@vzn/vx 0.0.651 → 0.0.653

package/src/util/config-frame.ts

@@ -13,6 +13,19 @@ import path from 'node:path'
 const HEAD =
   /^(\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s)(?:: (?:(tasks\.[^\s:]+)(:?)|`([^`\n]+)`|task name ("(?:[^"\\\n]|\\.)*")))? /
 
+/**
+ * A quoted name as the source spells it. A glob refusal quotes the glob
+ * raw, so `"app/\\[id\\]"` is no JSON string: parsed alone, vx lock crashed
+ * on it in place of the refusal.
+ */
+function unquote(quoted: string): string {
+  try {
+    return JSON.parse(quoted) as string
+  } catch {
+    return quoted.slice(1, -1)
+  }
+}
+
 /**
  * The message with its file named at `line:col`, relative to `cwd`, and a
  * frame of the source under it; undefined when the message names no
@@ -32,11 +45,25 @@ export function configErrorFrame(message: string, cwd: string): string | undefin
   const rest = message.slice(head[0].length)
   // The field the refusal is about, past the path that leads to it:
   // `has unknown field "comand"`, or `tasks.build: \`cache\` is not allowed`.
-  const named =
-    colon === ':' ? /^`([^`]+)`/.exec(rest) : /^has (?:unknown )?field "([^"]+)"/.exec(rest)
+  // A refused key is quoted: `tasks.b.exec.env.define: "A=B" is not …`.
+  const said =
+    colon === ':'
+      ? /^(?:`([^`]+)`|("(?:[^"\\\n]|\\.)*"))/.exec(rest)
+      : /^has (?:unknown )?field "([^"]+)"/.exec(rest)
+  const named = said === null ? null : [said[0], said[1] ?? unquote(said[2]!)]
+  // `plugins[2].name`: an element of an array, framed at the element (a
+  // plugin is a call, so no key inside it is searched).
+  const element = setting === undefined ? null : /^([^[]+)\[(\d+)\]/.exec(setting)
   const fieldPath =
-    taskName === undefined ? (tasksPath ?? setting)?.split('.') : ['tasks', JSON.parse(taskName)]
-  const segments = [...(fieldPath ?? []), ...(named === null ? [] : [named[1]!])]
+    taskName !== undefined
+      ? ['tasks', unquote(taskName)]
+      : element !== null
+        ? element[1]!.split('.')
+        : (tasksPath ?? setting)?.split('.')
+  const segments = [
+    ...(fieldPath ?? []),
+    ...(named === null || element !== null ? [] : [named[1]!]),
+  ]
   if (segments.length === 0) return undefined
   let source: string
   try {
@@ -44,7 +71,7 @@ export function configErrorFrame(message: string, cwd: string): string | undefin
   } catch {
     return undefined
   }
-  const at = locate(source, segments)
+  const at = locate(source, segments, element === null ? undefined : Number(element[2]))
   if (at === undefined) return undefined
   return framed(file, source, at, message.slice(file.length), cwd)
 }
@@ -54,8 +81,71 @@ export function configErrorFrame(message: string, cwd: string): string | undefin
 const POSITION =
   /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s):(\d+):(\d+)(: [^]*)$/
 
+// The loader's `Project config <file> threw: <message> (at <file>:<line>:<col>)`:
+// the config's own throw, placed by its stack in the config itself.
+const THREW =
+  /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s) threw: ([^\n]*?) \(at (\/[^\n]*?):(\d+):(\d+)\)([^]*)$/
+
+// The loader's `<kind> config <file>: cannot find '<pkg>' …`: placed at the
+// specifier. And `<kind> config at <file> did not export a default object`:
+// at the `export default` that exported something else, when there is one.
+const UNPROVIDED =
+  /^(?:Project|Workspace) config (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s): (cannot find '([^'\n]+)'[^]*)$/
+const NOT_OBJECT =
+  /^(?:Project|Workspace) config at (\/[^\n]*?\/(?:vx\.config|\.vx\/workspace)\.[cm]?[jt]s) (did not export a default object[^]*)$/
+
+/** The file, the source offset `find` places in it, and what follows `<file>:<line>:<col>`. */
+function sourceFrame(
+  file: string,
+  find: (source: string) => number,
+  rest: string,
+  cwd: string,
+): string | undefined {
+  let source: string
+  try {
+    source = readFileSync(file, 'utf8')
+  } catch {
+    return undefined
+  }
+  const at = find(source)
+  if (at < 0) return undefined
+  const before = source.slice(0, at)
+  const line = before.split('\n').length
+  return framed(file, source, { line, col: at - before.lastIndexOf('\n') }, rest, cwd)
+}
+
 function positionFrame(message: string, cwd: string): string | undefined {
-  const pos = POSITION.exec(message)
+  const unprovided = UNPROVIDED.exec(message)
+  if (unprovided !== null) {
+    const [, file, said, pkg] = unprovided as unknown as [string, string, string, string]
+    const spec = new RegExp(
+      `(?<=\\b(?:from|import|import\\(|require\\()\\s*)(['"])${escapeRe(pkg)}\\1`,
+    )
+    return sourceFrame(file, (src) => spec.exec(src)?.index ?? -1, `: ${said}`, cwd)
+  }
+  const notObject = NOT_OBJECT.exec(message)
+  if (notObject !== null) {
+    const [, file, said] = notObject as unknown as [string, string, string]
+    return sourceFrame(
+      file,
+      // No default: at the named export written instead, when there is one.
+      (src) => (/^export\s+default\b/m.exec(src) ?? /^export\b/m.exec(src))?.index ?? -1,
+      `: ${said}`,
+      cwd,
+    )
+  }
+  const threw = THREW.exec(message)
+  const pos =
+    threw !== null && threw[3] === threw[1]
+      ? [
+          threw[0],
+          threw[1],
+          threw[4],
+          threw[5],
+          // A cause's own `(at …)` names the same file: relative there too.
+          `: threw: ${threw[2]}${threw[6]!.replaceAll(threw[1]!, path.relative(cwd, threw[1]!))}`,
+        ]
+      : POSITION.exec(message)
   if (pos === null) return undefined
   const [, file, line, col, rest] = pos as unknown as [string, string, string, string, string]
   let source: string
@@ -105,6 +195,8 @@ function framed(
 function locate(
   source: string,
   segments: readonly string[],
+  /** The element of the array the last segment holds; past its end, the key. */
+  index?: number,
 ): { line: number; col: number } | undefined {
   let pos = 0
   let end = source.length
@@ -137,6 +229,10 @@ function locate(
     i = next
   }
   if (found < 0) return undefined
+  if (index !== undefined && i === segments.length) {
+    const el = elementStart(source, pos, index)
+    if (el !== undefined) found = el
+  }
   const before = source.slice(0, found)
   const line = before.split('\n').length
   return { line, col: found - before.lastIndexOf('\n') }
@@ -172,6 +268,46 @@ function literalEnd(source: string, from: number): number {
   return source.length
 }
 
+/** Where element `index` of the array literal at `from` (past blanks) starts, if it has one. */
+function elementStart(source: string, from: number, index: number): number | undefined {
+  let i = from
+  while (i < source.length && /\s/.test(source[i]!)) i++
+  if (source[i] !== '[') return undefined
+  let depth = 0
+  let n = 0
+  // Each element starts at the first code past `[` or a top-level `,`.
+  let pending = true
+  for (i++; i < source.length; i++) {
+    const c = source[i]!
+    if (c === '/' && source[i + 1] === '/') {
+      i = source.indexOf('\n', i)
+      if (i < 0) return undefined
+      continue
+    }
+    if (c === '/' && source[i + 1] === '*') {
+      i = source.indexOf('*/', i + 2)
+      if (i < 0) return undefined
+      i++
+      continue
+    }
+    if (/\s/.test(c)) continue
+    if (depth === 0 && (c === ']' || c === ')' || c === '}')) return undefined
+    if (pending) {
+      if (n === index) return i
+      pending = false
+    }
+    if (c === '"' || c === "'" || c === '`') {
+      for (i++; i < source.length && source[i] !== c; i++) if (source[i] === '\\') i++
+    } else if (c === '{' || c === '[' || c === '(') depth++
+    else if (c === '}' || c === ']' || c === ')') depth--
+    else if (c === ',' && depth === 0) {
+      n++
+      pending = true
+    }
+  }
+  return undefined
+}
+
 function escapeRe(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }

package/src/util/edit-distance.ts

@@ -85,11 +85,27 @@ export function nearMatches(name: string, candidates: Iterable<string>, limit =
     if (out.length >= limit) break
     if (out.includes(c)) continue
     const n = c.toLowerCase()
-    if (n.includes(q) || q.includes(n)) out.push(c)
+    if (n.includes(q) || wordIn(q, n)) out.push(c)
   }
   return out.slice(0, limit)
 }
 
+/**
+ * `name` stands in `query` as a whole word (`build` in `build-and-test`):
+ * a bare substring offered `ui` for `guide` and `a` for anything.
+ */
+function wordIn(query: string, name: string): boolean {
+  for (let i = query.indexOf(name); i !== -1; i = query.indexOf(name, i + 1)) {
+    const end = i + name.length
+    if (
+      (i === 0 || !/[a-z0-9]/.test(query[i - 1]!)) &&
+      (end === query.length || !/[a-z0-9]/.test(query[end]!))
+    )
+      return true
+  }
+  return false
+}
+
 /**
  * The names to offer when no one name is near: sorted, the first `limit`,
  * then a count. A typo past two edits named nothing to pick from (M-56).

package/src/util/errors.ts

@@ -86,16 +86,22 @@ export function errorCode(err: unknown): string {
  * Does this argv ask for JSON (`--format json`, `--format=json`,
  * `--dry=json`)? Then a refusal is a JSON document on stdout too, so a
  * reader of stdout gets an answer, not nothing. Args after `--` are the
- * task's, not vx's.
+ * task's, not vx's. Each flag's LAST value counts, as every verb's parser
+ * keeps it: `--format json --format pretty` prints pretty. `--dry` alone is
+ * run's pretty plan, and a switch beside `--format` elsewhere.
  */
 export function wantsJson(argv: readonly string[]): boolean {
+  let format: string | undefined
+  let dry: string | undefined
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!
-    if (a === '--') return false
-    if (a === '--format=json' || a === '--dry=json') return true
-    if (a === '--format' && argv[i + 1] === 'json') return true
+    if (a === '--') break
+    if (a === '--format') format = argv[++i]
+    else if (a.startsWith('--format=')) format = a.slice('--format='.length)
+    else if (a === '--dry') dry = 'pretty'
+    else if (a.startsWith('--dry=')) dry = a.slice('--dry='.length)
   }
-  return false
+  return format === 'json' || dry === 'json'
 }
 
 /**
@@ -185,9 +191,18 @@ export function isOutOfFds(err: unknown): err is NodeJS.ErrnoException {
 export const OUT_OF_FDS_HINT =
   'the process is out of file descriptors; raise the limit (ulimit -n 4096) and re-run'
 
-/** A file system refusing a write for a reason no code path caused: permission or space. */
+/**
+ * `ENAMETOOLONG`: a path past what the file system takes (PATH_MAX, 4096
+ * bytes on Linux; NAME_MAX for one name). The path is the user's: an
+ * output that deep failed its save as an internal error.
+ */
+function isNameTooLong(err: unknown): err is NodeJS.ErrnoException {
+  return err instanceof Error && (err as NodeJS.ErrnoException).code === 'ENAMETOOLONG'
+}
+
+/** A file system refusing a path for a reason no code path caused: permission, space or length. */
 export function isFsRefusal(err: unknown): err is NodeJS.ErrnoException {
-  return isPermissionError(err) || isDiskFull(err)
+  return isPermissionError(err) || isDiskFull(err) || isNameTooLong(err)
 }
 
 export const DISK_FULL_HINT = 'the disk that path is on is full'
@@ -205,6 +220,7 @@ const READ_SYSCALLS = new Set(['scandir', 'stat', 'lstat', 'readlink', 'read', '
 export function fsRefusalHint(err: NodeJS.ErrnoException): string {
   const { syscall } = err
   if (isDiskFull(err)) return DISK_FULL_HINT
+  if (isNameTooLong(err)) return 'that path is longer than the file system allows; shorten it'
   // A listing told to be a write sent the user to chmod the wrong thing.
   return READ_SYSCALLS.has(syscall ?? '') ? READ_PERMISSION_HINT : PERMISSION_HINT
 }

package/src/util/foreign-cache-dir.ts

@@ -0,0 +1,60 @@
+import { existsSync, realpathSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import path from 'node:path'
+import { UserError } from './errors.js'
+
+export const OWN_DIR_HINT =
+  'Point `cache.dir` in .vx/workspace.ts (or --cache-dir) at a directory of its own, such as .vx/cache.'
+
+/** Cache directories this process already found to be vx's own, with the workspace root asked for. */
+const passed = new Set<string>()
+
+/**
+ * Refuses a cache directory that resolves to the home directory, the file
+ * system root, or a directory holding the workspace or a repository:
+ * compared unresolved, a `.vx/cache` linked to `~` or `..` passed, the run
+ * wrote its index and config bundle there, and `vx cache clean` deleted
+ * every entry (the home directory; the workspace's `.git` and config). The
+ * config bundle asks first and the cache's open again: one realpath, as a
+ * pass is kept for the process; a refusal is decided afresh each time. A
+ * directory not there yet is made as named, by its caller.
+ */
+export function refuseForeignCacheDir(cacheDir: string, workspaceRoot: string | undefined): void {
+  const memo = `${path.resolve(cacheDir)}\0${workspaceRoot ?? ''}`
+  if (passed.has(memo)) return
+  let real: string
+  try {
+    real = realpathSync(cacheDir)
+  } catch {
+    return
+  }
+  const home = process.env['HOME'] || homedir()
+  let what: string | undefined
+  if (real === path.parse(real).root) what = 'the file system root'
+  else if (sameDir(real, home)) what = 'the home directory'
+  else if (
+    (workspaceRoot !== undefined && !path.relative(real, workspaceRoot).startsWith('..')) ||
+    existsSync(path.join(real, '.git'))
+  )
+    what = 'a directory holding the workspace or a repository'
+  if (what === undefined) {
+    passed.add(memo)
+    return
+  }
+  throw new UserError(
+    `cache directory ${cacheDir} resolves to ${real}, ${what}: vx would keep its index there and \`vx cache clean\` would delete from it. ${OWN_DIR_HINT}`,
+    'VX_E_CONFIG',
+  )
+}
+
+function sameDir(a: string, b: string): boolean {
+  if (a === path.resolve(b)) return true
+  // A home named through a link: stats only when the names could agree.
+  if (path.basename(a) !== path.basename(b)) return false
+  try {
+    const [x, y] = [statSync(a), statSync(b)]
+    return x.ino === y.ino && x.dev === y.dev
+  } catch {
+    return false
+  }
+}

package/src/util/git-ignored.ts

@@ -4,6 +4,8 @@
 // knows every rule source (nested files, `info/exclude`, `core.excludesFile`)
 // and that a directory holding a tracked file is not ignored.
 
+import { existsSync } from 'node:fs'
+import path from 'node:path'
 import { gitEnv } from './hide-env.js'
 import { isLiteralPattern, normalizeGlob } from './paths.js'
 import { executablePath } from './which.js'
@@ -37,6 +39,56 @@ export function ignoreProbes(glob: string): { paths: string[]; deep: boolean; di
 
 const CHECK_IGNORE = ['check-ignore', '--stdin', '-z']
 
+/**
+ * Per directory git runs in, whether its `core.ignorecase=true` is false on
+ * disk: a `.git` copied from macOS to Linux keeps the setting, and git then
+ * takes a new `a.txt` beside the tracked `A.txt` for the tracked file and
+ * lists it nowhere. Asked only where git's config was read anyway.
+ */
+const caseLies = new Map<string, boolean>()
+
+/**
+ * Whether `core.ignorecase=true`, which git in `dir` reported, is false on
+ * disk: one stat of `probe` (an existing path) with its name's case
+ * swapped, once per `dir`. A name with no cased letter cannot tell, so git
+ * is trusted.
+ */
+export function ignoreCaseLies(dir: string, probe: string): boolean {
+  const at = path.resolve(dir)
+  let lies = caseLies.get(at)
+  if (lies === undefined) {
+    const name = path.basename(probe)
+    const lower = name.toLowerCase()
+    const twin = lower === name ? name.toUpperCase() : lower
+    lies = twin !== name && !existsSync(path.join(path.dirname(probe), twin))
+    caseLies.set(at, lies)
+  }
+  return lies
+}
+
+/**
+ * What a git spawn in `cwd` prepends so a wrong `core.ignorecase` hides no
+ * file: `-c core.ignorecase=false` at or under a directory `ignoreCaseLies`
+ * found lying (the disk there tells case apart, so the override is git's
+ * own answer for any repository on it), else nothing.
+ */
+export function gitCaseArgs(cwd: string): readonly string[] {
+  if (caseLies.size === 0) return []
+  const at = path.resolve(cwd)
+  for (const [dir, lies] of caseLies)
+    if (lies && (at === dir || at.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)))
+      return CASE_SENSITIVE
+  return []
+}
+
+const CASE_SENSITIVE = ['-c', 'core.ignorecase=false']
+
+// git reads each line as a pathspec, so `:top/dist/` was asked as
+// `top/dist/`. `./` keeps it the path it is (this command refuses
+// `:(literal)`), and git echoes each path back as given.
+const stdinOf = (paths: readonly string[]): Buffer =>
+  Buffer.from(paths.map((p) => `./${p}\0`).join(''))
+
 function ignoredOf(exitCode: number, stdout: Uint8Array): Set<string> | null {
   // 0: some ignored; 1: none; anything else (no work tree): undecided.
   if (exitCode === 1) return new Set()
@@ -45,7 +97,8 @@ function ignoredOf(exitCode: number, stdout: Uint8Array): Set<string> | null {
     new TextDecoder()
       .decode(stdout)
       .split('\0')
-      .filter((p) => p !== ''),
+      .filter((p) => p !== '')
+      .map((p) => p.slice(2)),
   )
 }
 
@@ -57,10 +110,10 @@ export async function checkIgnore(
   if (paths.length === 0) return new Set()
   try {
     const proc = Bun.spawn({
-      cmd: [executablePath('git'), ...CHECK_IGNORE],
+      cmd: [executablePath('git'), ...gitCaseArgs(cwd), ...CHECK_IGNORE],
       env: gitEnv(),
       cwd,
-      stdin: Buffer.from(paths.map((p) => `${p}\0`).join('')),
+      stdin: stdinOf(paths),
       stdout: 'pipe',
       stderr: 'ignore',
     })
@@ -76,10 +129,10 @@ export function checkIgnoreSync(cwd: string, paths: readonly string[]): Set<stri
   if (paths.length === 0) return new Set()
   try {
     const r = Bun.spawnSync({
-      cmd: [executablePath('git'), ...CHECK_IGNORE],
+      cmd: [executablePath('git'), ...gitCaseArgs(cwd), ...CHECK_IGNORE],
       env: gitEnv(),
       cwd,
-      stdin: Buffer.from(paths.map((p) => `${p}\0`).join('')),
+      stdin: stdinOf(paths),
       stdout: 'pipe',
       stderr: 'ignore',
     })
@@ -99,6 +152,7 @@ export function listedSync(cwd: string, dirs: readonly string[]): string[] | nul
     const r = Bun.spawnSync({
       cmd: [
         executablePath('git'),
+        ...gitCaseArgs(cwd),
         'ls-files',
         '-z',
         '--cached',

package/src/util/index.ts

@@ -75,6 +75,7 @@ export {
   dieOf,
   exitClaimedBySignal,
   killGraceMs,
+  POST_EXIT_DRAIN_MS,
   settleWithin,
   teardownTimeoutMs,
   testTimerMs,
@@ -101,18 +102,30 @@ export { gitEnv, helperEnv, hideEnvFromTasks } from './hide-env.js'
 export {
   checkIgnore,
   checkIgnoreSync,
+  gitCaseArgs,
+  ignoreCaseLies,
   ignoreProbes,
   listedSync,
   wholeIgnored,
 } from './git-ignored.js'
+export { OWN_DIR_HINT, refuseForeignCacheDir } from './foreign-cache-dir.js'
 export { realPath, realpathOf } from './real-path.js'
-export { IGNORE_ALL, ignoreDir, refuseSymlink, writeNoFollow } from './write-file.js'
+export {
+  IGNORE_ALL,
+  ignoreDir,
+  type PendingWrite,
+  refuseSymlink,
+  writeAllOrNone,
+  writeNoFollow,
+} from './write-file.js'
 export {
   heldSecrets,
+  holdSecret,
   maskedCommand,
   maskedStreams,
   maskedLine,
   MASKED,
+  maskStreams,
   secretMask,
   secretNamed,
   type SecretMask,
@@ -134,3 +147,4 @@ export {
   parseDependencySpec,
   type DependencySpec,
 } from './dependency-spec.js'
+export { stripEscapes } from './plain-text.js'

package/src/util/paths.ts

@@ -202,7 +202,7 @@ export function isLiteralPattern(glob: string): boolean {
 }
 
 /**
- * The alphabet of a TASK glob (`inputs.files`, `cache.outputs.files`,
+ * The alphabet of a TASK glob (`inputs.files`, `outputs.files`,
  * `workspaceFiles`), behind {@link isLiteralPattern}, for the callers that
  * need the POSITION of the first wildcard rather than a verdict. Every site
  * that asks "must this declaration be matched?" reads this one regex: item
@@ -306,13 +306,50 @@ function compileAnyTaskGlob(rawPatterns: readonly string[]): (rel: string) => bo
   if (patterns.length === 0) return () => false
   const sources = patterns.map(regExpSource)
   const globs = patterns.map(taskGlob)
-  if (sources.every((r) => r !== null)) {
-    const re = new RegExp(`^(?:${sources.join('|')})$`, 'u')
+  if (!sources.every((r) => r !== null)) return (rel) => globs.some((g) => g.match(rel))
+  // Each `**/` alternative opened with its own prefix, retried at every
+  // slash of the path: 1000 `**/fileN.ts` globs took 24 s over 200,000
+  // paths. One shared prefix before their alternation takes 50 ms.
+  const deep: string[] = []
+  const rest: string[] = []
+  for (const s of sources as string[]) {
+    if (s.startsWith(LEADING_GLOBSTAR)) deep.push(s.slice(LEADING_GLOBSTAR.length))
+    else rest.push(s)
+  }
+  const res = alternations(rest)
+  for (let i = 0; i < deep.length; i += ALTERNATIVES_PER_REGEXP) {
+    const part = deep.slice(i, i + ALTERNATIVES_PER_REGEXP)
+    res.push(new RegExp(`^${LEADING_GLOBSTAR}(?:${part.join('|')})$`, 'u'))
+  }
+  if (res.length === 1) {
+    const re = res[0]!
     return (rel) => (rel.endsWith('/') ? globs.some((g) => g.match(rel)) : re.test(rel))
   }
-  return (rel) => globs.some((g) => g.match(rel))
+  return (rel) =>
+    rel.endsWith('/') ? globs.some((g) => g.match(rel)) : res.some((re) => re.test(rel))
+}
+
+/**
+ * Alternatives per compiled RegExp. Bun's engine falls off a cliff past a
+ * few thousand: over 200k paths, 2000 literal-file alternatives took 32 ms,
+ * 4000 took 482 ms and 8000 took 15 s, so a project listing 4000 files in
+ * `inputs.files` paid that on every key. Below the cliff, the cost of
+ * splitting is flat.
+ */
+const ALTERNATIVES_PER_REGEXP = 1000
+
+function alternations(sources: readonly string[]): RegExp[] {
+  const out: RegExp[] = []
+  for (let i = 0; i < sources.length; i += ALTERNATIVES_PER_REGEXP) {
+    const part = sources.slice(i, i + ALTERNATIVES_PER_REGEXP)
+    out.push(new RegExp(`^(?:${part.join('|')})$`, 'u'))
+  }
+  return out
 }
 
+/** What {@link regExpSource} writes for a leading `**` segment. */
+const LEADING_GLOBSTAR = '(?:[^]*/)?'
+
 const REGEXP_SYNTAX = /[\\^$.*+?()[\]{}|]/g
 
 /**
@@ -336,7 +373,7 @@ function regExpSource(pattern: string): string | null {
       // more names (`src/**` does not match `src`).
       if (segments.length === 1) out += '[^]*'
       else if (last) out += '/[^]+'
-      else out += i === 0 ? '(?:[^]*/)?' : '/(?:[^]*/)?'
+      else out += i === 0 ? LEADING_GLOBSTAR : `/${LEADING_GLOBSTAR}`
       continue
     }
     if (seg === '' || seg === '.' || seg === '..' || seg.includes('**')) return null
@@ -535,9 +572,15 @@ function classEnd(pattern: string, i: number): number {
   return end === -1 ? i : end
 }
 
+// A `\x` is one character to both scans: it opens, closes and cuts nothing,
+// and stays in its alternative for the glob to read. Expansion turned off
+// at any escape, `{src,app/\[id\]}` named neither tree.
 function expandBraces(pattern: string, slashOnly: boolean): string[] {
-  if (pattern.includes('\\')) return [pattern]
   for (let open = 0; open < pattern.length; open++) {
+    if (pattern[open] === '\\') {
+      open++
+      continue
+    }
     if (pattern[open] === '[') {
       open = classEnd(pattern, open)
       continue
@@ -548,7 +591,8 @@ function expandBraces(pattern: string, slashOnly: boolean): string[] {
     let close = -1
     for (let i = open; i < pattern.length && close === -1; i++) {
       const c = pattern[i]
-      if (c === '[') i = classEnd(pattern, i)
+      if (c === '\\') i++
+      else if (c === '[') i = classEnd(pattern, i)
       else if (c === '{') depth++
       else if (c === '}' && --depth === 0) close = i
       else if (c === ',' && depth === 1) cuts.push(i)

package/src/util/plain-text.ts

@@ -0,0 +1,19 @@
+// A string escape (OSC, DCS, SOS, PM, APC) through its terminator, or to the
+// line's end when it has none: Bun.stripANSI drops an unterminated one with
+// everything after it, so a stray title escape ate the failure reason
+// printed below it. An ESC that is not ST ends it too and is left for
+// Bun.stripANSI, as a terminal aborts the string there. C1 openers are not
+// looked for: output is decoded UTF-8, where an 8-bit C1 byte reads as
+// U+FFFD, and scanning for them doubled the cost on non-Latin-1 text.
+// eslint-disable-next-line no-control-regex -- ESC is the point
+const STRING_OPENER = /\x1b[\]P_^X]/
+// eslint-disable-next-line no-control-regex -- ESC is the point
+const STRING_ESCAPE = /\x1b[\]P_^X][^\x07\x1b\x9c\n]*(?:\x07|\x1b\\|\x9c)?/g
+
+/** `text` without terminal escapes, never losing a line to an unterminated one. */
+export function stripEscapes(text: string): string {
+  // Tested first, after the cheaper ESC search: the replace alone cost half
+  // again as much on coloured text, the regex alone 3x on plain text.
+  if (text.indexOf('\x1b') === -1 || !STRING_OPENER.test(text)) return Bun.stripANSI(text)
+  return Bun.stripANSI(text.replace(STRING_ESCAPE, ''))
+}