fs: extract provider operations into shared crate

crates/workdir/src/lib.rs

@@ -8,7 +8,6 @@
 pub mod http;
 mod local;
 mod operation;
-mod search;
 
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -16,6 +15,11 @@ use std::sync::Arc;
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 
+pub use fs_operation::{
+    ContentHash, EditRequest, EditResult, EntryKind, FsPath as WorkdirPath, GlobRequest,
+    GlobResult, GrepOutputMode, GrepRequest, GrepResult, ListEntry, ListRequest, ListResult,
+    ReadRequest, ReadResult, StatRequest, StatResult, WriteRequest, WriteResult,
+};
 pub use local::{LocalWorkdirSession, SymlinkInfo, direct_symlink, first_symlink};
 pub use operation::*;
 
@@ -248,3 +252,42 @@ impl WorkdirError {
         }
     }
 }
+
+impl From<fs_operation::FsError> for WorkdirError {
+    fn from(error: fs_operation::FsError) -> Self {
+        match error {
+            fs_operation::FsError::InvalidPath(message) => Self::InvalidPath(message),
+            fs_operation::FsError::RelativePath(path) => Self::RelativePath(path),
+            fs_operation::FsError::OutOfScope(path) => Self::OutOfScope(path),
+            fs_operation::FsError::NotFound(path) => Self::NotFound(path),
+            fs_operation::FsError::BrokenSymlink { path, link, target } => {
+                Self::BrokenSymlink { path, link, target }
+            }
+            fs_operation::FsError::SymlinkOutOfScope {
+                path,
+                target,
+                required_permission,
+            } => Self::SymlinkOutOfScope {
+                path,
+                target,
+                required_permission,
+            },
+            fs_operation::FsError::SymlinkDirectoryNotTraversed { tool, path, target } => {
+                Self::SymlinkDirectoryNotTraversed { tool, path, target }
+            }
+            fs_operation::FsError::ReadOnly(path) => Self::ReadOnly(path),
+            fs_operation::FsError::IsDirectory(path) => Self::IsDirectory(path),
+            fs_operation::FsError::NotDirectory(path) => {
+                Self::InvalidArgument(format!("path is not a directory: {}", path.display()))
+            }
+            fs_operation::FsError::SymlinkTargetIsDirectory { path, target } => {
+                Self::SymlinkTargetIsDirectory { path, target }
+            }
+            fs_operation::FsError::Conflict(message) => Self::Conflict(message),
+            fs_operation::FsError::InvalidGlob(message) => Self::InvalidGlob(message),
+            fs_operation::FsError::InvalidRegex(message) => Self::InvalidRegex(message),
+            fs_operation::FsError::InvalidArgument(message) => Self::InvalidArgument(message),
+            fs_operation::FsError::Io { path, source } => Self::Io { path, source },
+        }
+    }
+}

crates/workdir/src/local.rs

@@ -9,7 +9,9 @@
 //! state, such as read-before-edit tracking, remains owned by the tool layer.
 
 use std::collections::HashMap;
-use std::io::{Read as _, Seek as _, SeekFrom, Write as _};
+#[cfg(test)]
+use std::io::Write as _;
+use std::io::{Read as _, Seek as _, SeekFrom};
 use std::path::{Path, PathBuf};
 use std::process::Stdio;
 use std::sync::Arc;
@@ -17,8 +19,6 @@ use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::time::Duration;
 
 use async_trait::async_trait;
-use globset::Glob;
-use ignore::WalkBuilder;
 use manifest::{Scope, SharedScope};
 use sha2::{Digest, Sha256};
 use tokio::process::Command;
@@ -27,11 +27,13 @@ use tokio::task::JoinHandle;
 
 use crate::{
     CommandHandle, CommandOutput, CommandOutputRequest, CommandRequest, CommandStatus, EditRequest,
-    EditResult, EntryKind, GlobRequest, GlobResult, GrepRequest, GrepResult, ListEntry,
-    ListRequest, ListResult, ReadRequest, ReadResult, StatRequest, StatResult, Workdir,
-    WorkdirError, WorkdirPath, WorkdirSession, WorkdirSessionCapabilities,
-    WorkdirSessionCapability, WriteOutcome, WriteRequest, WriteResult,
+    EditResult, GlobRequest, GlobResult, GrepRequest, GrepResult, ListRequest, ListResult,
+    ReadRequest, ReadResult, StatRequest, StatResult, Workdir, WorkdirError, WorkdirPath,
+    WorkdirSession, WorkdirSessionCapabilities, WorkdirSessionCapability, WriteRequest,
+    WriteResult,
 };
+#[cfg(test)]
+use crate::{EntryKind, WriteOutcome};
 
 #[derive(Debug)]
 enum LocalCommand {
@@ -42,6 +44,19 @@ enum LocalCommand {
     Completed(CommandOutput),
 }
 
+#[derive(Debug)]
+struct ScopeAccess(Arc<Scope>);
+
+impl fs_operation::FsAccessPolicy for ScopeAccess {
+    fn is_readable(&self, path: &Path) -> bool {
+        self.0.is_readable(path)
+    }
+
+    fn is_writable(&self, path: &Path) -> bool {
+        self.0.is_writable(path)
+    }
+}
+
 #[derive(Debug)]
 struct LocalWorkdirSessionInner {
     workdir: Workdir,
@@ -191,6 +206,7 @@ impl LocalWorkdirSession {
     ///
     /// Follows symlinks. Rejects directories, relative paths, paths not
     /// readable by the scope, and missing files.
+    #[cfg(test)]
     pub(crate) fn read_bytes(&self, path: &Path) -> Result<Vec<u8>, WorkdirError> {
         if !path.is_absolute() {
             return Err(WorkdirError::RelativePath(path.to_path_buf()));
@@ -241,6 +257,7 @@ impl LocalWorkdirSession {
     ///   target file transitions atomically between states.
     ///
     /// This method does **not** consult tool-specific read history.
+    #[cfg(test)]
     pub(crate) fn write(&self, path: &Path, content: &[u8]) -> Result<WriteOutcome, WorkdirError> {
         if !path.is_absolute() {
             return Err(WorkdirError::RelativePath(path.to_path_buf()));
@@ -342,13 +359,6 @@ impl LocalWorkdirSession {
             self.inner.root.join(path.as_str())
         }
     }
-
-    fn logical_path(&self, path: &Path) -> Result<WorkdirPath, WorkdirError> {
-        let relative = path
-            .strip_prefix(&self.inner.root)
-            .map_err(|_| WorkdirError::InvalidPath("path escaped Workdir root".into()))?;
-        WorkdirPath::new(relative.to_string_lossy())
-    }
 }
 
 #[async_trait]
@@ -363,244 +373,67 @@ impl WorkdirSession for LocalWorkdirSession {
 
     async fn stat(&self, request: StatRequest) -> Result<StatResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Read)?;
-        let path = self.resolve(&request.path);
-        let metadata = std::fs::symlink_metadata(&path).map_err(|error| {
-            let error = match error.kind() {
-                std::io::ErrorKind::NotFound => WorkdirError::NotFound(path.clone()),
-                _ => WorkdirError::io(&path, error),
-            };
-            sanitize_error(error, &request.path)
-        })?;
-        let kind = if metadata.file_type().is_symlink() {
-            EntryKind::Symlink
-        } else if metadata.is_file() {
-            EntryKind::File
-        } else if metadata.is_dir() {
-            EntryKind::Directory
-        } else {
-            EntryKind::Other
-        };
-        Ok(StatResult {
-            path: request.path,
-            kind,
-            size: metadata.len(),
-        })
+        let logical = request.path.clone();
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_stat(&self.inner.root, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn read(&self, request: ReadRequest) -> Result<ReadResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Read)?;
-        let path = self.resolve(&request.path);
-        let bytes = LocalWorkdirSession::read_bytes(self, &path)
-            .map_err(|error| sanitize_error(error, &request.path))?;
-        let content_hash = Sha256::digest(&bytes).into();
-        let lines = bytes
-            .split_inclusive(|byte| *byte == b'\n')
-            .collect::<Vec<_>>();
-        let total_lines = lines.len();
-        if request.offset > total_lines && request.offset != 0 {
-            return Err(WorkdirError::InvalidArgument(format!(
-                "offset {} exceeds file length {total_lines}",
-                request.offset
-            )));
-        }
-        let end = request
-            .offset
-            .saturating_add(request.limit)
-            .min(total_lines);
-        let mut selected = lines[request.offset.min(total_lines)..end]
-            .iter()
-            .flat_map(|line| line.iter().copied())
-            .collect::<Vec<_>>();
-        let byte_truncated = selected.len() > request.max_bytes;
-        if byte_truncated {
-            let mut byte_end = request.max_bytes;
-            if let Ok(text) = std::str::from_utf8(&selected) {
-                while byte_end > 0 && !text.is_char_boundary(byte_end) {
-                    byte_end -= 1;
-                }
-            }
-            selected.truncate(byte_end);
-        }
-        Ok(ReadResult {
-            path: request.path,
-            bytes: selected,
-            start_line: request.offset,
-            total_lines,
-            content_hash,
-            truncated: end < total_lines || byte_truncated,
-        })
+        let logical = request.path.clone();
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_read(&self.inner.root, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn write(&self, request: WriteRequest) -> Result<WriteResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Write)?;
-        let path = self.resolve(&request.path);
-        if path.exists() {
-            let current = LocalWorkdirSession::read_bytes(self, &path)
-                .map_err(|error| sanitize_error(error, &request.path))?;
-            let current_hash: [u8; 32] = Sha256::digest(&current).into();
-            if request.expected_hash != Some(current_hash) {
-                return Err(WorkdirError::Conflict(request.path.to_string()));
-            }
-        } else if request.expected_hash.is_some() {
-            return Err(WorkdirError::Conflict(request.path.to_string()));
-        }
-        LocalWorkdirSession::write(self, &path, &request.content)
-            .map_err(|error| sanitize_error(error, &request.path))
+        let logical = request.path.clone();
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_write(&self.inner.root, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn edit(&self, request: EditRequest) -> Result<EditResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Edit)?;
-        let path = self.resolve(&request.path);
-        let bytes = LocalWorkdirSession::read_bytes(self, &path)
-            .map_err(|error| sanitize_error(error, &request.path))?;
-        let current_hash: [u8; 32] = Sha256::digest(&bytes).into();
-        if current_hash != request.expected_hash {
-            return Err(WorkdirError::Conflict(request.path.to_string()));
-        }
-        let text = String::from_utf8(bytes).map_err(|_| {
-            WorkdirError::InvalidArgument(format!("file is not UTF-8: {}", request.path))
-        })?;
-        let occurrences = text.matches(&request.old_string).count();
-        if occurrences == 0 {
-            return Err(WorkdirError::InvalidArgument("old_string not found".into()));
-        }
-        if !request.replace_all && occurrences != 1 {
-            return Err(WorkdirError::InvalidArgument(format!(
-                "old_string occurs {occurrences} times; set replace_all or provide more context"
-            )));
-        }
-        let replacements = if request.replace_all { occurrences } else { 1 };
-        let edited = if request.replace_all {
-            text.replace(&request.old_string, &request.new_string)
-        } else {
-            text.replacen(&request.old_string, &request.new_string, 1)
-        };
-        let outcome = LocalWorkdirSession::write(self, &path, edited.as_bytes())
-            .map_err(|error| sanitize_error(error, &request.path))?;
-        let content_hash = Sha256::digest(edited.as_bytes()).into();
-        Ok(EditResult {
-            replacements,
-            bytes_written: outcome.bytes_written,
-            content_hash,
-        })
+        let logical = request.path.clone();
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_edit(&self.inner.root, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn list(&self, request: ListRequest) -> Result<ListResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Read)?;
-        let base = self.resolve(&request.path);
-        let scope = self.inner.scope.snapshot();
-        if !scope.is_readable(&base) {
-            return Err(WorkdirError::OutOfScope(PathBuf::from(
-                request.path.as_str(),
-            )));
-        }
-        let mut entries = Vec::new();
-        for entry in std::fs::read_dir(&base)
-            .map_err(|error| sanitize_error(WorkdirError::io(&base, error), &request.path))?
-        {
-            let entry = entry
-                .map_err(|error| sanitize_error(WorkdirError::io(&base, error), &request.path))?;
-            let path = entry.path();
-            if !scope.is_readable(&path) {
-                continue;
-            }
-            let link_metadata = std::fs::symlink_metadata(&path)
-                .map_err(|error| sanitize_error(WorkdirError::io(&path, error), &request.path))?;
-            let is_symlink = link_metadata.file_type().is_symlink();
-            let metadata = if is_symlink {
-                link_metadata
-            } else {
-                entry.metadata().map_err(|error| {
-                    sanitize_error(WorkdirError::io(&path, error), &request.path)
-                })?
-            };
-            let kind = if is_symlink {
-                EntryKind::Symlink
-            } else if metadata.is_file() {
-                EntryKind::File
-            } else if metadata.is_dir() {
-                EntryKind::Directory
-            } else {
-                EntryKind::Other
-            };
-            entries.push(ListEntry {
-                path: self.logical_path(&path)?,
-                kind,
-                size: metadata.len(),
-            });
-        }
-        entries.sort_by(|left, right| {
-            let left_dir = left.kind == EntryKind::Directory;
-            let right_dir = right.kind == EntryKind::Directory;
-            right_dir
-                .cmp(&left_dir)
-                .then_with(|| left.path.as_str().cmp(right.path.as_str()))
-        });
-        let total_entries = entries.len();
-        let total_bytes = entries.iter().map(|entry| entry.size).sum();
-        let truncated = total_entries > request.limit;
-        entries.truncate(request.limit);
-        Ok(ListResult {
-            entries,
-            total_entries,
-            total_bytes,
-            truncated,
-        })
+        let logical = request.path.clone();
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_list(&self.inner.root, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn glob(&self, request: GlobRequest) -> Result<GlobResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Glob)?;
+        let logical = request.path.clone();
         let base = self.resolve(&request.path);
-        if let Some(info) = direct_symlink(&base)
-            && info.target_exists
-            && info.resolved_path.is_dir()
-        {
-            return Err(WorkdirError::SymlinkDirectoryNotTraversed {
-                tool: "Glob",
-                path: PathBuf::from(request.path.as_str()),
-                target: PathBuf::from("<provider-internal target>"),
-            });
-        }
-        let matcher = Glob::new(&request.pattern)
-            .map_err(|error| WorkdirError::InvalidGlob(error.to_string()))?
-            .compile_matcher();
-        let scope = self.inner.scope.snapshot();
-        if !scope.is_readable(&base) {
-            return Err(WorkdirError::OutOfScope(PathBuf::from(
-                request.path.as_str(),
-            )));
-        }
-        let mut matches = Vec::new();
-        for entry in WalkBuilder::new(&base).hidden(false).build().flatten() {
-            let path = entry.path();
-            if !path.is_file() || !scope.is_readable(path) {
-                continue;
-            }
-            let relative = path.strip_prefix(&base).unwrap_or(path);
-            if matcher.is_match(relative) {
-                matches.push(self.logical_path(path)?);
-            }
-        }
-        matches.sort_by(|left, right| left.as_str().cmp(right.as_str()));
-        let truncated = matches.len() > request.limit;
-        matches.truncate(request.limit);
-        Ok(GlobResult {
-            paths: matches,
-            truncated,
-        })
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_glob(&self.inner.root, &base, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn grep(&self, request: GrepRequest) -> Result<GrepResult, WorkdirError> {
         self.ensure_capability(WorkdirSessionCapability::Grep)?;
         let base = self.resolve(&request.path);
         let logical = request.path.clone();
-        crate::search::run_grep(
-            &self.inner.root,
-            base,
-            request,
-            &self.inner.scope.snapshot(),
-        )
-        .map_err(|error| sanitize_error(error, &logical))
+        let access = ScopeAccess(self.inner.scope.snapshot());
+        fs_operation::run_grep(&self.inner.root, base, request, &access)
+            .map_err(WorkdirError::from)
+            .map_err(|error| sanitize_error(error, &logical))
     }
 
     async fn start_command(&self, request: CommandRequest) -> Result<CommandHandle, WorkdirError> {
@@ -948,6 +781,7 @@ pub fn direct_symlink(path: &Path) -> Option<SymlinkInfo> {
     }
 }
 
+#[cfg(test)]
 fn symlink_out_of_scope_or_plain(
     path: &Path,
     symlink: Option<&SymlinkInfo>,
@@ -971,6 +805,7 @@ fn symlink_out_of_scope_or_plain(
     WorkdirError::OutOfScope(path.to_path_buf())
 }
 
+#[cfg(test)]
 fn broken_symlink_error(path: &Path, info: &SymlinkInfo) -> WorkdirError {
     WorkdirError::BrokenSymlink {
         path: path.to_path_buf(),

crates/workdir/src/operation.rs

@@ -1,216 +1,5 @@
-use std::fmt;
-use std::path::{Component, Path, PathBuf};
-
 use serde::{Deserialize, Serialize};
 
-use crate::WorkdirError;
-
-/// Logical path relative to the bound Workdir root.
-#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize)]
-#[serde(transparent)]
-pub struct WorkdirPath(String);
-
-impl<'de> Deserialize<'de> for WorkdirPath {
-    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
-    where
-        D: serde::Deserializer<'de>,
-    {
-        let value = String::deserialize(deserializer)?;
-        Self::new(&value).map_err(serde::de::Error::custom)
-    }
-}
-
-impl WorkdirPath {
-    pub fn root() -> Self {
-        Self(String::new())
-    }
-
-    pub fn new(value: impl AsRef<str>) -> Result<Self, WorkdirError> {
-        let value = value.as_ref();
-        if value.is_empty() || value == "." {
-            return Ok(Self::root());
-        }
-        let path = Path::new(value);
-        if path.is_absolute() || value.contains('\\') {
-            return Err(WorkdirError::InvalidPath(value.to_owned()));
-        }
-
-        let mut normalized = PathBuf::new();
-        for component in path.components() {
-            match component {
-                Component::Normal(part) => normalized.push(part),
-                Component::CurDir => {}
-                Component::ParentDir | Component::RootDir | Component::Prefix(_) => {
-                    return Err(WorkdirError::InvalidPath(value.to_owned()));
-                }
-            }
-        }
-        let value = normalized.to_string_lossy().replace('\\', "/");
-        Ok(Self(value))
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-
-    pub fn is_root(&self) -> bool {
-        self.0.is_empty()
-    }
-}
-
-impl fmt::Display for WorkdirPath {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        if self.0.is_empty() {
-            f.write_str(".")
-        } else {
-            f.write_str(&self.0)
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct StatRequest {
-    pub path: WorkdirPath,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct StatResult {
-    pub path: WorkdirPath,
-    pub kind: EntryKind,
-    pub size: u64,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum EntryKind {
-    File,
-    Directory,
-    Symlink,
-    Other,
-}
-
-pub type ContentHash = [u8; 32];
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ReadRequest {
-    pub path: WorkdirPath,
-    pub offset: usize,
-    pub limit: usize,
-    pub max_bytes: usize,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ReadResult {
-    pub path: WorkdirPath,
-    pub bytes: Vec<u8>,
-    pub start_line: usize,
-    pub total_lines: usize,
-    pub content_hash: ContentHash,
-    pub truncated: bool,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct WriteRequest {
-    pub path: WorkdirPath,
-    pub content: Vec<u8>,
-    pub expected_hash: Option<ContentHash>,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct WriteResult {
-    pub bytes_written: usize,
-    pub created: bool,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EditRequest {
-    pub path: WorkdirPath,
-    pub old_string: String,
-    pub new_string: String,
-    pub replace_all: bool,
-    pub expected_hash: ContentHash,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct EditResult {
-    pub replacements: usize,
-    pub bytes_written: usize,
-    pub content_hash: ContentHash,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ListRequest {
-    pub path: WorkdirPath,
-    pub limit: usize,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ListEntry {
-    pub path: WorkdirPath,
-    pub kind: EntryKind,
-    pub size: u64,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ListResult {
-    pub entries: Vec<ListEntry>,
-    pub total_entries: usize,
-    pub total_bytes: u64,
-    pub truncated: bool,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct GlobRequest {
-    pub pattern: String,
-    pub path: WorkdirPath,
-    pub limit: usize,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct GlobResult {
-    pub paths: Vec<WorkdirPath>,
-    pub truncated: bool,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum GrepOutputMode {
-    Content,
-    FilesWithMatches,
-    Count,
-}
-
-impl Default for GrepOutputMode {
-    fn default() -> Self {
-        Self::FilesWithMatches
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct GrepRequest {
-    pub pattern: String,
-    pub path: WorkdirPath,
-    pub glob: Option<String>,
-    pub file_type: Option<String>,
-    pub case_insensitive: bool,
-    pub before_context: usize,
-    pub after_context: usize,
-    pub multiline: bool,
-    pub output_mode: GrepOutputMode,
-    pub limit: usize,
-    pub offset: usize,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct GrepResult {
-    /// Provider-rendered bounded grep report. Keeping rendering here avoids
-    /// transferring candidate files across a remote provider boundary.
-    pub output: String,
-    pub match_count: usize,
-    pub matched_files: usize,
-    pub truncated: bool,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(transparent)]
 pub struct CommandHandle(pub String);
@@ -248,29 +37,3 @@ pub struct CommandOutput {
     pub next_cursor: Option<usize>,
     pub truncated: bool,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::WorkdirPath;
-
-    #[test]
-    fn logical_paths_normalize_only_safe_root_relative_components() {
-        assert_eq!(
-            WorkdirPath::new("./docs//item.md").unwrap().as_str(),
-            "docs/item.md"
-        );
-        assert!(WorkdirPath::new("../secret").is_err());
-        assert!(WorkdirPath::new("docs/../secret").is_err());
-        assert!(WorkdirPath::new("/absolute").is_err());
-        assert!(WorkdirPath::new(r"..\secret").is_err());
-    }
-
-    #[test]
-    fn deserialization_cannot_bypass_logical_path_validation() {
-        let error = serde_json::from_str::<WorkdirPath>(r#""../secret""#).unwrap_err();
-        assert!(error.to_string().contains("invalid Workdir path"));
-
-        let path = serde_json::from_str::<WorkdirPath>(r#""docs/item.md""#).unwrap();
-        assert_eq!(path.as_str(), "docs/item.md");
-    }
-}

crates/workdir/src/search.rs

@@ -1,405 +0,0 @@
-use std::path::{Path, PathBuf};
-
-use grep_regex::RegexMatcherBuilder;
-use grep_searcher::sinks::UTF8 as UTF8Sink;
-use grep_searcher::{BinaryDetection, Searcher, SearcherBuilder, Sink, SinkContext, SinkMatch};
-use ignore::WalkBuilder;
-use ignore::overrides::OverrideBuilder;
-use ignore::types::TypesBuilder;
-use manifest::Scope;
-
-use crate::{GrepOutputMode, GrepRequest, GrepResult, WorkdirError, direct_symlink};
-
-struct ContentLine {
-    path: PathBuf,
-    line_number: Option<u64>,
-    text: String,
-    is_match: bool,
-}
-
-struct GrepReport {
-    mode: GrepOutputMode,
-    show_line_numbers: bool,
-    files: Vec<PathBuf>,
-    counts: Vec<(PathBuf, usize)>,
-    lines: Vec<ContentLine>,
-    truncated: bool,
-}
-
-impl GrepReport {
-    fn into_result(self, root: &Path) -> GrepResult {
-        let (match_count, matched_files) = match self.mode {
-            GrepOutputMode::FilesWithMatches => (self.files.len(), self.files.len()),
-            GrepOutputMode::Count => (
-                self.counts.iter().map(|(_, count)| *count).sum(),
-                self.counts.len(),
-            ),
-            GrepOutputMode::Content => (
-                self.lines.iter().filter(|line| line.is_match).count(),
-                self.lines
-                    .iter()
-                    .map(|line| line.path.as_path())
-                    .collect::<std::collections::BTreeSet<_>>()
-                    .len(),
-            ),
-        };
-        let mut output = String::new();
-        match self.mode {
-            GrepOutputMode::FilesWithMatches => {
-                for path in &self.files {
-                    output.push_str(&logical_display(root, path));
-                    output.push('\n');
-                }
-            }
-            GrepOutputMode::Count => {
-                for (path, count) in &self.counts {
-                    output.push_str(&format!("{}:{count}\n", logical_display(root, path)));
-                }
-            }
-            GrepOutputMode::Content => {
-                for line in &self.lines {
-                    let separator = if line.is_match { ':' } else { '-' };
-                    let path = logical_display(root, &line.path);
-                    if self.show_line_numbers
-                        && let Some(number) = line.line_number
-                    {
-                        output.push_str(&format!(
-                            "{path}{separator}{number}{separator}{}\n",
-                            line.text
-                        ));
-                    } else {
-                        output.push_str(&format!("{path}{separator}{}\n", line.text));
-                    }
-                }
-            }
-        }
-        GrepResult {
-            output,
-            match_count,
-            matched_files,
-            truncated: self.truncated,
-        }
-    }
-}
-
-fn logical_display(root: &Path, path: &Path) -> String {
-    path.strip_prefix(root)
-        .unwrap_or(path)
-        .to_string_lossy()
-        .replace('\\', "/")
-}
-
-const DEFAULT_HEAD_LIMIT: usize = 250;
-
-struct GrepParams {
-    pattern: String,
-    path: Option<PathBuf>,
-    glob: Option<String>,
-    file_type: Option<String>,
-    case_insensitive: bool,
-    before: Option<usize>,
-    after: Option<usize>,
-    context: Option<usize>,
-    line_numbers: Option<bool>,
-    multiline: bool,
-    output_mode: Option<GrepOutputMode>,
-    head_limit: Option<usize>,
-    offset: Option<usize>,
-}
-
-pub(crate) fn run_grep(
-    root: &Path,
-    base: PathBuf,
-    request: GrepRequest,
-    scope: &Scope,
-) -> Result<GrepResult, WorkdirError> {
-    let p = GrepParams {
-        pattern: request.pattern,
-        path: Some(base.clone()),
-        glob: request.glob,
-        file_type: request.file_type,
-        case_insensitive: request.case_insensitive,
-        before: Some(request.before_context),
-        after: Some(request.after_context),
-        context: None,
-        line_numbers: Some(true),
-        multiline: request.multiline,
-        output_mode: Some(request.output_mode),
-        head_limit: Some(request.limit),
-        offset: Some(request.offset),
-    };
-    let matcher = RegexMatcherBuilder::new()
-        .case_insensitive(p.case_insensitive)
-        .multi_line(p.multiline)
-        .dot_matches_new_line(p.multiline)
-        .build(&p.pattern)
-        .map_err(|e| WorkdirError::InvalidRegex(e.to_string()))?;
-
-    let (before, after) = match (p.before, p.after, p.context) {
-        (_, _, Some(c)) => (c, c),
-        (b, a, None) => (b.unwrap_or(0), a.unwrap_or(0)),
-    };
-
-    let mut sb = SearcherBuilder::new();
-    sb.binary_detection(BinaryDetection::quit(b'\x00'))
-        .line_number(p.line_numbers.unwrap_or(true))
-        .multi_line(p.multiline)
-        .before_context(before)
-        .after_context(after);
-    let mut searcher = sb.build();
-
-    let base = p.path.unwrap_or(base);
-    if !base.is_absolute() {
-        return Err(WorkdirError::RelativePath(base));
-    }
-    let symlink = direct_symlink(&base);
-    if !scope.is_readable(&base) {
-        return Err(if let Some(info) = symlink.as_ref() {
-            let link_parent_readable = info
-                .link_path
-                .parent()
-                .map(|parent| scope.is_readable(parent))
-                .unwrap_or(false);
-            if info.target_exists && link_parent_readable {
-                WorkdirError::SymlinkOutOfScope {
-                    path: base.clone(),
-                    target: info.resolved_path.clone(),
-                    required_permission: "read",
-                }
-            } else {
-                WorkdirError::OutOfScope(base.clone())
-            }
-        } else {
-            WorkdirError::OutOfScope(base.clone())
-        });
-    }
-    if let Some(info) = symlink.as_ref() {
-        if !info.target_exists {
-            return Err(WorkdirError::BrokenSymlink {
-                path: base.clone(),
-                link: info.link_path.clone(),
-                target: info.target_path.clone(),
-            });
-        }
-    }
-    let base_meta = std::fs::metadata(&base).map_err(|e| match e.kind() {
-        std::io::ErrorKind::NotFound => WorkdirError::NotFound(base.clone()),
-        _ => WorkdirError::io(&base, e),
-    })?;
-    if !base_meta.is_dir() {
-        return Err(WorkdirError::InvalidArgument(format!(
-            "grep search path is not a directory: {}",
-            base.display()
-        )));
-    }
-    if let Some(info) = symlink.as_ref() {
-        return Err(WorkdirError::SymlinkDirectoryNotTraversed {
-            tool: "Grep",
-            path: base.clone(),
-            target: info.resolved_path.clone(),
-        });
-    }
-
-    let mut wb = WalkBuilder::new(&base);
-    wb.hidden(true)
-        .git_ignore(true)
-        .git_global(true)
-        .git_exclude(true)
-        .ignore(true)
-        .parents(true)
-        .follow_links(false);
-
-    if let Some(t) = p.file_type.as_deref() {
-        let mut tb = TypesBuilder::new();
-        tb.add_defaults();
-        tb.select(t);
-        let types = tb
-            .build()
-            .map_err(|e| WorkdirError::InvalidArgument(format!("invalid type {t}: {e}")))?;
-        wb.types(types);
-    }
-    if let Some(g) = p.glob.as_deref() {
-        let mut ob = OverrideBuilder::new(&base);
-        ob.add(g)
-            .map_err(|e| WorkdirError::InvalidGlob(e.to_string()))?;
-        let ov = ob
-            .build()
-            .map_err(|e| WorkdirError::InvalidGlob(e.to_string()))?;
-        wb.overrides(ov);
-    }
-
-    let mode = p.output_mode.unwrap_or_default();
-    let head_limit = p.head_limit.unwrap_or(DEFAULT_HEAD_LIMIT);
-    let offset = p.offset.unwrap_or(0);
-    let show_line_numbers = p.line_numbers.unwrap_or(true);
-
-    let mut report = GrepReport {
-        mode,
-        show_line_numbers,
-        files: Vec::new(),
-        counts: Vec::new(),
-        lines: Vec::new(),
-        truncated: false,
-    };
-
-    // Per-mode walker state.
-    let mut matching_files_seen: usize = 0;
-    let mut matches_seen: usize = 0;
-
-    'walker: for entry in wb.build().flatten() {
-        if !entry.file_type().map(|t| t.is_file()).unwrap_or(false) {
-            continue;
-        }
-        let path = entry.path();
-        if !scope.is_readable(path) {
-            continue;
-        }
-
-        match mode {
-            GrepOutputMode::FilesWithMatches => {
-                let hit = scan_any_match(&mut searcher, &matcher, path)?;
-                if !hit {
-                    continue;
-                }
-                if matching_files_seen >= offset {
-                    report.files.push(path.to_path_buf());
-                    if report.files.len() >= head_limit {
-                        report.truncated = true;
-                        break 'walker;
-                    }
-                }
-                matching_files_seen += 1;
-            }
-            GrepOutputMode::Count => {
-                let count = scan_count(&mut searcher, &matcher, path)?;
-                if count == 0 {
-                    continue;
-                }
-                if matching_files_seen >= offset {
-                    report.counts.push((path.to_path_buf(), count));
-                    if report.counts.len() >= head_limit {
-                        report.truncated = true;
-                        break 'walker;
-                    }
-                }
-                matching_files_seen += 1;
-            }
-            GrepOutputMode::Content => {
-                let before_count = matches_seen;
-                let mut sink = ContentSink {
-                    path: path.to_path_buf(),
-                    lines: &mut report.lines,
-                    matches_seen: &mut matches_seen,
-                    offset,
-                    head_limit,
-                };
-                searcher
-                    .search_path(&matcher, path, &mut sink)
-                    .map_err(|e| WorkdirError::io(path, e))?;
-                // If we hit head_limit during this file, stop walking.
-                if matches_seen >= offset.saturating_add(head_limit) && matches_seen > before_count
-                {
-                    report.truncated = true;
-                    break 'walker;
-                }
-            }
-        }
-    }
-
-    Ok(report.into_result(root))
-}
-
-fn scan_any_match(
-    searcher: &mut Searcher,
-    matcher: &grep_regex::RegexMatcher,
-    path: &Path,
-) -> Result<bool, WorkdirError> {
-    let mut hit = false;
-    let sink = UTF8Sink(|_, _| {
-        hit = true;
-        Ok(false) // stop searching this file immediately
-    });
-    searcher
-        .search_path(matcher, path, sink)
-        .map_err(|e| WorkdirError::io(path, e))?;
-    Ok(hit)
-}
-
-fn scan_count(
-    searcher: &mut Searcher,
-    matcher: &grep_regex::RegexMatcher,
-    path: &Path,
-) -> Result<usize, WorkdirError> {
-    let mut count = 0usize;
-    let sink = UTF8Sink(|_, _| {
-        count += 1;
-        Ok(true)
-    });
-    searcher
-        .search_path(matcher, path, sink)
-        .map_err(|e| WorkdirError::io(path, e))?;
-    Ok(count)
-}
-
-struct ContentSink<'a> {
-    path: PathBuf,
-    lines: &'a mut Vec<ContentLine>,
-    matches_seen: &'a mut usize,
-    offset: usize,
-    head_limit: usize,
-}
-
-impl Sink for ContentSink<'_> {
-    type Error = std::io::Error;
-
-    fn matched(&mut self, _searcher: &Searcher, mat: &SinkMatch<'_>) -> Result<bool, Self::Error> {
-        let idx = *self.matches_seen;
-        *self.matches_seen += 1;
-
-        // Skip matches before offset.
-        if idx < self.offset {
-            return Ok(true);
-        }
-        // Stop searching this file once we've filled the head_limit.
-        if idx >= self.offset.saturating_add(self.head_limit) {
-            return Ok(false);
-        }
-
-        let text = String::from_utf8_lossy(mat.bytes())
-            .trim_end_matches('\n')
-            .trim_end_matches('\r')
-            .to_string();
-        self.lines.push(ContentLine {
-            path: self.path.clone(),
-            line_number: mat.line_number(),
-            text,
-            is_match: true,
-        });
-        Ok(true)
-    }
-
-    fn context(
-        &mut self,
-        _searcher: &Searcher,
-        ctx: &SinkContext<'_>,
-    ) -> Result<bool, Self::Error> {
-        let seen = *self.matches_seen;
-        if seen < self.offset {
-            return Ok(true);
-        }
-        if seen >= self.offset.saturating_add(self.head_limit) {
-            return Ok(false);
-        }
-        let text = String::from_utf8_lossy(ctx.bytes())
-            .trim_end_matches('\n')
-            .trim_end_matches('\r')
-            .to_string();
-        self.lines.push(ContentLine {
-            path: self.path.clone(),
-            line_number: ctx.line_number(),
-            text,
-            is_match: false,
-        });
-        Ok(true)
-    }
-}