@thegitai/cli 1.0.0-beta.9 → 1.0.0-preview.10

package/dist/src/executor.js

@@ -1,11 +1,25 @@
-import chalk from 'chalk';
-import * as pty from '@homebridge/node-pty-prebuilt-multiarch';
+import chalk from './colors.js';
 import { execFileSync, spawn } from 'child_process';
 import { existsSync, statSync } from 'fs';
+import { createRequire } from 'node:module';
 import os from 'os';
 import path from 'path';
 import { ARTIFACT_INSPECT_BLOCK_DIRS, getBlockedArtifactInspectDir, relativeProjectPath, } from './artifact-policy.js';
 import { emitCommandOutput, isTuiMode } from './runtime-mode.js';
+import { ensureSessionScratchDir, isInsideTheGitAiScratch, sessionScratchDir, } from './scratch-dir.js';
+const requireFromHere = createRequire(import.meta.url);
+let nodePtyCache;
+function loadNodePty() {
+    if (nodePtyCache !== undefined)
+        return nodePtyCache;
+    try {
+        nodePtyCache = requireFromHere('@lydell/node-pty');
+    }
+    catch {
+        nodePtyCache = null;
+    }
+    return nodePtyCache;
+}
 const COMMON_TOOLCHAIN_BIN_DIRS = ['/usr/local/go/bin'];
 function detectVenvBin(dir) {
     for (const name of ['.venv', 'venv', 'env']) {
@@ -204,6 +218,7 @@ function isExistingDirectory(absPath) {
         return false;
     }
 }
+const OS_TEMP_BLOCK_MARKER = 'os-temp:';
 function getBlockedOsTempInspection(rawToken, rootDir) {
     const token = normalizeToken(rawToken);
     if (!token || !path.isAbsolute(token))
@@ -211,6 +226,8 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     const resolved = path.resolve(token);
     if (!isInsideOsTemp(resolved))
         return null;
+    if (isInsideTheGitAiScratch(resolved))
+        return null;
     if (rootDir) {
         const resolvedRoot = path.resolve(rootDir);
         if (resolved === resolvedRoot ||
@@ -221,7 +238,7 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     if (resolved === path.resolve(os.tmpdir()) ||
         hasPathGlob(token) ||
         isExistingDirectory(resolved)) {
-        return path.basename(os.tmpdir()) || os.tmpdir();
+        return `${OS_TEMP_BLOCK_MARKER}${path.basename(os.tmpdir()) || os.tmpdir()}`;
     }
     return null;
 }
@@ -237,6 +254,9 @@ function findBlockedDirForToken(rawToken, rootDir, baseDir, allowBareDirMatch =
         const resolved = path.isAbsolute(token)
             ? path.resolve(token)
             : path.resolve(baseDir ?? rootDir, token);
+        const osTempResolved = getBlockedOsTempInspection(resolved, rootDir);
+        if (osTempResolved)
+            return osTempResolved;
         return getBlockedProjectPathDir(resolved, rootDir);
     }
     if (!allowBareDirMatch || !BLOCKED_PATH_INSPECT_DIRS.has(token)) {
@@ -373,11 +393,16 @@ function findBlockedDirInCommandTokens(command, rootDir, baseDir) {
     }
     return null;
 }
+function expandTempEnvRefs(command) {
+    return command
+        .replace(/\$\{THEGITAI_SCRATCH_DIR[^}]*\}|\$THEGITAI_SCRATCH_DIR\b/g, sessionScratchDir())
+        .replace(/\$\{TMPDIR[^}]*\}|\$TMPDIR\b/g, process.env.TMPDIR || os.tmpdir());
+}
 function findIgnoredPathInspection(command, rootDir) {
     if (!FILE_INSPECTION_COMMAND_PATTERN.test(command)) {
         return null;
     }
-    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(command));
+    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(expandTempEnvRefs(command)));
     const baseDir = getCommandBaseDir(haystack, rootDir);
     const blockedDir = findBlockedDirInCommandTokens(haystack, rootDir, baseDir);
     if (blockedDir) {
@@ -434,7 +459,7 @@ function shouldDropOutputLine(line, rootDir, baseDir) {
 function isLsDirectoryHeader(line) {
     return /^\.?\/?.+:$/.test(line) && !line.includes(' ');
 }
-function sanitizeCommandText(command, text, rootDir) {
+export function sanitizeCommandText(command, text, rootDir) {
     if (!text)
         return '';
     const lines = text.split('\n');
@@ -509,7 +534,7 @@ export function cancelActiveCommand() {
         cancelled: true,
     });
 }
-function terminateChild(child, signal) {
+export function terminateChild(child, signal) {
     if (!child?.pid)
         return;
     if (process.platform === 'win32') {
@@ -537,10 +562,17 @@ function terminateChild(child, signal) {
     }
 }
 export function getBlockedPathInspectDir(command, rootDir) {
-    return findIgnoredPathInspection(command, rootDir);
+    const blocked = findIgnoredPathInspection(command, rootDir);
+    return blocked?.startsWith(OS_TEMP_BLOCK_MARKER)
+        ? blocked.slice(OS_TEMP_BLOCK_MARKER.length)
+        : blocked;
 }
 export function getBlockedCommandReason(command, hasTimeout, rootDir) {
     const ignoredDir = findIgnoredPathInspection(command, rootDir);
+    if (ignoredDir?.startsWith(OS_TEMP_BLOCK_MARKER)) {
+        const tempName = ignoredDir.slice(OS_TEMP_BLOCK_MARKER.length);
+        return `Listing or scanning the shared OS temp directory (${tempName}) is blocked because it can contain other users' and processes' files. Use the session scratch directory ${ensureSessionScratchDir()} for temporary scripts and files — creating, running, and listing are all allowed there — or reference an exact file path.`;
+    }
     if (ignoredDir) {
         return `Command inspects an off-limits generated or dependency directory (${ignoredDir}). Avoid that path.`;
     }
@@ -559,7 +591,7 @@ export function getBlockedCommandReason(command, hasTimeout, rootDir) {
     }
     return null;
 }
-function commandUsesSudo(command) {
+export function commandUsesSudo(command) {
     return /\bsudo\b/.test(getUnquotedShellText(command));
 }
 export function sudoPromptFromTail(text) {
@@ -587,7 +619,7 @@ function redactSecrets(text, secrets) {
     }
     return redacted;
 }
-function buildCommandEnv(cwd) {
+export function buildCommandEnv(cwd) {
     const venvBin = detectVenvBin(cwd);
     const envPath = buildCommandPath(process.env.PATH, venvBin ? [venvBin] : []);
     return {
@@ -602,12 +634,13 @@ function buildCommandEnv(cwd) {
         npm_config_fund: 'false',
         npm_config_audit: 'false',
         NUXI_INIT_SKIP_PROMPT: 'true',
+        THEGITAI_SCRATCH_DIR: ensureSessionScratchDir(),
     };
 }
 function sanitizePtyOutput(command, output, cwd, secrets) {
     return sanitizeCommandText(command, stripSudoPromptText(redactSecrets(output, secrets)), cwd);
 }
-async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword) {
+async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword, nodePty) {
     return new Promise((resolve) => {
         let output = '';
         let timedOut = false;
@@ -623,7 +656,7 @@ async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, reques
         const args = process.platform === 'win32'
             ? ['/d', '/s', '/c', command]
             : ['-lc', command];
-        const child = pty.spawn(shell, args, {
+        const child = nodePty.spawn(shell, args, {
             cols: 120,
             rows: 30,
             cwd,
@@ -776,7 +809,10 @@ export async function runCommand(command, cwd, { requestSudoPassword, timeout, }
     }
     const exploratory = isExploratoryCommand(command);
     if (requestSudoPassword && commandUsesSudo(command)) {
-        return runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword);
+        const nodePty = loadNodePty();
+        if (nodePty) {
+            return runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword, nodePty);
+        }
     }
     return new Promise((resolve) => {
         let stdout = '';

package/dist/src/help-text.js

@@ -1,9 +1,5 @@
-import chalk from 'chalk';
+import chalk from './colors.js';
 import { getCliVersion, getPlatformTag } from './version.js';
-// The bound keys (Enter/Esc/Ctrl+C/Tab/arrows) are identical across platforms in
-// a terminal. The one thing that genuinely differs is the terminal's paste
-// shortcut, so surface the one for the host OS (right-click paste works
-// everywhere regardless).
 function pasteShortcutForPlatform() {
     switch (process.platform) {
         case 'darwin':
@@ -26,6 +22,7 @@ const HELP_MARKDOWN = [
     '',
     '- `ai` — start an interactive chat session in the current repo',
     '- `ai "<request>"` — start an interactive session with `<request>` as the first message',
+    '- Coding sessions require terminal stdin and stdout; piped prompts are not supported.',
     '',
     '## Auth',
     '',
@@ -39,8 +36,8 @@ const HELP_MARKDOWN = [
     '',
     '- `ai --list-sessions` — list saved sessions for this repo',
     '- `ai --session <id|name>` — resume a saved session by id or name',
-    '- Sessions are stored locally and scoped to the current repo. The five',
-    '  most recent sessions per repo are kept.',
+    '- Sessions are stored locally and can be listed or resumed in the same repo.',
+    '  Continuing one requires the TheGitAI account used for that session.',
     '',
     '## Options',
     '',
@@ -60,7 +57,8 @@ const HELP_MARKDOWN = [
     '## Keys & clipboard',
     '',
     '- **Enter** sends • **Shift+Tab** cycles modes • **Esc** cancels the turn •',
-    '  **Ctrl+C** quits. These are the same on macOS, Linux, and Windows.',
+    '  **Ctrl+C** clears the composer or the queued message, and quits once there',
+    '  is nothing left to clear. These are the same on macOS, Linux, and Windows.',
     `- **Paste** into the composer with your terminal's paste shortcut (\`${PASTE_SHORTCUT}\``,
     '  on this system) or by right-clicking the composer.',
     '- **Copy** from the transcript by dragging to select; double-click copies a',
@@ -77,7 +75,11 @@ const HELP_MARKDOWN = [
     '- `/model` — list supported models and pick one',
     '- `/model <id>` — switch the active model without clearing history',
     '- `/resume` — resume a saved session for this repo',
-    '- `/clear` — clear the current conversation history',
+    '- `/jobs` — manage long-running commands like dev servers and watchers:',
+    '  browse them, press Enter to expand one and read its output, k to stop it',
+    '- `/jobs output <id>` — print one job\'s full captured output',
+    '- `/jobs kill <id>` — stop one background job',
+    '- `/new` — start a new conversation; this session remains saved',
     '- `/exit` — quit the session',
     '',
     '## Safety & approvals',
@@ -89,6 +91,12 @@ const HELP_MARKDOWN = [
     '  command and keeps the password masked and local.',
     '- `-y` / `--yes` at startup auto-approves every shell command and file',
     '  edit for the whole session — use with care.',
+    '- Long-running commands (e.g. dev servers) can run as managed background',
+    '  jobs after the same approval as any other command. Background output',
+    '  stays quiet once the model has responded; the footer shows only a compact',
+    '  shell-running indicator, `/jobs` lists, inspects, and kills jobs, and',
+    '  killed jobs disappear immediately. Every job is killed when the session',
+    '  ends.',
     '- File and shell operations are confined to the target repo root.',
     '- Sensitive directories (`.git`, `node_modules`, build output) are',
     '  never indexed.',
@@ -99,12 +107,14 @@ const HELP_MARKDOWN = [
     '- Auth or permission errors → run `ai whoami` to confirm the signed-in',
     '  account.',
     '- Usage or quota errors → run `ai --usage`.',
-    '- Stuck on the wrong account → `ai logout`, then `ai login` again.',
+    '- Signed in with the wrong credentials → `ai logout`, then `ai login` with',
+    '  the account you intended to use.',
+    '- A local session was used with a different sign-in → sign in with the',
+    '  account you used for that session or start a new session.',
     '- For anything else, re-run the command and report the printed error',
     '  message — there is no client-side debug mode by design.',
 ].join('\n');
 export function formatAboutCard() {
-    // Fenced so the column alignment survives terminal markdown rendering.
     return [
         '```',
         'TheGitAI',
@@ -121,8 +131,15 @@ export function formatInteractiveHelpText() {
     return HELP_MARKDOWN;
 }
 export function formatCliHelpText({ color = false } = {}) {
-    if (!color)
-        return HELP_MARKDOWN;
+    if (!color) {
+        return HELP_MARKDOWN.split('\n')
+            .map((line) => line
+            .replace(/^#{1,6}\s+/, '')
+            .replace(/^-\s+/, '  ')
+            .replace(/`([^`]+)`/g, '$1')
+            .replace(/\*\*([^*]+)\*\*/g, '$1'))
+            .join('\n');
+    }
     return HELP_MARKDOWN.split('\n')
         .map((line) => {
         const heading = line.match(/^(#{1,6})\s+(.*)$/);

package/dist/src/patcher.js

@@ -1,8 +1,9 @@
-import chalk from 'chalk';
-import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from 'fs';
+import chalk from './colors.js';
+import { chmodSync, closeSync, constants, existsSync, fchmodSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync, } from 'fs';
 import path from 'path';
 import { createInterface } from 'readline';
 import { runCommand } from './executor.js';
+import { ensureSessionScratchDir, isInsideTheGitAiScratch, isWithinSessionScratchDir, } from './scratch-dir.js';
 import { isTuiMode } from './runtime-mode.js';
 import { truncate } from './utils.js';
 function parseUnifiedDiff(patchText) {
@@ -143,17 +144,92 @@ export function renderDiffPreview(filePath, patchText) {
 function normalizeRoot(rootDir) {
     return path.resolve(rootDir);
 }
-export function resolveProjectPath(rootDir, filePath) {
+function expandScratchPath(filePath) {
+    const match = filePath.match(/^(?:\$THEGITAI_SCRATCH_DIR|\$\{THEGITAI_SCRATCH_DIR\})(?:[\\/](.*))?$/);
+    if (!match)
+        return filePath;
+    const root = ensureSessionScratchDir();
+    return match[1] ? path.join(root, match[1]) : root;
+}
+export function classifyProjectPath(rootDir, filePath) {
     const absRoot = normalizeRoot(rootDir);
-    const absPath = path.resolve(absRoot, filePath);
+    const absPath = path.resolve(absRoot, expandScratchPath(filePath));
+    if (isWithinSessionScratchDir(absPath)) {
+        return absPath !== path.resolve(ensureSessionScratchDir()) &&
+            isInsideTheGitAiScratch(absPath)
+            ? 'scratch'
+            : 'outside';
+    }
     const relative = path.relative(absRoot, absPath);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
-        throw new Error(`Refusing to access path outside the project root: ${filePath}`);
+    if (!relative.startsWith('..') && !path.isAbsolute(relative)) {
+        return 'project';
+    }
+    return 'outside';
+}
+export function resolveProjectPath(rootDir, filePath) {
+    const absRoot = normalizeRoot(rootDir);
+    const absPath = path.resolve(absRoot, expandScratchPath(filePath));
+    if (classifyProjectPath(rootDir, filePath) === 'outside') {
+        throw new Error(`Refusing to access path outside the project root: ${filePath}. Allowed locations are the project root and the session scratch directory ($THEGITAI_SCRATCH_DIR).`);
     }
     return absPath;
 }
+function mkdirForWrite(absPath, scratchPath) {
+    const parent = path.dirname(absPath);
+    if (!scratchPath) {
+        mkdirSync(parent, { recursive: true });
+        return;
+    }
+    const scratchRoot = path.resolve(ensureSessionScratchDir());
+    const relative = path.relative(scratchRoot, parent);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Refusing to create a directory outside the session scratch root: ${parent}`);
+    }
+    let current = scratchRoot;
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            mkdirSync(current, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST')
+                throw error;
+        }
+        const stat = lstatSync(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Refusing to traverse unsafe scratch directory: ${current}`);
+        }
+        if (process.platform !== 'win32')
+            chmodSync(current, 0o700);
+    }
+}
+function writeScratchFile(absPath, content) {
+    const scratchRoot = realpathSync(ensureSessionScratchDir());
+    const parent = realpathSync(path.dirname(absPath));
+    const relativeParent = path.relative(scratchRoot, parent);
+    if (relativeParent.startsWith('..') || path.isAbsolute(relativeParent)) {
+        throw new Error(`Refusing to write through an unsafe scratch directory: ${absPath}`);
+    }
+    const verifiedPath = path.join(parent, path.basename(absPath));
+    const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+    const fd = openSync(verifiedPath, constants.O_WRONLY | constants.O_CREAT | noFollow, 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.nlink > 1) {
+            throw new Error(`Refusing to write an unsafe scratch file: ${absPath}`);
+        }
+        ftruncateSync(fd, 0);
+        if (process.platform !== 'win32')
+            fchmodSync(fd, 0o600);
+        writeFileSync(fd, content);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 export function writeProjectFile(rootDir, filePath, content) {
     const absPath = resolveProjectPath(rootDir, filePath);
+    const scratchPath = classifyProjectPath(rootDir, filePath) === 'scratch';
     if (existsSync(absPath)) {
         try {
             const existingContent = readFileSync(absPath, 'utf-8');
@@ -162,15 +238,20 @@ export function writeProjectFile(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
-    mkdirSync(path.dirname(absPath), { recursive: true });
-    writeFileSync(absPath, content, 'utf-8');
+    mkdirForWrite(absPath, scratchPath);
+    if (scratchPath) {
+        writeScratchFile(absPath, content);
+    }
+    else {
+        writeFileSync(absPath, content, 'utf-8');
+    }
     return { absPath, changed: true };
 }
 export function writeProjectFileBuffer(rootDir, filePath, content) {
     const absPath = resolveProjectPath(rootDir, filePath);
+    const scratchPath = classifyProjectPath(rootDir, filePath) === 'scratch';
     if (existsSync(absPath)) {
         try {
             const existingContent = readFileSync(absPath);
@@ -179,11 +260,15 @@ export function writeProjectFileBuffer(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
-    mkdirSync(path.dirname(absPath), { recursive: true });
-    writeFileSync(absPath, content);
+    mkdirForWrite(absPath, scratchPath);
+    if (scratchPath) {
+        writeScratchFile(absPath, content);
+    }
+    else {
+        writeFileSync(absPath, content);
+    }
     return { absPath, changed: true };
 }
 export function deleteProjectFile(rootDir, filePath) {

package/dist/src/project-index.js

@@ -39,10 +39,21 @@ function removeFile(index, relPath) {
     index.chunksByFile.delete(relPath);
     index.fileSignatures.delete(relPath);
 }
+function countIndexedChunks(index) {
+    return Array.from(index.chunksByFile.values()).reduce((sum, chunks) => sum + chunks.length, 0);
+}
 async function initializeIndex(index) {
     if (index.initialized) {
-        return Array.from(index.chunksByFile.values()).reduce((sum, chunks) => sum + chunks.length, 0);
+        return countIndexedChunks(index);
+    }
+    if (!index._initializing) {
+        index._initializing = scanProjectIntoIndex(index).finally(() => {
+            index._initializing = null;
+        });
     }
+    return index._initializing;
+}
+async function scanProjectIntoIndex(index) {
     const files = listProjectFiles(index.rootDir);
     const chunks = await scanFiles(index.rootDir, files);
     index.fileSignatures.clear();
@@ -106,6 +117,7 @@ export function createIndex({ rootDir, onStatus = null, onContextLog = null, })
     return {
         rootDir: path.resolve(rootDir),
         initialized: false,
+        _initializing: null,
         fileSignatures: new Map(),
         chunksByFile: new Map(),
         onStatus,

package/dist/src/project-orientation.js

@@ -0,0 +1,99 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readdirSync, readFileSync, } from 'node:fs';
+import path from 'node:path';
+import { shouldIgnoreArtifactPath } from './artifact-policy.js';
+const MAX_TOP_LEVEL_ENTRIES = 80;
+const MAX_DECLARED_TASKS = 40;
+const MAX_NAME_CHARS = 120;
+const MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
+function normalizeName(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value
+        .replace(/[\u0000-\u001f\u007f]/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_NAME_CHARS);
+    return normalized || null;
+}
+function normalizeNames(value, limit) {
+    if (!Array.isArray(value))
+        return [];
+    const names = [];
+    const seen = new Set();
+    for (const item of value) {
+        const name = normalizeName(item);
+        if (!name || seen.has(name))
+            continue;
+        seen.add(name);
+        names.push(name);
+        if (names.length >= limit)
+            break;
+    }
+    return names;
+}
+function readPackageTasks(rootDir) {
+    const packagePath = path.join(rootDir, 'package.json');
+    let fd = null;
+    try {
+        const pathStat = lstatSync(packagePath);
+        if (pathStat.isSymbolicLink() ||
+            !pathStat.isFile() ||
+            pathStat.nlink > 1 ||
+            pathStat.size > MAX_PACKAGE_JSON_BYTES) {
+            return [];
+        }
+        const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+        fd = openSync(packagePath, constants.O_RDONLY | noFollow);
+        const fileStat = fstatSync(fd);
+        if (!fileStat.isFile() ||
+            fileStat.nlink > 1 ||
+            fileStat.size > MAX_PACKAGE_JSON_BYTES ||
+            fileStat.dev !== pathStat.dev ||
+            fileStat.ino !== pathStat.ino) {
+            return [];
+        }
+        const parsed = JSON.parse(readFileSync(fd, 'utf8'));
+        if (!parsed?.scripts || typeof parsed.scripts !== 'object')
+            return [];
+        return normalizeNames(Object.keys(parsed.scripts), MAX_DECLARED_TASKS);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+export function normalizeProjectOrientation(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const record = value;
+    const topLevelEntries = normalizeNames(record.topLevelEntries, MAX_TOP_LEVEL_ENTRIES);
+    const packageScripts = normalizeNames(record.packageScripts, MAX_DECLARED_TASKS);
+    if (topLevelEntries.length === 0 && packageScripts.length === 0)
+        return null;
+    return {
+        topLevelEntries,
+        packageScripts,
+        truncated: record.truncated === true,
+    };
+}
+export function collectProjectOrientation(rootDir) {
+    try {
+        const entries = readdirSync(rootDir, { withFileTypes: true })
+            .filter((entry) => !shouldIgnoreArtifactPath(entry.name))
+            .sort((a, b) => a.name.localeCompare(b.name));
+        const topLevelEntries = entries
+            .slice(0, MAX_TOP_LEVEL_ENTRIES)
+            .map((entry) => `${entry.name}${entry.isDirectory() ? '/' : ''}`);
+        return normalizeProjectOrientation({
+            topLevelEntries,
+            packageScripts: readPackageTasks(rootDir),
+            truncated: entries.length > MAX_TOP_LEVEL_ENTRIES,
+        });
+    }
+    catch {
+        return null;
+    }
+}

package/dist/src/scanner.js

@@ -1,14 +1,12 @@
 import { execSync } from 'child_process';
-import { readFileSync, statSync } from 'fs';
-import { glob } from 'glob';
+import { readdirSync, readFileSync, statSync } from 'fs';
 import path from 'path';
 import { getNodePrimarySignature, getStructuralChildren, parseRepoSource, } from './tree-sitter-runtime.js';
-import { ARTIFACT_FALLBACK_IGNORE_GLOBS, ARTIFACT_IGNORE_DIRS, ARTIFACT_IGNORE_FILES, ARTIFACT_INSPECT_BLOCK_DIRS, BINARY_ARTIFACT_EXTENSIONS, isSensitiveProjectPath, shouldIgnoreArtifactPath, } from './artifact-policy.js';
+import { ARTIFACT_IGNORE_DIRS, ARTIFACT_IGNORE_FILES, ARTIFACT_INSPECT_BLOCK_DIRS, BINARY_ARTIFACT_EXTENSIONS, isSensitiveProjectPath, shouldIgnoreArtifactPath, } from './artifact-policy.js';
 const BINARY_EXTENSIONS = BINARY_ARTIFACT_EXTENSIONS;
 const ALWAYS_IGNORE_FILES = ARTIFACT_IGNORE_FILES;
 export const ALWAYS_IGNORE_DIRS = ARTIFACT_IGNORE_DIRS;
 export const BLOCKED_PATH_INSPECT_DIRS = ARTIFACT_INSPECT_BLOCK_DIRS;
-const FALLBACK_IGNORE = ARTIFACT_FALLBACK_IGNORE_GLOBS;
 export const SCANNER_MAX_SOURCE_FILE_BYTES = 100 * 1024;
 const MAX_FILE_SIZE = SCANNER_MAX_SOURCE_FILE_BYTES;
 const MAX_CHUNKS = 2000;
@@ -29,16 +27,56 @@ function getFiles(rootDir, { limit = Infinity } = {}) {
         return Number.isFinite(limit) ? files.slice(0, limit) : files;
     }
     catch {
-        return glob
-            .sync('**/*', {
-            cwd: rootDir,
-            nodir: true,
-            dot: false,
-            ignore: FALLBACK_IGNORE,
-        })
-            .slice(0, Number.isFinite(limit) ? limit : undefined);
+        return walkProjectFilesFallback(rootDir, Number.isFinite(limit) ? limit : Infinity);
     }
 }
+const FALLBACK_LOCKFILES = new Set([
+    'package-lock.json',
+    'yarn.lock',
+    'pnpm-lock.yaml',
+]);
+function isFallbackIgnoredFile(relPath, fileName) {
+    if (shouldIgnorePath(relPath))
+        return true;
+    if (fileName.endsWith('.lock'))
+        return true;
+    return FALLBACK_LOCKFILES.has(fileName);
+}
+function walkProjectFilesFallback(rootDir, limit) {
+    const results = [];
+    const visit = (relDir) => {
+        if (results.length >= limit)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(path.join(rootDir, relDir), {
+                withFileTypes: true,
+            });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (results.length >= limit)
+                return;
+            const name = entry.name;
+            if (name.startsWith('.'))
+                continue;
+            const relPath = relDir ? `${relDir}/${name}` : name;
+            if (entry.isDirectory()) {
+                if (ALWAYS_IGNORE_DIRS.has(name) || shouldIgnoreArtifactPath(relPath)) {
+                    continue;
+                }
+                visit(relPath);
+            }
+            else if (entry.isFile() && !isFallbackIgnoredFile(relPath, name)) {
+                results.push(relPath);
+            }
+        }
+    };
+    visit('');
+    return results;
+}
 function shouldSkipFile(relPath, stat) {
     if (shouldIgnorePath(relPath))
         return true;