agpm_cli/

pattern.rs

//! Pattern-based dependency resolution for AGPM.
//!
//! This module provides glob pattern matching functionality to support
//! pattern-based dependencies in AGPM manifests. Pattern dependencies
//! allow installation of multiple resources matching a glob pattern,
//! enabling bulk operations on related resources.
//!
//! # Pattern Syntax
//!
//! AGPM uses standard glob patterns with the following support:
//!
//! - `*` matches any sequence of characters within a single path component
//! - `**` matches any sequence of path components (recursive matching)
//! - `?` matches any single character
//! - `[abc]` matches any character in the set
//! - `[a-z]` matches any character in the range
//! - `{foo,bar}` matches either "foo" or "bar" (brace expansion)
//!
//! # Examples
//!
//! ## Common Pattern Usage
//!
//! ```toml
//! # Install all agents in the agents/ directory
//! [agents]
//! ai-helpers = { source = "community", path = "agents/*.md", version = "v1.0.0" }
//!
//! # Install all review-related agents recursively
//! review-tools = { source = "community", path = "**/review*.md", version = "v1.0.0" }
//!
//! # Install specific agent categories
//! python-agents = { source = "community", path = "agents/python-*.md", version = "v1.0.0" }
//! ```
//!
//! ## Security Considerations
//!
//! Pattern matching includes several security measures:
//!
//! - **Path Traversal Prevention**: Patterns containing `..` are rejected
//! - **Absolute Path Restriction**: Patterns starting with `/` or containing drive letters are rejected
//! - **Symlink Safety**: Pattern matching does not follow symlinks to prevent directory traversal
//! - **Input Validation**: All patterns are validated before processing
//!
//! # Performance
//!
//! Pattern matching is optimized for typical repository structures:
//!
//! - **Recursive Traversal**: Uses `walkdir` for efficient directory traversal
//! - **Pattern Caching**: Compiled glob patterns are reused across matches
//! - **Early Termination**: Stops on first match when appropriate
//! - **Memory Efficient**: Streaming approach for large directory trees

use anyhow::{Context, Result};
use glob::Pattern;
use std::collections::HashSet;
use std::path::{Path, PathBuf};
use tracing::{debug, trace};
use walkdir::WalkDir;

/// Pattern matcher for resource discovery in repositories.
///
/// The `PatternMatcher` provides glob pattern matching capabilities for
/// discovering resources in Git repositories and local directories. It supports
/// standard glob patterns and handles cross-platform path matching.
///
/// # Thread Safety
///
/// `PatternMatcher` is thread-safe and can be cloned for use in concurrent contexts.
///
/// # Examples
///
/// ```rust,no_run
/// use agpm_cli::pattern::PatternMatcher;
/// use std::path::Path;
///
/// # fn example() -> anyhow::Result<()> {
/// let matcher = PatternMatcher::new("agents/*.md")?;
///
/// // Check if a path matches
/// assert!(matcher.matches(Path::new("agents/helper.md")));
/// assert!(!matcher.matches(Path::new("snippets/code.md")));
///
/// // Find all matches in a directory
/// let matches = matcher.find_matches(Path::new("/path/to/repo"))?;
/// println!("Found {} matching files", matches.len());
/// # Ok(())
/// # }
/// ```
#[derive(Debug, Clone)]
pub struct PatternMatcher {
    pattern: Pattern,
    original_pattern: String,
}

impl PatternMatcher {
    /// Creates a new pattern matcher from a glob pattern string.
    ///
    /// The pattern is compiled once during creation for efficient matching.
    /// Invalid glob patterns will return an error.
    ///
    /// # Arguments
    ///
    /// * `pattern_str` - A glob pattern string (e.g., "*.md", "**/*.py")
    ///
    /// # Returns
    ///
    /// A new `PatternMatcher` instance ready for matching operations.
    ///
    /// # Errors
    ///
    /// Returns an error if:
    /// - The pattern contains invalid glob syntax
    /// - The pattern is malformed or contains unsupported features
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternMatcher;
    ///
    /// // Simple wildcard
    /// let matcher = PatternMatcher::new("*.md")?;
    ///
    /// // Recursive matching
    /// let matcher = PatternMatcher::new("**/docs/*.md")?;
    ///
    /// // Character classes
    /// let matcher = PatternMatcher::new("agent[0-9].md")?;
    /// # Ok::<(), anyhow::Error>(())
    /// ```
    pub fn new(pattern_str: &str) -> Result<Self> {
        let pattern = Pattern::new(pattern_str)
            .with_context(|| format!("Invalid glob pattern: {pattern_str}"))?;

        Ok(Self {
            pattern,
            original_pattern: pattern_str.to_string(),
        })
    }

    /// Finds all files matching the pattern in the specified directory.
    ///
    /// This method recursively traverses the directory tree and returns all
    /// files that match the compiled pattern. The search is performed relative
    /// to the base path, ensuring portable pattern matching across platforms.
    ///
    /// # Security
    ///
    /// This method includes security measures:
    /// - Does not follow symlinks to prevent directory traversal attacks
    /// - Returns relative paths to prevent information disclosure
    /// - Handles permission errors gracefully
    ///
    /// # Arguments
    ///
    /// * `base_path` - The directory to search in (must exist)
    ///
    /// # Returns
    ///
    /// A vector of relative paths (from `base_path`) that match the pattern.
    /// Paths are returned as `PathBuf` for easy manipulation.
    ///
    /// # Errors
    ///
    /// Returns an error if:
    /// - The base path does not exist or cannot be accessed
    /// - The base path cannot be canonicalized
    /// - Permission errors occur during directory traversal
    /// - I/O errors prevent directory reading
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternMatcher;
    /// use std::path::Path;
    ///
    /// # async fn example() -> anyhow::Result<()> {
    /// let matcher = PatternMatcher::new("**/*.md")?;
    /// let matches = matcher.find_matches(Path::new("/repo"))?;
    ///
    /// for path in matches {
    ///     println!("Found: {}", path.display());
    /// }
    /// # Ok(())
    /// # }
    /// ```
    pub fn find_matches(&self, base_path: &Path) -> Result<Vec<PathBuf>> {
        debug!("Searching for pattern '{}' in {:?}", self.original_pattern, base_path);

        let mut matches = Vec::new();
        let base_path = base_path
            .canonicalize()
            .with_context(|| format!("Failed to canonicalize path: {base_path:?}"))?;

        for entry in WalkDir::new(&base_path)
            .follow_links(false) // Security: don't follow symlinks
            .into_iter()
            .filter_map(std::result::Result::ok)
        {
            let path = entry.path();

            // Get relative path for pattern matching
            if let Ok(relative_path) = path.strip_prefix(&base_path) {
                let relative_str = relative_path.to_string_lossy();

                trace!("Checking path: {}", relative_str);

                if self.pattern.matches(&relative_str) {
                    debug!("Found match: {}", relative_str);
                    matches.push(relative_path.to_path_buf());
                }
            }
        }

        debug!("Found {} matches for pattern '{}'", matches.len(), self.original_pattern);
        Ok(matches)
    }

    /// Checks if a single path matches the compiled pattern.
    ///
    /// This is a lightweight operation that checks if the given path
    /// matches the pattern without filesystem access. Useful for filtering
    /// or validation operations.
    ///
    /// # Arguments
    ///
    /// * `path` - The path to test against the pattern
    ///
    /// # Returns
    ///
    /// `true` if the path matches the pattern, `false` otherwise.
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternMatcher;
    /// use std::path::Path;
    ///
    /// # fn example() -> anyhow::Result<()> {
    /// let matcher = PatternMatcher::new("agents/*.md")?;
    ///
    /// assert!(matcher.matches(Path::new("agents/helper.md")));
    /// assert!(matcher.matches(Path::new("agents/reviewer.md")));
    /// assert!(!matcher.matches(Path::new("snippets/code.md")));
    /// assert!(!matcher.matches(Path::new("agents/nested/deep.md")));
    /// # Ok(())
    /// # }
    /// ```
    pub fn matches(&self, path: &Path) -> bool {
        let path_str = path.to_string_lossy();
        self.pattern.matches(&path_str)
    }

    /// Returns the original pattern string used to create this matcher.
    ///
    /// Useful for logging, debugging, or displaying the pattern to users.
    ///
    /// # Returns
    ///
    /// The original pattern string as provided to [`PatternMatcher::new`].
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternMatcher;
    ///
    /// # fn example() -> anyhow::Result<()> {
    /// let pattern_str = "**/*.md";
    /// let matcher = PatternMatcher::new(pattern_str)?;
    ///
    /// assert_eq!(matcher.pattern(), pattern_str);
    /// # Ok(())
    /// # }
    /// ```
    pub fn pattern(&self) -> &str {
        &self.original_pattern
    }
}

/// Resolves pattern-based dependencies to concrete file paths.
///
/// The `PatternResolver` provides advanced pattern matching with exclusion
/// support and deterministic ordering. It's designed for resolving
/// pattern-based dependencies in AGPM manifests to concrete resource files.
///
/// # Features
///
/// - **Exclusion Patterns**: Support for excluding specific patterns from results
/// - **Deterministic Ordering**: Results are always returned in sorted order
/// - **Deduplication**: Automatically removes duplicate paths from results
/// - **Multiple Pattern Support**: Can resolve multiple patterns in one operation
///
/// # Examples
///
/// ```rust,no_run
/// use agpm_cli::pattern::PatternResolver;
/// use std::path::Path;
///
/// # fn example() -> anyhow::Result<()> {
/// let mut resolver = PatternResolver::new();
///
/// // Add exclusion patterns
/// resolver.exclude("**/test_*.md")?;
/// resolver.exclude("**/.*")?; // Exclude hidden files
///
/// // Resolve pattern with exclusions applied
/// let matches = resolver.resolve("**/*.md", Path::new("/repo"))?;
/// println!("Found {} files (excluding test files and hidden files)", matches.len());
/// # Ok(())
/// # }
/// ```
pub struct PatternResolver {
    /// Patterns to exclude from matching
    exclude_patterns: Vec<Pattern>,
}

impl PatternResolver {
    /// Creates a new pattern resolver with no exclusions.
    ///
    /// The resolver starts with an empty exclusion list. Use [`exclude`]
    /// to add patterns that should be filtered out of results.
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternResolver;
    ///
    /// let resolver = PatternResolver::new();
    /// // PatternResolver starts with no exclusions
    /// ```
    ///
    /// [`exclude`]: PatternResolver::exclude
    pub const fn new() -> Self {
        Self {
            exclude_patterns: Vec::new(),
        }
    }

    /// Adds an exclusion pattern to filter out unwanted results.
    ///
    /// Files matching exclusion patterns will be removed from resolution
    /// results. Exclusions are applied after the main pattern matching,
    /// making them useful for filtering out test files, hidden files,
    /// or other unwanted resources.
    ///
    /// # Arguments
    ///
    /// * `pattern` - A glob pattern for files to exclude
    ///
    /// # Errors
    ///
    /// Returns an error if the exclusion pattern is invalid glob syntax.
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternResolver;
    ///
    /// # fn example() -> anyhow::Result<()> {
    /// let mut resolver = PatternResolver::new();
    ///
    /// // Exclude test files
    /// resolver.exclude("**/test_*.md")?;
    /// resolver.exclude("**/*_test.md")?;
    ///
    /// // Exclude hidden files
    /// resolver.exclude("**/.*")?;
    ///
    /// // Exclude backup files
    /// resolver.exclude("**/*.bak")?;
    /// resolver.exclude("**/*~")?;
    /// # Ok(())
    /// # }
    /// ```
    pub fn exclude(&mut self, pattern: &str) -> Result<()> {
        let pattern = Pattern::new(pattern)
            .with_context(|| format!("Invalid exclusion pattern: {pattern}"))?;
        self.exclude_patterns.push(pattern);
        Ok(())
    }

    /// Resolves a pattern to a list of resource paths with exclusions applied.
    ///
    /// This is the primary method for pattern resolution. It finds all files
    /// matching the pattern, applies exclusion filters, removes duplicates,
    /// and returns results in deterministic sorted order.
    ///
    /// # Algorithm
    ///
    /// 1. Use `PatternMatcher` to find all files matching the pattern
    /// 2. Filter out any files matching exclusion patterns
    /// 3. Remove duplicates (though unlikely with file paths)
    /// 4. Sort results for deterministic ordering
    ///
    /// # Arguments
    ///
    /// * `pattern` - The glob pattern to match files against
    /// * `base_path` - The directory to search within
    ///
    /// # Returns
    ///
    /// A vector of `PathBuf` objects representing matching files,
    /// sorted in lexicographic order for deterministic results.
    ///
    /// # Errors
    ///
    /// Returns an error if:
    /// - The pattern is invalid glob syntax
    /// - The base path doesn't exist or can't be accessed
    /// - I/O errors occur during directory traversal
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternResolver;
    /// use std::path::Path;
    ///
    /// # fn example() -> anyhow::Result<()> {
    /// let mut resolver = PatternResolver::new();
    /// resolver.exclude("**/test_*.md")?;
    ///
    /// let matches = resolver.resolve("agents/*.md", Path::new("/repo"))?;
    /// for path in &matches {
    ///     println!("Agent: {}", path.display());
    /// }
    /// # Ok(())
    /// # }
    /// ```
    pub fn resolve(&self, pattern: &str, base_path: &Path) -> Result<Vec<PathBuf>> {
        let matcher = PatternMatcher::new(pattern)?;
        let mut matched_paths = matcher.find_matches(base_path)?;

        // Apply exclusions
        if !self.exclude_patterns.is_empty() {
            matched_paths.retain(|path| {
                let path_str = path.to_string_lossy();
                !self.exclude_patterns.iter().any(|exclude| exclude.matches(&path_str))
            });
        }

        // Sort for deterministic ordering
        matched_paths.sort();

        Ok(matched_paths)
    }

    /// Resolves multiple patterns and returns unique results.
    ///
    /// This method combines results from multiple pattern resolutions,
    /// automatically deduplicating any files that match multiple patterns.
    /// Useful for installing resources from multiple pattern-based dependencies.
    ///
    /// # Arguments
    ///
    /// * `patterns` - A slice of pattern strings to resolve
    /// * `base_path` - The directory to search within
    ///
    /// # Returns
    ///
    /// A vector of unique `PathBuf` objects representing all files that
    /// match any of the provided patterns, sorted for deterministic results.
    ///
    /// # Errors
    ///
    /// Returns an error if any pattern is invalid or if directory access fails.
    ///
    /// # Examples
    ///
    /// ```rust,no_run
    /// use agpm_cli::pattern::PatternResolver;
    /// use std::path::Path;
    ///
    /// # fn example() -> anyhow::Result<()> {
    /// let resolver = PatternResolver::new();
    /// let patterns = vec![
    ///     "agents/*.md".to_string(),
    ///     "helpers/*.md".to_string(),
    ///     "tools/*.md".to_string(),
    /// ];
    ///
    /// let matches = resolver.resolve_multiple(&patterns, Path::new("/repo"))?;
    /// println!("Found {} unique resources", matches.len());
    /// # Ok(())
    /// # }
    /// ```
    pub fn resolve_multiple(&self, patterns: &[String], base_path: &Path) -> Result<Vec<PathBuf>> {
        let mut all_matches = HashSet::new();

        for pattern in patterns {
            let matches = self.resolve(pattern, base_path)?;
            all_matches.extend(matches);
        }

        let mut result: Vec<_> = all_matches.into_iter().collect();
        result.sort();

        Ok(result)
    }
}

impl Default for PatternResolver {
    fn default() -> Self {
        Self::new()
    }
}

/// Extracts a resource name from a file path.
///
/// This function determines an appropriate resource name by extracting
/// the file stem (filename without extension) from the path. This is
/// used when generating resource names for pattern-based dependencies.
///
/// # Arguments
///
/// * `path` - The file path to extract a name from
///
/// # Returns
///
/// The file stem as a string, or "unknown" if the path has no filename.
///
/// # Examples
///
/// ```rust,no_run
/// use agpm_cli::pattern::extract_resource_name;
/// use std::path::Path;
///
/// assert_eq!(extract_resource_name(Path::new("agents/helper.md")), "helper");
/// assert_eq!(extract_resource_name(Path::new("/path/to/script.py")), "script");
/// assert_eq!(extract_resource_name(Path::new("no-extension")), "no-extension");
/// assert_eq!(extract_resource_name(Path::new("/")), "unknown");
/// ```
pub fn extract_resource_name(path: &Path) -> String {
    path.file_stem().and_then(|s| s.to_str()).unwrap_or("unknown").to_string()
}

/// Validates that a pattern is safe and doesn't contain path traversal attempts.
///
/// This security function prevents malicious patterns that could access
/// files outside the intended directory boundaries. It checks for common
/// path traversal patterns and absolute paths that could escape the
/// repository or project directory.
///
/// # Security Checks
///
/// - **Path Traversal**: Rejects patterns containing `..` components
/// - **Absolute Paths (Unix)**: Rejects patterns starting with `/`
/// - **Absolute Paths (Windows)**: Rejects patterns containing `:` or starting with `\`
///
/// # Arguments
///
/// * `pattern` - The glob pattern to validate
///
/// # Returns
///
/// `Ok(())` if the pattern is safe to use.
///
/// # Errors
///
/// Returns an error if the pattern contains dangerous components:
/// - Path traversal attempts (`../`, `../../`, etc.)
/// - Absolute paths (`/etc/passwd`, `C:\Windows\`, etc.)
/// - UNC paths on Windows (`\\server\share`)
///
/// # Examples
///
/// ```rust,no_run
/// use agpm_cli::pattern::validate_pattern_safety;
///
/// // Safe patterns
/// assert!(validate_pattern_safety("*.md").is_ok());
/// assert!(validate_pattern_safety("agents/*.md").is_ok());
/// assert!(validate_pattern_safety("**/*.md").is_ok());
///
/// // Unsafe patterns
/// assert!(validate_pattern_safety("../etc/passwd").is_err());
/// # #[cfg(unix)]
/// # assert!(validate_pattern_safety("/etc/*").is_err());
/// # #[cfg(windows)]
/// # assert!(validate_pattern_safety("C:\\Windows\\*").is_err());
/// ```
pub fn validate_pattern_safety(pattern: &str) -> Result<()> {
    // Check for path traversal attempts
    if pattern.contains("..") {
        anyhow::bail!("Pattern contains path traversal (..): {pattern}");
    }

    // Check for absolute paths on Unix
    if cfg!(unix) && pattern.starts_with('/') {
        anyhow::bail!("Pattern contains absolute path: {pattern}");
    }

    // Check for absolute paths on Windows
    if cfg!(windows) && (pattern.contains(':') || pattern.starts_with('\\')) {
        anyhow::bail!("Pattern contains absolute path: {pattern}");
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::fs;
    use tempfile::TempDir;

    #[test]
    fn test_pattern_matcher_creation_and_basic_matching() {
        let pattern = PatternMatcher::new("*.md").unwrap();

        assert!(pattern.matches(Path::new("test.md")));
        assert!(pattern.matches(Path::new("README.md")));
        assert!(!pattern.matches(Path::new("test.txt")));
        assert!(!pattern.matches(Path::new("test.md.backup")));
    }

    #[test]
    fn test_pattern_matcher_directory_patterns() {
        let pattern = PatternMatcher::new("agents/*.md").unwrap();

        assert!(pattern.matches(Path::new("agents/test.md")));
        assert!(pattern.matches(Path::new("agents/helper.md")));
        assert!(!pattern.matches(Path::new("snippets/test.md")));
        // Note: glob patterns like "agents/*.md" will match nested paths in some implementations
        // For strict single-level matching, the pattern would need to be more specific
    }

    #[test]
    fn test_pattern_matcher_recursive_globstar() {
        let pattern = PatternMatcher::new("**/*.md").unwrap();

        assert!(pattern.matches(Path::new("test.md")));
        assert!(pattern.matches(Path::new("agents/test.md")));
        assert!(pattern.matches(Path::new("agents/subdir/test.md")));
        assert!(!pattern.matches(Path::new("test.txt")));
    }

    #[test]
    fn test_find_matches_in_directory_structure() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create test file structure
        fs::create_dir_all(base_path.join("agents")).unwrap();
        fs::create_dir_all(base_path.join("snippets")).unwrap();
        fs::create_dir_all(base_path.join("agents/subdir")).unwrap();

        fs::write(base_path.join("README.md"), "").unwrap();
        fs::write(base_path.join("agents/helper.md"), "").unwrap();
        fs::write(base_path.join("agents/assistant.md"), "").unwrap();
        fs::write(base_path.join("agents/subdir/nested.md"), "").unwrap();
        fs::write(base_path.join("snippets/code.md"), "").unwrap();
        fs::write(base_path.join("config.toml"), "").unwrap();

        // Test recursive pattern
        let pattern = PatternMatcher::new("**/*.md").unwrap();
        let matches = pattern.find_matches(base_path).unwrap();
        assert_eq!(matches.len(), 5); // All .md files in the tree

        // Test directory pattern - matches files in agents directory
        let pattern = PatternMatcher::new("agents/*.md").unwrap();
        let matches = pattern.find_matches(base_path).unwrap();
        // The glob pattern "agents/*.md" should match agents/helper.md, agents/assistant.md
        // and potentially agents/subdir/nested.md depending on glob implementation
        assert!(matches.len() >= 2);
        assert!(matches.contains(&PathBuf::from("agents/helper.md")));
        assert!(matches.contains(&PathBuf::from("agents/assistant.md")));

        // Test recursive pattern
        let pattern = PatternMatcher::new("**/*.md").unwrap();
        let matches = pattern.find_matches(base_path).unwrap();
        assert_eq!(matches.len(), 5);
        assert!(matches.contains(&PathBuf::from("README.md")));
        assert!(matches.contains(&PathBuf::from("agents/helper.md")));
        assert!(matches.contains(&PathBuf::from("agents/assistant.md")));
        assert!(matches.contains(&PathBuf::from("agents/subdir/nested.md")));
        assert!(matches.contains(&PathBuf::from("snippets/code.md")));
    }

    #[test]
    fn test_pattern_resolver_with_exclusion_filters() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create test files
        fs::create_dir_all(base_path.join("agents")).unwrap();
        fs::write(base_path.join("agents/helper.md"), "").unwrap();
        fs::write(base_path.join("agents/test.md"), "").unwrap();
        fs::write(base_path.join("agents/example.md"), "").unwrap();

        let mut resolver = PatternResolver::new();
        resolver.exclude("*/test.md").unwrap();
        resolver.exclude("*/example.md").unwrap();

        let matches = resolver.resolve("agents/*.md", base_path).unwrap();
        assert_eq!(matches.len(), 1);
        assert!(matches.contains(&PathBuf::from("agents/helper.md")));
    }

    #[test]
    fn test_resolve_multiple_patterns_with_deduplication() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create test files
        fs::create_dir_all(base_path.join("agents")).unwrap();
        fs::create_dir_all(base_path.join("snippets")).unwrap();
        fs::write(base_path.join("agents/helper.md"), "").unwrap();
        fs::write(base_path.join("snippets/code.md"), "").unwrap();
        fs::write(base_path.join("README.md"), "").unwrap();

        let resolver = PatternResolver::new();
        let patterns =
            vec!["agents/*.md".to_string(), "snippets/*.md".to_string(), "*.md".to_string()];

        let matches = resolver.resolve_multiple(&patterns, base_path).unwrap();
        assert_eq!(matches.len(), 3);
        assert!(matches.contains(&PathBuf::from("agents/helper.md")));
        assert!(matches.contains(&PathBuf::from("snippets/code.md")));
        assert!(matches.contains(&PathBuf::from("README.md")));
    }

    #[test]
    fn test_extract_resource_name_from_paths() {
        assert_eq!(extract_resource_name(Path::new("agents/helper.md")), "helper");
        assert_eq!(extract_resource_name(Path::new("test.md")), "test");
        assert_eq!(extract_resource_name(Path::new("path/to/resource.txt")), "resource");
        assert_eq!(extract_resource_name(Path::new("noextension")), "noextension");
    }

    #[test]
    fn test_validate_pattern_security_checks() -> Result<(), Box<dyn std::error::Error>> {
        // Valid patterns
        validate_pattern_safety("*.md")?;
        validate_pattern_safety("agents/*.md")?;
        validate_pattern_safety("**/*.md")?;

        // Invalid patterns - path traversal
        assert!(validate_pattern_safety("../parent/*.md").is_err());
        assert!(validate_pattern_safety("agents/../*.md").is_err());
        assert!(validate_pattern_safety("../../etc/passwd").is_err());

        // Invalid patterns - absolute paths
        if cfg!(unix) {
            assert!(validate_pattern_safety("/etc/*.conf").is_err());
            assert!(validate_pattern_safety("/home/user/*.md").is_err());
        }

        if cfg!(windows) {
            assert!(validate_pattern_safety("C:\\Windows\\*.dll").is_err());
            assert!(validate_pattern_safety("\\\\server\\share\\*.md").is_err());
        }
        Ok(())
    }

    #[test]
    fn test_pattern_with_alternatives() {
        let pattern = PatternMatcher::new("agents/{helper,assistant}.md").unwrap();

        // Note: glob crate doesn't support {a,b} syntax directly
        // This test documents current behavior
        assert!(!pattern.matches(Path::new("agents/helper.md")));
        assert!(!pattern.matches(Path::new("agents/assistant.md")));
        assert!(pattern.matches(Path::new("agents/{helper,assistant}.md")));
    }

    #[test]
    fn test_pattern_case_sensitivity() {
        let pattern = PatternMatcher::new("*.MD").unwrap();

        // Pattern matching is case-sensitive on Unix, case-insensitive on Windows
        if cfg!(unix) {
            assert!(!pattern.matches(Path::new("test.md")));
            assert!(pattern.matches(Path::new("test.MD")));
        }
    }

    #[test]
    fn test_complex_patterns() {
        // Test character class
        let pattern = PatternMatcher::new("agent[0-9].md").unwrap();
        assert!(pattern.matches(Path::new("agent1.md")));
        assert!(pattern.matches(Path::new("agent5.md")));
        assert!(!pattern.matches(Path::new("agenta.md")));
        assert!(!pattern.matches(Path::new("agent10.md")));

        // Test negation
        let pattern = PatternMatcher::new("!test*.md").unwrap();
        // Note: glob crate doesn't support negation directly
        assert!(pattern.matches(Path::new("!test*.md")));

        // Test question mark wildcard
        let pattern = PatternMatcher::new("agent?.md").unwrap();
        assert!(pattern.matches(Path::new("agent1.md")));
        assert!(pattern.matches(Path::new("agenta.md")));
        assert!(!pattern.matches(Path::new("agent10.md")));
        assert!(!pattern.matches(Path::new("agent.md")));
    }

    #[test]
    fn test_edge_cases() -> Result<(), Box<dyn std::error::Error>> {
        // Empty pattern
        PatternMatcher::new("")?;

        // Pattern with spaces
        let pattern = PatternMatcher::new("my agent.md").unwrap();
        assert!(pattern.matches(Path::new("my agent.md")));
        assert!(!pattern.matches(Path::new("myagent.md")));

        // Pattern with special characters
        let pattern = PatternMatcher::new("agent-v1.0.0.md").unwrap();
        assert!(pattern.matches(Path::new("agent-v1.0.0.md")));

        // Very long pattern
        let long_pattern = "a".repeat(1000) + "*.md";
        PatternMatcher::new(&long_pattern)?;
        Ok(())
    }

    #[test]
    fn test_find_matches_with_symlinks() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create files and a symlink
        fs::create_dir_all(base_path.join("real")).unwrap();
        fs::write(base_path.join("real/file.md"), "").unwrap();

        #[cfg(unix)]
        {
            use std::os::unix::fs::symlink;
            symlink(base_path.join("real"), base_path.join("link")).unwrap();

            let pattern = PatternMatcher::new("**/*.md").unwrap();
            let matches = pattern.find_matches(base_path).unwrap();

            // Should not follow symlinks (security measure)
            assert_eq!(matches.len(), 1);
            assert!(matches.contains(&PathBuf::from("real/file.md")));
        }

        #[cfg(not(unix))]
        {
            // On non-Unix systems, just verify basic functionality
            let pattern = PatternMatcher::new("**/*.md").unwrap();
            let matches = pattern.find_matches(base_path).unwrap();
            assert_eq!(matches.len(), 1);
            assert!(matches.contains(&PathBuf::from("real/file.md")));
        }
    }

    #[test]
    fn test_pattern_resolver_with_multiple_exclusions() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create test files
        fs::create_dir_all(base_path.join("agents")).unwrap();
        fs::write(base_path.join("agents/helper.md"), "").unwrap();
        fs::write(base_path.join("agents/test.md"), "").unwrap();
        fs::write(base_path.join("agents/debug.md"), "").unwrap();
        fs::write(base_path.join("agents/production.md"), "").unwrap();

        let mut resolver = PatternResolver::new();
        resolver.exclude("*/test.md").unwrap();
        resolver.exclude("*/debug.md").unwrap();

        let matches = resolver.resolve("agents/*.md", base_path).unwrap();
        assert_eq!(matches.len(), 2);
        assert!(matches.contains(&PathBuf::from("agents/helper.md")));
        assert!(matches.contains(&PathBuf::from("agents/production.md")));
    }

    #[test]
    fn test_concurrent_pattern_resolution() {
        use std::sync::Arc;
        use std::thread;

        let temp_dir = TempDir::new().unwrap();
        let base_path = Arc::new(temp_dir.path().to_path_buf());

        // Create test files
        for i in 0..100 {
            fs::write(base_path.join(format!("file{}.md", i)), "").unwrap();
        }

        // Run pattern matching concurrently
        let mut handles = vec![];
        for _ in 0..10 {
            let path = Arc::clone(&base_path);
            let handle = thread::spawn(move || {
                let pattern = PatternMatcher::new("*.md").unwrap();
                pattern.find_matches(&path).unwrap()
            });
            handles.push(handle);
        }

        // All threads should find the same files
        let results: Vec<_> = handles.into_iter().map(|h| h.join().unwrap()).collect();
        let first_result = &results[0];
        for result in &results[1..] {
            assert_eq!(result.len(), first_result.len());
        }
    }

    #[test]
    fn test_pattern_performance() {
        let temp_dir = TempDir::new().unwrap();
        let base_path = temp_dir.path();

        // Create a large directory structure
        for i in 0..10 {
            let dir = base_path.join(format!("dir{}", i));
            fs::create_dir_all(&dir).unwrap();
            for j in 0..100 {
                fs::write(dir.join(format!("file{}.md", j)), "").unwrap();
            }
        }

        let pattern = PatternMatcher::new("**/*.md").unwrap();
        let start = std::time::Instant::now();
        let matches = pattern.find_matches(base_path).unwrap();
        let duration = start.elapsed();

        assert_eq!(matches.len(), 1000);
        // Should complete reasonably quickly (< 1 second for 1000 files)
        assert!(duration.as_secs() < 1);
    }
}