fix(grep): bound recursive searches and skip directory cycles

[chaliy]

What changed

Recursive grep skips symlinks resolving to an ancestor, scans one file at a time, and stops traversal when -q finds a match. Traversal, retained directory/index paths, and file input use the existing shared execution budget and live-byte leases. Sibling aliases remain independent searches. Canonical resolution is shared with find; diagnostics preserve GNU wording and a UTF-8-safe 1 KiB cap.

Why

Fixes Codex Security finding commit:882c2e7c8e488191b9d8fb8bb341118e: two self-links could exponentially amplify traversal and retained copies of the same file before scanning. Per-lookup symlink hop limits did not bound the overall walk.

Before / After

A safe single-link regression (mkdir /d; echo x > /d/f; ln -s . /d/a; grep -R x /d) printed the same file 41 times before the fix. It now prints /d/f:x once and warns grep: /d/a: warning: recursive directory loop, exiting 0. All three initial tests failed before the fix (cycle revisits, traversal work, and live file admission).

The reported two-link layout now completes: grep -Rq x /d returns 0; a nonmatching search returns 1 with one warning per cyclic link. No resource-exhausting unpatched two-link run was executed. GNU grep 3.11 comparison: 104/104 cases match, including the new cycle and sibling-alias cases.

Validation:

• cargo test -p bashkit --lib --bins --tests --features http_client,ssh,sqlite: 4,753 passed; all nine new resource/cycle regressions passed.
• Single-threaded fail-point suite: 19 passed; feature-sliced doc tests: 153 passed.
• Formatting, all-target/all-feature clippy, cargo deny check, cargo vet --locked, 150 script tests, OKF, docs, workflow, and capability checks passed.
• CLI smoke, Criterion parallel-execution benchmark, and just bench passed (96 cases, zero errors, 100% output match).
• Rustdoc generated and opened; existing feature-gated link warnings remain.

Local just pre-pr and just test hit an unrelated macOS stack overflow in misconfig_huge_ast_depth_still_safe when the whole workspace combines runtime features. The exact test also aborts on untouched main f286bf332c6eadcda068c645077432d7da7f729d; it passes with default features and in the feature slice above. Its test and limits are unchanged. Required PR CI must pass before merge.

Risk

Medium: resource limits now apply during recursive search, so oversized searches can terminate earlier. Traversal order remains deterministic files-first/name order (the existing GNU readdir-order limitation). Host/custom filesystem backends retain responsibility for concurrent read allocation; VFS file admission occurs before cloning contents.

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	54471aa	Commit Preview URL Branch Preview URL	Oct 08 2026, 01:32 AM