@poe-platform/safe-bash 0.1.521 → 0.1.523

package/dist/safe-bash/shell/runtime.js

@@ -27,7 +27,7 @@ import { formatPrintf, printfCommand } from "../commands/basic.js";
 import { pathOf, UsageError } from "../commands/internal.js";
 import { cloneGetoptsState, createGetoptsInput, createGetoptsState, GetoptsError, getoptsInputAllocationSize, scanGetopts, withGetoptsIndex } from "./getopts.js";
 import { activateChildCancellation, prepareChildCancellation, selectRuntimeCancellationOutcome, subscribeCancellation, } from "./cancellation.js";
-import { getArrayAssignment, getArraySelector, copyArraySelector, numericIndex, literalIndex, isQuoteMarker } from "./arrays/syntax.js";
+import { getArrayAssignment, getArraySelector, copyArraySelector, numericIndex, literalIndex, isQuoteMarker, prefixNameQuoteGroups } from "./arrays/syntax.js";
 import { ArrayFailure, ArrayOwner, exactSum } from "./arrays/ledger.js";
 import { controlNames, IndexedBinding, textToken } from "./arrays/bindings.js";
 import { arrayStore, guestArrays, requireArrays, snapshotState, stateMonitor, trackState } from "./arrays/state.js";
@@ -76,6 +76,40 @@ export function resolveLimits(...limits) {
     return result;
 }
 const budgetedSinks = new WeakMap();
+async function sortExpansionStrings(values, work) {
+    const compare = async (left, right) => {
+        for (let index = 0; index < Math.min(left.length, right.length); index++) {
+            const pending = stringCheckpoint(work);
+            if (pending)
+                await pending;
+            const difference = left.charCodeAt(index) - right.charCodeAt(index);
+            if (difference)
+                return difference;
+        }
+        return left.length - right.length;
+    };
+    const sift = async (root, end) => {
+        while (root * 2 + 1 < end) {
+            let child = root * 2 + 1;
+            if (child + 1 < end && await compare(values[child], values[child + 1]) < 0)
+                child++;
+            if (await compare(values[root], values[child]) >= 0)
+                return;
+            const saved = values[root];
+            values[root] = values[child];
+            values[child] = saved;
+            root = child;
+        }
+    };
+    for (let index = Math.floor(values.length / 2) - 1; index >= 0; index--)
+        await sift(index, values.length);
+    for (let end = values.length - 1; end > 0; end--) {
+        const saved = values[0];
+        values[0] = values[end];
+        values[end] = saved;
+        await sift(0, end);
+    }
+}
 export class Budget {
     limits;
     onInternalError;
@@ -87,6 +121,8 @@ export class Budget {
     iterations = 0;
     bytes = 0;
     sourceBytes = 0;
+    globstarEntries = 0;
+    globstarStates = 0;
     controller = new AbortController();
     signal;
     #wallClockTimer;
@@ -259,7 +295,7 @@ const typedSavedVariables = new WeakMap();
 const valueScope = Symbol("shell value allocation scope");
 const invokedValues = new WeakMap();
 function isolateIO(io) {
-    return { ...io, ...(io.descriptors ? { descriptors: new Map([...io.descriptors].map(([number, descriptor]) => [number, { ...descriptor }])) } : {}) };
+    return { ...io, nameExpansionContext: undefined, ...(io.descriptors ? { descriptors: new Map([...io.descriptors].map(([number, descriptor]) => [number, { ...descriptor }])) } : {}) };
 }
 function activeIO(io) {
     const input = io.descriptors?.get(0);
@@ -1534,6 +1570,7 @@ export class Runtime {
             const current = store.get(name);
             if (index !== undefined && current) {
                 staged = index === "members" ? IndexedBinding.create(store.owner) : await current.copy(this.signal);
+                staged.assigned = current.assigned;
                 let maximum = -1;
                 for (const key of staged.values.keys()) {
                     operation.reserve({ work: 2 }).release();
@@ -1775,7 +1812,8 @@ export class Runtime {
                 throw new ArrayFailure("readonly binding");
             if (!watch.valid())
                 throw new ArrayFailure("stale binding");
-            if (!(assignment.kind === "compound" && assignment.append && writes === 0)) {
+            staged.assigned = true;
+            if (!(assignment.kind === "compound" && assignment.append && writes === 0 && current?.assigned)) {
                 let released;
                 stateMonitor(state).publish(tickets, name, () => {
                     supersede();
@@ -2092,8 +2130,8 @@ export class Runtime {
                             fs: this.fs, cwd: state.cwd, signal: this.signal,
                             locale: state.variables.LC_ALL || state.variables.LC_COLLATE || state.variables.LANG || "C",
                             work: { remaining: this.budget.limits.maxExpansionBytes, signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes"), allocation },
-                            expand: async (word, pattern = false) => (await this.word(word, state, io, false, pattern, false, pattern)).join(""),
-                            regex: (subject, pattern) => this.ere(subject, pattern, state, io),
+                            expand: async (word, pattern = false) => (await this.word(word, state, { ...io, nameExpansionContext: "conditional" }, false, pattern, false, pattern)).join(""),
+                            regex: (subject, pattern) => this.ere(subject, pattern, state, { ...io, nameExpansionContext: "conditional" }),
                             option: name => name === "braceexpand" ? state.braceexpand !== false : name === "errexit" ? !!state.errexit : name === "nounset" ? !!state.nounset : name === "pipefail" ? state.pipefail : false,
                             present: name => {
                                 const match = /^([a-zA-Z_][a-zA-Z_0-9]*)(?:\[(0|[1-9][0-9]*|[@*])\])?$/u.exec(name);
@@ -2356,7 +2394,7 @@ export class Runtime {
                     await writeDiagnostic(io.stderr, `shell: warning: ${warning}\n`);
                 if (++words % 128 === 0)
                     await yieldTurn(this.signal);
-                const part = (await this.word(word, state, io, false)).join("");
+                const part = (await this.word(word, state, { ...io, nameExpansionContext: "document" }, false)).join("");
                 size += Buffer.byteLength(part);
                 if (size > this.budget.limits.maxExpansionBytes)
                     this.budget.fail("maxExpansionBytes");
@@ -3319,6 +3357,7 @@ export class Runtime {
             cwd: state.cwd, variables, exported, functions: new Map(), getopts: { cursor: createGetoptsState(), integer: true },
             directoryStack: { entries: [], bytes: 0 },
             dotglob: false,
+            globstar: false,
             positional: [...args], arg0, profile: context.command === "sh" ? "sh" : "bash", status: 0, substitutionStatus: 0, depth: state.depth + 1,
             loopDepth: 0, functionDepth: 0, locals: [], pipefail: false, isolated: true,
             errexit: false,
@@ -4476,7 +4515,7 @@ export class Runtime {
                     unset = true;
                 else {
                     await this.diagnostic(context, `shopt: ${option.startsWith("--") ? option : `-${flag}`}: unsupported option`);
-                    await writeDiagnostic(context.stderr, "shopt: usage: shopt [-pqsu] [--] [dotglob ...]\n");
+                    await writeDiagnostic(context.stderr, "shopt: usage: shopt [-pqsu] [--] [dotglob globstar ...]\n");
                     return 2;
                 }
             }
@@ -4485,28 +4524,29 @@ export class Runtime {
             await this.diagnostic(context, "shopt: cannot set and unset shell options simultaneously");
             return 1;
         }
-        const emit = async () => {
+        const emit = async (name) => {
             if (!quiet)
-                await writeText(context.stdout, print ? `shopt -${state.dotglob ? "s" : "u"} dotglob\n` : `dotglob             \t${state.dotglob ? "on" : "off"}\n`);
+                await writeText(context.stdout, print ? `shopt -${state[name] ? "s" : "u"} ${name}\n` : `${name.padEnd(20)}\t${state[name] ? "on" : "off"}\n`);
         };
         if (index === context.args.length) {
-            if ((!set || state.dotglob) && (!unset || !state.dotglob))
-                await emit();
+            for (const name of ["dotglob", "globstar"])
+                if ((!set || state[name]) && (!unset || !state[name]))
+                    await emit(name);
             return 0;
         }
         let status = 0;
         for (; index < context.args.length; index++) {
             this.signal.throwIfAborted();
             const name = context.args[index];
-            if (name !== "dotglob") {
-                await this.diagnostic(context, `shopt: ${name}: unsupported shell option name (only dotglob is supported)`);
+            if (name !== "dotglob" && name !== "globstar") {
+                await this.diagnostic(context, `shopt: ${name}: unsupported shell option name (supported: dotglob, globstar)`);
                 status = 1;
             }
             else if (set || unset)
-                state.dotglob = set;
+                state[name] = set;
             else {
-                await emit();
-                if (!state.dotglob)
+                await emit(name);
+                if (!state[name])
                     status = 1;
             }
         }
@@ -5204,7 +5244,83 @@ export class Runtime {
     async part(part, state, io, hereString = false) {
         return shellValueText(await this.valuePart(part, state, io, hereString));
     }
+    async *prefixNames(prefix, state) {
+        const allocation = this.budget.values.scope();
+        const store = arrayStore(state);
+        const holding = store?.owner.hold();
+        const work = { remaining: Math.min(Number.MAX_SAFE_INTEGER, this.budget.limits.maxExpansionBytes * 4 + 1024), signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+        try {
+            allocation.reserveBytes(128);
+            const names = [];
+            const seen = new Set();
+            let bytes = 0;
+            const consider = async (name, assigned) => {
+                const scanned = await scanString(name, work);
+                const pending = stringCheckpoint(work, name.length + 1);
+                if (pending)
+                    await pending;
+                if (!assigned || !name.startsWith(prefix) || seen.has(name))
+                    return;
+                for (let index = 0; index < name.length; index++) {
+                    const pending = stringCheckpoint(work);
+                    if (pending)
+                        await pending;
+                    const code = name.charCodeAt(index);
+                    if (!(code === 95 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || index > 0 && code >= 48 && code <= 57))
+                        return;
+                }
+                if (names.length >= this.budget.limits.maxExpansionFields)
+                    this.budget.fail("maxExpansionFields");
+                if (scanned.bytes > this.budget.limits.maxExpansionBytes - bytes)
+                    this.budget.fail("maxExpansionBytes");
+                bytes += scanned.bytes;
+                allocation.reserveBytes(name.length * 2 + 64);
+                seen.add(name);
+                names.push(name);
+            };
+            for (const name in state.variables)
+                if (Object.hasOwn(state.variables, name))
+                    await consider(name, state.variables[name] !== undefined);
+            if (store)
+                for (const [name, entry] of store.bindings)
+                    await consider(name, entry.binding.assigned);
+            // Bash lists initialized names from dynamically enclosing local scopes,
+            // even when the current local value shadows them with an unset value.
+            for (const frame of state.locals)
+                for (const [name, saved] of frame) {
+                    await consider(name, saved.value !== undefined || typedSavedVariables.get(saved)?.binding?.assigned === true);
+                }
+            await sortExpansionStrings(names, work);
+            for (const name of names) {
+                const pending = stringCheckpoint(work);
+                if (pending)
+                    await pending;
+                yield name;
+            }
+        }
+        finally {
+            allocation.close();
+            holding?.release();
+        }
+    }
     async valuePart(part, state, io, hereString = false) {
+        if (part.kind === "variable" && part.prefixNames) {
+            const ifs = state.variables.IFS ?? " ";
+            const separator = io.nameExpansionContext === "document" || io.nameExpansionContext === "conditional" && part.prefixNames === "@"
+                ? " " : ifs.length ? String.fromCodePoint(ifs.codePointAt(0)) : "";
+            const fragments = [];
+            let bytes = 0;
+            for await (const name of this.prefixNames(part.name, state)) {
+                const join = fragments.length ? separator : "";
+                bytes += Buffer.byteLength(name) + Buffer.byteLength(join);
+                if (bytes > this.budget.limits.maxExpansionBytes)
+                    this.budget.fail("maxExpansionBytes");
+                io[valueScope]?.reserve((name.length + join.length) * 2 + 32, 0);
+                fragments.push(join, name);
+            }
+            io[valueScope]?.reserve(bytes * 2, 0);
+            return fragments.join("");
+        }
         const binding = part.kind === "variable" ? arrayStore(state)?.get(part.name) : undefined;
         const holding = binding ? requireArrays(state).owner.hold() : undefined;
         const selector = getArraySelector(part);
@@ -5652,7 +5768,8 @@ export class Runtime {
             }
             return fields;
         }
-        const arrayOwned = word.parts.some(part => part.kind === "variable" && (getArraySelector(part) !== undefined || arrayStore(state)?.get(part.name) !== undefined));
+        const arrayOwned = word.parts.some(part => part.kind === "variable" && !part.prefixNames && (getArraySelector(part) !== undefined || arrayStore(state)?.get(part.name) !== undefined));
+        const prefixOwned = word.parts.some(part => part.kind === "variable" && part.prefixNames === "@");
         const owner = arrayOwned ? requireArrays(state).owner : undefined;
         const holding = owner?.hold();
         const scratch = !owner && split && state.variables.IFS !== "" && word.parts.some(part => !part.quoted && part.kind !== "text")
@@ -5663,12 +5780,14 @@ export class Runtime {
             owner?.reserve({ metadata: 128 + word.parts.length * 32, allocatedSlots: word.parts.length + 1, work: word.parts.length + 5 });
             scratch?.reserve(word.parts.length * 32, 0);
             const fields = [];
+            let emptyNameGroups;
+            let quoteGroup;
             const addField = () => {
                 if (fields.length >= this.budget.limits.maxExpansionFields)
                     this.budget.fail("maxExpansionFields");
                 scratch?.reserve(32, 0);
                 owner?.reserve({ metadata: 32, allocatedSlots: 1, work: 3 });
-                fields.push({ fragments: [], bytes: false, patterns: undefined, present: false });
+                fields.push({ fragments: [], bytes: false, patterns: undefined, present: false, independentPresence: false });
             };
             addField();
             let expansionBytes = 0;
@@ -5708,6 +5827,15 @@ export class Runtime {
                 regexAppend?.(text, !glob);
                 field.fragments.push(value);
                 field.present ||= present;
+                if (present) {
+                    if (size > 0 || !quoteGroup)
+                        field.independentPresence = true;
+                    else {
+                        io[valueScope]?.reserve(32, 0);
+                        field.quoteGroups ??= [];
+                        field.quoteGroups.push(quoteGroup);
+                    }
+                }
             };
             const appendSplit = async (value) => {
                 this.budget.cpuCheckpoint();
@@ -5764,7 +5892,8 @@ export class Runtime {
             const parts = word.parts.map((part) => ({ part, splitText: false, io }));
             for (let index = 0; index < parts.length; index++) {
                 const { part, splitText, io: partIO } = parts[index];
-                const quotedPresence = part.quoted && !(arrayOwned && isQuoteMarker(part));
+                quoteGroup = prefixNameQuoteGroups.get(part);
+                const quotedPresence = part.quoted && !((arrayOwned || prefixOwned) && isQuoteMarker(part));
                 if (part.kind === "variable" && ["-", "+", ":-", ":+"].includes(part.operator ?? "") && /^[a-zA-Z_][a-zA-Z_0-9]*$/u.test(part.name)) {
                     const value = this.variable(state, part.name);
                     const missing = value === undefined || (part.operator.startsWith(":") && value === "");
@@ -5779,7 +5908,20 @@ export class Runtime {
                     }
                 }
                 const selector = getArraySelector(part);
-                if (part.kind === "variable" && selector?.kind === "members" && !part.length && split && (!part.quoted || selector.separator === "@")) {
+                if (part.kind === "variable" && part.prefixNames === "@" && split && (part.quoted || state.variables.IFS === "")) {
+                    let position = 0;
+                    for await (const name of this.prefixNames(part.name, state)) {
+                        if (position++)
+                            addField();
+                        append(name, !part.quoted, true);
+                    }
+                    if (position === 0 && quoteGroup) {
+                        io[valueScope]?.reserve(32, 0);
+                        emptyNameGroups ??= new Set();
+                        emptyNameGroups.add(quoteGroup);
+                    }
+                }
+                else if (part.kind === "variable" && selector?.kind === "members" && !part.length && split && (!part.quoted || selector.separator === "@")) {
                     const members = await this.arrayMembers(part.name, state);
                     for (let position = 0; position < members.length; position++) {
                         if (position > 0)
@@ -5823,6 +5965,21 @@ export class Runtime {
             for (const field of fields) {
                 if (!field.present && split)
                     continue;
+                if (split && !field.independentPresence && field.quoteGroups) {
+                    const work = { remaining: this.budget.limits.maxExpansionBytes, signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+                    let empty = true;
+                    for (const group of field.quoteGroups) {
+                        const pending = stringCheckpoint(work);
+                        if (pending)
+                            await pending;
+                        if (!emptyNameGroups?.has(group)) {
+                            empty = false;
+                            break;
+                        }
+                    }
+                    if (empty)
+                        continue;
+                }
                 if (scratch && field.fragments.length > 1 && !field.bytes)
                     scratch.reserve(field.fragments.reduce((bytes, value) => bytes + shellValueText(value).length * 2, 0), 0);
                 const assembled = concatShellValues(field.fragments, io[valueScope]);
@@ -5969,9 +6126,213 @@ export class Runtime {
             holding.release();
         }
     }
+    async recursiveGlob(value, pattern, state) {
+        // Entry/state limits are invocation-wide, including hidden and nonmatching
+        // entries. They are separate from the number of emitted expansion fields.
+        const failWalk = (message) => {
+            const error = new FsError("EFBIG", { syscall: "glob", message });
+            this.budget.controller.abort(error);
+            throw error;
+        };
+        const work = { remaining: Math.min(Number.MAX_SAFE_INTEGER, this.budget.limits.maxExpansionBytes * 4 + 1024), signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+        const scratch = this.budget.values.scope();
+        work.allocation = scratch;
+        try {
+            const segments = [];
+            let start = 0;
+            for (let end = 0; end <= pattern.length; end++) {
+                const pending = stringCheckpoint(work);
+                if (pending)
+                    await pending;
+                if (end !== pattern.length && pattern[end] !== "/")
+                    continue;
+                if (end > start) {
+                    const bytes = (await scanString(pattern, work, start, end)).bytes;
+                    if (++this.budget.globstarStates > 100_000)
+                        failWalk("globstar traversal state limit exceeded");
+                    scratch.reserveBytes(bytes * 2 + 64);
+                    segments.push(pattern.slice(start, end));
+                }
+                start = end + 1;
+            }
+            const make = (parent, suffix, bytes, descend, depth) => {
+                const separator = parent.path && parent.path !== "/" ? "/" : "";
+                const size = parent.bytes + separator.length + bytes;
+                if (size > this.budget.limits.maxExpansionBytes)
+                    this.budget.fail("maxExpansionBytes");
+                if (++this.budget.globstarStates > 100_000)
+                    failWalk("globstar traversal state limit exceeded");
+                if (depth > 128)
+                    failWalk("globstar directory depth limit exceeded");
+                // Includes the candidate, queue/map/set slots and later segment-array
+                // references. Reservations remain cumulative until this glob settles.
+                scratch.reserveBytes(size * 2 + 128);
+                return { path: parent.path + separator + suffix, bytes: size, descend, depth };
+            };
+            const empty = { path: "", bytes: 0, descend: true, depth: 0 };
+            let candidates = [make(empty, pattern.startsWith("/") ? "/" : "", pattern.startsWith("/") ? 1 : 0, true, 0)];
+            const ignored = (error) => {
+                this.signal.throwIfAborted();
+                return ["ENOENT", "ENOTDIR", "EACCES"].includes(errorCode(error) ?? "");
+            };
+            const read = async (candidate) => {
+                const maxEntries = 100_000 - this.budget.globstarEntries;
+                let entries;
+                try {
+                    entries = await interruptible(this.fs.readdir(pathOf(state, candidate.path || "."), { signal: this.signal, maxEntries }), this.signal);
+                }
+                catch (error) {
+                    this.signal.throwIfAborted();
+                    if (errorCode(error) === "EFBIG")
+                        this.budget.controller.abort(error);
+                    throw error;
+                }
+                this.signal.throwIfAborted();
+                if (entries.length > maxEntries)
+                    failWalk("globstar directory entry limit exceeded");
+                this.budget.globstarEntries += entries.length;
+                return entries;
+            };
+            let wildcardPrefix = false;
+            for (let index = 0; index < segments.length; index++) {
+                const segment = segments[index];
+                const terminal = index === segments.length - 1;
+                const next = new Map();
+                const add = (candidate) => {
+                    const prior = next.get(candidate.path);
+                    if (!prior || candidate.descend && !prior.descend)
+                        next.set(candidate.path, candidate);
+                };
+                if (segment === "**") {
+                    const visited = new Set();
+                    for (const root of candidates) {
+                        this.signal.throwIfAborted();
+                        try {
+                            if ((await interruptible(this.fs.stat(pathOf(state, root.path || "."), { signal: this.signal }), this.signal)).type !== "directory")
+                                continue;
+                        }
+                        catch (error) {
+                            if (ignored(error))
+                                continue;
+                            throw error;
+                        }
+                        if (!terminal || root.path) {
+                            // A literal prefix retains its separator in the zero-depth
+                            // terminal match; expanded prefixes do not (GNU Bash 5.2).
+                            add(terminal && !wildcardPrefix && root.path !== "/" ? make(root, "", 0, root.descend, root.depth) : root);
+                        }
+                        const queue = root.descend ? [root] : [];
+                        while (queue.length) {
+                            const directory = queue.pop();
+                            if (visited.has(directory.path))
+                                continue;
+                            visited.add(directory.path);
+                            let entries;
+                            try {
+                                entries = await read(directory);
+                            }
+                            catch (error) {
+                                if (ignored(error))
+                                    continue;
+                                throw error;
+                            }
+                            for (const entry of entries) {
+                                const pending = stringCheckpoint(work);
+                                if (pending)
+                                    await pending;
+                                if (entry.name === "." || entry.name === ".." || !state.dotglob && entry.name.startsWith("."))
+                                    continue;
+                                const bytes = (await scanString(entry.name, work)).bytes;
+                                const child = make(directory, entry.name, bytes, entry.type === "directory", directory.depth + (entry.type === "directory" ? 1 : 0));
+                                if (terminal || entry.type === "directory" || entry.type === "symlink" && root.path !== "")
+                                    add(child);
+                                if (entry.type === "directory")
+                                    queue.push(child);
+                            }
+                        }
+                    }
+                    wildcardPrefix = true;
+                }
+                else if (!/(?:^|[^\\])[*?[]/u.test(segment)) {
+                    const literal = segment.replace(/\\(.)/gu, "$1");
+                    const bytes = (await scanString(literal, work)).bytes;
+                    for (const candidate of candidates)
+                        add(make(candidate, literal, bytes, true, candidate.depth));
+                }
+                else {
+                    const matches = await compilePattern(segment, work);
+                    for (const candidate of candidates) {
+                        let entries;
+                        try {
+                            entries = await read(candidate);
+                        }
+                        catch (error) {
+                            if (ignored(error))
+                                continue;
+                            throw error;
+                        }
+                        for (const entry of entries) {
+                            const pending = stringCheckpoint(work);
+                            if (pending)
+                                await pending;
+                            if (entry.name !== "." && entry.name !== ".." && (state.dotglob || !entry.name.startsWith(".") || segment.startsWith(".")) && await matches(entry.name)) {
+                                add(make(candidate, entry.name, (await scanString(entry.name, work)).bytes, true, candidate.depth));
+                            }
+                        }
+                    }
+                    wildcardPrefix = true;
+                }
+                candidates = [...next.values()];
+            }
+            const found = [];
+            let outputBytes = 0;
+            for (const candidate of candidates) {
+                this.signal.throwIfAborted();
+                try {
+                    const path = pathOf(state, candidate.path);
+                    const stat = await interruptible(value.endsWith("/") ? this.fs.stat(path, { signal: this.signal }) : this.fs.lstat(path, { signal: this.signal }), this.signal);
+                    if (value.endsWith("/") && stat.type !== "directory")
+                        continue;
+                    const slash = value.endsWith("/") && !candidate.path.endsWith("/") ? "/" : "";
+                    if (found.length >= this.budget.limits.maxExpansionFields)
+                        this.budget.fail("maxExpansionFields");
+                    outputBytes += candidate.bytes + slash.length;
+                    if (outputBytes > this.budget.limits.maxExpansionBytes)
+                        this.budget.fail("maxExpansionBytes");
+                    scratch.reserveBytes(candidate.bytes * 2 + slash.length + 8);
+                    found.push(candidate.path + slash);
+                }
+                catch (error) {
+                    if (!ignored(error))
+                        throw error;
+                }
+            }
+            // In-place heap sort preserves ordinary UTF-16 pathname order while
+            // charging comparisons, including long common prefixes, and yielding.
+            await sortExpansionStrings(found, work);
+            return found.length ? found : [value];
+        }
+        finally {
+            scratch.close();
+        }
+    }
     async glob(value, pattern, state) {
         if (!/(?:^|[^\\])[*?[]/u.test(pattern))
             return [value];
+        if (state.globstar) {
+            const work = { remaining: Math.min(Number.MAX_SAFE_INTEGER, this.budget.limits.maxExpansionBytes * 4 + 1024), signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
+            let start = 0;
+            for (let end = 0; end <= pattern.length; end++) {
+                const pending = stringCheckpoint(work);
+                if (pending)
+                    await pending;
+                if (end !== pattern.length && pattern[end] !== "/")
+                    continue;
+                if (end - start === 2 && pattern[start] === "*" && pattern[start + 1] === "*")
+                    return this.recursiveGlob(value, pattern, state);
+                start = end + 1;
+            }
+        }
         const absolute = pattern.startsWith("/");
         const work = { remaining: Math.min(Number.MAX_SAFE_INTEGER, this.budget.limits.maxExpansionBytes * 4 + 1024), signal: this.signal, exhausted: () => this.budget.fail("maxExpansionBytes") };
         let candidates = [absolute ? "/" : ""];