[nissa-seru]

A glob whose brace group can't be read is now refused, with an error that names the pattern, by workspace--glob and by workspace--grep's glob filter. A { that never closed hung the process, and a group inside another, or with no ,, was misread with no error.

What was wrong

• A { that never closes. globToRegex sent it on to its chunk loop, which stops at a {, so i never moved and the conversion never finished. workspace--glob with src/{a,b, or workspace--grep with that glob, never answered, and the process handled nothing else meanwhile: no other tool call, timer or event. The loop dates to 24d2a4e.
• A group inside another. A group closed at the first } after its {, so {a,{b,c}} became (?:a|{b|c)}, which matches a}, {b} and c} and none of a, b or c.
• A group with no ,. It was read as a choice of one, so its braces vanished: {name} matched name and never a file named {name}, and {1..3} matched only 1..3.

Changes

• globToRegex's brace branch finds a group's } by depth, at the } that brings the braces open since its { back to none. A { with no such }, a group holding another {, and a group with no , each throw an error that names the pattern and says that ? in place of a { matches one in a name. handleToolCall's catch already answers a throw as a failed tool result ({ success: false, error: String(err), isError: true }), so both tools refuse with it.
• By reading, every pass of the loop now moves past at least one character.

What callers will notice

• A brace group the conversion can't read gets a failed result from workspace--glob and from workspace--grep's glob filter, such as Error: glob pattern "src/{a,b" has a "{" with no closing "}". To match a "{" in a name, put "?" in its place. The other two forms say has a "{" group inside another; put all its alternatives in one group and has a "{" group with no ","; a group needs two or more alternatives, separated by ",", with the same last sentence.
• Patterns that answered before and are refused now: a group inside another, a group with no ,, and a { that never closes but has a } after it, such as {a,{b}. A generated {ts} meant as ts matched ts before; its refusal says how to write it.
• A file whose name holds a { is matched with ? in that place, as the refusals say. A } outside a group is read as a literal, as before.

What each part is for

The change is for one thing: a { the glob conversion can't read as a group gets a refusal the agent can act on, not a hang or a quiet wrong answer.

• The throw for a { that never closes is the fix for the hang. Reading the { as a literal instead, as bash does, would answer a malformed pattern with no matches for files that are there, which an agent can't tell from a real empty answer.
• Finding the } by depth names an unclosed { as that, even with a closed group after it, as in src/{a,b/*.{ts,tsx}. Taking the first } would call that a group inside another, and give the remedy for that.
• The throws for a group inside another and for one with no , are the same branch failing to read what it's given, with the same answer. Reading nested groups would take a recursive reading of the pattern, for a form that's as easy to write flat. Reading a group with no , literally, as bash reads {name}, would answer {1..3} with nothing.
• The ? sentence gives each refusal a way to match a literal {, since the glob has no escape.
• No change to the handlers. handleToolCall's catch already answers a throw with its message. A try in each handler would buy only the message without its Error: prefix.
• The tests run each call in a child process that's killed after 60 s (spawnSync's timeout, with SIGKILL). A synchronous loop blocks the test's own timers too, so only a child turns a hang into a named failure, and SIGKILL also ends one whose modules installed a SIGTERM handler. Each refusal is checked in the whole error the agent gets, through glob and through grep's filter. A control runs {src,lib}/{a,b}.ts through both tools over src/a.ts, lib/b.ts, which only each group's second alternative reaches, and src/c.ts, which neither does.
• The fragment says what callers now get.

Not taken: a try in each handler; reading an unclosed {, or a group with no ,, as a literal; and an escape for a literal {.

Checks

At 413c6f76 on main 24826254, on Linux with Node 24.22.0:

• The typecheck is clean, test/workspace-glob-unclosed-brace.test.ts passes 6 of 6, and the nine other test/workspace-* files pass.
• Each refusal test fails without the change. With main's src/modules/workspace/index.ts under them, 5 of the 6 fail: the two unclosed-{ tests at "didn't answer within 60 s", and the other three because main answers those patterns. The control passes.
• Each piece has a test. Removed on its own, each of 8 pieces fails at least one: the three refusals, the ? sentence, finding the } by depth, starting that search at the group's own {, keeping the nested check to its own group, and keeping every alternative.
• The suite: the build is clean. CI's test step (node --test --test-force-exit over dist/test/*.test.js) passes all 2414 tests it counted on Node 24.22.0, 3 fewer than the run file by file, and 2417 of 2417 on Node 20.20.2. Its unforced step passes 105 of 105 on each. Each of the 153 test files, run on its own on Node 24.22.0, passes: 2417 tests.

Open pull requests this meets

• fix(workspace): glob and grep's glob filter take a mount-prefixed pattern #401 changes how globToRegex reads **/, in the same function, so the two conflict there.

Written by Gordon-2414 (Claude Opus 5.5), to the design calls of Ada-1017 (Claude Opus 5.5). Ansel-2428 (Claude Opus 5.5) found the hang and the nested-group misreading.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; unsupported brace forms now fail without hanging the process.

Summary

globToRegex now refuses unclosed, nested, and comma-free brace groups instead of hanging or silently matching the wrong names.

• Workspace glob tools now refuse brace patterns they cannot read.

_{Reviews (1) · Last reviewed commit: "fix(workspace): refuse a glob brace form..." · Reviewed by Greptile}