedAfterMs = query.modified_after ? new Date(query.modified_after).getTime() : undefined;
     if (modifiedAfterMs !== undefined && Number.isNaN(modifiedAfterMs)) {
         return { error: `Invalid modified_after date: ${query.modified_after}` };
@@ -23,23 +33,32 @@ export async function executeFilesQuery(query, output, projectRoot) {
         return { error: `Invalid modified_before date: ${query.modified_before}` };
     }
     const gitignoreMatcher = respectGitignore
-        ? buildGitignoreMatcher(join(projectRoot, '.gitignore'))
+        ? buildGitignoreMatcher(join(projectRoot, '.gitignore'), diagnostics)
         : null;
+    if (respectGitignore) {
+        const rootGitignorePath = join(projectRoot, '.gitignore');
+        const nestedGitignores = findNestedGitignoreFiles(basePath, rootGitignorePath);
+        if (nestedGitignores.length > 0) {
+            addFindWarning(diagnostics, `Nested .gitignore files are not applied by find files; ${nestedGitignores.length} nested file(s) detected, including '${nestedGitignores[0]}'.`);
+        }
+    }
     let hasContentRegex;
     if (query.has_content) {
         try {
-            hasContentRegex = new RegExp(query.has_content);
+            hasContentRegex = compileSafeRegExp(query.has_content, '', { operation: 'find files has_content' });
         }
         catch (e) {
             return { error: `Invalid has_content regex: ${summarizeError(e)}` };
         }
     }
     const SCAN_CEILING = 50_000;
-    const scannedFiles = await collectGlobFiles(basePath, patterns, includeHidden, followSymlinks);
+    const scannedFiles = await collectGlobFiles(basePath, patterns, includeHidden, followSymlinks, diagnostics);
     const matchedFiles = new Set();
     for (const file of scannedFiles) {
-        if (matchedFiles.size >= SCAN_CEILING)
+        if (matchedFiles.size >= SCAN_CEILING) {
+            addFindWarning(diagnostics, `File scan stopped after ${SCAN_CEILING} matches; results may be incomplete.`);
             break;
+        }
         const rel = relative(basePath, file);
         if (gitignoreMatcher && gitignoreMatcher(rel))
             continue;
@@ -66,8 +85,8 @@ export async function executeFilesQuery(query, output, projectRoot) {
                 entry.size = s.size;
                 entry.mtimeMs = s.mtimeMs;
             }
-            catch {
-                // ignore stat errors
+            catch (err) {
+                addFindWarning(diagnostics, `Could not stat '${entry.path}'; filters and sorting may be incomplete: ${summarizeError(err)}`);
             }
             if (query.min_size !== undefined && (entry.size ?? 0) < query.min_size)
                 continue;
@@ -91,11 +110,11 @@ export async function executeFilesQuery(query, output, projectRoot) {
         for (const entry of entries) {
             try {
                 const text = await Bun.file(entry.path).text();
-                if (hasContentRegex.test(text))
+                if (safeRegExpTest(hasContentRegex, text, { operation: 'find files has_content', maxInputChars: 500_000 }))
                     filtered.push(entry);
             }
-            catch {
-                // unreadable file
+            catch (err) {
+                addFindWarning(diagnostics, `Could not read '${entry.path}' for has_content filtering: ${summarizeError(err)}`);
             }
         }
         entries = filtered;
@@ -112,7 +131,7 @@ export async function executeFilesQuery(query, output, projectRoot) {
     });
     const format = output.format ?? 'files_only';
     if (format === 'count_only') {
-        return makeCountResult(entries.length);
+        return withFindWarnings(makeCountResult(entries.length), diagnostics.warnings);
     }
     if (format === 'with_stats') {
         const result = entries.map((e) => ({
@@ -120,7 +139,7 @@ export async function executeFilesQuery(query, output, projectRoot) {
             size: e.size,
             modified: e.mtimeMs !== undefined ? new Date(e.mtimeMs).toISOString() : undefined,
         }));
-        return { files: result, count: result.length };
+        return withFindWarnings({ files: result, count: result.length }, diagnostics.warnings);
     }
     if (format === 'with_preview') {
         const previewLines = output.preview_lines ?? 3;
@@ -131,12 +150,12 @@ export async function executeFilesQuery(query, output, projectRoot) {
                 const text = await Bun.file(entry.path).text();
                 preview = text.split('\n').slice(0, previewLines);
             }
-            catch {
-                // unreadable
+            catch (err) {
+                addFindWarning(diagnostics, `Could not read '${entry.path}' for preview: ${summarizeError(err)}`);
             }
             result.push({ file: entry.path, preview });
         }
-        return { files: result, count: result.length };
+        return withFindWarnings({ files: result, count: result.length }, diagnostics.warnings);
     }
-    return makeFilesResult(entries.map((e) => e.path), entries.length);
+    return withFindWarnings(makeFilesResult(entries.map((e) => e.path), entries.length), diagnostics.warnings);
 }

package/dist/platform/tools/find/references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/references.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGlE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA+DlC"}
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../../../src/platform/tools/find/references.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBlE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiFlC"}