@warlock.js/ai-workspace 5.45.0 → 5.47.0

package/cjs/index.cjs

@@ -2147,6 +2147,53 @@ var Refusal = class extends Error {
 		this.refusedPath = refusedPath;
 	}
 };
+/**
+* The first word of `command` that has an unquoted backslash before a
+* letter, digit or dot inside it (a Windows-style path bash reads as
+* escapes), with the same word spelled with forward slashes. Quoted text
+* and `\ ` style escapes (a backslash before a space, quote, `$` and the
+* like) are left alone.
+*/
+function findWindowsStylePath(command) {
+	let quote = null;
+	let start = 0;
+	let found = false;
+	let suggestion = "";
+	const finish = (end) => found ? {
+		word: command.slice(start, end),
+		suggestion
+	} : null;
+	for (let index = 0; index < command.length; index++) {
+		const char = command[index];
+		if (quote === null && /[\s;&|<>()]/.test(char)) {
+			const hit = finish(index);
+			if (hit !== null) return hit;
+			start = index + 1;
+			found = false;
+			suggestion = "";
+			continue;
+		}
+		if (quote === "'") {
+			suggestion += char;
+			quote = char === "'" ? null : quote;
+			continue;
+		}
+		if (char === "\\") {
+			const next = command[index + 1] ?? "";
+			if (quote === null && index > start && /[A-Za-z0-9.]/.test(next)) {
+				found = true;
+				suggestion += "/";
+				continue;
+			}
+			suggestion += char + next;
+			index++;
+			continue;
+		}
+		if (char === "\"" || char === "'") quote = quote === null ? char : quote === char ? null : quote;
+		suggestion += char;
+	}
+	return finish(command.length);
+}
 /** Per-line checker state. */
 var LineChecker = class {
 	constructor(policy, shell, line, dialect, interpreter, remembered = []) {
@@ -2636,9 +2683,14 @@ function checkSimpleCommand(checker, simple, cwds, dialect) {
 */
 function checkShellCommand(policy, command, options) {
 	const resolved = options?.resolved ?? resolveShell(policy.shell, options?.host ?? currentShellHost());
-	return runCheck(policy, command, resolved.interpreter, resolved.dialect, options?.remembered);
+	return runCheck(policy, command, resolved.interpreter, resolved.dialect, options?.remembered, options?.platform ?? options?.host?.platform ?? process.platform);
 }
-function runCheck(policy, command, interpreter, dialect, remembered) {
+/** Bash on Windows reads `ab\\x` as an escape, not a path: refuse and show the forward-slash form. */
+function refuseWindowsStylePath(command) {
+	const hit = findWindowsStylePath(command);
+	if (hit !== null) throw new Refusal("unsupported-syntax", `\`${hit.word}\` uses Windows-style backslashes, which bash reads as escapes and so runs a different path. Write the path with forward slashes: \`${hit.suggestion}\` (or quote it).`);
+}
+function runCheck(policy, command, interpreter, dialect, remembered, platform = process.platform) {
 	const shell = policy.shell;
 	if (!shell) return {
 		allowed: false,
@@ -2652,8 +2704,10 @@ function runCheck(policy, command, interpreter, dialect, remembered) {
 	const checker = new LineChecker(policy, shell, command, shellMode ? dialect : "posix", interpreter, remembered);
 	try {
 		if (command.trim() === "") throw new Refusal("not-allowed", "The command is empty.");
-		if (shellMode) checkShellLine(checker, policy, command, dialect);
-		else {
+		if (shellMode) {
+			if (interpreter === "bash" && platform === "win32") refuseWindowsStylePath(command);
+			checkShellLine(checker, policy, command, dialect);
+		} else {
 			const argv = tokenizeCommand(command);
 			if (argv === null) throw argvModeRefusal(command);
 			checker.checkArgv(argv, argv.map(() => false), 0);
@@ -3667,6 +3721,117 @@ async function runAfterEdit(policy, event) {
 	}
 }
 
+//#endregion
+//#region ../../packages/ai-workspace/src/hooks/shell-output.ts
+/** Shortest gap between two deliveries to the hook (about 20 a second). */
+const MIN_INTERVAL_MS = 50;
+/** A line this long without a newline is delivered anyway (minus the tail kept back). */
+const MAX_PENDING_CHARS = 16384;
+/** Characters of an over-long line held back, so a secret on the cut is still whole next time. */
+const HOLD_BACK_CHARS = 512;
+/** Shortest `shell.env` value masked automatically. */
+const MIN_SECRET_LENGTH = 8;
+/**
+* Feeds a command's output to `hooks.onShellOutput`.
+*
+* Redaction needs a whole secret in one piece, and a process writes in
+* arbitrary pieces, so output is buffered to line boundaries before it is
+* redacted and delivered; the unfinished last line waits until its newline
+* arrives or the command ends (an over-long line is cut, keeping its last
+* characters back). Deliveries are merged to at most one per
+* {@link MIN_INTERVAL_MS} and the hook can never throw into the command.
+*/
+var ShellOutputStreamer = class ShellOutputStreamer {
+	constructor(hooks, source, env) {
+		this.hooks = hooks;
+		this.source = source;
+		this.received = false;
+		this.pending = {
+			stdout: "",
+			stderr: ""
+		};
+		this.ready = {
+			stdout: "",
+			stderr: ""
+		};
+		this.lastEmit = 0;
+		this.ended = false;
+		this.secrets = Object.values(env ?? {}).filter((value) => value.length >= MIN_SECRET_LENGTH).sort((a, b) => b.length - a.length);
+	}
+	/** A streamer when the policy has `onShellOutput`, otherwise `undefined`. */
+	static create(hooks, source, env) {
+		return hooks?.onShellOutput === void 0 ? void 0 : new ShellOutputStreamer(hooks, source, env);
+	}
+	/** Add decoded output of one stream. */
+	push(stream, text) {
+		if (this.ended || text === "") return;
+		this.received = true;
+		let pending = this.pending[stream] + text;
+		const newline = pending.lastIndexOf("\n");
+		if (newline >= 0) {
+			this.ready[stream] += pending.slice(0, newline + 1);
+			pending = pending.slice(newline + 1);
+		}
+		if (pending.length > MAX_PENDING_CHARS) {
+			this.ready[stream] += pending.slice(0, pending.length - HOLD_BACK_CHARS);
+			pending = pending.slice(pending.length - HOLD_BACK_CHARS);
+		}
+		this.pending[stream] = pending;
+		this.schedule();
+	}
+	/** Deliver everything left, including unfinished lines, and stop. */
+	end() {
+		if (this.ended) return;
+		for (const stream of ["stdout", "stderr"]) {
+			this.ready[stream] += this.pending[stream];
+			this.pending[stream] = "";
+		}
+		this.clearTimer();
+		this.flush();
+		this.ended = true;
+	}
+	schedule() {
+		if (this.timer !== void 0) return;
+		const wait = Math.max(0, this.lastEmit + MIN_INTERVAL_MS - Date.now());
+		this.timer = setTimeout(() => {
+			this.timer = void 0;
+			this.flush();
+		}, wait);
+		this.timer.unref?.();
+	}
+	clearTimer() {
+		if (this.timer !== void 0) {
+			clearTimeout(this.timer);
+			this.timer = void 0;
+		}
+	}
+	flush() {
+		this.lastEmit = Date.now();
+		for (const stream of ["stdout", "stderr"]) {
+			const text = this.ready[stream];
+			if (text === "") continue;
+			this.ready[stream] = "";
+			this.deliver(stream, text);
+		}
+	}
+	deliver(stream, text) {
+		try {
+			let chunk = text;
+			for (const secret of this.secrets) chunk = chunk.split(secret).join("[redacted]");
+			chunk = this.hooks.redactShellOutput?.(chunk) ?? chunk;
+			if (chunk === "") return;
+			const event = {
+				command: this.source.command,
+				stream,
+				chunk,
+				...this.source.callId !== void 0 ? { callId: this.source.callId } : {},
+				...this.source.jobId !== void 0 ? { jobId: this.source.jobId } : {}
+			};
+			this.hooks.onShellOutput?.(event);
+		} catch {}
+	}
+};
+
 //#endregion
 //#region ../../packages/ai-workspace/src/output/spill.ts
 const DEFAULT_MAX_LINES = 2e3;
@@ -4089,7 +4254,7 @@ var ShellJobs = class {
 		});
 		const job = new ShellJob(`job-${this.nextId++}`, spec.command, spec.retainBytes);
 		this.jobs.set(job.id, job);
-		const handle = spec.launch((stream, chunk) => job.append(stream, chunk));
+		const handle = spec.launch((stream, chunk) => job.append(stream, chunk), job.id);
 		job.process = handle;
 		if (spec.timeoutMs !== void 0 && spec.timeoutMs > 0) {
 			job.timer = setTimeout(() => {
@@ -4148,6 +4313,210 @@ var ShellJobs = class {
 	}
 };
 
+//#endregion
+//#region ../../packages/ai-workspace/src/search/walk.ts
+/** Directories `glob` and `grep` never descend into unless `search.skipDirs` says otherwise. */
+const DEFAULT_SEARCH_SKIP_DIRS = [".git", "node_modules"];
+/** Default most files one `glob` or `grep` walk looks at. */
+const DEFAULT_SEARCH_MAX_FILES = 5e4;
+/**
+* The directory a glob can be anchored at: its leading segments that hold no
+* wildcard, never counting the last segment (it may be a file). `""` is the root.
+*/
+function staticGlobPrefix(pattern) {
+	const segments = pattern.split("/");
+	const kept = [];
+	for (let index = 0; index < segments.length - 1; index++) {
+		const segment = segments[index] ?? "";
+		if (segment === "" || segment === "." || segment === ".." || /[*?[\]{}\\]/.test(segment)) break;
+		kept.push(segment);
+	}
+	return kept.join("/");
+}
+/** Parse the lines of a `.gitignore` located at workspace-relative `base`. */
+function parseGitignore(content, base) {
+	const rules = [];
+	for (const raw of content.split(/\r?\n/)) {
+		let line = raw.trimEnd();
+		if (line === "" || line.startsWith("#")) continue;
+		const negate = line.startsWith("!");
+		if (negate) line = line.slice(1);
+		const dirOnly = line.endsWith("/");
+		if (dirOnly) line = line.slice(0, -1);
+		const anywhere = line.startsWith("**/");
+		if (anywhere) line = line.slice(3);
+		if (line.startsWith("/")) line = line.slice(1);
+		if (line === "") continue;
+		rules.push({
+			base,
+			negate,
+			dirOnly,
+			anywhere,
+			nameOnly: !anywhere && !line.includes("/") && !raw.trimStart().startsWith("/"),
+			regex: globToRegExp(line)
+		});
+	}
+	return rules;
+}
+/** Whether the ordered rules (last match wins) ignore the entry at `rel`. */
+function isIgnored(rel, name, isDir, rules) {
+	let ignored = false;
+	for (const rule of rules) {
+		if (rule.dirOnly && !isDir) continue;
+		const local = rule.base === "" ? rel : rel.slice(rule.base.length + 1);
+		let hit;
+		if (rule.nameOnly) hit = rule.regex.test(name);
+		else if (rule.anywhere) {
+			const parts = local.split("/");
+			hit = parts.some((_, index) => rule.regex.test(parts.slice(index).join("/")));
+		} else hit = rule.regex.test(local);
+		if (hit) ignored = !rule.negate;
+	}
+	return ignored;
+}
+/** Whether a directory name or relative path is one of the `skipDirs` globs. */
+function isSkipped(name, rel, skipDirs) {
+	return skipDirs.some((glob) => glob.includes("/") ? matchesAnyGlob(rel, [glob]) : globToRegExp(glob).test(name));
+}
+/**
+* List a directory with entry types: the backend's own typed listing when it has
+* one, else its plain listing plus `stat`, else (no `stat`) a second listing per
+* entry to tell directories from files.
+*/
+async function listTyped(backend, absDir) {
+	if (backend.listTyped !== void 0) return backend.listTyped(absDir);
+	const entries = await backend.list(absDir);
+	return Promise.all(entries.map(async (entry) => {
+		if (backend.stat !== void 0) try {
+			return {
+				path: entry,
+				type: (await backend.stat(entry)).type
+			};
+		} catch {
+			return {
+				path: entry,
+				type: "other"
+			};
+		}
+		try {
+			if ((await backend.list(entry)).length === 0) try {
+				await backend.readFile(entry);
+				return {
+					path: entry,
+					type: "file"
+				};
+			} catch {
+				return {
+					path: entry,
+					type: "directory"
+				};
+			}
+			return {
+				path: entry,
+				type: "directory"
+			};
+		} catch {
+			return {
+				path: entry,
+				type: "file"
+			};
+		}
+	}));
+}
+/** Read `.gitignore` at `absDir`, or nothing when there is none. */
+async function readGitignore(backend, absDir, base) {
+	try {
+		return parseGitignore(await backend.readFile(node_path.default.join(absDir, ".gitignore")), base);
+	} catch {
+		return [];
+	}
+}
+/**
+* Walk the files under `startDir` breadth first. Denied, skipped and
+* gitignored directories are dropped before they are listed, so a tree such as
+* `node_modules` is never read. Directories are read `concurrency` at a time,
+* the signal is checked between batches, and the walk stops at `maxFiles`.
+* Symlinks are never followed; a symlink to a file is reported only when its
+* target is inside the jail root.
+*/
+async function walkFiles(options) {
+	const { backend, jailRoot, startDir, denyPaths, skipDirs, signal } = options;
+	const files = [];
+	let truncated = false;
+	const isDenied = (rel) => denyPaths.length > 0 && matchesAnyGlob(rel, denyPaths);
+	const isDeniedDir = (rel) => isDenied(rel) || denyPaths.some((glob) => glob.endsWith("/**") && globToRegExp(glob.slice(0, -3)).test(rel));
+	const startRel = node_path.default.relative(jailRoot, startDir).split(node_path.default.sep).join("/");
+	let inherited = [];
+	if (options.gitignore) {
+		const segments = startRel === "" ? [] : startRel.split("/");
+		for (let depth = 0; depth < segments.length; depth++) {
+			const base = segments.slice(0, depth).join("/");
+			const abs = base === "" ? jailRoot : node_path.default.join(jailRoot, ...segments.slice(0, depth));
+			inherited = inherited.concat(await readGitignore(backend, abs, base));
+		}
+	}
+	let level = [{
+		abs: startDir,
+		rel: startRel,
+		rules: inherited
+	}];
+	const readDir = async (dir, next) => {
+		let entries;
+		try {
+			entries = await listTyped(backend, dir.abs);
+		} catch {
+			return;
+		}
+		let rules = dir.rules;
+		if (options.gitignore && entries.some((entry) => node_path.default.basename(entry.path) === ".gitignore" && entry.type !== "directory")) rules = rules.concat(await readGitignore(backend, dir.abs, dir.rel));
+		for (const entry of entries) {
+			if (files.length >= options.maxFiles) {
+				truncated = true;
+				return;
+			}
+			const name = node_path.default.basename(entry.path);
+			const rel = dir.rel === "" ? name : `${dir.rel}/${name}`;
+			let type = entry.type;
+			let abs = entry.path;
+			if (type === "symlink") try {
+				const target = await backend.realpath(entry.path);
+				if (!isInside(target, jailRoot) || backend.stat === void 0) continue;
+				if ((await backend.stat(target)).type !== "file") continue;
+				type = "file";
+				abs = entry.path;
+			} catch {
+				continue;
+			}
+			if (type === "directory") {
+				if (isDeniedDir(rel) || isSkipped(name, rel, skipDirs)) continue;
+				if (options.gitignore && isIgnored(rel, name, true, rules)) continue;
+				next.push({
+					abs,
+					rel,
+					rules
+				});
+				continue;
+			}
+			if (type !== "file" || isDenied(rel)) continue;
+			if (options.gitignore && isIgnored(rel, name, false, rules)) continue;
+			files.push(abs);
+		}
+	};
+	while (level.length > 0 && !truncated) {
+		const next = [];
+		for (let index = 0; index < level.length && !truncated; index += options.concurrency) {
+			signal?.throwIfAborted();
+			await Promise.all(level.slice(index, index + options.concurrency).map((dir) => readDir(dir, next)));
+		}
+		signal?.throwIfAborted();
+		level = next;
+	}
+	return {
+		files,
+		truncated
+	};
+}
+
 //#endregion
 //#region ../../packages/ai-workspace/src/ops.ts
 /** Default line window a read returns when the policy sets no `defaultLines`. */
@@ -4320,20 +4689,35 @@ var Ops = class {
 		}
 	}
 	/**
-	* Recursively collect every file under `absDir` as absolute paths,
-	* via the backend's `list` (so it works over disk or the in-memory
-	* mock). Directories are descended; files are accumulated.
+	* Collect the files a `glob` or `grep` should look at, starting at the
+	* folder the pattern is anchored to (see {@link staticGlobPrefix}).
+	* `denyPaths`, `search.skipDirs` and `.gitignore` are applied before a
+	* directory is listed.
 	*/
-	async walkFiles(absDir) {
-		const found = [];
-		const entries = await this.backend.list(absDir);
-		await Promise.all(entries.map(async (entry) => {
-			if (await this.isDirectory(entry)) {
-				const nested = await this.walkFiles(entry);
-				found.push(...nested);
-			} else found.push(entry);
-		}));
-		return found;
+	async searchFiles(jailRoot, pattern, signal) {
+		const prefix = pattern === void 0 ? "" : staticGlobPrefix(pattern);
+		const search = this.policy.search;
+		let startDir = jailRoot;
+		if (prefix !== "") try {
+			startDir = (await resolveInJail(this.policy, prefix)).absolutePath;
+		} catch (error) {
+			if (error instanceof WorkspacePolicyError) return {
+				files: [],
+				truncated: false
+			};
+			throw error;
+		}
+		return walkFiles({
+			backend: this.backend,
+			jailRoot,
+			startDir,
+			denyPaths: this.policy.denyPaths ?? [],
+			skipDirs: search?.skipDirs ?? DEFAULT_SEARCH_SKIP_DIRS,
+			gitignore: search?.gitignore ?? true,
+			maxFiles: search?.maxFiles ?? 5e4,
+			concurrency: Math.max(1, search?.concurrency ?? 16),
+			...signal ? { signal } : {}
+		});
 	}
 	/** Whether an absolute path is a directory, by attempting to list it. */
 	async isDirectory(absPath) {
@@ -4572,14 +4956,29 @@ var Ops = class {
 		const timeoutMs = opts?.timeoutMs ?? shell?.timeoutMs;
 		const maxOutputBytes = shell?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
 		const interpreter = this.resolvedShell.interpreter;
-		const result = await this.backend.exec(command, {
-			cwd: this.policy.cwd,
-			timeoutMs,
-			env: buildCommandEnv(this.policy),
-			...signal ? { signal } : {},
-			...interpreter !== "none" ? { interpreter } : {},
-			...interpreter !== "none" && this.resolvedShell.file !== void 0 ? { interpreterPath: this.resolvedShell.file } : {}
-		});
+		const env = buildCommandEnv(this.policy);
+		const live = ShellOutputStreamer.create(this.policy.hooks, {
+			command,
+			...opts?.callId !== void 0 ? { callId: opts.callId } : {}
+		}, this.policy.shell?.env);
+		let result;
+		try {
+			result = await this.backend.exec(command, {
+				cwd: this.policy.cwd,
+				timeoutMs,
+				env,
+				...live ? { onOutput: (stream, chunk) => live.push(stream, chunk) } : {},
+				...signal ? { signal } : {},
+				...interpreter !== "none" ? { interpreter } : {},
+				...interpreter !== "none" && this.resolvedShell.file !== void 0 ? { interpreterPath: this.resolvedShell.file } : {}
+			});
+			if (live !== void 0 && !live.received) {
+				live.push("stdout", result.stdout);
+				live.push("stderr", result.stderr);
+			}
+		} finally {
+			live?.end();
+		}
 		const stdout = await this.fitStream("run_shell-stdout", result.stdout, maxOutputBytes);
 		const stderr = await this.fitStream("run_shell-stderr", result.stderr, maxOutputBytes);
 		const cancelled = result.cancelled === true;
@@ -4619,13 +5018,24 @@ var Ops = class {
 			retainBytes: shell?.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES,
 			maxJobs: background.maxJobs ?? 4,
 			...timeoutMs !== void 0 ? { timeoutMs } : {},
-			launch: (onOutput) => start(command, {
-				cwd: this.policy.cwd,
-				env,
-				...interpreter !== "none" ? { interpreter } : {},
-				...interpreterPath !== void 0 ? { interpreterPath } : {},
-				onOutput
-			})
+			launch: (onOutput, jobId) => {
+				const live = ShellOutputStreamer.create(this.policy.hooks, {
+					command,
+					jobId
+				}, this.policy.shell?.env);
+				const handle = start(command, {
+					cwd: this.policy.cwd,
+					env,
+					...interpreter !== "none" ? { interpreter } : {},
+					...interpreterPath !== void 0 ? { interpreterPath } : {},
+					onOutput: (stream, chunk) => {
+						onOutput(stream, chunk);
+						live?.push(stream, chunk);
+					}
+				});
+				handle.done.then(() => live?.end());
+				return handle;
+			}
 		});
 	}
 	async shellOutput(id, opts) {
@@ -4760,9 +5170,11 @@ var Ops = class {
 		const flags = opts?.ignoreCase ? "i" : "";
 		const regex = new RegExp(pattern, flags);
 		const globRegex = opts?.glob ? globToRegExp(opts.glob) : void 0;
-		const files = await this.walkFiles(jailRoot);
+		const walked = await this.searchFiles(jailRoot, opts?.glob, opts?.signal);
+		const files = walked.files.sort();
 		const matches = [];
 		for (const absFile of files) {
+			opts?.signal?.throwIfAborted();
 			const relativePath = node_path.default.relative(jailRoot, absFile).split(node_path.default.sep).join("/");
 			if (globRegex && !globRegex.test(relativePath)) continue;
 			if (this.isDenied(relativePath)) continue;
@@ -4782,14 +5194,22 @@ var Ops = class {
 						line: index + 1,
 						text: line
 					});
-					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return this.fitMatches(matches);
+					if (matches.length >= DEFAULT_MAX_GREP_MATCHES) return this.fitMatches(matches, walked.truncated);
 				}
 			}
 		}
-		return this.fitMatches(matches);
+		return this.fitMatches(matches, walked.truncated);
 	}
 	/** Apply the `output` limits to a finished match list. */
-	async fitMatches(matches) {
+	async fitMatches(matches, maxFilesReached) {
+		const result = await this.fitMatchesWithin(matches);
+		return maxFilesReached ? {
+			...result,
+			truncated: true,
+			maxFilesReached: true
+		} : result;
+	}
+	async fitMatchesWithin(matches) {
 		const fitted = await this.spiller.list("grep", matches, (match) => `${match.path}:${match.line}:${match.text}`, "head");
 		return fitted.truncation === void 0 ? {
 			matches,
@@ -4802,27 +5222,42 @@ var Ops = class {
 			...spilledField({ stdout: fitted.truncation })
 		};
 	}
-	async globResult(pattern) {
-		const all = await this.glob(pattern);
+	async globResult(pattern, opts) {
+		const { paths: all, maxFilesReached } = await this.globWalk(pattern, opts?.signal);
 		const fitted = await this.spiller.list("glob", all, (entry) => entry, "head");
-		return fitted.truncation === void 0 ? { paths: all } : {
+		const reached = maxFilesReached ? {
+			truncated: true,
+			maxFilesReached: true
+		} : {};
+		return fitted.truncation === void 0 ? {
+			paths: all,
+			...reached
+		} : {
 			paths: fitted.items,
 			truncated: true,
 			truncation: fitted.truncation,
-			...spilledField({ stdout: fitted.truncation })
+			...spilledField({ stdout: fitted.truncation }),
+			...reached
 		};
 	}
-	async glob(pattern) {
+	async glob(pattern, opts) {
+		return (await this.globWalk(pattern, opts?.signal)).paths;
+	}
+	/** Match `pattern` against the walked files; sorted, with whether the walk hit `maxFiles`. */
+	async globWalk(pattern, signal) {
 		const { absolutePath: jailRoot } = await resolveInJail(this.policy, ".");
 		const regex = globToRegExp(pattern);
-		const files = await this.walkFiles(jailRoot);
+		const walked = await this.searchFiles(jailRoot, pattern, signal);
 		const matched = [];
-		for (const absFile of files) {
+		for (const absFile of walked.files) {
 			const relativePath = node_path.default.relative(jailRoot, absFile).split(node_path.default.sep).join("/");
 			if (this.isDenied(relativePath)) continue;
 			if (regex.test(relativePath)) matched.push(relativePath);
 		}
-		return matched.sort();
+		return {
+			paths: matched.sort(),
+			maxFilesReached: walked.truncated
+		};
 	}
 	async exists(inputPath) {
 		const { absolutePath } = await resolveInJail(this.policy, inputPath);
@@ -5112,6 +5547,13 @@ var LocalBackend = class {
 	async list(absDir) {
 		return _warlock_js_fs.fs.dirs.list(absDir);
 	}
+	/** List children with their kinds from one directory read (symlinks not followed). */
+	async listTyped(absDir) {
+		return (await (0, node_fs_promises.readdir)(absDir, { withFileTypes: true })).map((entry) => ({
+			path: node_path.default.join(absDir, entry.name),
+			type: entry.isSymbolicLink() ? "symlink" : entry.isDirectory() ? "directory" : entry.isFile() ? "file" : "other"
+		}));
+	}
 	/**
 	* Describe a path without following a final symlink (`lstat` — like
 	* `realpath`, a filesystem operation `@warlock.js/fs` does not expose).
@@ -5212,6 +5654,10 @@ var LocalBackend = class {
 				settled = true;
 				if (timer !== void 0) clearTimeout(timer);
 				signal?.removeEventListener("abort", onAbort);
+				for (const stream of ["stdout", "stderr"]) {
+					const tail = liveDecoders[stream].end();
+					if (tail !== "") opts.onOutput?.(stream, tail);
+				}
 				resolve({
 					exitCode,
 					stdout: Buffer.concat(stdoutChunks).toString("utf8"),
@@ -5220,11 +5666,22 @@ var LocalBackend = class {
 					cancelled
 				});
 			};
+			const liveDecoders = {
+				stdout: new node_string_decoder.StringDecoder("utf8"),
+				stderr: new node_string_decoder.StringDecoder("utf8")
+			};
+			const live = (stream, chunk) => {
+				if (opts.onOutput === void 0 || settled) return;
+				const text = liveDecoders[stream].write(chunk);
+				if (text !== "") opts.onOutput(stream, text);
+			};
 			child.stdout?.on("data", (chunk) => {
 				stdoutBytes = pushCapped(stdoutChunks, stdoutBytes, chunk);
+				live("stdout", chunk);
 			});
 			child.stderr?.on("data", (chunk) => {
 				stderrBytes = pushCapped(stderrChunks, stderrBytes, chunk);
+				live("stderr", chunk);
 			});
 			child.on("error", () => {
 				settle(127);
@@ -5970,12 +6427,13 @@ const globInputSchema = objectSchema({ pattern: stringField() }, GLOB_JSON_SCHEM
 function makeGlobTool(ops, options) {
 	return (0, _warlock_js_ai.tool)({
 		name: options?.name ?? "glob",
-		description: "Find files in the workspace whose path matches a glob pattern (supports `*`, `**`, and `?`). Returns the matching workspace-relative paths, sorted.",
+		description: "Find files in the workspace whose path matches a glob pattern (supports `*`, `**`, and `?`). Returns the matching workspace-relative paths, sorted. Skips node_modules, .git and gitignored folders; start the pattern with a folder (`src/**/*.ts`) to search faster.",
 		action: (input) => `Finding files matching ${input.pattern}`,
 		input: globInputSchema,
-		async execute(input) {
-			if (ops.globResult !== void 0) return ops.globResult(input.pattern);
-			return { paths: await ops.glob(input.pattern) };
+		async execute(input, ctx) {
+			const opts = ctx?.signal ? { signal: ctx.signal } : void 0;
+			if (ops.globResult !== void 0) return ops.globResult(input.pattern, opts);
+			return { paths: await ops.glob(input.pattern, opts) };
 		}
 	});
 }
@@ -6017,10 +6475,11 @@ function makeGrepTool(ops, options) {
 		description: "Search file contents across the workspace for a regular-expression pattern. Optionally narrow the scanned files with a glob and match case-insensitively. Returns every matching line with its file path and 1-based line number.",
 		action: (input) => `Searching for /${input.pattern}/`,
 		input: grepInputSchema,
-		async execute(input) {
+		async execute(input, ctx) {
 			return ops.grep(input.pattern, {
 				glob: input.glob,
-				ignoreCase: input.ignoreCase
+				ignoreCase: input.ignoreCase,
+				...ctx?.signal ? { signal: ctx.signal } : {}
 			});
 		}
 	});
@@ -6276,6 +6735,7 @@ const DIALECT_RULES = {
 	powershell: "Use PowerShell syntax: `;`, `&&`, `||`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not.",
 	powershell5: "Use Windows PowerShell 5.1 syntax: `;`, pipes, `$( )`, the call operator `&` and the redirections `>`, `>>`, `2>` and `2>&1` are supported, and every command in the line is checked (aliases such as `rm` and `Remove-Item` are treated alike). This version cannot chain with `&&` or `||`: put one command per call, or join with `;` (which runs the next command whatever the exit code). Script blocks, `Invoke-Expression`, here-strings, splatting and `if` / `foreach` are not supported."
 };
+const WINDOWS_BASH_PATH_RULE = " Write paths with forward slashes (`cd ab/terra4/client`, `C:/work/app`): bash reads an unquoted backslash as an escape, so a line with `ab\\terra4` is refused.";
 const PLATFORM_NAMES = {
 	win32: "Windows",
 	darwin: "macOS",
@@ -6286,7 +6746,7 @@ function shellSentence(options) {
 	const dialect = options?.shellDialect;
 	if (options?.shellLabel === void 0 || dialect === void 0 || dialect === "none") return "";
 	const platform = options.platform ?? process.platform;
-	return ` Commands run on ${PLATFORM_NAMES[platform] ?? platform} using ${options.shellLabel}. ` + DIALECT_RULES[dialect];
+	return ` Commands run on ${PLATFORM_NAMES[platform] ?? platform} using ${options.shellLabel}. ` + DIALECT_RULES[dialect] + (platform === "win32" && options.shellLabel === "bash" ? WINDOWS_BASH_PATH_RULE : "");
 }
 /** The lower of the model's timeout and the cap (either may be absent). */
 function cappedTimeout(requested, cap) {
@@ -6924,8 +7384,8 @@ var WorkspaceImpl = class WorkspaceImpl {
 	grep(pattern, opts) {
 		return this.ops.grep(pattern, opts);
 	}
-	glob(pattern) {
-		return this.ops.glob(pattern);
+	glob(pattern, opts) {
+		return this.ops.glob(pattern, opts);
 	}
 	exists(filePath) {
 		return this.ops.exists(filePath);